Commit Graph

343 Commits

Author SHA1 Message Date
Ying Xie
dc2fb747a5 [ebtables] install ebtables in base image and install filter rules
- Add ebtables package, and install some filter rules:
  1. ebtables -A FORWARD -d BGA -j DROP
  2. ebtables -A FORWARD -p ARP -j DROP

Basically, we let the ARP packets in the VLAN being forwarded by the ASIC,
kernel gets a copy of these ARP packets and the forwarding from Kenerl gets
dropped. So there is always only one copy of ARP/response in the VLAN.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-05-06 22:13:03 +00:00
Joe LeVeque
cc90d7f5ee [sudoers] Add /usr/bin/teamshow to READ_ONLY_CMDS (#2846) 2019-05-01 15:51:13 +00:00
Ying Xie
3b02eec933 [db migrator] migrate the DB to latest schema when needed (#2808)
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-04-30 23:43:52 +00:00
Qi Luo
dd31c2d84a Remove unused packages in docker images and host (#2807)
* Remove unneeded packages in docker images and host
* Remove libpython3.6 from snmp docker image
2019-04-30 19:12:00 +00:00
Ying Xie
edc8685e1e [teamd service] start teamd service after swss (#2829)
SWSS clears DB tables, if teamd is not started after swss, there is a
race condition that swss might clear vital teamd information.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-04-26 22:14:14 +00:00
Andriy Moroz
5004d2b4fe Increase syncd start timeout (#2776)
* Increase syncd start timeout

Signed-off-by: Andriy Moroz <c_andriym@mellanox.com>

* Replace TimeoutSec to TimeoutStartSec

Signed-off-by: Andriy Moroz <c_andriym@mellanox.com>
2019-04-26 15:27:11 +00:00
Stepan Blyshchak
08fed3c125 [snmp.service] Make swss.service a requisite (#2790) 2019-04-18 16:55:55 +00:00
Renuka Manavalan
6c1a0ce58c [hostcfgd] -- Fix the default for failthrough as false.
This implies that by default, if TACACS is configured properly and it reported auth_err, then don't try fail through to traditional unix authentication through /etc/passwd.

If this failthrough is intended, make it explicit through "sudo config aaa authentication failthrough enable"

Removed an unused variable "aaa.fallback"

Tested manually. Note the presence of 'auth_err=die' in all cases except when failthrough is explicitly enabled.

admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough default; date
Wed Apr  3 23:05:18 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1316 Apr  3 23:05 /etc/pam.d/common-auth-sonic
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass

admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough enable; date ; h4 "AAA|authentication"
Wed Apr  3 23:06:37 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1294 Apr  3 23:06 /etc/pam.d/common-auth-sonic
auth    [success=done new_authtok_reqd=done default=ignore]     pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth    [success=done new_authtok_reqd=done default=ignore]     pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass

admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough disable; date ; h4 "AAA|authentication"
Wed Apr  3 23:07:09 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1321 Apr  3 23:07 /etc/pam.d/common-auth-sonic
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass
2019-04-08 23:41:51 +00:00
Ying Xie
4eaa4dabff Revert "[teamd service] teamd service should start after syncd (#2724)" (#2733)
This reverts commit 0d1efb131c.
2019-04-04 15:22:44 +00:00
paavaanan
27f1aa7e09 removing dhcp- turn- off option from initrd (#2555)
* removing dhcp changes from initrd

* removing mgmt-intf-dhcp file
2019-04-04 15:22:14 +00:00
Ying Xie
13a643bb3e [teamd service] teamd service should start after syncd (#2724)
* [teamd service] teamd service should start after syncd

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* combine after lines
2019-04-01 22:47:47 +00:00
Ying Xie
681e34a2b1
[service] add warmboot finializer service (#2725)
After warm reboot is done, we need to disable warm reboot flag and
tear down anything setup for warm reboot and persisted across.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-04-01 14:16:31 -07:00
Qi Luo
3d8d4aeef0 [security] Do not generate ssh server keys for non RSA protocols (#2718) 2019-03-29 22:37:47 +00:00
Ying Xie
f29e6230e5 [docker script] skip docker mount point checking for database container (#2683)
database container doesn't mount hwsku folder.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-03-22 15:53:41 +00:00
Joe LeVeque
ecec579933 [services] Services which start containers now use 'docker wait' instead of 'docker attach' (#2661) 2019-03-19 03:05:37 +00:00
Wenda Ni
f720c2a9a3 [qos]: Map tc 1, 2, 5, and 6 back to pg 0 (#2650)
Lossy traffic does not need to be mapped to different ingress PGs. They can all share the same ingress PG.

