makedhcp using the Kea backend fails for any node whose mac table entry
uses the *NOIP* sentinel to mark a secondary NIC that has no IP address
(e.g. "mac1|mac2!*NOIP*|mac3!*NOIP*"). kea_node_reservations() and
kea_node_reservations6() split each NIC's hostname and pass it straight
to getipaddr(), so the literal string "*NOIP*" is treated as a host to
resolve. It cannot resolve, and the reservation is reported as unresolved
-- which aborts the whole makedhcp run, leaving the node with no Kea
reservation at all and therefore no DHCP lease.
This breaks provisioning on distros that use the Kea backend (e.g. EL10,
which has no ISC dhcp-server): the node never gets an address and is
unreachable, while the ISC backend has always handled *NOIP* and is
unaffected.
Skip *NOIP* NICs in both the DHCPv4 and DHCPv6 reservation builders, the
same way the ISC path does -- there is no address to reserve for them.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit 9125d4da3c)
Goconserver.pm shells out to `service goconserver start|stop|restart` (and
`service conserver stop`). That command is provided by the initscripts package,
which is NOT installed on a minimal EL9/EL10 management node -- there, every one
of these calls fails with rc!=0.
The damaging case is restart_service(). makegocons calls build_conf(), which
rewrites /etc/goconserver/server.conf with the cert-enabled configuration
(global.ssl_key_file/ssl_cert_file/ssl_ca_cert_file), and then calls
restart_service() so the daemon picks it up. When the restart fails, xCAT only
logs "Could not restart goconserver service." and the daemon keeps running with
the configuration it read at boot -- the packaged default, which has no ssl_*
fields. goconserver's TLS is gated on those fields being set (sslEnable stays
false), so it silently serves plain HTTP on the api port while Goconserver.pm
always talks to it over https. Every subsequent request then dies with
SSL connect attempt failed error:0A0000C6:SSL routines::packet length too long
so makegocons/makegocons -d report "Failed to send delete request." and the
console can never be registered. On EL8 the bug is invisible because initscripts
happens to be installed there.
Use the xCAT::Utils service helpers (startservice/stopservice/restartservice),
which resolve the unit through servicemap() and issue `systemctl <action> <unit>`
on systemd hosts, falling back to `service`/`initctl` only where appropriate.
This is the same mechanism the rest of the tree (AAsn.pm and friends) already
uses for named, dhcpd, nfs and others.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit b42bbe0e02)
envvar() resolves a template variable purely from %ENV, so a template that
references $XCATROOT expands to an empty string whenever XCATROOT is not
present in the environment of the process doing the substitution. $::XCATROOT
is set as a package global at module load and is reliably available, so use it
for that one variable before falling back to %ENV.
Recovered from the unmerged lenovobuild branch (original da72c6b8).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
(cherry picked from commit 34866ebc23)
`ip -6 route` output for ECMP/multipath routes carries `nexthop` continuation
lines, and a `default` route has no network prefix. donets() treated both as
networks and added bogus entries to the networks table. Skip them alongside
the existing link-local/unreachable/via/lo filtering.
Recovered from the unmerged lenovobuild branch (original 7094ba0c).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
(cherry picked from commit c97e973f36)
donets() only skips the exact address 'fe80::/64' when scanning routes, so a
link-local route with any other prefix (e.g. a longer fe80:: subnet) is added
to the networks table as a bogus network. Match any fe80:: prefix instead of
the single literal value.
Recovered from the unmerged lenovobuild branch (original 8b79cf85).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
(cherry picked from commit d2be0c3865)
nodech's ^= operator removed only a single literal value, so
"nodech n1 groups^=a,b" tried to strip the combined string "a,b" and left the
individual groups in place. Split the value on commas and remove each piece.
Recovered from the unmerged lenovobuild branch (original 95c78b33).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
(cherry picked from commit f71ddef6ba)
nodech's ,= operator appended the whole right-hand side as one value, so
"nodech n1 groups,=a,b" added the literal "a,b" and its duplicate check only
compared against that combined string. Split the value on commas and add each
piece individually, skipping any already present.
Recovered from the unmerged lenovobuild branch (original 086b0c0d).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
(cherry picked from commit 6e33661fc0)
getzonesfornet() derives the number of reverse-zone nibbles as
$nibbs = $maskbits / 4, then decrements it once per hex nibble of the network
prefix. For a sub-nibble (not 4-bit-aligned) IPv6 mask $nibbs can go negative
before the padding loop, and `while ($nibbs)` then never terminates: it keeps
decrementing past zero while appending "0." to $rev, spinning forever and
growing the string until the process is killed.
