Add GNMI client cert cname check support. (#18709)

SECURITY.md

@@ -0,0 +1,41 @@
+<!-- BEGIN MICROSOFT SECURITY.MD V0.0.9 BLOCK -->
+
+## Security
+
+Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet) and [Xamarin](https://github.com/xamarin).
+
+If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/security.md/definition), please report it to us as described below.
+
+## Reporting Security Issues
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/security.md/msrc/create-report).
+
+If you prefer to submit without logging in, send email to [[email protected]](mailto:[email protected]).  If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/security.md/msrc/pgp).
+
+You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc). 
+
+Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
+
+  * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
+  * Full paths of source file(s) related to the manifestation of the issue
+  * The location of the affected source code (tag/branch/commit or direct URL)
+  * Any special configuration required to reproduce the issue
+  * Step-by-step instructions to reproduce the issue
+  * Proof-of-concept or exploit code (if possible)
+  * Impact of the issue, including how an attacker might exploit the issue
+
+This information will help us triage your report more quickly.
+
+If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/security.md/msrc/bounty) page for more details about our active programs.
+
+## Preferred Languages
+
+We prefer all communications to be in English.
+
+## Policy
+
+Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/security.md/cvd).
+
+<!-- END MICROSOFT SECURITY.MD BLOCK -->

dockers/docker-sonic-telemetry/telemetry.sh

@@ -33,6 +33,9 @@ if [ -n "$CERTS" ]; then
     if [ ! -z $CA_CRT ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
+
+    # Reuse GNMI_CLIENT_CERT for telemetry service
+    TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
 elif [ -n "$X509" ]; then
     SERVER_CRT=$(echo $X509 | jq -r '.server_crt')
     SERVER_KEY=$(echo $X509 | jq -r '.server_key')

platform/broadcom/platform-modules-nokia.mk

@@ -12,3 +12,7 @@ $(NOKIA_IXR7250_PLATFORM_MODULE)_PLATFORM = x86_64-nokia_ixr7250e_sup-r0
 $(NOKIA_IXR7250_PLATFORM_MODULE)_PLATFORM += x86_64-nokia_ixr7250e_36x400g-r0
 SONIC_DPKG_DEBS += $(NOKIA_IXR7250_PLATFORM_MODULE)
 
+NDK_VERSION = 22.9.23
+NOKIA_NDK_DEBIAN = ndk_$(NDK_VERSION)_amd64.deb
+$(NOKIA_NDK_DEBIAN)_URL = "https://github.com/Nokia-ION/ndk-releases/releases/download/v$(NDK_VERSION)/$(NOKIA_NDK_DEBIAN)"
+SONIC_ONLINE_DEBS += $(NOKIA_NDK_DEBIAN)

src/iccpd/src/mlacp_link_handler.c

@@ -258,39 +258,6 @@ static int ndisc_set_handler(struct CSM *csm, struct LocalInterface *lif, int ad
  * Port-Channel Status Handler
  *
  ****************************************/
-static void set_route_by_linux_route(struct CSM* csm,
-                                     struct LocalInterface *local_if,
-                                     int is_add)
-{
-    /* TODO Need to remove this function
-         when set static route with zebra works fine*/
-
-    char ipv4_dest_str[INET_ADDRSTRLEN];
-    char syscmd[128];
-    char *ptr;
-    int ret = 0;
-
-    /* enable kernel forwarding support*/
-    system("echo 1 > /proc/sys/net/ipv4/ip_forward");
-
-    if (!csm || !local_if)
-        return;
-
-    sprintf(ipv4_dest_str, "%s", show_ip_str(htonl(local_if->ipv4_addr)));
-    ptr = strrchr(ipv4_dest_str, '.');
-    strcpy(ptr, ".0\0");
-
-    /* set gw route */
-    /* sprintf(syscmd, "ip route %s %s/%d proto static metric 200 nexthop via %s > /dev/null 2>&1", */
-    sprintf(syscmd, "ip route %s %s/%d metric 200 nexthop via %s > /dev/null 2>&1",
-            (is_add) ? "add" : "del", ipv4_dest_str, local_if->prefixlen, csm->peer_ip);
-
-    ret = system(syscmd);
-    ICCPD_LOG_DEBUG(__FUNCTION__, "%s  ret = %d", syscmd, ret);
-
-    return;
-}
-
 static void update_vlan_if_info(struct CSM *csm,
                                 struct LocalInterface *local_if,
                                 struct LocalInterface *vlan_if,
@@ -354,7 +321,6 @@ static void set_l3_itf_state(struct CSM *csm,
         /* set static route*/
         if (route_type == ROUTE_ADD)
         {
-            /*set_route_by_linux_route(csm, set_l3_local_if, 1);*/   /*add static route by linux route tool*/
             /*If the L3 intf is not Vlan, del ARP; else wait ARP age*/
             if (strncmp(set_l3_local_if->name, VLAN_PREFIX, 4) != 0)
             {
@@ -364,7 +330,6 @@ static void set_l3_itf_state(struct CSM *csm,
         }
         else if (route_type == ROUTE_DEL)
         {
-            /*set_route_by_linux_route(csm, set_l3_local_if, 0);*/    /*del static route by linux route tool*/
             arp_set_handler(csm, set_l3_local_if, 1);     /* add arp*/
             ndisc_set_handler(csm, set_l3_local_if, 1); /* add nd */
         }

src/radius/nss/libnss-radius/nss_radius_common.c

@@ -25,6 +25,7 @@ The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
 #include <sys/file.h>
 #include <regex.h>
 #include <time.h>
+#include <sys/wait.h>
 
