From b49f49576ef9d801a48ce7a01a78c72e65be7880 Mon Sep 17 00:00:00 2001

From: Klaus Wenninger <klaus.wenninger@aon.at>

Date: Fri, 30 Jul 2021 18:07:25 +0200

Subject: [PATCH 1/3] Fix, Refactor: fenced: add return value to

 get_agent_metadata

Used to distinguish between empty metadata per design,

case of failed getting metadata that might succeed on a

retry and fatal failure.

Fixes as well regression that leads to endless retries getting

metadata for #watchdog - not superserious as it happens with

delays in between but still undesirable.

---

 daemons/fenced/fenced_commands.c | 92 +++++++++++++++++++-------------

 1 file changed, 55 insertions(+), 37 deletions(-)

diff --git a/daemons/fenced/fenced_commands.c b/daemons/fenced/fenced_commands.c

index a778801b1..cd9968f1a 100644

--- a/daemons/fenced/fenced_commands.c

+++ b/daemons/fenced/fenced_commands.c

@@ -69,7 +69,7 @@ static void stonith_send_reply(xmlNode * reply, int call_options, const char *re

 static void search_devices_record_result(struct device_search_s *search, const char *device,

                                          gboolean can_fence);

-static xmlNode * get_agent_metadata(const char *agent);

+static int get_agent_metadata(const char *agent, xmlNode **metadata);

 static void read_action_metadata(stonith_device_t *device);

 typedef struct async_command_s {

@@ -323,19 +323,26 @@ fork_cb(GPid pid, gpointer user_data)

 static int

 get_agent_metadata_cb(gpointer data) {

     stonith_device_t *device = data;

+    guint period_ms;

-    device->agent_metadata = get_agent_metadata(device->agent);

-    if (device->agent_metadata) {

-        read_action_metadata(device);

-        stonith__device_parameter_flags(&(device->flags), device->id,

+    switch (get_agent_metadata(device->agent, &device->agent_metadata)) {

+        case pcmk_rc_ok:

+            if (device->agent_metadata) {

+                read_action_metadata(device);

+                stonith__device_parameter_flags(&(device->flags), device->id,

                                         device->agent_metadata);

-        return G_SOURCE_REMOVE;

-    } else {

-        guint period_ms = pcmk__mainloop_timer_get_period(device->timer);

-        if (period_ms < 160 * 1000) {

-            mainloop_timer_set_period(device->timer, 2 * period_ms);

-        }

-        return G_SOURCE_CONTINUE;

+            }

+            return G_SOURCE_REMOVE;

+

+        case EAGAIN:

+            period_ms = pcmk__mainloop_timer_get_period(device->timer);

+            if (period_ms < 160 * 1000) {

+                mainloop_timer_set_period(device->timer, 2 * period_ms);

+            }

+            return G_SOURCE_CONTINUE;

+

+        default:

+            return G_SOURCE_REMOVE;

     }

 }

@@ -700,38 +707,41 @@ init_metadata_cache(void) {

     }

 }

-static xmlNode *

-get_agent_metadata(const char *agent)

+int

+get_agent_metadata(const char *agent, xmlNode ** metadata)

 {

-    xmlNode *xml = NULL;

     char *buffer = NULL;

+    if (metadata == NULL) {

+        return EINVAL;

+    }

+    *metadata = NULL;

+    if (pcmk__str_eq(agent, STONITH_WATCHDOG_AGENT, pcmk__str_none)) {

+        return pcmk_rc_ok;

+    }

     init_metadata_cache();

     buffer = g_hash_table_lookup(metadata_cache, agent);

-    if(pcmk__str_eq(agent, STONITH_WATCHDOG_AGENT, pcmk__str_casei)) {

-        return NULL;

-

-    } else if(buffer == NULL) {

+    if (buffer == NULL) {

         stonith_t *st = stonith_api_new();

         int rc;

         if (st == NULL) {

             crm_warn("Could not get agent meta-data: "

                      "API memory allocation failed");

