[iproute2]: Add macsec-xpn-support iproute2 in syncd #8702

Pterosaur · 2021-09-08T03:21:48Z

Wait for PR: sonic-net/sonic-swss#1970

Why I did it

The iproute2 from apt source is out-of-date to support 256 bits cipher of MACsec and the iproute2 isn't support XPN of MACsec in current version.

How I did it

Install the iproute2 from debian source code and patch the XPN support change.

How to verify it

Run ip link add link eth0 name macsec0 type macsec sci 1 encrypt on cipher gcm-aes-xpn-256 in syncd container without error

Which release branch to backport (provide reason below if selected)

Description for the changelog

A picture of a cute animal (not mandatory but encouraged)

Signed-off-by: Ze Gan <[email protected]>

qiluo-msft · 2021-09-09T12:10:41Z

platform/vs/docker-syncd-vs/Dockerfile.j2

@@ -9,7 +9,7 @@ ENV DEBIAN_FRONTEND=noninteractive

 RUN apt-get update

-RUN apt-get install -f -y iproute2 libcap2-bin
+RUN apt-get install -f -y libbsd0 libcap2-bin


Is this build dependency? If yes, add some comment.
Alternatively, use apt-get build-dep iproute2 ? #Closed

I think libbsd0 is a run-time dependency. And I want the original iproute2 from apt source is replaced by this PR. So I remove the original one.

If it is a runtime dependency, is it better to install by apt-get install -f without specifying them one-by-one. In future, the dependency is free to change, and we are still good.

qiluo-msft · 2021-09-09T12:15:50Z

src/iproute2/Makefile

-	wget -O iproute2_$(IPROUTE2_VERSION_FULL).dsc -N "https://sonicstorage.blob.core.windows.net/packages/iproute2_4.9.0-1.dsc?sv=2015-04-05&sr=b&sig=m6FcMH9dOh8ggipBgOsONiXvDxoi6bfUO%2BxvidsMNMQ%3D&se=2154-10-23T11%3A59%3A53Z&sp=r"
-	wget -O iproute2_$(IPROUTE2_VERSION_FULL).debian.tar.xz -N "https://sonicstorage.blob.core.windows.net/packages/iproute2_4.9.0-1.debian.tar.xz?sv=2015-04-05&sr=b&sig=U5NFuwG5C3vZXlUUNvoPMnKDtMKk66zbweA9rQYbEVY%3D&se=2154-10-23T12%3A00%3A15Z&sp=r"
-	dpkg-source -x iproute2_$(IPROUTE2_VERSION_FULL).dsc
+	git clone https://salsa.debian.org/debian/iproute2.git iproute2-$(IPROUTE2_VERSION)


Did you ever try source code from debian website, like https://packages.debian.org/buster-backports/iproute2 ? #Closed

Is there any difference? I saw some other components use the source from salsa.debian.org. Which one is recommended?

Debian source code is more similiar to the debian vanilla installation package.

qiluo-msft · 2021-09-09T12:17:01Z

src/iproute2/patch/0001-patch-macsec-xpn-support.patch

+From f07b3b162f23c7159146b4098fb25994e3b55a9d Mon Sep 17 00:00:00 2001
+From: Ze Gan <[email protected]>
+Date: Mon, 30 Aug 2021 06:45:28 +0000
+Subject: [PATCH] MACsec XPN support


Did you submit this patch to upstream? #Pending

No, I just generated this patch from my private repo, is it a right way?

Just a recommendation. If the feature is useful in general, you may collect more feedback there.

Sure, I will do that, but I think it will take a long cycle to merge my change to the upstream and backport it to the debian.

Signed-off-by: Ze Gan <[email protected]>

Pterosaur · 2021-09-26T14:28:58Z

/azp run

azure-pipelines · 2021-09-26T14:29:15Z

Azure Pipelines successfully started running 1 pipeline(s).

lguohan · 2021-11-11T08:53:06Z

/azp run

azure-pipelines · 2021-11-11T08:53:12Z

You have several pipelines (over 10) configured to build pull requests in this repository. Specify which pipelines you would like to run by using /azp run [pipelines] command. You can specify multiple pipelines using a comma separated list.

lguohan · 2021-11-11T08:53:43Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2021-11-11T08:53:55Z

Azure Pipelines successfully started running 1 pipeline(s).

qiluo-msft · 2021-11-12T01:39:01Z

sonic-slave-buster/Dockerfile.j2

-        pkg-config
+        pkg-config \
+# For iproute2
+        libbpf-dev=1:0.3-2~bpo10+1 \


libbpf-dev=1:0.3-2~bpo10+1 \

Can we use apt-get install -t buster-backports libbpf-dev?
The benefit is it could follow the backport sources and catch any security update. #Closed

Good suggestion, let me try it.

Done, please review it.

Pterosaur · 2021-11-16T01:41:38Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2021-11-16T01:41:50Z

Azure Pipelines successfully started running 1 pipeline(s).

