XCP-ng
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    XCP-ng 8.2 updates announcements and testing

    Scheduled Pinned Locked Moved News
    707 Posts 67 Posters 1.1m Views 86 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stormiS Offline
      stormi Vates 🪐 XCP-ng Team @gskger
      last edited by

      @gskger Thanks. Looks good 🙂

      1 Reply Last reply Reply Quote 0
      • stormiS Offline
        stormi Vates 🪐 XCP-ng Team
        last edited by stormi

        New security updates to test for 8.1 and 8.2

        Plus all the other update candidates queued for release if you haven't tested them yet (listed below).

        New update candidates are available for testing and due to be released as official updates very soon, as is usually the case for security updates.

        • kernel security update, protecting against host DoS (unresponsiveness or crash)
        • a fix for the network performance issues - mainly visible with FreeBSD VMs - caused by a previous security fix
        • a fix for Xen's crash analysis after a reboot
        • (8.2 only) the fixes described in this post

        Test on XCP-ng 8.2

        yum clean metadata --enablerepo=xcp-ng-testing
yum update bugtool-conn-tests kernel xcp-ng-release xcp-ng-release-config xcp-ng-release-presets xcp-python-libs xen-dom0-libs xen-dom0-tools xen-hypervisor xen-libs xen-tools xenserver-status-report --enablerepo=xcp-ng-testing
reboot

        Test on XCP-ng 8.1

        yum clean metadata --enablerepo=xcp-ng-testing
yum update kernel xen-dom0-libs xen-dom0-tools xen-hypervisor xen-libs xen-tools --enablerepo=xcp-ng-testing
reboot

        What to test

        The main goal is to avoid obvious regressions, so test whatever you want. The closer to your actual use of XCP-ng, the better.

        Test window before official release of the updates

        Between 24h and 48h.

        gskgerG J H 3 Replies Last reply Reply Quote 0
        • gskgerG Offline
          gskger Top contributor @stormi
          last edited by gskger

          @stormi Updated my two host playlab (8.2.0 fully patched, the third host currently serves as a Covid-19 homeoffice workstation) with no error. Rebooted and ran the usual tests (create, live migrate, copy and delete a linux and a windows 10 VM as well as create / revert snapshot (with/without ram) ). Fooled myself with a VM_LACKS_FEATURE error on the windows 10 VM until I realized that I forgot to install the Guest tools 🤕 - I need more sleep. Will try a restore after tonights backup.

          Edit: restore from backup worked as well 👍

          1 Reply Last reply Reply Quote 4
          • olivierlambertO Online
            olivierlambert Vates 🪐 Co-Founder CEO
            last edited by

            Thanks again @gskger

            At some point, you'll earn a "XCP-ng QA team" badge 😛

            gskgerG 1 Reply Last reply Reply Quote 1
            • gskgerG Offline
              gskger Top contributor @olivierlambert
              last edited by

              @olivierlambert It is a pleasure to help. I highly appreciate your teams work on making XCP-ng better and more secure as well as the support you give.

              1 Reply Last reply Reply Quote 2
              • J Offline
                jmccoy555 @stormi
                last edited by

                @stormi Only updated my test host so far, but all looks good to me.... no passthrough issues!!! 🙂

                Will try and update my pool over the weekend and run some FreeBSD speed tests before and after (been waiting for that patch to make it out into the world).

                J 1 Reply Last reply Reply Quote 3
                • H Offline
                  HeMaN @stormi
                  last edited by

                  @stormi said in Updates announcements and testing:

                  yum update bugtool-conn-tests kernel xcp-ng-release xcp-ng-release-config xcp-ng-release-presets xcp-python-libs xen-dom0-libs xen-dom0-tools xen-hypervisor xen-libs xen-tools xenserver-status-report --enablerepo=xcp-ng-testing

                  Updated both host in the pool (xcp-ng 8.2 fully patched), did my usual stuff and found no anomalities.
                  Looking good for me!

