* Switch the nss look up order as "compat" followed by "tacplus".
This helps use the legacy passwd file for user info and go to tacacs only if not found.
This means, we never contact tacacs for local users like "admin".
This isolates local users from any issues with tacacs servers.
W/o this fix, the sudo commands by local users could take <count of servers> * <tacacs timeout> seconds, if the tacacs servers are unreachable.
* Skip tacacs server access for local non-tacacs users.
Revert the order of 'compat tacplus' to original 'tacplus compat' as tacplus
access is required for all tacacs users, who also get created locally.
* Change URL for isc-dhcp source repository
* Modify supervisor conf to generate dhcrelay commands with '-id' and '-iu' options
* Comments; Also clean up jinja2 syntax
* Patch relay to open one socket per interface and send to all servers on all upstream interfaces
* Patch relay agent to properly forward BOOTREQUEST only on appropriate interface if it is a directed broadcast
* Port upstream patches to isc-dhcp-relay to support upstream/downstream interfaces
* Update patch to properly support interfaces with multiple IP addresses assigned
* Pass --enable-use-sockets to configure instead of uncommenting USE_SOCKETS directly
Submodule src/sonic-utilities 6130695..a1f961c:
> update scheme variable name (#531)
> [teamshow]: Add * to indicate if the state has been synced into database (#395)
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
Submodule src/sonic-swss e26e1d8..8246bd9:
> [watermarkorch] only perform periodic clear if the polling is on (#781)
Submodule src/sonic-utilities e3bb8b9..6130695:
> [reboot] log reboot progress and add a sanity check before reboot (#526)
> Fix TODO to get/set active ports only (#494)
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
- Add ebtables package, and install some filter rules:
1. ebtables -A FORWARD -d BGA -j DROP
2. ebtables -A FORWARD -p ARP -j DROP
Basically, we let the ARP packets in the VLAN being forwarded by the ASIC,
kernel gets a copy of these ARP packets and the forwarding from Kenerl gets
dropped. So there is always only one copy of ARP/response in the VLAN.
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
* DellEMC S6000, xcvrd support
* sleep 1 second to avoid busy looping
* removal of dead code
* Correct typo error to 1 second
* Introduced 1 second sleep
* Revamped script with blocking call support
* get_transceiver_change_event api definition update
* adding timeout support for get_transceiver_change_event
Port libteam patch which fixes the race condition we observed during
warm reboot.
Remove early patches: 0006, 0008, 0009.
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
SWSS clears DB tables, if teamd is not started after swss, there is a
race condition that swss might clear vital teamd information.
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
Submodule src/sonic-sairedis 74f0f44..d027eae:
> [SAI header] upgrade SAI header to version v1.3.7 (#445)
Submodule src/sonic-utilities 0f7e75c..9005508:
> Bring queue storm status to 'pfcwd show stats' (#500)
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
Submodule src/sonic-swss ae74a27..6e8f991:
> Create ingress table group during the PFCWD stats list installment (#815)
Submodule src/sonic-utilities 6ba6d27..0f7e75c:
> If fast-reboot-dump gives an error, don't continue with fast-reboot (#515)
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
Backport of
54f137c105
According to 6.4.15 of IEEE 802.1AX-2014, Figure 6-22, the state that the
port is selected moves MUX state from DETACHED to ATTACHED.
But ATTACHED state does not mean that the port can send and receive user
frames. COLLECTING_DISTRIBUTION state is the state that the port can send
and receive user frames. To move MUX state from ATTACHED to
COLLECTING_DISTRIBUTION, the partner state should be sync as well as the
port selected.
In function lacp_port_actor_update(), only INFO_STATE_SYNCHRONIZATION
should be set to the actor.state when the port is selected.
INFO_STATE_COLLECTING and INFO_STATE_DISTRIBUTING should be set to false
with ATTACHED mode and set to true when INFO_STATE_SYNCHRONIZATION of
partner.state is set.
In function lacp_port_should_be_{enabled, disabled}(), we also need to
check the INFO_STATE_SYNCHRONIZATION bit of partner.state.
