Skip to content

Commit ca1602e

Browse files
sanjanchsanjanch
committed
Added validation for CSCwd40071
1 parent 128ab55 commit ca1602e

6 files changed

Lines changed: 227 additions & 0 deletions

‎aci-preupgrade-validation-script.py‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6026,6 +6026,35 @@ def apic_downgrade_compat_warning_check(cversion, tversion, **kwargs):
60266026
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
60276027

60286028

6029+
@check_wrapper(check_title="Inband Management Policy Misconfiguration")
6030+
def inband_management_policy_misconfig_check(cversion, tversion, **kwargs):
6031+
6032+
result = PASS
6033+
headers = ["Node_ID", "Address", "Gateway"]
6034+
data = []
6035+
recommended_action = " Contact Cisco TAC to remove any identified misconfigured 'mgmtRsInBStNode' objects"
6036+
doc_url = "https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#inband-management-policy-misconfiguration"
6037+
6038+
if not tversion:
6039+
return Result(result=MANUAL, msg=TVER_MISSING)
6040+
if cversion.older_than("6.0(4c)") and (tversion.newer_than("6.0(4c)") or tversion.same_as("6.0(4c)")):
6041+
mgmtRsInBStNodes = icurl('class', 'mgmtRsInBStNode.json?query-target-filter=or(eq(mgmtRsInBStNode.addr,"0.0.0.0"),eq(mgmtRsInBStNode.addr,"0.0.0.0/0"),eq(mgmtRsInBStNode.gw,"0.0.0.0"))')
6042+
for mgmtRsInBStNode in mgmtRsInBStNodes:
6043+
attrs = mgmtRsInBStNode["mgmtRsInBStNode"]["attributes"]
6044+
addr = attrs['addr']
6045+
gw = attrs['gw']
6046+
node_match = re.search(node_regex, attrs['dn'])
6047+
node_id = node_match.group("node")
6048+
data.append([node_id, addr, gw])
6049+
else:
6050+
return Result(result=NA, msg=VER_NOT_AFFECTED)
6051+
6052+
if data:
6053+
result = FAIL_O
6054+
6055+
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
6056+
6057+
60296058
# ---- Script Execution ----
60306059

60316060

@@ -6188,6 +6217,7 @@ class CheckManager:
61886217
standby_sup_sync_check,
61896218
isis_database_byte_check,
61906219
configpush_shard_check,
6220+
inband_management_policy_misconfig_check,
61916221

61926222
]
61936223
ssh_checks = [

‎docs/docs/validations.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,7 @@ Items | Defect | This Script
193193
[Stale pconsRA Object][d26] | CSCwp22212 | :warning:{title="Deprecated"} | :no_entry_sign:
194194
[ISIS DTEPs Byte Size][d27] | CSCwp15375 | :white_check_mark: | :no_entry_sign:
195195
[Policydist configpushShardCont Crash][d28] | CSCwp95515 | :white_check_mark: |
196+
[Inband Management Policy Misconfiguration][d29]| CSCwd40071 | :white_check_mark: | :no_entry_sign:
196197

197198
[d1]: #ep-announce-compatibility
198199
[d2]: #eventmgr-db-size-defect-susceptibility
@@ -222,6 +223,7 @@ Items | Defect | This Script
222223
[d26]: #stale-pconsra-object
223224
[d27]: #isis-dteps-byte-size
224225
[d28]: #policydist-configpushshardcont-crash
226+
[d29]: #inband-management-policy-misconfiguration
225227

226228

227229
## General Check Details
@@ -2648,6 +2650,26 @@ Due to [CSCwp95515][59], upgrading to an affected version while having any `conf
26482650
If any instances of `configpushShardCont` are flagged by this script, Cisco TAC must be contacted to identify and resolve the underlying issue before performing the upgrade.
26492651

