From e72084c3bfff2e9fb277a4671ee6f032662b2870 Mon Sep 17 00:00:00 2001
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
Date: Fri, 19 Jun 2026 10:18:08 +0200
Subject: [PATCH] - portblock: add IPv6 support - portblock: fix IPv6 rule
 detection in the iptables backend

  Resolves: RHEL-171180, RHEL-183132
---
 RHEL-171180-portblock-add-IPv6-support.patch  | 26 +++++++++++++++++++
 ...le-detection-in-the-iptables-backend.patch | 26 +++++++++++++++++++
 resource-agents.spec                          | 12 ++++++++-
 3 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 RHEL-171180-portblock-add-IPv6-support.patch
 create mode 100644 RHEL-183132-portblock-fix-IPv6-rule-detection-in-the-iptables-backend.patch

diff --git a/RHEL-171180-portblock-add-IPv6-support.patch b/RHEL-171180-portblock-add-IPv6-support.patch
new file mode 100644
index 0000000..5319931
--- /dev/null
+++ b/RHEL-171180-portblock-add-IPv6-support.patch
@@ -0,0 +1,26 @@
+--- a/heartbeat/portblock	2026-06-19 09:34:28.950367810 +0200
++++ b/heartbeat/portblock	2026-06-19 10:06:09.851173500 +0200
+@@ -47,6 +47,14 @@
+ : ${OCF_RESKEY_method=${OCF_RESKEY_method_default}}
+ : ${OCF_RESKEY_status_check=${OCF_RESKEY_status_check_default}}
+ : ${OCF_RESKEY_ip=${OCF_RESKEY_ip_default}}
++
++# IPv6 support: detect family from service IP and parameterise both backends.
++case "$OCF_RESKEY_ip" in
++  *:*) ip_family=ip6 ;;
++  *)   ip_family=ip  ;;
++esac
++IPTABLES=${ip_family}tables
++
+ : ${OCF_RESKEY_reset_local_on_unblock_stop=${OCF_RESKEY_reset_local_on_unblock_stop_default}}
+ : ${OCF_RESKEY_tickle_dir=${OCF_RESKEY_tickle_dir_default}}
+ : ${OCF_RESKEY_sync_script=${OCF_RESKEY_sync_script_default}}
+@@ -778,7 +786,7 @@
+ fi 
+ 
+ # iptables v1.4.20+ is required to use -w (wait)
+-version=$(iptables -V | grep -oE '[0-9]+[\.0-9]+')
++version=$($IPTABLES -V | grep -oE '[0-9]+[\.0-9]+')
+ ocf_version_cmp "$version" "1.4.19.1"
+ if [ "$?" -eq "2" ]; then
+     wait="-w"
diff --git a/RHEL-183132-portblock-fix-IPv6-rule-detection-in-the-iptables-backend.patch b/RHEL-183132-portblock-fix-IPv6-rule-detection-in-the-iptables-backend.patch
new file mode 100644
index 0000000..0ed5478
--- /dev/null
+++ b/RHEL-183132-portblock-fix-IPv6-rule-detection-in-the-iptables-backend.patch
@@ -0,0 +1,26 @@
+--- a/heartbeat/portblock	2026-06-19 10:15:51.367092196 +0200
++++ b/heartbeat/portblock	2026-06-19 10:15:41.619851027 +0200
+@@ -313,7 +313,10 @@
+ active_grep_pat()
+ {
+   w="[ 	][ 	]*"
+-  any="0\\.0\\.0\\.0/0"
++  case $ip_family in
++    ip6) any="::/0" ;;
++    *)   any="0\\.0\\.0\\.0/0" ;;
++  esac
+   src=$any dst=$3
+   if [ "$4" = "s" ]; then
+     local src=$3
+@@ -327,9 +330,9 @@
+     local prot="\(udp\|17\)"
+   fi
+   if [ "$method" = "DROP" ]; then
+-    echo "^DROP${w}${prot}${w}--${w}${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}$"
++    echo "^DROP${w}${prot}${w}\(--${w}\)\?${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}$"
+   else
+-    echo "^REJECT${w}${prot}${w}--${w}${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}${w}ctstate${w}NEW,RELATED,ESTABLISHED${w}reject-with${w}tcp-reset$"
++    echo "^REJECT${w}${prot}${w}\(--${w}\)\?${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}${w}ctstate${w}NEW,RELATED,ESTABLISHED${w}reject-with${w}tcp-reset$"
+   fi
+ }
+ 
diff --git a/resource-agents.spec b/resource-agents.spec
index 9d5a16e..adb1a55 100644
--- a/resource-agents.spec
+++ b/resource-agents.spec
@@ -45,7 +45,7 @@
 Name:		resource-agents
 Summary:	Open Source HA Reusable Cluster Resource Scripts
 Version:	4.10.0
-Release:	126%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}
+Release:	127%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}
 License:	GPLv2+ and LGPLv2+
 URL:		https://github.com/ClusterLabs/resource-agents
 Source0:	%{upstream_prefix}-%{upstream_version}.tar.gz
@@ -222,6 +222,8 @@ Patch169:	RHEL-180767-2-nfsserver-fixes-incorrect-indentation.patch
 Patch170:	RHEL-182808-sybaseASE-fix-for-missing-sybaseASE-env-during-probe-action.patch
 Patch171:	RHEL-180767-3-nfsserver-do-not-try-to-stop-fsidd-when-not-present.patch
 Patch172:	RHEL-184272-nfsserver-monitor-nfsdcld-and-nfs-mountd-services-to-trigger-recovery-on-failure.patch
+Patch173:	RHEL-171180-portblock-add-IPv6-support.patch
+Patch174:	RHEL-183132-portblock-fix-IPv6-rule-detection-in-the-iptables-backend.patch
 
 # bundled ha-cloud-support libs
 Patch500:	ha-cloud-support-aliyun.patch
@@ -539,6 +541,8 @@ exit 1
 %patch -p1 -P 170
 %patch -p1 -P 171
 %patch -p1 -P 172
+%patch -p1 -P 173
+%patch -p1 -P 174
 
 # bundled ha-cloud-support libs
 %patch -p1 -P 500
@@ -873,6 +877,12 @@ rm -rf %{buildroot}/usr/share/doc/resource-agents
 %{_usr}/lib/ocf/lib/heartbeat/OCF_*.pm
 
 %changelog
+* Fri Jun 19 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-127
+- portblock: add IPv6 support
+- portblock: fix IPv6 rule detection in the iptables backend
+
+  Resolves: RHEL-171180, RHEL-183132
+
 * Fri Jun 12 2026 Arslan Ahmad <arahmad@redhat.com> - 4.10.0-126
 - nfsserver: monitor nfsdcld and nfs-mountd services to trigger
   recovery on failure