Bug: test_cacl_application_nondualtor: expected-rule generator missing the caclmgrd-owned redfish_syslog docker0 tcp/2514 ACCEPT

Open Beginner friendly
#28,005 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
84/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
testing-qa

Research direction

Start in tests/cacl/test_cacl_application.py, especially generate_expected_rules and the existing dhcp_server handling. Run test_cacl_application_nondualtor with the redfish feature enabled and disabled to compare generated expectations with iptables. Done means the redfish_syslog tcp/2514 rule is expected only when redfish is enabled.

Written by the indexing model from the issue text.

Description

Bug :bug:
Is it platform specific

generic

Importance or Severity

Medium

Description of the bug

https://github.com/sonic-net/sonic-host-services/pull/429 made caclmgrd own a docker0 RELP (tcp/2514) INPUT ACCEPT exception for the redfish container's syslog forwarding, installed while the redfish FEATURE state is enabled. It is the companion of sonic-net/sonic-buildimage#29258, which points bridge-networked containers' rsyslog at the docker0 gateway.

tests/cacl/test_cacl_application.py verifies iptables by exhaustive comparison against a generated expectation. generate_expected_rules learned the dhcp_server instance of this rule in #26477 (feature-gated, tcp/2514) but not the redfish one, so on any device where the redfish feature is enabled at run time, test_cacl_application_nondualtor reports the caclmgrd-owned rule as unexpected and fails.

Steps to Reproduce
  1. Boot a master image built with INCLUDE_REDFISH=y whose sonic-host-services contains https://github.com/sonic-net/sonic-host-services/pull/429
  2. config feature state redfish enabled
  3. Run tests/cacl/test_cacl_application.py::test_cacl_application_nondualtor.
Actual Behavior and Expected Behavior

Actual: Failed: Unexpected iptables rules: {'-A INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment redfish_syslog -j ACCEPT'}

Expected: the redfish_syslog rule is part of the expected ruleset while the feature is enabled, mirroring the dhcp_server handling. Generating the expectation for both bridged features from the FEATURE state, the same condition caclmgrd keys on, keeps the test correct in both feature states.

Relevant log output
Output of show version
Attach files (if any)

No response

Dominant language
Python
Stars
276
Forks
1.1k
Avg merge
3d 19h
Merged PRs (30d)
231

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sonic-net/sonic-mgmt

All issues in sonic-net/sonic-mgmt

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.