#### Why I did it
`os` and `commands` modules are not secure against maliciously constructed input
`getstatusoutput` is detected without a static string, uses `shell=True`
#### How I did it
Eliminate the use of `os` and `commands`
Use `subprocess` instead
Signed-off-by: Neetha John <nejo@microsoft.com>
Why I did it
ECN parameters need to be updated for storage backend
How I did it
Included the check for storage backend devices to update qos configs
How to verify it
Verified that the new ecn settings are applied on storage backend device.
Verified that the old ecn settings are applied for storage frontend, non storage frontend/backend devices
Signed-off-by: maipbui <maibui@microsoft.com>
#### Why I did it
The [xml.etree.ElementTree](https://docs.python.org/3/library/xml.etree.elementtree.html#module-xml.etree.ElementTree) module is not secure against maliciously constructed data.
`os` - not secure against maliciously constructed input and dangerous if used to evaluate dynamic content
`subprocess.getstatusoutput` is dangerous because include shell=True in the implementation
#### How I did it
Remove xml. Use [lxml](https://pypi.org/project/lxml/) XML parsers package that prevent potentially malicious operation.
Replace `os` by `subprocess`
Use command as an array instead of string
Use `getstatusoutput_noshell` in `sonic_py_common` lib
- Why I did it
Change YANG model to support syslog rate limit configuration feature
- How I did it
modified sonic-syslog.yang and sonic-feature.yang to support the new added configuration schema
- How to verify it
Unit test
- Why I did it
Add support for compiling Spectrum-4 ASIC firmware to the SONiC image
Add support for Spectrum-4 ASIC firmware upgrade
- How I did it
Update Mellanox fw make files to include Spectrum-4 ASIC firmware binaries.
Update firmware upgrade scripts to be able to detect Spectrum-4 ASIC.
- How to verify it
Run regression tests
Signed-off-by: Kebo Liu <kebol@nvidia.com>
Why I did it
Provide GNMI native write interface for configuration.
How I did it
Add configuration parameters for GNMI native write.
How to verify it
Check build pipeline.
Why I did it
Submodule update for sonic-gnmi
Incorporates:
8226e46 Upgrade pipeline to use bullseye. (sonic-net/sonic-gnmi#58)
ae72767 Add gnmi_dump tool for debug and unit test (sonic-net/sonic-gnmi#60)
6b0253a Add conditional check for split (sonic-net/sonic-gnmi#55)
99bfa8f Remove LOGLEVEL DB since is no longer used (sonic-net/sonic-gnmi#56)
54806a8 Support new gnmi config interface in telemetry container. (sonic-net/sonic-gnmi#7)
How I did it
Move submodule
How to verify it
Check build pipeline.
Why I did it
Added to allow test_crm_route to pass; the test tries to add a /126 ipv6 route and this change is required in order for the count of available routes to be updated correctly.
Why I did it
Submodule update for sonic-swss-common
Incorporates:
5d481da Install swsscommon.i with libswsscommon-dev (#717)
How I did it
I have updated sonic-swss-common repo, this PR is used to update submodule.
How to verify it
Build image, install libswsscommon-dev, and check /usr/share/swss.
- Why I did it
Upgrade the app-extension developer environments (sonic-sdk & sonic-sdk-bullseye) to bullseye
- How to verify it
Built an app-extension using these images and verified if it is up and running.
Signed-off-by: Vivek Reddy <vkarri@nvidia.com>
Why I did it
The variable is not initialized in src/systemd-sonic-generator/systemd-sonic-generator.c. I fixed this one.
How I did it
Assure pointer is initialized to NULL when defined and before use.
- Why I did it
Add SDK hash calculator Debian and update SDK makefile to compile it.
- How I did it
SDK hash calculator Debian will be used by ECMP calculator (PR #12482)
- How to verify it
Compile sonic-buildimage and verify SDK hash calculator Debian exist in target folder.
