Handling Control Plane ACLs so that IPv4 rules and IP… #1

Signed-off-by: Guohan Lu <[email protected]>

1. undefine led_classdev_register as it is defined in leds.h 2. header file location change a. linux/i2c/pmbus.h -> linux/pmbus.h b. linux/i2c-mux-gpio.h -> linux/platform_data/i2c-mux-gpio.h c. linux/i2c/pca954x.h -> linux/platform_data/pca954x.h

Signed-off-by: Guohan Lu <[email protected]>

do mount/umount in the chroot environment install cron explicitly install rasdaemon as a replacement for mcelog switch python package docker-py to docker

ebtables is not enabled by default in buster Signed-off-by: Guohan Lu <[email protected]>

explicitly install dependency linux-base Signed-off-by: Guohan Lu <[email protected]>

backport upstream patch https://salsa.debian.org/ssh-team/openssh/commit/4c771b9c7f2f9c5ddd0aefdbfb16441c2d7969a9 Signed-off-by: Guohan Lu <[email protected]>

change depends to linux-image-4.19.0-6-amd64 in debian/control Signed-off-by: Guohan Lu <[email protected]>

/usr/sbin/mke2fs is now rom busybox which does not support the operation we need

Signed-off-by: Guohan Lu <[email protected]>

…date due to the upgrade from docker-py (1.6.0) to docker (4.1.0)

Signed-off-by: Guohan Lu <[email protected]>

Currently we port SONiC to buster in a way that base image is on buster and other dockers based on stretch. The benefit is that tasks can be carried out simultaneously. The build procedure can be treated as 2 stages. The first stage is to build the stretch-based debs and dockers and the second stage is to build the buster-based ones. One thing we have to pay attention to is some debs depend on kernel should not be built at stretch stage because the kernel isn't available at that time. The idea is to move that kind of debs out of SONIC_STRETCH_DEBS. Meanwhile, any dependency explicitly put on the stretch based dockers on kernel should be removed.

The initialization of /dev/random (crng init) is responsible for random number generation. On some devices, crng took very long to finish.

Co-authored-by: Bing Sun <[email protected]>

- create a file in files/image_config/ntp/ntp-systemd-wrapper to add mgmt vrf related start cmd for ntp service. So that the default /usr/lib/ntp/ntp-systemd-wrapper can be overriden during build time. - modify build_debian.sh to cp files/image_config/ntp/ntp-systemd-wrapper to /usr/lib/ntp/ntp-systemd-wrapper during build time. Co-authored-by: Bing Sun <[email protected]>

in buster, by default, rsyslog service does not create pidfile which breaks monit configuration Signed-off-by: Guohan Lu <[email protected]>

Signed-off-by: Guohan Lu <[email protected]>

…net#4248) * Centec x86 goldengate update (#8)

from 3.7.3.3-3 to 3.7.3.3-4 Fixes for PFC WD Signed-off-by: Abhishek Dosi <[email protected]>

Signed-off-by: Guohan Lu <[email protected]>

…4445)

console means the vga port. this is mainly used for virtual environment such as hyper-v or virtualbox where you have the virtual vga port to display the boot up process. Signed-off-by: Guohan Lu <[email protected]>

add $(BLDENV) in cache flags for following targets: - $(SONIC_MAKE_DEBS) - $(SONIC_DPKG_DEBS) - $(SONIC_ONLINE_DEBS) - $(SONIC_COPY_DEBS) - $(SONIC_MAKE_FILES) This is because we could build a same package for both base image and docker which can be different os distribution, i.e., buster v.s. stretch. - target/debs/buster/swig3.0_3.0.12-2_amd64.deb - target/debs/stretch/swig3.0_3.0.12-2_amd64.deb Signed-off-by: Guohan Lu <[email protected]>

…t#57)

Added DPKG support for ICCPD package Added warning support for missing dependency files that causes the incorrect SHA generation.

[baseimage]: upgrade base image to debian buster bring up the base image to debian buster 4.19 kernel. using the merge commits to preserve the individual commits to better track the history.

Signed-off-by: Nazarii Hnydyn <[email protected]>

This patch set implements the following: - Fixes the conflicts in chassis.py / platform.py in sonic_platfrom - Consolidating the common library files in sonic_platform - Moving QFX5210 specific drivers to qfx5210/modules - Moving Juniper common fpga drivers to common/modules - Cleaning up the platform driver files - Bug fixes in QFX5210 platform monitor & initialiazation script - Fixing the bugs in QFX5210 eeprom parsing Signed-off-by: Ciju Rajan K <[email protected]>

…onic-net#4447)

…and PSU fan speed policy (sonic-net#4403)

…et#4450) Signed-off-by: Guohan Lu <[email protected]>

…onic-net#4426) Signed-off-by: Arvindsrinivasan Lakshmi Narasimhan <[email protected]>

it is important to understand the motivation of the PR. what I did is usually the PR title, so remove. Signed-off-by: Guohan Lu <[email protected]>

hardware daemons are not supported in kvm vs platform now admin@vlab-01:/usr/share/sonic/device/x86_64-kvm_x86_64-r0$ docker exec -it pmon bash root@vlab-01:/# supervisorctl status fancontrol STOPPED Not started lm-sensors STOPPED Not started rsyslogd RUNNING pid 23, uptime 0:03:09 start.sh EXITED Apr 22 09:07 AM supervisor-proc-exit-listener RUNNING pid 17, uptime 0:03:10 Signed-off-by: Guohan Lu <[email protected]>

- add led_proc_init.soc - update config.bcm

…kage (sonic-net#4466) Signed-off-by: Guohan Lu <[email protected]>

…et#4105) Co-authored-by: Jostar Yang <[email protected]>

The one big bgp configuration template was splitted into chunks. Currently we have three types of bgp neighbor peers: general bgp peers. They are represented by CONFIG_DB::BGP_NEIGHBOR table entries dynamic bgp peers. They are represented by CONFIG_DB::BGP_PEER_RANGE table entries monitors bgp peers. They are represented by CONFIG_DB::BGP_MONITORS table entries This PR introduces three templates for each peer type: bgp policies: represent policieas that will be applied to the bgp peer-group (ip prefix-lists, route-maps, etc) bgp peer-group: represent bgp peer group which has common configuration for the bgp peer type and uses bgp routing policy from the previous item bgp peer-group instance: represent bgp configuration, which will be used to instatiate a bgp peer-group for the bgp peer-type. Usually this one is simple, consist of the referral to the bgp peer-group, bgp peer description and bgp peer ip address. This PR redefined constant.yml file. Now this file has a setting for to use or don't use bgp_neighbor metadata. This file has more parameters for now, which are not used. They will be used in the next iteration of bgpcfgd. Currently all tests have been disabled. I'm going to create next PR with the tests right after this PR is merged. I'm going to introduce better bgpcfgd in a short time. It will include support of dynamic changes for the templates. FIX:: sonic-net#4231

