MGR slave/standby common_config.txt Synchronization Issues due to FAF-only Validation Errors

Summary

On a subordinate MGR, an <fxferfile> entry commonly uses tp_config --validatecommonconfig SERVERFILE as its validation hook. If the common configuration contains FAF blacklist trap entries but the MGR cannot validate those entries locally, the hook exits non-zero. tp_fclient then rejects the downloaded file and emits clientErrorOccurred; it does not replace the local copy. The subordinate MGR can therefore retain an older common_config.txt.

The resolution documented here replaces the hook only on the subordinate MGR with a wrapper. The wrapper preserves normal tp_config validation, ignores only findings whose location ends in /faf:, and then requires xmllint --noout to confirm that the downloaded XML is well formed. A non-FAF tp_config finding or malformed XML still rejects the transfer.

Evidence and behavior

• MGR redundancy relies on tp_fclient on the subordinate MGR to keep configuration files synchronized with the master MGR.
• The standard <fxferfile> example uses tp_config --validatecommonconfig SERVERFILE.
• tp_fclient writes the received content to a temporary file for validation. If the hook fails, it generates an FXFER error trap and returns before it writes and moves the replacement local file.
• In this failure mode, the recurring clientErrorOccurred trap reports only FAF blacklist findings. If any finding is outside an FAF element, do not use this workaround.

Mandatory applicability checks

Do not use this workaround as a general replacement for tp_config validation. Apply it only when all checks below are satisfied.

1. On the subordinate MGR, inspect the latest clientErrorOccurred trap. The validation output must contain only FAF-located findings, in the form /tpconfig/.../faf:, followed by the invalid-trap message.
2. Validate the same common_config.txt on a node with the FAF capability that owns the referenced trap catalog. The command must return exit status 0:

/usr/TextPass/bin/tp_config --validatecommonconfig /usr/TextPass/etc/common_config.txt echo ExitStatus:$?

1. Confirm xmllint is available on the subordinate MGR:

/bin/xmllint --version

1. Confirm the subordinate MGR's host-specific configuration contains the <fxferfile> entry for common_config.txt, and back it up before editing.

Resolution

1. Install the wrapper on the subordinate MGR

Run as root. Install the validation wrapper below on the subordinate MGR.

#!/bin/sh # fxfer validate hook for common_config.txt on MGR nodes. # Full tp_config validation, EXCEPT findings located in FAF elements: # the FAF package is not installed on MGR nodes, so FAF trap names cannot # be validated there (they validate correctly on the FWL traffic nodes). # Any non-FAF tp_config finding still rejects the file. # Exit 0 = accept, non-zero = reject (stderr is captured into the SNMP alarm). 
FILE="$1" [ -n "$FILE" ] && [ -r "$FILE" ] || { echo "usage: $0 <file>" >&2; exit 2; } 
ERRS=$(/usr/TextPass/bin/tp_config --validatecommonconfig "$FILE" 2>&1) [ $? -eq 0 ] && exit 0 
# tp_config findings are pairs: a location line (/tpconfig/...:) followed by # one indented message line. Keep only pairs whose location is NOT a FAF element. NONFAF=$(printf '%s\n' "$ERRS" | awk '    /^\// { loc = $0; next }    {        if (loc == "" || loc !~ /\/faf:$/) {            if (loc != "") print loc            print        }        loc = ""    }') 
if [ -n "$NONFAF" ]; then    printf '%s\n' "$NONFAF" >&2    exit 1 fi 
# All findings were FAF-located: enforce well-formedness as the safety floor. /bin/xmllint --noout "$FILE" exit $?

chown textpass:textpass /usr/TextPass/bin/tp_validatecommonconfig_mgr chmod 755 /usr/TextPass/bin/tp_validatecommonconfig_mgr md5sum /usr/TextPass/bin/tp_validatecommonconfig_mgr ls -l /usr/TextPass/bin/tp_validatecommonconfig_mgr

Expected verification: the file is owned by textpass:textpass and mode is -rwxr-xr-x. Record the checksum locally if change-control or rollback procedures require it.

2. Validate the current local file with the wrapper

su - textpass /usr/TextPass/bin/tp_validatecommonconfig_mgr /usr/TextPass/etc/common_config.txt echo ExitStatus:$?

Required result: ExitStatus:0. Stop if the command returns any other status.

3. Change only the FXFER validation hook

Back up the host-specific MGR configuration before editing it:

cp -p /usr/TextPass/etc/<subordinate-host>_config.txt /usr/TextPass/etc/<subordinate-host>_config.txt.bak.$(date +%Y%m%d)

In the existing <fxferfile> block for common_config.txt, change only the validate attribute to:

<fxferfile    localpath="/usr/TextPass/etc/common_config.txt"    serverpath="/usr/TextPass/etc/common_config.txt"    validate="/usr/TextPass/bin/tp_validatecommonconfig_mgr SERVERFILE" />

SERVERFILE is a literal token used by tp_fclient; do not replace it with a path. Validate the host-specific configuration after saving:

/bin/xmllint --noout /usr/TextPass/etc/<subordinate-host>_config.txt echo ExitStatus:$?

Required result: ExitStatus:0.

4. Restart and verify file synchronization

systemctl restart ftransfer.service sleep 30 pgrep -af tp_fclient

Required result: two continuous tp_fclient processes using the configured file-transfer servers.

Then, as textpass, verify that the local common_config.txt is updated and matches the master copy:

ls -l /usr/TextPass/etc/common_config.txt md5sum /usr/TextPass/etc/common_config.txt

If no update occurs, on the master MGR run:

touch /usr/TextPass/etc/common_config.txt

Then recheck the subordinate MGR within several minutes. Compare the file checksum directly on both nodes; do not rely on the timestamp alone.

5. Confirm ongoing operation

• Perform one additional master-side touch test and verify that the subordinate file updates again.
• Confirm that no new FXFER clientErrorOccurred trap is generated after the service restart and synchronization test.

Why this is safe for this condition

• A successful ordinary tp_config --validatecommonconfig check remains an immediate accept.
• Any non-FAF validation finding is written to standard error and returns status 1; FXFER rejects the file.
• When all tp_config findings are FAF-located, xmllint --noout still rejects malformed or truncated XML.
• Unexpected output that does not conform to the expected paired location/message format is treated as a non-FAF error and is rejected.

Rollback

Restore the backup of the host-specific configuration and restart the transfer service:

cp -p /usr/TextPass/etc/<subordinate-host>_config.txt.bak.<YYYYMMDD> /usr/TextPass/etc/<subordinate-host>_config.txt systemctl restart ftransfer.service

The wrapper can remain on the server; it has no effect unless referenced by the validate attribute.

Do not use this article for

• Validation errors outside an FAF element.
• A common_config.txt file that fails validation on the FAF-capable node as well as on the MGR.
• General FXFER connectivity, ownership, or missing-file failures.

Success criteria

• The wrapper returns ExitStatus:0 for the current valid common_config.txt.
• The edited host-specific configuration passes xmllint --noout.
• The expected continuous tp_fclient processes are running after restart.
• The subordinate common_config.txt updates and its checksum matches the master copy.
• No new FXFER clientErrorOccurred trap is generated during the synchronization test.