 #include "nss_radius_common.h"
 
@@ -167,6 +168,124 @@ static void init_rnm(RADIUS_NSS_CONF_B * conf) {
 
 }
 
+static int user_add(const char* name, char* gid, char* sec_grp, char* gecos, 
+                        char* home, char* shell, const char* unconfirmed_user, int many_to_one) {
+    pid_t pid, w;
+    int status = 0;
+    int wstatus;
+    char cmd[64];
+
+    snprintf(cmd, 63, "%s", USERADD);
+
+    pid = fork();
+
+    if(pid > 0) {
+        do {
+            w = waitpid(pid, &wstatus, WUNTRACED | WCONTINUED);
+            if (w == -1)
+                return -1;
+        } while (!WIFEXITED(wstatus) && !WIFSIGNALED(wstatus));
+        if WIFEXITED(wstatus)
+            return WEXITSTATUS(wstatus);
+        else
+            return -1;
+
+    // Child
+
+    } else if(pid == 0) {
+
+        if (many_to_one)
+          execl(cmd, cmd, "-g", gid, "-G", sec_grp, "-c", gecos, "-m", "-s", shell, name, NULL);
+        else
+          execl(cmd, cmd, "-U", "-G", sec_grp, "-c", unconfirmed_user, "-d", home, "-m", "-s", shell, name, NULL);
+        syslog(LOG_ERR, "exec of %s failed with errno=%d", cmd, errno);
+        return -1;
+
+    // Error
+    } else {
+        fprintf(stderr, "error forking the child\n");
+        return -1;
+    }
+
+    return status;
+}
+
+static int user_del(const char* name) {
+    pid_t pid, w;
+    int status = 0;
+    int wstatus;
+    char cmd[64];
+
+    snprintf(cmd, 63, "%s", USERDEL);
+
+    pid = fork();
+
+    if(pid > 0) {
+        do {
+            w = waitpid(pid, &wstatus, WUNTRACED | WCONTINUED);
+            if (w == -1)
+                return -1;
+        } while (!WIFEXITED(wstatus) && !WIFSIGNALED(wstatus));
+        if WIFEXITED(wstatus)
+            return WEXITSTATUS(wstatus);
+        else
+            return -1;
+
+    // Child
+
+    } else if(pid == 0) {
+
+        execl(cmd, cmd, "-r", name, NULL);
+        syslog(LOG_ERR, "exec of %s failed with errno=%d", cmd, errno);
+        return -1;
+
+    // Error
+    } else {
+        fprintf(stderr, "error forking the child\n");
+        return -1;
+    }
+
+    return status;
+}
+
+static int user_mod(const char* name, char* sec_grp) {
+    pid_t pid, w;
+    int status = 0;
+    int wstatus;
+    char cmd[64];
+
+    snprintf(cmd, 63, "%s", USERMOD);
+
+    pid = fork();
+
+    if(pid > 0) {
+        do {
+            w = waitpid(pid, &wstatus, WUNTRACED | WCONTINUED);
+            if (w == -1)
+                return -1;
+        } while (!WIFEXITED(wstatus) && !WIFSIGNALED(wstatus));
+        if WIFEXITED(wstatus)
+            return WEXITSTATUS(wstatus);
+        else
+            return -1;
+
+    // Child
+
+    } else if(pid == 0) {
+
+        execl(cmd, cmd, "-G", sec_grp, "-c", name, name, NULL);
+        syslog(LOG_ERR, "exec of %s failed with errno=%d", cmd, errno);
+        return -1;
+
+    // Error
+    } else {
+        fprintf(stderr, "error forking the child\n");
+        return -1;
+    }
+
+    return status;
+}
+
 int parse_nss_config(RADIUS_NSS_CONF_B * conf, char * prog,
     char * file_buf, int file_buf_sz, int * errnop, int * plockfd) {
 
@@ -379,22 +498,6 @@ int unparse_nss_config(RADIUS_NSS_CONF_B * conf, int * errnop, int * plockfd) {
     return 0;
 }
 
-static int invoke_popen(RADIUS_NSS_CONF_B * conf, char * cmd) {
-    FILE * fp;
-    int status = 0;
-
-    if (conf->debug)
-        syslog(LOG_DEBUG, "%s:%s", conf->prog, cmd);
-
-    if (((fp = popen(cmd, "r")) == NULL) || (pclose(fp) == -1)) {
-        syslog(LOG_ERR, "%s: %s: popen()/pclose() failed %p, errno=%d",
-            conf->prog, cmd, fp, errno);
-            status = errno;
-    }
-
-    return status;
-}
-
 static int radius_getpwnam_r_cleanup(int status, FILE * fp) {
     if (fp)
         fclose(fp);
@@ -434,10 +537,8 @@ static int radius_update_user_cleanup(int status) {
 int radius_update_user(RADIUS_NSS_CONF_B * conf, const char * user, int mpl) {
 
     char buf[BUFLEN];
-    char usermod[4096];
     struct passwd pw, *result = NULL;
     RADIUS_NSS_MPL * rnm = NULL;
-    int written = 0;
     int status;
 