…e-docekr (sonic-net#4481) example: ``` SONIC_RUN_CMDS="gzip -d -c target/sonic-vs.img.gz > target/sonic-vs.img;\ qemu-img convert target/sonic-vs.img -O vhdx -o subformat=dynamic target/sonic-vs.vhdx"\ BLDENV=buster make -f Makefile.work sonic-slave-run ``` Signed-off-by: Guohan Lu <[email protected]>

…U ACS-MSN3420 (sonic-net#4436) * New SKU support for MSN3420 Signed-off-by: Shlomi Bitton <[email protected]> Conflicts: device/mellanox/x86_64-mlnx_msn2700-r0/plugins/sfputil.py * Add CPLD's * Symlink fixes and semantics * Adding new platform at end of lines

* remove air flow direction from dynamic minimum algorithm * adjust minimum table according to thermal data

* [dhcpmon] Filter DHCP O/A Messages of Neighboring Vlans This code fixes a bug where two or more vlans exist. Cross contamination happens for DHCP packets Offer/Ack when received on shared northbound links. The code filters out those packet based on dst IP equal Vlan loopback IP. signed-off-by: Tamer Ahmed <[email protected]>

Signed-off-by: Nazarii Hnydyn <[email protected]>

* [DellEMC] S6100-Fix i2C ISMT issue * Modified the retry condition for bit bang

…net#4480) This change adds support to build dockers using buster as base. - Define docker-base-buster using docker-base-stretch as starting point - Define docker-config-engine-buster using docker-config-engine-stretch as starting point. - sonic-mgmt-framework docker is updated to build using buster as base Signed-off-by: Joyas Joseph <[email protected]>

…wss, swss-common submodules. (sonic-net#4465) * Multi-ASIC platforms will have the ID field in the DEVICE_METADATA, which will be pulled and will be used when starting the orchagent process with the new option [-i INST_ID] This is currently added only for Broadcom ASIC based platforms * Making the asic instance ID passing global across asics/platforms. Also changed the config DB id field to asic_id * Minor updates * Advance sonic-swss submodule * Advance swss_common submodule as well due to dependencies

* src/sonic-utilities 798ce2f...7ce5b62 (19): > [utility] Filter FDB entries (sonic-net#890) > [fast reboot] set a fast-reboot DB flag (sonic-net#887) > [show] Add 'ip/ipv6 bgp network' commands (sonic-net#888) > [Vxlan] : adding show vnet/vxlan cmds (sonic-net#880) > [show][bgp] Use only 'show ip bgp' as the base and use bgp_frr_v4 file for FRR routing stack (sonic-net#884) > Revert "[config] Implement a process level lock (sonic-net#857)" (sonic-net#882) > [generate_dump] Dump systemd specific information (sonic-net#602) > [config] Implement a process level lock (sonic-net#857) > [fwutil]: Update Command-Reference.md. (sonic-net#876) > Add platform options to 'show techsupport' command (sonic-net#865) > [doc]: add ltgm and jenkins badge (sonic-net#875) > Fix even more Python warnings (sonic-net#873) > [showtech]: dump docker stats (sonic-net#864) > Fix more Python warnings (sonic-net#869) > Fix Python warnings (sonic-net#867) > Fixes bug for PFCWD feature parameters (sonic-net#838) > Explicitly specify command names with underscores (continued) (sonic-net#852) > [watermarkstat] Fix issue of fields overwritten before display (sonic-net#862) > [pfc] Add command line to enable/disable/show PFC (sonic-net#796)

…onic-net#4494) $DOCKER_IMAGES_FOR_INSTALLERS contains all dockers to be included in the image. If INSTALL_DEBUG_TOOLS=y, then it contains debug docker images as well non-debug docker images when there is no debug version of that docker image. $STRETCH_DOCKER_IMAGES will have the non-debug docker images needed by the image. $STRETCH_DBG_DOCKER_IMAGES should contain the debug version of the docker images. Signed-off-by: Guohan Lu <[email protected]>

accomplish it according MCLAG HLD document, the principle is similar to IPv4 ARP.

Signed-off-by: Guohan Lu <[email protected]>

…KU ACS-MSN4600C (sonic-net#4483) * New SKU support for MSN4600C Signed-off-by: Shlomi Bitton <[email protected]>

…tem (sonic-net#4431) * Run fsck filesystem check support prior mounting filesystem If the filesystem become non clean ("dirty"), SONiC does not run fsck to repair and mark it as clean again. This patch adds the functionality to run fsck on each boot, prior to the filesystem being mounted. This allows the filesystem to be repaired if needed. Note that if the filesystem is maked as clean, fsck does nothing and simply return so this is perfectly fine to call fsck every time prior to mount the filesystem. How to verify this patch (using bash): Using an image without this patch: Make the filesystem "dirty" (not clean) [we are making the assumption that filesystem is stored in /dev/sda3 - Please adjust depending of the platform] [do this only on a test platform!] dd if=/dev/sda3 of=superblock bs=1 count=2048 printf "$(printf '\\x%02X' 2)" | dd of="superblock" bs=1 seek=1082 count=1 conv=notrunc &> /dev/null dd of=/dev/sda3 if=superblock bs=1 count=2048 Verify that filesystem is not clean tune2fs -l /dev/sda3 | grep "Filesystem state:" reboot and verify that the filesystem is still not clean Redo the same test with an image with this patch, and verify that at next reboot the filesystem is repaired and becomes clean. fsck log is stored on syslog, using the string FSCK as markup.

