ctdb/config/events/legacy/10.interface.script

   1 #!/bin/sh
   2
   3 # Handle public IP address release and takeover, as well as monitoring
   4 # interfaces used by public IP addresses.
   5
   6 [ -n "$CTDB_BASE" ] ||
   7         CTDB_BASE=$(d=$(dirname "$0") && cd -P "$d" && dirname "$PWD")
   8
   9 . "${CTDB_BASE}/functions"
  10
  11 load_script_options
  12
  13 if ! have_public_addresses; then
  14         if [ "$1" = "init" ]; then
  15                 echo "No public addresses file found"
  16         fi
  17         exit 0
  18 fi
  19
  20 monitor_interfaces()
  21 {
  22         get_public_ifaces
  23
  24         down_interfaces_found=false
  25         up_interfaces_found=false
  26
  27         # Note that this loop must not exit early.  It must process
  28         # all interfaces so that the correct state for each interface
  29         # is set in CTDB using setifacelink.
  30         #
  31         # public_ifaces set by get_public_ifaces() above
  32         # shellcheck disable=SC2154
  33         for _iface in $public_ifaces; do
  34                 if interface_monitor "$_iface"; then
  35                         up_interfaces_found=true
  36                         $CTDB setifacelink "$_iface" up >/dev/null 2>&1
  37                 else
  38                         down_interfaces_found=true
  39                         $CTDB setifacelink "$_iface" down >/dev/null 2>&1
  40                 fi
  41         done
  42
  43         if ! $down_interfaces_found; then
  44                 return 0
  45         fi
  46
  47         if ! $up_interfaces_found; then
  48                 return 1
  49         fi
  50
  51         if [ "$CTDB_PARTIALLY_ONLINE_INTERFACES" != "yes" ]; then
  52                 return 1
  53         fi
  54
  55         return 0
  56 }
  57
  58 # Sets: iface, ip, maskbits
  59 get_iface_ip_maskbits()
  60 {
  61         _iface_in="$1"
  62         ip="$2"
  63         _maskbits_in="$3"
  64
  65         # Intentional word splitting here
  66         # shellcheck disable=SC2046
  67         set -- $(ip_maskbits_iface "$ip")
  68         if [ -n "$1" ]; then
  69                 maskbits="$1"
  70                 iface="$2"
  71
  72                 if [ "$iface" != "$_iface_in" ]; then
  73                         printf 'WARNING: Public IP %s hosted on interface %s but VNN says %s\n' \
  74                                 "$ip" "$iface" "$_iface_in"
  75                 fi
  76                 if [ "$maskbits" != "$_maskbits_in" ]; then
  77                         printf 'WARNING: Public IP %s has %s bit netmask but VNN says %s\n' \
  78                                 "$ip" "$maskbits" "$_maskbits_in"
  79                 fi
  80         else
  81                 die "ERROR: Unable to determine interface for IP ${ip}"
  82         fi
  83 }
  84
  85 ip_block()
  86 {
  87         _ip="$1"
  88         _iface="$2"
  89
  90         case "$_ip" in
  91         *:*) _family="inet6" ;;
  92         *) _family="inet" ;;
  93         esac
  94
  95         # Extra delete copes with previously killed script
  96         iptables_wrapper "$_family" \
  97                 -D INPUT -i "$_iface" -d "$_ip" -j DROP 2>/dev/null
  98         iptables_wrapper "$_family" \
  99                 -I INPUT -i "$_iface" -d "$_ip" -j DROP
 100 }
 101
 102 ip_unblock()
 103 {
 104         _ip="$1"
 105         _iface="$2"
 106
 107         case "$_ip" in
 108         *:*) _family="inet6" ;;
 109         *) _family="inet" ;;
 110         esac
 111
 112         iptables_wrapper "$_family" \
 113                 -D INPUT -i "$_iface" -d "$_ip" -j DROP 2>/dev/null
 114 }
 115
 116 ctdb_check_args "$@"
 117
 118 case "$1" in
 119 init)
 120         _promote="sys/net/ipv4/conf/all/promote_secondaries"
 121         get_proc "$_promote" >/dev/null 2>&1 ||
 122                 die "Public IPs only supported if promote_secondaries is available"
 123
 124         # Make sure we drop any IPs that might still be held if
 125         # previous instance of ctdbd got killed with -9 or similar
 126         drop_all_public_ips
 127         ;;
 128
 129 startup)
 130         monitor_interfaces
 131         ;;
 132
 133 shutdown)
 134         drop_all_public_ips
 135         ;;
 136
 137 takeip)
 138         iface=$2
 139         ip=$3
 140         maskbits=$4
 141
 142         update_my_public_ip_addresses "takeip" "$ip"
 143
 144         add_ip_to_iface "$iface" "$ip" "$maskbits" || {
 145                 exit 1
 146         }
 147
 148         # In case a previous "releaseip" for this IP was killed...