-            return NULL;

+            return EAGAIN;

         }

-        rc = st->cmds->metadata(st, st_opt_sync_call, agent, NULL, &buffer, 10);

+        rc = st->cmds->metadata(st, st_opt_sync_call, agent,

+                                NULL, &buffer, 10);

         stonith_api_delete(st);

         if (rc || !buffer) {

             crm_err("Could not retrieve metadata for fencing agent %s", agent);

-            return NULL;

+            return EAGAIN;

         }

         g_hash_table_replace(metadata_cache, strdup(agent), buffer);

     }

-    xml = string2xml(buffer);

-

-    return xml;

+    *metadata = string2xml(buffer);

+    return pcmk_rc_ok;

 }

 static gboolean

@@ -962,19 +972,27 @@ build_device_from_xml(xmlNode * msg)

         g_list_free_full(device->targets, free);

         device->targets = NULL;

     }

-    device->agent_metadata = get_agent_metadata(device->agent);

-    if (device->agent_metadata) {

-        read_action_metadata(device);

-        stonith__device_parameter_flags(&(device->flags), device->id,

-                                        device->agent_metadata);

-    } else {

-        if (device->timer == NULL) {

-            device->timer = mainloop_timer_add("get_agent_metadata", 10 * 1000,

+    switch (get_agent_metadata(device->agent, &device->agent_metadata)) {

+        case pcmk_rc_ok:

+            if (device->agent_metadata) {

+                read_action_metadata(device);

+                stonith__device_parameter_flags(&(device->flags), device->id,

+                                                device->agent_metadata);

+            }

+            break;

+

+        case EAGAIN:

+            if (device->timer == NULL) {

+                device->timer = mainloop_timer_add("get_agent_metadata", 10 * 1000,

                                            TRUE, get_agent_metadata_cb, device);

-        }

-        if (!mainloop_timer_running(device->timer)) {

-            mainloop_timer_start(device->timer);

-        }

+            }

+            if (!mainloop_timer_running(device->timer)) {

+                mainloop_timer_start(device->timer);

+            }

+            break;

+

+        default:

+            break;

     }

     value = g_hash_table_lookup(device->params, "nodeid");

-- 

2.27.0

From 5dd1e4459335764e0adf5fa78d81c875ae2332e9 Mon Sep 17 00:00:00 2001

From: Klaus Wenninger <klaus.wenninger@aon.at>

Date: Fri, 30 Jul 2021 18:15:10 +0200

Subject: [PATCH 2/3] feature: watchdog-fencing: allow restriction to certain

 nodes

Bump CRM_FEATURE_SET to 3.11.0 to encourage cluster being

fully upgraded to a version that supports the feature

before explicitly adding a watchdog-fence-device.

---

 configure.ac                        |   1 +

 daemons/controld/controld_control.c |   2 +-

 daemons/controld/controld_fencing.c |  14 ++

 daemons/controld/controld_fencing.h |   1 +

 daemons/fenced/Makefile.am          |   2 +-

 daemons/fenced/fence_watchdog.in    | 283 ++++++++++++++++++++++++++++

 daemons/fenced/fenced_commands.c    | 141 +++++++++++---

 daemons/fenced/fenced_remote.c      |  71 ++++---

 daemons/fenced/pacemaker-fenced.c   | 131 +++++++++----

 daemons/fenced/pacemaker-fenced.h   |   5 +-

 include/crm/crm.h                   |   2 +-

 include/crm/fencing/internal.h      |   8 +-

 lib/fencing/st_client.c             |  61 ++++++

 lib/lrmd/lrmd_client.c              |   6 +-

 rpm/pacemaker.spec.in               |   3 +

 16 files changed, 635 insertions(+), 97 deletions(-)

