From 2cadaefb71ec91d6b62e704d7d22aac904a35d09 Mon Sep 17 00:00:00 2001 From: Justinas Stankevicius Date: Sat, 1 Nov 2025 13:38:08 +0200 Subject: [PATCH] nixos/keepalived: support nftables for openFirewall --- .../networking/keepalived/default.nix | 32 ++++-- nixos/tests/all-tests.nix | 2 +- nixos/tests/keepalived.nix | 104 ++++++++++-------- pkgs/by-name/ke/keepalived/package.nix | 2 +- 4 files changed, 81 insertions(+), 59 deletions(-) diff --git a/nixos/modules/services/networking/keepalived/default.nix b/nixos/modules/services/networking/keepalived/default.nix index 61f9d0b5afd9..6c4a44ca6c72 100644 --- a/nixos/modules/services/networking/keepalived/default.nix +++ b/nixos/modules/services/networking/keepalived/default.nix @@ -325,18 +325,28 @@ in assertions = flatten (map vrrpInstanceAssertions vrrpInstances); - networking.firewall = lib.mkIf cfg.openFirewall { - extraCommands = '' - # Allow VRRP and AH packets - ip46tables -A nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT - ip46tables -A nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT - ''; + networking.firewall = lib.mkIf cfg.openFirewall ( + if config.networking.nftables.enable then + { + extraInputRules = '' + meta l4proto vrrp counter accept comment "services.keepalived.openFirewall" + meta l4proto ah counter accept comment "services.keepalived.openFirewall" + ''; + } + else + { + extraCommands = '' + # Allow VRRP and AH packets + ip46tables -A nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT + ip46tables -A nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT + ''; - extraStopCommands = '' - ip46tables -D nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT - ip46tables -D nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT - ''; - }; + extraStopCommands = '' + ip46tables -D nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT + ip46tables -D nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT + ''; + } + ); systemd.timers.keepalived-boot-delay = { description = "Keepalive Daemon delay to avoid instant transition to MASTER state"; diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index bcb00f3b067f..69ad4ca89b6a 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -793,7 +793,7 @@ in kbd-setfont-decompress = runTest ./kbd-setfont-decompress.nix; kbd-update-search-paths-patch = runTest ./kbd-update-search-paths-patch.nix; kea = runTest ./kea.nix; - keepalived = runTest ./keepalived.nix; + keepalived = discoverTests (import ./keepalived.nix); keepassxc = runTest ./keepassxc.nix; kerberos = handleTest ./kerberos/default.nix { }; kernel-generic = handleTest ./kernel-generic { }; diff --git a/nixos/tests/keepalived.nix b/nixos/tests/keepalived.nix index d5ffa6e9838d..2bc512446693 100644 --- a/nixos/tests/keepalived.nix +++ b/nixos/tests/keepalived.nix @@ -1,48 +1,60 @@ -{ pkgs, lib, ... }: +let + mkTest = + { useNftables }: + import ./make-test-python.nix ( + { pkgs, lib, ... }: + { + name = "keepalived-${if useNftables then "nftables" else "iptables"}"; + meta.maintainers = [ lib.maintainers.raitobezarius ]; + + nodes = { + node1 = + { pkgs, ... }: + { + networking.nftables.enable = useNftables; + services.keepalived.enable = true; + services.keepalived.openFirewall = true; + services.keepalived.vrrpInstances.test = { + interface = "eth1"; + state = "MASTER"; + priority = 50; + virtualIps = [ { addr = "192.168.1.200"; } ]; + virtualRouterId = 1; + }; + environment.systemPackages = [ pkgs.tcpdump ]; + }; + node2 = + { pkgs, ... }: + { + networking.nftables.enable = useNftables; + services.keepalived.enable = true; + services.keepalived.openFirewall = true; + services.keepalived.vrrpInstances.test = { + interface = "eth1"; + state = "MASTER"; + priority = 100; + virtualIps = [ { addr = "192.168.1.200"; } ]; + virtualRouterId = 1; + }; + environment.systemPackages = [ pkgs.tcpdump ]; + }; + }; + + testScript = '' + # wait for boot time delay to pass + for node in [node1, node2]: + node.wait_until_succeeds( + "systemctl show -p LastTriggerUSecMonotonic keepalived-boot-delay.timer | grep -vq 'LastTriggerUSecMonotonic=0'" + ) + node.wait_for_unit("keepalived") + node2.wait_until_succeeds("ip addr show dev eth1 | grep -q 192.168.1.200") + node1.fail("ip addr show dev eth1 | grep -q 192.168.1.200") + node1.succeed("ping -c1 192.168.1.200") + ''; + } + ); +in { - name = "keepalived"; - meta.maintainers = [ lib.maintainers.raitobezarius ]; - - nodes = { - node1 = - { pkgs, ... }: - { - services.keepalived.enable = true; - services.keepalived.openFirewall = true; - services.keepalived.vrrpInstances.test = { - interface = "eth1"; - state = "MASTER"; - priority = 50; - virtualIps = [ { addr = "192.168.1.200"; } ]; - virtualRouterId = 1; - }; - environment.systemPackages = [ pkgs.tcpdump ]; - }; - node2 = - { pkgs, ... }: - { - services.keepalived.enable = true; - services.keepalived.openFirewall = true; - services.keepalived.vrrpInstances.test = { - interface = "eth1"; - state = "MASTER"; - priority = 100; - virtualIps = [ { addr = "192.168.1.200"; } ]; - virtualRouterId = 1; - }; - environment.systemPackages = [ pkgs.tcpdump ]; - }; - }; - - testScript = '' - # wait for boot time delay to pass - for node in [node1, node2]: - node.wait_until_succeeds( - "systemctl show -p LastTriggerUSecMonotonic keepalived-boot-delay.timer | grep -vq 'LastTriggerUSecMonotonic=0'" - ) - node.wait_for_unit("keepalived") - node2.wait_until_succeeds("ip addr show dev eth1 | grep -q 192.168.1.200") - node1.fail("ip addr show dev eth1 | grep -q 192.168.1.200") - node1.succeed("ping -c1 192.168.1.200") - ''; + nftables = mkTest { useNftables = true; }; + iptables = mkTest { useNftables = false; }; } diff --git a/pkgs/by-name/ke/keepalived/package.nix b/pkgs/by-name/ke/keepalived/package.nix index fed5d5ae8395..14071b8517d0 100644 --- a/pkgs/by-name/ke/keepalived/package.nix +++ b/pkgs/by-name/ke/keepalived/package.nix @@ -38,7 +38,7 @@ stdenv.mkDerivation rec { enableParallelBuilding = true; - passthru.tests.keepalived = nixosTests.keepalived; + passthru.tests = nixosTests.keepalived; nativeBuildInputs = [ pkg-config