Skip to content

[device/dell] Mitigation for security vulnerability #11875

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
qiluo-msft merged 10 commits into from
Jan 6, 2023
Merged

[device/dell] Mitigation for security vulnerability #11875

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
24bab7a
Replace subprocess getstatusoutput to subprocess run
maipbui Aug 31, 2022
a1bd8ec
Fix ipmi_sdr_list
maipbui Aug 31, 2022
867da79
Fix indentation and use similar old logic
maipbui Sep 6, 2022
cd61bca
Remove redundant replace
maipbui Sep 6, 2022
017f143
Add awk back
maipbui Sep 8, 2022
8593247
Add function in sonic_py_common library
maipbui Sep 13, 2022
7f54f67
Fix bug
maipbui Sep 13, 2022
f74eda9
Replace unsafe functions in platform directory
maipbui Sep 16, 2022
f320820
fix to exception
maipbui Sep 18, 2022
43934a5
Fix lgtm
maipbui Oct 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 16 additions & 15 deletions device/dell/x86_64-dellemc_n3248pxe_c3338-r0/plugins/fanutil.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,10 @@
# Platform-specific FAN status interface for SONiC
#

import commands
import sys
import subprocess

SENSORS_CMD = "docker exec -i pmon /usr/bin/sensors"
SENSORS_CMD = ["docker", "exec", "-i", "pmon", "/usr/bin/sensors"]
DOCKER_SENSORS_CMD = "/usr/bin/sensors"


Expand All @@ -33,24 +33,25 @@ def isDockerEnv(self):
return True

def get_num_fans(self):
n3248pxe_MAX_FANTRAYS = 3
return n3248pxe_MAX_FANTRAYS
n3248pxe_MAX_FANTRAYS = 3
return n3248pxe_MAX_FANTRAYS

def get_presence(self, idx):
sysfs_path = "/sys/devices/platform/dell-n3248pxe-cpld.0/fan" + self._fan_mapping[idx] + "_prs"
return int(open(sysfs_path).read(), 16)
sysfs_path = "/sys/devices/platform/dell-n3248pxe-cpld.0/fan" + self._fan_mapping[idx] + "_prs"
return int(open(sysfs_path).read(), 16)

def get_direction(self, idx):
sysfs_path = "/sys/devices/platform/dell-n3248pxe-cpld.0/fan" + self._fan_mapping[idx] + "_dir"
return open(sysfs_path).read()
sysfs_path = "/sys/devices/platform/dell-n3248pxe-cpld.0/fan" + self._fan_mapping[idx] + "_dir"
return open(sysfs_path).read()

def get_speed(self, idx):
dockerenv = self.isDockerEnv()
if not dockerenv:
status, cmd_output = commands.getstatusoutput(SENSORS_CMD)
else :
status, cmd_output = commands.getstatusoutput(DOCKER_SENSORS_CMD)

p = subprocess.run(SENSORS_CMD, capture_output=True, universal_newlines=True)
status, cmd_output = p.returncode, p.stdout
else:
p = subprocess.run(DOCKER_SENSORS_CMD, capture_output=True, universal_newlines=True)
status, cmd_output = p.returncode, p.stdout
if status:
print('Failed to execute sensors command')
sys.exit(0)
Expand All @@ -64,9 +65,9 @@ def get_speed(self, idx):
return 0.0

def get_status(self, idx):
sysfs_path = "/sys/devices/platform/dell-n3248pxe-cpld.0/fan" + self._fan_mapping[idx] + "_prs"
return int(open(sysfs_path).read(), 16)
sysfs_path = "/sys/devices/platform/dell-n3248pxe-cpld.0/fan" + self._fan_mapping[idx] + "_prs"
return int(open(sysfs_path).read(), 16)


