conntrackd

#!/bin/sh
#
# Conntrackd for initating active/backup state sync between two nodes
# code based on Dummy template and primary-backup.sh
#
# Copyright (C) 2010 op5 AB, Jonathan Petersson <[email protected]>
#                    All Rights Reserved.
# Copyright (C) 2008 by Pablo Neira Ayuso <[email protected]>
#                    All Rights Reserved.
# Copyright (C) 2004 SUSE LINUX AG, Lars Marowsky-Brée
#                    All Rights Reserved.
#
# Disclamer:
# This software has only been tested on Debian Lenny, modifications
# may be needed for other distributions and operating-systems.
#
# Conntrackd will get started automatically if it's not already
# running. However there's no active error-handling for startup errors
# please refer to conntrackd regular error-logs for trouble shooting.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of version 2 of the GNU General Public License as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it would be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
#
# Further, this software is distributed without any warranty that it is
# free of the rightful claim of any third person regarding infringement
# or the like.  Any license provided herein, whether implied or
# otherwise, applies only to this software file.  Patent licenses, if
# any, provided herein do not apply to combinations of this program with
# other software, or any other product whatsoever.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write the Free Software Foundation,
# Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
#

#######################################################################
# Initialization:

: ${OCF_FUNCTIONS_DIR=/usr/lib/ocf/resource.d/heartbeat}
. ${OCF_FUNCTIONS_DIR}/.ocf-shellfuncs

#######################################################################

# Fill in some defaults if no values are specified
OCF_RESKEY_binary_default="/usr/sbin/conntrackd"
OCF_RESKEY_config_default="/etc/conntrackd/conntrackd.conf"
OCF_RESKEY_lockfile_default="/var/lock/conntrack.lock"

: ${OCF_RESKEY_binary=${OCF_RESKEY_binary_default}}
: ${OCF_RESKEY_config=${OCF_RESKEY_config_default}}
: ${OCF_RESKEY_lockfile=${OCF_RESKEY_lockfile_default}}

CONNTRACKD="${OCF_RESKEY_binary} -C ${OCF_RESKEY_config}"

meta_data() {
    cat <<EOF
<?xml version="1.0"?>
<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
<resource-agent name="Conntrackd" version="0.6">
<version>0.6</version>

<longdesc lang="en">
This is a Conntrackd resource to manage primary and secondary state between two firewalls in a cluster.
</longdesc>
<shortdesc lang="en">Manages primary/backup conntrackd state</shortdesc>

<parameters>
<parameter name="binary" unique="0">
<longdesc lang="en">
Location of conntrackd binary.
</longdesc>
<shortdesc lang="en">Conntrackd bin</shortdesc>
<contect type="string" default="${OCF_RESKEY_binary_default}"/>
</parameter>

<parameter name="config" unique="0">
<longdesc lang="en">
Location of conntrackd configuration file.
</longdesc>
<shortdesc lang="en">Conntrackd config</shortdesc>
<contect type="string" default="${OCF_RESKEY_config_default}"/>
</parameter>

<parameter name="lockfile" unique="0">
<longdesc lang="en">
Location of conntrackd lock-file.
</longdesc>
<shortdesc lang="en">Conntrackd lock-file</shortdesc>
<contect type="string" default="${OCF_RESKEY_lockfile_default}"/>
</parameter>

</parameters>

<actions>
<action name="start"        timeout="20" />
<action name="stop"         timeout="20" />
<action name="monitor"      timeout="20" interval="10" depth="0" />
<action name="reload"       timeout="20" />
<action name="migrate_to"   timeout="20" />
<action name="migrate_from" timeout="20" />
<action name="meta-data"    timeout="5" />
<action name="validate-all"   timeout="20" />
</actions>
</resource-agent>
EOF
}

#######################################################################

conntrackd_usage() {
    cat <<EOF
usage: $0 {start|stop|monitor|migrate_to|migrate_from|validate-all|meta-data}

Expects to have a fully populated OCF RA-compliant environment set.
EOF
}

conntrackd_start() {

    # Call monitor to verify that conntrackd is running
    conntrackd_monitor

    if [ $? -eq  $OCF_SUCCESS ]; then

    # commit the external cache into the kernel table
    ocf_run $CONNTRACKD -c || exit $OCF_ERR_GENERIC

    # flush the internal and the external caches
    ocf_run $CONNTRACKD -f || exit "asd".$OCF_ERR_GENERIC

    # resynchronize my internal cache to the kernel table
    ocf_run $CONNTRACKD -R || exit $OCF_ERR_GENERIC

    # send a bulk update to backups
    ocf_run $CONNTRACKD -B || exit $OCF_ERR_GENERIC

    return $OCF_SUCCESS
    fi
}

conntrackd_stop() {

    # Call monitor to verify that conntrackd is running
    conntrackd_monitor

    if [ $? =  $OCF_SUCCESS ]; then

    # shorten kernel conntrack timers to remove the zombie entries.
    $CONNTRACKD -t
    if [ $? -eq 1 ]
    then
        return $OCF_ERR_GENERIC
    fi

    # request resynchronization with the master firewall replica
    $CONNTRACKD -n
    if [ $? -eq 1 ]
    then
        return $OCF_ERR_GENERIC
    fi

    fi

    return $OCF_SUCCESS
}

conntrackd_monitor() {

    local conntrackd_pid
    conntrackd_pid=`pidof ${OCF_RESKEY_binary}`

    if [ -f $OCF_RESKEY_lockfile ]; then
    if [ -n $conntrackd_pid ]; then
        if [ -n `${OCF_RESKEY_binary} -s | grep "cache internal" > /dev/null` ]; then
        return $OCF_SUCCESS
        else
        return $OCF_ERR_GENERIC
        fi
    else
        return $OCF_ERR_GENERIC
    fi
    else
    $OCF_NOT_RUNNING
    fi
}

conntrackd_validate() {

    # Check if conntrackd config exists
    if [ ! -f ${OCF_RESKEY_config} ]; then
    return $OCF_ERR_INSTALLED
    fi

    return $OCF_SUCCESS
}

case $__OCF_ACTION in
meta-data)  meta_data
        exit $OCF_SUCCESS
        ;;
start)      conntrackd_validate
            conntrackd_start
        ;;
stop)       conntrackd_validate
        conntrackd_stop
        ;;
monitor)    conntrackd_validate
            conntrackd_monitor
        ;;
reload)     conntrackd_validate
        ocf_log err "Reloading..."
            conntrackd_start
        ;;
validate-all)   conntrackd_validate;;
usage|help) conntrackd_usage
        exit $OCF_SUCCESS
        ;;
*)      conntrackd_usage
        exit $OCF_ERR_UNIMPLEMENTED
        ;;
esac
rc=$?
ocf_log debug "${OCF_RESOURCE_INSTANCE} $__OCF_ACTION : $rc"
exit $rc