26502652

2653+
### Inband Management Policy Misconfiguration
2654+
2655+
RCA:
2656+
2657+
Due to the defect [CSCwh80837][62], starting from version 6.0(4c), an implicit deletion of `fvRsCustQosPol` was introduced under InBand EPG as QoS configuration is not applicable to management inband EPG and it was raising an invalid fault under it. This implicit deletion triggers a re-processing and pushes updates to `fvInBEpP` (Inband Endpoint Profile) on leaf nodes where the inband management policy is deployed.
2658+
2659+
Impact:
2660+
2661+
When upgrading from versions prior to 6.0(4c) to versions 6.0(4c) or later, if there is a misconfiguration in the inband management policies (`mgmtRsInBStNode`) with invalid values, the re-processing triggered by [CSCwh80837][62] will expose the underlying [CSCwd40071][63] defect. This results in continuous policyelem core dumps when attempting to add any access policies configuration to a leaf switch (such as VLANs tied to leaf profiles via physical domain, AAEP, interface policy group, or port selector).
2662+
2663+
The invalid configuration occurs when `mgmtRsInBStNode` has "0.0.0.0" values (with no mask) for either the "addr" or "gw" fields.
2664+
2665+
Suggestion:
2666+
2667+
This check identifies misconfigured `mgmtRsInBStNode` objects where either "addr" or "gw" attributes are set to "0.0.0.0" when the upgrade crosses the 6.0(4c) release boundary. Contact Cisco TAC to remove any identified misconfigured objects before performing the upgrade to prevent policyelem crashes.
2668+
2669+
!!! note
2670+
The [CSCwd40071][63] defect affects versions 5.2(5c) and later, with a fix available in 6.0(1g). However, the issue will only be triggered during upgrades crossing 6.0(4c) due to [CSCwh80837][62].
2671+
2672+
26512673
[0]: https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script
26522674
[1]: https://www.cisco.com/c/dam/en/us/td/docs/Website/datacenter/apicmatrix/index.html
26532675
[2]: https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-release-notes-list.html
@@ -2710,3 +2732,5 @@ If any instances of `configpushShardCont` are flagged by this script, Cisco TAC
27102732
[59]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp95515
27112733
[60]: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html#Inter
27122734
[61]: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html#EnablePolicyCompression
2735+
[62]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh80837
2736+
[63]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd40071

‎tests/checks/inband_management_policy_misconfig_check/mgmtRsInBStNode_invalid_addr_and_gw_config.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[
2+
{
3+
"mgmtRsInBStNode": {
4+
"attributes": {
5+
"tDn": "topology/pod-1/node-103",
6+
"addr": "0.0.0.0",
7+
"configurationMode": "static",
8+
"dn": "uni/tn-mgmt/mgmtp-default/inb-inb/rsinBStNode-[topology/pod-1/node-103]",
9+
"gw": "0.0.0.0",
10+
"modTs": "2024-12-20T07:45:21.454+00:00",
11+
"rType": "mo",
12+
"rn": "rsinBStNode-[topology/pod-1/node-103]",
13+
"stateQual": "none",
14+
"tType": "mo"
15+
}
16+
}
17+
}
18+
]

‎tests/checks/inband_management_policy_misconfig_check/mgmtRsInBStNode_invalid_address_config.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[
2+
{
3+
"mgmtRsInBStNode": {
4+
"attributes": {
5+
"tDn": "topology/pod-1/node-103",
6+
"addr": "0.0.0.0",
7+
"configurationMode": "static",
8+
"dn": "uni/tn-mgmt/mgmtp-default/inb-inb/rsinBStNode-[topology/pod-1/node-103]",
9+
"gw": "191.1.1.1",
10+
"modTs": "2024-12-20T07:45:21.454+00:00",
11+
"rType": "mo",
12+
"rn": "rsinBStNode-[topology/pod-1/node-103]",
13+
"stateQual": "none",
14+
"tType": "mo"
15+
}
16+
}
17+
}
18+
]

‎tests/checks/inband_management_policy_misconfig_check/mgmtRsInBStNode_invalid_gateway_config.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[
2+
{
3+
"mgmtRsInBStNode": {
4+
"attributes": {
5+
"tDn": "topology/pod-1/node-103",
6+
"addr": "191.1.1.153/24",
7+
"configurationMode": "static",
8+
"dn": "uni/tn-mgmt/mgmtp-default/inb-inb/rsinBStNode-[topology/pod-1/node-103]",
9+
"gw": "0.0.0.0",
10+
"modTs": "2024-12-20T07:45:21.454+00:00",
11+
"rType": "mo",
12+
"rn": "rsinBStNode-[topology/pod-1/node-103]",
13+
"stateQual": "none",
14+
"tType": "mo"
15+
}
16+
}
17+
}
18+
]

