…form (sonic-net#2572)

/etc/init.d/sxdkernel stop may take up to 15 sec which has impact on
control plane downtime

Signed-off-by: Stepan Blyschak <[email protected]>

…to INFO (sonic-net#2576)

* Add a log message for each notification of add/del TACACS server.

Signed-off-by: Renuka Manavalan <[email protected]>

* Moved another syslog message from DEBUG to INFO to be able to see those notifications.

All these changes are to help with a one-time-seen-bug, that hostcfgd did not act upon changes to redis for TACACS servers. We could not repro the bug.

Signed-off-by: Renuka Manavalan <[email protected]>

Signed-off-by: Guohan Lu <[email protected]>

…r config and reload with default l2 configuration. (sonic-net#2536)

'show vlan config' not displaying the VLAN members, after clear config done loaded with default l2 configuration.

need to flush asic db in swss.sh instead of syncd.sh

orchagent might already started in swss.sh and put commands
into asic db before asic db is flushed in syncd.sh. This
causes race condition such as INIT_VIEW not passing to syncd.

Signed-off-by: Guohan Lu <[email protected]>

Signed-off-by: Mykola Faryma <[email protected]>

Conflicts:
	src/sonic-config-engine/tests/sample_output/ports.json
	src/sonic-config-engine/tests/test_cfggen.py

- removing -g to disable jump when time difference is greater than 1000s
- add -x to disable initial jump

…sonic-net#2494)" (sonic-net#2590)

This reverts commit 33fe8d2.

…net#2593)

Signed-off-by: Mykola Faryma <[email protected]>

…onic-net#2594)

* [201811 submodules] advance sairedis, swss, swss-common, utilities

Submodule src/sonic-sairedis d57222a..54b02a1:
  > Add support for fdb_event MOVE and check fdb event oids (sonic-net#420)
  > [vslib] add missing port attributes for virtual switch (sonic-net#419)

Submodule src/sonic-swss 584490c..62e2a20:
  > [fdborch] Store vlan id of FDB entry instead of port pvid into stateD… (sonic-net#759)
  > [portsorch] Change speed set flow (sonic-net#764)
  > Create egress ACL table group during the PFCWD stats list installment (sonic-net#787)

Submodule src/sonic-swss-common 286ef34..2592b0c:
  > Add support for WarmStart::setDataCheckState() (#242)

Submodule src/sonic-utilities b44b462..d409987:
  > [sonic_installer] Improve error handling (sonic-net#460)
  > [clock] sync os time to CMOS before rebooting (sonic-net#465)
  > [intfstat] add intfstat script to output RIF counters (sonic-net#439)

Signed-off-by: Ying Xie <[email protected]>

* [201811 utilties] add 201811 branch for sonic-utilities repo

Submodule src/sonic-utilities d409987...ff1448c:
  > [sonic_installer] Improve error handling (sonic-net#460)
  > [clock] sync os time to CMOS before rebooting (sonic-net#465)
  < [sonic_installer] Improve error handling (sonic-net#460)
  < [clock] sync os time to CMOS before rebooting (sonic-net#465)
  < [intfstat] add intfstat script to output RIF counters (sonic-net#439)

Signed-off-by: Ying Xie <[email protected]>

…2592)

Signed-off-by: Mykola Faryma <[email protected]>

Submodule src/sonic-swss 62e2a20..4b489ce:
  > Fix incorrect ACL CRM increment, resulting orchagent crash (sonic-net#800)

Signed-off-by: Ying Xie <[email protected]>

Signed-off-by: Andriy Moroz <[email protected]>

…nic-net#2619)

Submodule src/sonic-utilities ff1448c..f95da07:
  > [fast/warm reboot] set default reboot method to "kexec -e" (sonic-net#473)

Signed-off-by: Ying Xie <[email protected]>

Signed-off-by: Andriy Moroz <[email protected]>

…ices (sonic-net#2634)

* [services] Ensure swss and syncd services start before dependent services

* Add 'attach' functions to scripts which get installed to /usr/local/bin so that services only reference the one script each

* Add 'After=swss.service' to syncd.service

…aces to be ready before starting radvd (sonic-net#2558)

…efactor patch (sonic-net#2624)

…-net#2573)

Rate limiting at 20,000 messages per 5-minute interval

…-net#2639)

start() is called by service startPre method, which is blocking. Starting
syncd service here is causing deadlock.

attach() is called by service start method, which is non-blocking.

