Merge branch 'master' into azure-master_dhcp_yang_2

LICENSE

@@ -1,15 +1,13 @@
-Copyright (C) 2016  Microsoft
+Copyright (C) 2023  Microsoft
 
-This program is free software; you can redistribute it and/or
-modify it under the terms of the GNU General Public License
-as published by the Free Software Foundation; either version 2
-of the License, or (at your option) any later version.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
 
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
+    http://www.apache.org/licenses/LICENSE-2.0
 
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

build_debian.sh

@@ -644,6 +644,10 @@ then
 
 fi
 
+## Set FIPS runtime default option
+sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "mkdir -p /etc/fips"
+sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo 0 > /etc/fips/fips_enable"
+
 # #################
 #   secure boot
 # #################

files/build/versions/build/build-sonic-slave-bullseye/versions-deb-bullseye

@@ -24,6 +24,7 @@ libsairedis==1.0.0
 libsairedis-dev==1.0.0
 libsaithrift-dev==0.9.4
 libsaivs==1.0.0
+libsaivs-dev==1.0.0
 libswsscommon==1.0.0
 libswsscommon-dev==1.0.0
 libtac-dev==1.4.1-1
@@ -33,7 +34,7 @@ libteam-utils==1.30-1
 libteam5==1.30-1
 libteamdctl0==1.30-1
 libthrift-0.11.0==0.11.0-4
-libthrift-dev==0.14.1
+libthrift-dev==0.11.0-4
 libthrift0==0.14.1
 libyang==1.0.73
 libyang-cpp==1.0.73
@@ -73,7 +74,7 @@ sxd-libs==1.mlnx.4.5.5142
 sxd-libs-dev==1.mlnx.4.5.5142
 syncd==1.0.0
 syncd-vs==1.0.0
-thrift-compiler==0.14.1
+thrift-compiler==0.11.0-4
 wjh-libs==1.mlnx.4.5.5142
 wjh-libs-dev==1.mlnx.4.5.5142
 wpasupplicant==2:2.9.0-14

files/build/versions/build/build-sonic-slave-bullseye/versions-py3-all-arm64

@@ -2,4 +2,3 @@ bcrypt==3.2.2
 bitarray==1.5.3
 click==7.0
 requests==2.31.0
-zipp==1.2.0

files/build/versions/default/versions-git

@@ -1,11 +1,11 @@
-https://chromium.googlesource.com/chromium/tools/depot_tools.git==a654ff36bb3dba91a3d4f1ac8a2c6e2055e1f2df
+https://chromium.googlesource.com/chromium/tools/depot_tools.git==d411904b84c0d9f539bbdc84e3d63f9f282c658b
 https://github.com/aristanetworks/swi-tools.git==b5f087e4774168bf536360d43c9c509c8f14ad9f
 https://github.com/CESNET/libyang.git==ea94c8b9f513f8a6ddc6ce1540fa41eaf4c8922a
 https://github.com/daveolson53/audisp-tacplus.git==559c9f22edd4f2dea0ecedffb3ad9502b12a75b6
 https://github.com/daveolson53/libnss-tacplus.git==19008ab68d9d504aa58eb34d5f564755a1613b8b
 https://github.com/dyninc/OpenBFDD.git==e35f43ad8d2b3f084e96a84c392528a90d05a287
-https://github.com/flashrom/flashrom.git==e08899fcf4127de5cb2ad2dd134539d41f7e33b0
-https://github.com/FreeRADIUS/freeradius-server.git==54eb782f8b01c98a41208116e0f134a4c1564e4f
+https://github.com/flashrom/flashrom.git==2b692d78c2ab8cb1ba68516cb4bd2ceae80d8936
+https://github.com/FreeRADIUS/freeradius-server.git==1be5b1d181b5c51c34dc4b7f8e639082f80d6c87
 https://github.com/FreeRADIUS/pam_radius.git==8d373539bb9f13b0abfe8bcae0095a930a00fad0
 https://github.com/jeroennijhof/pam_tacplus.git==4284d9016e64def2bb81d5f50f96dc3b59bfdc39
 https://github.com/jpirko/libteam.git==7cb5de8b01be132bd4150eff460bfd83296414b6
@@ -21,4 +21,4 @@ https://salsa.debian.org/debian/libteam.git==48142125234a665ad5367b724af36a58fb4
 https://salsa.debian.org/kernel-team/ethtool/==d0578651310379629399dde060577d4b9b0bcab1
 https://salsa.debian.org/kernel-team/initramfs-tools.git==193dfbb7929e518976f89f6c8dd9201982e56f80
 https://salsa.debian.org/sk-guest/monit.git==c9da7ebb1f35dfba17b50b5969a6e75e29cbec0d
-https://salsa.debian.org/ssh-team/openssh.git==74d15e80b8730335a9b13469ca6cafe4c1c8e485
+https://salsa.debian.org/ssh-team/openssh.git==d9a514f93f17d22766cfe760e25254ef13cb5eb1