Signed-off-by: Guohan Lu <[email protected]>

)

- Add Makefile rules to build debug containers for SWI images - Fix some platform API implementation for xcvrd and thermalctld - Improvements to arista diag command - Miscellaneous refactors Co-authored-by: Maxime Lorrillere <[email protected]>

Commits on Mar 20, 2020 SFP(sff8472 attributes) transciever eeprom attribute support. (sonic-net#74) 9b1dea5 Commits on Mar 22, 2020 Detect an SFP adapter in a QSFP port, and instantiate an SFP object i… 116eeec Commits on Apr 13, 2020 [component]: Introduce new firmware management API. 2632a59 Commits on Apr 16, 2020 [Chassis base] Add sfp error event definition (sonic-net#80) f1f00ec Commits on Apr 24, 2020 [component]: Update firmware management API. 777901f [component]: Extend docstrings for firmware management API. b066ec7 Commits on Apr 30, 2020 [component]: Fix review comments. d96344e Merge pull request sonic-net#82 from nazariig/master-component-firmware-api 28c39c5 Signed-off-by: Nazarii Hnydyn <[email protected]>

currently, vs docker always create 32 front panel ports. when vs docker starts, it first detects the peer links in the namespace and then setup equal number of front panel interfaces as the peer links. Signed-off-by: Guohan Lu <[email protected]>

…snmpagent (sonic-net#4421) * [sonic-py-swsssdk] update submodule for sonic-py-swsssdk * update snmpagent submodule * [sonic-py-swsssdk] update submodule for namespace changes

…et#4509) Update SAI/SDK/FW and MSN4700 device files to support 8 lanes 400G Update SAI to 1.16.3 Update SDK to 4.4.0914 Update FW to *.2007.1112 Update MSN4700 device files to support 8 lanes 400G

Replacing "amd64" with $PLATFORM_ARCH variable Fix for compiling marvell-armhf arch Signed-off-by: Sabareesh Kumar Anandan <[email protected]>

* src/sonic-utilities 7ce5b62...3471926 (4): > Make `config` command support abbreviation. (sonic-net#893) > [fwutil]: Fix firmware update command. (sonic-net#895) > [doc]: ZTP configuration and show commands (sonic-net#866) > Allow show ztp to display non-sensitive information visible to > non-root user (sonic-net#872) * src/sonic-ztp 374c9e8...c959371 (2): > Fix ztp profile unit test (#14) > Create a shadow ZTP data json file accessible to non-root user (#13)

…ic-net#4478) - Remove syseepromd from the critical process of pmon docker - Fix supervisor autorestart configuration of syseepromd

* ssd_mitigation_changes * ssd_mitigation_changes * ssd_mitigation_changes * ssd_mitigation_changes

- Add port auto-negotiation attribute. - Add CPLD command to disable mode.

- Modify configuration file path in sai.profile. - Modify configuration file for as7726_32x. - Add led_proc_init.soc and custom_led.bin

Signed-off-by: Guohan Lu <[email protected]>

Signed-off-by: Shlomi Bitton <[email protected]>

c2facd8 [show] Fix abbreviations for 'show ip bgp ...' commands (sonic-net#901) cb68e7d Add support for multi-ASIC devices (sonic-net#877) 44ed6e9 Improved route_check tool and adopt to 20191130 image. (sonic-net#898) 6fba8db [psushow] Add a column to display LED color to show platform psustatus output (sonic-net#886) e747456 ssd_mitigation_changes (sonic-net#829)

…e minigraph (sonic-net#4222) - Changes to minigraph.py to parse minigraph.xml of a multi asic platform - Changes to portconfig.py to parse additional column "asic_port_name" in port_config.ini - Add a new option -n to sonic-cfggen for multi asic platforms - Add unit tests for config generation for multi asic platforms Signed-off-by: SuvarnaMeenakshi <[email protected]> Signed-off-by: Arvindsrinivasan Lakshmi Narasimhan <[email protected]>

* [device] DellEmc S5232 support for new hwsku C8D48 8 100G ports and 48 50G ports * 10G ports update for S5232 hwsku-C8D48 Signed-off-by: Srideep Devireddy <[email protected]>

…#4528)

* Add IxNetwork python client to sonic mgmt docker

… file for yang module (sonic-net#4471)

Signed-off-by: Guohan Lu <[email protected]>

…orms (sonic-net#4488) - change the references to 'type' field to 'sub_role' - change the references to 'InternalFrontend' and 'InternalBackend' to 'FrontEnd' and 'BackEnd' respectively - add a statement to reflect route-reflector for backend asics - add a change to set "next-hop-self force" configuration for internal BGP session in multi asic platform. Signed-off-by: Arvindsrinivasan Lakshmi Narasimhan <[email protected]>

…ic-net#4541)

Signed-off-by: Danny Allen <[email protected]>

…up all (sonic-net#4547) Issue was key not correct to look into self.peer. It need to be tuple of (vrf,nbr). Updated for both add/del

…et#3945) 1. ebtables -t filter -A FORWARD -p 802_1Q --vlan-encap 0806 -j DROP The ARP packet with vlan tag can't match the default rule. Signed-off-by: wangshengjun <[email protected]>

…f first boot into new image (sonic-net#4538)

Signed-off-by: Shlomi Bitton <[email protected]>

* [Mellanox] Fix 'sensors.conf' mapping for SN4700 Signed-off-by: Shlomi Bitton <[email protected]> * Fix some labels name

…cript (sonic-net#4550) * [Mellanox] Add patch to disable hw-management thermal control shell script * Remove SimX patch since https://github.com/Azure/sonic-buildimage/pull/4364/files has already handle it

Signed-off-by: SuvarnaMeenakshi <[email protected]>

Signed-off-by: Akhilesh Samineni <[email protected]>

Signed-off-by: Qi Luo <[email protected]>

sonic-net#4477) * Multi DB with namespace support, Introducing the database_global.json file for supporting accessing DB's in other namespaces for service running in linux host * Updates based on comments * Adding the j2 templates for database_config and database_global files. * Updating to retrieve the redis DIR's to be mounted from database_global.json file. * Additional check to see if asic.conf file exists before sourcing it. * Updates based on PR comments discussion. * Review comments update * Updates to the argument "-n" for namespace used in both context of parsing minigraph and multi DB access. * Update with the attribute "persistence_for_warm_boot" that was added to database_config.json file earlier. * Removing the database_config.json file to avioid confusion in future. We use the database_config.json.j2 file to generate database_config.json files dynamically. * Update the comments for sudo usage in docker_image_ctrl.j2 * Update with the new logic in PING PONG tests using sonic-db-cli. With this we wait till the PONG response is received when redis server is up. * Similar changes in swss and syncd scripts for the PING tests with sonic-db-cli * Updated with a missing , in the database_config.json.j2 file, Do pip install of j2cli in docker-base-buster.

