RDE reference implementation causing split brain

[marioa]

Reference implementation for RDE is not robust enough, relying on timers/timeouts, and causing often split brain situations (both controllers actives or both standby).

See mail discussion:
http://list.opensaf.org/pipermail/devel/2008-August/001150.html

Fix could look like:
- having epoch counter that increments each time a TCP connection has been established with peer RDF
- then when controller establish connection one with larger epoch number (larger history) will be active
- if two epoch numbers are same one with smaller OpenSAF node number will be active

[anonymous]

Besides cases of both controllers becoming active or both becoming standby, there is
the case of the currently active going down and comming back up quickly enough that the
current standby did not react. In this case the restarted active will becomme active again.
The problem here is twofold:
1) The standby is too slow in reacting to the loss of the active;
2) The RDE negotiation is not reliable, allowing the restarted active to resume as active

regardless of the (sync) state of the standby.

I would recommend using tipc as the mechanism for detecting loss of peer,
in any new RDE reference implementation. If not, then a good explanation of why not
is needed.

[anders.bjornerstedt@…]

I was the "anonymous" contributor in the prior change.

Anders Bjorenrstedt