[packages/keepalived] Up to 2.4.3 (fixes CVE-2018-19115, CVE-2021-44225)
arekm
arekm at pld-linux.org
Thu Oct 15 11:43:46 CEST 2026
commit 8a54b6f523045c9d999bd8d370884766e62c3c6a
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Thu Oct 15 11:42:23 2026 +0200
Up to 2.4.3 (fixes CVE-2018-19115, CVE-2021-44225)
keepalived-config.patch | 313 --------------------------------
keepalived-use-linux-libc-headers.patch | 69 -------
keepalived.spec | 116 ++++++++----
3 files changed, 80 insertions(+), 418 deletions(-)
---
diff --git a/keepalived.spec b/keepalived.spec
index 502f618..2aaad30 100644
--- a/keepalived.spec
+++ b/keepalived.spec
@@ -1,26 +1,40 @@
-# TODO: Check if --with-kernel-dir=/usr/src/linux/include/ fix is OK
-# ( https://dev.openwrt.org/ticket/12875 )
+#
+# Conditional build:
+%bcond_without dbus # D-Bus interface for VRRP instances
+%bcond_without snmp # SNMP subagent (keepalived, VRRP and checker MIBs)
+
Summary: HA monitor built upon LVS, VRRP and services poller
Summary(pl.UTF-8): Monitor HA zbudowany w oparciu o LVS, VRRP i narzędzie do sprawdzania usług
Name: keepalived
-Version: 1.2.15
-Release: 4
-License: GPL v2
+Version: 2.4.3
+Release: 1
+License: GPL v2+
Group: Applications/System
-Source0: http://www.keepalived.org/software/%{name}-%{version}.tar.gz
-# Source0-md5: d85fcb8e564ea03b0ca7b2357bf30c51
+Source0: https://www.keepalived.org/software/%{name}-%{version}.tar.gz
+# Source0-md5: 5a5c30d3275c380c8cf1a2df67ebbc3c
Source1: %{name}.init
Source2: %{name}.sysconfig
-Patch0: %{name}-config.patch
-URL: http://www.keepalived.org/
-BuildRequires: autoconf
-BuildRequires: automake
-#BuildRequires: kernel-source >= 2.6.0
-BuildRequires: openssl-devel >= 0.9.7d
-BuildRequires: popt-devel
-BuildRequires: rpmbuild(macros) >= 1.268
+URL: https://www.keepalived.org/
+BuildRequires: iptables-devel
+BuildRequires: ipset-devel
+# configure links libkmod and libmagic whenever they are found; there is no switch
+BuildRequires: kmod-devel
+BuildRequires: libmagic-devel
+BuildRequires: libmnl-devel
+BuildRequires: libnftnl-devel
+BuildRequires: libnl-devel >= 3
+BuildRequires: openssl-devel
+BuildRequires: pcre2-8-devel
+BuildRequires: pkgconfig
+BuildRequires: rpmbuild(macros) >= 1.644
+BuildRequires: systemd-devel
+%{?with_dbus:BuildRequires: glib2-devel}
+%{?with_snmp:BuildRequires: net-snmp-devel}
Requires(post,preun): /sbin/chkconfig
+Requires(post,preun,postun): systemd-units >= 38
Requires: rc-scripts
+Requires: systemd-units >= 38
+%{?with_snmp:Requires: net-snmp-mibs}
Suggests: genhash
BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
@@ -66,56 +80,86 @@ program, for monitoring HTTP and HTTPS services.