Dynamic threshold setting changed to 0 and WRED profile green min threshold set to 250000 for Tomahawk devices Changed the dynamic threshold settings in pg_profile_lookup.ini Added a macro for WRED profiles in qos.json.j2 for Tomahawk devices Necessary changes made in qos.config.j2 to use the macro if present Signed-off-by: Neetha John <[email protected]>

Signed-off-by: Guohan Lu <[email protected]>

* Changes for LLDP for Multi NPU Platoforms:- a) Enable LLDP for Host namespace for Management Port b) Make sure Management IP is avaliable in per asic namespace needed for LLDP Chassis configuration c) Make sure chassis mac-address is correct in per asic namespace d) Do not run lldp on eth0 of per asic namespace and avoid chassis configuration for same e) Use Linux hostname instead from Device Metadata for lldp chassis configuration since in multi-npu platforms device metadata hostname will be differnt Signed-off-by: Abhishek Dosi <[email protected]> * Address Review Comment with following changes: a) Use Device Metadata hostname even in per namespace conatiner. updated minigraph parsing for same to have hostname as system hostname and add new key for asic name b) Minigraph changes to have MGMT_INTERFACE Key in per asic/namespace config also as needed for LLDP for setting chassis management IP. Signed-off-by: Abhishek Dosi <[email protected]> * Address Review Comments

Change PSU MAX temperature to 80 degree Change tmp75 sensors default temperature value from 25/50 to 70/80 degree.

… packets (sonic-net#4412) Modified caclmgrd behavior to enhance control plane security as follows: Upon starting or receiving notification of ACL table/rule changes in Config DB: 1. Add iptables/ip6tables commands to allow all incoming packets from established TCP sessions or new TCP sessions which are related to established TCP sessions 2. Add iptables/ip6tables commands to allow bidirectional ICMPv4 ping and traceroute 3. Add iptables/ip6tables commands to allow bidirectional ICMPv6 ping and traceroute 4. Add iptables/ip6tables commands to allow all incoming Neighbor Discovery Protocol (NDP) NS/NA/RS/RA messages 5. Add iptables/ip6tables commands to allow all incoming IPv4 DHCP packets 6. Add iptables/ip6tables commands to allow all incoming IPv6 DHCP packets 7. Add iptables/ip6tables commands to allow all incoming BGP traffic 8. Add iptables/ip6tables commands for all ACL rules for recognized services (currently SSH, SNMP, NTP) 9. For all services which we did not find configured ACL rules, add iptables/ip6tables commands to allow all incoming packets for those services (allows the device to accept SSH connections before the device is configured) 10. Add iptables rules to drop all packets destined for loopback interface IP addresses 11. Add iptables rules to drop all packets destined for management interface IP addresses 12. Add iptables rules to drop all packets destined for point-to-point interface IP addresses 13. Add iptables rules to drop all packets destined for our VLAN interface gateway IP addresses 14. Add iptables/ip6tables commands to allow all incoming packets with TTL of 0 or 1 (This allows the device to respond to tools like tcptraceroute) 15. If we found control plane ACLs in the configuration and applied them, we lastly add iptables/ip6tables commands to drop all other incoming packets

…onic-net#4571) - mgmt buffer issue on 400G port - high CPU utilization issue caused by some counter reading

… futures (sonic-net#4575) Signed-off-by: Guohan Lu <[email protected]>

Signed-off-by: Andriy Kokhan <[email protected]>

- Updated bf_tun kernel driver; - Temporarily disabled WNC modules build; Signed-off-by: Andriy Kokhan <[email protected]>

…face Binding for Multi-NPU platforms (sonic-net#4491) * [sonic-buildimage] updated minigraph for ACL Table data and ACL Interface binding update for multu-npu platform based on subrole as "Frontend" or "Backend". For backend npu no ACL table is associated. For frontend npu only front-panel interface are associated. Updated with test case and fix typo in sample-mingraph for npu Address Review comments Signed-off-by: Abhishek Dosi <[email protected]> * Fixed the logic as per preview comment. Interface Filter logic only applies to Everflow/Mirror tables. * Address Review Comments.

…ICE (sonic-net#4573) and then we load image and reboot even if there was existing config_db.json we will look for DHCP Service. we should disbale update_graph in such cases. This behaviour is silimar to what we have in 201811 image.

… present (sonic-net#4581) Since the introduction of VRF, interface-related tables in ConfigDB will have multiple entries, one of which only contains the interface name and no IP prefix. Thus, when iterating over the keys in the tables, we need to ignore the entries which do not contain IP prefixes.

…backend asics (sonic-net#4588) Signed-off-by: Arvindsrinivasan Lakshmi Narasimhan <[email protected]>

This patchset implement the following: - Setting the FAN frequency - Corrections to the EM policy with respect to platform defined temperature / fan values - Updates to the platform monitorng script logging - Fixes to platform initialization script Signed-off-by: Ciju Rajan K <[email protected]>

…to sonic_device_util.py (sonic-net#4559) * Moved utility functions for multi-npu platforms from sonic-utilities config/main.py to here so that they can be used any module * Fix the issue with test run during compilation with acl-uploader PR#908 of sonic-utilities. * Fix get_num_npu as it was retuning string and not int * Address Review Comments * Address Review Comments

* Fix libsnmp-base compilation failure * Convert docker-snmp-sv2 to buster * Define install_python3_wheels * Address review comments * Address review comments * Advance snmpagent submodule * Bump net-snmp to the Buster version * Revert "Fix libsnmp-base compilation failure" * use azure storage url