def set_speed(self, idx):
Comment thread
maipbui marked this conversation as resolved.
Outdated
return False
return False
15 changes: 9 additions & 6 deletions device/dell/x86_64-dellemc_n3248pxe_c3338-r0/plugins/psuutil.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@
# Platform-specific PSU status interface for SONiC
#

import commands
import os
import sys
import subprocess

SENSORS_CMD = "docker exec -i pmon /usr/bin/sensors"
SENSORS_CMD = ["docker", "exec", "-i", "pmon", "/usr/bin/sensors"]
DOCKER_SENSORS_CMD = "/usr/bin/sensors"

try:
Expand Down Expand Up @@ -95,10 +95,13 @@ def get_psu_presence(self, index):
def get_sensor(self):
dockerenv = self.isDockerEnv()
if not dockerenv:
status, cmd_output = commands.getstatusoutput(SENSORS_CMD)
else :
status, cmd_output = commands.getstatusoutput(DOCKER_SENSORS_CMD)

p = subprocess.run(SENSORS_CMD, capture_output=True, universal_newlines=True)
status, cmd_output = p.returncode, p.stdout
else:
p = subprocess.run(DOCKER_SENSORS_CMD, capture_output=True, universal_newlines=True)
status, cmd_output = p.returncode, p.stdout
if cmd_output[-1:] == '\n':
cmd_output = cmd_output[:-1]
if status:
print('Failed to execute sensors command')
sys.exit(0)
Expand Down
29 changes: 15 additions & 14 deletions device/dell/x86_64-dellemc_n3248te_c3338-r0/plugins/fanutil.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
import subprocess
import sys

SENSORS_CMD = "docker exec -i pmon /usr/bin/sensors"
SENSORS_CMD = ["docker", "exec", "-i", "pmon", "/usr/bin/sensors"]
DOCKER_SENSORS_CMD = "/usr/bin/sensors"


Expand All @@ -33,24 +33,25 @@ def isDockerEnv(self):
return True

def get_num_fans(self):
N3248TE_MAX_FANTRAYS = 3
return N3248TE_MAX_FANTRAYS
N3248TE_MAX_FANTRAYS = 3
return N3248TE_MAX_FANTRAYS

def get_presence(self, idx):
sysfs_path = "/sys/devices/platform/dell-n3248te-cpld.0/fan" + self._fan_mapping[idx] + "_prs"
return int(open(sysfs_path).read(), 16)
sysfs_path = "/sys/devices/platform/dell-n3248te-cpld.0/fan" + self._fan_mapping[idx] + "_prs"
return int(open(sysfs_path).read(), 16)

def get_direction(self, idx):
sysfs_path = "/sys/devices/platform/dell-n3248te-cpld.0/fan" + self._fan_mapping[idx] + "_dir"
return open(sysfs_path).read()
sysfs_path = "/sys/devices/platform/dell-n3248te-cpld.0/fan" + self._fan_mapping[idx] + "_dir"
return open(sysfs_path).read()

def get_speed(self, idx):
dockerenv = self.isDockerEnv()
if not dockerenv:
status, cmd_output = subprocess.getstatusoutput(SENSORS_CMD)
else :
status, cmd_output = subprocess.getstatusoutput(DOCKER_SENSORS_CMD)

p = subprocess.run(SENSORS_CMD, capture_output=True, universal_newlines=True)
status, cmd_output = p.returncode, p.stdout
else:
p = subprocess.run(DOCKER_SENSORS_CMD, capture_output=True, universal_newlines=True)
status, cmd_output = p.returncode, p.stdout
if status:
print('Failed to execute sensors command')
sys.exit(0)
Expand All @@ -64,9 +65,9 @@ def get_speed(self, idx):
return 0.0

def get_status(self, idx):
sysfs_path = "/sys/devices/platform/dell-n3248te-cpld.0/fan" + self._fan_mapping[idx] + "_prs"
return int(open(sysfs_path).read(), 16)
sysfs_path = "/sys/devices/platform/dell-n3248te-cpld.0/fan" + self._fan_mapping[idx] + "_prs"
return int(open(sysfs_path).read(), 16)