%prep
%setup -q
-%patch -P0 -p1
%build
-%{__aclocal}
-%{__autoconf}
%configure \
- STRIP=/bin/true \
- CFLAGS="%{rpmcflags} -D_WITH_LINKWATCH_" \
- --with-kernel-dir=/usr/src/linux/include
-# CFLAGS="%{rpmcflags} -include %{_includedir}/linux/errno.h -D_WITH_LINKWATCH_"
+ --enable-bfd \
+ %{?with_dbus:--enable-dbus} \
+ --enable-iptables \
+ --enable-json \
+ --enable-libipset \
+ --enable-libnl \
+ --enable-nftables \
+ --enable-regex \
+ %{?with_snmp:--enable-snmp --enable-snmp-rfc} \
+ --enable-systemd \
+ --with-init=systemd \
+ --with-systemdsystemunitdir=%{systemdunitdir}
+
%{__make}
%install
rm -rf $RPM_BUILD_ROOT
-install -d $RPM_BUILD_ROOT/etc/{rc.d/init.d,sysconfig}
+install -d $RPM_BUILD_ROOT/etc/rc.d/init.d
%{__make} install \
- STRIP=/bin/true \
DESTDIR=$RPM_BUILD_ROOT
-install %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/%{name}
-install %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/%{name}
+install -p %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/%{name}
+cp -p %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/%{name}
+
+# upstream ships only a sample; keep the installed config inert until edited
+%{__sed} -e 's/^/# /' $RPM_BUILD_ROOT%{_sysconfdir}/keepalived/keepalived.conf.sample \
+ > $RPM_BUILD_ROOT%{_sysconfdir}/keepalived/keepalived.conf
+%{__rm} $RPM_BUILD_ROOT%{_sysconfdir}/keepalived/keepalived.conf.sample
+%{__rm} -r $RPM_BUILD_ROOT%{_sysconfdir}/keepalived/samples
+%{__rm} -r $RPM_BUILD_ROOT%{_docdir}/%{name}
-# Cleanups:
-rm -rf $RPM_BUILD_ROOT/etc/keepalived/samples
-rm -f $RPM_BUILD_ROOT/etc/init.d/keepalived
+# PLD sysconfig and init script use KEEPALIVED_OPTS
+%{__sed} -i -e 's/\$KEEPALIVED_OPTIONS/$KEEPALIVED_OPTS/' $RPM_BUILD_ROOT%{systemdunitdir}/%{name}.service
%clean
rm -rf $RPM_BUILD_ROOT
%post
-/sbin/chkconfig --add keepalived
-%service keepalived restart
+/sbin/chkconfig --add %{name}
+%service %{name} restart
+%systemd_post %{name}.service
%preun
if [ "$1" = "0" ]; then
- %service keepalived stop
- /sbin/chkconfig --del keepalived
+ %service -q %{name} stop
+ /sbin/chkconfig --del %{name}
fi
+%systemd_preun %{name}.service
+
+%postun
+%systemd_reload
+
+%triggerpostun -- %{name} < 2.4.3-1
+%systemd_trigger %{name}.service
%files
%defattr(644,root,root,755)
-%doc AUTHOR ChangeLog CONTRIBUTORS README TODO doc/samples doc/keepalived*
+%doc AUTHOR ChangeLog CONTRIBUTORS README.md TODO doc/NOTE_vrrp_vmac.txt doc/keepalived.conf.SYNOPSIS doc/samples
+%dir %{_sysconfdir}/keepalived
%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/keepalived/keepalived.conf
%config(noreplace) %verify(not md5 mtime size) /etc/sysconfig/%{name}
-%attr(755,root,root) %{_sbindir}/keepalived
%attr(754,root,root) /etc/rc.d/init.d/%{name}
-%dir %{_sysconfdir}/keepalived
+%{systemdunitdir}/%{name}.service
+%attr(755,root,root) %{_sbindir}/keepalived
%{_mandir}/man5/keepalived.conf.5*
%{_mandir}/man8/keepalived.8*
+%if %{with dbus}
+%config(noreplace) %verify(not md5 mtime size) /etc/dbus-1/system.d/org.keepalived.Vrrp1.conf
+%{_datadir}/dbus-1/interfaces/org.keepalived.Vrrp1.Instance.xml
+%{_datadir}/dbus-1/interfaces/org.keepalived.Vrrp1.Vrrp.xml
+%endif
+%if %{with snmp}
+%{_datadir}/snmp/mibs/KEEPALIVED-MIB.txt