Make the padding loop `while ($nibbs > 0)` so it can never run away, and
return early only when $nibbs is genuinely negative. $nibbs == 0 is the normal
nibble-aligned case (e.g. a /64) and must still emit its reverse zone.
Recovered from the unmerged lenovobuild branch (original 0e070cd2). The
original guarded with `$nibbs < 1`, which also dropped the valid $nibbs == 0
case and left standard /64 subnets with no reverse zone; corrected to
`$nibbs < 0` after lab validation on a real provisioning cluster.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
(cherry picked from commit f0a879491d)
mknb writes the compressed genesis filesystem by streaming cpio output
straight onto the final path in $tftpdir/xcat (genesis.fs.$arch.lzma or .gz).
When two mknb/nodeset runs target a shared $tftpdir at once, one run reads or
overwrites the other's half-written image, producing a corrupt genesis.fs and
failed netboots.
Write each image to a uniquely-suffixed temporary file
(xCAT::Utils::genpassword(24)) and File::Copy::move() it into place. move()
within the same directory is a rename, so the final path only ever appears
complete. Both modules are already imported by mknb.pm.
Recovered from the unmerged lenovobuild branch (originals c651e7b8 and its
fix da0723f2, which switched the suffix to genpassword after the first
attempt only produced a single character). master lacks the branch's xz
path, so only the lzma and gzip paths are adjusted here.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
(cherry picked from commit 6da5efd29a)
Modern x86-64 UEFI firmware (including OVMF and recent iPXE) reports DHCP
client architecture 00:07, but the xNBA network-boot conditionals only matched
00:09. A UEFI node would load xnba.efi, re-request with user-class xNBA and
arch 00:07, fail to match, and be handed xnba.efi again -- an endless boot
loop. Accept 00:07 alongside 00:09 in the xNBA UEFI branches of both the
network-level (addnet) and node-level (addnode) dhcpd statements.
Validated on an OVMF UEFI client: it progresses from xnba.efi to the .uefi
genesis config and boots, instead of looping on xnba.efi.
Recovered from the unmerged lenovobuild branch (5d697b5c, 86b0e12e).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
(cherry picked from commit 60bd6e7cd9)
The DNS-managed-networks check used my_ip_facing($net->{net}), which only
returns local addresses on the interface directly facing that network. A
nameserver that is a local address reachable via a different (routed)
interface was therefore treated as external, and the network was wrongly
dropped from ddns management.
Use thishostisnot(), which recognizes any local address regardless of the
interface, and keep the existing <xcatmaster> and site-nameserver special
cases.
Recovered from the unmerged lenovobuild branch (original 3c343f83), adapted
to preserve those special cases: lab validation showed the original replaced
them wholesale, which would exclude any network whose nameserver is the
literal <xcatmaster> token (thishostisnot('<xcatmaster>') is true).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
(cherry picked from commit a0dfc3343a)
ddns.pm's DNS-update send has a 3-try retry loop, but it only retried on
NOTAUTH and -- on the final attempt -- the `next` fell out of the loop without
reporting failure. makedns then printed "Completed updating DNS records." and
"DNS setup is completed" even when the update was never accepted.
Two problems this causes:
- SERVFAIL was never retried. named routinely replies SERVFAIL transiently
right after a zone (re)load, before the zone is ready to accept dynamic
updates; the update succeeds a second or two later. This reliably breaks real
flat-cluster provisioning on el9/el10, where the test case's makedns -n runs
right after named reloads the zone with the new compute node.
- A persistent NOTAUTH/SERVFAIL (retries exhausted) was silently swallowed and
reported as success, so a genuinely failed DNS update looked like it worked.
Extract the batch send into send_ddns_update(), which retries NOTAUTH and
SERVFAIL (pausing on SERVFAIL), returns 0 only on NOERROR, and otherwise emits
the error and returns 1. Both batch-send sites now `return 1 if
send_ddns_update(...)`, so a real failure aborts add_or_delete_records instead
of falsely reporting success.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit 9dd025bf05)
build_xmldesc only recognised cpumodel "ppc64" (big-endian) when deciding to set
<os type arch='ppc64' machine='pseries'>, but ppc64le hosts report cpumodel
"ppc64le" (virNodeGetInfo model). A guest on a ppc64le hypervisor was therefore
emitted as an x86-style domain -- no machine type and with pae/acpi/apic -- and
libvirt rejected it: "machine type 'pseries-*' does not support ACPI".
Recognise "ppc64le" alongside "ppc64" for the arch/machine block, and omit the
x86-only pae/acpi/apic features on both. Little- and big-endian pseries guests
both use libvirt <os> arch "ppc64".