* [sonic-platform-daemons] submodule update
git log --oneline 7c0a326..master
e8c5657 (HEAD -> master, origin/master, origin/HEAD) [ycabled] fix
exception-handling logic for ycabled (#306)
905874d [ycabled] move swsscommon API's from subroutines to call them
exactly once per task_worker/thread (#303)
510d330 Fix typo in xcvrd (#313)
9ae551f [ycabled] add support for detach mode in 'active-active'
topology (#309)
82fc7a6 Added filtering logic to send filtered fields from DB event
(#307)
8a2dad9 [ycabled] fix no port/state returned by grpc server (#308)
4ea12cf Fix xcvrd to support 400G ZR optic (#293)
23b6970 [ycabled] fix naming error for error condition for CLI handling
(#302)
501abb2 [ycabled] add some exception catching logic to some vendor
specific API's (#301)
534f839 [ycabled] add support for getting grpc secerts via shared file
(#298)
3622aac Remove shell=True (#300)
143422b add support to execute new ycable API's, add datetime field to
mux_info (#297)
6522c46 [ycabled] add notification for gRPC connection state transitions
to IDLE/TRANSIENT_FAILURE (#295)
4b3b238 Install libyang to azure pipeline (#292)
8ff5f37 Use get() to fetch default value from dictionary for port
admin_status #286
b03cc74 [Xcvrd] Soak duplicate events and process only updated
interested events (#285)
3acb171 [ycable] cleanup logic for creating grpc future ready (#289)
ce3b6db [ycabled] fix insert events from xcvrd;cleanup some mux toggle
logic (#287)
Signed-off-by: vaibhav-dahiya <vdahiya@microsoft.com>
Why I did it
sonic-swss-common needs to support SWIG wrapper for go.
Submodule update for sonic-swss-common
Incorporates:
d63130c [[CI]Install libyang from common-lib when build bullseye (#710)
bfe123e Add decorator for Yang default value. (#713)
1d66080 Use SWIGPYTHON to improve SWIG for GO wrapper. (#714)
How I did it
I have updated sonic-swss-common repo, this PR is used to update submodule.
How to verify it
Build image, and sonic-gnmi pipeline will verify SWIG wrapper.
#### Why I did it
When build the sonic-slave-bash target, it cannot go to the shell failed in the step to build sonic-build-hooks, the error logs as below. It may have impact on some of the users, it may be relative to different version of the make.
```
$ QUIET=n BLDENV=bullseye make NOJESSIE=1 NOSTRETCH=1 sonic-slave-bash
+++ Making sonic-slave-bash +++
BLDENV=buster make -f Makefile.work sonic-slave-bash
make[1]: Entering directory `/builds2/stephens/wip/update-submodule/sonic-buildimage'
echo -n ""
pushd src/sonic-build-hooks; TRUSTED_GPG_URLS=https://packages.trafficmanager.net/debian/public_key.gpg,https://packages.microsoft.com/keys/microsoft.asc make all; popd
/builds2/stephens/wip/update-submodule/sonic-buildimage/src/sonic-build-hooks /builds2/stephens/wip/update-submodule/sonic-buildimage
make[2]: Entering directory `/builds2/stephens/wip/update-submodule/sonic-buildimage/src/sonic-build-hooks'
dpkg-deb: building package 'sonic-build-hooks' in 'buildinfo/sonic-build-hooks_1.0_all.deb'.
make[2]: Leaving directory `/builds2/stephens/wip/update-submodule/sonic-buildimage/src/sonic-build-hooks'
/builds2/stephens/wip/update-submodule/sonic-buildimage
mkdir -p sonic-slave-buster/buildinfo
cp src/sonic-build-hooks/buildinfo/sonic-build-hooks* sonic-slave-buster/buildinfo
[ "n" == y ] && scripts/build_mirror_config.sh sonic-slave-buster amd64 buster
make[1]: *** [sonic-build-hooks] Error 1
make[1]: Leaving directory `/builds2/stephens/wip/update-submodule/sonic-buildimage'
make: *** [sonic-slave-bash] Error 2
```
#### How I did it
Change the format as below:
```
[ xxx = yyy ] && do something
```
To
```
if [ xxx = yyy ]; then do something; if
```
#### How to verify it
Verified by who found the issue, the issue gone when the patch applied.