+%{_datadir}/snmp/mibs/VRRP-MIB.txt
+%{_datadir}/snmp/mibs/VRRPv3-MIB.txt
+%endif
%files genhash
%defattr(644,root,root,755)
diff --git a/keepalived-config.patch b/keepalived-config.patch
deleted file mode 100644
index 26f5d87..0000000
--- a/keepalived-config.patch
+++ /dev/null
@@ -1,313 +0,0 @@
---- keepalived-1.1.19.a/keepalived/etc/keepalived/keepalived.conf 2009-09-28 12:56:54.000000000 +0200
-+++ keepalived-1.1.19.b/keepalived/etc/keepalived/keepalived.conf 2009-10-18 22:03:28.000000000 +0200
-@@ -1,155 +1,155 @@
--! Configuration File for keepalived
--
--global_defs {
-- notification_email {
-- acassen at firewall.loc
-- failover at firewall.loc
-- sysadmin at firewall.loc
-- }
-- notification_email_from Alexandre.Cassen at firewall.loc
-- smtp_server 192.168.200.1
-- smtp_connect_timeout 30
-- router_id LVS_DEVEL
--}
--
--vrrp_instance VI_1 {
-- state MASTER
-- interface eth0
-- virtual_router_id 51
-- priority 100
-- advert_int 1
-- authentication {
-- auth_type PASS
-- auth_pass 1111
-- }
-- virtual_ipaddress {
-- 192.168.200.16
-- 192.168.200.17
-- 192.168.200.18
-- }
--}
--
--virtual_server 192.168.200.100 443 {
-- delay_loop 6
-- lb_algo rr
-- lb_kind NAT
-- nat_mask 255.255.255.0
-- persistence_timeout 50
-- protocol TCP
--
-- real_server 192.168.201.100 443 {
-- weight 1
-- SSL_GET {
-- url {
-- path /
-- digest ff20ad2481f97b1754ef3e12ecd3a9cc
-- }
-- url {
-- path /mrtg/
-- digest 9b3a0c85a887a256d6939da88aabd8cd
-- }
-- connect_timeout 3
-- nb_get_retry 3
-- delay_before_retry 3
-- }
-- }
--}
--
--virtual_server 10.10.10.2 1358 {
-- delay_loop 6
-- lb_algo rr
-- lb_kind NAT
-- persistence_timeout 50
-- protocol TCP
--
-- sorry_server 192.168.200.200 1358
--
-- real_server 192.168.200.2 1358 {
-- weight 1
-- HTTP_GET {
-- url {
-- path /testurl/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334d
-- }
-- url {
-- path /testurl2/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334d
-- }
-- url {
-- path /testurl3/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334d
-- }
-- connect_timeout 3
-- nb_get_retry 3
-- delay_before_retry 3
-- }
-- }
--
-- real_server 192.168.200.3 1358 {
-- weight 1
-- HTTP_GET {
-- url {
-- path /testurl/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334c
-- }
-- url {
-- path /testurl2/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334c
-- }
-- connect_timeout 3
-- nb_get_retry 3
-- delay_before_retry 3
-- }
-- }
--}
--
--virtual_server 10.10.10.3 1358 {
-- delay_loop 3
-- lb_algo rr
-- lb_kind NAT
-- nat_mask 255.255.255.0
-- persistence_timeout 50
-- protocol TCP
--
-- real_server 192.168.200.4 1358 {
-- weight 1
-- HTTP_GET {
-- url {
-- path /testurl/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334d
-- }
-- url {
-- path /testurl2/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334d
-- }
-- url {
-- path /testurl3/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334d
-- }
-- connect_timeout 3
-- nb_get_retry 3
-- delay_before_retry 3
-- }
-- }
--
-- real_server 192.168.200.5 1358 {
-- weight 1
-- HTTP_GET {
-- url {
-- path /testurl/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334d
-- }
-- url {
-- path /testurl2/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334d
-- }
-- url {
