feat: add VRRP unicast peer support for macvlan and restricted network environments

- Add unicast_src_ip and unicast_peers config fields
- NewUnicastSocket binds to source IP for proper packet reception
- SendTo() sends VRRP advertisements directly to peer IPs
- Receive loop filters packets from non-peer sources in unicast mode
- Backward compatible: multicast mode used when unicast_peers is empty
- Add unicast config example (etc/config.unicast.yaml)
- Update README with unicast documentation and examples

internal/vrrp/instance.go

@@ -21,6 +21,8 @@ type Instance struct {
 	AuthType        uint8
 	AuthPass        string
 	TrackScripts    []string
+	UnicastSrcIP    net.IP
+	UnicastPeers    []net.IP
 
 	state           *StateMachine
 	priorityCalc    *PriorityCalculator
@@ -54,6 +56,8 @@ func NewInstance(
 	authType string,
 	authPass string,
 	trackScripts []string,
+	unicastSrcIP string,
+	unicastPeers []string,
 	log *logger.Logger,
 ) (*Instance, error) {
 	if vrID < 1 || vrID > 255 {
@@ -90,6 +94,28 @@ func NewInstance(
 		return nil, fmt.Errorf("failed to get interface: %w", err)
 	}
 
+	var parsedSrcIP net.IP
+	var parsedPeers []net.IP
+
+	if len(unicastPeers) > 0 {
+		parsedPeers = make([]net.IP, 0, len(unicastPeers))
+		for _, peer := range unicastPeers {
+			ip := net.ParseIP(peer)
+			if ip == nil {
+				return nil, fmt.Errorf("invalid unicast peer IP: %s", peer)
+			}
+			parsedPeers = append(parsedPeers, ip.To4())
+		}
+
+		if unicastSrcIP != "" {
+			parsedSrcIP = net.ParseIP(unicastSrcIP)
+			if parsedSrcIP == nil {
+				return nil, fmt.Errorf("invalid unicast src IP: %s", unicastSrcIP)
+			}
+			parsedSrcIP = parsedSrcIP.To4()
+		}
+	}
+
 	inst := &Instance{
 		Name:            name,
 		VirtualRouterID: vrID,
@@ -101,6 +127,8 @@ func NewInstance(
 		AuthType:        authTypeNum,
 		AuthPass:        authPass,
 		TrackScripts:    trackScripts,
+		UnicastSrcIP:    parsedSrcIP,
+		UnicastPeers:    parsedPeers,
 		state:           NewStateMachine(StateInit),
 		priorityCalc:    NewPriorityCalculator(priority),
 		history:         NewStateHistory(100),
@@ -131,7 +159,15 @@ func (inst *Instance) Start() error {
 	inst.mu.Unlock()
 
 	var err error
-	inst.socket, err = NewSocket(inst.Interface)
+	if len(inst.UnicastPeers) > 0 {
+		if inst.UnicastSrcIP != nil {
+			inst.socket, err = NewUnicastSocket(inst.Interface, inst.UnicastSrcIP)
+		} else {
+			inst.socket, err = NewSocket(inst.Interface)
+		}
+	} else {
+		inst.socket, err = NewSocket(inst.Interface)
+	}
 	if err != nil {
 		return fmt.Errorf("failed to create socket: %w", err)
 	}
@@ -142,8 +178,13 @@ func (inst *Instance) Start() error {
 		return fmt.Errorf("failed to create ARP sender: %w", err)
 	}
 
-	inst.log.Info("[%s] starting VRRP instance (VRID=%d, Priority=%d, Interface=%s)",
-		inst.Name, inst.VirtualRouterID, inst.Priority, inst.Interface)
+	if len(inst.UnicastPeers) > 0 {
+		inst.log.Info("[%s] starting VRRP instance (VRID=%d, Priority=%d, Interface=%s, Mode=unicast, SrcIP=%s, Peers=%v)",
+			inst.Name, inst.VirtualRouterID, inst.Priority, inst.Interface, inst.socket.localIP, inst.UnicastPeers)
+	} else {
+		inst.log.Info("[%s] starting VRRP instance (VRID=%d, Priority=%d, Interface=%s, Mode=multicast)",
+			inst.Name, inst.VirtualRouterID, inst.Priority, inst.Interface)
+	}
 
 	inst.state.SetState(StateBackup)
 	inst.masterDownTimer.Start()
@@ -213,6 +254,13 @@ func (inst *Instance) receiveLoop() {
 			continue
 		}
 
