181 lines
5.9 KiB
Diff
181 lines
5.9 KiB
Diff
--- a/heartbeat/portblock 2025-10-21 09:27:41.753028260 +0200
|
|
+++ b/heartbeat/portblock 2025-10-21 09:28:55.573855995 +0200
|
|
@@ -28,6 +28,8 @@
|
|
OCF_RESKEY_portno_default=""
|
|
OCF_RESKEY_direction_default="in"
|
|
OCF_RESKEY_action_default=""
|
|
+OCF_RESKEY_method_default="drop"
|
|
+OCF_RESKEY_status_check_default="rule"
|
|
OCF_RESKEY_ip_default="0.0.0.0/0"
|
|
OCF_RESKEY_reset_local_on_unblock_stop_default="false"
|
|
OCF_RESKEY_tickle_dir_default=""
|
|
@@ -37,6 +39,8 @@
|
|
: ${OCF_RESKEY_portno=${OCF_RESKEY_portno_default}}
|
|
: ${OCF_RESKEY_direction=${OCF_RESKEY_direction_default}}
|
|
: ${OCF_RESKEY_action=${OCF_RESKEY_action_default}}
|
|
+: ${OCF_RESKEY_method=${OCF_RESKEY_method_default}}
|
|
+: ${OCF_RESKEY_status_check=${OCF_RESKEY_status_check_default}}
|
|
: ${OCF_RESKEY_ip=${OCF_RESKEY_ip_default}}
|
|
: ${OCF_RESKEY_reset_local_on_unblock_stop=${OCF_RESKEY_reset_local_on_unblock_stop_default}}
|
|
: ${OCF_RESKEY_tickle_dir=${OCF_RESKEY_tickle_dir_default}}
|
|
@@ -185,6 +189,26 @@
|
|
<content type="string" default="${OCF_RESKEY_action_default}" />
|
|
</parameter>
|
|
|
|
+<parameter name="method" unique="0" required="0">
|
|
+<longdesc lang="en">
|
|
+Block method:
|
|
+drop: Use DROP rule.
|
|
+reject: Use REJECT rule w/conntrack to clear connections when blocking.
|
|
+</longdesc>
|
|
+<shortdesc lang="en">Block method</shortdesc>
|
|
+<content type="string" default="${OCF_RESKEY_method_default}" />
|
|
+</parameter>
|
|
+
|
|
+<parameter name="status_check" unique="0" required="0">
|
|
+<longdesc lang="en">
|
|
+Status check:
|
|
+rule: Check rule.
|
|
+pseudo: Check pseudo status when rule is absent.
|
|
+</longdesc>
|
|
+<shortdesc lang="en">Status check</shortdesc>
|
|
+<content type="string" default="${OCF_RESKEY_status_check_default}" />
|
|
+</parameter>
|
|
+
|
|
<parameter name="reset_local_on_unblock_stop" unique="0" required="0">
|
|
<longdesc lang="en">
|
|
If for some reason the long lived server side TCP sessions won't be cleaned up
|
|
@@ -253,6 +277,7 @@
|
|
<action name="demote" timeout="10s"/>
|
|
<action name="status" depth="0" timeout="10s" interval="10s" />
|
|
<action name="monitor" depth="0" timeout="10s" interval="10s" />
|
|
+<action name="monitor" depth="0" timeout="10s" interval="9s" role="Promoted" />
|
|
<action name="meta-data" timeout="5s" />
|
|
<action name="validate-all" timeout="5s" />
|
|
</actions>
|
|
@@ -288,7 +313,11 @@
|
|
else
|
|
local prot="\(udp\|17\)"
|
|
fi
|
|
- echo "^DROP${w}${prot}${w}--${w}${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}$"
|
|
+ if [ "$method" = "DROP" ]; then
|
|
+ echo "^DROP${w}${prot}${w}--${w}${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}$"
|
|
+ else
|
|
+ echo "^REJECT${w}${prot}${w}--${w}${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}${w}ctstate${w}NEW,RELATED,ESTABLISHED${w}reject-with${w}tcp-reset$"
|
|
+ fi
|
|
}
|
|
|
|
#chain_isactive {udp|tcp} portno,portno ip chain
|
|
@@ -374,17 +403,17 @@
|
|
|
|
SayActive()
|
|
{
|
|
- ocf_log debug "$CMD DROP rule [$*] is running (OK)"