 create mode 100755 daemons/fenced/fence_watchdog.in

diff --git a/configure.ac b/configure.ac

index 436100c81..013562e46 100644

--- a/configure.ac

+++ b/configure.ac

@@ -1972,6 +1972,7 @@ CONFIG_FILES_EXEC([cts/cts-cli],

                   [cts/support/fence_dummy],

                   [cts/support/pacemaker-cts-dummyd],

                   [daemons/fenced/fence_legacy],

+                  [daemons/fenced/fence_watchdog],

                   [doc/abi-check],

                   [extra/resources/ClusterMon],

                   [extra/resources/HealthSMART],

diff --git a/daemons/controld/controld_control.c b/daemons/controld/controld_control.c

index 45a70bb92..b5da6a46c 100644

--- a/daemons/controld/controld_control.c

+++ b/daemons/controld/controld_control.c

@@ -615,7 +615,7 @@ static pcmk__cluster_option_t crmd_opts[] = {

     },

     {

         "stonith-watchdog-timeout", NULL, "time", NULL,

-        "0", pcmk__valid_sbd_timeout,

+        "0", controld_verify_stonith_watchdog_timeout,

         "How long to wait before we can assume nodes are safely down "

             "when watchdog-based self-fencing via SBD is in use",

         "If nonzero, along with `have-watchdog=true` automatically set by the "

diff --git a/daemons/controld/controld_fencing.c b/daemons/controld/controld_fencing.c

index 0fba6613b..6c2a6c550 100644

--- a/daemons/controld/controld_fencing.c

+++ b/daemons/controld/controld_fencing.c

@@ -11,6 +11,7 @@

 #include <crm/crm.h>

 #include <crm/msg_xml.h>

 #include <crm/common/xml.h>

+#include <crm/stonith-ng.h>

 #include <crm/fencing/internal.h>

 #include <pacemaker-controld.h>

@@ -886,6 +887,19 @@ te_fence_node(crm_graph_t *graph, crm_action_t *action)

     return TRUE;

 }

+bool

+controld_verify_stonith_watchdog_timeout(const char *value)

+{

+    gboolean rv = TRUE;

+

+    if (stonith_api && (stonith_api->state != stonith_disconnected) &&

+        stonith__watchdog_fencing_enabled_for_node_api(stonith_api,

+                                                       fsa_our_uname)) {

+        rv = pcmk__valid_sbd_timeout(value);

+    }

+    return rv;

+}

+

 /* end stonith API client functions */

diff --git a/daemons/controld/controld_fencing.h b/daemons/controld/controld_fencing.h

index d0ecc8234..ef68a0c83 100644

--- a/daemons/controld/controld_fencing.h

+++ b/daemons/controld/controld_fencing.h

@@ -24,6 +24,7 @@ void update_stonith_max_attempts(const char* value);

 void controld_trigger_fencer_connect(void);

 void controld_disconnect_fencer(bool destroy);

 gboolean te_fence_node(crm_graph_t *graph, crm_action_t *action);

+bool controld_verify_stonith_watchdog_timeout(const char *value);

 // stonith cleanup list

 void add_stonith_cleanup(const char *target);

diff --git a/daemons/fenced/Makefile.am b/daemons/fenced/Makefile.am

index 43413e11d..2923d7c9b 100644

--- a/daemons/fenced/Makefile.am

+++ b/daemons/fenced/Makefile.am

@@ -15,7 +15,7 @@ halibdir	= $(CRM_DAEMON_DIR)

 halib_PROGRAMS	= pacemaker-fenced cts-fence-helper

-sbin_SCRIPTS	= fence_legacy

+sbin_SCRIPTS	= fence_legacy fence_watchdog

 noinst_HEADERS	= pacemaker-fenced.h

diff --git a/daemons/fenced/fence_watchdog.in b/daemons/fenced/fence_watchdog.in

new file mode 100755

index 000000000..c83304f1d

--- /dev/null

+++ b/daemons/fenced/fence_watchdog.in

@@ -0,0 +1,283 @@

+#!@PYTHON@

+"""Dummy watchdog fence agent for providing meta-data for the pacemaker internal agent

+"""

+

+__copyright__ = "Copyright 2012-2021 the Pacemaker project contributors"

+__license__ = "GNU General Public License version 2 or later (GPLv2+) WITHOUT ANY WARRANTY"

+

+import io

+import os

+import re

+import sys

+import atexit

+import getopt

+

+SHORT_DESC = "Dummy watchdog fence agent"

+LONG_DESC = """fence_watchdog just provides

+meta-data - actual fencing is done by the pacemaker internal watchdog agent."""