Pterosaur · 2021-11-19T04:41:31Z

/azp run Azure.sonic-buildimage (Build vs),Azure.sonic-buildimage (Build mellanox),Azure.sonic-buildimage (Build broadcom),Azure.docker-slave-bullseye (Build Build_bullseye_arm64),Azure.docker-slave-bullsey

azure-pipelines · 2021-11-19T04:41:36Z

No pipelines are associated with this pull request.

Signed-off-by: Ze Gan <[email protected]>

qiluo-msft · 2021-11-24T06:07:52Z

src/iproute2/Makefile

-	wget -O iproute2_$(IPROUTE2_VERSION_FULL).debian.tar.xz -N "https://sonicstorage.blob.core.windows.net/packages/iproute2_4.9.0-1.debian.tar.xz?sv=2015-04-05&sr=b&sig=U5NFuwG5C3vZXlUUNvoPMnKDtMKk66zbweA9rQYbEVY%3D&se=2154-10-23T12%3A00%3A15Z&sp=r"
+	wget -O iproute2_$(IPROUTE2_VERSION).orig.tar.xz http://deb.debian.org/debian/pool/main/i/iproute2/iproute2_$(IPROUTE2_VERSION).orig.tar.xz
+	wget -O iproute2_$(IPROUTE2_VERSION_FULL).dsc http://deb.debian.org/debian/pool/main/i/iproute2/iproute2_$(IPROUTE2_VERSION_FULL).dsc
+	wget -O iproute2_$(IPROUTE2_VERSION_FULL).debian.tar.xz http://deb.debian.org/debian/pool/main/i/iproute2/iproute2_$(IPROUTE2_VERSION_FULL).debian.tar.xz


http://deb.debian.org

@xumia, for reproducible build, do we still need to manually backup the downloaded files to sonicstorage?

Not necessary, it will upload the package automatically.

Add macsec-xpn-support iproute2 in syncd

b9dd790

Signed-off-by: Ze Gan <[email protected]>

Pterosaur marked this pull request as ready for review September 8, 2021 12:18

Pterosaur requested review from lguohan, qiluo-msft and xumia as code owners September 8, 2021 12:18

Pterosaur mentioned this pull request Sep 8, 2021

[vslib]: Add MACsec xpn support sonic-net/sonic-sairedis#924

Merged

qiluo-msft reviewed Sep 9, 2021

View reviewed changes

Pterosaur added 3 commits September 13, 2021 09:54

Polish code

ae2d37f

Signed-off-by: Ze Gan <[email protected]>

Remove useless files

a48f58b

Signed-off-by: Ze Gan <[email protected]>

Add self-compiled iproute2 to docker sonic vs

4b4e171

Signed-off-by: Ze Gan <[email protected]>

qiluo-msft reviewed Nov 12, 2021

View reviewed changes

Pterosaur requested a review from qiluo-msft November 12, 2021 06:05

qiluo-msft previously approved these changes Nov 12, 2021

View reviewed changes

Enhance apt install for iproute2 dependencies

bfb322d

Signed-off-by: Ze Gan <[email protected]>

Pterosaur dismissed qiluo-msft’s stale review via bfb322d November 23, 2021 04:38

Pterosaur force-pushed the update_iproute2 branch from 1841e89 to bfb322d Compare November 23, 2021 04:38

Merge branch 'master' into update_iproute2

1478966

Signed-off-by: Ze Gan <[email protected]>

Pterosaur force-pushed the update_iproute2 branch from aab3060 to 1478966 Compare November 23, 2021 08:35

qiluo-msft reviewed Nov 24, 2021

View reviewed changes

qiluo-msft approved these changes Nov 24, 2021

View reviewed changes

Pterosaur merged commit ada0e50 into sonic-net:master Nov 25, 2021

[iproute2]: Add macsec-xpn-support iproute2 in syncd #8702

[iproute2]: Add macsec-xpn-support iproute2 in syncd #8702

Uh oh!

Conversation

Pterosaur commented Sep 8, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

A picture of a cute animal (not mandatory but encouraged)

Uh oh!

qiluo-msft Sep 9, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qiluo-msft Sep 9, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qiluo-msft Sep 9, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Pterosaur commented Sep 26, 2021

Uh oh!

azure-pipelines bot commented Sep 26, 2021

Uh oh!

lguohan commented Nov 11, 2021

Uh oh!

azure-pipelines bot commented Nov 11, 2021

Uh oh!

lguohan commented Nov 11, 2021

Uh oh!

azure-pipelines bot commented Nov 11, 2021

Uh oh!

qiluo-msft Nov 12, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Pterosaur commented Nov 16, 2021

Uh oh!

azure-pipelines bot commented Nov 16, 2021

Uh oh!

Pterosaur commented Nov 19, 2021

Uh oh!

azure-pipelines bot commented Nov 19, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Pterosaur commented Sep 8, 2021 •

edited

Loading

qiluo-msft Sep 9, 2021 •

edited

Loading

qiluo-msft Sep 9, 2021 •

edited

Loading

qiluo-msft Sep 9, 2021 •

edited

Loading

qiluo-msft Nov 12, 2021 •

edited

Loading