-- path /testurl3/test.jsp
-- digest 640205b7b0fc66c1ea91c463fac6334d
-- }
-- connect_timeout 3
-- nb_get_retry 3
-- delay_before_retry 3
-- }
-- }
--}
-+# ! Configuration File for keepalived
-+#
-+# global_defs {
-+# notification_email {
-+# acassen at firewall.loc
-+# failover at firewall.loc
-+# sysadmin at firewall.loc
-+# }
-+# notification_email_from Alexandre.Cassen at firewall.loc
-+# smtp_server 192.168.200.1
-+# smtp_connect_timeout 30
-+# router_id LVS_DEVEL
-+# }
-+#
-+# vrrp_instance VI_1 {
-+# state MASTER
-+# interface eth0
-+# virtual_router_id 51
-+# priority 100
-+# advert_int 1
-+# authentication {
-+# auth_type PASS
-+# auth_pass 1111
-+# }
-+# virtual_ipaddress {
-+# 192.168.200.16
-+# 192.168.200.17
-+# 192.168.200.18
-+# }
-+# }
-+#
-+# virtual_server 192.168.200.100 443 {
-+# delay_loop 6
-+# lb_algo rr
-+# lb_kind NAT
-+# nat_mask 255.255.255.0
-+# persistence_timeout 50
-+# protocol TCP
-+#
-+# real_server 192.168.201.100 443 {
-+# weight 1
-+# SSL_GET {
-+# url {
-+# path /
-+# digest ff20ad2481f97b1754ef3e12ecd3a9cc
-+# }
-+# url {
-+# path /mrtg/
-+# digest 9b3a0c85a887a256d6939da88aabd8cd
-+# }
-+# connect_timeout 3
-+# nb_get_retry 3
-+# delay_before_retry 3
-+# }
-+# }
-+# }
-+#
-+# virtual_server 10.10.10.2 1358 {
-+# delay_loop 6
-+# lb_algo rr
-+# lb_kind NAT
-+# persistence_timeout 50
-+# protocol TCP
-+#
-+# sorry_server 192.168.200.200 1358
-+#
-+# real_server 192.168.200.2 1358 {
-+# weight 1
-+# HTTP_GET {
-+# url {
-+# path /testurl/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334d
-+# }
-+# url {
-+# path /testurl2/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334d
-+# }
-+# url {
-+# path /testurl3/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334d
-+# }
-+# connect_timeout 3
-+# nb_get_retry 3
-+# delay_before_retry 3
-+# }
-+# }
-+#
-+# real_server 192.168.200.3 1358 {
-+# weight 1
-+# HTTP_GET {
-+# url {
-+# path /testurl/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334c
-+# }
-+# url {
-+# path /testurl2/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334c
-+# }
-+# connect_timeout 3
-+# nb_get_retry 3
-+# delay_before_retry 3
-+# }
-+# }
-+# }
-+#
-+# virtual_server 10.10.10.3 1358 {
-+# delay_loop 3
-+# lb_algo rr
-+# lb_kind NAT
-+# nat_mask 255.255.255.0
-+# persistence_timeout 50
-+# protocol TCP
-+#
-+# real_server 192.168.200.4 1358 {
-+# weight 1
-+# HTTP_GET {
-+# url {
-+# path /testurl/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334d
-+# }
-+# url {
-+# path /testurl2/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334d
-+# }
-+# url {
-+# path /testurl3/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334d
-+# }
-+# connect_timeout 3
-+# nb_get_retry 3
-+# delay_before_retry 3
-+# }
-+# }
-+#
-+# real_server 192.168.200.5 1358 {
-+# weight 1
-+# HTTP_GET {
-+# url {
-+# path /testurl/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334d
-+# }
-+# url {
-+# path /testurl2/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334d
-+# }
-+# url {
-+# path /testurl3/test.jsp
-+# digest 640205b7b0fc66c1ea91c463fac6334d
-+# }
-+# connect_timeout 3
-+# nb_get_retry 3
-+# delay_before_retry 3
-+# }
-+# }
-+# }
diff --git a/keepalived-use-linux-libc-headers.patch b/keepalived-use-linux-libc-headers.patch