def set_speed(self, idx):
return False
return False
15 changes: 9 additions & 6 deletions device/dell/x86_64-dellemc_n3248te_c3338-r0/plugins/psuutil.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@
# Platform-specific PSU status interface for SONiC
#

import commands
import os
import sys
import subprocess

SENSORS_CMD = "docker exec -i pmon /usr/bin/sensors"
SENSORS_CMD = ["docker", "exec", "-i", "pmon", "/usr/bin/sensors"]
DOCKER_SENSORS_CMD = "/usr/bin/sensors"

try:
Expand Down Expand Up @@ -95,10 +95,13 @@ def get_psu_presence(self, index):
def get_sensor(self):
dockerenv = self.isDockerEnv()
if not dockerenv:
status, cmd_output = commands.getstatusoutput(SENSORS_CMD)
else :
status, cmd_output = commands.getstatusoutput(DOCKER_SENSORS_CMD)

p = subprocess.run(SENSORS_CMD, capture_output=True, universal_newlines=True)
status, cmd_output = p.returncode, p.stdout
else:
p = subprocess.run(DOCKER_SENSORS_CMD, capture_output=True, universal_newlines=True)
status, cmd_output = p.returncode, p.stdout
if cmd_output[-1:] == '\n':
cmd_output = cmd_output[:-1]
if status:
print('Failed to execute sensors command')
sys.exit(0)
Expand Down
14 changes: 10 additions & 4 deletions device/dell/x86_64-dellemc_s5212f_c3538-r0/plugins/psuutil.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@
import subprocess

S5212F_MAX_PSUS = 2
IPMI_PSU_DATA = "docker exec -it pmon ipmitool sdr list"
IPMI_PSU_DATA_DOCKER = "ipmitool sdr list"
IPMI_PSU_DATA = ["docker", "exec", "-it", "pmon", "ipmitool", "sdr", "list"]
IPMI_PSU_DATA_DOCKER = ["ipmitool", "sdr", "list"]
PSU_PRESENCE = "PSU{0}_stat"
# Use this for older firmware
# PSU_PRESENCE="PSU{0}_prsnt"
Expand Down Expand Up @@ -44,7 +44,8 @@ def get_pmc_register(self, reg_name):
if dockerenv == True:
ipmi_cmd = IPMI_PSU_DATA_DOCKER

status, ipmi_sdr_list = subprocess.getstatusoutput(ipmi_cmd)
p = subprocess.run(ipmi_cmd, capture_output=True, universal_newlines=True)
status, ipmi_sdr_list = p.returncode, p.stdout

if status:
logging.error('Failed to execute:' + ipmi_sdr_list)
Expand Down Expand Up @@ -91,6 +92,11 @@ def get_psu_presence(self, index):
:param index: An integer, index of the PSU of which to query status
:return: Boolean, True if PSU is plugged, False if not
"""
cmd_status, psu_status = subprocess.getstatusoutput('ipmitool raw 0x04 0x2d ' + hex(0x30 + index) + " | awk '{print substr($0,9,1)}'")
cmd = ["ipmitool", "raw", "0x04", "0x2d", hex(0x30 + index)]
proc = subprocess.run(cmd, capture_output=True, universal_newlines=True)
line = proc.stdout
if line[-1:] == '\n':
line = line[:-1]
psu_status = line[8] if len(line) > 8 else ''
return 1 if psu_status == '1' else 0

