Fix the version of m2crypto (0.38).

.github/codeql/codeql-config.yml

@@ -0,0 +1,4 @@
+name: "CodeQL config"
+queries:
+  - uses: security-and-quality
+  - uses: security-extended

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,43 @@
+# For more infomation, please visit: https://github.com/github/codeql-action
+
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - 'master'
+      - '202[0-9][0-9][0-9]'
+  pull_request_target:
+    branches:
+      - 'master'
+      - '202[0-9][0-9][0-9]'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'python' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        config-file: ./.github/codeql/codeql-config.yml
+        languages: ${{ matrix.language }}
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"

azure-pipelines.yml

@@ -13,6 +13,13 @@ resources:
     name: sonic-net/sonic-swss
     endpoint: sonic-net
 
+variables:
+  - name: BUILD_BRANCH
+    ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
+      value: $(System.PullRequest.TargetBranch)
+    ${{ else }}:
+      value: $(Build.SourceBranchName)
+
 stages:
 - stage: Build
 
@@ -26,7 +33,7 @@ stages:
       vmImage: ubuntu-20.04
 
     container:
-      image: sonicdev-microsoft.azurecr.io:443/sonic-slave-bullseye:latest
+      image: sonicdev-microsoft.azurecr.io:443/sonic-slave-bullseye:$(BUILD_BRANCH)
 
     steps:
     - script: |
@@ -45,16 +52,18 @@ stages:
         artifact: sonic-buildimage.vs
         runVersion: 'latestFromBranch'
         runBranch: 'refs/heads/$(sourceBranch)'
+        patterns: |
+          **/*.deb
+          **/*.whl
       displayName: "Download artifacts from latest sonic-buildimage build"
 
     - script: |
         set -xe
-        sudo apt-get -y purge libhiredis-dev libnl-3-dev libnl-route-3-dev
+        sudo apt-get -y purge libnl-3-dev libnl-route-3-dev || true
         sudo dpkg -i libnl-3-200_*.deb
         sudo dpkg -i libnl-genl-3-200_*.deb
         sudo dpkg -i libnl-route-3-200_*.deb
         sudo dpkg -i libnl-nf-3-200_*.deb
-        sudo dpkg -i libhiredis0.14_*.deb
         sudo dpkg -i libyang_1.0.73_amd64.deb
         sudo dpkg -i libyang-cpp_1.0.73_amd64.deb
         sudo dpkg -i python3-yang_1.0.73_amd64.deb
@@ -66,9 +75,9 @@ stages:
         source: specific
         project: build
         pipeline: 9
-        artifact: sonic-swss-common.bullseye.amd64
+        artifact: sonic-swss-common
         runVersion: 'latestFromBranch'
-        runBranch: 'refs/heads/master'
+        runBranch: 'refs/heads/$(sourceBranch)'
       displayName: "Download sonic swss common deb packages"
 
     - script: |

clear/bgp_frr_v6.py

@@ -26,9 +26,9 @@ def neigh_all(ipaddress):
     """Clear all BGP peers"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear bgp ipv6 {}"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 {}".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear bgp ipv6 *"'
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 *"]
     run_command(command)
 
 # 'in' subcommand
@@ -38,9 +38,9 @@ def neigh_in(ipaddress):
     """Send route-refresh"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear bgp ipv6 {} in"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 {} in".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear bgp ipv6 * in"'
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 * in"]
     run_command(command)
 
 
@@ -51,9 +51,9 @@ def neigh_out(ipaddress):
     """Resend all outbound updates"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear bgp ipv6 {} out"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 {} out".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear bgp ipv6 * out"'
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 * out"]
     run_command(command)
 
 
@@ -69,22 +69,22 @@ def soft_in(ipaddress):
     """Send route-refresh"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear bgp ipv6 {} soft in"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 {} soft in".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear bgp ipv6 * soft in"'
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 * soft in"]
     run_command(command)
 
 
 # 'soft all' subcommand
-@neighbor.command('all')
+@soft.command('all')
 @click.argument('ipaddress', required=False)
 def soft_all(ipaddress):
     """Clear BGP neighbors soft configuration"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear bgp ipv6 {} soft"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 {} soft".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear bgp ipv6 * soft"'
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 * soft"]
     run_command(command)
 