+		if len(inst.UnicastPeers) > 0 {
+			if !inst.isUnicastPeer(srcIP) {
+				inst.log.Debug("[%s] ignoring packet from non-peer %s", inst.Name, srcIP)
+				continue
+			}
+		}
+
 		if err := pkt.Validate(inst.AuthPass); err != nil {
 			inst.log.Warn("[%s] packet validation failed: %v", inst.Name, err)
 			continue
@@ -222,6 +270,15 @@ func (inst *Instance) receiveLoop() {
 	}
 }
 
+func (inst *Instance) isUnicastPeer(ip net.IP) bool {
+	for _, peer := range inst.UnicastPeers {
+		if peer.Equal(ip) {
+			return true
+		}
+	}
+	return false
+}
+
 func (inst *Instance) handleAdvertisement(pkt *VRRPPacket, srcIP net.IP) {
 	currentState := inst.state.GetState()
 	localPriority := inst.priorityCalc.GetPriority()
@@ -272,12 +329,22 @@ func (inst *Instance) sendAdvertisement() error {
 		inst.AuthPass,
 	)
 
-	if err := inst.socket.Send(pkt); err != nil {
-		inst.log.Error("[%s] failed to send advertisement: %v", inst.Name, err)
-		return err
+	if len(inst.UnicastPeers) > 0 {
+		for _, peer := range inst.UnicastPeers {
+			if err := inst.socket.SendTo(pkt, peer); err != nil {
+				inst.log.Error("[%s] failed to send unicast advertisement to %s: %v", inst.Name, peer, err)
+				return err
+			}
+		}
+		inst.log.Debug("[%s] sent unicast advertisement (priority=%d, peers=%d)", inst.Name, priority, len(inst.UnicastPeers))
+	} else {
+		if err := inst.socket.Send(pkt); err != nil {
+			inst.log.Error("[%s] failed to send advertisement: %v", inst.Name, err)
+			return err
+		}
+		inst.log.Debug("[%s] sent multicast advertisement (priority=%d)", inst.Name, priority)
 	}
 
-	inst.log.Debug("[%s] sent advertisement (priority=%d)", inst.Name, priority)
 	return nil
 }
 

internal/vrrp/manager.go

@@ -36,6 +36,8 @@ func (m *Manager) LoadFromConfig(cfg *config.Config) error {
 			vrrpCfg.AuthType,
 			vrrpCfg.AuthPass,
 			vrrpCfg.TrackScripts,
+			vrrpCfg.UnicastSrcIP,
+			vrrpCfg.UnicastPeers,
 			m.log,
 		)
 		if err != nil {

internal/vrrp/socket.go

@@ -47,29 +47,11 @@ func NewSocket(ifaceName string) (*Socket, error) {
 		return nil, fmt.Errorf("no IPv4 address found on interface %s", ifaceName)
 	}
 
-	fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_RAW, VRRPProtocolNumber)
+	rawConn, packetConn, err := createRawConn()
 	if err != nil {
 		return nil, fmt.Errorf("failed to create raw socket: %w", err)
 	}
 
-	if err := syscall.SetsockoptInt(fd, syscall.SOL_SOCKET, syscall.SO_REUSEADDR, 1); err != nil {
-		syscall.Close(fd)
-		return nil, fmt.Errorf("failed to set SO_REUSEADDR: %w", err)
-	}
-
-	file := os.NewFile(uintptr(fd), "vrrp-socket")
-	packetConn, err := net.FilePacketConn(file)
-	file.Close()
-	if err != nil {
-		return nil, fmt.Errorf("failed to create packet connection: %w", err)
-	}
-
-	rawConn, err := ipv4.NewRawConn(packetConn)
-	if err != nil {
-		packetConn.Close()
-		return nil, fmt.Errorf("failed to create raw connection: %w", err)
-	}
-
 	groupIP := net.ParseIP(VRRPMulticastAddr).To4()
 	if groupIP == nil {
 		rawConn.Close()
@@ -95,6 +77,71 @@ func NewSocket(ifaceName string) (*Socket, error) {
 	}, nil
 }
 
