Skip to content

Commit 217dbcb

Browse files
sanjanchsanjanch
authored
Added validation for CSCwd40071 (#332)
* Added validation for CSCwd40071 * Addressed the comments * Added cversion for the check * Removed empty spaces * logic change. removed 0.0.0.0/0 and made pytest changes * logic modified and validation.md file updated
1 parent 07ea2db commit 217dbcb

7 files changed

Lines changed: 262 additions & 0 deletions

‎aci-preupgrade-validation-script.py‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6293,6 +6293,30 @@ def multipod_modular_spine_bootscript_check(tversion, fabric_nodes, username, pa
62936293
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
62946294

62956295

6296+
@check_wrapper(check_title="Inband Management Policy Misconfiguration")
6297+
def inband_management_policy_misconfig_check(cversion, tversion, **kwargs):
6298+
result = PASS
6299+
headers = ["Node_ID", "Address", "Gateway"]
6300+
data = []
6301+
recommended_action = "Contact Cisco TAC to remove any identified misconfigured 'mgmtRsInBStNode' objects"
6302+
doc_url = "https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#inband-management-policy-misconfiguration"
6303+
6304+
if (cversion.older_than("5.2(8d)")) and (tversion.newer_than("6.0(4c)") or tversion.same_as("6.0(4c)")):
6305+
mgmtRsInBStNodes = icurl('class', 'mgmtRsInBStNode.json?query-target-filter=or(eq(mgmtRsInBStNode.addr,"0.0.0.0"),eq(mgmtRsInBStNode.gw,"0.0.0.0"))')
6306+
for mgmtRsInBStNode in mgmtRsInBStNodes:
6307+
attrs = mgmtRsInBStNode["mgmtRsInBStNode"]["attributes"]
6308+
addr = attrs['addr']
6309+
gw = attrs['gw']
6310+
node_match = re.search(node_regex, attrs['dn'])
6311+
node_id = node_match.group("node")
6312+
data.append([node_id, addr, gw])
6313+
else:
6314+
return Result(result=NA, msg=VER_NOT_AFFECTED)
6315+
if data:
6316+
result = FAIL_O
6317+
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
6318+
6319+
62966320
# ---- Script Execution ----
62976321

62986322

@@ -6462,6 +6486,7 @@ class CheckManager:
64626486
auto_firmware_update_on_switch_check,
64636487
rogue_ep_coop_exception_mac_check,
64646488
n9k_c9408_model_lem_count_check,
6489+
inband_management_policy_misconfig_check,
64656490
]
64666491
ssh_checks = [
64676492
# General

‎docs/docs/validations.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,7 @@ Items | Defect | This Script
198198
[Rogue EP Exception List missing on switches][d30] | CSCwp64296 | :white_check_mark: | :no_entry_sign:
199199
[N9K-C9408 with more than 5 N9K-X9400-16W LEMs][d31] | CSCws82819 | :white_check_mark: | :no_entry_sign:
200200
[Multi-Pod Modular Spine Bootscript File][d32] | CSCwr66848 | :white_check_mark: | :no_entry_sign:
201+
[Inband Management Policy Misconfiguration][d33]| CSCwd40071 | :white_check_mark: | :no_entry_sign:
201202

202203
[d1]: #ep-announce-compatibility
203204
[d2]: #eventmgr-db-size-defect-susceptibility
@@ -231,6 +232,7 @@ Items | Defect | This Script
231232
[d30]: #rogue-ep-exception-list-missing-on-switches
232233
[d31]: #n9k-c9408-with-more-than-5-n9k-x9400-16w-lems
233234
[d32]: #multi-pod-modular-spine-bootscript-file
235+
[d33]: #inband-management-policy-misconfiguration
234236

235237
## General Check Details
236238

@@ -2753,6 +2755,21 @@ This issue happens only when the target version is specifically 6.1(4h).
27532755
To avoid this issue, change the target version to another version. Or verify that the `bootscript` file exists in the bootflash of each modular spine switch prior to upgrading to 6.1(4h). If the file is missing, you have to do clean reboot on the impacted spine to ensure that `/bootflash/bootscript` gets created again. In case you already upgraded your spine and you are experiencing the traffic impact due to this issue, clean reboot of the spine will restore the traffic.
27542756