Signed-off-by: Ying Xie <[email protected]>

Signed-off-by: Wenda Ni <[email protected]>

)

Submodule src/sonic-swss 4b489ce..90eb25d:
  > [portsorch] fix bug in speed set (sonic-net#806)

Submodule src/sonic-swss-common 2592b0c..c674e64:
  > Add multiple fields hdel support (#267)
  > Update PFC_WD table name in CONFIG_DB (#266)

Signed-off-by: Ying Xie <[email protected]>

…t#2632)

Signed-off-by: Nazarii Hnydyn <[email protected]>

Submodule src/sonic-sairedis 54b02a1..8182916:
  > Add pre match to comparison logic and unittests (sonic-net#423)
  > Drop FDB notifications if they contain invalid OIDs (sonic-net#428)

Signed-off-by: Ying Xie <[email protected]>

PFC_WD table naming change is not ready to be included yet.

Submodule src/sonic-swss-common c674e64..2592b0c (rewind):
  < Add multiple fields hdel support (#267)
  < Update PFC_WD table name in CONFIG_DB (#266)

Signed-off-by: Ying Xie <[email protected]>

)

Signed-off-by: Mykola Faryma <[email protected]>

…isted in <Devices> section (sonic-net#2522)

Signed-off-by: Nadiya.Stetskovych <[email protected]>

Lossy traffic does not need to be mapped to different ingress PGs. They can all share the same ingress PG.

Signed-off-by: Wenda Ni <[email protected]>

…onic-net#2659)

Signed-off-by: Qi Luo <[email protected]>

…net#2671)

* fix lpmode set failure issue by skipping nvport

…er (sonic-net#2683)

database container doesn't mount hwsku folder.

Signed-off-by: Ying Xie <[email protected]>

Just so that the folder will be clean and make working on new patches
much easier.

Signed-off-by: Ying Xie <[email protected]>

Submodule src/sonic-utilities 2fe01fe..9d9aaa0:
  > [warm/fast reboot] setup control plane assistant when available (sonic-net#487)
  > [reboot script] add -h, -? options (sonic-net#484)

Signed-off-by: Ying Xie <[email protected]>

…onic-net#2707)

* [jessie repo] remove one dependency on jessie-backport repo

Signed-off-by: Ying Xie <[email protected]>

* [build] remove dependency on retried jessie-backports repo

The downloaded Jessie docker image still reference jessie-updates.
Removing it from the list.

Signed-off-by: Ying Xie <[email protected]>

* fix typo

* move chunk

* [docker-ptf] avoid using retired Jessie repos

Signed-off-by: Ying Xie <[email protected]>

…ng neighbor… (sonic-net#2602)

* Skip setting the same hwaddr to lag port to avoid disrupting neighbor entries

Signed-off-by: Jipan Yang <[email protected]>

…net#2699)

Race condition has been noticed after warm reboot: sometimes when
port_changed notification was received, the link message didn't
have the device name. Without device name, creating team port
would fail.

Registering to the interface information change notification, so
later when device name becomes available, retry creating team port.

Signed-off-by: Ying Xie <[email protected]>

Signed-off-by: Andriy Moroz <[email protected]>

…ic-net#2718)

…verlay SNMP (sonic-net#2721)

* [snmpagent][swss-common] advance sub module head to include overlay SNMP

Submodule src/sonic-snmpagent 0f2bbd7..26f0495:
  > Remove verbose feature missing logs (#102)
  > Enable overriding interface counters OIDs (#98)

Submodule src/sonic-swss-common 5f4abd9..36fd5e9:
  > Add new DB index for SNMP_OVERLAY_DB (#262)

Note: overlay DB also requires change in swss-common, which has been
      moved ahead.

Signed-off-by: Ying Xie <[email protected]>

* [utilities] advance utilities sub-module head

Submodule src/sonic-utilities 9d9aaa0..d1070b2:
  > [warm-reboot] initialize warm reboot state table before warm rebooting (sonic-net#492)
  > Allow config shutdown and startup operations on valid PortChannel interface names (sonic-net#474)

After warm reboot is done, we need to disable warm reboot flag and
tear down anything setup for warm reboot and persisted across.