12 changes: 10 additions & 2 deletions device/dell/x86_64-dellemc_s5224f_c3538-r0/plugins/psuutil.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,10 @@ def get_pmc_register(self, reg_name):
if dockerenv == True:
ipmi_cmd = IPMI_PSU_DATA_DOCKER

status, ipmi_sdr_list = subprocess.getstatusoutput(ipmi_cmd)
p = subprocess.run(ipmi_cmd, capture_output=True, universal_newlines=True)
status, ipmi_sdr_list = p.returncode, p.stdout
if ipmi_sdr_list[-1:] == '\n':
ipmi_sdr_list = ipmi_sdr_list[:-1]

if status:
logging.error('Failed to execute:' + ipmi_sdr_list)
Expand Down Expand Up @@ -92,6 +95,11 @@ def get_psu_presence(self, index):
:param index: An integer, index of the PSU of which to query status
:return: Boolean, True if PSU is plugged, False if not
"""
cmd_status, psu_status = subprocess.getstatusoutput('ipmitool raw 0x04 0x2d ' + hex(0x30 + index) + " | awk '{print substr($0,9,1)}'")
cmd = ["ipmitool", "raw", "0x04", "0x2d", hex(0x30 + index)]
proc = subprocess.run(cmd, capture_output=True, universal_newlines=True)
line = proc.stdout
if line[-1:] == '\n':
line = line[:-1]
psu_status = line[8] if len(line) > 8 else ''
return 1 if psu_status == '1' else 0

95 changes: 52 additions & 43 deletions device/dell/x86_64-dellemc_s5232f_c3538-r0/plugins/psuutil.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,22 +4,17 @@
#


import os.path
import logging
import sys

if sys.version_info[0] < 3:
import commands
else:
import subprocess as commands

import subprocess

S5232F_MAX_PSUS = 2
IPMI_PSU1_DATA = "docker exec -it pmon ipmitool raw 0x04 0x2d 0x31 | awk '{print substr($0,9,1)}'"
IPMI_PSU1_DATA_DOCKER = "ipmitool raw 0x04 0x2d 0x31 | awk '{print substr($0,9,1)}'"
IPMI_PSU2_DATA = "docker exec -it pmon ipmitool raw 0x04 0x2d 0x32 | awk '{print substr($0,9,1)}'"
IPMI_PSU2_DATA_DOCKER = "ipmitool raw 0x04 0x2d 0x32 | awk '{print substr($0,9,1)}'"
IPMI_PSU1_DATA = ["docker", "exec", "-it", "pmon", "ipmitool", "raw", "0x04", "0x2d", "0x31"]
IPMI_PSU1_DATA_DOCKER = ["ipmitool", "raw", "0x04", "0x2d", "0x31"]
IPMI_PSU2_DATA = ["docker", "exec", "-it", "pmon", "ipmitool", "raw", "0x04", "0x2d", "0x32"]
IPMI_PSU2_DATA_DOCKER = ["ipmitool", "raw", "0x04", "0x2d", "0x32"]
PSU_PRESENCE = "PSU{0}_stat"
awk_cmd = ['awk', '{print substr($0,9,1)}']
# Use this for older firmware
# PSU_PRESENCE="PSU{0}_prsnt"

Expand All @@ -46,25 +41,28 @@ def isDockerEnv(self):
# Fetch a BMC register
def get_pmc_register(self, reg_name):

status = 1
ipmi_cmd_1 = IPMI_PSU1_DATA
ipmi_cmd_2 = IPMI_PSU1_DATA
ipmi_cmd = ''
dockerenv = self.isDockerEnv()
if dockerenv == True:
if index == 1:
status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU1_DATA_DOCKER)
ipmi_cmd = IPMI_PSU1_DATA_DOCKER
elif index == 2:
status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU2_DATA_DOCKER)
ipmi_cmd = IPMI_PSU2_DATA_DOCKER
else:
if index == 1:
status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU1_DATA)
ipmi_cmd = IPMI_PSU1_DATA
elif index == 2:
status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU2_DATA)

if status:
logging.error('Failed to execute ipmitool')
sys.exit(0)

