Improve nss-tacplus TACACS connect timeout
#### Why I did it
TACACS login usually config multiple server, when a high priority server not reachable or high lantency, remote user login will slowly, also run SUDO command will slowly.
To improve this issue, enable read timeout in nss-tacplus.
### How I did it
Enable read timeout in nss-tacplus.
#### How to verify it
Pass all UT.
### Description for the changelog
Improve nss-tacplus TACACS connect timeout.
#### Why I did it
src/sonic-platform-daemons
```
* 8829614 - (HEAD -> master, origin/master, origin/HEAD) Enable periodic polling of TRANSCEIVER_FIRMWARE_INFO table in DomInfoUpdateTask (#443) (10 minutes ago) [mihirpat1]
* 55b5805 - Combine psu presence/status update with data update (#424) (9 hours ago) [Yuanzhe]
```
#### How I did it
#### How to verify it
#### Description for the changelog
### Why I did it
When try to install k8s gpg file, there reports an error.
- "E: gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation curl: (23) Failed writing body".
To fix error we need to install gunpg package. But apt-key add is going to be deprecated, mv the gpg file to /etc/apt/trusted.gpg.d/ directly
### How I did it
Download k8s gpg file and put it in /etc/apt/trusted.gpg.d/
#### How to verify it
We can install k8s gpg file successfully, but no gnupg package installed inside sonic image.
#### Why I did it
src/sonic-mgmt-common
```
* fbb5fcd - (HEAD -> master, origin/master, origin/HEAD) Script to populate the test data to the simulator db (10 hours ago) [Sachin Holla]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/sonic-platform-common
```
* 56921d8 - (HEAD -> master, origin/master, origin/HEAD) File system based sensors implementation for voltage and current sensors (#426) (21 hours ago) [Mridul Bajpai]
```
#### How I did it
#### How to verify it
#### Description for the changelog
Why I did it
We Nokia took the task to make macsec container to work with bookworm.
This PR requires another PR for sonic-wpa-supplicant(sonic-net/sonic-wpa-supplicant#80) to be in first. Otherwise sonic build will fail for bookworm wpasupplicant debian package.
How I did it
How to verify it
After build and boot up system with new image, macsec container should run with bookworm. Corresponding mgmt macsec suite will work here.
Which release branch to backport (provide reason below if selected)
Tested branch (Please provide the tested image version)
Tested with latest master of sonic-buildimage. Built vs image and loaded into vs testing environment. Code pass with macsec test suites.
Description for the changelog
Make macsec container to build with bookworm
- Why I did it
Adding explicit dependency of libnl-route-3 for Mellanox SAI library. This is required for the latest SAI library.
- How I did it
Modifying Make files
- How to verify it
Building with the changes.
- Why I did it
Error messages occured when trying to read PSU files on init:
ERR pmon#psud: Failed to read from file /var/run/hw-management/power/psu1_volt_out2_capability - FileNotFoundError(2, 'No such file or directory')
This can happen when the power cord is disconnected from the PSU, so some PSU files may be absent, e.g.:
/var/run/hw-management/power/psu2_volt_out2
/var/run/hw-management/power/psu2_volt_out2_capability
- How I did it
Check if a file exists for a specific PSU parameter If not, return None so we can't read the PSU file any further
- How to verify it
Disconnect power cord from PSU and power supply from system
Wait few minutes and then connect power supply to system without power cord
Check logs for errors
Signed-off-by: Oleksandra Bella <oleksandrab@nvidia.com>
- Why I did it
Changing LPMODE timing is different between cables.
We want to add functionality to make sure LPMODE has changed.
For that, the wait_until utility is used and every 1 second (until timeout), it will check with lower-layers what is the current Lpmode.
Once it is the expected mode, set_lpmode() functino will return True.
If after seconds, Lpmode is still not in the expected mode, set_lpmode() function will return False.
- How I did it
Add use of wait_until function to make sure lpmode was changed.
