Fix the version of m2crypto (0.38).#124
Closed
chaoskao wants to merge 429 commits into
Closed
Conversation
- What I did I added requires "protocol" field due to fpmsyncd reconcile logic (WarmRestartHelper class) requires old fvs keys to match new fvs. - How I did it Add "protocol" field in db migration. - How to verify it Upgrade from older branch to new image with supported FIB pending. The field was added by sonic-net/sonic-swss#2551. Signed-off-by: Stepan Blyschak <stepanb@nvidia.com>
#### What I did Adjust `show runningconfiguration syslog` command according to the new syslog configuration file #### How I did it Fix regex to match the target syslog server #### How to verify it Run the next command in sonic shell: ``` show runningconfiguration syslog ```
Added two clear commands for fabric counters queue and fabric counters port.
sonic-clear fabriccountersport
sonic-clear fabriccountersqueue
By issuing the command, the fabric counters are clear and saved. An example is as follow.
# show fabric counters port
ASIC PORT STATE IN_CELL IN_OCTET OUT_CELL OUT_OCTET CRC FEC_CORRECTABLE FEC_UNCORRECTABLE SYMBOL_ERR
------ ------ ------- --------- ---------- ---------- ----------- ----- ----------------- ------------------- ----------
...
0 49 up 1 244 0 0 0 2 2,372,752,496 0
0 50 up 2 315 1 135 0 4 2,522,457,120 4
...
# sonic-clear fabriccountersport
Clear and update saved counters port
# show fabric counters port
ASIC PORT STATE IN_CELL IN_OCTET OUT_CELL OUT_OCTET CRC FEC_CORRECTABLE FEC_UNCORRECTABLE SYMBOL_ERR
------ ------ ------- --------- ---------- ---------- ----------- ----- ----------------- ------------------- ------------
...
0 49 up 0 0 0 0 0 0 0 0
0 50 up 0 0 0 0 0 0 0
Signed-off-by: Jie Feng <jfeng@arista.com>
…->master upgrade + fast-reboot. Add UT. (#2839) Add migration of FLEX_COUNTER_DELAY_STATUS attribute of config_db FLEX_COUNTER_TABLE during the SONiC to SONiC upgrade + fast-reboot from older versions 201911 -> master. This change is required for the fast-reboot procedure because without it the counters will be created during the init flow which will waste a lot of resources and cause data plane degradation of more than 30 seconds. How I did it Modify the db_migrator.py. How to verify it Add UT. Signed-off-by: vadymhlushko-mlnx <vadymh@nvidia.com>
This reverts commit fceef2e.
…unication (#2525) Signed-off-by: Arvindsrinivasan Lakshmi Narasimhan arlakshm@microsoft.com Microsoft ADO 24363637 What I did Currently on multi asic platform the acl-loader script connects to all the db in the namespaces using unix sockets. This cause permission errors when executing show acl commands for user with RO privileges. To avoid this change the acl-loader to use tcp socket to connect to db in namespaces How I did it update acl-loader How to verify it UT Signed-off-by: Arvindsrinivasan Lakshmi Narasimhan <arlakshm@microsoft.com>
- What I did Implement config and show commands for static DNS feature. According to sonic-net/SONiC#1262 HLD. - How I did it Static DNS config commands are implemented in the new config/dns.py file. DNS config commands are available under config dns ... sub-command. Show commands are implemented in the new show/dns.py file. DNS show commands are available under show dns ... sub-command. - How to verify it Compile sonic-utilities package. The unit tests will run automatically during the compilation. Coverage for config/dns.py : 94% Coverage for show/dns.py : 86% - Previous command output (if the output of a command-line utility has changed) - New command output (if the output of a command-line utility has changed) # config dns nameserver add 1.1.1.1 # config dns nameserver add 8.8.8.8 # show dns nameserver Nameserver ------------ 1.1.1.1 8.8.8.8
- What I did Added support for secure upgrade - How I did it It includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). HLD can be found in the following PR: sonic-net/SONiC#1024 - How to verify it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. - Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future.
#### What I did Added support for marvell sdk commands in "show techsupport". #### How I did it Modified the generate_dump script, to add marvell sdk commands under a proper platform check. #### How to verify it Verified the change by running "show techsupport" command and check all the newly added marvel sdk commands are collecting the correct information.
…ph (#2887) Microsoft ADO: 18217044 This PR is follow up to an old PR: #2515 This PR addresses two issues: Not migrating RESTAPI, TELEMETRY, DEVICE_METADATA entries if they are not supported in target image's minigraph.py. Not migrating these entries if minigraph.xml file is missing. Not maintaining the config for these tables in two different places. Currently db migrator has its own constants, and minigraph.py maintains its own. How I did it This change removes hardcoding config in migrator code, and migrating the config for RESTAPI, TELEMETRY, DEVICE_METADATA from minigraph generator. How to verify it Tested on a physical device.