27552757

2758+
### Inband Management Policy Misconfiguration
2759+
2760+
Due to the defect [CSCwh80837][67], starting from version 6.0(4c), mgmtRsInBStNode policy get modified in leaf/spine during Apic upgrade.
2761+
2762+
Impact:
2763+
2764+
When upgrading Apic from versions prior to 6.0(4c) to versions 6.0(4c) or later, if there is a misconfiguration in the inband management policies (mgmtRsInBStNode) with invalid values, the re-processing triggered by [CSCwh80837][67] will expose the underlying [CSCwd40071][68] defect. This results in continuous policyelem core dumps and switch reboot if Switch are running impacted version of [CSCwd40071][68].
2765+
2766+
The invalid configuration occurs when mgmtRsInBStNode has "0.0.0.0" values ( with or without mask) for either the "addr" or "gw" fields.
2767+
2768+
Suggestion:
2769+
2770+
Contact Cisco TAC to remove any identified misconfigured objects before performing the upgrade to prevent policyelem crashes.
2771+
The [CSCwd40071][68] defect affects versions 5.2(5c) and later with a fix available in 6.0(1g). However, the issue will only be triggered during Apic upgrades crossing 6.0(4c) due to [CSCwh80837][67].
2772+
27562773
[0]: https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script
27572774
[1]: https://www.cisco.com/c/dam/en/us/td/docs/Website/datacenter/apicmatrix/index.html
27582775
[2]: https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-release-notes-list.html
@@ -2820,3 +2837,5 @@ To avoid this issue, change the target version to another version. Or verify tha
28202837
[64]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp64296
28212838
[65]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCws82819
28222839
[66]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwr66848
2840+
[67]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh80837
2841+
[68]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd40071

‎tests/checks/inband_management_policy_misconfig_check/mgmtRsInBStNode_invalid_addr_and_gw_config.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[
2+
{
3+
"mgmtRsInBStNode": {
4+
"attributes": {
5+
"tDn": "topology/pod-1/node-103",
6+
"addr": "0.0.0.0",
7+
"configurationMode": "static",
8+
"dn": "uni/tn-mgmt/mgmtp-default/inb-inb/rsinBStNode-[topology/pod-1/node-103]",
9+
"gw": "0.0.0.0",
10+
"modTs": "2024-12-20T07:45:21.454+00:00",
11+
"rType": "mo",
12+
"rn": "rsinBStNode-[topology/pod-1/node-103]",
13+
"stateQual": "none",
14+
"tType": "mo"
15+
}
16+
}
17+
}
18+
]

‎tests/checks/inband_management_policy_misconfig_check/mgmtRsInBStNode_invalid_address_config.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[
2+
{
3+
"mgmtRsInBStNode": {
4+
"attributes": {
5+
"tDn": "topology/pod-1/node-103",
6+
"addr": "0.0.0.0",
7+
"configurationMode": "static",
8+
"dn": "uni/tn-mgmt/mgmtp-default/inb-inb/rsinBStNode-[topology/pod-1/node-103]",
9+
"gw": "191.1.1.1",
10+
"modTs": "2024-12-20T07:45:21.454+00:00",
11+
"rType": "mo",
12+
"rn": "rsinBStNode-[topology/pod-1/node-103]",
13+
"stateQual": "none",
14+
"tType": "mo"
15+
}
16+
}
17+
}
18+
]

‎tests/checks/inband_management_policy_misconfig_check/mgmtRsInBStNode_invalid_gateway_config.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[
2+
{
3+
"mgmtRsInBStNode": {
4+
"attributes": {
5+
"tDn": "topology/pod-1/node-103",
6+
"addr": "191.1.1.153/24",
7+
"configurationMode": "static",
8+
"dn": "uni/tn-mgmt/mgmtp-default/inb-inb/rsinBStNode-[topology/pod-1/node-103]",
9+
"gw": "0.0.0.0",
10+
"modTs": "2024-12-20T07:45:21.454+00:00",
11+
"rType": "mo",
12+
"rn": "rsinBStNode-[topology/pod-1/node-103]",
13+
"stateQual": "none",
14+
"tType": "mo"
15+
}
16+
}
17+
}
18+
]

‎tests/checks/inband_management_policy_misconfig_check/mgmtRsInBStNode_valid_config.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
[]

