Bug 592736

Summary: Cannot use discovery mode with the update option
Product: Red Hat Enterprise Linux 5 Reporter: Vladik Romanovsky <vromanov>
Component: iscsi-initiator-utilsAssignee: Mike Christie <mchristi>
Status: CLOSED ERRATA QA Contact: Red Hat Kernel QE team <kernel-qe>
Severity: high Docs Contact:
Priority: high    
Version: 5.5CC: abaron, coughlan, cpelland, mchristi, mkenneth, raud, rmusil, sander, sgrinber
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 602899 (view as bug list) Environment:
Last Closed: 2011-01-13 22:58:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 591641, 602899, 604649    

Description Vladik Romanovsky 2010-05-16 15:35:19 UTC
Hi,

According to iscsiadm.c, a discovery mode with an update option, that changes the discovery.sendtargets.auth.authmethod to CHAP, is not allowed by verify_mode_params():

...

case MODE_DISCOVERY:
 		if ((rc = verify_mode_params(argc, argv, "SIPdmtplo", 0))) { 
                // options v,n are missing 
 			log_error("discovery mode: option '-%c' is not "
 				  "allowed/supported", rc);
 			rc = -1;
 			goto out;
 		}


Moreover, an update method is not implemented for a discovery mode in opposite to the iscsiadm documentation page. 

iscsiadm -m discovery [ -hV ] [ -d debug_level ] [ -P printlevel ] [ -I iface -t type -p ip:port [ -l ] ] | [ -o operation ] [ -n name] [ -v value ]

This behaviour is preventing vdsm to discover targets with chap authentication.
for example: iscsiadm -m discovery -p 10.35.17.244:3260 -o update -n discovery.sendtargets.auth.authmethod -v CHAP

Thanks,

Vladik

Comment 2 Mike Christie 2010-05-17 21:29:06 UTC
This command is added upstream:

http://git.kernel.org/?p=linux/kernel/git/mnc/open-iscsi.git;a=commit;h=3bb88ea9be814a2f598cf6f1d1fcdbc2f57ff0a8

Adding devel ack to bring in change for RHEL 5.6.

Comment 3 Mike Christie 2010-05-17 21:37:51 UTC
(In reply to comment #0)

> Moreover, an update method is not implemented for a discovery mode in opposite
> to the iscsiadm documentation page. 
> 
> iscsiadm -m discovery [ -hV ] [ -d debug_level ] [ -P printlevel ] [ -I iface
> -t type -p ip:port [ -l ] ] | [ -o operation ] [ -n name] [ -v value ]
> 

-o for iscsiadm discovery is supported, but not all the flags are.


So what users had normally done (and what can be done if this is not okd for 5.5.z) is just edit the iscsid.conf settings's

#node.session.auth.authmethod = CHAP

# To set a CHAP username and password for initiator
# authentication by the target(s), uncomment the following lines:
#node.session.auth.username = username
#node.session.auth.password = password

run iscsiadm discovery command. Then if you have other targets you need to do discovery to repeat the operation. Or if you needed to change a CHAP setting then you can edit iscsid.conf again and run the discovery command.

Comment 4 Vladik Romanovsky 2010-05-17 22:34:35 UTC
(In reply to comment #3)

Hi, 

The only available options for discovery, currently, are show and delete, Update is missing, which is in opposite to the man page.

Moreover, each host should be able to discover and login to more then one target, while each of these targets can be configured with different authentication method or/and credentials.
   
According to the above and the fact that discovery is being sent by RHEVM to the VDSM service on the host, we will have to change the config file and restart the iscsid service for each discovery attempt, in case these flags wont be included for a discovery mode. 

Thanks,

Vladik

Comment 5 Mike Christie 2010-05-18 01:13:54 UTC
(In reply to comment #4)
> 
> According to the above and the fact that discovery is being sent by RHEVM to
> the VDSM service on the host, we will have to change the config file and
> restart the iscsid service for each discovery attempt, in case these flags wont


Why do you think you have to restart the iscsi service? You should not have to do that. You do not have to run this like RHEL4's linux-iscsi based initiator.

Comment 6 Vladik Romanovsky 2010-05-20 06:10:12 UTC
(In reply to comment #5)
> (In reply to comment #4)
> > 
> > According to the above and the fact that discovery is being sent by RHEVM to
> > the VDSM service on the host, we will have to change the config file and
> > restart the iscsid service for each discovery attempt, in case these flags wont
> 
> 
> Why do you think you have to restart the iscsi service? You should not have to
> do that. You do not have to run this like RHEL4's linux-iscsi based initiator.    