… 4.19 (sonic-net#4605) * centec x86 update for buster * optimize dal code

Signed-off-by: Joyas Joseph <[email protected]>

…ic-net#4603) * Install python3 in docker-base-buster, so all derived image will benefit Signed-off-by: Qi Luo <[email protected]>

…t#4604)

Fix is_mgmt_vrf_enabled when MGMT_VRF_CONFIG is not present the config (sonic-net#885) Changes to support acl-loader command for multi-npu platforms. (sonic-net#908) Stop/Start restapi server upon config reload (sonic-net#911) [fanshow] Add column drawer name and led status to output of show platform(sonic-net#991) [MultiDB] use sonic-db-cli instead of redis-cli in new added codes (sonic-net#907) [show] Add `ntpstat` output to `show ntp` (sonic-net#861) [config] Log invocation of config commands to syslog (sonic-net#259) Remove dependency on click-default-group package (sonic-net#903) [config] Add 'interface transceiver' subgroup with 'lpmode' and 'rese…' (sonic-net#904) [show] Add 'errors' and 'rates' subcommands to 'show interfaces count…(sonic-net#900) [config] Support load_minigraph command for multi NPU platform (sonic-net#896) [Vnet] Fix NameError for 'swsssdk' and align output (sonic-net#902)

…ce-cli difference versions can cause compatibility issue between the server and client Signed-off-by: Guohan Lu <[email protected]>

…e-cli Signed-off-by: Guohan Lu <[email protected]>

…-net#4606) lldpmgrd listens for changes to the PORT table in the CONFIG_DB and APP_DB in order to handle alias/description config change. It checks if port is up or down by looking into the oper-status for in APP_DB PORT TABLE. If it cannot find it in the App DB, it will log error. During initializing, it is possible that there is a port change in CONFIG_DB and but the not ready in APP_DB. The change here is to only log error in is_port_up() after port init done.

Signed-off-by: Joyas Joseph <[email protected]>

) PR sonic-net#4605 has two changes that are missing, fix them.

…onic-net#4542) Signed-off-by: Rajendra Dendukuri <[email protected]>

…t#4577) * [ntp] enable/disable NTP long jump according to reboot type - Enable NTP long jump after cold reboot. - Disable NTP long jump after warrm/fast reboot. Signed-off-by: Ying Xie <[email protected]> * fix typo * further refactoring * use sonic-db-cli instead

sonic-net#4507)

…0 and Z9100 (sonic-net#4593) For detecting transceiver change events through xcvrd in DellEMC S6000, S6100 and Z9100 platforms. - In S6000, rename 'get_transceiver_change_event' in chassis.py to 'get_change_event' and return appropriate values. - In S6100, implement 'get_change_event' through polling method (poll interval = 1 second) in chassis.py (Transceiver insertion/removal does not generate interrupts due to a CPLD bug) - In Z9100, implement 'get_change_event' through interrupt method using select.epoll().

Changes to commands config reload/load-minigraph (sonic-net#919)

* Changes to support config-setup service for multi-npu platforms. For Multi-npu we are not supporting as of now config initializtion and ZTP. It will support creating config db from minigraph or using config db from previous file system Signed-off-by: Abhishek Dosi <[email protected]> * Address Review Comments. * Address Review comments * Address Review Comments of using pyhton based config load_minigraph/ config save/config reload from shell scripts so that we don't duplicate code. Also while running from shell we will skip stop/start services done by those commands. * Updated to use python command so no code duplication.

…ti NPU platforms (sonic-net#4600) * The following changes for multi-npu platforms are done - Set the type in device_metadata for asic configuration to be same as host - Set the admin-status of internal bgp sessions as up Signed-off-by: Arvindsrinivasan Lakshmi Narasimhan <[email protected]>

Signed-off-by: Guohan Lu <[email protected]>

fixes sonic-net#4473

* Adding new BGP peer groups PEER_V4_INT and PEER_V6_INT. The internal BGP sessions will be added to this peer group while the external BGP sessions will be added to the exising PEER_V4 and PEER_V6 peer group. * Check for "ASIC" keyword in the hostname to identify the internal neighbors.

…x_gpio (sonic-net#4522) SFP util changes to support GPIO mux over i2c_mux_gpio Signed-off-by: Antony Rheneus <[email protected]>

…ys s9130 and s9230 (sonic-net#4618) The default state of the port at startup is admin up, which can cause the port's state to be inconsistent with the actual state

…net#4408)

…el upgrade (sonic-net#4332) - bug fix : Fixed an issue which the nps ko file was not loaded due to the wrong service file name - Optimize the code to reduce changes due to the kernel upgrade - Remove nephos ko file loaded in swss.service.j2 because it has loaded at syncd.service.j2

…row of TH2 to be breakout (sonic-net#4295) - What I did 1. Rename the config.bcm to th2-as7816-64x25G-48x100G_row1.config.bcm, due to that it just allow 1st row of TH2 to be breakout 2. Add port_flex_enable to support dynamic port breakout. 3. Remove the loopback port due to it would make syncd terminate. => The port_config.ini doesn't include the loopback ports. When portsorch start, it would compare the ports in SDK and port_config.ini. Portsorch would remove the loopback ports due to the loopback ports didn't been defined in port_config.ini But the broadcom SAI doesn't support remove port for th2. So it would return fail and syncd would terminate. - How I did it - How to verify it Run with the new SONiC image and syncd would not terminate Signed-off-by: chiourung_huang <[email protected]>

* [device][accton]: Update for AS5835-54T * [device][accton]: Update for AS5835-54T to delete its config.bcm off-loading to the self-brought up of the Broadcom SAI version, 3.5.2.3 due to SONiC not supported. * [device][accton]: Add config.bcm for AS5835-54T * Ran config_checker passed on our config.bcm, however, we off-loaded the needed MV2 SDK config setting to our self-brought up SAI libraries due to the compatibility of config_check among SONiC different branches. [-] help_cli_enable=1 [-] ifp_inports_support_enable=1 [-] memlist_enable=1 [-] port_flex_enable=1 [-] reglist_enable=1 * [device][accton]: Update config.bcm for AS5835-54T based on the latest config_checker Co-authored-by: Polly Hsu <[email protected]>

