fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs - #740
Closed
qiluo-msft wants to merge 16 commits into
Closed
fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs#740qiluo-msft wants to merge 16 commits into
qiluo-msft wants to merge 16 commits into
Conversation
<!-- Please make sure you've read and understood our contributing guidelines: https://github.com/Azure/SONiC/blob/gh-pages/CONTRIBUTING.md failure_prs.log skip_prs.log Make sure all your commits include a signature generated with `git commit -s` ** If this is a bug fix, make sure your description includes "fixes #xxxx", or "closes #xxxx" or "resolves #xxxx" Please provide the following information: --> #### Why I did it 1. In order to retrieve Fabric Counters using Streaming telemetry, the COUNTERS_FABRIC_PORT_NAME_MAP table in COUNTERS_DB has to be queried first to get PORT name to OID mapping, then COUNTERS:oid:<> table in COUNTERS_DB has to be queried to get the Fabric Counters. To make the retrieval easy, changes are made in this PR to add v2r mapping for Fabric Counters in Packet Chassis similar to Ethernet interface counters. Reference sonic-net/sonic-telemetry#77 2 The Fabric counters Port name is unique within a given asic namespace and is not unique across a linecard. For example, there will be a port named PORT0 in asic0 and PORT0 in asic1 namespace as well. In order to make this unique across a multi-asic linecard, this PR appends asic namespace in the interface name. For example, PORT0 in asic0 will be called "PORT0-asic0". #### How I did it 1. Add v2r mapping support to read all ports from COUNTERS_FABRIC_PORT_NAME_MAP so that Streaming telemetry can query using Fabric port name and COUNTERS_DB. 2. Modify the Fabric Port name by appending Asic namespace. 3. Add unit-test 4. Modify clean up and set up multi namespace to reset countersFabricPortNameMap so that the port map is re-initialized when changing from single to multi- namespace in unit-test #### How to verify it Verified on a multi-asic linecard: ``` gnmi_get -target_addr localhost:50051 -xpath COUNTERS/PORT0-asic0 -xpath_target COUNTERS_DB -insecure == getRequest: prefix: < target: "COUNTERS_DB" > path: < elem: < name: "COUNTERS" > elem: < name: "PORT0-asic0" > > encoding: JSON_IETF == getResponse: notification: < timestamp: 1737484675266818454 prefix: < target: "COUNTERS_DB" > update: < path: < elem: < name: "COUNTERS" > elem: < name: "PORT0-asic0" > > val: < json_ietf_val: "{\"SAI_PORT_STAT_IF_IN_ERRORS\":\"0\",\"SAI_PORT_STAT_IF_IN_FABRIC_DATA_UNITS\":\"0\",\"SAI_PORT_STAT_IF_IN_FEC_CORRECTABLE_FRAMES\":\"0\",\"SAI_PORT_STAT_IF_IN_FEC_NOT_CORRECTABLE_FRAMES\":\"0\",\"SAI_PORT_STAT_IF_IN_FEC_SYMBOL_ERRORS\":\"0\",\"SAI_PORT_STAT_IF_IN_OCTETS\":\"0\",\"SAI_PORT_STAT_IF_OUT_FABRIC_DATA_UNITS\":\"0\",\"SAI_PORT_STAT_IF_OUT_OCTETS\":\"0\"}" > > > ``` Verified on single asic Linecard: ``` gnmi_get -target_addr localhost:50051 -xpath COUNTERS/PORT0 -xpath_target COUNTERS_DB -insecure == getRequest: prefix: < target: "COUNTERS_DB" > path: < elem: < name: "COUNTERS" > elem: < name: "PORT0" > > encoding: JSON_IETF == getResponse: notification: < timestamp: 1737567049704926166 prefix: < target: "COUNTERS_DB" > update: < path: < elem: < name: "COUNTERS" > elem: < name: "PORT0" > > val: < json_ietf_val: "{\"SAI_PORT_STAT_IF_IN_ERRORS\":\"0\",\"SAI_PORT_STAT_IF_IN_FABRIC_DATA_UNITS\":\"181562945\",\"SAI_PORT_STAT_IF_IN_FEC_CORRECTABLE_FRAMES\":\"0\",\"SAI_PORT_STAT_IF_IN_FEC_NOT_CORRECTABLE_FRAMES\":\"0\",\"SAI_PORT_STAT_IF_IN_FEC_SYMBOL_ERRORS\":\"0\",\"SAI_PORT_STAT_IF_IN_OCTETS\":\"40499614075\",\"SAI_PORT_STAT_IF_OUT_FABRIC_DATA_UNITS\":\"11152\",\"SAI_PORT_STAT_IF_OUT_OCTETS\":\"2588370\"}" > > > gnmi_get -target_addr localhost:50051 -xpath COUNTERS/PORT* -xpath_target COUNTERS_DB -insecure ``` Verified on Pizza box to ensure no error log is seen. #### Which release branch to backport (provide reason below if selected) <!-- - Note we only backport fixes to a release branch, *not* features! - Please also provide a reason for the backporting below. - e.g. - [x] 202006 --> - [ ] 201811 - [ ] 201911 - [ ] 202006 - [ ] 202012 - [ ] 202106 - [ ] 202111 #### Description for the changelog <!-- Write a short (one line) summary that describes the changes in this pull request for inclusion in the changelog: --> #### Link to config_db schema for YANG module changes <!-- Provide a link to config_db schema for the table for which YANG model is defined Link should point to correct section on https://github.com/Azure/SONiC/wiki/Configuration. --> #### A picture of a cute animal (not mandatory but encouraged)
