Skip to content

vpp: Workaround scapy bfd issue #22644

Merged
yejianquan merged 6 commits intosonic-net:masterfrom
yue-fred-gao:workaround_scapy_bfd
Mar 1, 2026
Merged

vpp: Workaround scapy bfd issue #22644
yejianquan merged 6 commits intosonic-net:masterfrom
yue-fred-gao:workaround_scapy_bfd

Conversation

@yue-fred-gao
Copy link
Copy Markdown
Contributor

@yue-fred-gao yue-fred-gao commented Feb 26, 2026 •
edited
Loading

Description of PR

Summary:
Fixes # (issue)

Type of change

  • Bug fix
  • Testbed and Framework(new/improvement)
  • New Test case
    • Skipped for non-supported platforms
  • Test case improvement

Back port request

  • 202205
  • 202305
  • 202311
  • 202405
  • 202411
  • 202505
  • 202511

Approach

What is the motivation for this PR?

After upgrading scapy in ptf container, a bug is introduced. BFDResponder generates BFD packet with auth field even auth flag is not enabled. The authentication field is appended to the end of the BFD packet without adjusting UDP header length. This causes udp checksum verification failed.
Here is the packet from PTF:

18:16:27.682014 IP6 fddd:a100:a0::a37:10.49157 > fc00:1::32.4784: UDP, bad length 35 > 24
0x0000: 225d a77e b78e 1e44 8b06 c367 86dd 6000
0x0010: 0000 0020 11ff fddd a100 00a0 0000 0000
0x0020: 0000 0a37 0010 fc00 0001 0000 0000 0000
0x0030: 0000 0000 0032 c005 12b0 002b 9c68 2080
0x0040: 0a18 cdba 0001 c349 ff6a 000f 4240 000f
0x0050: 4240 0000 0001 010b 0170 6173 7377 6f72
0x0060: 64

Here is the issue about scapy bfd issue: secdev/scapy#4937

How did you do it?

Set optional_auth to None to get around the bug

How did you verify/test it?

Verified with sonic-mgmt test

Any platform specific information?

Supported testbed topology if it's a new test case?

Documentation

@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented Feb 26, 2026

/azp run

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines bot commented Feb 26, 2026

Azure Pipelines successfully started running 1 pipeline(s).

@yue-fred-gao
Fix unused import
294e216 
Signed-off-by: Yue Gao <[email protected]>
@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented Feb 26, 2026

/azp run

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines bot commented Feb 26, 2026

Azure Pipelines successfully started running 1 pipeline(s).

@yue-fred-gao yue-fred-gao marked this pull request as ready for review February 27, 2026 14:42
@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented Feb 27, 2026

/azp run

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines bot commented Feb 27, 2026

Azure Pipelines successfully started running 1 pipeline(s).

@yue-fred-gao
Remove debug output
a5661bb 
Signed-off-by: Yue Gao <[email protected]>
@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented Feb 27, 2026

/azp run

@github-actions github-actions bot requested a review from zypgithub February 27, 2026 15:29
@azure-pipelines
Copy link
Copy Markdown

azure-pipelines bot commented Feb 27, 2026

Azure Pipelines successfully started running 1 pipeline(s).

dypet
dypet approved these changes Feb 27, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@dypet dypet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@yue-fred-gao
Copy link
Copy Markdown
Contributor Author

yue-fred-gao commented Feb 27, 2026

/azpw run

@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented Feb 27, 2026

/AzurePipelines run

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines bot commented Feb 27, 2026

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented Feb 28, 2026

/azp run

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines bot commented Feb 28, 2026

Azure Pipelines successfully started running 1 pipeline(s).