Signed-off-by: Wenda Ni <wenni@microsoft.com>
2019-03-19 03:04:46 +00:00
Nadiia Stetskovych
4998609c2f [minigraph]: Do not fail for minigraphs which do not have neighbors listed in <Devices> section (#2522)
Signed-off-by: Nadiya.Stetskovych <nstetskovych@barefootnetworks.com>
2019-03-19 03:02:33 +00:00
Wenda Ni
0b13c45774 Add hook to allow customizing link cable lengths
Signed-off-by: Wenda Ni <wenni@microsoft.com>
2019-03-07 03:32:56 +00:00
Ying Xie
deab95cff6 [swss/syncd] cold start syncd service in swss in attach method (#2639)
start() is called by service startPre method, which is blocking. Starting
syncd service here is causing deadlock.

attach() is called by service start method, which is non-blocking.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-03-07 03:30:34 +00:00
Joe LeVeque
c6ccb80803 [services] Ensure swss and syncd services start before dependent services (#2634)
* [services] Ensure swss and syncd services start before dependent services

* Add 'attach' functions to scripts which get installed to /usr/local/bin so that services only reference the one script each

* Add 'After=swss.service' to syncd.service
2019-03-07 03:23:13 +00:00
Ying Xie
d5250ad4b4 Revert "[baseimage] Delay ntp-config service to start after 5 minutes (#2494)" (#2590)
This reverts commit 33fe8d298e.
2019-02-21 18:28:04 +00:00
lguohan
c5b0c59b78 [swss]: flush asic db in swss.sh for non warm-boot (#2582)
need to flush asic db in swss.sh instead of syncd.sh

orchagent might already started in swss.sh and put commands
into asic db before asic db is flushed in syncd.sh. This
causes race condition such as INIT_VIEW not passing to syncd.

Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-02-21 18:23:58 +00:00
Renuka Manavalan
def2780f18 [hostcfgd]: Promote logs for update-notifications-from-DB from DEBUG to INFO (#2576)
* Add a log message for each notification of add/del TACACS server.

Signed-off-by: Renuka Manavalan <remanava@microsoft.com>

* Moved another syslog message from DEBUG to INFO to be able to see those notifications.

All these changes are to help with a one-time-seen-bug, that hostcfgd did not act upon changes to redis for TACACS servers. We could not repro the bug.

Signed-off-by: Renuka Manavalan <remanava@microsoft.com>
2019-02-21 18:14:04 +00:00
Stepan Blyshchak
e5daf216fd [syncd.sh] Don't stop sxdkernel during warm shutdown on Mellanox platform (#2572)
/etc/init.d/sxdkernel stop may take up to 15 sec which has impact on
control plane downtime

Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>
2019-02-21 18:11:37 +00:00
Ying Xie
4faa5f2f92
[warm boot] cherry-pick PR #2538 and advance related sub-modules (#2569)
PR#2538 cannot merge due to master branch status. It has been tested
against 201811 branch.

Submodule src/sonic-sairedis 21f4a49..d57222a:
  > Add more specific logic for ingress ACL and buffer profile (#421)
  > Move warm_restart enable/disable config to stateDB WARM_RESTART_ENABLE_TABLE (#418)
  > Add support for vlan tagged frames in virtual switch (#417)

Submodule src/sonic-swss 1590030..584490c:
  > Move warm_restart enable/disable config to stateDB WARM_RESTART_ENABLE_TABLE (#786)
  > [vstest]: Potential fix for timing issue in warm_reboot's routing UT (#788)

Submodule src/sonic-swss-common 594f4e8..286ef34:
  > Move warm_restart enable/disable config to stateDB WARM_RESTART_ENABLE_TABLE (#260)

Submodule src/sonic-utilities c6666e2..b44b462:
  > Move warm_restart enable/disable config to stateDB WARM_RESTART_ENABL… (#458)
  > [aclshow] output only counters per table/rule (#442)

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

[PR 2538] Move warm_restart enable/disable config to stateDB WARM_RESTART_ENABLE_TABLE

Signed-off-by: Jipan Yang <jipan.yang@alibaba-inc.com>
2019-02-14 12:12:55 -08:00
Ying Xie
24bce77def [swss/syncd] log swss/syncd service script activities (#2545)
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-02-14 17:04:21 +00:00
Wenda Ni
b1bdecb1c0 [QoS]: Link pg 2 and 6 to lossy buffer profile (#2511)
* Link pg 2 and 6 to lossy buffer profile

Signed-off-by: Wenda <wenni@microsoft.com>
2019-02-03 04:41:19 +00:00
zhenggen-xu
4a24103206 [updategraph] After system upgrade, restore files/directories with original attributes etc. (#2368)
* [updategraph] After system upgrade, restore files/directories with
original attributes etc.
Restore a few more files that was missed before.
Restore FRR configuration directory if exists on old system