 # 'soft out' subcommand
@@ -94,8 +94,7 @@ def soft_out(ipaddress):
     """Resend all outbound updates"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear bgp ipv6 {} soft out"' \
-            .format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 {} soft out".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear bgp ipv6 * soft out"'
+        command = ['sudo', 'vtysh', '-c', "clear bgp ipv6 * soft out"]
     run_command(command)

clear/bgp_quagga_v4.py

@@ -27,9 +27,9 @@ def neigh_all(ipaddress):
     """Clear all BGP peers"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ip bgp {}"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp {}".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ip bgp *"'
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp *"]
     run_command(command)
 
 
@@ -40,9 +40,9 @@ def neigh_in(ipaddress):
     """Send route-refresh"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ip bgp {} in"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp {} in".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ip bgp * in"'
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp * in"]
     run_command(command)
 
 
@@ -53,9 +53,9 @@ def neigh_out(ipaddress):
     """Resend all outbound updates"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ip bgp {} out"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp {} out".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ip bgp * out"'
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp * out"]
     run_command(command)
 
 
@@ -71,9 +71,9 @@ def soft_all(ipaddress):
     """Clear BGP neighbors soft configuration"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ip bgp {} soft"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp {} soft".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ip bgp * soft"'
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp * soft"]
     run_command(command)
 
 
@@ -84,9 +84,9 @@ def soft_in(ipaddress):
     """Send route-refresh"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ip bgp {} soft in"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp {} soft in".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ip bgp * soft in"'
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp * soft in"]
     run_command(command)
 
 
@@ -97,7 +97,7 @@ def soft_out(ipaddress):
     """Resend all outbound updates"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ip bgp {} soft out"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp {} soft out".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ip bgp * soft out"'
+        command = ['sudo', 'vtysh', '-c', "clear ip bgp * soft out"]
     run_command(command)

clear/bgp_quagga_v6.py

@@ -25,9 +25,9 @@ def neigh_all(ipaddress):
     """Clear all BGP peers"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ipv6 bgp {}"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ipv6 bgp {}".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ipv6 bgp *"'
+        command = ['sudo', 'vtysh', '-c', "clear ipv6 bgp *"]
     run_command(command)
 
 
@@ -38,9 +38,9 @@ def neigh_in(ipaddress):
     """Send route-refresh"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ipv6 bgp {} in"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ipv6 bgp {} in".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ipv6 bgp * in"'
+        command = ['sudo', 'vtysh', '-c', "clear ipv6 bgp * in"]
     run_command(command)
 
 
@@ -51,9 +51,9 @@ def neigh_out(ipaddress):
     """Resend all outbound updates"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ipv6 bgp {} out"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', 'clear ipv6 bgp {} out'.format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ipv6 bgp * out"'
+        command = ['sudo', 'vtysh', '-c', 'clear ipv6 bgp * out']
     run_command(command)
 
 
@@ -69,9 +69,9 @@ def soft_all(ipaddress):
     """Clear BGP neighbors soft configuration"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ipv6 bgp {} soft"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ipv6 bgp {} soft".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ipv6 bgp * soft"'
+        command = ['sudo', 'vtysh', '-c', "clear ipv6 bgp * soft"]
     run_command(command)
 
 
@@ -82,9 +82,9 @@ def soft_in(ipaddress):
     """Send route-refresh"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ipv6 bgp {} soft in"'.format(ipaddress)
+        command = ['sudo', 'vtysh', '-c', "clear ipv6 bgp {} soft in".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ipv6 bgp * soft in"'
+        command = ['sudo', 'vtysh', '-c', "clear ipv6 bgp * soft in"]
     run_command(command)
 
 
@@ -95,8 +95,7 @@ def soft_out(ipaddress):
     """Resend all outbound updates"""
 
     if ipaddress is not None:
-        command = 'sudo vtysh -c "clear ipv6 bgp {} soft out"' \
-            .format(ipaddress)
+        command = ['sudo' ,'vtysh' ,'-c', "clear ipv6 bgp {} soft out".format(ipaddress)]
     else:
-        command = 'sudo vtysh -c "clear ipv6 bgp * soft out"'
+        command = ['sudo', 'vtysh', '-c', "clear ipv6 bgp * soft out"]
     run_command(command)