blob: 134a0e67aee20bb94aea43594f258b5dc2f8c72e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
|
#!/bin/sh
#################################
# interface event script for ctdb
# this adds/removes IPs from your
# public interface
. $CTDB_BASE/functions
loadconfig
[ -z "$CTDB_PUBLIC_ADDRESSES" ] && {
CTDB_PUBLIC_ADDRESSES=$CTDB_BASE/public_addresses
}
[ ! -f "$CTDB_PUBLIC_ADDRESSES" ] && {
echo "No public addresses file found. Nothing to do for 10.interfaces"
exit 0
}
monitor_interfaces()
{
local INTERFACES=`cat $CTDB_PUBLIC_ADDRESSES |
sed -e "s/^[^\t ]*[\t ]*//" -e "s/,/ /g" -e "s/[\t ]*$//"`
[ "$CTDB_PUBLIC_INTERFACE" ] && INTERFACES="$CTDB_PUBLIC_INTERFACE $INTERFACES"
[ "$CTDB_NATGW_PUBLIC_IFACE" ] && INTERFACES="$CTDB_NATGW_PUBLIC_IFACE $INTERFACES"
local IFACE
INTERFACES=`for IFACE in $INTERFACES ; do echo $IFACE ; done | sort | uniq`
local fail=0
for IFACE in $INTERFACES ; do
# These interfaces are sometimes bond devices
# When we use VLANs for bond interfaces, there will only
# be an entry in /proc for the underlying real interface
local REALIFACE=`echo $IFACE |sed -e 's/\..*$//'`
[ -f /proc/net/bonding/$REALIFACE ] && {
grep -q 'Currently Active Slave: None' /proc/net/bonding/$REALIFACE && {
echo "ERROR: No active slaves for bond device $REALIFACE"
fail=1
continue;
}
grep -q '^MII Status: up' /proc/net/bonding/$REALIFACE || {
echo "ERROR: public network interface $REALIFACE is down"
fail=1
continue;
}
return 0;
}
case $IFACE in
ib*)
# we dont know how to test ib links
;;
*)
[ -z "$IFACE" ] || {
/usr/sbin/ethtool $IFACE | grep -q 'Link detected: yes' || {
# On some systems, this is not successful when a
# cable is plugged but the interface has not been
# brought up previously. Bring the interface up and
# try again...
/sbin/ip link set $IFACE up
/usr/sbin/ethtool $IFACE | grep -q 'Link detected: yes' || {
echo "ERROR: No link on the public network interface $IFACE"
fail=1
continue
}
}
}
;;
esac
done
return $fail;
}
case "$1" in
#############################
# called when ctdbd starts up
init)
# make sure that we only respond to ARP messages from the NIC where
# a particular ip address is associated.
[ -f /proc/sys/net/ipv4/conf/all/arp_filter ] && {
echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
}
cat "$CTDB_PUBLIC_ADDRESSES" | cut -d/ -f1 | while read _IP; do
_IP_HELD=`/sbin/ip addr show | grep "inet $_IP/"`
[ -z "$_IP_HELD" ] || {
_IFACE=`echo $_IP_HELD | sed -e "s/.*\s//"`
_NM=`echo $_IP_HELD | sed -e "s/.*$_IP\///" -e "s/\s.*//"`
echo "Removing public address $_IP/$_NM from device $_IFACE"
/sbin/ip addr del $_IP/$_NM dev $_IFACE
}
done
;;
################################################
# called when ctdbd wants to claim an IP address
takeip)
if [ $# != 4 ]; then
echo "must supply interface, IP and maskbits"
exit 1
fi
iface=$2
ip=$3
maskbits=$4
add_ip_to_iface $iface $ip $maskbits || {
exit 1;
}
# cope with the script being killed while we have the interface blocked
iptables -D INPUT -i $iface -d $ip -j DROP 2> /dev/null
# flush our route cache
echo 1 > /proc/sys/net/ipv4/route/flush
;;
##################################################
# called when ctdbd wants to release an IP address
releaseip)
if [ $# != 4 ]; then
echo "must supply interface, IP and maskbits"
exit 1
fi
# releasing an IP is a bit more complex than it seems. Once the IP
# is released, any open tcp connections to that IP on this host will end
# up being stuck. Some of them (such as NFS connections) will be unkillable
# so we need to use the killtcp ctdb function to kill them off. We also
# need to make sure that no new connections get established while we are
# doing this! So what we do is this:
# 1) firewall this IP, so no new external packets arrive for it
# 2) use netstat -tn to find existing connections, and kill them
# 3) remove the IP from the interface
# 4) remove the firewall rule
iface=$2
ip=$3
maskbits=$4
failed=0
# we do an extra delete to cope with the script being killed
iptables -D INPUT -i $iface -d $ip -j DROP 2> /dev/null
iptables -I INPUT -i $iface -d $ip -j DROP
kill_tcp_connections $ip
delete_ip_from_iface $iface $ip $maskbits || {
iptables -D INPUT -i $iface -d $ip -j DROP 2> /dev/null
exit 1;
}
iptables -D INPUT -i $iface -d $ip -j DROP 2> /dev/null
# flush our route cache
echo 1 > /proc/sys/net/ipv4/route/flush
;;
###########################################
# called when ctdbd has finished a recovery
recovered)
;;
####################################
# called when ctdbd is shutting down
shutdown)
;;
monitor)
monitor_interfaces
ret=$?
test x"$ret" != x"0" && {
exit 1;
}
;;
*)
ctdb_standard_event_handler "$@"
;;
esac
exit 0
|
