Blame SOURCES/bz1409513-portblock-wait.patch

05a495
From 14b45df580668220cf97744df93cb9ee5484a14e Mon Sep 17 00:00:00 2001
05a495
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
05a495
Date: Thu, 8 Dec 2016 11:18:10 +0100
05a495
Subject: [PATCH 1/2] portblock: Use -w (wait) to avoid "insufficient
05a495
 privileges" error
05a495
05a495
---
05a495
 heartbeat/portblock | 10 +++++-----
05a495
 1 file changed, 5 insertions(+), 5 deletions(-)
05a495
05a495
diff --git a/heartbeat/portblock b/heartbeat/portblock
05a495
index c480954..e7de217 100755
05a495
--- a/heartbeat/portblock
05a495
+++ b/heartbeat/portblock
05a495
@@ -242,7 +242,7 @@ active_grep_pat()
05a495
 chain_isactive()
05a495
 {
05a495
   PAT=`active_grep_pat "$1" "$2" "$3"`
05a495
-  $IPTABLES -n -L INPUT | grep "$PAT" >/dev/null
05a495
+  $IPTABLES -w -n -L INPUT | grep "$PAT" >/dev/null
05a495
 }
05a495
 
05a495
 save_tcp_connections()
05a495
@@ -370,13 +370,13 @@ IptablesBLOCK()
05a495
     : OK -- chain already active
05a495
   else
05a495
     if $try_reset ; then
05a495
-      $IPTABLES -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
05a495
+      $IPTABLES -w -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
05a495
       tickle_local
05a495
     fi
05a495
-    $IPTABLES -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
05a495
+    $IPTABLES -w -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
05a495
     rc=$?
05a495
     if $try_reset ; then
05a495
-      $IPTABLES -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
05a495
+      $IPTABLES -w -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
05a495
     fi
05a495
   fi
05a495
 
05a495
@@ -389,7 +389,7 @@ IptablesUNBLOCK()
05a495
   if
05a495
     chain_isactive "$1" "$2" "$3"
05a495
   then
05a495
-    $IPTABLES -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
05a495
+    $IPTABLES -w -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
05a495
   else
05a495
     : Chain Not active
05a495
   fi
05a495
05a495
From 57d31bc04a0421cf2746830d5e987e52f9f9acd3 Mon Sep 17 00:00:00 2001
05a495
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
05a495
Date: Fri, 9 Dec 2016 13:57:49 +0100
05a495
Subject: [PATCH 2/2] portblock: version check for -w
05a495
05a495
---
05a495
 heartbeat/portblock | 19 ++++++++++++++-----
05a495
 1 file changed, 14 insertions(+), 5 deletions(-)
05a495
05a495
diff --git a/heartbeat/portblock b/heartbeat/portblock
05a495
index e7de217..92f7071 100755
05a495
--- a/heartbeat/portblock
05a495
+++ b/heartbeat/portblock
05a495
@@ -242,7 +242,7 @@ active_grep_pat()
05a495
 chain_isactive()
05a495
 {
05a495
   PAT=`active_grep_pat "$1" "$2" "$3"`
05a495
-  $IPTABLES -w -n -L INPUT | grep "$PAT" >/dev/null
05a495
+  $IPTABLES $wait -n -L INPUT | grep "$PAT" >/dev/null
05a495
 }
05a495
 
05a495
 save_tcp_connections()
05a495
@@ -370,13 +370,13 @@ IptablesBLOCK()
05a495
     : OK -- chain already active
05a495
   else
05a495
     if $try_reset ; then
05a495
-      $IPTABLES -w -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
05a495
+      $IPTABLES $wait -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
05a495
       tickle_local
05a495
     fi
05a495
-    $IPTABLES -w -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
05a495
+    $IPTABLES $wait -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
05a495
     rc=$?
05a495
     if $try_reset ; then
05a495
-      $IPTABLES -w -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
05a495
+      $IPTABLES $wait -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
05a495
     fi
05a495
   fi
05a495
 
05a495
@@ -389,7 +389,7 @@ IptablesUNBLOCK()
05a495
   if
05a495
     chain_isactive "$1" "$2" "$3"
05a495
   then
05a495
-    $IPTABLES -w -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
05a495
+    $IPTABLES $wait -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
05a495
   else
05a495
     : Chain Not active
05a495
   fi
05a495
@@ -526,6 +526,15 @@ if [ -z "$OCF_RESKEY_action" ]; then
05a495
   exit $OCF_ERR_CONFIGURED
05a495
 fi 
05a495
 
05a495
+# iptables v1.4.20+ is required to use -w (wait)
05a495
+version=$(iptables -V | awk -F ' v' '{print $NF}')
05a495
+ocf_version_cmp "$version" "1.4.19.1"
05a495
+if [ "$?" -eq "2" ]; then
05a495
+    wait="-w"
05a495
+else
05a495
+    wait=""
05a495
+fi
05a495
+
05a495
 protocol=$OCF_RESKEY_protocol
05a495
 portno=$OCF_RESKEY_portno
05a495
 action=$OCF_RESKEY_action