…"show bfd peer" (#2750) Signed-off-by: PinghaoQu qu.pinghao@h3c.com What I did In the show bfd peer section, "show bgp peer" command should be "show bfd peer" How I did it Changed "show bgp peer" to "show bfd peer" How to verify it Check Command-Reference.md
Signed-off-by: vadymhlushko-mlnx <vadymh@nvidia.com> What I did Set the correct value for the db_migrator class variable CURRENT_VERSION, because if the new DB version was introduced the CURRENT_VERSION variable should have the newest version value. How I did it Edit the db_migrator.py. How to verify it Extend existing UT.
HLD sonic-net/SONiC#1101 - What I did Implemented CLI for Generic Hash feature - How I did it Integrated Generic Hash interface into config and show CLI root - How to verify it Run Generic Hash CLI UTs Signed-off-by: Nazarii Hnydyn <nazariig@nvidia.com>
…om minigraph parser (#2890) MSFT ADO: 24419953 This is to fix a bug where warm upgrade from old image (eg. 20181130) to new image (eg. 202012) does not update docker_routing_config_mode to the new config expected the target OS. For eg., in 201811 DEVICE_METADATA.localhost.docker_routing_config_mode is set to unified. After upgrade to 202012 the value is not changed. However, the expectation in newer images is that the value is separated. The move from unified to separated was done as part of an old change: sonic-net/sonic-buildimage#2961 However, migration logic was not updated since then. Because of this miss, cross-branch warm-upgrade from 201811 to 2020212 to 202305 to latest will always keep the setting as unified. How I did it Added a common migration logic: update docker_routing_config_mode to the value from minigraph parser. How to verify it Added a new unit test. Updated old unit tests.
What I did Skip soc_ipv6 when comparing appl_db and asic_db route entries on active-active dualtor. Because it's creating false alarms when tunnel route is added for soc ips. The route is meant to be programmed in asic only. sign-off: Jing Zhang zhangjing@microsoft.com How I did it How to verify it Run the updated script on active-active dualtor devices.
What I did sonic-net/sonic-buildimage#14549 This PR has introduced DNS configuration to CONFIG_DB, we need to migrate original CONFIG_DB to support DNS configuration during upgrading SONiC. How I did it If there's no DNS_NAMESERVER table in CONFIG_DB, read DNS_NAMESERVER table from minigraph and update CONFIG_DB. How to verify it Run unit test for db migrator.
What I did As the subject. This PR is to leave the vlan neighbor route checking to dualtor_neighbor_check.py script: #2840 Signed-off-by: Longxiang Lyu lolv@microsoft.com How I did it If any misses are found on dualtor, ignore those vlan neighbor misses. How to verify it UT and verify on testbed.
…well (#2909) Update `show mux config` to print soc_ipv6 as well if it exists. sign-off: Jing Zhang zhangjing@microsoft.com
…2840)
#### What I did
Add script `dualtor_neighbor_check.py` to verify the neighbor consistency
based on the mux state. It will have the following output:
```
NEIGHBOR MAC PORT MUX_STATE IN_MUX_TOGGLE NEIGHBOR_IN_ASIC TUNNERL_IN_ASIC HWSTATUS
------------- ----------------- ---------- ----------- --------------- ------------------ ----------------- ----------
192.168.0.2 ee:86:d8:46:7d:01 Ethernet4 standby False no yes consistent
192.168.0.3 86:73:c2:22:bf:02 Ethernet8 standby False no yes consistent
192.168.0.24 56:a6:bf:c5:dd:17 Ethernet92 active False yes no consistent
192.168.0.25 3a:18:56:f5:02:18 Ethernet96 active False yes no consistent
192.168.0.100 00:00:00:00:00:00 N/A N/A N/A no yes consistent
```
Signed-off-by: Longxiang Lyu <lolv@microsoft.com>
#### How I did it
the workflow of this scripts:
1. for non-zero-mac neighbors in `APPL_DB` `NEIGH_TABLE`, use the `ASIC_DB` fdb entries to find the mux port that it belongs to.
2. check if the neighbor is consistent with mux state:
* if mux state is `active`, the neighbor is consistent only if the neighbor is present in `ASIC_DB` but no tunnel route.
* if mux state is `standby`, the neighbor is consistent only if the tunnel route is present in `ASIC_DB`1 but no neighbor.