- How to verify it
sfputil lpmode on
sfputil lpmode off
#### Why I did it
src/sonic-platform-common
```
* 3d35404 - (HEAD -> master, origin/master, origin/HEAD) Certain VDM fields not populating after encountering KeyError on 400ZR optics (#442) (34 hours ago) [mihirpat1]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/sonic-platform-daemons
```
* b9e6ba5 - (HEAD -> master, origin/master, origin/HEAD) Updated supported CMIS module types in xcvrd to include new module for SPC4 (#440) (25 hours ago) [Tomer Shalvi]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/sonic-sairedis
```
* d770370 - (HEAD -> master, origin/master, origin/HEAD) [asan] Disable the "maybe-uninitialized" warning when compiled with ASAN enabled. (#1360) (30 hours ago) [Oleksandr Ivantsiv]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/sonic-swss
```
* 9c995f0c - (HEAD -> master, origin/master, origin/HEAD) [asan] Disable the "maybe-uninitialized" warning when compiled with ASAN enabled. (30 hours ago) [Oleksandr Ivantsiv]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/sonic-utilities
```
* bf355960 - (HEAD -> master, origin/master, origin/HEAD) Add vlan validation in config interface ip add command (#3155) (24 hours ago) [Mati Alfaro]
* ba98c7f8 - CLI enhancements to revtrieve data from TRANSCEIVER_FIRMWARE_INFO table (#3177) (34 hours ago) [mihirpat1]
* aefb61bd - Modify transceiver PM CLI to handle N/A value for DOM threshold (#3174) (34 hours ago) [mihirpat1]
```
#### How I did it
#### How to verify it
#### Description for the changelog
- Why I did it
The field 'subport' represents the index of the split port within a physical port. For example, if a port is split into 4, the subport of the first logical port is 1, the subport of the second logical port is 2, and so on.
In xcvrd, the CMIS manager uses the subport to calculate the lane mask, which is used to control the data path per lane. In Nvidia platform, the subport is missing and is always set to 0. According to the xcvrd code, when subport=0, it will always correspond to the first logical port. Therefore, if we shut down any logical port that is not the first one, we will see the operational status of the first logical port also becomes down.
This PR aims to add the subport field to CONFIG DB and prevent such scenarios. This is applicable only for static default breakout mode. For DPB, subport calculation will happen on the fly (changes are not in Sonic yet).
(Subport HLD: HLD of subport: [link to the HLD document])
- How I did it
I have added the 'subport' field to all relevant Nvidia hwsku.json files (minigraph generation is based on them). Additionally, I introduced the new 'subport' field to portconfig.py, so that sonic-cfggen will be able to generate the minigraph with it. In this file, I also fixed an error that caused all attributes from hwsku.json to be applied only to the first logical ports associated with a physical port.
Furthermore, I updated hwsku_json_checker to include the new field and applied a fix to the sample_hwsku.json file. sample_hwsku.json is the file that sonic-config-engine's unit tests rely on for its tests. Previously, it only included attributes for the first logical port of a split physical port. For example, if Ethernet4, a 4-lane port, was split into 2 ports, then sample_hwsku.json included only the entry for Ethernet4, with no entry for Ethernet6. This misalignment with the structure of other hwsku.json files has been corrected as well.
- How to verify it
Ensure that each logical port has the correct value of 'subport' in CONFIG DB, and that shutting down a logical port affects only that port and not other ports in the split.
If encountered a line without RequiredBy or WantedBy the code passes uninitialized pointer to get_install_targets_from_line(). Where it can fail with segfault or silently pass randomly.
- Why I did it
Uninitialized target_suffix is passed to get_install_targets_from_line() when other fields are present in [Install] section, like this:
root@sonic:/home/admin# systemctl cat ntpsec
...
[Install]
Alias=ntp.service
Alias=ntpd.service
WantedBy=multi-user.target
- How I did it
Initialize target_suffix with NULL, put an assert in get_install_targets_from_line(). Edited test to cover this scenario.
- How to verify it
UT and on the switch.
Signed-off-by: Stepan Blyschak <stepanb@nvidia.com>
- Why I did it
The creation of system EEPROM VPD file "/var/run/hw-management/eeprom/vpd_info" is triggered by the udev event during the system boot up, in case the CPU is busy during the bootup, the udev event handling can be delayed, and need to wait for some more time for the file creation.
- How I did it
Extend the waiting time from 10s to 20s to overcome some extreme case.