Signed-off-by: Zhenggen Xu <zxu@linkedin.com>

* Removed deployment_id_asn_map.yml from copy list

Signed-off-by: Zhenggen Xu <zxu@linkedin.com>
2019-02-02 20:54:58 +00:00
Prince Sunny
e9125b944a [swss]: Change VrfMgrd startup order, cleanup VRF_TABLE from state DB (#2510) 2019-02-02 19:39:42 +00:00
Joe LeVeque
f167e670fd [baseimage] Delay ntp-config service to start after 5 minutes (#2494) 2019-02-02 19:35:27 +00:00
Wenda Ni
cdbbb7eb4d [QoS]: QoS Config change for multiple devices (#2505)
* QoS config change: 1) DSCP mapping; 2) link pg/queue 6 to lossy buffer;
3) redistribute scheduler

Signed-off-by: Wenda <wenni@microsoft.com>

* Add scheduling weight to queue 2

Signed-off-by: Wenda <wenni@microsoft.com>

* Link pg/queue 2 to lossy buffer

Signed-off-by: Wenda <wenni@microsoft.com>

* Update the pg headroom for a7060-D48C8 50G

Signed-off-by: Wenda <wenni@microsoft.com>

* Update config gen test for qos

Signed-off-by: Wenda <wenni@microsoft.com>

* Update pg headroom size, and update egress lossy pool size accordingly

Signed-off-by: Wenda <wenni@microsoft.com>

* Update headroom pool size; Update ingress service pool and egress lossy
pool sizes accordingly;

Signed-off-by: Wenda <wenni@microsoft.com>

* a7260: update headroom pool size; Update ingress service pool and egress lossy pool sizes accordingly;

Signed-off-by: Wenda <wenni@microsoft.com>

* Update config gen test for buffer

Signed-off-by: Wenda <wenni@microsoft.com>
2019-02-02 19:34:35 +00:00
Joe LeVeque
38c08dfac9 [reboot cause] Move reboot-cause files to /host directory so they persist across SONiC upgrades (#2490)
* [reboot cause] Move reboot-cause files to /host directory so they persist across SONiC upgrades

* [sonic-utilities] Update submodule to include related changes
2019-02-02 19:29:52 +00:00
Joe LeVeque
2acfac712c [caclmgrd] Don't crash if we find empty/null rule_props (#2475)
* [caclmgrd] Don't crash if we find empty/null rule_props
2019-01-25 21:10:52 +00:00
stepanblyschak
0921211009 [mellanox|ffb] ISSU version check (#2437)
* Revert "[mellanox]: Integrate CRIU tool to SYNCD docker container (#2061)"

This reverts commit 514b38f348.

Conflicts:
	platform/mellanox/docker-syncd-mlnx.mk
	sonic-slave/Dockerfile

* [mellanox|ffb] remove unused scripts

Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>

* [mellanox|ffb] ISSU version check

Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>

* [mlnx|ffb] remove extra ';'

Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>
2019-01-22 22:41:42 +00:00
stepanblyschak
ff526dd103 [mellanox|ffb] use system level warm reboot for Mellanox fastfast boot (#2374)
* [mellanox|ffb] use system level warm reboot for Mellanox fastfast boot

Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>

* [mellanox|ffb] add comments for mellanox start/stop drivers section

Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>
2019-01-10 14:09:03 -08:00
lguohan
b57a376622
[docker-engine]: upgrade docker engine to 18.09 (#2417)
* [docker-engine]: upgrade docker engine to 18.09
2019-01-04 20:47:43 -08:00
Volodymyr Samotiy
b506241b84 [syncd]: Fix reload flow for Mellanox platforms (#2386)
* Perform stop/start of Mellanox driver tools for all types of reboot
* Don't set Mellanox FAST_BOOT option for "cold" reboot
* Don't send "syncd_request_shutdown" event for "cold" reboot on Mellanox platforms

Signed-off-by: Volodymyr Samotiy <volodymyrs@mellanox.com>
2018-12-15 11:36:12 -08:00
zhenggen-xu
f093ef2a9f [security kernel] Upgrade kernel from 4.9.110-3+deb9u2 to 4.9.110-3+deb9u6 (#2367)
* [security kernel] Upgrade kernel from 4.9.110-3+deb9u2 to 4.9.110-3+deb9u6
short version: 4.9.0-7 to 4.9.0-8

See changelogs for security fixes:
https://tracker.debian.org/media/packages/l/linux/changelog-4.9.110-3deb9u6

Signed-off-by: Zhenggen Xu <zxu@linkedin.com>

* Update sonic-linux-kernel submodule after it was merged

Signed-off-by: Zhenggen Xu <zxu@linkedin.com>
2018-12-11 04:17:17 -08:00
Samuel Angebault
6c7bcf5067 [device/Arista] fix small issue for the 7170 (#2373)
* Fix boot0 install on vfat