ipmi_cmd = IPMI_PSU2_DATA
with subprocess.Popen(ipmi_cmd, universal_newlines=True, stdout=subprocess.PIPE) as p1:
with subprocess.Popen(awk_cmd, universal_newlines=True, stdin=p1.stdout, stdout=subprocess.PIPE) as p2:
ipmi_sdr_list = p2.communicate()[0]
p1.wait()
if p1.returncode != 0 and p2.returncode != 0:
logging.error('Failed to execute ipmitool')
sys.exit(0)

if ipmi_sdr_list[-1:] == '\n':
ipmi_sdr_list = ipmi_sdr_list[:-1]
output = ipmi_sdr_list

return output
Expand All @@ -87,24 +85,29 @@ def get_psu_status(self, index):
"""
# Until psu_status is implemented this is hardcoded temporarily

psu_status = 'f'
ret_status = 1
psu_status = ''
ipmi_cmd = ''
dockerenv = self.isDockerEnv()
if dockerenv == True:
if index == 1:
ret_status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU1_DATA_DOCKER)
ipmi_cmd = IPMI_PSU1_DATA_DOCKER
elif index == 2:
ret_status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU2_DATA_DOCKER)
ipmi_cmd = IPMI_PSU2_DATA_DOCKER
else:
if index == 1:
ret_status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU1_DATA)
ipmi_cmd = IPMI_PSU1_DATA
elif index == 2:
ret_status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU2_DATA)

if ret_status:
logging.error('Failed to execute ipmitool : ')
sys.exit(0)

ipmi_cmd = IPMI_PSU2_DATA
with subprocess.Popen(ipmi_cmd, universal_newlines=True, stdout=subprocess.PIPE) as p1:
Comment thread
maipbui marked this conversation as resolved.
Outdated
with subprocess.Popen(awk_cmd, universal_newlines=True, stdin=p1.stdout, stdout=subprocess.PIPE) as p2:
ipmi_sdr_list = p2.communicate()[0]
p1.wait()
if p1.returncode != 0 and p2.returncode != 0:
logging.error('Failed to execute ipmitool')
sys.exit(0)

if ipmi_sdr_list[-1:] == '\n':
ipmi_sdr_list = ipmi_sdr_list[:-1]
psu_status = ipmi_sdr_list
return (not int(psu_status, 16) > 1)

Expand All @@ -116,22 +119,28 @@ def get_psu_presence(self, index):
:return: Boolean, True if PSU is plugged, False if not
"""
psu_status = '0'
ret_status = 1
ipmi_cmd = ''
dockerenv = self.isDockerEnv()
if dockerenv == True:
if index == 1:
ret_status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU1_DATA_DOCKER)
ipmi_cmd = IPMI_PSU1_DATA_DOCKER
elif index == 2:
ret_status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU2_DATA_DOCKER)
ipmi_cmd = IPMI_PSU2_DATA_DOCKER
else:
if index == 1:
ret_status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU1_DATA)
ipmi_cmd = IPMI_PSU1_DATA
elif index == 2:
ret_status, ipmi_sdr_list = commands.getstatusoutput(IPMI_PSU2_DATA)

if ret_status:
logging.error('Failed to execute ipmitool : ')
sys.exit(0)
ipmi_cmd = IPMI_PSU2_DATA
with subprocess.Popen(ipmi_cmd, universal_newlines=True, stdout=subprocess.PIPE) as p1:
Comment thread
maipbui marked this conversation as resolved.
Outdated
with subprocess.Popen(awk_cmd, universal_newlines=True, stdin=p1.stdout, stdout=subprocess.PIPE) as p2:
ipmi_sdr_list = p2.communicate()[0]
p1.wait()
if p1.returncode != 0 and p2.returncode != 0:
logging.error('Failed to execute ipmitool')
sys.exit(0)

if ipmi_sdr_list[-1:] == '\n':
ipmi_sdr_list = ipmi_sdr_list[:-1]

psu_status = ipmi_sdr_list
return (int(psu_status, 16) & 1)
Loading