* [iccpd] build iccpd deb by auto tools

…on. (sonic-net#3861) **- What I did** #### wheel package Makefiles - wheel package Makefiles for sonic-yang-mgmt package. #### libyang Python APIs: - python APIs based on libyang - functions to load/merge yang models and Yang data files - function to validate data trees based on Yang models - functions to merge yang data files/trees - add/set/delete node in schema and data trees - find data/schema nodes from xpath from the Yang data/schema tree in memory - find dependencies - dump the data tree in json/xml #### Extension of libyang Python APIs: -- Cropping input config based on Yang Model. -- Translate input config based on Yang Model. -- rev Translate input config based on Yang Model. -- Find xpath of port, portleaf and a yang list. -- Find if node is key of a list while deletion if yes, then delete the parent. Signed-off-by: Praveen Chaudhary [email protected] Signed-off-by: Ping Mao [email protected]

- Fix fancontrol.service path - Fix return temp format in thermal API - Improve init time in chassis API - Upgrade sfp API

Signed-off-by: Guohan Lu <[email protected]>

…vices

…rvices

…ices

…rvices Signed-off-by: Guohan Lu <[email protected]>

…rt services Signed-off-by: Guohan Lu <[email protected]>

…ervices

…vices

…ervices

…rvices

…ervices

… services Signed-off-by: Guohan Lu <[email protected]>

…ervices

… services

…vices Signed-off-by: Guohan Lu <[email protected]>

Signed-off-by: Guohan Lu <[email protected]>

Added support for S6000 new HWSKU-Q20S48 Modified port_config.ini, TD2 settings to bring the ports UP. Added support for S6000 new HWSKU-Q20S48(20x40G-48x10G) This HWSKU is applicable for S6000 platform, not S6000-ON platform

1. On the ARM architecture, python-j2cli is installed from source code, depends on python-setuptools and python-wheel. 2. On the ARM architecture, install python-cryptography from source code(from azure-storage==0.36.0) depends on libffi-dev and libssl-dev. 3. install crossbuild in buster slave for arm arch kernel compile. 4. Versions before 18.09 do not install docker-ce-cli. 5. umount /proc after dockerfs. 6. change image apt source list from stretch to buster for arm.

Signed-off-by: Guohan Lu <[email protected]>

…#4631) * Trigger thermal action log only if thermal condition changes * test file existence before read file content * fix error for set psu fan speed * Remove logs because it print too frequently

…-net#4638)

…nic-net#4637)

3y Power YPEB-1200am PSU doens't support read fan_dir from pmbus register Check with vendor this PUS type only support F2B fan direction. So add to show "F2B" when red psu_fan_dir sysfs.

Signed-off-by: Sabareesh Kumar Anandan <[email protected]>

…nic-net#4652)

**- Why I did it** Advance sonic-py-swsssdk submodule to fix sonic-net#4632 **- How I did it** In py3, the response from redis connector is encoded as byte array. They need to be decoded before accessing them as strings. Use following commands to test sonic-db-cli CONFIG_DB "keys *" sonic-db-cli CONFIG_DB "hget PORT|Ethernet0 admin_status" **- How to verify it** sonic-db-cli CONFIG_DB "keys *" sonic-db-cli CONFIG_DB "hget PORT|Ethernet0 admin_status" Signed-off-by: Rajendra Dendukuri <[email protected]>

…et#4602) * [platform]: Add a new supported platform, Delta-agc032 Switch Vendor: Delta Switch SKU: Delta-agc032 CPU: BROADWELL-DE ASIC Vendor: Broadcom Switch ASIC: Tomahawk3, BCM56980 Port Configuration: 32x400G + 2x10G - What I did Add a new Delta platform Delta-agc032. - How I did it Add files by following SONiC Porting Guide. - How to verify it 1. decode-syseeprom 2. sensors 3. psuutil 4. sfputil 5. show interface status 6. bcmcmd Signed-off-by: zoe-kuan <[email protected]>

… platform API changes (sonic-net#4644) - Skip thermalctld in DellEMC S6000, S6100, Z9100 and Z9264 platforms. - Change the return type of thermal Platform APIs in DellEMC S6000, S6100, Z9100 and Z9264 platforms to 'float'.

…-net#4658)

…s are installed in setup.py. (sonic-net#4657) Changes: -- Removing the part where build dependencies are installed in setup.py. -- Adding build dependencies in corresponsing rules\..*.mk file. Signed-off-by: Praveen Chaudhary [email protected]

Co-authored-by: Boyang Yu <[email protected]>

Add 'hw-management-generate-dump.sh' to 'show techsupport' command (sonic-net#923) Add common PCIe diag tool (sonic-net#771) Multi-asic changes for config bgp commands and utilities. (sonic-net#910) Loopback interface configuration CLIs (sonic-net#879) Signed-off-by: Shlomi Bitton <[email protected]>

…rs (sonic-net#4666) Images built from master branch and installed on devices where we mount /var/lib/docker in RAM (because the HDD is small) were failing to boot properly. The Docker service failed to start because /var/lib/docker was filled to 100%. This is due to the increase in total number of containers in the image. As of today, /var/lib/docker contains 1.3 GB of data. Therefore, this PR increases the size of the ramdisk to 1.5 GB to accommodate all the containers. Example output below from an Arista-7050-QX32 SKU: ``` admin@sonic:~$ df -h Filesystem Size Used Avail Use% Mounted on ... tmpfs 1.5G 1.3G 172M 89% /var/lib/docker ... ```

Signed-off-by: Joyas Joseph <[email protected]>

…et#4669) This changes is needed to support parallel build Jobs. Made LIBYANG_PY2 and LIBYANG_PY3 depend on LIBYANG and LIBYANG_CPP. Also LIBYANG_CPP depends on LIBYANG. Signed-off-by: Praveen Chaudhary [email protected]

…st image (sonic-net#4661) Fix sonic-net#4656

…ic-net#4672) both for sonic-slave-stretch and sonic-slave-buster

…onic-net#4673) This will allow us to disable services and have it persist across reboots by using the `systemctl mask` operation

This reverts commit dc0f010.