* Update submodule sonic-utilities
72b9cf9 [psushow & psuutil] Support PSU power threshold checking (#2326)
dfdc92e Revert "Support the bandit check by GitHub Action (#2358)" (#2509)
85638b2 YANG Validation for ConfigDB Updates: DEVICE_METADATA, SNMP, SNMP_COMMUNITY tables (#2481)
da44d71 YANG Validation for ConfigDB Updates: PORT_STORM_CONTROL, PORT_QOS_MAP, BUFFER_PROFILE, BUFFER_PG, BUFFER_QUEUE, BUFFER_POOL, FEATURE, DEFAULT_LOSSLESS_BUFFER_PARAMETER tables (#
ba9b628 [sfp] Fix issue: Application Advertisement is not well formatted (#2491)
Signed-off-by: Stephen Sun <stephens@nvidia.com>
* Update submodule sonic-platform-daemons
ed818f8 [PSU daemon] Support PSU power threshold checking (#288)
707a720 [chassisd] update chassisd to write fabric and lc asics on sep erate table (#311)
e8c5657 [ycabled] fix exception-handling logic for ycabled (#306)
905874d [ycabled] move swsscommon API's from subroutines to call them exactly once per task_worker/thread (#303)
510d330 Fix typo in xcvrd (#313)
9ae551f [ycabled] add support for detach mode in 'active-active' topology (#309)
82fc7a6 Added filtering logic to send filtered fields from DB event (#307)
8a2dad9 [ycabled] fix no port/state returned by grpc server (#308)
4ea12cf Fix xcvrd to support 400G ZR optic (#293)
23b6970 [ycabled] fix naming error for error condition for CLI handling (#302)
501abb2 [ycabled] add some exception catching logic to some vendor specific API's (#301)
534f839 [ycabled] add support for getting grpc secerts via shared file (#298)
3622aac Remove shell=True (#300)
143422b add support to execute new ycable API's, add datetime field to mux_info (#297)
6522c46 [ycabled] add notification for gRPC connection state transitions to IDLE/TRANSIENT_FAILURE (#295)
4b3b238 Install libyang to azure pipeline (#292)
8ff5f37 Use get() to fetch default value from dictionary for port admin_status #286
b03cc74 [Xcvrd] Soak duplicate events and process only updated interested events (#285)
3acb171 [ycable] cleanup logic for creating grpc future ready (#289)
ce3b6db [ycabled] fix insert events from xcvrd;cleanup some mux toggle logic (#287)
Signed-off-by: Stephen Sun <stephens@nvidia.com>
* Update submodule sonic-platform-common
7c48be2 Add warning/critical thresholds for PSU power (#304)
f5ba0d0 Add missing PM and VDM related EEPROM read (#326)
02dd597 implement CMIS set_laser_freq to support 100GHz grid space (#294)
Signed-off-by: Stephen Sun <stephens@nvidia.com>
* Revert "Update submodule sonic-platform-daemons"
This reverts commit aea648b157.
Signed-off-by: Stephen Sun <stephens@nvidia.com>
Why I did it
TX FIR tuning should be done based on the type of inserted transceiver
How I did it
Add media_settings.json which contains the tuning data for 100G optic and 400G optic.
How to verify it
Tested against x86_64-arista_7800r3a_36d2_lc
* Support power threshold
Signed-off-by: Stephen Sun <stephens@nvidia.com>
* get_psu_power_warning_threshold => get_psu_power_warning_suppress_threshold
Signed-off-by: Stephen Sun <stephens@nvidia.com>
* Fix comments
Signed-off-by: Stephen Sun <stephens@nvidia.com>
Signed-off-by: Stephen Sun <stephens@nvidia.com>
Why I did it
The PR is to apply separated DSCP_TO_TC_MAP and TC_TO_QUEUE_MAP to uplink ports on dualtor.
The traffic with DSCP 2 and DSCP 6 from T1 is treated as lossless traffic.
DSCP TC Queue
2 2 2
6 6 6
Traffic with DSCP 2 or DSCP 6 from downlink is still treated as lossy traffic as before.
How I did it
Define DSCP_TO_TC_MAP|AZURE_UPLINK and TC_TO_QUEUE_MAP|AZURE_UPLINK.
How to verify it
Verified by UT
Verified by coping the new template to a testbed, and rendering a config_db.json
Update sonic-mgmt-common submodule pointer to include the following:
68e0341 Remove LOGLEVEL DB since is no longer used (#64)
Signed-off-by: dprital <drorp@nvidia.com>
Update sonic-swss submodule pointer to include the following:
da56bd6 Remove LOGLEVEL DB since is no longer used (#2507)
Signed-off-by: dprital <drorp@nvidia.com>
Update sonic-py-swsssdk submodule pointer to include the following:
d3584fc Remove LOGLEVEL DB since is no longer used (#129)
Signed-off-by: dprital <drorp@nvidia.com>
Why I did it
Some sonic-mgmt platform_tests/api were failing on the 7060CX-32S
How I did it
Added the missing metadata in platform.json and platform_components.json
This is purely test data and does not impact our API implementation.
