From 91466ca842f1c822971f97dbaba9d79429c3f2de Mon Sep 17 00:00:00 2001 From: Rod Persky <770327+Rod-Persky@users.noreply.github.com> Date: Thu, 9 Jul 2026 13:29:06 +1000 Subject: [PATCH 1/3] Changes to support TACACS+ TraceID HLD Signed-off-by: Rod Persky <770327+Rod-Persky@users.noreply.github.com> --- data/templates/tacplus_nss.conf.j2 | 7 +++++++ scripts/hostcfgd | 9 +++++++-- .../TACACS_config_db_local_and_tacacs/tacplus_nss.conf | 5 +++++ .../TACACS_config_db_tacacs/tacplus_nss.conf | 5 +++++ tests/hostcfgd/test_tacacs_vectors.py | 6 ++++-- 5 files changed, 28 insertions(+), 4 deletions(-) diff --git a/data/templates/tacplus_nss.conf.j2 b/data/templates/tacplus_nss.conf.j2 index 812b47bf..1a12e83a 100644 --- a/data/templates/tacplus_nss.conf.j2 +++ b/data/templates/tacplus_nss.conf.j2 @@ -34,6 +34,13 @@ local_authorization {% if tacacs_authorization %} tacacs_authorization {% endif %} +{% if traceid_authorization %} + +# traceid_authorization - If you want to send SSH TraceId in TACACS+ authorization, set it +# Default: on +# traceid_authorization +traceid_authorization +{% endif %} # src_ip - set source address of TACACS+ protocol packets # Default: None (auto source ip address) diff --git a/scripts/hostcfgd b/scripts/hostcfgd index 9b67ba41..14259304 100644 --- a/scripts/hostcfgd +++ b/scripts/hostcfgd @@ -87,6 +87,7 @@ LIMITS_CONF = "/etc/security/limits.conf" TACPLUS_SERVER_PASSKEY_DEFAULT = "" TACPLUS_SERVER_TIMEOUT_DEFAULT = "5" TACPLUS_SERVER_AUTH_TYPE_DEFAULT = "pap" +TACPLUS_TRACEID_AUTHORIZATION_DEFAULT = True # RADIUS RADIUS_SERVER_AUTH_PORT_DEFAULT = "1812" @@ -366,7 +367,8 @@ class AaaCfg(object): self.tacplus_global_default = { 'auth_type': TACPLUS_SERVER_AUTH_TYPE_DEFAULT, 'timeout': TACPLUS_SERVER_TIMEOUT_DEFAULT, - 'passkey': TACPLUS_SERVER_PASSKEY_DEFAULT + 'passkey': TACPLUS_SERVER_PASSKEY_DEFAULT, + 'traceid_authorization': TACPLUS_TRACEID_AUTHORIZATION_DEFAULT } self.tacplus_global = {} self.tacplus_servers = {} @@ -467,6 +469,8 @@ class AaaCfg(object): def tacacs_global_update(self, key, data, modify_conf=True): if key == 'global': self.tacplus_global = data + if 'traceid_authorization' in self.tacplus_global: + self.tacplus_global['traceid_authorization'] = is_true(self.tacplus_global['traceid_authorization']) if modify_conf: self.modify_conf_file() @@ -808,7 +812,8 @@ class AaaCfg(object): local_accounting=local_accounting_conf, tacacs_accounting=tacacs_accounting_conf, local_authorization=local_authorization_conf, - tacacs_authorization=tacacs_authorization_conf) + tacacs_authorization=tacacs_authorization_conf, + traceid_authorization=tacplus_global['traceid_authorization']) with open(NSS_TACPLUS_CONF, 'w') as f: f.write(nss_tacplus_conf) diff --git a/tests/hostcfgd/sample_output/TACACS_config_db_local_and_tacacs/tacplus_nss.conf b/tests/hostcfgd/sample_output/TACACS_config_db_local_and_tacacs/tacplus_nss.conf index 431cbcec..2c6ab5ea 100644 --- a/tests/hostcfgd/sample_output/TACACS_config_db_local_and_tacacs/tacplus_nss.conf +++ b/tests/hostcfgd/sample_output/TACACS_config_db_local_and_tacacs/tacplus_nss.conf @@ -24,6 +24,11 @@ local_authorization # tacacs_authorization tacacs_authorization +# traceid_authorization - If you want to send SSH TraceId in TACACS+ authorization, set it +# Default: on +# traceid_authorization +traceid_authorization + # src_ip - set source address of TACACS+ protocol packets # Default: None (auto source ip address) # src_ip=2.2.2.2 diff --git a/tests/hostcfgd/sample_output/TACACS_config_db_tacacs/tacplus_nss.conf b/tests/hostcfgd/sample_output/TACACS_config_db_tacacs/tacplus_nss.conf