totemconfig: Make sure join timeout is less than consensus

The thesis contains this paragraph:

  "The Join timeout is shorter than the Consensus timeout and is used
   to increase the probability that Join messages from all currently
   working processors are received during a single round of
   consensus."

Empirically I can confirm that making join less than consensus can
cause havoc with a cluster so I think we should enforce this.

Signed-off-by: Christine Caulfield <ccaulfie@redhat.com>
Reviewed-by: Jan Friesse <jfriesse@redhat.com>

exec/totemconfig.c

@@ -636,6 +636,13 @@ int totem_config_validate (
 		goto parse_error;
 	}
 
+	if (totem_config->consensus_timeout < totem_config->join_timeout) {
+		snprintf (local_error_reason, sizeof(local_error_reason),
+			"The consensus timeout parameter (%d ms) may not be less than join timeout (%d ms).",
+			totem_config->consensus_timeout, totem_config->join_timeout);
+		goto parse_error;
+	}
+
 	if (totem_config->merge_timeout == 0) {
 		totem_config->merge_timeout = MERGE_TIMEOUT;
 	}