- How to verify it
continuously run reboot case and verify whether still can see error msg "ERR decode-syseeprom: Nowhere to read syseeprom from! No symlink found"
Signed-off-by: Kebo Liu <kebol@nvidia.com>
In some local buildings, an error /bin/bash: line 0: cd: src/sonic-dash-api/sonic-dash-api: No such file or directory will be raised due to the directory structure of sonic-dash-api has been changed.
Signed-off-by: Ze Gan <ganze718@gmail.com>
#### Why I did it
src/sonic-swss
```
* 97c7f3ed - (HEAD -> master, origin/master, origin/HEAD) Fix multi VLAN neighbor learning (#3049) (4 hours ago) [Lawrence Lee]
* 2617d4c5 - [intfsorch] Enable ipv6 proxy ndp along with proxy arp (#3045) (6 hours ago) [Nikola Dancejic]
```
#### How I did it
#### How to verify it
#### Description for the changelog
### Why I did it
- Currently inside k8s master image we are going to use AAD to do authentication related stuff with python language, we need to pre-install several azure key-vault related python packages.
- Need to upgrade cri-dockerd to 0.3.10 to support bookworm
- Need to change netcat package name to netcat-openbsd for bookworm
- Remove the unnecessary apt-get update
##### Work item tracking
- Microsoft ADO **(number only)**: 26435886
#### How I did it
- pip3 install azure-keyvault-secrets
- apt-get -y install netcat-openbsd
- upgrade the cri-dockerd version for bookworm
#### How to verify it
- pip3 list to check if azure-keyvault-secrets is installed inside image
- dpkg -l to check if netcat-openbsd is installed inside image
- systemctl status cri-dockerd.service to check if it's running well
### Why I did it
Update sonic-sairedis submodule pointer to include the following:
Add new functionality to syncd_init_common.sh, to use common sai.profile (https://github.com/sonic-net/sonic-sairedis/pull/1352)
### How I did it
Advance sonic-sairedis pointer
Adding rule to ebtables to drop multicast packets in kernel. This was
done to address a bug where NS packets were flooding ports with
duplicate packets.
Signed-off-by: Nikola Dancejic <ndancejic@microsoft.com>
#### Why I did it
src/sonic-sairedis
```
* 09cd7f6 - (HEAD -> master, origin/master, origin/HEAD) Add new functionality to syncd_init_common.sh, to use common sai.profile (#1352) (17 hours ago) [noaOrMlnx]
```
#### How I did it
#### How to verify it
#### Description for the changelog
### Why I did it
ipmitool utility is used to access various HW sensors. Some platforms use "ipmitool raw " to read specific addresses.
ipmitool_1.8.19-4_amd64.deb, that is part of bookworm has a defect. The package is missing file enterprise.txt that is expected by the "raw read" code path.
It is so because the file the .deb tries to download at the build time does not have the necessary extension as it is available on remote server: https://www.iana.org/assignments/enterprise-numbers.txt
### How I did it
The defect had been fixed using coding changes in next unstable version of Linux. It is expected to be available in future stable version of the OS. Hence to keep the changes to minimal, the .dsc file is downloaded and only the Makefile is modified to download the correct file. To make is work as patch necessary changes are made.
#### How to verify it
Build log is attached and installation of the file is noted line #2274
When using vanilla bookworm on platforms like 5212 or 5224:
-------------------------------------------------------------------
root@sonic:~# ipmitool raw 0x04 0x2d 0x31
IANA PEN registry open failed: No such file or directory
00 c0 01 80
When fixed we should not see the above error:
--------------------------------------------------
root@sonic:/home/admin# ipmitool raw 0x04 0x2d 0x31
00 c0 00 80
### Description for the changelog
This change is to address ipmitool raw read issue. This patch must be removed once it is available in next stable Linux release that contains the fix.
1edb0e27e4
### Why I did it
Command cannot be executed when tacacs+ in AAA authorization is set and passkey in TACPLUs is not set. There should be such restriction in YANG model definition.