     /* Verify uid is not in the reserved range (<=1000).
@@ -466,82 +567,53 @@ int radius_update_user(RADIUS_NSS_CONF_B * conf, const char * user, int mpl) {
     if (conf->trace)
         dump_rnm(mpl, rnm, "update");
 
-    written = snprintf(usermod, sizeof(usermod),
-        "%s -G %s -c \"%s\" \"%s\"", USERMOD, rnm->groups, user, user);
-
-    if (written >= sizeof(usermod)) {
-        syslog(LOG_ERR,
-          "%s: truncated usermod cmd. Skipping:\"%s\"\n", conf->prog, usermod);
-        return radius_update_user_cleanup(STATUS_E2BIG);
+    if(0 != user_mod(user, rnm->groups)) {
+      syslog(LOG_ERR, "%s: %s %s failed", conf->prog, USERMOD, user);
+        return -1;
     }
-
-    return radius_update_user_cleanup(invoke_popen(conf, usermod));
-}
-
-static int radius_create_user_cleanup(int status) {
-    return status;
+    return 0;
 }
 
 int radius_create_user(RADIUS_NSS_CONF_B * conf, const char * user, int mpl,
     int unconfirmed) {
 
-    char buf[BUFLEN];
-    char useradd[4096];
+    char buf[BUFLEN] = {0};
     RADIUS_NSS_MPL * rnm = &((conf->rnm)[mpl-1]);
-    int written = 0;
 
     if (conf->trace)
         dump_rnm(mpl, rnm, "create");
 
+    if(strlen(user) > 32) {
+        syslog(LOG_ERR, "%s: Username too long", conf->prog);
+        return -1;
+    }
 
-    if (conf->many_to_one) {
+    syslog(LOG_INFO, "%s: Creating user \"%s\"", conf->prog, user);
 
-        written = snprintf(useradd, sizeof(useradd),
-            "%s -g %d -G %s -c \"%s\" -m -s %s \"%s\"",
-            USERADD, rnm->gid, rnm->groups, rnm->gecos, rnm->shell, user);
+    char sgid[10] = {0};
+    char home[64] = {0};
+    snprintf(sgid, 10, "%d", rnm->gid);
+    snprintf(home, 63, "/home/%s", user);
 
-    } else {
+    snprintf(buf, sizeof(buf), "Unconfirmed-%ld", time(NULL));
 
-        snprintf(buf, sizeof(buf), "Unconfirmed-%ld", time(NULL));
-        written = snprintf(useradd, sizeof(useradd),
-            "%s -U -G %s -c \"%s\" -d \"/home/%s\" -m -s %s \"%s\"",
-            USERADD, rnm->groups, unconfirmed ? buf : user, user,
-            rnm->shell, user);
-
-    }
+    if(0 != user_add(user, sgid, rnm->groups, rnm->gecos, home, rnm->shell, unconfirmed ? buf : user, conf->many_to_one)) {
+      syslog(LOG_ERR, "%s: %s %s failed", conf->prog, USERADD, user);
 
-    if (written >= sizeof(useradd)) {
-        syslog(LOG_ERR,
-          "%s: truncated useradd cmd. Skipping:\"%s\"\n", conf->prog, useradd);
-        return radius_create_user_cleanup(STATUS_E2BIG);
+        return -1;
     }
-
-    syslog(LOG_INFO, "%s: Creating user \"%s\"", conf->prog, user);
-
-    return radius_create_user_cleanup(invoke_popen(conf, useradd));
-}
-
-static int radius_delete_user_cleanup(int status) {
-    return status;
+    return 0;
 }
 
 int radius_delete_user(RADIUS_NSS_CONF_B * conf, const char * user) {
 
-    char buf[BUFLEN];
-    char userdel[4096];
-    int written = 0;
-
-    written = snprintf(userdel, sizeof(userdel), "%s -r \"%s\"", USERDEL, user);
-
-    if (written >= sizeof(userdel)) {
-        syslog(LOG_ERR,
-          "%s: truncated userdel cmd. Skipping:\"%s\"\n", conf->prog, userdel);
-        return radius_delete_user_cleanup(STATUS_E2BIG);
-    }
-
     syslog(LOG_INFO, "%s: Deleting user \"%s\"", conf->prog, user);
+    if(0 != user_del(user)) {
+      syslog(LOG_ERR, "%s: %s %s failed", conf->prog, USERDEL, user);
 
-    return radius_delete_user_cleanup(invoke_popen(conf, userdel));
+        return -1;
+    }
+    return 0;
 }
 
 int radius_clear_unconfirmed_users_cleanup(int status, FILE * fp) {