files/build/versions/default/versions-mirror

@@ -1,15 +1,15 @@
 deb.nodesource.com_node%5f14.x_dists_bullseye==2023-02-17T00:35:28Z
 deb.nodesource.com_node%5f14.x_dists_buster==2023-02-17T00:35:28Z
-debian==20230718T000215Z
-debian-security==20230718T000622Z
+debian==20230723T000130Z
+debian-security==20230723T000131Z
 download.docker.com_linux_debian_dists_bullseye==2023-07-07T20:10:57Z
 download.docker.com_linux_debian_dists_buster==2023-07-07T20:10:57Z
 packages.microsoft.com_repos_sonic-dev_dists_jessie==2022-10-31T19:34:29Z
-packages.trafficmanager.net_snapshot_debian-security_20230718T000622Z_dists_bullseye-security==2023-07-17T13:53:30Z
-packages.trafficmanager.net_snapshot_debian-security_20230718T000622Z_dists_buster_updates==2023-07-17T13:53:30Z
-packages.trafficmanager.net_snapshot_debian_20230718T000215Z_dists_bullseye==2023-06-10T08:52:21Z
-packages.trafficmanager.net_snapshot_debian_20230718T000215Z_dists_bullseye-backports==2023-07-17T20:24:12Z
-packages.trafficmanager.net_snapshot_debian_20230718T000215Z_dists_bullseye-updates==2023-07-17T20:24:12Z
-packages.trafficmanager.net_snapshot_debian_20230718T000215Z_dists_buster==2023-06-10T08:53:33Z
-packages.trafficmanager.net_snapshot_debian_20230718T000215Z_dists_buster-backports==2023-07-17T20:24:12Z
-packages.trafficmanager.net_snapshot_debian_20230718T000215Z_dists_buster-updates==2023-06-10T08:55:10Z
+packages.trafficmanager.net_snapshot_debian-security_20230723T000131Z_dists_bullseye-security==2023-07-22T08:48:51Z
+packages.trafficmanager.net_snapshot_debian-security_20230723T000131Z_dists_buster_updates==2023-07-22T08:48:51Z
+packages.trafficmanager.net_snapshot_debian_20230723T000130Z_dists_bullseye==2023-06-10T08:52:21Z
+packages.trafficmanager.net_snapshot_debian_20230723T000130Z_dists_bullseye-backports==2023-07-22T20:31:09Z
+packages.trafficmanager.net_snapshot_debian_20230723T000130Z_dists_bullseye-updates==2023-07-22T20:31:09Z
+packages.trafficmanager.net_snapshot_debian_20230723T000130Z_dists_buster==2023-06-10T08:53:33Z
+packages.trafficmanager.net_snapshot_debian_20230723T000130Z_dists_buster-backports==2023-07-22T20:31:09Z
+packages.trafficmanager.net_snapshot_debian_20230723T000130Z_dists_buster-updates==2023-06-10T08:55:10Z

