sonic-buildimage/platform/vs
xumia a6437d8ab6
[202305] Support FIPS for armhf (#18283)
* [Security] Fix the krb5 vulnerability issue (#17914)

### Why I did it
Fix the krb5 vulnerable issue
CVE-2021-36222  allows remote attackers to cause a NULL pointer dereference and daemon crash
CVE-2021-37750  NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field
DSA 5286-1  remote code execution

##### Work item tracking
- Microsoft ADO **(number only)**: 26577929

#### How I did it
Upgrade the krb5 version to 1.18.3-6+deb11u14+fips.

* [Build] Fix krb5 package not found issue (#17926)

Why I did it
Fix the build issue caused by the wrong version specified.

See the build error logs:

Try 4: /usr/bin/wget --retry-connrefused failed to get: -O
--2024-01-26 11:38:23--  https://sonicstorage.blob.core.windows.net/public/fips/bullseye/0.10/amd64/libk5crypto3_1.18.3-6+deb11u14+fips_amd64.deb
Resolving sonicstorage.blob.core.windows.net (sonicstorage.blob.core.windows.net)... 20.60.59.131
Connecting to sonicstorage.blob.core.windows.net (sonicstorage.blob.core.windows.net)|20.60.59.131|:443... connected.
HTTP request sent, awaiting response... 404 The specified blob does not exist.
2024-01-26 11:38:23 ERROR 404: The specified blob does not exist..

Try 5: /usr/bin/wget --retry-connrefused failed to get: -O
make[1]: *** [Makefile:12: /sonic/target/debs/bullseye/symcrypt-openssl_0.10_amd64.deb] Error 8
make[1]: Leaving directory '/sonic/src/sonic-fips'
Work item tracking
Microsoft ADO (number only): 26577929
The package not installed but PR passed issue is traced in another issue #17927

How I did it
Add the libkrb5-dev and the depended packages to fix docker-sonic-vs build failure.
The package libzmq3-dev has dependency on the libkrb5-dev.

* [202305] Support FIPS for armhf

* Remove no use mirror

* Fix fips options issue
2024-03-09 11:39:12 +08:00
..
docker-gbsyncd-vs [infra] Support syslog rate limit configuration (#12490) 2022-12-20 10:53:58 +02:00
docker-sonic-vs [202305] Support FIPS for armhf (#18283) 2024-03-09 11:39:12 +08:00
docker-syncd-vs Upgrade docker-sonic-vs and docker-syncd-vs to Bullseye (#13294) 2023-03-19 21:14:27 -07:00
sonic-version [build]: add branch and release name in sonic_version.yml (#6356) 2021-08-08 20:44:02 -07:00
tests [DPB]Removing default admin status initialization in DPB flow while loading minigraph (#8711) 2021-09-13 09:01:29 -07:00
create_vnet.sh [vs]: dynamically create front panel ports in vs docker (#4499) 2020-04-30 12:50:59 -07:00
docker-gbsyncd-vs.dep Add gearbox phy device files and a new physyncd docker to support VS gearbox phy feature (#4851) 2020-09-25 08:32:44 -07:00
docker-gbsyncd-vs.mk [dockers] label SONiC Docker with manifest (#5939) 2021-04-26 13:51:50 -07:00
docker-ptf-sai.dep [PTF-SAIv2]Add ptf docker for sai-ptf (saiv2) (#9729) 2022-02-18 01:48:50 -08:00
docker-ptf-sai.mk [SAI PTF] SAI PTF docker support sai-ptf v2 (#12719) 2022-11-17 04:42:51 -08:00
docker-ptf.dep [docker-ptf]: build docker ptf 2021-01-27 08:28:21 -08:00
docker-ptf.mk Revert "[SAI PTF]Syncd-rpc and PTF docker support sai ptf v2 (#11610)" (#12677) 2022-11-14 09:56:10 +08:00
docker-sonic-vs.dep [build]: support for DPKG local caching (#4117) 2020-03-11 20:04:52 -07:00
docker-sonic-vs.mk [202305] Support FIPS for armhf (#18283) 2024-03-09 11:39:12 +08:00
docker-syncd-vs.dep [build]: support for DPKG local caching (#4117) 2020-03-11 20:04:52 -07:00
docker-syncd-vs.mk Upgrade docker-sonic-vs and docker-syncd-vs to Bullseye (#13294) 2023-03-19 21:14:27 -07:00
gbsyncd-vs.mk Add gearbox phy device files and a new physyncd docker to support VS gearbox phy feature (#4851) 2020-09-25 08:32:44 -07:00
kvm-image.dep [build]: support for DPKG local caching (#4117) 2020-03-11 20:04:52 -07:00
kvm-image.mk [vs][multi-asic]: Add new platforms for multi-asic vs. (#8269) 2021-08-31 22:45:59 -07:00
libsaithrift-dev.dep [docker-ptf]: build docker ptf 2021-01-27 08:28:21 -08:00
libsaithrift-dev.mk Revert "[SAI PTF]Syncd-rpc and PTF docker support sai ptf v2 (#11610)" (#12677) 2022-11-14 09:56:10 +08:00
one-image.dep [build]: support for DPKG local caching (#4117) 2020-03-11 20:04:52 -07:00
one-image.mk [vsimage]: install systemd generator into one image 2020-04-17 04:51:51 +00:00
onie.dep [build]: support for DPKG local caching (#4117) 2020-03-11 20:04:52 -07:00
onie.mk [202305] [build] Use public storage for public resources. (#18199) 2024-02-28 08:58:56 -08:00
platform.conf [vs]: build sonic vs kvm image (#2269) 2018-11-20 22:32:40 -08:00
raw-image.dep [vsraw]: build sonic-vs.raw image 2020-04-17 04:51:51 +00:00
raw-image.mk [vsraw]: build sonic-vs.raw image 2020-04-17 04:51:51 +00:00
README.gns3.md [vsimage]: Support for the creation of a GNS3 appliance file (#3553) 2019-10-07 07:16:11 -07:00
README.vsdocker.md [vs]: dynamically create front panel ports in vs docker (#4499) 2020-04-30 12:50:59 -07:00
README.vsvm.md [multi-asic][vs]: Update readme file to create multi-asic vs (#6867) 2021-03-05 12:46:07 -08:00
rules.dep [PTF-SAIv2]Add ptf docker for sai-ptf (saiv2) (#9729) 2022-02-18 01:48:50 -08:00
rules.mk [PTF-SAIv2]Add ptf docker for sai-ptf (saiv2) (#9729) 2022-02-18 01:48:50 -08:00
sonic_multiasic.xml Multi-ASIC implementation (#3888) 2020-03-31 10:06:19 -07:00
sonic-gns3a.sh [gns3]: modify SONiC VS image name (#13136) 2023-01-03 10:02:10 -08:00
sonic-version.dep [build]: support for DPKG local caching (#4117) 2020-03-11 20:04:52 -07:00
sonic-version.mk Support to add SONiC OS Version in device info (#14601) 2023-04-12 09:20:08 +08:00
sonic.xml [vs]: sync changes to disk and add e1000 driver to sonic vm (#2288) 2018-11-22 12:09:21 -08:00
syncd-vs.dep [build]: support for DPKG local caching (#4117) 2020-03-11 20:04:52 -07:00
syncd-vs.mk [docker-orchagent]: make build depends only on sairedis package (#4880) 2020-07-12 18:08:51 +00:00