@yue-fred-gao
Copy link
Copy Markdown
Contributor Author

yue-fred-gao commented Feb 28, 2026

/azpw run

@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented Feb 28, 2026

/AzurePipelines run

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines bot commented Feb 28, 2026

Azure Pipelines successfully started running 1 pipeline(s).

yejianquan
yejianquan approved these changes Mar 1, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@yejianquan yejianquan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for the fix

@yejianquan yejianquan merged commit 25c4d06 into sonic-net:master Mar 1, 2026
19 of 22 checks passed
@yue-fred-gao yue-fred-gao mentioned this pull request Mar 2, 2026
Open
aronovic pushed a commit to aronovic/sonic-mgmt that referenced this pull request Mar 3, 2026
@yue-fred-gao @aronovic
vpp: Workaround scapy bfd issue (sonic-net#22644)
85eefc5 
Approach
What is the motivation for this PR?
After upgrading scapy in ptf container, a bug is introduced. BFDResponder generates BFD packet with auth field even auth flag is not enabled. The authentication field is appended to the end of the BFD packet without adjusting UDP header length. This causes udp checksum verification failed.
Here is the packet from PTF:

18:16:27.682014 IP6 fddd:a100:a0::a37:10.49157 > fc00:1::32.4784: UDP, bad length 35 > 24
0x0000: 225d a77e b78e 1e44 8b06 c367 86dd 6000
0x0010: 0000 0020 11ff fddd a100 00a0 0000 0000
0x0020: 0000 0a37 0010 fc00 0001 0000 0000 0000
0x0030: 0000 0000 0032 c005 12b0 002b 9c68 2080
0x0040: 0a18 cdba 0001 c349 ff6a 000f 4240 000f
0x0050: 4240 0000 0001 010b 0170 6173 7377 6f72
0x0060: 64
Here is the issue about scapy bfd issue: secdev/scapy#4937

How did you do it?
Set optional_auth to None to get around the bug

How did you verify/test it?
Verified with sonic-mgmt test

Signed-off-by: Yue Gao <[email protected]>
Signed-off-by: Mihut Aronovici <[email protected]>
rraghav-cisco pushed a commit to rraghav-cisco/sonic-mgmt that referenced this pull request Mar 3, 2026
@yue-fred-gao @rraghav-cisco
vpp: Workaround scapy bfd issue (sonic-net#22644)
b731be9 
Approach
What is the motivation for this PR?
After upgrading scapy in ptf container, a bug is introduced. BFDResponder generates BFD packet with auth field even auth flag is not enabled. The authentication field is appended to the end of the BFD packet without adjusting UDP header length. This causes udp checksum verification failed.
Here is the packet from PTF:

18:16:27.682014 IP6 fddd:a100:a0::a37:10.49157 > fc00:1::32.4784: UDP, bad length 35 > 24
0x0000: 225d a77e b78e 1e44 8b06 c367 86dd 6000
0x0010: 0000 0020 11ff fddd a100 00a0 0000 0000
0x0020: 0000 0a37 0010 fc00 0001 0000 0000 0000
0x0030: 0000 0000 0032 c005 12b0 002b 9c68 2080
0x0040: 0a18 cdba 0001 c349 ff6a 000f 4240 000f
0x0050: 4240 0000 0001 010b 0170 6173 7377 6f72
0x0060: 64
Here is the issue about scapy bfd issue: secdev/scapy#4937

How did you do it?
Set optional_auth to None to get around the bug

How did you verify/test it?
Verified with sonic-mgmt test

Signed-off-by: Yue Gao <[email protected]>
Signed-off-by: Raghavendran Ramanathan <[email protected]>
kazinator-arista pushed a commit to kazinator-arista/sonic-mgmt that referenced this pull request Mar 4, 2026
@SahilChaudhari
[202505]: Changed pciesvc driver compilation methods to support linux…
c06c473 
… 6.1.123 (#23478)

changed hardcoded src/sonic-linux-kernel path to /lib/modules/<kernel_version>/ path
changed platform.conf to use single kernel version variable instead changing all places
Release artifacts for Pensando dpu to build docker-dpu.tar.gz and libsai debs for 1.87.0-SS-15 release
Why I did it
Picked: sonic-net#22900
Picked: sonic-net#22644

Work item tracking
Microsoft ADO (number only):
How I did it
git clone https://github.com/sonic-net/sonic-buildimage.git
<path_to_sonic-builldimage>: make init
<path_to_sonic-builldimage>: make configure PLATFORM=pensando PLATFORM_ARCH=arm64
cd <path_to_sonic-builldimage>/platform/pensando/pensando-sonic-artifacts
<path_to_sonic-builldimage>/platform/pensando/pensando-sonic-artifacts: gh release download 1.87.0-SS-15-release
<path_to_sonic-builldimage>: NOJESSIE=1 NOSTRETCH=1 NOBUSTER=0 NOBULLSEYE=0 make target/sonic-pensando.tar
How to verify it
Load the SONiC image from ONIE and make sure the interfaces are UP. All containers are up. midplane ip should work.