‎tests/checks/inband_management_policy_misconfig_check/test_inband_management_policy_misconfig_check.py‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
import os
2+
import pytest
3+
import logging
4+
import importlib
5+
from helpers.utils import read_data
6+
7+
script = importlib.import_module("aci-preupgrade-validation-script")
8+
log = logging.getLogger(__name__)
9+
dir = os.path.dirname(os.path.abspath(__file__))
10+
test_function = "inband_management_policy_misconfig_check"
11+
mgmtRsInBStNode = 'mgmtRsInBStNode.json?query-target-filter=or(eq(mgmtRsInBStNode.addr,"0.0.0.0"),eq(mgmtRsInBStNode.gw,"0.0.0.0"))'
12+
13+
@pytest.mark.parametrize(
14+
"icurl_outputs, cversion, tversion, expected_result, expected_data",
15+
[
16+
# Current version is affected, Target version = 6.0(4c), valid data
17+
(
18+
{
19+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_valid_config.json")
20+
},
21+
"5.2(7g)",
22+
"6.0(4c)",
23+
script.PASS,
24+
[]
25+
),
26+
# Current version is affected, Target version = 6.0(4c), invalid address
27+
(
28+
{
29+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_address_config.json"),
30+
},
31+
"5.2(7f)",
32+
"6.0(4c)",
33+
script.FAIL_O,
34+
[
35+
["103", "0.0.0.0", "191.1.1.1"]
36+
]
37+
),
38+
# Current version is affected, Target version = 6.0(4c), invalid gateway
39+
(
40+
{
41+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_gateway_config.json"),
42+
},
43+
"5.2(7f)",
44+
"6.0(4c)",
45+
script.FAIL_O,
46+
[
47+
["103", "191.1.1.153/24", "0.0.0.0"],
48+
]
49+
),
50+
# Current version is affected, Target version = 6.0(4c), invalid both data
51+
(
52+
{
53+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
54+
},
55+
"5.2(7f)",
56+
"6.0(4c)",
57+
script.FAIL_O,
58+
[
59+
["103", "0.0.0.0", "0.0.0.0"],
60+
]
61+
),
62+
# Current version is affected, Target version > 6.0(4c), valid data
63+
(
64+
{
65+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_valid_config.json"),
66+
},
67+
"5.2(7f)",
68+
"6.0(8f)",
69+
script.PASS,
70+
[]
71+
),
72+
# Current version is affected, Target version > 6.0(4c), invalid address
73+
(
74+
{
75+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_address_config.json"),
76+
},
77+
"5.2(7f)",
78+
"6.0(5h)",
79+
script.FAIL_O,
80+
[
81+
["103", "0.0.0.0", "191.1.1.1"],
82+
]
83+
),
84+
# Current version is affected, Target version > 6.0(4c), invalid gateway
85+
(
86+
{
87+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_gateway_config.json"),
88+
},
89+
"5.2(7f)",
90+
"6.0(5j)",
91+
script.FAIL_O,
92+
[
93+
["103", "191.1.1.153/24", "0.0.0.0"],
94+
]
95+
),
96+
# Current version is affected, Target version > 6.0(4c), invalid both data
97+
(
98+
{
99+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
100+
},
101+
"5.2(7f)",
102+
"6.0(6c)",
103+
script.FAIL_O,
104+
[
105+
["103", "0.0.0.0", "0.0.0.0"],
106+
]
107+
),
108+
# Current version is affected, Target version < 6.0(4c), invalid both data
109+
(
110+
{
111+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
112+
},
113+
"5.2(7f)",
114+
"6.0(3g)",
115+
script.NA,
116+
[]
117+
),
118+
# Current version is affected, Target version < 6.0(4c), valid both data
119+
(
120+
{
121+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_valid_config.json"),
122+
},
123+
"5.2(7f)",
124+
"6.0(3g)",
125+
script.NA,
126+
[]
127+
),
128+
# Current version is not affected, Target version = 6.0(4c), invalid both data
129+
(
130+
{
131+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
132+
},
133+
"5.3(2f)",
134+
"6.0(4c)",
135+
script.NA,
136+
[]
137+
),
138+
# Current version is not affected, Target version > 6.0(4c), invalid both data
139+
(
140+
{
141+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
142+
},
143+
"5.3(2f)",
144+
"6.0(6c)",
145+
script.NA,
146+
[]
147+
),
148+
# Current version is not affected, Target version < 6.0(4c), invalid both data
149+
(
150+
{
151+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
152+
},
153+
"5.3(2f)",
154+
"6.0(3g)",
155+
script.NA,
156+
[]
157+
),
158+
],
159+
)
160+
def test_logic(run_check, mock_icurl, cversion, tversion, expected_result, expected_data):
161+
result = run_check(cversion=script.AciVersion(cversion), tversion=script.AciVersion(tversion))
162+
assert result.result == expected_result
163+
assert result.data == expected_data

0 commit comments

Comments
 (0)