+func NewUnicastSocket(ifaceName string, srcIP net.IP) (*Socket, error) {
+	iface, err := net.InterfaceByName(ifaceName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get interface %s: %w", ifaceName, err)
+	}
+
+	rawConn, packetConn, err := createRawConn()
+	if err != nil {
+		return nil, err
+	}
+
+	// Bind to the specific interface and source IP so we receive unicast VRRP packets
+	bindAddr := &syscall.SockaddrInet4{}
+	copy(bindAddr.Addr[:], srcIP.To4())
+	fd, _ := rawConn.SyscallConn()
+	var bindErr error
+	fd.Control(func(fd uintptr) {
+		bindErr = syscall.Bind(int(fd), bindAddr)
+	})
+	if bindErr != nil {
+		rawConn.Close()
+		return nil, fmt.Errorf("failed to bind to %s: %w", srcIP, bindErr)
+	}
+
+	if err := rawConn.SetControlMessage(ipv4.FlagTTL|ipv4.FlagSrc|ipv4.FlagDst|ipv4.FlagInterface, true); err != nil {
+		rawConn.Close()
+		return nil, fmt.Errorf("failed to set control message: %w", err)
+	}
+
+	return &Socket{
+		conn:       rawConn,
+		packetConn: packetConn,
+		iface:      iface,
+		localIP:    srcIP,
+		groupIP:    nil,
+	}, nil
+}
+
+func createRawConn() (*ipv4.RawConn, net.PacketConn, error) {
+	fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_RAW, VRRPProtocolNumber)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create raw socket: %w", err)
+	}
+
+	if err := syscall.SetsockoptInt(fd, syscall.SOL_SOCKET, syscall.SO_REUSEADDR, 1); err != nil {
+		syscall.Close(fd)
+		return nil, nil, fmt.Errorf("failed to set SO_REUSEADDR: %w", err)
+	}
+
+	file := os.NewFile(uintptr(fd), "vrrp-socket")
+	packetConn, err := net.FilePacketConn(file)
+	file.Close()
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create packet connection: %w", err)
+	}
+
+	rawConn, err := ipv4.NewRawConn(packetConn)
+	if err != nil {
+		packetConn.Close()
+		return nil, nil, fmt.Errorf("failed to create raw connection: %w", err)
+	}
+
+	return rawConn, packetConn, nil
+}
+
 func (s *Socket) Send(pkt *VRRPPacket) error {
 	data, err := pkt.Marshal()
 	if err != nil {
@@ -119,6 +166,30 @@ func (s *Socket) Send(pkt *VRRPPacket) error {
 	return nil
 }
 
+func (s *Socket) SendTo(pkt *VRRPPacket, dst net.IP) error {
+	data, err := pkt.Marshal()
+	if err != nil {
+		return fmt.Errorf("failed to marshal packet: %w", err)
+	}
+
+	header := &ipv4.Header{
+		Version:  ipv4.Version,
+		Len:      ipv4.HeaderLen,
+		TOS:      0xC0,
+		TotalLen: ipv4.HeaderLen + len(data),
+		TTL:      255,
+		Protocol: VRRPProtocolNumber,
+		Dst:      dst,
+		Src:      s.localIP,
+	}
+
+	if err := s.conn.WriteTo(header, data, nil); err != nil {
+		return fmt.Errorf("failed to send packet to %s: %w", dst, err)
+	}
+
+	return nil
+}
+
 func (s *Socket) Receive() (*VRRPPacket, net.IP, error) {
 	buf := make([]byte, 1500)
 
@@ -140,8 +211,10 @@ func (s *Socket) SetReadDeadline(t time.Time) error {
 }
 
 func (s *Socket) Close() error {
-	if err := s.conn.LeaveGroup(s.iface, &net.IPAddr{IP: s.groupIP}); err != nil {
-		return err
+	if s.groupIP != nil {
+		if err := s.conn.LeaveGroup(s.iface, &net.IPAddr{IP: s.groupIP}); err != nil {
+			return err
+		}
 	}
 	return s.conn.Close()
-}
+}