                  1 Reply Last reply Reply Quote 3
                  • stormiS Offline
                    stormi Vates 🪐 XCP-ng Team
                    last edited by

                    Many thanks to all testers. The updates have been published on Friday, along with the blog post: https://xcp-ng.org/blog/2021/02/26/february-2021-security-updates/

                    1 Reply Last reply Reply Quote 3
                    • J Offline
                      jmccoy555 @jmccoy555
                      last edited by

                      Updating my pool now.... quite a substantial speed increase on FreeBSD 😊

                      root@FILE001:~ # iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 64.0 KByte (default)
------------------------------------------------------------
[  4] local 10.10.1.125 port 5001 connected with 10.10.1.126 port 42952
[ ID] Interval       Transfer     Bandwidth
[  4]  0.0-10.1 sec   694 MBytes   576 Mbits/sec
^Croot@FILE001:~ # iperf -c 10.10.1.126
------------------------------------------------------------
Client connecting to 10.10.1.126, TCP port 5001
TCP window size:  105 KByte (default)
------------------------------------------------------------
[  3] local 10.10.1.125 port 50605 connected with 10.10.1.126 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.0 sec   202 MBytes   169 Mbits/sec
root@FILE001:~ # iperf -c 10.10.1.126
------------------------------------------------------------
Client connecting to 10.10.1.126, TCP port 5001
TCP window size: 80.8 KByte (default)
------------------------------------------------------------
[  3] local 10.10.1.125 port 45072 connected with 10.10.1.126 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.0 sec  4.06 GBytes  3.49 Gbits/sec
root@FILE001:~ # iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 64.0 KByte (default)
------------------------------------------------------------
[  4] local 10.10.1.125 port 5001 connected with 10.10.1.126 port 47101
[ ID] Interval       Transfer     Bandwidth
[  4]  0.0-10.0 sec  2.17 GBytes  1.86 Gbits/sec
^Croot@FILE001:~ #
                      1 Reply Last reply Reply Quote 2
                      • stormiS Offline
                        stormi Vates 🪐 XCP-ng Team
                        last edited by stormi

                        It's testing time again!

                        We changed the way we build the guest tools ISO and so we need as much feedback as we can get regarding the new guest tools. The main goal is to look for regressions. Details and feedback on https://xcp-ng.org/forum/topic/4378/new-guest-tools-iso-for-linux-and-freebsd-can-you-help-with-the-tests.

                        1 Reply Last reply Reply Quote 0
                        • stormiS Offline
                          stormi Vates 🪐 XCP-ng Team
                          last edited by stormi

                          New security updates to test for 8.1 and 8.2

                          New update candidates are available for testing and due to be released as official updates very soon, as is usually the case for security updates.

                          • kernel security and bugfix update, prevents DoS attacks from the guests and brings fixes to event handling.
                          • openvswitch security update, prevents malicious network traffic to cause packets to be dropped.
                          • Fixed ixgbe driver to avoid the memory leaks discussed at https://xcp-ng.org/forum/topic/2507/alert-control-domain-memory-usage

                          Test on XCP-ng 8.2

                          yum clean metadata --enablerepo=xcp-ng-testing
yum update kernel openvswitch openvswitch-ipsec intel-ixgbe --enablerepo=xcp-ng-testing
reboot

                          Note: this won't update openvswitch-ipsec if not present on the system, that is, unless you're using XO's private networks.

                          Test on XCP-ng 8.1

                          This will be the last security update for XCP-ng 8.1, whose end of life is officially today, March 31st.

                          yum clean metadata --enablerepo=xcp-ng-testing
yum update kernel openvswitch openvswitch-ipsec intel-ixgbe --enablerepo=xcp-ng-testing
reboot

                          What to test

                          The main goal is to avoid obvious regressions, so test whatever you want. The closer to your actual use of XCP-ng, the better.

                          Note: as the the code for event handling was changed, pay special attention to network performance in VMs, especially FreeBSD VMs since they are outside the scope of Citrix testing.

                          Test window before official release of the updates

                          Between 24h and 48h.