+

+ALL_OPT = {

+    "version" : {

+        "getopt" : "V",

+        "longopt" : "version",

+        "help" : "-V, --version                  Display version information and exit",

+        "required" : "0",

+        "shortdesc" : "Display version information and exit",

+        "order" : 53

+        },

+    "help"    : {

+        "getopt" : "h",

+        "longopt" : "help",

+        "help" : "-h, --help                     Display this help and exit",

+        "required" : "0",

+        "shortdesc" : "Display help and exit",

+        "order" : 54

+        },

+    "action" : {

+        "getopt" : "o:",

+        "longopt" : "action",

+        "help" : "-o, --action=[action]          Action: metadata",

+        "required" : "1",

+        "shortdesc" : "Fencing Action",

+        "default" : "metadata",

+        "order" : 1

+        },

+    "nodename" : {

+        "getopt" : "N:",

+        "longopt" : "nodename",

+        "help" : "-N, --nodename                 Node name of fence victim (ignored)",

+        "required" : "0",

+        "shortdesc" : "Ignored",

+        "order" : 2

+        },

+    "plug" : {

+        "getopt" : "n:",

+        "longopt" : "plug",

+        "help" : "-n, --plug=[id]                Physical plug number on device (ignored)",

+        "required" : "1",

+        "shortdesc" : "Ignored",

+        "order" : 4

+        }

+}

+

+

+def agent():

+    """ Return name this file was run as. """

+

+    return os.path.basename(sys.argv[0])

+

+

+def fail_usage(message):

+    """ Print a usage message and exit. """

+

+    sys.exit("%s\nPlease use '-h' for usage" % message)

+

+

+def show_docs(options):

+    """ Handle informational options (display info and exit). """

+

+    device_opt = options["device_opt"]

+

+    if "-h" in options:

+        usage(device_opt)

+        sys.exit(0)

+

+    if "-o" in options and options["-o"].lower() == "metadata":

+        metadata(device_opt, options)

+        sys.exit(0)

+

+    if "-V" in options:

+        print(AGENT_VERSION)

+        sys.exit(0)

+

+

+def sorted_options(avail_opt):

+    """ Return a list of all options, in their internally specified order. """

+

+    sorted_list = [(key, ALL_OPT[key]) for key in avail_opt]

+    sorted_list.sort(key=lambda x: x[1]["order"])

+    return sorted_list

+

+

+def usage(avail_opt):

+    """ Print a usage message. """

+    print(LONG_DESC)

+    print()

+    print("Usage:")

+    print("\t" + agent() + " [options]")

+    print("Options:")

+

+    for dummy, value in sorted_options(avail_opt):

+        if len(value["help"]) != 0:

+            print("   " + value["help"])

+

+

+def metadata(avail_opt, options):

+    """ Print agent metadata. """

+

+    print("""

+<resource-agent name="%s" shortdesc="%s">

+<longdesc>%s</longdesc>

+<parameters>""" % (agent(), SHORT_DESC, LONG_DESC))

+

+    for option, dummy in sorted_options(avail_opt):

+        if "shortdesc" in ALL_OPT[option]:

+            print('    

+                  'required="' + ALL_OPT[option]["required"] + '">')

+

+            default = ""

+            default_name_arg = "-" + ALL_OPT[option]["getopt"][:-1]

+            default_name_no_arg = "-" + ALL_OPT[option]["getopt"]

+

+            if "default" in ALL_OPT[option]:

+                default = 'default="%s"' % str(ALL_OPT[option]["default"])

+            elif default_name_arg in options:

+                if options[default_name_arg]:

+                    try:

+                        default = 'default="%s"' % options[default_name_arg]

+                    except TypeError:

+                        ## @todo/@note: Currently there is no clean way how to handle lists

+                        ## we can create a string from it but we can't set it on command line

+                        default = 'default="%s"' % str(options[default_name_arg])

+            elif default_name_no_arg in options:

+                default = 'default="true"'

+

+            mixed = ALL_OPT[option]["help"]

+            ## split it between option and help text

+            res = re.compile(r"^(.*--\S+)\s+", re.IGNORECASE | re.S).search(mixed)

+            if None != res:

+                mixed = res.group(1)

+            mixed = mixed.replace("<", "<").replace(">", ">")

+            print('      <getopt mixed="' + mixed + '" />')

+

+            if ALL_OPT[option]["getopt"].count(":") > 0:

+                print('      <content type="string" ' + default + ' />')

+            else:

+                print('      <content type="boolean" ' + default + ' />')

+

+            print('      <shortdesc lang="en">' + ALL_OPT[option]["shortdesc"] + '</shortdesc>')

+            print('    </parameter>')

+

+    print('  </parameters>\n <actions>')

+    print('    <action name="on" />')

+    print('    <action name="off" />')

+    print('    <action name="reboot" />')

+    print('    <action name="monitor" />')

+    print('    <action name="list" />')

+    print('    <action name="metadata" />')

+    print('  </actions>')

+    print('</resource-agent>')

+

+

+def option_longopt(option):

+    """ Return the getopt-compatible long-option name of the given option. """

+

+    if ALL_OPT[option]["getopt"].endswith(":"):

+        return ALL_OPT[option]["longopt"] + "="

+    else:

+        return ALL_OPT[option]["longopt"]

+

+

+def opts_from_command_line(argv, avail_opt):

+    """ Read options from command-line arguments. """

+

+    # Prepare list of options for getopt

+    getopt_string = ""

+    longopt_list = []

+    for k in avail_opt:

+        if k in ALL_OPT:

+            getopt_string += ALL_OPT[k]["getopt"]

+        else:

+            fail_usage("Parse error: unknown option '" + k + "'")

+

+        if k in ALL_OPT and "longopt" in ALL_OPT[k]:

+            longopt_list.append(option_longopt(k))

+

+    try:

+        opt, dummy = getopt.gnu_getopt(argv, getopt_string, longopt_list)

+    except getopt.GetoptError as error:

+        fail_usage("Parse error: " + error.msg)

+

+    # Transform longopt to short one which are used in fencing agents

+    old_opt = opt

+    opt = {}

+    for old_option in dict(old_opt).keys():

+        if old_option.startswith("--"):

+            for option in ALL_OPT.keys():

+                if "longopt" in ALL_OPT[option] and "--" + ALL_OPT[option]["longopt"] == old_option:

+                    opt["-" + ALL_OPT[option]["getopt"].rstrip(":")] = dict(old_opt)[old_option]

+        else:

+            opt[old_option] = dict(old_opt)[old_option]

+

+    return opt

+

+

+def opts_from_stdin(avail_opt):

+    """ Read options from standard input. """

+

+    opt = {}

+    name = ""

+    for line in sys.stdin.readlines():

+        line = line.strip()

+        if line.startswith("#") or (len(line) == 0):

+            continue

+

+        (name, value) = (line + "=").split("=", 1)

+        value = value[:-1]

+

+        if name not in avail_opt:

+            print("Parse error: Ignoring unknown option '%s'" % line,

+                  file=sys.stderr)

+            continue

+

+        if ALL_OPT[name]["getopt"].endswith(":"):

+            opt["-"+ALL_OPT[name]["getopt"].rstrip(":")] = value

+        elif value.lower() in ["1", "yes", "on", "true"]:

+            opt["-"+ALL_OPT[name]["getopt"]] = "1"

+

+    return opt

+

+

+def process_input(avail_opt):