files/build/versions/default/versions-web

@@ -31,7 +31,7 @@ https://deb.debian.org/debian/pool/main/k/kdump-tools/kdump-tools_1.6.8.4.tar.xz
 https://deb.nodesource.com/gpgkey/nodesource.gpg.key==003b51a89a133b5db4cca98b2dea3117
 https://deb.nodesource.com/node_14.x/dists/bullseye/Release==6b7d50c433d129d4c6fd95bdf56070fa
 https://deb.nodesource.com/node_14.x/dists/buster/Release==42875141604382f0abb4d047f645dfe1
-https://deb.nodesource.com/setup_14.x==1c9de9348c0acd5f2ee422a6d0c333b3
+https://deb.nodesource.com/setup_14.x==472c9614e7c6dd029f205890ed356a22
 https://download.docker.com/linux/debian/gpg==1afae06b34a13c1b3d9cb61a26285a15
 https://github.com/aristanetworks/sonic-firmware/raw/446f30ccd8626f904d89d5798da7294948e090a6/phy/phy-credo_1.0_amd64.deb==6c3d6c32477615cbe049b9161ce15bd5
 https://github.com/barefootnetworks/sonic-release-pkgs/raw/dev/bfnplatform_20221130_sai_1.11.0_deb11.deb==4a77e5f35b75ad7ce062f631581b40e2

files/build/versions/dockers/docker-base-bullseye/versions-py3

@@ -1,7 +1,7 @@
 j2cli==0.3.10
 jinja2==3.1.2
 markupsafe==2.1.3
-pip==23.2
+pip==23.2.1
 setuptools==49.6.0
 supervisor==4.2.1
 supervisord-dependent-startup==1.4.0

files/build/versions/dockers/docker-base-buster/versions-py3

@@ -1,7 +1,7 @@
 j2cli==0.3.10
 jinja2==3.1.2
 markupsafe==2.1.3
-pip==23.2
+pip==23.2.1
 setuptools==49.6.0
 supervisor==4.2.1
 supervisord-dependent-startup==1.4.0

files/build/versions/dockers/docker-platform-monitor/versions-py3

@@ -1,5 +1,5 @@
 attrs==20.3.0
-certifi==2023.5.7
+certifi==2023.7.22
 charset-normalizer==3.2.0
 grpcio==1.39.0
 grpcio-tools==1.39.0
@@ -15,5 +15,5 @@ pyrsistent==0.15.5
 python_sdk_api==4.5.5142
 requests==2.31.0
 thrift==0.13.0
-urllib3==2.0.3
+urllib3==2.0.4
 zipp==1.0.0

files/build/versions/dockers/docker-sonic-mgmt-framework/versions-py3

@@ -5,7 +5,7 @@ click==8.1.6
 clickclick==20.10.2
 connexion==2.7.0
 flask==2.2.5
-grpcio==1.56.0
+grpcio==1.56.2
 grpcio-tools==1.20.0
 idna==3.4
 importlib-resources==5.12.0

files/build/versions/dockers/docker-sonic-vs/versions-py3

@@ -1,7 +1,7 @@
 async-timeout==4.0.2
 bcrypt==3.2.2
 blessed==1.20.0
-certifi==2023.5.7
+certifi==2023.7.22
 cffi==1.15.1
 charset-normalizer==3.2.0
 click==7.0

files/build/versions/dockers/sonic-slave-bullseye/versions-py3

@@ -6,7 +6,7 @@ automat==20.2.0
 babel==2.8.0
 bcrypt==3.1.7
 beautifulsoup4==4.9.3
-bitarray==2.7.6
+bitarray==2.8.0
 certifi==2020.6.20
 chardet==4.0.0
 click==7.1.2
@@ -58,7 +58,7 @@ parameterized==0.8.1
 parse==1.6.6
 pexpect==4.8.0
 pillow==9.4.0
-pip==23.2
+pip==23.2.1
 pluggy==0.13.0
 ptyprocess==0.7.0
 py==1.10.0