3. if there are any inconsistent neighbors and the mux port is currently in-toggle, the script will have a non-zero negative return, and will write error messages to logs.
#### How to verify it
UT and verify on testbed.
#### Previous command output (if the output of a command-line utility has changed)
#### New command output (if the output of a command-line utility has changed)
…lure (#2897) #### What I did When a second techsupport instance starts while one is running, the message thrown before exiting is not very user friendly. Thus updating the message for it to make more sense.
* Flush RESTAPI db in fast-reboot shutdown path
…(#2919) What I did MSFT ADO: 24598790 Why: RESTAPI table has certs generated from minigraph parser. The values in RESTAPI table (cert and key names) are dependent on how they are hardcoded in minigraph parser. Current solution works on public repo, but breaks the internal build (different naming). What: Do not match values for RESTAPI attributes. The test still ensures that missing table and keys are migrated. How I did it How to verify it
…to version 4_0_1 (#2912) #### What I did In PR #2893 the db_migrator "migrate_dns_nameserver" was misplaced in the latest version being version 4_0_4 instead of being placed in version 4_0_3. Additionally, the log info for version 4_0_1 was missing as well
Handle corner case for multi-asics: 1. when golden config file is empty for multi-asic case 2. when config format is incorrect for multi-asics, e.g. localhost or namespace is missing in golden config db
* Update DB entry table ref syntax. Allow non-lossless queues to be queried and updated. Remove entire wred_profile entry to activate a change to the SAI layer. If wred_profile was the only value and was removed, delete entire key entry. Check that a port is available before attempting an index access. * Update mock DB syntax, fix UT. Update mock DB syntax for wred_profile entries. Add UT support for expecting no wred profile to exist. Fix UT expectations. * Add new lossy queue tests. * rm comment. * rm another comment. --------- Co-authored-by: Kevin Wang <65380078+kevinskwang@users.noreply.github.com>
…#2928) * [build] Fix dependency issue between responses and urllib3 package.
#### What I did Add [YANG "refine"](https://www.rfc-editor.org/rfc/rfc7950.html#section-7.13.2) support for the `sonic_cli_gen` utility. YANG refine is used to override the `description` and `mandatory` statements for YANG `grouping`. #### How I did it Modify the `sonic_cli_gen/yang_parser.py` #### How to verify it Modify the `sonic_cli_gen` UT
…command. What I did: Fixed the sFlow unit test because some command calls were removed from "config sflow enable" command. Why I did it: To fix the failing unit test. How I verified it: Ran the unit test and confirmed that all cases passed.
warning messages are showed when executing the “config sflow enable” command.
- What I did: Only apply lossless buffer configuration for ecSAI. - Why I did: When upgrading to SONiC 202311.X, running tests with sonic-mgmt on community SAI would cause syncd to crash due to issues with the lossless buffer configuration. To avoid this, the config load_minigraph command must clear the buffer before reapplying the configuration, and the lossless buffer configuration should only be applied on ecSAI. - How I verified: Load SONIC 202311.X on community SAI and ecSAI, verify the lossless buffer configuration only apply on ecSAI.
[Buffer] Only apply lossless buffer configuration for ecSAI.
When implementing DPB ansible test, the DPB CLI command will prompt out "Below Config can not be verified, It may cause harm to the system." "Do you wish to Continue?" and wait for the user to press key to proceed. To make it easier in implementing DPB ansible test cases, do no display the warning message if no unverified config existed.
Only print command and argument information - sonic-cli-list show argument Only print command and option information - sonic-cli-list show option Print all information - sonic-cli-list show all
Root Cause: When SAG is enabled, the IPv6 link-local address may change. If DHCPv6 is also enabled, the binding address used may become incorrect, resulting in the failure to properly receive packets from the server side. Solution: Restart the DHCP relay container to update the IPv6 link-local address whenever both SAG and DHCPv6 are enabled.
…and canceling unnecessary checks Why i did? - On low-performance CPUs, large ROUTE_ENTRY executions caused system hangs due to excessive SubscriberStateTable subscriptions to ASIC_STATE TABLE, which also led to prolonged route_check execution (>120s) and crashes triggered by monit termination (>300s). - Unnecessary synchronization checks between APPL-DB and ASIC-DB were redundant, as route_check only requires ASIC_STATE:SAI_OBJECT_TYPE_ROUTE_ENTRY subscriptions. what i did? 1. Canceled redundant subscription checks and TEST_DATA 1 to prevent system hangs. 2. Modified ASIC_TABLE_NAME in route_check.py and route_check_test_data.py to subscribe only to ASIC_STATE:SAI_OBJECT_TYPE_ROUTE_ENTRY, reducing subscription overhead. 3. Refactored checkout_rt_entry to extract_normalize_ip for clearer IP extraction logic, enhancing route_check efficiency.