+    """ Set standard environment variables, and parse all options. """

+

+    # Set standard environment

+    os.putenv("LANG", "C")

+    os.putenv("LC_ALL", "C")

+

+    # Read options from command line or standard input

+    if len(sys.argv) > 1:

+        return opts_from_command_line(sys.argv[1:], avail_opt)

+    else:

+        return opts_from_stdin(avail_opt)

+

+

+def atexit_handler():

+    """ Close stdout on exit. """

+

+    try:

+        sys.stdout.close()

+        os.close(1)

+    except IOError:

+        sys.exit("%s failed to close standard output" % agent())

+

+

+def main():

+    """ Make it so! """

+

+    device_opt = ALL_OPT.keys()

+

+    ## Defaults for fence agent

+    atexit.register(atexit_handler)

+    options = process_input(device_opt)

+    options["device_opt"] = device_opt

+    show_docs(options)

+

+    print("Watchdog fencing may be initiated only by the cluster, not this agent.",

+          file=sys.stderr)

+

+    sys.exit(1)

+

+

+if __name__ == "__main__":

+    main()

diff --git a/daemons/fenced/fenced_commands.c b/daemons/fenced/fenced_commands.c

index cd9968f1a..9470ea2c1 100644

--- a/daemons/fenced/fenced_commands.c

+++ b/daemons/fenced/fenced_commands.c

@@ -397,15 +397,13 @@ stonith_device_execute(stonith_device_t * device)

         return TRUE;

     }

-    if(pcmk__str_eq(device->agent, STONITH_WATCHDOG_AGENT, pcmk__str_casei)) {

-        if(pcmk__str_eq(cmd->action, "reboot", pcmk__str_casei)) {

-            pcmk__panic(__func__);

-            goto done;

-

-        } else if(pcmk__str_eq(cmd->action, "off", pcmk__str_casei)) {

-            pcmk__panic(__func__);

-            goto done;

-

+    if (pcmk__str_any_of(device->agent, STONITH_WATCHDOG_AGENT,

+                         STONITH_WATCHDOG_AGENT_INTERNAL, NULL)) {

+        if (pcmk__strcase_any_of(cmd->action, "reboot", "off", NULL)) {

+            if (node_does_watchdog_fencing(stonith_our_uname)) {

+                pcmk__panic(__func__);

+                goto done;

+            }

         } else {

             crm_info("Faking success for %s watchdog operation", cmd->action);

             cmd->done_cb(0, 0, NULL, cmd);

@@ -716,7 +714,7 @@ get_agent_metadata(const char *agent, xmlNode ** metadata)

         return EINVAL;

     }

     *metadata = NULL;

-    if (pcmk__str_eq(agent, STONITH_WATCHDOG_AGENT, pcmk__str_none)) {

+    if (pcmk__str_eq(agent, STONITH_WATCHDOG_AGENT_INTERNAL, pcmk__str_none)) {

         return pcmk_rc_ok;

     }

     init_metadata_cache();

@@ -1050,24 +1048,6 @@ schedule_internal_command(const char *origin,

     schedule_stonith_command(cmd, device);

 }

-gboolean

-string_in_list(GList *list, const char *item)

-{

-    int lpc = 0;

-    int max = g_list_length(list);

-

-    for (lpc = 0; lpc < max; lpc++) {

-        const char *value = g_list_nth_data(list, lpc);

-

-        if (pcmk__str_eq(item, value, pcmk__str_casei)) {

-            return TRUE;

-        } else {

-            crm_trace("%d: '%s' != '%s'", lpc, item, value);

-        }

-    }

-    return FALSE;

-}

-

 static void

 status_search_cb(GPid pid, int rc, const char *output, gpointer user_data)

 {

@@ -1144,7 +1124,7 @@ dynamic_list_search_cb(GPid pid, int rc, const char *output, gpointer user_data)

         if (!alias) {

             alias = search->host;