                          gskgerG 2 Replies Last reply Reply Quote 2
                          • gskgerG Offline
                            gskger Top contributor @stormi
                            last edited by gskger

                            @stormi Successfully updated my two host playlab (8.2.0 full patched, but with the new guest tools ISO). Rebooted both hosts and ran my usual test program (create, live migrate (without (only Debian) and with guest-tools installed (Debian 10 and Windows 10) avoiding the VM_LACKS_FEATURE error on Windows 10 - more sleep this time 😇 ), copy and delete as well as create / revert to snapshot (with/without ram) and (live/halted=shutdown) storage migration remote to local SR and back). Also restored a Debian 10 VM from a pre-update backup with no problem. Looks good 👍. Will see how backup runs tonight, but I am confident that this will work as well.

                            Edit #1: typos 🙄

                            Edit #2: Thanks to Xen Orchestra, out-of-band management even for Optiplex 9010s, a notebook and a very nice evening on the balcony, I extended my tests to Ubuntu 20 LTS. And you might guess it - works as well 😁

                            Edit #3: Deleted a subsequent post on an asyncMap is not defined error because it is not related to the security update.

                            1 Reply Last reply Reply Quote 2
                            • gskgerG Offline
                              gskger Top contributor @stormi
                              last edited by gskger

                              This post is deleted!
                              1 Reply Last reply Reply Quote 0
                              • T Offline
                                tzerod
                                last edited by

                                Tested new security patches on 8.2.

                                Network performance seems just fine. Have 4 Windows server 2019 and 2 Fedora Server VMs recording video feed. Haven't observed any difference in performance.

                                Supermicro SYS-1029U-TR4 with 768gig ram.
                                Network usage: about 400mbps constant.
                                ZFS

                                1 Reply Last reply Reply Quote 3
                                • J Offline
                                  jmccoy555
                                  last edited by jmccoy555

                                  Only updated one host in my pool so far, but it has my TrueNAS VM and network performance looks comparable ⭐

                                  edit:

                                  Actually quite an improvement in comparison to my results above

                                  root@FILE001:~ # iperf -c 10.10.1.126
------------------------------------------------------------
Client connecting to 10.10.1.126, TCP port 5001
TCP window size: 80.8 KByte (default)
------------------------------------------------------------
[  3] local 10.10.1.125 port 35576 connected with 10.10.1.126 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.1 sec  6.30 GBytes  5.36 Gbits/sec
root@FILE001:~ # iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 64.0 KByte (default)
------------------------------------------------------------
[  4] local 10.10.1.125 port 5001 connected with 10.10.1.126 port 54773
[ ID] Interval       Transfer     Bandwidth
[  4]  0.0-10.0 sec  3.57 GBytes  3.06 Gbits/sec

                                  Also done a VM reboot now and no passthrough issues 😄

                                  1 Reply Last reply Reply Quote 3
                                  • stormiS Offline
                                    stormi Vates 🪐 XCP-ng Team
                                    last edited by

                                    Just in time 🙂

                                    Updates now published: https://xcp-ng.org/blog/2021/04/01/april-2021-1st-security-bugfixe-update/

                                    J 1 Reply Last reply Reply Quote 0
                                    • J Offline
                                      jmccoy555 @stormi
                                      last edited by

                                      @stormi Security updates on April 1st 🤣

                                      stormiS 1 Reply Last reply Reply Quote 2
                                      • stormiS Offline
                                        stormi Vates 🪐 XCP-ng Team @jmccoy555
                                        last edited by

                                        @jmccoy555 Yeah. Install them today and they'll turn your hosts into VMware.

                                        J 1 Reply Last reply Reply Quote 1
                                        • J Offline
                                          jmccoy555 @stormi
                                          last edited by

                                          @stormi Isn't that a virus, not a bug fix????

                                          1 Reply Last reply Reply Quote 0
                                          • olivierlambertO Online
                                            olivierlambert Vates 🪐 Co-Founder CEO
                                            last edited by

                                            😆

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post