ClusterLabs / fence-agents

Fence agents
104 stars 160 forks source link

fence_scsi: fix registration handling if ISID conflicts #529

Closed smohanan20 closed 1 year ago

smohanan20 commented 1 year ago

Problem:

ISID (Initiator Session ID) which belongs to I_T Nexus, changes for RHEL based on the session ID that's used for iSCSI connections. This means that the connection to the same device can be set up with different ISID on reconnects.

If an iSCSI client establishes a connection with a device using an ISID (say X) and registers/reserves with the device using a key, the key is associated with the I_T nexus (with ISID X). Now if a device reconnects for some reason (like client reboots), it establishes a new iSCSI connection (with ISID Y) and fence agent tries to register again. However fence_scsi looks up the reservation key for the device, sees that it matches with the key and skips sending a new registration command assuming that the key belongs to it (ignoring the ISID).

Impact:

This can cause the iSCSI initiator to have no access to the device since it is not registered.

Proposed Fix:

To fix this, the agent needs to clear the old registration and register with the device based on what the active state of the registration/reservation is.

  1. If the client holds a reservation, the agent issues a PREEMPT request with the same key. The iSCSI target will replace the old entry with the new entry.
  2. If the client does not hold the reservation, the agent issues a PREEMPT request with the same key to remove the old registration. The agent sends another REGISTER command to register with the new ISID.

Both (1) and (2) are done in accordance with SCSI spec SPC3 - (1) Section 5.6.10.4.3 "Preempting persistent reservations and registration handling" Section and (2) Section 5.6.10.4.4 "Removing registrations".

If the ISID does not change across reboots, the fix has no impact since the preempt will insert a new entry anyway.

knet-ci-bot commented 1 year ago

Can one of the admins verify this patch?

oalbrigt commented 1 year ago

ok to test

oalbrigt commented 1 year ago

Thanks.