* Update sonic-sairedis (sairedis with SAI 1.6 headers) * Update SAIBCM to 3.7.4.2, which is built upon SAI1.6 headers * missed updating BRCM_SAI variable, fixed it * Update SAIBCM to 3.7.4.2, updated link to libsaibcm * [Mellanox] Update SAI (release:v1.16.3; API:v1.6) Signed-off-by: Volodymyr Samotiy <[email protected]> * Update sonic-sairedis pointer to include SAI1.6 headers * [Mellanox] Update SDK to 4.4.0914 and FW to xx.2007.1112 to match SAI 1.16.3 (API:v1.6) Signed-off-by: Volodymyr Samotiy <[email protected]> * ensure the veth link is up in docker VS container * ensure the veth link is up in docker VS container * [Mellanox] Update SAI (release:v1.16.3.2; API:v1.6) Signed-off-by: Volodymyr Samotiy <[email protected]> * use 'config interface startup' instead of using ifconfig command, also undid the previous change' Co-authored-by: Volodymyr Samotiy <[email protected]>

…et#4670) To support t0 config

PIP installs grpcio-tools via source code Co-authored-by: taocy <[email protected]>

… fail (sonic-net#4675) This change allows the recursive `git clean` and `git reset` commands to continue even if they encounter an error in one of the submodules. Previously, if an error was encountered, the operation would terminate with a message similar to the following: Stopping at 'src/sonic-mgmt-framework'; script returned non-zero status.

Fix hostcfgd so that changes to the "FEATURE" table in ConfigDB are properly handled. Three changes here: 1. Fix indenting such that the handling of each key actually occurs in the for key in status_data.keys(): loop 2. Add calls to sudo systemctl mask and sudo systemctl unmask as appropriate to ensure changes persist across reboots 3. Substitute returns with continues so that even if one service fails, we still try to handle the others Note that the masking is persistent, even if the configuration is not saved. We may want to consider only calling systemctl enable/disable in hostcfgd when the DB table changes, and only call systemctl mask/unmask upon calling config save.

I found that with IPv4Network types, calling list(ip_ntwrk.hosts()) is reliable. However, when doing the same with an IPv6Network, I found that the conversion to a list can hang indefinitely. This appears to me to be a bug in the ipaddress.IPv6Network implementation. However, I could not find any other reports on the web. This patch changes the behavior to call next() on the ip_ntwrk.hosts() generator instead, which returns the IP address of the first host.

Auto restart restapi server after cert rollover

**- Why I did it** We need RIF counters to be enabled by default. Flex Counter does probe for supported counters. If a platform does not support RIF counters, SAI will return NOT_SUPPORTED and Flex Counter will stop polling the counter. **- How to verify it** After fresh install rif counter gropup is enabled by default: $ counterpoll show Type Interval (in ms) Status -------------------- ------------------ -------- QUEUE_STAT default (10000) enable PORT_STAT default (1000) enable RIF_STAT default (1000) enable QUEUE_WATERMARK_STAT default (10000) enable PG_WATERMARK_STAT default (10000) enable Signed-off-by: Mykola Faryma <[email protected]>

Cleanup description string First port (management port) are excluded from general port naming scheme. Management port are excluded from general port naming scheme. before: |on GNS3 |in SONiC | |---------|---------| |Ethernet0|eth0 | |Ethernet1|Ethernet0| |Ethernet2|Ethernet4| |Ethernet3|Ethernet8| after: |on GNS3 |in SONiC | |---------|---------| |eth0 |eth0 | |Ethernet0|Ethernet0| |Ethernet1|Ethernet4| |Ethernet2|Ethernet8| Signed-off-by: Masaru OKI <[email protected]>

- Sensor and Fan information added to primary platforms for thermal API. - Refactors involving better abstractions, code reuse and dead code removal. - Improvements to the diag capabilities - Pylintrc added to improve code quality. Will become fatal at a later time. Co-authored-by: Baptiste Covolato <[email protected]>

) **- Why I did it** When I tested auto-restart feature of swss container by manually killing one of critical processes in it, swss will be stopped. Then syncd container as the peer container should also be stopped as expected. However, I found sometimes syncd container can be stopped, sometimes it can not be stopped. The reason why syncd container can not be stopped is the process (/usr/local/bin/syncd.sh stop) to execute the stop() function will be stuck between the lines 164 –167. Systemd will wait for 90 seconds and then kill this process. 164 # wait until syncd quit gracefully 165 while docker top syncd$DEV | grep -q /usr/bin/syncd; do 166 sleep 0.1 167 done The first thing I did is to profile how long this while loop will spin if syncd container can be normally stopped after swss container is stopped. The result is 5 seconds or 6 seconds. If syncd container can be normally stopped, two messages will be written into syslog: str-a7050-acs-3 NOTICE syncd#dsserve: child /usr/bin/syncd exited status: 134 str-a7050-acs-3 INFO syncd#supervisord: syncd [5] child /usr/bin/syncd exited status: 134 The second thing I did was to add a timer in the condition of while loop to ensure this while loop will be forced to exit after 20 seconds: After that, the testing result is that syncd container can be normally stopped if swss is stopped first. One more thing I want to mention is that if syncd container is stopped during 5 seconds or 6 seconds, then the two log messages can be still seen in syslog. However, if the execution time of while loop is longer than 20 seconds and is forced to exit, although syncd container can be stopped, I did not see these two messages in syslog. Further, although I observed the auto-restart feature of swss container can work correctly right now, I can not make sure the issue which syncd container can not stopped will occur in future. **- How I did it** I added a timer around the while loop in stop() function. This while loop will exit after spinning 20 seconds. Signed-off-by: Yong Zhao <[email protected]>

) - What I did In order to allow the SONiC community to check in platform capability file i.e. platform.json file directly under device folder. We need to add this test to make sure the contents of the this file is compliant with platform capability design specified in DPB HLD doc - How I did it Added platformJson_checker.py file in Test folder. Signed-off-by: Sangita Maity <[email protected]>

…ic-net#4690)

