Skip to content

Commit

Permalink
[tacacs] Skip ipintutil check on older OS versions (sonic-net#3154)
Browse files Browse the repository at this point in the history
Signed-off-by: Danny Allen <daall@microsoft.com>
  • Loading branch information
daall authored and vmittal-msft committed Sep 28, 2021
1 parent f4eda89 commit 124ef4a
Showing 1 changed file with 16 additions and 6 deletions.
22 changes: 16 additions & 6 deletions tests/tacacs/test_ro_user.py
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,11 @@ def ssh_remote_allow_run(localhost, remote_ip, username, password, cmd):
res = ssh_remote_run(localhost, remote_ip, username, password, cmd)
# Verify that the command is allowed
logger.info("check command \"{}\" rc={}".format(cmd, res['rc']))
return res['rc'] == 0 or (res['rc'] != 0 and "Make sure your account has RW permission to current device" not in res['stderr'])
expected = res['rc'] == 0 or (res['rc'] != 0 and "Make sure your account has RW permission to current device" not in res['stderr'])
if not expected:
logger.error("error output=\"{}\"".format(res["stderr"]))
return expected


def ssh_remote_ban_run(localhost, remote_ip, username, password, cmd):
res = ssh_remote_run(localhost, remote_ip, username, password, cmd)
Expand Down Expand Up @@ -74,26 +78,32 @@ def test_ro_user_allowed_command(localhost, duthosts, rand_one_dut_hostname, cre
'"sudo vtysh -c \'show ip bgp su\'"',
'"sudo vtysh -n 0 -c \'show ip bgp su\'"',
'sudo decode-syseeprom',
'sudo generate_dump',
'sudo generate_dump -s "5 secs ago"',
'sudo lldpshow',
'sudo pcieutil check',
# 'sudo psuutil *',
# 'sudo sfputil show *',
'sudo ip netns identify 1',
]

# Some newer commands may not be available in 201911 or 202012
if not any(version in duthost.os_version for version in ("201911", "202012")):
commands_direct += [
'sudo ipintutil',
'sudo ipintutil -a ipv6',
'sudo ipintutil -n asic0 -d all',
'sudo ipintutil -n asic0 -d all -a ipv6'
]
# Run as readonly use the commands allowed indirectly based on sudoers file
'sudo ipintutil -n asic0 -d all -a ipv6',
]

# Run as readonly use the commands allowed indirectly based on sudoers file
commands_indirect = [
'show version',
'show interface status',
'show interface portchannel',
'show ip bgp summary',
'show ip interface',
'show ipv6 interface',
'show lldp table'
'show lldp table',
]

for command in commands_direct + commands_indirect:
Expand Down

0 comments on commit 124ef4a

Please sign in to comment.