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
* Add new device CIG CS6436-56P
* Delete minigraph.xml
It isn't necessary in the current system, just delete it
* Update qos.json.j2
* Update port_config.ini
Add the speed column. The cmd to show interface status as:
root@switch1:~# show interface status
Interface Lanes Speed MTU Alias Oper Admin Type Asym PFC
----------- --------------- ------- ----- ------------ ------ ------- ------ ----------
Ethernet0 8 25G 9100 Ethernet1/1 up up SFP N/A
Ethernet1 9 25G 9100 Ethernet2/1 up up SFP N/A
Ethernet2 10 25G 9100 Ethernet3/1 down down N/A N/A
Ethernet3 11 25G 9100 Ethernet4/1 down down N/A N/A
Ethernet4 12 25G 9100 Ethernet5/1 down down N/A N/A
Ethernet5 13 25G 9100 Ethernet6/1 down down N/A N/A
Ethernet6 14 25G 9100 Ethernet7/1 down down N/A N/A
Ethernet7 15 25G 9100 Ethernet8/1 down down N/A N/A
Ethernet8 16 25G 9100 Ethernet9/1 down down N/A N/A
Ethernet9 17 25G 9100 Ethernet10/1 down down N/A N/A
Ethernet10 18 25G 9100 Ethernet11/1 down down N/A N/A
Ethernet11 19 25G 9100 Ethernet12/1 down down N/A N/A
Ethernet12 20 25G 9100 Ethernet13/1 down down N/A N/A
Ethernet13 21 25G 9100 Ethernet14/1 down down N/A N/A
Ethernet14 22 25G 9100 Ethernet15/1 down down N/A N/A
Ethernet15 23 25G 9100 Ethernet16/1 down down N/A N/A
Ethernet16 32 25G 9100 Ethernet17/1 down down N/A N/A
Ethernet17 33 25G 9100 Ethernet18/1 down down N/A N/A
Ethernet18 34 25G 9100 Ethernet19/1 down down N/A N/A
Ethernet19 35 25G 9100 Ethernet20/1 down down N/A N/A
Ethernet20 40 25G 9100 Ethernet21/1 down down N/A N/A
Ethernet21 41 25G 9100 Ethernet22/1 down down N/A N/A
Ethernet22 42 25G 9100 Ethernet23/1 down down N/A N/A
Ethernet23 43 25G 9100 Ethernet24/1 down down N/A N/A
Ethernet24 48 25G 9100 Ethernet25/1 down down N/A N/A
Ethernet25 49 25G 9100 Ethernet26/1 down down N/A N/A
Ethernet26 50 25G 9100 Ethernet27/1 down down N/A N/A
Ethernet27 51 25G 9100 Ethernet28/1 down down N/A N/A
Ethernet28 56 25G 9100 Ethernet29/1 down down N/A N/A
Ethernet29 57 25G 9100 Ethernet30/1 down down N/A N/A
Ethernet30 58 25G 9100 Ethernet31/1 down down N/A N/A
Ethernet31 59 25G 9100 Ethernet32/1 down down N/A N/A
Ethernet32 64 25G 9100 Ethernet33/1 down down N/A N/A
Ethernet33 65 25G 9100 Ethernet34/1 down down N/A N/A
Ethernet34 66 25G 9100 Ethernet35/1 down down N/A N/A
Ethernet35 67 25G 9100 Ethernet36/1 down down N/A N/A
Ethernet36 68 25G 9100 Ethernet37/1 down down N/A N/A
Ethernet37 69 25G 9100 Ethernet38/1 down down N/A N/A
Ethernet38 70 25G 9100 Ethernet39/1 down down N/A N/A
Ethernet39 71 25G 9100 Ethernet40/1 down down N/A N/A
Ethernet40 72 25G 9100 Ethernet41/1 down down N/A N/A
Ethernet41 73 25G 9100 Ethernet42/1 down down N/A N/A
Ethernet42 74 25G 9100 Ethernet43/1 down down N/A N/A
Ethernet43 75 25G 9100 Ethernet44/1 down down N/A N/A
Ethernet44 76 25G 9100 Ethernet45/1 down down N/A N/A
Ethernet45 77 25G 9100 Ethernet46/1 down down N/A N/A
Ethernet46 78 25G 9100 Ethernet47/1 down down N/A N/A
Ethernet47 79 25G 9100 Ethernet48/1 down down N/A N/A
Ethernet48 84,85,86,87 100G 9100 Ethernet49/1 up up QSFP28 N/A
Ethernet49 80,81,82,83 100G 9100 Ethernet50/1 up up QSFP28 N/A
Ethernet50 92,93,94,95 100G 9100 Ethernet51/1 down down N/A N/A
Ethernet51 88,89,90,91 100G 9100 Ethernet52/1 down down N/A N/A
Ethernet52 108,109,110,111 100G 9100 Ethernet53/1 down down N/A N/A
Ethernet53 104,105,106,107 100G 9100 Ethernet54/1 down down N/A N/A
Ethernet54 116,117,118,119 100G 9100 Ethernet55/1 down down N/A N/A
Ethernet55 112,113,114,115 100G 9100 Ethernet56/1 down down N/A N/A
root@switch1:~#
Submodule src/sonic-utilities 6aee909..79a0185:
> [fast/warm reboot] add some sanity check before warm reboot (#510)
> In sync with our latest change, where we default failthrough to be False. (#507)
> [generate_dump] system dump improvements (#503)
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
There are some platforms with less powerful CPU/hard-drive could take
longer to get ready for BGP. For these platforms, 240 seconds would be
a safer threshold.
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
Submodule src/sonic-sairedis 483c89e..97dd2a8:
> Fix compilation issues in stretch docker with gcc-6.3 (#426)
> Make object list deterministic when iterating (#438)
> Ignore ACL_COUNTER bytes and packets during comparison logic (#443)
Submodule src/sonic-swss d22b2de..ae74a27:
> Survive pfc watchdog storm action across warm-reboot (#794)
Submodule src/sonic-swss-common 36fd5e9..24c0ff7:
> Update PFC_WD table name in CONFIG_DB (#266)
Submodule src/sonic-utilities bae21e7..6aee909:
> [neighbor advertiser] convert int to string before concatenating (#505)
> [config]: Change the order of interface commands (#504)
> Change PFC watchdog CONFIG_DB table name from PFC_WD_TABLE to PFC_WD (#475)
Signed-off-by: Ying Xie <ying.xie@microsoft.com>