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit 37666b92cd)
The Ubuntu live-server ISO copycds imports is not a complete apt pool, so
both Ubuntu install paths fail without an external mirror: the netboot
genimage's debootstrap from the ISO-only pkgdir cannot resolve packages,
and the Subiquity diskful install (Template.pm) fell back to the airgapped
file:///cdrom config. Default site.ubuntu_apt_mirror to
http://archive.ubuntu.com/ubuntu when unset (overridable for local/geo/
ports mirrors). In the Ubuntu genimage, when pkgdir has no http mirror,
build the debootstrap source and chroot sources.list from that mirror with
the codename derived from osvers and the release/-updates/-security pockets
(main + universe) -- the compute pkglist needs universe (busybox-static,
dracut*) and the security-updated openssh. Ubuntu-only; EL netboot
(netboot/rh) and copycds/packimage are untouched.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit 03e1559989)
The Ubuntu live-server install media is not a complete apt package mirror.
With the generated apt configuration pinned to the media only, an install that
needs a package absent from the media stalls instead of fetching it. Emit an
online-mirror apt configuration when one is configured (site.ubuntu_apt_mirror)
so missing packages are retrieved from the archive; offline behaviour is
unchanged when it is unset.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
(cherry picked from commit 846e611772)
When all addkcmdline options have R:: prefix (persistent options for
the installed OS), the volatile check in xnba.pm and pxe.pm would fail
because volatile was undefined. This left the original R::-prefixed
string in the netboot config instead of stripping it.
The fix ensures we always use the volatile portion after calling
splitkcmdline, even if it's empty. Persistent (R::) options are
handled separately by Template.pm via PERSKCMDLINE for the installed
OS bootloader.
Fixes#7442
The activenics{"!remote!"} hash key is checked at line 1940 but never
set by any code path — neither the dhcpinterfaces parsing nor the
querynics discovery populates it. This causes the guard to always
evaluate true, hitting next and silently skipping every !remote!
network when dhcpinterfaces is defined in the site table or on a
service node.
Remove the dead check so remote networks are processed correctly.
The inner activenics{$netif} check (which uses the actual interface
name after stripping the !remote! prefix) is the correct guard and
is preserved.
Original analysis by lebonez in xcat2/xcat-core#7242.
Co-authored-by: Lebonez <25910791+lebonez@users.noreply.github.com>
Add a shared OMAPI policy helper for ISC DHCP and DDNS so administrators can select the key name, signing algorithm, and omshell path from the site table while preserving the existing xcat_key hmac-md5 default.
Keep local ISC updates from hanging indefinitely when omshell does not exit, and use a static host-declaration fallback for local Ubuntu ISC releases where omshell is unstable for xCAT host updates.
Co-authored-by: gskouson <1507929+gskouson@users.noreply.github.com>
OpenBMC BMCs intermittently return 503 Service Unavailable when the
REST service is busy or recovering. xCAT reported the error immediately,
requiring the user to manually retry. A second attempt usually succeeds.
Retry the same request up to 3 times with a 3-second wait on 503.
If all retries fail, report the error as before. The existing 504
handling for bmcreboot is preserved.
Ref: #4264
Extend the existing sha256-to-sha1 fallback (already present in
got_rmcp_response for Open Session errors) to also cover RAKP2
rejections with "Unauthorized name" (0x0d) or "Invalid role" (0x09).
Ref: #7511
Set bit 4 (0x10) of the requested privilege byte in RAKP Message 1
for name-only user lookup, matching ipmitool behavior. Use the same
value consistently in all HMAC calculations (RAKP2 verification,
RAKP3 auth code, SIK derivation).
Without this, some BMCs fail user lookup with "Unauthorized name"
even though the credentials are correct.
Ref: #7511
OpenBMC-based BMCs return message tag 0 in RAKP2/RAKP4 instead of
echoing the tag from the request. xCAT rejected these as stale
responses and retried indefinitely until timeout.
Accept tag 0 but verify the remote console session ID in the response
matches our current sidm. This prevents stale retries from corrupting
session state while allowing OpenBMC responses through.
Applied to got_rmcp_response, got_rakp2, and got_rakp4.
Ref: #7511
cbc_pad in decrypt mode reads the last byte as the pad count, then
calls splice(@block, 0 - $count). If decrypted data is corrupt, the
pad count can exceed the array size, crashing with "Modification of
non-creatable array value attempted, subscript -16".
Return empty string on invalid padding so the caller treats it as a
decryption failure rather than accepting corrupted data as a valid
IPMI response.
Ref: #7511
Vinícius Ferrão
Daniel Hilst
xcat2-backport-automation[bot]
Vinícius Ferrão
Markus Hilger