‎tests/checks/inband_management_policy_misconfig_check/test_inband_management_policy_misconfig_check.py‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
import os
2+
import pytest
3+
import logging
4+
import importlib
5+
from helpers.utils import read_data
6+
7+
script = importlib.import_module("aci-preupgrade-validation-script")
8+
9+
log = logging.getLogger(__name__)
10+
dir = os.path.dirname(os.path.abspath(__file__))
11+
12+
test_function = "inband_management_policy_misconfig_check"
13+
14+
# icurl query
15+
mgmtRsInBStNode = 'mgmtRsInBStNode.json?query-target-filter=or(eq(mgmtRsInBStNode.addr,"0.0.0.0"),eq(mgmtRsInBStNode.addr,"0.0.0.0/0"),eq(mgmtRsInBStNode.gw,"0.0.0.0"))'
16+
17+
18+
@pytest.mark.parametrize(
19+
"icurl_outputs, cversion, tversion, expected_result",
20+
[
21+
# Target version missing
22+
(
23+
{
24+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
25+
},
26+
"5.2(5c)",
27+
None,
28+
script.MANUAL,
29+
),
30+
# Current version < 6.0(4c), target version = 6.0(4c), valid data
31+
(
32+
{
33+
mgmtRsInBStNode: [],
34+
},
35+
"6.0(3g)",
36+
"6.0(4c)",
37+
script.PASS,
38+
),
39+
# Current version < 6.0(4c), target version > 6.0(4c), valid data
40+
(
41+
{
42+
mgmtRsInBStNode: [],
43+
},
44+
"6.0(3e)",
45+
"6.0(8f)",
46+
script.PASS,
47+
),
48+
# Current version > 6.0(4c), target version >= 6.0(4c), invalid address
49+
(
50+
{
51+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_address_config.json"),
52+
},
53+
"6.0(4c)",
54+
"6.0(5h)",
55+
script.NA,
56+
),
57+
58+
# Current version > 6.0(4c), target version >= 6.0(4c), invalid gateway
59+
(
60+
{
61+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_gateway_config.json"),
62+
},
63+
"6.0(5h)",
64+
"6.0(5j)",
65+
script.NA,
66+
),
67+
# Current version > 6.0(4c), target version >= 6.0(4c), invalid both data
68+
(
69+
{
70+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
71+
},
72+
"6.0(5j)",
73+
"6.0(6c)",
74+
script.NA,
75+
),
76+
# Current version < 6.0(4c), target version < 6.0(4c), invalid both data
77+
(
78+
{
79+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
80+
},
81+
"6.0(3g)",
82+
"6.0(3f)",
83+
script.NA,
84+
),
85+
# Current version < 6.0(4c), target version >= 6.0(4c), invalid address
86+
(
87+
{
88+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_address_config.json"),
89+
},
90+
"6.0(3g)",
91+
"6.0(4c)",
92+
script.FAIL_O,
93+
),
94+
# Current version < 6.0(4c), target version >= 6.0(4c), invalid gateway
95+
(
96+
{
97+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_gateway_config.json"),
98+
},
99+
"5.3(2c)",
100+
"6.1(4h)",
101+
script.FAIL_O,
102+
),
103+
# Current version < 6.0(4c), target version >= 6.0(4c), invalid both data
104+
(
105+
{
106+
mgmtRsInBStNode: read_data(dir, "mgmtRsInBStNode_invalid_addr_and_gw_config.json"),
107+
},
108+
"5.2(8h)",
109+
"6.1(3f)",
110+
script.FAIL_O,
111+
),
112+
],
113+
)
114+
def test_logic(run_check, mock_icurl, cversion, tversion, expected_result):
115+
result = run_check(
116+
cversion = script.AciVersion(cversion),
117+
tversion = script.AciVersion(tversion) if tversion else None,
118+
)
119+
assert result.result == expected_result

0 commit comments

Comments
 (0)