Hi,

Maybe we are missing something.. 
But making changes in iscsid.conf, without restarting the iscsid service, dosn't apply and the discovery fails (on RHEL5.5). Moreover, there is no reload option as well for this service.


Thanks,
Vladik

Comment 7 Mike Christie 2010-05-21 03:39:49 UTC
(In reply to comment #3)
> #node.session.auth.authmethod = CHAP
> 
> # To set a CHAP username and password for initiator
> # authentication by the target(s), uncomment the following lines:
> #node.session.auth.username = username
> #node.session.auth.password = password
> 

Maybe I caused some confusion with this comment. You were talking about changing discovery.sendtargets.* settings with the
iscsiadm -m discovery -p x -o update -n .. -v .., and above I cut and paste the node.session values. I meant to write the dicscovery ones like this:

#discovery.sendtargets.auth.authmethod = CHAP

# To set a discovery session CHAP username and password for the initiator
# authentication by the target(s), uncomment the following lines:
#discovery.sendtargets.auth.username = username
#discovery.sendtargets.auth.password = password




(In reply to comment #6)
> Maybe we are missing something.. 
> But making changes in iscsid.conf, without restarting the iscsid service,


I am not even sure how restarting the iscsid service is picking up new settings for discovery sessions.


Restarting the iscsid service does not pickup any iscsid.conf changes for discovery or normal sessions. It will pick up new /var/lib/iscsi/nodes values for normal sessions when iscsid is restarted, but that does nothing for discovery sessions.



Just to make sure we are talking about the same thing, are you saying you have to do service iscsid restart so new iscsid.conf settings take effect on discovery sessions when you run iscsiadm -m discovery .... commands or are you saying you have to do restart for new settings to be picked up for normal sessions (normal sessions are the session we access disks though. They are the ones you see when you run iscsiadm -m session)?



iscsiadm -m discovery ...... will read iscsid.conf, and apply the settings in there to the discovery session (I mean it will use discover.sendtargets.* settings in iscsid.conf for the discovery session login and that finding target), and it will use the node.* settings to setup the /var/lib/liscsi/nodes records for the targets that are found. It will overwrite the /var/lib/iscsi/nodes records for targets found with the new settings and it will overwrite the /var//lib/sendtargets record for the discovery portal with the new settings in iscsid.conf.


iscsiadm -m ...... -login (this is also run when you do service iscsid start) will read the /var/lib/iscsi/nodes settings and use them.

If there are sessions running when /sbin/iscsid is run (like it would be done when iscsid restart is run) it will read /var/lib/iscsi/nodes for running sessions and use them for running sessions.



So if you mean you edit iscsid.conf then have to do service iscsid restart to pick up iscsid.conf settings then I have no idea what is going on. It should not be working like this, because iscsiadm and the iscsid init script and iscsid do not read from there. iscsiadm and iscsid reads from /var/lib/iscsi/nodes for normal sessions.


If you mean you edit iscsid.conf, run iscsiadm -m discovery ..., then restart iscsid service so normal sessions get the new values than that makes sense, and I should have been more clear. I should have said you have to run the iscsiadm logout and login command after running the discovery command. So you have to do:

1. edit iscsid.conf
2. iscsiadm -m discovery ....
3. iscsiadm -m .... --logout
4. iscsiadm -m .... --login



However, if this whole time you have wanted node.* settings to be updated for normal sessions without having to login/logout, then the patch in comment #2 will not help. That patch just updates the /var/lib/iscsi/send_targets record for the discovery portal. You have to then run iscsiadm -m discovery .... to use that new value in a discovery session. *And* the problem is that the command you mention in the bz description does not do anything for normal sessions (you have to run the iscsiadm -m node -o update ... command to update the /var/lib/iscsi/nodes values (you could also run the discovery command because as I mentioned above it will rebuild the db, and then you have to logout and login of a session or you could do the iscsid restart). It only updates the discovery record.

If you wanted to be able to update iscsid.conf and then have it affect a running normal sessions setting let me know. It will be more work and require some kernel changes.


If you just wanted the discovery settings to get updated like is done with the command you mentioned in the bz description, then send the exact commands and sequence you are running, because this would be another bug to fix. Doing something like

1. edit iscsid.conf
2. cp /var/lib/iscsi/send_targets/20.15.0.9,3260/st_config st_config.orig
3. iscsiadm -m discovery -p 20.15.0.9,3260 -o delete // note you do not have this do this now but you should.
4 iscsiadm -m discovery -t st -p 20.15.0.9
5. diff st_config.orig /var/lib/iscsi/send_targets/20.15.0.9,3260/st_config

should show differences in the discovery settings.