files/build/versions/dockers/sonic-slave-buster/versions-deb-buster

@@ -23,7 +23,7 @@ autopoint==0.19.8.1-9
 autotools-dev==20180224.1
 bash-completion==1:2.8-6
 bc==1.07.1-2+b1
-bind9-host==1:9.11.5.P4+dfsg-5.1+deb10u8
+bind9-host==1:9.11.5.P4+dfsg-5.1+deb10u9
 binfmt-support==2.2.0-2
 binutils==2.31.1-16
 binutils-common==2.31.1-16
@@ -85,7 +85,7 @@ distro-info-data==0.41+deb10u7
 dkms==2.6.1-4
 dmeventd==2:1.02.155-3
 dmsetup==2:1.02.155-3
-dnsutils==1:9.11.5.P4+dfsg-5.1+deb10u8
+dnsutils==1:9.11.5.P4+dfsg-5.1+deb10u9
 docbook==4.5-6
 docbook-dsssl==1.79-9.1
 docbook-to-man==1:2.0.0-42
@@ -286,8 +286,8 @@ libbabeltrace-dev==1.5.6-2+deb10u1
 libbabeltrace1==1.5.6-2+deb10u1
 libbatik-java==1.10-2+deb10u2
 libbdplus0==0.1.2-3
-libbind-export-dev==1:9.11.5.P4+dfsg-5.1+deb10u8
-libbind9-161==1:9.11.5.P4+dfsg-5.1+deb10u8
+libbind-export-dev==1:9.11.5.P4+dfsg-5.1+deb10u9
+libbind9-161==1:9.11.5.P4+dfsg-5.1+deb10u9
 libbinutils==2.31.1-16
 libbison-dev==2:3.3.2.dfsg-1
 libbit-vector-perl==7.4-1+b5
@@ -451,8 +451,8 @@ libdist-checkconflicts-perl==0.11-1
 libdistro-info-perl==0.21
 libdjvulibre-text==3.5.27.1-10+deb10u1
 libdjvulibre21==3.5.27.1-10+deb10u1
-libdns-export1104==1:9.11.5.P4+dfsg-5.1+deb10u8
-libdns1104==1:9.11.5.P4+dfsg-5.1+deb10u8
+libdns-export1104==1:9.11.5.P4+dfsg-5.1+deb10u9
+libdns1104==1:9.11.5.P4+dfsg-5.1+deb10u9
 libdom4j-java==2.1.1-2
 libdouble-conversion1==3.1.0-3
 libdoxia-core-java==1.7-2
@@ -669,14 +669,14 @@ libipc-system-simple-perl==1.25-4
 libipt2==2.0-2
 libiptc-dev==1.8.2-4
 libiptc0==1.8.2-4
-libirs-export161==1:9.11.5.P4+dfsg-5.1+deb10u8
-libirs161==1:9.11.5.P4+dfsg-5.1+deb10u8
-libisc-export1100==1:9.11.5.P4+dfsg-5.1+deb10u8
-libisc1100==1:9.11.5.P4+dfsg-5.1+deb10u8
-libisccc-export161==1:9.11.5.P4+dfsg-5.1+deb10u8
-libisccc161==1:9.11.5.P4+dfsg-5.1+deb10u8
-libisccfg-export163==1:9.11.5.P4+dfsg-5.1+deb10u8
-libisccfg163==1:9.11.5.P4+dfsg-5.1+deb10u8
+libirs-export161==1:9.11.5.P4+dfsg-5.1+deb10u9
+libirs161==1:9.11.5.P4+dfsg-5.1+deb10u9
+libisc-export1100==1:9.11.5.P4+dfsg-5.1+deb10u9
+libisc1100==1:9.11.5.P4+dfsg-5.1+deb10u9
+libisccc-export161==1:9.11.5.P4+dfsg-5.1+deb10u9
+libisccc161==1:9.11.5.P4+dfsg-5.1+deb10u9
+libisccfg-export163==1:9.11.5.P4+dfsg-5.1+deb10u9
+libisccfg163==1:9.11.5.P4+dfsg-5.1+deb10u9
 libisl19==0.20-2
 libitext1-java==1.4-7
 libitm1==8.3.0-6
@@ -756,7 +756,7 @@ liblua5.1-0-dev==5.1.5-8.1+b2
 liblvm2cmd2.03==2.03.02-3
 liblwp-mediatypes-perl==6.02-1
 liblwp-protocol-https-perl==6.07-2
-liblwres161==1:9.11.5.P4+dfsg-5.1+deb10u8
+liblwres161==1:9.11.5.P4+dfsg-5.1+deb10u9
 liblzma-dev==5.2.4-1+deb10u1
 liblzo2-2==2.10-0.1
 liblzo2-dev==2.10-0.1

