caclmgrd interface rules patch 1 #197
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
gupurush
force-pushed
the
caclmgrd-interface-rules-patch-1
branch
from
91e84f7 to
38f32c7
Compare
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
gupurush
force-pushed
the
caclmgrd-interface-rules-patch-1
branch
from
38f32c7 to
d131a47
Compare
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
@ZhaohuiS Could you help review? |
ZhaohuiS
reviewed
Feb 5, 2025
| if (dst_port not in self.ACL_SERVICES["NTP"]["dst_ports"] and | ||
| dst_port not in self.ACL_SERVICES["SNMP"]["dst_ports"] and | ||
| dst_port not in self.ACL_SERVICES["SSH"]["dst_ports"]): | ||
| rule_cmd = self.exclude_mgmt_port(rule_cmd) |
There was a problem hiding this comment.
For EXTERNAL_CLIENT, there is no DST_PORT setting for it, with your change, does it mean it will block restapi or gnmi traffic from eth0?
@qiluo-msft @prsunny could you please review this change? It will prohibit traffic from eth0 except NTP,SNMP and SSH.
"EXTERNAL_CLIENT": {
"ip_protocols": ["tcp"],
"multi_asic_ns_to_host_fwd":True
},
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Added management port exclusion (!, -i, eth0) for data plane protocols in iptable rules. Data plane protocols like BGP, BFD, and VXLAN are restricted to data interfaces only, while management protocols (NTP, SNMP, SSH) retain management port access. This enforces proper traffic segregation between management and data plane.
What is the motivation for this PR?
To enhance security by properly segregating management and data plane traffic through iptable rules in caclmgrd.
How did you do it?
Added exclude_mgmt_port rule (!, -i, eth0)
Applied exclusion to data plane protocols (BGP, BFD, VXLAN)
Preserved management port access for management services (NTP, SNMP, SSH)
Implemented conditional exclusion for other ACL rules based on service type