sonic: Restrict SSH to the OOB management network

[berendt]

Closes #2329

What this does

Generates, per switch, a SONiC control-plane ACL (handled by caclmgrd) that permits SSH only from the device's OOB management subnet. Once a CTRLPLANE table binds the SSH service, caclmgrd installs an implicit default-drop for it, so front-panel / in-band interfaces with IPs in the default VRF can no longer reach TCP/22.

Walkthrough (commit order)

1. sonic: Take ownership of ACL_TABLE and ACL_RULE on regen — registers both tables in ON_DEMAND_OWNED_TABLE_KEYS (feeding OWNED_TABLE_KEYS), so base-config content is dropped up front and the tables are rebuilt from scratch on every regen. The on-demand registry was chosen over TOP_LEVEL_SCAFFOLD_KEYS so the tables are entirely absent when nothing emits them (no empty {} scaffold entries). Includes an orchestrator test pinning that stale ACL entries carried over from config_db.json do not survive a regen without an OOB IP. The existing exhaustive ownership test (test_generate_sonic_config_every_owned_table_drops_stale_entries) picks the new keys up automatically.

2. sonic: Restrict SSH to the OOB management network — adds _add_ssh_acl_configuration(config, device, oob_ip_result), called from generate_sonic_config in the management-interface block, only when an OOB IP exists. The permitted subnet is derived from the same get_device_oob_ip result used for MGMT_INTERFACE, normalised to the network address via IPv4Network(..., strict=False). Emits exactly the shape from the issue:

   • ACL_TABLE["SSH_ONLY"] — type: CTRLPLANE, services: ["SSH"]
   • ACL_RULE["SSH_ONLY|RULE_1"] — PRIORITY 9999, PACKET_ACTION ACCEPT, SRC_IP <oob_network>/<prefix>, IP_TYPE IP

   Tests: helper-level (table/rule shape, network normalisation incl. non-octet boundary, wholesale replacement of pre-existing entries) plus orchestrator glue (called with the full OOB result when present, not called and tables absent when not).

Notes for the reviewer

• Only the device's own OOB subnet is permitted — no metalbox/gateway or central admin networks (per the issue, this iteration).
• When no OOB IP is present, no ACL is emitted and SSH is not locked down (per the issue, to be revisited if needed).
• ACL_TABLE/ACL_RULE are not in the generated pydantic schema set (_generated/_schemas.py only models DASH_ACL_*), so the validator reports them as warnings, not errors. Adding the sonic-acl YANG model is deferred (relates to Cover Enterprise SONiC tables in the YANG model set #2258).
• SNMP/GNMI control-plane ACLs are Ensure that the SONiC SNMP/GNMI services are accessible only on the management network #2330; the helper and owned-table wiring added here are the shared mechanism it can build on.
• No CHANGELOG edit — this repo batches changelog entries in release PRs.

AI-assisted: Claude Code

[berendt]

Has to be revisited after merge of #2338.

[sourcery-ai]

Hey - I've left some high level feedback:

• In _add_ssh_acl_configuration you overwrite config["ACL_TABLE"] and config["ACL_RULE"] wholesale; consider using setdefault/update so additional ACL emitters (e.g. future SNMP/GNMI CTRLPLANE ACLs) can coexist without being clobbered.
• The orchestrator test test_generate_sonic_config_no_oob_ip_drops_stale_acl_tables asserts that ACL_TABLE/ACL_RULE are absent entirely; this may become too strict once other features legitimately emit ACLs without an OOB IP, so you might narrow the assertion to the SSH-only entries instead.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `_add_ssh_acl_configuration` you overwrite `config["ACL_TABLE"]` and `config["ACL_RULE"]` wholesale; consider using `setdefault`/`update` so additional ACL emitters (e.g. future SNMP/GNMI CTRLPLANE ACLs) can coexist without being clobbered.
- The orchestrator test `test_generate_sonic_config_no_oob_ip_drops_stale_acl_tables` asserts that `ACL_TABLE`/`ACL_RULE` are absent entirely; this may become too strict once other features legitimately emit ACLs without an OOB IP, so you might narrow the assertion to the SSH-only entries instead.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}