* Only display the hook name in boot0

Instead of printing the entire path

* Update arista driver submodule
2018-12-11 04:14:46 -08:00
Ying Xie
6ba93acd9c
[update graph] adapt to warm reboot scenario (#2353)
* [update graph] adapt to warm reboot scenario

When migrating configuration, always copy config files from old_config
to /etc/sonic. But if warm reboot is detected, then skip configuration
operations.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* log file copies and misses
2018-12-06 10:24:50 -08:00
Wenda Ni
f5e678cf84 Port QoS & buffer changes in 0330 to master (#2239)
* 1) DSCP 46 to 5; 2) ecn config for lossless traffic; 3) ecn on by default; 4) DWRR equal weight;

Signed-off-by: Wenda <wenni@microsoft.com>

* 1) link pg & queue 5 to lossy buffer profile; 2) ingress lossless alpha 1/8

Signed-off-by: Wenda <wenni@microsoft.com>

* Update the test case for qos & buffer json template

Signed-off-by: Wenda <wenni@microsoft.com>

* Migrate a7050-qx32 and s6000 to use pg_profile lookup architecture

Signed-off-by: Wenda <wenni@microsoft.com>

* Update pg headroom egress service pool for a7050-qx-32s, a7050-qx32, and s6000

Signed-off-by: Wenda <wenni@microsoft.com>

* Link queue 5 to lossy profile

Signed-off-by: Wenda <wenni@microsoft.com>
2018-12-04 20:51:55 -08:00
kannankvs
a9a7ce1091 tacacs management vrf changes (#2217) 2018-12-04 10:22:48 -08:00
Volodymyr Samotiy
75b41233d2 [Mellanox|FFB]: Add support for Mellanox fast-fast boot (#2294)
* [mlnx|ffb] Add support for mellanox fast-fast boot

Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>

* [mlnx|ffb]: Add support of "config end" event for mlnx fast-fast boot

Signed-off-by: Volodymyr Samotiy <volodymyrs@mellanox.com>

* [Mellanox|FFB]: Fix review comments

* Change naming convention from "fast-fast" to "fastfast"

Signed-off-by: Volodymyr Samotiy <volodymyrs@mellanox.com>
2018-12-04 10:11:24 -08:00
Samuel Angebault
989b60059b [device/arista]: Update (#2336)
* Update arista drivers submodule

* Ignore the possible timestamp warning in tar extraction

* Add verbosity toggle to boot0

Console logging is slow because of the 9600 baud rate.
Some time can be saved by decreasing the console verbosity.

* Add hook mechanism in boot0.

Support additional features in boot0 via hooks.
Hooks are unpacked and executed at post-install or pre-exec time.

* Fix 7170 sensors.conf file

Fix critical temperature settings for MAX6658 sensors

* Fix the random swap of storage devices

For arista 7050 switches running with linux 4.9, it is likely the device
name of flash drive (/dev/sda) and usb (/dev/sdb) randomly swap in kernel
booting, depending on which one is ready first. It breaks the expectation
that flash will be mounted as root by setting root=/dev/sda1. This patch
will correct ROOT to flash device refering to the path under block_flash.

* Fix 7170 fancontrol

* Do not remove aquota.user file in boot0

This file is a filesystem protected file used by EOS.
It can be simply removed and will make the SONiC installation failed if
not skipped.
2018-12-04 10:08:55 -08:00
Taoyu Li
aedfd6e708 [sonic-cfggen] Multi-key should be in form of (a,b) instead of 'a|b' (#2337) 2018-12-04 10:07:44 -08:00
Joe LeVeque
298d2ad8f4
[boot] Refactor: All services which start Docker containers start before ntp-config service (#2335) 2018-12-03 16:01:44 -08:00
Ying Xie
84bde1511a
[sonic boot] disable dhcp during boot up, until updategraph service is running (#2316)
* [sonic] disable management port eth0 during boot up

Signed-off-by: Ying Xie <ying.xie@microsoft.com>

* [updategraph] enable dhcp client on management port eth0

Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2018-11-29 08:34:22 -08:00
Joe LeVeque
d1c9b0cb77 [boot] Start ntp-config service after all Docker containers are started (#2303) 2018-11-28 00:12:03 -08:00
Ying Xie
ce60c53933
[build image] copy init_interfaces to interfaces (#2302)
init_interfaces meant to be sonic init interfaces configuration file.
However, it needs to be copied to the right file name to take effect.

Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2018-11-27 14:35:17 -08:00
Nikos
7056b49af7 Routing application split config support (#2286)
* Routing application split config support

Signed-off-by: nikos <ntriantafillis@gmail.com>

* Routing application split config support
Routing application split config support

Signed-off-by: nikos <Nikos Triantafillis>
2018-11-26 18:19:12 -08:00