How to verify it
Run platform_tests / api and expect 100% pass rate.
Make syncd rpc docker which supports sai-ptf v2
local bulild the target
NOSTRETCH=y NOJESSIE=y make configure PLATFORM=vs
NOSTRETCH=y NOJESSIE=y NOBULLSEYE=y SAITHRIFT_V2=y make target/docker-ptf-sai.gz
NOSTRETCH=y NOJESSIE=y make configure PLATFORM=vs
NOSTRETCH=y NOJESSIE=y NOBULLSEYE=y make target/docker-ptf.gz
NOSTRETCH=y NOJESSIE=y make configure PLATFORM=broadcom
NOSTRETCH=y NOJESSIE=y ENABLE_SYNCD_RPC=y SAITHRIFT_V2=y make target/docker-syncd-brcm-rpcv2.gz
NOSTRETCH=y NOJESSIE=y ENABLE_SYNCD_RPC=y SAITHRIFT_V2=y make target/docker-saiserverv2-brcm.gz
Test done:
#12619
NOSTRETCH=y NOJESSIE=y make configure PLATFORM=broadcom
NOSTRETCH=y NOJESSIE=y ENABLE_SYNCD_RPC=y make target/docker-syncd-brcm-rpc.gz
NOSTRETCH=y NOJESSIE=y ENABLE_SYNCD_RPC=y make target/docker-saiserver-brcm.gz
Signed-off-by: richardyu-ms <richard.yu@microsoft.com>
Signed-off-by: richardyu-ms <richard.yu@microsoft.com>
Why I did it
Need sonic-host-services to support "config reload" and "config apply-patch"
How I did it
I have updated sonic-host-services repo, and I update the submodule with this PR
How to verify it
Build image and run unit test.
Add wan topo test using TestbedV2.
Why I did it
Add wan topo test using TestbedV2.
How I did it
Add a job to run wan topo in pr test.
Signed-off-by: Yutong Zhang <yutongzhang@microsoft.com>
Why I did it
There were some changes in apt source code in version 2.1.9.
As a result apt used in bullseye (2.2.4) is intolerant to network issues.
This was fixed in 10631550f1 Already fixed version is used in bookworm (2.5.4)
And not yet affected version is used in buster (1.8.2.3)
How I did it
Set Acquire::Retries to 3 for sonic-slave-bullseye, docker-base-bullseye and final Debian image.
Ref: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1876035
Signed-off-by: Konstantin Vasin k.vasin@yadro.com
Why I did it
A recent migration of SonicV2Connector from swsssdk to swsscommon.swsscommon broke phy-credo.
How I did it
Change the import path while keeping a fallback on the previous one for 202205
How to verify it
phy-credo.service no longer fails due to an import error
Why I did it
Some sonic-mgmt platform_tests/api were failing on the 7260CX3-64
How I did it
Added the missing metadata in platform.json and platform_components.json
This is purely test data and does not impact our API implementation.
How to verify it
Run platform_tests/api and expect 100% passrate.
Revert SSHD config change.
#### Why I did it
Some test case and code may impact by SSHD config change.
#### How I did it
Revert following change in build_debian.sh script:
ClientAliveInterval change back to 900.
MaxAuthTries change back to default value.
Banner change to disabled.
#### How to verify it
Pass all E2E test case.
#### Which release branch to backport (provide reason below if selected)
<!--
- Note we only backport fixes to a release branch, *not* features!
- Please also provide a reason for the backporting below.
- e.g.
- [x] 202006
-->
- [ ] 201811
- [ ] 201911
- [ ] 202006
- [ ] 202012
- [ ] 202106
- [ ] 202111
- [ ] 202205
#### Description for the changelog
Revert SSHD config change.
#### Link to config_db schema for YANG module changes
<!--
Provide a link to config_db schema for the table for which YANG model
is defined
Link should point to correct section on https://github.com/Azure/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md
-->
#### A picture of a cute animal (not mandatory but encouraged)
add partial reboot cause support for linecards
add watchdog support for linecards
add power draw information for chassis
properly implement Chassis.get_port_or_cage_type
fix pcieutil on chassis with powered off cards
fix watchdog-control.service crash
misc fixes and cleanups
Signed-off-by: Neetha John <nejo@microsoft.com>
Why I did it
There is a need to have separate profiles on compute and storage and this infra update will help achieve that
How I did it
Moved buffer pool/profile and qos definitions on TD2 to a common folder and all TD2 hwsku's will reference that folder
