From 05a4951ce60f89ce467db0a0d49d3eb6a312f1a7 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Jan 17 2017 15:27:00 +0000 Subject: import resource-agents-3.9.5-82.el7_3.4 --- diff --git a/SOURCES/bz1409513-portblock-wait.patch b/SOURCES/bz1409513-portblock-wait.patch new file mode 100644 index 0000000..b57e5cf --- /dev/null +++ b/SOURCES/bz1409513-portblock-wait.patch @@ -0,0 +1,114 @@ +From 14b45df580668220cf97744df93cb9ee5484a14e Mon Sep 17 00:00:00 2001 +From: Oyvind Albrigtsen +Date: Thu, 8 Dec 2016 11:18:10 +0100 +Subject: [PATCH 1/2] portblock: Use -w (wait) to avoid "insufficient + privileges" error + +--- + heartbeat/portblock | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/heartbeat/portblock b/heartbeat/portblock +index c480954..e7de217 100755 +--- a/heartbeat/portblock ++++ b/heartbeat/portblock +@@ -242,7 +242,7 @@ active_grep_pat() + chain_isactive() + { + PAT=`active_grep_pat "$1" "$2" "$3"` +- $IPTABLES -n -L INPUT | grep "$PAT" >/dev/null ++ $IPTABLES -w -n -L INPUT | grep "$PAT" >/dev/null + } + + save_tcp_connections() +@@ -370,13 +370,13 @@ IptablesBLOCK() + : OK -- chain already active + else + if $try_reset ; then +- $IPTABLES -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset ++ $IPTABLES -w -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset + tickle_local + fi +- $IPTABLES -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP ++ $IPTABLES -w -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP + rc=$? + if $try_reset ; then +- $IPTABLES -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset ++ $IPTABLES -w -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset + fi + fi + +@@ -389,7 +389,7 @@ IptablesUNBLOCK() + if + chain_isactive "$1" "$2" "$3" + then +- $IPTABLES -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP ++ $IPTABLES -w -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP + else + : Chain Not active + fi + +From 57d31bc04a0421cf2746830d5e987e52f9f9acd3 Mon Sep 17 00:00:00 2001 +From: Oyvind Albrigtsen +Date: Fri, 9 Dec 2016 13:57:49 +0100 +Subject: [PATCH 2/2] portblock: version check for -w + +--- + heartbeat/portblock | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/heartbeat/portblock b/heartbeat/portblock +index e7de217..92f7071 100755 +--- a/heartbeat/portblock ++++ b/heartbeat/portblock +@@ -242,7 +242,7 @@ active_grep_pat() + chain_isactive() + { + PAT=`active_grep_pat "$1" "$2" "$3"` +- $IPTABLES -w -n -L INPUT | grep "$PAT" >/dev/null ++ $IPTABLES $wait -n -L INPUT | grep "$PAT" >/dev/null + } + + save_tcp_connections() +@@ -370,13 +370,13 @@ IptablesBLOCK() + : OK -- chain already active + else + if $try_reset ; then +- $IPTABLES -w -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset ++ $IPTABLES $wait -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset + tickle_local + fi +- $IPTABLES -w -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP ++ $IPTABLES $wait -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP + rc=$? + if $try_reset ; then +- $IPTABLES -w -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset ++ $IPTABLES $wait -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset + fi + fi + +@@ -389,7 +389,7 @@ IptablesUNBLOCK() + if + chain_isactive "$1" "$2" "$3" + then +- $IPTABLES -w -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP ++ $IPTABLES $wait -D INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP + else + : Chain Not active + fi +@@ -526,6 +526,15 @@ if [ -z "$OCF_RESKEY_action" ]; then + exit $OCF_ERR_CONFIGURED + fi + ++# iptables v1.4.20+ is required to use -w (wait) ++version=$(iptables -V | awk -F ' v' '{print $NF}') ++ocf_version_cmp "$version" "1.4.19.1" ++if [ "$?" -eq "2" ]; then ++ wait="-w" ++else ++ wait="" ++fi ++ + protocol=$OCF_RESKEY_protocol + portno=$OCF_RESKEY_portno + action=$OCF_RESKEY_action diff --git a/SPECS/resource-agents.spec b/SPECS/resource-agents.spec index 6aee971..f87e8f1 100644 --- a/SPECS/resource-agents.spec +++ b/SPECS/resource-agents.spec @@ -32,7 +32,7 @@ Name: resource-agents Summary: Open Source HA Reusable Cluster Resource Scripts Version: 3.9.5 -Release: 82%{?dist}.3 +Release: 82%{?dist}.4 License: GPLv2+, LGPLv2+ and ASL 2.0 URL: https://github.com/ClusterLabs/resource-agents %if 0%{?fedora} || 0%{?centos_version} || 0%{?rhel} @@ -172,6 +172,7 @@ Patch127: bz1391495-nfsserver-keep-options.patch Patch128: bz1394296-redis-fix-selinux-permissions.patch Patch129: bz1400103-redis-notify-clients-of-master-being-demoted.patch Patch130: bz1400103-nova-compute-wait-nova-compute-unfence.patch +Patch131: bz1409513-portblock-wait.patch Obsoletes: heartbeat-resources <= %{version} Provides: heartbeat-resources = %{version} @@ -194,31 +195,35 @@ BuildRequires: libnet-devel %endif ## Runtime deps -## These apply to rgmanager agents only to guarantee agents -## are functional -%if %{with rgmanager} # system tools shared by several agents Requires: /bin/bash /bin/grep /bin/sed /bin/gawk -Requires: /bin/ps /usr/bin/pkill /bin/hostname -Requires: /sbin/fuser -Requires: /sbin/findfs /bin/mount +Requires: /bin/ps /usr/bin/pkill /bin/hostname /bin/netstat +Requires: /usr/sbin/fuser /bin/mount -# fs.sh -Requires: /sbin/quotaon /sbin/quotacheck +# Filesystem / fs.sh / netfs.sh Requires: /sbin/fsck Requires: /usr/sbin/fsck.ext2 /usr/sbin/fsck.ext3 /usr/sbin/fsck.ext4 Requires: /usr/sbin/fsck.xfs +Requires: /sbin/mount.nfs /sbin/mount.nfs4 /usr/sbin/mount.cifs -# ip.sh -Requires: /sbin/ip /usr/sbin/ethtool -Requires: /sbin/rdisc /usr/sbin/arping /bin/ping /bin/ping6 +# IPaddr2 +Requires: /sbin/ip -# lvm.sh +# LVM / lvm.sh Requires: /usr/sbin/lvm -# netfs.sh -Requires: /sbin/mount.nfs /sbin/mount.nfs4 /usr/sbin/mount.cifs +# nfsserver / netfs.sh Requires: /usr/sbin/rpc.nfsd /sbin/rpc.statd /usr/sbin/rpc.mountd + +# rgmanager +%if %{with rgmanager} +# ip.sh +Requires: /usr/sbin/ethtool +Requires: /sbin/rdisc /usr/sbin/arping /bin/ping /bin/ping6 + +# nfsexport.sh +Requires: /sbin/findfs +Requires: /sbin/quotaon /sbin/quotacheck %endif ## Runtime dependencies required to guarantee heartbeat agents @@ -409,6 +414,7 @@ exit 1 %patch128 -p1 %patch129 -p1 %patch130 -p1 +%patch131 -p1 %build if [ ! -f configure ]; then @@ -663,6 +669,12 @@ ccs_update_schema > /dev/null 2>&1 ||: %endif %changelog +* Tue Jan 3 2017 Oyvind Albrigtsen - 3.9.5-82.4 +- portblock: use iptables wait +- Add netstat dependency + + Resolves: rhbz#1409513 + * Wed Nov 30 2016 Oyvind Albrigtsen - 3.9.5-82.3 - redis: notify clients of master being demoted