conserver-xcat version

[kcgthb]

Hi!

I've noticed that upstream Conserver is version 8.2.1 (from June 2015), while the xCAT provided conserver-xcat is version 8.1.6.

Is there a specific reason for this, or a reason that would prevent from upgrading it? Is conserver-xcat modified or different from the upstream version? Is there anything that would prevent from using the upstream version instead of a xCAT-specific one? Conserver is packaged in many distributions these days.

Thanks.

[whowutwut]

Hi @kcgthb I'm not sure if there's a specific reason we have not moved up. It might just be the fact that we did not want to re-package the xcat dependencies. @zet809 Can you take a look into this? If the os provides the package, maybe we should consider dropping it from our dependency package and just use the one with the OS.

[chenglch]

I have compared the source code from diff files of xcat-dep/conserver with the code from upstream version. The changes about sslauthority related is not included.

[kcgthb]

Thanks @chenglch. Do you think the sslauthority patch could be applied or ported to version 8.2.1? That would allow to upgrade and the conserver-xcat version too.

I'm currently trying to debug an issue where the output of consoles via rcons/wcons becomes corrupted (garbled output) after some time, and I want to make sure that the version that xCAT ships does not miss a fix that would correct this. And there have been quite a number of changes between 8.1.6 and 8.2.1.

[chenglch]

Hi @kcgthb , thanks for your effort to debug the console issue. Is it possible to provide more information about the issue so that we can see whether it can be recreated locally ?

For the conserver patches, xcat should apply the upstream changes and add our new patch for sslauthority, and then build packages for different platform, this can not be completed very soon.

Could you try the newer version of conserver without sslauthority configuration manually at first? If it solve your issue, we can try to locate where the error is and then make plans to upgrade to the new version.

[kcgthb]

The issue I'm tracking down is that after some time, the output of consoles becomes illegible (non printable characters all over). The machines are Dell servers with iDRAC BMC controllers, and the IPMI serial-over-LAN console works great otherwise.

What makes me think that the issue is with conserver rather than the BMC controllers is that when the console output is garbled in rcons, connecting to the console directly with ipmitool sol activate works correctly. And restarting conserver also resolves the issue.

I was gonna test the upstream version to see if it resolves the issues, but was wondering about any xCAT-specific modifications. Thanks for looking for differences in details.

What are those sslauthority patches for exactly? They are quite old (9 years), are they still required for recent xCAT versions? Recent Conserver versions have support for sslcacertificatefile options and the like, could those be used instead?

Anyway, I'll try the regular conserver version and report back.

Thanks!

[chenglch]

Thinks for your information.
Our patch file is https://github.com/xcat2/xcat-dep/blob/master/conserver/certificate-auth.patch

I checked it again, you are right, this patch has been included but its name is sslcacertificatefile now. We will check conserver package in different OS and change the code of xcat accordingly.

[kcgthb]

Excellent, thank you!

[kcgthb]

Hi!
So, I tried to replace my conserver-xcat installation by conserver and conserver-client (version 8.2.1, from EPEL), and it seems to be working fine.
The only change I had to make was to replace the sslauthority keyword by sslcacertificatefile in both /etc/conserver.cf and ~/.consolerc:

--- /etc/conserver.cf.orig      2017-05-30 09:28:13.557417273 -0700
+++ /etc/conserver.cf   2017-05-30 09:27:36.054214843 -0700
@@ -11,7 +11,7 @@
 }
 config * {
   sslrequired yes;
-  sslauthority /etc/xcat/cert/ca.pem;
+  sslcacertificatefile /etc/xcat/cert/ca.pem;
   sslcredentials /etc/xcat/cert/server-cred.pem;
 }
 default cyclades { type host; portbase 7000; portinc 1; }

--- /root/.consolerc.orig       2017-05-30 09:26:44.790938183 -0700
+++ /root/.consolerc    2017-05-30 09:26:25.316833097 -0700
@@ -1,6 +1,6 @@
 config * {
       port 782;
       sslenabled yes;
-      sslauthority /root/.xcat/ca.pem;
+      sslcacertificatefile /root/.xcat/ca.pem;
       sslcredentials /root/.xcat/client-cred.pem;
 }

Other than that, it looks ok.

[kcgthb]

Looks like the change of SSL options syntax affected some users: https://sourceforge.net/p/xcat/mailman/xcat-user/thread/3DCC7A4E-F88D-4BA2-8387-588E3799894D%40brown.edu/#msg35907923

[whowutwut]

Yea, we updated the version into xcat dep for the upcoming 2.13.5 release at the end of this month so we could test some things. Unfortunately we don't have a repo fixed to version specific like we do for xcat core so the public yum repo becomes effective serving the updated version. Will see what Cheng long says

[chenglch]

@whowutwut , the online repo for xcat-dep is the latest one, we must switch it to point to the xcat-dep for 2.13.4 until xcat 2.13.5 is released. xcat-core for 2.13.4 can not work with the latest xcat-dep.

[zet809]

I agree with you that we shall also have a xcat-dep devel on-line repo, we can use the repo before a new xCAT version is released.
Since we will release 2.13.5 next Friday, for the user's issue, I suggest to work around it with:

1. Download 2.13.4 xcat-dep tar ball from https://xcat.org/files/xcat/xcat-dep/2.x_Linux/xcat-dep-2.13.4-linux.tar.bz2
2. Extract it and go to the correct sub directory for his OS+arch
3. Force to install it with "rpm -U -v -h --force /path/to/conserver-xcat-8.1.16-10.ppc64le.rpm"

[daniceexi]

If user install xcat 2.13.4 offline, then he/she should download the corresponding xcat dep which is indicated i n the 2.13.4 release notes. The problem happens when customer want to install xcat 2.13.4 from online repo, for we just have one online repo for dep.
Even after we released 2.13.5. What if customer want to install the latest version of 2.12.x from online repo?

[whowutwut]

@daniceexi we need to create more repos for this support

I opened xcat2/xcat-core#3322 to track this issue