files/build/versions/dockers/sonic-slave-buster/versions-py3

@@ -4,7 +4,7 @@ async-timeout==4.0.2
 atomicwrites==1.1.5
 attrs==18.2.0
 babel==2.6.0
-bitarray==2.7.6
+bitarray==2.8.0
 certifi==2018.8.24
 chardet==3.0.4
 cov-core==1.15.0
@@ -41,7 +41,7 @@ parameterized==0.8.1
 pbr==4.2.0
 pexpect==4.8.0
 pillow==9.4.0
-pip==23.2
+pip==23.2.1
 pluggy==0.8.0
 ptyprocess==0.7.0
 py==1.7.0

files/build/versions/host-image/versions-py3

@@ -4,7 +4,7 @@ azure-storage==0.36.0
 bcrypt==3.2.2
 bitarray==1.5.3
 blessed==1.20.0
-certifi==2023.5.7
+certifi==2023.7.22
 cffi==1.15.1
 charset-normalizer==3.2.0
 click==7.0
@@ -40,7 +40,7 @@ paramiko==2.11.0
 pathtools==0.1.2
 pddf-platform==1.0
 pexpect==4.8.0
-pip==23.2
+pip==23.2.1
 prefixed==0.7.0
 prettyprinter==0.18.0
 protobuf==3.20.3

files/build_templates/dns.j2

@@ -0,0 +1,11 @@
+{# Please follow below example to add your DNS server
+{
+  "DNS_NAMESERVER": {
+      "6.6.6.6": {},
+      "2001:4860:4860::64": {}
+  }
+}
+#}
+{
+    "DNS_NAMESERVER": {}
+}

files/build_templates/docker_image_ctl.j2

@@ -596,6 +596,7 @@ start() {
         -v /usr/share/sonic/device/$PLATFORM/$HWSKU/$DEV:/usr/share/sonic/hwsku:ro \
 {%- endif %}
         $REDIS_MNT \
+        -v /etc/fips/fips_enable:/etc/fips/fips_enable:ro \
         -v /usr/share/sonic/device/$PLATFORM:/usr/share/sonic/platform:ro \
         -v /usr/share/sonic/templates/rsyslog-container.conf.j2:/usr/share/sonic/templates/rsyslog-container.conf.j2:ro \
 {%- if sonic_asic_platform != "mellanox" %}

files/build_templates/sonic_debian_extension.j2

@@ -373,6 +373,9 @@ sudo cp $IMAGE_CONFIGS/ntp/ntp-systemd-wrapper $FILESYSTEM_ROOT/usr/lib/ntp/
 sudo cp $IMAGE_CONFIGS/ntp/ntp.service $FILESYSTEM_ROOT_USR_LIB_SYSTEMD_SYSTEM
 echo "ntp.service" | sudo tee -a $GENERATED_SERVICE_FILE
 