<!-- Please make sure you've read and understood our contributing guidelines: https://github.com/Azure/SONiC/blob/gh-pages/CONTRIBUTING.md failure_prs.log skip_prs.log Make sure all your commits include a signature generated with `git commit -s` ** If this is a bug fix, make sure your description includes "fixes #xxxx", or "closes #xxxx" or "resolves #xxxx" Please provide the following information: --> #### Why I did it Pfcwd queries currently use PFC_WD_TABLE which is not the correct table name. Use PFC_WD instead. Since Pfcwd are not crucial to other COUNTERS paths, if map creation of Pfcwd fails, we will fail gracefully and return empty json for Pfcwd instead of impacting all COUNTER_DB queries. #### How I did it Change table name #### How to verify it UT and manual testing #### Which release branch to backport (provide reason below if selected) <!-- - Note we only backport fixes to a release branch, *not* features! - Please also provide a reason for the backporting below. - e.g. - [x] 202006 --> - [ ] 201811 - [ ] 201911 - [ ] 202006 - [ ] 202012 - [ ] 202106 - [ ] 202111 #### Description for the changelog <!-- Write a short (one line) summary that describes the changes in this pull request for inclusion in the changelog: --> #### Link to config_db schema for YANG module changes <!-- Provide a link to config_db schema for the table for which YANG model is defined Link should point to correct section on https://github.com/Azure/SONiC/wiki/Configuration. --> #### A picture of a cute animal (not mandatory but encouraged)
Manually revert delete field logic 202411
Update agent-pool to 22.04 since 20.04 is no longer available. <!-- Please make sure you've read and understood our contributing guidelines: https://github.com/Azure/SONiC/blob/gh-pages/CONTRIBUTING.md failure_prs.log skip_prs.log Make sure all your commits include a signature generated with `git commit -s` ** If this is a bug fix, make sure your description includes "fixes #xxxx", or "closes #xxxx" or "resolves #xxxx" Please provide the following information: --> #### Why I did it Ubuntu 20.04 agent is no longer available. #### How I did it Update agent-pool to use ubuntu 22.04 #### How to verify it See azure-pipeline runs. #### Which release branch to backport (provide reason below if selected) <!-- - Note we only backport fixes to a release branch, *not* features! - Please also provide a reason for the backporting below. - e.g. - [x] 202006 --> - [ ] 201811 - [ ] 201911 - [ ] 202006 - [ ] 202012 - [ ] 202106 - [ ] 202111 #### Description for the changelog <!-- Write a short (one line) summary that describes the changes in this pull request for inclusion in the changelog: --> #### Link to config_db schema for YANG module changes <!-- Provide a link to config_db schema for the table for which YANG model is defined Link should point to correct section on https://github.com/Azure/SONiC/wiki/Configuration. --> #### A picture of a cute animal (not mandatory but encouraged)
…able and key for APPL_DB (#419) Why I did it Backport of #375 MS: 32418202 SONiC telemetry does not behave according to gnmi specifications As per gnmi specification regarding missing data, "There is no requirement that the path specified in the message must exist within the current data tree on the server. While the path within the subscription SHOULD be a valid path within the set of schema modules that the target supports, subscribing to any syntactically valid path within such modules MUST be allowed. In the case that a particular path does not (yet) exist, the target MUST NOT close the RPC and instead should continue to monitor for the existence of the path, and transmit telemetry updates should it exist in the future." As per gnmi specification regarding deleted keys/paths, "Where a node within the subscribed paths has been removed, the delete field of the Notification message MUST have the path of the node that has been removed appended to it." How I did it If there is missing data, we will not return any failures, but instead we will send sync responses only until data is on the device for polling APPL_DB If data is deleted, we will send a delete notification to tell client that path they are querying is deleted and after send sync responses for polling APPL_DB. How to verify it UT and reverified on 20241110.17
… path `COUNTERS/Ethernet*/Queues` (#422) * Added periodic watermarks for egress queues under the existing virtual path COUNTERS/Ethernet*/Queues. Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com> * Formatting changes. Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com> * Ran 'go mod tidy'. Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com> * Revert "Ran 'go mod tidy'." This reverts commit a4ac0b7. * Removed database name from update paths in tests. Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com> --------- Signed-off-by: Mahdi Ramezani <mramezani@microsoft.com>