##### Work item tracking
- Microsoft ADO **(number only)**: 26898399
#### How I did it
Add restirction
#### How to verify it
unit test
#### Why I did it
src/sonic-utilities
```
* 7670609a - (HEAD -> master, origin/master, origin/HEAD) Fix sfputil CLI failure for multi-asic platforms (#3168) (2 days ago) [longhuan-cisco]
* 6e4130d8 - [config] Check golden config exist early if flag is set (#3169) (3 days ago) [jingwenxie]
* 1c094d30 - [show] Update show run all to cover all asic config in multiasic (#3148) (5 days ago) [jingwenxie]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/sonic-swss-common
```
* 9330086 - (HEAD -> master, origin/master, origin/HEAD) [dbconnector]: Add API getDbKeys in dbconnector (#854) (4 days ago) [Ze Gan]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/wpasupplicant/sonic-wpa-supplicant
```
* d41110905 - (HEAD -> master, origin/master, origin/HEAD) Merge pull request #80 from wumiaont/master (4 days ago) [Kamil Cudnik]
* 7406f4ba4 - Fix compile issues with debian bookworm (10 days ago) [wumiaont]
* caed4ef71 - Fix compile issues with bookworm and openssl 3.0 (10 days ago) [wumiaont]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/sonic-platform-daemons
```
* 9141305 - (HEAD -> master, origin/master, origin/HEAD) Enhance port_update_event logic to be thread-safe (#430) (3 days ago) [longhuan-cisco]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/sonic-swss
```
* 91321737 - (HEAD -> master, origin/master, origin/HEAD) Fixed orchagent crash in VM with the Qos BUFFER_QUEUE|system-port|Queue-id-range config (#3050) (2 days ago) [saksarav-nokia]
```
#### How I did it
#### How to verify it
#### Description for the changelog
- Why I did it
The existing grub configuration has a hardcoded "amd64" architecture in the kernel and initramfs names. This causes an error in the attempt to load the image compiled for a different architecture.
- How I did it
Use configured architecture in the GRUB config.
- How to verify it
Compile the image for Arm64 architecture and install it on the device.
- Why I did it
On some Nvidia platforms, fan direction could not be determined. Therefore 'N/A' becomes a valid value for those cases.
- How I did it
Add 'N/A' to the valid fan direction mapping, to avoid an error in the log.
- How to verify it
Check fan direction on Nvidia platforms, and make sure there aren't errors in the log.
* Update Redis DB start options for multi-asic and chassis cases
Starting with Redis 7.0 (specifically, redis/redis#9034), setting a
custom `--bind` address on the command line no longer disables protected
mode (which blocks connections from non-localhost IP addresses unless a
password is set). For multi-asic and chassis database DBs, we currently
specify a non-localhost IP address and do not specify any password,
which means this change would break things there.
To work around this, if we are specifying a non-localhost IP address on
the command line, then disable protected mode.
* Clean up debug pacakge list for docker-teamd
The debug pacakges for swss and libswsscommon are already installed by
docker-swss-layer-bookworm and docker-config-engine-bookworm, so they
don't need to be specified here again.
Signed-off-by: Saikrishna Arcot <sarcot@microsoft.com>
PR #17836 added the container checking for database-chassis for Supervisor. But the related container_feature_dict[] is missing for the database-chassis. This causes the exception failure shows on Supervisor
Signed-off-by: mlok <marty.lok@nokia.com>
Why I did it
This is sonic-mgmt-docker Python3 migration.
How I did it
Remove Python3 venv from sonic-mgmt-docker
How to verify it
Compile docker and verify the Python3 venv is NOT there.
Why I did it
github workflow is not easy to extend to other repos.
Use github app instead to share the same workflow.
Work item tracking
Microsoft ADO (number only): 26855292
How I did it
How to verify it
#### Why I did it
src/sonic-platform-common
```
* 796e89a - (HEAD -> master, origin/master, origin/HEAD) Change get_transceiver_info_firmware_versions return type to dict (#440) (2 days ago) [mihirpat1]
```
#### How I did it
#### How to verify it
#### Description for the changelog
#### Why I did it
src/sonic-platform-daemons
```
* f1511c2 - (HEAD -> master, origin/master, origin/HEAD) Move firmware version fields to TRANSCEIVER_FIRMWARE_INFO table (#435) (2 days ago) [mihirpat1]
```
#### How I did it
#### How to verify it
#### Description for the changelog