 149         ip_unblock "$ip" "$iface"
 150
 151         flush_route_cache
 152         ;;
 153
 154 releaseip)
 155         # Releasing an IP is a bit more complex than it seems. Once
 156         # the IP is released, any open TCP connections to that IP on
 157         # this host will end up being stuck. Some of them (such as NFS
 158         # connections) will be unkillable so we need to terminate
 159         # them. We also need to make sure that no new connections get
 160         # established while we are doing this.
 161         #
 162         # The steps are:
 163         #
 164         # 1) firewall this IP, so no new external packets arrive for it
 165         # 2) find existing connections, and kill them
 166         # 3) remove the IP from the interface
 167         # 4) remove the firewall rule
 168         shift
 169         get_iface_ip_maskbits "$@"
 170
 171         ip_block "$ip" "$iface"
 172
 173         kill_tcp_connections "$iface" "$ip"
 174
 175         update_my_public_ip_addresses "releaseip" "$ip"
 176
 177         delete_ip_from_iface "$iface" "$ip" "$maskbits" || {
 178                 ip_unblock "$ip" "$iface"
 179                 exit 1
 180         }
 181
 182         ip_unblock "$ip" "$iface"
 183
 184         flush_route_cache
 185         ;;
 186
 187 updateip)
 188         # Moving an IP is a bit more complex than it seems.  First we
 189         # drop all traffic on the old interface.  Then we try to
 190         # remove the IP from the old interface and add it to the new
 191         # interface.
 192         #
 193         # The steps are:
 194         #
 195         # 1) firewall this IP, so no new external packets arrive for it
 196         # 2) remove the IP from the old interface (and new interface, to be sure)
 197         # 3) add the IP to the new interface
 198         # 4) remove the firewall rule
 199         # 5) use ctdb gratarp to propagate the new mac address
 200         # 6) send tickle ACKs for existing connections, so dropped
 201         #    packets are resent
 202         _oiface=$2
 203         niface=$3
 204         _ip=$4
 205         _maskbits=$5
 206
 207         get_iface_ip_maskbits "$_oiface" "$_ip" "$_maskbits"
 208         oiface="$iface"
 209
 210         # Could check maskbits too.  However, that should never change
 211         # so we want to notice if it does.
 212         if [ "$oiface" = "$niface" ]; then
 213                 echo "Redundant \"updateip\" - ${ip} already on ${niface}"
 214                 exit 0
 215         fi
 216
 217         ip_block "$ip" "$oiface"
 218
 219         delete_ip_from_iface "$oiface" "$ip" "$maskbits" 2>/dev/null
 220         delete_ip_from_iface "$niface" "$ip" "$maskbits" 2>/dev/null
 221
 222         add_ip_to_iface "$niface" "$ip" "$maskbits" || {
 223                 ip_unblock "$ip" "$oiface"
 224                 exit 1
 225         }
 226
 227         ip_unblock "$ip" "$oiface"
 228
 229         flush_route_cache
 230
 231         # Propagate the new MAC address
 232         $CTDB gratarp "$ip" "$niface"
 233
 234         # Tickle all existing connections, so that dropped packets
 235         # are retransmitted and the tcp streams work
 236         tickle_tcp_connections "$ip"
 237         ;;
 238
 239 ipreallocated)
 240         # Just to make sure
 241         update_my_public_ip_addresses "ipreallocated"
 242         ;;
 243
 244 monitor)
 245         monitor_interfaces || exit 1
 246
 247         update_tickles
 248         ;;
 249 esac
 250
 251 exit 0