         }

-        if (string_in_list(dev->targets, alias)) {

+        if (pcmk__str_in_list(dev->targets, alias, pcmk__str_casei)) {

             can_fence = TRUE;

         }

     }

@@ -1215,9 +1195,62 @@ stonith_device_register(xmlNode * msg, const char **desc, gboolean from_cib)

     stonith_device_t *dup = NULL;

     stonith_device_t *device = build_device_from_xml(msg);

     guint ndevices = 0;

+    int rv = pcmk_ok;

     CRM_CHECK(device != NULL, return -ENOMEM);

+    /* do we have a watchdog-device? */

+    if (pcmk__str_eq(device->id, STONITH_WATCHDOG_ID, pcmk__str_none) ||

+        pcmk__str_any_of(device->agent, STONITH_WATCHDOG_AGENT,

+                     STONITH_WATCHDOG_AGENT_INTERNAL, NULL)) do {

+        if (stonith_watchdog_timeout_ms <= 0) {

+            crm_err("Ignoring watchdog fence device without "

+                    "stonith-watchdog-timeout set.");

+            rv = -ENODEV;

+            /* fall through to cleanup & return */

+        } else if (!pcmk__str_any_of(device->agent, STONITH_WATCHDOG_AGENT,

+                                 STONITH_WATCHDOG_AGENT_INTERNAL, NULL)) {

+            crm_err("Ignoring watchdog fence device with unknown "

+                    "agent '%s' unequal '" STONITH_WATCHDOG_AGENT "'.",

+                    device->agent?device->agent:"");

+            rv = -ENODEV;

+            /* fall through to cleanup & return */

+        } else if (!pcmk__str_eq(device->id, STONITH_WATCHDOG_ID,

+                                 pcmk__str_none)) {

+            crm_err("Ignoring watchdog fence device "

+                    "named %s !='"STONITH_WATCHDOG_ID"'.",

+                    device->id?device->id:"");

+            rv = -ENODEV;

+            /* fall through to cleanup & return */

+        } else {

+            if (pcmk__str_eq(device->agent, STONITH_WATCHDOG_AGENT,

+                             pcmk__str_none)) {

+                /* this either has an empty list or the targets

+                   configured for watchdog-fencing

+                 */

+                g_list_free_full(stonith_watchdog_targets, free);

+                stonith_watchdog_targets = device->targets;

+                device->targets = NULL;

+            }

+            if (node_does_watchdog_fencing(stonith_our_uname)) {

+                g_list_free_full(device->targets, free);

+                device->targets = stonith__parse_targets(stonith_our_uname);

+                g_hash_table_replace(device->params,

+                                     strdup(PCMK_STONITH_HOST_LIST),

+                                     strdup(stonith_our_uname));

+                /* proceed as with any other stonith-device */

+                break;

+            }

+

+            crm_debug("Skip registration of watchdog fence device on node not in host-list.");

+            /* cleanup and fall through to more cleanup and return */

+            device->targets = NULL;

+            stonith_device_remove(device->id, from_cib);

+        }

+        free_device(device);

+        return rv;

+    } while (0);

+

     dup = device_has_duplicate(device);

     if (dup) {

         ndevices = g_hash_table_size(device_list);

@@ -1598,6 +1631,39 @@ stonith_level_remove(xmlNode *msg, char **desc)

  *       (CIB registration is not sufficient), because monitor should not be

  *       possible unless the device is "started" (API registered).

  */

+

+static char *

+list_to_string(GList *list, const char *delim, gboolean terminate_with_delim)

+{

+    int max = g_list_length(list);

+    size_t delim_len = delim?strlen(delim):0;

+    size_t alloc_size = 1 + (max?((max-1+(terminate_with_delim?1:0))*delim_len):0);

+    char *rv;

+    GList *gIter;

+

+    for (gIter = list; gIter != NULL; gIter = gIter->next) {

+        const char *value = (const char *) gIter->data;

+

+        alloc_size += strlen(value);

+    }

+    rv = calloc(alloc_size, sizeof(char));

+    if (rv) {