index c9b8ab29..26a1e6f6 100644 --- a/tests/hostcfgd/sample_output/TACACS_config_db_tacacs/tacplus_nss.conf +++ b/tests/hostcfgd/sample_output/TACACS_config_db_tacacs/tacplus_nss.conf @@ -22,6 +22,11 @@ tacacs_accounting # tacacs_authorization tacacs_authorization +# traceid_authorization - If you want to send SSH TraceId in TACACS+ authorization, set it +# Default: on +# traceid_authorization +traceid_authorization + # src_ip - set source address of TACACS+ protocol packets # Default: None (auto source ip address) # src_ip=2.2.2.2 diff --git a/tests/hostcfgd/test_tacacs_vectors.py b/tests/hostcfgd/test_tacacs_vectors.py index a6938eb6..3fab97e1 100644 --- a/tests/hostcfgd/test_tacacs_vectors.py +++ b/tests/hostcfgd/test_tacacs_vectors.py @@ -47,7 +47,8 @@ "auth_type": "chap", "timeout": 5, "passkey": "dellsonic", - "src_intf": "Ethernet0" + "src_intf": "Ethernet0", + "traceid_authorization": "false" } }, "TACPLUS_SERVER": { @@ -109,7 +110,8 @@ "auth_type": "chap", "timeout": 5, "passkey": "dellsonic", - "src_intf": "Ethernet0" + "src_intf": "Ethernet0", + "traceid_authorization": "false" } }, "TACPLUS_SERVER": { From 272e85a4d04ba93f257159d27e71b3073ad14b02 Mon Sep 17 00:00:00 2001 From: Rod Persky <770327+Rod-Persky@users.noreply.github.com> Date: Tue, 14 Jul 2026 21:08:12 +1000 Subject: [PATCH 2/3] Fix issue in template file for testing --- data/templates/tacplus_nss.conf.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/tacplus_nss.conf.j2 b/data/templates/tacplus_nss.conf.j2 index 1a12e83a..909c1616 100644 --- a/data/templates/tacplus_nss.conf.j2 +++ b/data/templates/tacplus_nss.conf.j2 @@ -34,7 +34,7 @@ local_authorization {% if tacacs_authorization %} tacacs_authorization {% endif %} -{% if traceid_authorization %} +{% if tacacs_authorization and traceid_authorization %} # traceid_authorization - If you want to send SSH TraceId in TACACS+ authorization, set it # Default: on From 7cabfa68ee468b56fb0647317094a76aae40eb97 Mon Sep 17 00:00:00 2001 From: Rod Persky <770327+Rod-Persky@users.noreply.github.com> Date: Tue, 14 Jul 2026 21:29:20 +1000 Subject: [PATCH 3/3] continue to fix test failures Signed-off-by: Rod Persky <770327+Rod-Persky@users.noreply.github.com> --- tests/hostcfgd/hostcfgd_tacacs_test.py | 2 +- .../sample_output/TACACS_config_db_tacacs/tacplus_nss.conf | 5 ----- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/tests/hostcfgd/hostcfgd_tacacs_test.py b/tests/hostcfgd/hostcfgd_tacacs_test.py index c07b961c..fbafd746 100644 --- a/tests/hostcfgd/hostcfgd_tacacs_test.py +++ b/tests/hostcfgd/hostcfgd_tacacs_test.py @@ -38,7 +38,7 @@ class TestHostcfgdTACACS(TestCase): Test hostcfd daemon - TACACS """ def run_diff(self, file1, file2): - _, output = getstatusoutput_noshell(['diff', '-uR', file1, file2]) + _, output = getstatusoutput_noshell(['diff', '-ur', file1, file2]) return output """ diff --git a/tests/hostcfgd/sample_output/TACACS_config_db_tacacs/tacplus_nss.conf b/tests/hostcfgd/sample_output/TACACS_config_db_tacacs/tacplus_nss.conf index 26a1e6f6..c9b8ab29 100644 --- a/tests/hostcfgd/sample_output/TACACS_config_db_tacacs/tacplus_nss.conf +++ b/tests/hostcfgd/sample_output/TACACS_config_db_tacacs/tacplus_nss.conf @@ -22,11 +22,6 @@ tacacs_accounting # tacacs_authorization tacacs_authorization -# traceid_authorization - If you want to send SSH TraceId in TACACS+ authorization, set it -# Default: on -# traceid_authorization -traceid_authorization - # src_ip - set source address of TACACS+ protocol packets # Default: None (auto source ip address) # src_ip=2.2.2.2