Signed-off-by: Ying Xie <[email protected]>

* [vm build] force Linux to drop cache before calling kvm

KVM need to allocate 2G memory for this build. The system memory might
be occupied by cache at the moment and doesn't have 2G chunk to give
out. Forcing Kernel to drop cache to boost the chance of getting 2G
memory.

Signed-off-by: Ying Xie <[email protected]>

* [make] add option to enable/disable VS build memory preparation

Signed-off-by: Ying Xie <[email protected]>

* [teamd service] teamd service should start after syncd

Signed-off-by: Ying Xie <[email protected]>

* combine after lines

When adding a lag member dynamically after system boots up, teamd
port priv change handler could re-entrant itself and causing adding
operation to fail.

While handling PORT_CHANGE event, teamd_per_port.c port priv change
handler was called, it will then call runner_lacp to add port to lag,
the later causes IFINFO_CHANGE to be notified and calls the priv change
handler again, this re-entrance would cause runner_lacp port_added to
be called again and messes up with the previous adding sequence. Then
fails the lag member adding operation.

Prevent per port priv change handler re-entrance solves the problem.

Signed-off-by: Ying Xie <[email protected]>

…sonic-net#2728)

Submodule src/sonic-sairedis 8182916..483c89e:
  > Notify OA about exception and process only restart query events (sonic-net#437)

Submodule src/sonic-swss 91171b6..d22b2de:
  > Allow ACL entry creation without ACL counter (sonic-net#818)

Signed-off-by: Ying Xie <[email protected]>

…t#2743)

- Cherry-picked one change:

Submodule src/sonic-platform-common d4bf78c..42119e1:
  > remove gang port parsing (#24)

Signed-off-by: Ying Xie <[email protected]>

* removing dhcp changes from initrd

* removing mgmt-intf-dhcp file

…-net#2724)" (sonic-net#2733)

This reverts commit 0d1efb1.

Submodule src/sonic-utilities d1070b2..bae21e7:
  > Update neighbor advertiser (sonic-net#498)

Signed-off-by: Ying Xie <[email protected]>

This implies that by default, if TACACS is configured properly and it reported auth_err, then don't try fail through to traditional unix authentication through /etc/passwd.

If this failthrough is intended, make it explicit through "sudo config aaa authentication failthrough enable"

Removed an unused variable "aaa.fallback"

Tested manually. Note the presence of 'auth_err=die' in all cases except when failthrough is explicitly enabled.

admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough default; date
Wed Apr  3 23:05:18 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1316 Apr  3 23:05 /etc/pam.d/common-auth-sonic
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass

admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough enable; date ; h4 "AAA|authentication"
Wed Apr  3 23:06:37 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1294 Apr  3 23:06 /etc/pam.d/common-auth-sonic
auth    [success=done new_authtok_reqd=done default=ignore]     pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth    [success=done new_authtok_reqd=done default=ignore]     pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass

admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough disable; date ; h4 "AAA|authentication"
Wed Apr  3 23:07:09 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1321 Apr  3 23:07 /etc/pam.d/common-auth-sonic
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth    [success=done new_authtok_reqd=done default=ignore auth_err=die]        pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass

sonic-net#2759)

Submodule src/sonic-sairedis 483c89e..97dd2a8:
  > Fix compilation issues in stretch docker with gcc-6.3 (sonic-net#426)
  >  Make object list deterministic when iterating (sonic-net#438)
  > Ignore ACL_COUNTER bytes and packets during comparison logic (sonic-net#443)

Submodule src/sonic-swss d22b2de..ae74a27:
  > Survive pfc watchdog storm action across warm-reboot (sonic-net#794)

Submodule src/sonic-swss-common 36fd5e9..24c0ff7:
  > Update PFC_WD table name in CONFIG_DB (#266)

Submodule src/sonic-utilities bae21e7..6aee909:
  > [neighbor advertiser] convert int to string before concatenating (sonic-net#505)
  > [config]: Change the order of interface commands (sonic-net#504)
  > Change PFC watchdog CONFIG_DB table name from PFC_WD_TABLE to PFC_WD (sonic-net#475)

Signed-off-by: Ying Xie <[email protected]>