#!/bin/sh
#
# (C) 2008 by Pablo Neira Ayuso <pablo@netfilter.org>
#
# This software may be used and distributed according to the terms
# of the GNU General Public License, incorporated herein by reference.
#
# Description:
#
# This is the script for primary-backup setups for keepalived
# (http://www.keepalived.org). You may adapt it to make it work with other
# high-availability managers.
#
# Modified by : Mohit Mehta <mohit@vyatta.com>
# Slight modifications were made to this script for running with Vyatta
# The original script came from 0.9.14 debian conntrack-tools package

CONNTRACKD_BIN=/usr/sbin/conntrackd
CONNTRACKD_LOCK=/var/lock/conntrack.lock
CONNTRACKD_CONFIG=/run/conntrackd/conntrackd.conf
FACILITY=daemon
LEVEL=notice
TAG=conntrack-tools
LOGCMD="logger -t $TAG -p $FACILITY.$LEVEL"
VRRP_GRP="VRRP sync-group [$2]"
FAILOVER_STATE="/var/run/vyatta-conntrackd-failover-state"

$LOGCMD "vyatta-vrrp-conntracksync invoked at `date`"

if ! systemctl is-active --quiet conntrackd.service; then
    echo "conntrackd service not running"
    exit 1
fi

if [ ! -e $FAILOVER_STATE ]; then
	mkdir -p /var/run
	touch $FAILOVER_STATE
fi

case "$1" in
  master)
  	echo MASTER at `date` > $FAILOVER_STATE
    $LOGCMD "`uname -n` transitioning to MASTER state for $VRRP_GRP"
    #
    # commit the external cache into the kernel table
    #
    $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -c
    if [ $? -eq 1 ]
    then
        $LOGCMD "ERROR: failed to invoke conntrackd -c"
    fi

    #
    # commit the expect entries to the kernel
    #
    $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -c exp
    if [ $? -eq 1 ]
    then
        $LOGCMD "ERROR: failed to invoke conntrackd -ce exp"
    fi

    #
    # flush the internal and the external caches
    #
    $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -f
    if [ $? -eq 1 ]
    then
        $LOGCMD "ERROR: failed to invoke conntrackd -f"
    fi

    #
    # resynchronize my internal cache to the kernel table
    #
    $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -R
    if [ $? -eq 1 ]
    then
        $LOGCMD "ERROR: failed to invoke conntrackd -R"
    fi

    #
    # send a bulk update to backups
    #
    $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -B
    if [ $? -eq 1 ]
    then
        $LOGCMD "ERROR: failed to invoke conntrackd -B"
    fi
    ;;
  backup)
  	echo BACKUP at `date` > $FAILOVER_STATE
    $LOGCMD "`uname -n` transitioning to BACKUP state for $VRRP_GRP"
    #
    # is conntrackd running? request some statistics to check it
    #
    $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -s
    if [ $? -eq 1 ]
    then
        #
        # something's wrong, do we have a lock file?
        #
        if [ -f $CONNTRACKD_LOCK ]
        then
            $LOGCMD "WARNING: conntrackd was not cleanly stopped."
            $LOGCMD "If you suspect that it has crashed:"
            $LOGCMD "1) Enable coredumps"
            $LOGCMD "2) Try to reproduce the problem"
            $LOGCMD "3) Post the coredump to netfilter-devel@vger.kernel.org"
            rm -f $CONNTRACKD_LOCK
        fi
        $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -d
        if [ $? -eq 1 ]
        then
            $LOGCMD "ERROR: cannot launch conntrackd"
            exit 1
        fi
    fi
    #
    # shorten kernel conntrack timers to remove the zombie entries.
    #
    $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -t
    if [ $? -eq 1 ]
    then
        $LOGCMD "ERROR: failed to invoke conntrackd -t"
    fi

    #
    # request resynchronization with master firewall replica (if any)
    # Note: this does nothing in the alarm approach.
    #
    $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -n
    if [ $? -eq 1 ]
    then
        $LOGCMD "ERROR: failed to invoke conntrackd -n"
    fi
    ;;
  fault)
  	echo FAULT at `date` > $FAILOVER_STATE
    $LOGCMD "`uname -n` transitioning to FAULT state for $VRRP_GRP"
    #
    # shorten kernel conntrack timers to remove the zombie entries.
    #
    $CONNTRACKD_BIN -C $CONNTRACKD_CONFIG -t
    if [ $? -eq 1 ]
    then
        $LOGCMD "ERROR: failed to invoke conntrackd -t"
    fi
    ;;
  *)
  	echo UNKNOWN at `date` > $FAILOVER_STATE
    $LOGCMD "ERROR: `uname -n` unknown state transition for $VRRP_GRP"
    echo "Usage: vyatta-vrrp-conntracksync.sh {master|backup|fault}"
    exit 1
    ;;
esac

exit 0