Signed-off-by: Sahil Chaudhari <[email protected]>
aronovic pushed a commit to aronovic/sonic-mgmt that referenced this pull request Mar 10, 2026
@yue-fred-gao @aronovic
vpp: Workaround scapy bfd issue (sonic-net#22644)
f1e53c3 
Approach
What is the motivation for this PR?
After upgrading scapy in ptf container, a bug is introduced. BFDResponder generates BFD packet with auth field even auth flag is not enabled. The authentication field is appended to the end of the BFD packet without adjusting UDP header length. This causes udp checksum verification failed.
Here is the packet from PTF:

18:16:27.682014 IP6 fddd:a100:a0::a37:10.49157 > fc00:1::32.4784: UDP, bad length 35 > 24
0x0000: 225d a77e b78e 1e44 8b06 c367 86dd 6000
0x0010: 0000 0020 11ff fddd a100 00a0 0000 0000
0x0020: 0000 0a37 0010 fc00 0001 0000 0000 0000
0x0030: 0000 0000 0032 c005 12b0 002b 9c68 2080
0x0040: 0a18 cdba 0001 c349 ff6a 000f 4240 000f
0x0050: 4240 0000 0001 010b 0170 6173 7377 6f72
0x0060: 64
Here is the issue about scapy bfd issue: secdev/scapy#4937

How did you do it?
Set optional_auth to None to get around the bug

How did you verify/test it?
Verified with sonic-mgmt test

Signed-off-by: Yue Gao <[email protected]>
Signed-off-by: Mihut Aronovici <[email protected]>
selldinesh pushed a commit to selldinesh/sonic-mgmt that referenced this pull request Mar 16, 2026
@yue-fred-gao @selldinesh
vpp: Workaround scapy bfd issue (sonic-net#22644)
5ddb45f 
Approach
What is the motivation for this PR?
After upgrading scapy in ptf container, a bug is introduced. BFDResponder generates BFD packet with auth field even auth flag is not enabled. The authentication field is appended to the end of the BFD packet without adjusting UDP header length. This causes udp checksum verification failed.
Here is the packet from PTF:

18:16:27.682014 IP6 fddd:a100:a0::a37:10.49157 > fc00:1::32.4784: UDP, bad length 35 > 24
0x0000: 225d a77e b78e 1e44 8b06 c367 86dd 6000
0x0010: 0000 0020 11ff fddd a100 00a0 0000 0000
0x0020: 0000 0a37 0010 fc00 0001 0000 0000 0000
0x0030: 0000 0000 0032 c005 12b0 002b 9c68 2080
0x0040: 0a18 cdba 0001 c349 ff6a 000f 4240 000f
0x0050: 4240 0000 0001 010b 0170 6173 7377 6f72
0x0060: 64
Here is the issue about scapy bfd issue: secdev/scapy#4937

How did you do it?
Set optional_auth to None to get around the bug

How did you verify/test it?
Verified with sonic-mgmt test

Signed-off-by: Yue Gao <[email protected]>
Signed-off-by: selldinesh <[email protected]>
abhishek-nexthop pushed a commit to nexthop-ai/sonic-mgmt that referenced this pull request Mar 17, 2026
@yue-fred-gao @abhishek-nexthop
vpp: Workaround scapy bfd issue (sonic-net#22644)
2faea44 
Approach
What is the motivation for this PR?
After upgrading scapy in ptf container, a bug is introduced. BFDResponder generates BFD packet with auth field even auth flag is not enabled. The authentication field is appended to the end of the BFD packet without adjusting UDP header length. This causes udp checksum verification failed.
Here is the packet from PTF:

18:16:27.682014 IP6 fddd:a100:a0::a37:10.49157 > fc00:1::32.4784: UDP, bad length 35 > 24
0x0000: 225d a77e b78e 1e44 8b06 c367 86dd 6000
0x0010: 0000 0020 11ff fddd a100 00a0 0000 0000
0x0020: 0000 0a37 0010 fc00 0001 0000 0000 0000
0x0030: 0000 0000 0032 c005 12b0 002b 9c68 2080
0x0040: 0a18 cdba 0001 c349 ff6a 000f 4240 000f
0x0050: 4240 0000 0001 010b 0170 6173 7377 6f72
0x0060: 64
Here is the issue about scapy bfd issue: secdev/scapy#4937

How did you do it?
Set optional_auth to None to get around the bug

How did you verify/test it?
Verified with sonic-mgmt test

Signed-off-by: Yue Gao <[email protected]>
Signed-off-by: Abhishek <[email protected]>
vrajeshe pushed a commit to vrajeshe/sonic-mgmt that referenced this pull request Mar 23, 2026
@yue-fred-gao @vrajeshe
vpp: Workaround scapy bfd issue (sonic-net#22644)
5535484 
Approach
What is the motivation for this PR?
After upgrading scapy in ptf container, a bug is introduced. BFDResponder generates BFD packet with auth field even auth flag is not enabled. The authentication field is appended to the end of the BFD packet without adjusting UDP header length. This causes udp checksum verification failed.
Here is the packet from PTF:

18:16:27.682014 IP6 fddd:a100:a0::a37:10.49157 > fc00:1::32.4784: UDP, bad length 35 > 24
0x0000: 225d a77e b78e 1e44 8b06 c367 86dd 6000
0x0010: 0000 0020 11ff fddd a100 00a0 0000 0000
0x0020: 0000 0a37 0010 fc00 0001 0000 0000 0000
0x0030: 0000 0000 0032 c005 12b0 002b 9c68 2080
0x0040: 0a18 cdba 0001 c349 ff6a 000f 4240 000f
0x0050: 4240 0000 0001 010b 0170 6173 7377 6f72
0x0060: 64
Here is the issue about scapy bfd issue: secdev/scapy#4937

How did you do it?
Set optional_auth to None to get around the bug

How did you verify/test it?
Verified with sonic-mgmt test

Signed-off-by: Yue Gao <[email protected]>
Signed-off-by: Venkata Gouri Rajesh Etla <[email protected]>
@yue-fred-gao yue-fred-gao deleted the workaround_scapy_bfd branch March 25, 2026 20:30
ravaliyel pushed a commit to ravaliyel/sonic-mgmt that referenced this pull request Mar 27, 2026
@yue-fred-gao @ravaliyel
vpp: Workaround scapy bfd issue (sonic-net#22644)
9efdb68 
Approach
What is the motivation for this PR?
After upgrading scapy in ptf container, a bug is introduced. BFDResponder generates BFD packet with auth field even auth flag is not enabled. The authentication field is appended to the end of the BFD packet without adjusting UDP header length. This causes udp checksum verification failed.
Here is the packet from PTF:

18:16:27.682014 IP6 fddd:a100:a0::a37:10.49157 > fc00:1::32.4784: UDP, bad length 35 > 24
0x0000: 225d a77e b78e 1e44 8b06 c367 86dd 6000
0x0010: 0000 0020 11ff fddd a100 00a0 0000 0000
0x0020: 0000 0a37 0010 fc00 0001 0000 0000 0000
0x0030: 0000 0000 0032 c005 12b0 002b 9c68 2080
0x0040: 0a18 cdba 0001 c349 ff6a 000f 4240 000f
0x0050: 4240 0000 0001 010b 0170 6173 7377 6f72
0x0060: 64
Here is the issue about scapy bfd issue: secdev/scapy#4937

How did you do it?
Set optional_auth to None to get around the bug

How did you verify/test it?
Verified with sonic-mgmt test

Signed-off-by: Yue Gao <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yejianquan yejianquan yejianquan approved these changes

@dypet dypet dypet approved these changes

@mramezani95 mramezani95 Awaiting requested review from mramezani95

@rraghav-cisco rraghav-cisco Awaiting requested review from rraghav-cisco

@xwjiang-ms xwjiang-ms Awaiting requested review from xwjiang-ms

@zypgithub zypgithub Awaiting requested review from zypgithub

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@yue-fred-gao @mssonicbld @yejianquan @dypet