HOWTO Use Virtual Switch (VM)

  1. Install libvirt, kvm, qemu
sudo apt-get install libvirt-clients qemu-kvm libvirt-bin
  1. Create SONiC VM for single ASIC HWSKU
$ sudo virsh
Welcome to virsh, the virtualization interactive terminal.

Type:  'help' for help with commands
       'quit' to quit

virsh # 
virsh # create sonic.xml
Domain sonic created from sonic.xml

virsh # 
  1. Create SONiC VM for multi-ASIC HWSKU
  • Based on the number of asics of hwsku, update device/x86_64-kvm_x86_64-r0/asic.conf
NUM_ASIC=<n>
DEV_ID_ASIC_0=0
DEV_ID_ASIC_1=1
DEV_ID_ASIC_2=2
DEV_ID_ASIC_3=3
..
DEV_ID_ASIC_<n-1>=<n-1>

For example, a four asic VS asic.conf will be:

NUM_ASIC=4
DEV_ID_ASIC_0=0
DEV_ID_ASIC_1=1
DEV_ID_ASIC_2=2
DEV_ID_ASIC_3=3
  • Create a topology.sh script which will create the internal asic topology for the specific hwsku. For example, for msft_multi_asic_vs: https://github.com/Azure/sonic-buildimage/blob/master/device/virtual/x86_64-kvm_x86_64-r0/msft_multi_asic_vs/topology.sh

  • With the updated asic.conf and topology.sh, build sonic-vs.img which can be used to bring up multi-asic virtual switch.

  • Update platform/vs/sonic_multiasic.xml with higher memory and vcpu as required.

    • For 4-asic vs platform msft_four_asic_vs hwsku, 8GB memory and 10vCPUs.
    • For 7-ASIC vs platform msft_multi_asic_vs hwsku, 8GB and 16vCPUs.
  • Update the number of front-panel interfaces in sonic_multliasic.xml

    • For 4-ASIC vs platform, 8 front panel interfaces.
    • For 6-ASIC vs platform, 64 front panel interfaces.
  • With multi-asic sonic_vs.img and sonic_multiasic.xml file, bring up multi-asic vs as:

$ sudo virsh
Welcome to virsh, the virtualization interactive terminal.

Type:  'help' for help with commands
       'quit' to quit

virsh #
virsh # create sonic_multiasic.xml 
Domain sonic created from sonic.xml

virsh #
  • Steps to convert a prebuilt single asic sonic-vs.img:

    • Use the updated sonic_multiasic.xml file and bring up virtual switch.
    • Update /usr/share/sonic/device/x86_64-kvm_x86_64-r0/asic.conf as above.
    • Add topology.sh in /usr/share/sonic/device/x86_64-kvm_x86_64-r0/
    • stop database service and remove database docker, so that when vs is rebooted, database_global.json is created with the right namespaces.
      • systemctl stop database
      • docker rm database
    • sudo reboot
    • Once rebooted, VS should be multi-asic VS.
  • Start topology service.

sudo systemctl start topology.
  • Load configuration using minigraph or config_dbs.
  1. Access virtual switch:

    1. Connect SONiC VM via console
    $ telnet 127.0.0.1 7000
    

    OR

    1. Connect SONiC VM via SSH

      1. Connect via console (see 3.1 above)

      2. Request a new DHCP address

      sudo dhclient -v
      
      1. Connect via SSH
      $ ssh -p 3040 admin@127.0.0.1