|
 |
05a495 |
From 14b45df580668220cf97744df93cb9ee5484a14e Mon Sep 17 00:00:00 2001
|
|
|
05a495 |
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
|
|
|
05a495 |
Date: Thu, 8 Dec 2016 11:18:10 +0100
|
|
|
05a495 |
Subject: [PATCH 1/2] portblock: Use -w (wait) to avoid "insufficient
|
|
|
05a495 |
privileges" error
|
|
|
05a495 |
|
|
|
05a495 |
---
|
|
|
05a495 |
heartbeat/portblock | 10 +++++-----
|
|
|
05a495 |
1 file changed, 5 insertions(+), 5 deletions(-)
|
|
|
05a495 |
|
|
|
05a495 |
diff --git a/heartbeat/portblock b/heartbeat/portblock
|
|
|
05a495 |
index c480954..e7de217 100755
|
|
|
05a495 |
--- a/heartbeat/portblock
|
|
|
05a495 |
+++ b/heartbeat/portblock
|
|
|
05a495 |
@@ -242,7 +242,7 @@ active_grep_pat()
|
|
|
05a495 |
chain_isactive()
|
|
|
05a495 |
{
|
|
|
05a495 |
PAT=`active_grep_pat "$1" "$2" "$3"`
|
|
|
05a495 |
- $IPTABLES -n -L INPUT | grep "$PAT" >/dev/null
|
|
|
05a495 |
+ $IPTABLES -w -n -L INPUT | grep "$PAT" >/dev/null
|
|
|
05a495 |
}
|
|
|
05a495 |
|
|
|
05a495 |
save_tcp_connections()
|
|
|
05a495 |
@@ -370,13 +370,13 @@ IptablesBLOCK()
|
|
|
05a495 |
: OK -- chain already active
|
|
|
05a495 |
else
|
|
|
05a495 |
if $try_reset ; then
|
|
|
05a495 |
- $IPTABLES -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
|
05a495 |
+ $IPTABLES -w -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
|
05a495 |
tickle_local
|
|
|
05a495 |
fi
|
|
|
05a495 |
- $IPTABLES -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
|
05a495 |
+ $IPTABLES -w -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
|
05a495 |
rc=$?
|
|
|
05a495 |
if $try_reset ; then
|
|
|
05a495 |
- $IPTABLES -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
|
05a495 |
+ $IPTABLES -w -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
|
05a495 |
fi
|
|
|
05a495 |
fi
|
|
|
05a495 |
|
|
|
05a495 |
@@ -389,7 +389,7 @@ IptablesUNBLOCK()
|
|
|
05a495 |
if
|
|
|
05a495 |
chain_isactive "$1" "$2" "$3"
|
|
|
05a495 |
then
|
|
|
05a495 |
- $IPTABLES -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
|
05a495 |
+ $IPTABLES -w -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
|
05a495 |
else
|
|
|
05a495 |
: Chain Not active
|
|
|
05a495 |
fi
|
|
|
05a495 |
|
|
|
05a495 |
From 57d31bc04a0421cf2746830d5e987e52f9f9acd3 Mon Sep 17 00:00:00 2001
|
|
|
05a495 |
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
|
|
|
05a495 |
Date: Fri, 9 Dec 2016 13:57:49 +0100
|
|
|
05a495 |
Subject: [PATCH 2/2] portblock: version check for -w
|
|
|
05a495 |
|
|
|
05a495 |
---
|
|
|
05a495 |
heartbeat/portblock | 19 ++++++++++++++-----
|
|
|
05a495 |
1 file changed, 14 insertions(+), 5 deletions(-)
|
|
|
05a495 |
|
|
|
05a495 |
diff --git a/heartbeat/portblock b/heartbeat/portblock
|
|
|
05a495 |
index e7de217..92f7071 100755
|
|
|
05a495 |
--- a/heartbeat/portblock
|
|
|
05a495 |
+++ b/heartbeat/portblock
|
|
|
05a495 |
@@ -242,7 +242,7 @@ active_grep_pat()
|
|
|
05a495 |
chain_isactive()
|
|
|
05a495 |
{
|
|
|
05a495 |
PAT=`active_grep_pat "$1" "$2" "$3"`
|
|
|
05a495 |
- $IPTABLES -w -n -L INPUT | grep "$PAT" >/dev/null
|
|
|
05a495 |
+ $IPTABLES $wait -n -L INPUT | grep "$PAT" >/dev/null
|
|
|
05a495 |
}
|
|
|
05a495 |
|
|
|
05a495 |
save_tcp_connections()
|
|
|
05a495 |
@@ -370,13 +370,13 @@ IptablesBLOCK()
|
|
|
05a495 |
: OK -- chain already active
|
|
|
05a495 |
else
|
|
|
05a495 |
if $try_reset ; then
|
|
|
05a495 |
- $IPTABLES -w -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
|
05a495 |
+ $IPTABLES $wait -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
|
05a495 |
tickle_local
|
|
|
05a495 |
fi
|
|
|
05a495 |
- $IPTABLES -w -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
|
05a495 |
+ $IPTABLES $wait -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
|
05a495 |
rc=$?
|
|
|
05a495 |
if $try_reset ; then
|
|
|
05a495 |
- $IPTABLES -w -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
|
05a495 |
+ $IPTABLES $wait -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
|
05a495 |
fi
|
|
|
05a495 |
fi
|
|
|
05a495 |
|
|
|
05a495 |
@@ -389,7 +389,7 @@ IptablesUNBLOCK()
|
|
|
05a495 |
if
|
|
|
05a495 |
chain_isactive "$1" "$2" "$3"
|
|
|
05a495 |
then
|
|
|
05a495 |
- $IPTABLES -w -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
|
05a495 |
+ $IPTABLES $wait -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
|
05a495 |
else
|
|
|
05a495 |
: Chain Not active
|
|
|
05a495 |
fi
|
|
|
05a495 |
@@ -526,6 +526,15 @@ if [ -z "$OCF_RESKEY_action" ]; then
|
|
|
05a495 |
exit $OCF_ERR_CONFIGURED
|
|
|
05a495 |
fi
|
|
|
05a495 |
|
|
|
05a495 |
+# iptables v1.4.20+ is required to use -w (wait)
|
|
|
05a495 |
+version=$(iptables -V | awk -F ' v' '{print $NF}')
|
|
|
05a495 |
+ocf_version_cmp "$version" "1.4.19.1"
|
|
|
05a495 |
+if [ "$?" -eq "2" ]; then
|
|
|
05a495 |
+ wait="-w"
|
|
|
05a495 |
+else
|
|
|
05a495 |
+ wait=""
|
|
|
05a495 |
+fi
|
|
|
05a495 |
+
|
|
|
05a495 |
protocol=$OCF_RESKEY_protocol
|
|
|
05a495 |
portno=$OCF_RESKEY_portno
|
|
|
05a495 |
action=$OCF_RESKEY_action
|