Comment 8 Mike Christie 2010-05-21 03:49:35 UTC
(In reply to comment #7)
I should have said you have to run the iscsiadm
> logout and login command after running the discovery command. So you have to
> do:
> 
> 1. edit iscsid.conf
> 2. iscsiadm -m discovery ....
> 3. iscsiadm -m .... --logout
> 4. iscsiadm -m .... --login

Ooops, I mean

1. edit iscsid.conf
2. iscsiadm -m discovery ....
3. service iscsid restart

The 3 and 4 in the above comment would work too but that would kill IO to the disks.

Comment 9 Ayal Baron 2010-05-27 11:18:48 UTC
(In reply to comment #7)
> (In reply to comment #3)
> > #node.session.auth.authmethod = CHAP
> > 
> > # To set a CHAP username and password for initiator
> > # authentication by the target(s), uncomment the following lines:
> > #node.session.auth.username = username
> > #node.session.auth.password = password
> > 
> 
> Maybe I caused some confusion with this comment. You were talking about
> changing discovery.sendtargets.* settings with the
> iscsiadm -m discovery -p x -o update -n .. -v .., and above I cut and paste the
> node.session values. I meant to write the dicscovery ones like this:
> 
> #discovery.sendtargets.auth.authmethod = CHAP
> 
> # To set a discovery session CHAP username and password for the initiator
> # authentication by the target(s), uncomment the following lines:
> #discovery.sendtargets.auth.username = username
> #discovery.sendtargets.auth.password = password
> 
> 
> 
> 
> (In reply to comment #6)
> > Maybe we are missing something.. 
> > But making changes in iscsid.conf, without restarting the iscsid service,
> 
> 
> I am not even sure how restarting the iscsid service is picking up new settings
> for discovery sessions.
It's not, and that is not the issue at all.
> 
> 
> Restarting the iscsid service does not pickup any iscsid.conf changes for
> discovery or normal sessions. It will pick up new /var/lib/iscsi/nodes values
> for normal sessions when iscsid is restarted, but that does nothing for
> discovery sessions.
> 
> 
> 
> Just to make sure we are talking about the same thing, are you saying you have
> to do service iscsid restart so new iscsid.conf settings take effect on
> discovery sessions when you run iscsiadm -m discovery .... commands or are you
> saying you have to do restart for new settings to be picked up for normal
> sessions (normal sessions are the session we access disks though. They are the
> ones you see when you run iscsiadm -m session)?
neither, please forget the restart issue, it was a mistake.

The only issue we have is that according to the doc, iscsiadm should support chap for sendTargets discovery but doesn't.

Comment 10 Mike Christie 2010-05-28 00:18:43 UTC
> The only issue we have is that according to the doc, iscsiadm should support
> chap for sendTargets discovery but doesn't.    

I just want to clarify this because people search our bugzilla and I do not want them to get misinfo.

iscsiadm does support CHAP for sendtargets discovery as I described above.


iscsiadm does not support updating values like CHAP settings using the -o update command. The iscsiadm man page goes into more details about what discovery mode does with the update param. In older man pages in the -o/--op update section for iscsiadm it says it does not support update in discovery mode.


In newer versions we have this:

              update will update the recid with name to the  specified  value.
              In  discovery  node the recid, name  and value arguments are not
              needed.  The  update  operation  will  operate  on  the  portals
              returned  by  the  target,  and will update the record with info
              from the config file and command line.

Comment 11 Mike Christie 2010-06-16 08:12:27 UTC
Added new discovery2 mode in iscsi-initiator-utils-6.2.0.871-0.17.el5. This should give you want you want where you do not have to manipulate iscsid.conf each time you change a discovery setting.

To create a discovery record run:

iscsiadm -m discovery2 -t st -p ip:port -o new
(this creates a discovery record using the iscsid.conf settings as defaults in /var/lib/iscsi/send_targets/ip,port/st_config)

See record values:

iscsiadm -m discovery2 -t st -p ip:port -o show


See hidden values like CHAP passwords:

iscsiadm -m discovery2 -t st -p ip:port -o show --show


To modify the a setting for the record run :

iscsidm -m discovery2 -t st -p ip:port -o update -n name -v value

To discover targets using record settings:

iscsiadm -m discovery2 -t st -p ip:port --discover

Comment 15 Mike Christie 2010-07-11 10:27:43 UTC
This is fixed in iscsi-initiator-utils-6.2.0.871-0.18.el5. You can grab it here:
http://people.redhat.com/mchristi/iscsi/rhel5.6/iscsi-initiator-utils/

It is the same as before, but discovery2 mode is renamed to discoverydb mode. The return value bug should also be fixed.

Comment 19 errata-xmlrpc 2011-01-13 22:58:34 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0072.html