…ic-net#4722) [sonic-sairedis] * 322dd01 2020-06-05 | Fix debian/rules makefile: use shell commands instead of dollar replacements (sonic-net#621) (HEAD -> master, origin/master, origin/HEAD) [Qi Luo] * 6d55a75 2020-06-04 | Update SAI pointer to 1.6.1 (sonic-net#620) [Mahesh Maddikayala] * d6c40e5 2020-06-01 | [MultiDB] use get API to obtain dbid instead of hardcode value (sonic-net#618) [Dong Zhang] * bd132ec 2020-06-01 | Add synchronous mode to sairedis library (sonic-net#617) [Kamil Cudnik] * 0a77a09 2020-06-01 | [meta] Fix tests to be backward compatible (sonic-net#619) [Kamil Cudnik] [sonic-swss-common] * 35bc01a 2020-06-05 | EVPN VXLAN DB support (sonic-net#339) (HEAD -> master, origin/master, origin/HEAD) [Rajesh Sankaran] * 2c7354b 2020-05-30 | Add modifyRedis flag to consumer table object (sonic-net#344) [Kamil Cudnik] * 5a32636 2020-05-27 | Fix memory leak in pyext when Selectable is returned to Python (sonic-net#343) [pavel-shirshov]

* [MultiDB] daemon base should use multiDB DBConnector * [sonic-platform-daemon] update submodule for multiDB changes

…4725)

* [secure boot] Support to sign swi image * Fix build issue * fix tab format issue * Fix typing issue * Change the sign_image.sh command line * Remove SONIC_CETIFICATE_PATH * Fix bugs

Signed-off-by: Joyas Joseph <[email protected]>

**- Why I did it** For decoding system EEPROM of S6000 based on Dell offset format and S6000-ON’s system EEPROM in ONIE TLV format. **- How I did it** - Differentiate between S6000 and S6000-ON using the product name available in ‘dmi’ ( “/sys/class/dmi/id/product_name” ) - For decoding S6000 system EEPROM in Dell offset format and updating the redis DB with the EEPROM contents, added a new class ‘EepromS6000’ in eeprom.py, - Renamed certain methods in both Eeprom, EepromS6000 classes to accommodate the plugin-specific methods. **- How to verify it** - Use 'decode-syseeprom' command to list the system EEPROM details. - Wrote a python script to load chassis class and call the appropriate methods. UT Logs: [S6000_eeprom_logs.txt](https://github.com/Azure/sonic-buildimage/files/4735515/S6000_eeprom_logs.txt), [S6000-ON_eeprom_logs.txt](https://github.com/Azure/sonic-buildimage/files/4735461/S6000-ON_eeprom_logs.txt) Test script: [eeprom_test_py.txt](https://github.com/Azure/sonic-buildimage/files/4735509/eeprom_test_py.txt)

…ic-net#4713) Update sonic-snmpagent submodule with PRs: 89b7b2c [Multi-asic]: Namespace support for LLDP and Sensor tables (sonic-net#131) fcb8955 Simplify test code (sonic-net#132) a677876 [Multi-asic]: Support multi-asic platform (sonic-net#126) update sonic-py-swsssdk submodule with PRs: 132f8d5 [MultiDB]: use python class composition to avoid confusion in base class (sonic-net#74) Signed-off-by: SuvarnaMeenakshi <[email protected]>

The -sv2 suffix was used to differentiate SNMP Dockers when we transitioned from "SONiCv1" to "SONiCv2", about four years ago. The old Docker materials were removed long ago; there is no need to keep this suffix. Removing it aligns the name with all the other Dockers.

* Enable to build osw1800 * Modify wnc-eeprom which base on debian buster's eeprom.c Co-authored-by: Brand.huang <[email protected]>

) Signed-off-by: Sabareesh Kumar Anandan <[email protected]>

…sonic-net#4702) Update AS7312-54X,AS7312-54XS,AS7315-27XB config.bcm file to make sure there is no the following error message. configuration: format error in /usr/share/sonic/hwsku/th-as7312-48x25G+6x100G.config.bcm on line 110 (ignored)#15

**How I did it** - Modified port_config.ini, TD2 settings to bring the ports UP. **How to verify it** - Check LLDP neighbors,LLDP table, interface status,EEPROM and other show commands. - Do OIR, LED, Traffic testings.

**Why I did it** - Added support for S6000 new HWSKU-Q24S32 **How I did it** - Modified port_config.ini, TD2 settings to bring the ports UP. **How to verify it** - Check LLDP neighbors,LLDP table, interface status,EEPROM and other show commands. - Do OIR, LED, Traffic testings.

…v6 rules are not added to the same ACL table

…_rule and is_ipv6_rule is addressed and also raising Exceptions instead of simply aborting when the conflict occurs is handled

…existing functions

…e found

…rsioning rule

Handling Control Plane ACLs so that IPv4 rules and IP… #1

Handling Control Plane ACLs so that IPv4 rules and IP… #1

Commits on Apr 16, 2020

Commits on Apr 17, 2020

Commits on Apr 19, 2020

Commits on Apr 20, 2020

Commits on Apr 21, 2020

Commits on Apr 22, 2020

Commits on Apr 23, 2020

Commits on Apr 24, 2020

Commits on Apr 25, 2020

Commits on Apr 26, 2020

Commits on Apr 27, 2020

Commits on Apr 28, 2020

Commits on Apr 29, 2020

Commits on Apr 30, 2020

Commits on May 1, 2020

Commits on May 2, 2020

Commits on May 4, 2020

Commits on May 5, 2020

Commits on May 6, 2020

Commits on May 7, 2020

Commits on May 8, 2020

Commits on May 9, 2020

Commits on May 11, 2020

Commits on May 12, 2020

Commits on May 13, 2020

Commits on May 14, 2020

Commits on May 15, 2020

Commits on May 17, 2020

Commits on May 18, 2020

Commits on May 19, 2020

Commits on May 20, 2020

Commits on May 21, 2020

Commits on May 22, 2020

Commits on May 25, 2020

Commits on May 26, 2020

Commits on May 27, 2020

Commits on May 28, 2020

Commits on May 29, 2020

Commits on May 30, 2020

Commits on May 31, 2020

Commits on Jun 1, 2020

Commits on Jun 2, 2020

Commits on Jun 4, 2020

Commits on Jun 5, 2020

Commits on Jun 8, 2020

Commits on Jun 9, 2020

Commits on Jun 10, 2020

Commits on Jun 11, 2020

Commits on Jun 12, 2020

Commits on Jun 13, 2020

Commits on Jul 6, 2020