deleted file mode 100644
index 50bab36..0000000
--- a/keepalived-use-linux-libc-headers.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-diff -NurpP --minimal keepalived-1.1.19.a/configure.in keepalived-1.1.19.b/configure.in
---- keepalived-1.1.19.a/configure.in 2009-09-28 12:56:54.000000000 +0200
-+++ keepalived-1.1.19.b/configure.in 2009-10-18 23:00:33.000000000 +0200
-@@ -51,7 +51,7 @@ AC_CHECK_LIB(ssl, SSL_CTX_new,,AC_MSG_ER
- AC_CHECK_LIB(popt, poptGetContext,,AC_MSG_ERROR([Popt libraries is required]))
-
- dnl ----[ Kernel version check ]----
--CPPFLAGS="$CPPFLAGS -I$kernelinc"
-+dnl CPPFLAGS="$CPPFLAGS -I$kernelinc"
- AC_MSG_CHECKING([for kernel version])
- AC_TRY_RUN([
- #include <stdlib.h>
-@@ -116,7 +116,7 @@ AC_SUBST(KERN)
- dnl ----[ Checks for LVS and VRRP support ]----
- IPVS_SUPPORT="_WITHOUT_LVS_"
- if test "$enable_lvs" != "no"; then
-- AC_CHECK_HEADER([net/ip_vs.h],
-+ AC_CHECK_HEADER([linux/ip_vs.h],
- [IPVS_SUPPORT="_WITH_LVS_"],
- [
- IPVS_SUPPORT="_WITHOUT_LVS_"
-diff -NurpP --minimal keepalived-1.1.19.a/keepalived/include/check_data.h keepalived-1.1.19.b/keepalived/include/check_data.h
---- keepalived-1.1.19.a/keepalived/include/check_data.h 2009-09-28 13:31:07.000000000 +0200
-+++ keepalived-1.1.19.b/keepalived/include/check_data.h 2009-10-18 23:04:13.000000000 +0200
-@@ -39,7 +39,7 @@
- #else
- #define SCHED_MAX_LENGTH IP_VS_SCHEDNAME_MAXLEN
- #endif
--#include <net/ip_vs.h>
-+#include <linux/ip_vs.h>
- #else
- #define SCHED_MAX_LENGTH 1
- #endif
-diff -NurpP --minimal keepalived-1.1.19.a/keepalived/include/ipvswrapper.h keepalived-1.1.19.b/keepalived/include/ipvswrapper.h
---- keepalived-1.1.19.a/keepalived/include/ipvswrapper.h 2009-09-28 13:05:16.000000000 +0200
-+++ keepalived-1.1.19.b/keepalived/include/ipvswrapper.h 2009-10-18 23:03:04.000000000 +0200
-@@ -46,7 +46,7 @@
- #elif _KRNL_2_6_
- #include "../libipvs-2.6/libipvs.h"
- #endif
-- #include <net/ip_vs.h>
-+ #include <linux/ip_vs.h>
- #endif
-
- #ifndef IP_VS_TEMPLATE_TIMEOUT
-diff -NurpP --minimal keepalived-1.1.19.a/keepalived/libipvs-2.4/libipvs.h keepalived-1.1.19.b/keepalived/libipvs-2.4/libipvs.h
---- keepalived-1.1.19.a/keepalived/libipvs-2.4/libipvs.h 2009-09-28 12:56:54.000000000 +0200
-+++ keepalived-1.1.19.b/keepalived/libipvs-2.4/libipvs.h 2009-10-18 23:05:54.000000000 +0200
-@@ -10,7 +10,7 @@
- #ifndef _LIBIPVS_H
- #define _LIBIPVS_H
-
--#include <net/ip_vs.h>
-+#include <linux/ip_vs.h>
-
- /*
- * The default IPVS_SVC_PERSISTENT_TIMEOUT is a little larger than average
-diff -NurpP --minimal keepalived-1.1.19.a/keepalived/libipvs-2.6/libipvs.h keepalived-1.1.19.b/keepalived/libipvs-2.6/libipvs.h
---- keepalived-1.1.19.a/keepalived/libipvs-2.6/libipvs.h 2009-09-28 12:56:54.000000000 +0200
-+++ keepalived-1.1.19.b/keepalived/libipvs-2.6/libipvs.h 2009-10-18 23:05:04.000000000 +0200
-@@ -10,7 +10,7 @@
- #ifndef _LIBIPVS_H
- #define _LIBIPVS_H
-
--#include <net/ip_vs.h>
-+#include <linux/ip_vs.h>
-
- #define MINIMUM_IPVS_VERSION_MAJOR 1
- #define MINIMUM_IPVS_VERSION_MINOR 1
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/keepalived.git/commitdiff/8a54b6f523045c9d999bd8d370884766e62c3c6a
More information about the pld-cvs-commit
mailing list