- Why I did it: Code defect for unknown ASIC. The queue used by the mirror session is displayed according to the type of ASIC. It does not take into account that when encountering a new ASIC, the CLI will crash because the queue variable is not defined. - What I did: If an unsupported ASIC is encountered, "show mirror_session" will maintain the same format as the community without showing the queue. - How I verified it: The "show mirror_session" is working on the es9618xx device.
…session show mirror_session command crashes on ES9618xx
What I did: The original implementation applied QoS template files only when running with ecSAI. The condition was updated to apply the QoS template files by default, except when running with the community Broadcom SAI. As a result, the Xsight ES9618xx device is now able to load the QoS templates as well. Why I did it: The lack of QoS template files on the Xsight ES9618xx caused failures in the pfc_config and ecn_config_update test cases.
…community-brcm-sai QoS template files were not being applied on the Xsight ES9618xx device.
What I did: The original implementation applied QoS template files only when running with ecSAI. The condition was updated to apply the QoS template files by default, except when running with the community Broadcom SAI. As a result, the Xsight ES9618xx device is now able to load the QoS templates as well. Why I did it: The lack of QoS template files on the Xsight ES9618xx caused failures in the pfc_config and ecn_config_update test cases.
…community-brcm-sai-2 QoS template files were not being applied on the Xsight ES9618xx device.
…mmand to specifiy the methods will need quotes." This reverts commit e58bec5.
Revert "[radius] Fix the issue in authorization and accounting CLI command to specifiy the methods will need quotes."
- Why I did it: Maintain the community's native behavior without changing it. - What I did: 1. When using the "config acl add table" command to bind an ACL on a VLAN interface, the ACL table is bound to the VLAN member port instead of the VLAN interface. 2. When using the "acl-loader" command to create a rule, the default deny rule is not added to the egress ACL table. - How I verified it: Use the community version of test_acl.py in sonic-mgmt to verify ACL feature on es9618xx.
Restored ACL CLI behavior to be consistent with the community
Why I did it When excessive MAC addresses are learned and MAC aging occurs, pre-fetched keys may become out of sync with the actual ASIC_DB state, causing nbrshow or show arp to terminate unexpectedly. What I did Disable blocking on get_all() to avoid repeated retries. Add try-except to prevent nbrshow termination on database access failure. Add checks for required keys in FDB entries to avoid KeyError. How I verified it Run nbrshow -4/-6 or show arp on DUT with many MACs and aging events: command completes successfully. Problematic FDB entries are skipped; valid neighbors are displayed. ARP/neighbor pytest tests pass.
…712/AS7816 What I did: Added Edgecore switches to the support list in generic-config-updater for the dynamic_th field in BUFFER_PROFILE. Why I did it: Previously, generic-config-updater could not apply changes to the dynamic_th field in BUFFER_PROFILE on Edgecore switches due to missing support in the device list.
…fig-updater Support dynamic_th field in BUFFER_PROFILE for new devices AS9716/AS7712/AS7816
… update (edge-core#120) Added ES9618XX platform to the support list in generic-config-updater for the dynamic_th field in BUFFER_PROFILE. It's needed for sonic-mgmt test_mmu_dynamic_threshold_config_update.py::test_dynamic_th_config_updates test Signed-off-by: Anton Parkhomenko <aparkhomenko@larch-networks.com> Co-authored-by: Anton Parkhomenko <aparkhomenko@larch-networks.com>
Optimize FDB lookup and ARP display performance - Cache all BVID → VLAN mappings in advance to avoid repeated get_vlan_id_from_bvid() calls. - Replace linear search over bridge_mac_list with a dictionary lookup (vlan, mac) → if_name for O(1) performance. - Greatly reduces latency for show arp with large ARP/FDB tables.
"if tx_power:" checks truthiness It cannot distinguish None vs 0 Use is None / is not None when 0 is a meaningful value
The ZR transmit power cannot be set to zero
- What I did: Fix the version of m2crypto (0.38). - Why I did: The requirement will use the latest version (0.47) of M2Crypto, which requires OpenSSL 3.0. However, Sonic only uses OpenSSL 1.1. Therefore, the image build will be built.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What I did
Fix the version of m2crypto (0.38).
Why I did
The requirement will use the latest version (0.47) of M2Crypto, which requires OpenSSL 3.0.
However, Sonic only uses OpenSSL 1.1. Therefore, the image build will be built.