…431) PR for master: #370 Why I did it Periodic Priority Group (PG) watermarks can be found in the PERIODIC_WATERMARKS table in COUNTERS DB. The entries in this table can be accessed by OIDs (i.e., PERIODIC_WATERMARKS:<oid>), and the mapping between PG names (e.g., Ethernet16:5) and OIDs (e.g., oid:0x1a0000000000d6) is provided in the COUNTERS_PG_NAME_MAP table. So we need to add this mapping and virtual paths for periodic PG watermarks in order to be able to access the periodic PG watermarks directly (i.e., by specifying the port name instead of OID) in sonic-gnmi. How I did it Created the mapping between PG names and OIDs by reading the COUNTERS_PG_NAME_MAP table. Created the virtual path PERIODIC_WATERMARKS/Ethernet*/PriorityGroups and mapped it to the relevant entries in the PERIODIC_WATERMARKS table in COUNTERS DB. Added a few tests under TestGnmiSubscribe to verify that periodic PG watermark values are updated correctly. How to verify it I used gnmi_get to verify that the virtual path PERIODIC_WATERMARKS/Ethernet16/PriorityGroups retrieves all periodic PG watermarks for Ethernet16 and that the virtual path PERIODIC_WATERMARKS/Ethernet*/PriorityGroups retrieves all periodic PG watermarks for all ports. The results are added to grpc_telemetry.md. Note: The DUT on which the gnmi-get command was run had only one priority group per port. Description for the changelog Added the virtual path PERIODIC_WATERMARKS/Ethernet*/PriorityGroups so that periodic PG watermarks can be queried directly by specifying the port name in sonic-gnmi.
<!-- Please make sure you've read and understood our contributing guidelines: https://github.com/Azure/SONiC/blob/gh-pages/CONTRIBUTING.md failure_prs.log skip_prs.log Make sure all your commits include a signature generated with `git commit -s` ** If this is a bug fix, make sure your description includes "fixes #xxxx", or "closes #xxxx" or "resolves #xxxx" Please provide the following information: --> #### Why I did it CodeQL has been failing at head due to missing ../sonic-mgmt-common #### How I did it Add checking out sonic-mgmt-common. #### How to verify it Run at my forked master: https://github.com/hdwhdw/sonic-gnmi/actions/runs/12385901251 The run on this PR pipeline uses the workflow file on its master, hence failing is expected. #### Which release branch to backport (provide reason below if selected) <!-- - Note we only backport fixes to a release branch, *not* features! - Please also provide a reason for the backporting below. - e.g. - [x] 202006 --> - [ ] 201811 - [ ] 201911 - [ ] 202006 - [ ] 202012 - [ ] 202106 - [ ] 202111 #### Description for the changelog <!-- Write a short (one line) summary that describes the changes in this pull request for inclusion in the changelog: --> #### Link to config_db schema for YANG module changes <!-- Provide a link to config_db schema for the table for which YANG model is defined Link should point to correct section on https://github.com/Azure/SONiC/wiki/Configuration. --> #### A picture of a cute animal (not mandatory but encouraged)
* Update clientCertAuth.go * Update server_test.go * Add strings package import in clientCertAuth.go * Fix role key lookup in clientCertAuth * Add backward compatibility for single role schema * Add tests for client certificate authentication
[202411] Add cert multiple roles support
Manual cherrypick for adding support for RATES tables in Counters DB so that PRE_FEC/POST_FEC_BER via ST
- google.golang.org/grpc v1.64.1 -> v1.82.1 (CVE-2026-33186, GHSA-hrxh-6v49-42gf) - golang.org/x/crypto v0.24.0 -> v0.52.0 (CVE-2024-45337, CVE-2025-22869, CVE-2026-39828-39832) - golang.org/x/net v0.26.0 -> v0.55.0 (CVE-2023-39325, CVE-2024-45338, CVE-2026-25681) - golang.org/x/text v0.16.0 -> v0.39.0 (CVE-2026-56852) - antchfx/jsonquery v1.1.4 -> v1.3.7 (to fix antchfx/xpath CVE-2026-32287) - antchfx/xmlquery v1.3.1 -> v1.5.1 (to fix antchfx/xpath CVE-2026-32287) - antchfx/xpath v1.1.10 -> v1.3.6 (CVE-2026-32287) Signed-off-by: qiluo <qiluo@microsoft.com>
Contributor
|
/azp run |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Collaborator
Author
|
Superseded by a cleaner PR based directly on master with no extra commits. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
Trivy CVE scan identified multiple CRITICAL and HIGH severity vulnerabilities in the Go module dependencies of sonic-gnmi.
Superseded by #741 which is based cleanly on master.