+# Copy DNS templates
+sudo cp $BUILD_TEMPLATES/dns.j2 $FILESYSTEM_ROOT_USR_SHARE_SONIC_TEMPLATES/
+
 # Copy warmboot-finalizer files
 sudo LANG=C cp $IMAGE_CONFIGS/warmboot-finalizer/finalize-warmboot.sh $FILESYSTEM_ROOT/usr/local/bin/finalize-warmboot.sh
 sudo LANG=C cp $IMAGE_CONFIGS/warmboot-finalizer/warmboot-finalizer.service $FILESYSTEM_ROOT_USR_LIB_SYSTEMD_SYSTEM

installer/install.sh

@@ -243,6 +243,11 @@ fi
 echo "ONIE_IMAGE_PART_SIZE=$demo_part_size"
 
 extra_cmdline_linux=%%EXTRA_CMDLINE_LINUX%%
+# Inherit the FIPS option, so not necessary to do another reboot after upgraded
+if grep -q '\bsonic_fips=1\b' /proc/cmdline && echo " $extra_cmdline_linux" | grep -qv '\bsonic_fips=.\b'; then
+    extra_cmdline_linux="$extra_cmdline_linux sonic_fips=1"
+fi
+
 echo "EXTRA_CMDLINE_LINUX=$extra_cmdline_linux"
 
 # Update Bootloader Menu with installed image

platform/broadcom/sonic-platform-modules-cel/debian/platform-modules-haliburton.init

@@ -53,6 +53,7 @@ start)
         [ $found -eq 0 ] && echo "cannot find iSMT" && exit 1
 
         i2cset -y ${devnum} 0x73 0x10 0x00 0x01 i
+        sleep 0.5
 
         # Attach PCA9548 0x73 Channel Extender for CPU Board
         echo pca9548 0x73 > /sys/bus/i2c/devices/i2c-${devnum}/new_device

platform/innovium/sonic-platform-modules-cel/midstone-200i/modules/mc24lc64t.c

@@ -94,7 +94,7 @@ static int mc24lc64t_probe(struct i2c_client *client,
                         sizeof(struct mc24lc64t_data), GFP_KERNEL)))
                 return -ENOMEM;
 
-        drvdata->fake_client = i2c_new_dummy(client->adapter, client->addr + 1);
+        drvdata->fake_client = i2c_new_dummy_device(client->adapter, client->addr + 1);
         if (!drvdata->fake_client)
                 return -ENOMEM;
 

platform/vs/syncd-vs.mk

@@ -1,10 +1,10 @@
-$(LIBSAIREDIS)_DEB_BUILD_PROFILES += syncd vs
+$(LIBSAIREDIS)_DPKG_TARGET = binary-syncd-vs
 
 SYNCD_VS = syncd-vs_1.0.0_amd64.deb
 $(SYNCD_VS)_RDEPENDS += $(LIBSAIREDIS) $(LIBSAIMETADATA) $(LIBSAIVS)
 $(eval $(call add_derived_package,$(LIBSAIREDIS),$(SYNCD_VS)))
 
-SYNCD_VS_DBGSYM = syncd-vs-dbgsym_1.0.0_amd64.deb
-$(SYNCD_VS_DBGSYM)_DEPENDS += $(SYNCD_VS)
-$(SYNCD_VS_DBGSYM)_RDEPENDS += $(SYNCD_VS)
-$(eval $(call add_derived_package,$(LIBSAIREDIS),$(SYNCD_VS_DBGSYM)))
+SYNCD_VS_DBG = syncd-vs-dbg_1.0.0_amd64.deb
+$(SYNCD_VS_DBG)_DEPENDS += $(SYNCD_VS)
+$(SYNCD_VS_DBG)_RDEPENDS += $(SYNCD_VS)
+$(eval $(call add_derived_package,$(LIBSAIREDIS),$(SYNCD_VS_DBG)))