Merge branch 'master' into updates

doc/man/man5/keepalived.conf.5.in

@@ -72,7 +72,7 @@ There are three classes of scripts can be configured to be executed.
 (a) Notify scripts that are run when a vrrp instance or vrrp group
 changes state, or a virtual server quorum changes between up and down.
 
-(b) vrrp tracking scripts that will cause vrrp instances to go down it they exit
+(b) vrrp tracking scripts that will cause vrrp instances to go down if they exit
 a non-zero exist status, or if a weight is specified will add or subtract the
 weight to/from the priority of that vrrp instance.
 

keepalived/vrrp/vrrp_vmac.c

@@ -277,6 +277,7 @@ netlink_link_add_vmac(vrrp_t *vrrp, const interface_t *old_interface)
 	struct rtattr *linkinfo;
 	struct rtattr *data;
 	interface_t *ifp;
+	uint32_t group;
 	bool create_interface = true;
 	struct {
 		struct nlmsghdr n;
@@ -386,6 +387,14 @@ netlink_link_add_vmac(vrrp_t *vrrp, const interface_t *old_interface)
 			addattr32(&req.n, sizeof(req), IFLA_LINK, vrrp->configured_ifp->ifindex);
 			addattr_l(&req.n, sizeof(req), IFLA_IFNAME, vrrp->vmac_ifname, strlen(vrrp->vmac_ifname));
 		}
+
+		/*
+		 * Copy the group from the base interface to allow firewall rules
+		 * (iptables devgroup or nftables iifgroup, oifgroup) to continue
+		 * working regardless of the use_vmac setting.
+		 */
+		group = vrrp->configured_ifp->base_ifp->group;
+		addattr_l(&req.n, sizeof(req), IFLA_GROUP, &group, sizeof(group));
 		addattr_l(&req.n, sizeof(req), IFLA_ADDRESS, if_ll_addr, ETH_ALEN);
 
 #ifdef _HAVE_VRF_