[v4_1_esv] Failover primary now accepts secondary updates from active to abandoned

Merges in rt25189.

.gitignore

@@ -24,6 +24,7 @@ server/dhcpd
 server/tests/dhcpd_unittests
 server/tests/hash_unittests
 server/tests/legacy_unittests
+server/tests/leaseq_unittests
 server/tests/load_bal_unittests
 server/tests/test-suite.log
 tests/libt_api.a

RELNOTES

@@ -144,6 +144,13 @@ by Eric Young (eay@cryptsoft.com).
   to Jiri Popelka at Red Hat for reporting the issue.
   [ISC-Bugs #39952]
 
+- A failover primary server will now accept a binding status update from the
+  secondary which transitions a lease from ACTIVE to ABANDONED. This accounts
+  for instances in which a client declines a lease and only the secondary
+  server receives it.  Prior to this the primary server would reject such an
+  update as an "invalid state transition".
+  [ISC_BUGS #25189]
+
 			Changes since 4.1-ESV-R12b1
 
 - None

server/failover.c

@@ -3,7 +3,7 @@
    Failover protocol support code... */
 
 /*
- * Copyright (c) 2004-2014 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2004-2016 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1999-2003 by Internet Software Consortium
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -5960,9 +5960,12 @@ normal_binding_state_transition_check (struct lease *lease,
 		   lease. */
 		if (state -> i_am == primary) {
 			/* Except that the client may send the DHCPRELEASE
-			   to the secondary, and we have to accept that. */
-			if (binding_state == FTS_RELEASED)
-				return binding_state;
+			   to the secondary.  We also allow for when the
+                           secondary gets a DECLINE and the primary does not.*/
+                        if ((binding_state == FTS_RELEASED) ||
+                            (binding_state == FTS_ABANDONED))
+                                return binding_state;
+
 			new_state = lease -> binding_state;
 			goto out;
 		}