|
|
+ ocf_log debug "$CMD $method rule [$*] is running (OK)"
|
|
}
|
|
|
|
SayConsideredActive()
|
|
{
|
|
- ocf_log debug "$CMD DROP rule [$*] considered to be running (OK)"
|
|
+ ocf_log debug "$CMD $method rule [$*] considered to be running (OK)"
|
|
}
|
|
|
|
SayInactive()
|
|
{
|
|
- ocf_log debug "$CMD DROP rule [$*] is inactive"
|
|
+ ocf_log debug "$CMD $method rule [$*] is inactive"
|
|
}
|
|
|
|
#IptablesStatus {udp|tcp} portno,portno ip {in|out|both} {block|unblock}
|
|
@@ -405,14 +434,18 @@
|
|
case $5 in
|
|
block)
|
|
SayActive $*
|
|
- rc=$OCF_SUCCESS
|
|
+ if [ "$__OCF_ACTION" = "monitor" ] && [ "$promotion_score" = "$SCORE_PROMOTED" ]; then
|
|
+ rc=$OCF_RUNNING_MASTER
|
|
+ else
|
|
+ rc=$OCF_SUCCESS
|
|
+ fi
|
|
;;
|
|
*)
|
|
SayInactive $*
|
|
rc=$OCF_NOT_RUNNING
|
|
;;
|
|
esac
|
|
- elif ocf_is_ms; then
|
|
+ elif [ "$OCF_RESKEY_status_check" = "rule" ]; then
|
|
case $5 in
|
|
block)
|
|
SayInactive $*
|
|
@@ -420,7 +453,11 @@
|
|
;;
|
|
*)
|
|
SayActive $*
|
|
- rc=$OCF_SUCCESS
|
|
+ if [ "$__OCF_ACTION" = "monitor" ] && [ "$promotion_score" = "$SCORE_PROMOTED" ]; then
|
|
+ rc=$OCF_RUNNING_MASTER
|
|
+ else
|
|
+ rc=$OCF_SUCCESS
|
|
+ fi
|
|
;;
|
|
esac
|
|
else
|
|
@@ -461,7 +498,11 @@
|
|
: Chain already in desired state
|
|
else
|
|
[ "$chain" = "OUTPUT" ] && ds="s" || ds="d"
|
|
- $IPTABLES $wait "$op" "$chain" -p "$proto" -${ds} "$ip" -m multiport --${ds}ports "$ports" -j DROP
|
|
+ if [ "$method" = "DROP" ]; then
|
|
+ $IPTABLES $wait "$op" "$chain" -p "$proto" -${ds} "$ip" -m multiport --${ds}ports "$ports" -j DROP
|
|
+ else
|
|
+ $IPTABLES $wait "$op" "$chain" -p "$proto" -${ds} "$ip" -m multiport --${ds}ports "$ports" -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j REJECT --reject-with tcp-reset
|
|
+ fi
|
|
fi
|
|
}
|
|
|
|
@@ -486,7 +527,11 @@
|
|
$IPTABLES $wait -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
tickle_local
|
|
fi
|
|
- $IPTABLES $wait -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
+ if [ "$method" = "DROP" ]; then
|
|
+ $IPTABLES $wait -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
|
|
+ else
|
|
+ $IPTABLES $wait -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j REJECT --reject-with tcp-reset
|
|
+ fi
|
|
rc_in=$?
|
|
if $try_reset ; then
|
|
$IPTABLES $wait -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
|
|
@@ -718,6 +763,13 @@
|
|
ip=$OCF_RESKEY_ip
|
|
reset_local_on_unblock_stop=$OCF_RESKEY_reset_local_on_unblock_stop
|
|
nodename=$(ocf_local_nodename)
|
|
+case "$OCF_RESKEY_method" in
|
|
+ drop) method="DROP" ;;
|
|
+ reject) method="REJECT" ;;
|
|
+ *) ocf_log err "method: $OCF_RESKEY_method not supported"
|
|
+ exit $OCF_ERR_CONFIGURED
|
|
+ ;;
|
|
+esac
|
|
|
|
|
|
# If "tickle" is enabled, we need to record the list of currently established
|
|
@@ -743,6 +795,8 @@
|
|
fi
|
|
fi
|
|
|
|
+IptablesValidateAll
|
|
+
|
|
case $__OCF_ACTION in
|
|
start)
|
|
IptablesStart "$protocol" "$portno" "$ip" "$direction" "$action"
|
|
@@ -765,7 +819,6 @@
|
|
;;
|
|
|
|
validate-all)
|
|
- IptablesValidateAll
|
|
;;
|
|
|
|
*) usage
|