Skip to content

Update iptables to block BGP (TCP 179) traffic on eth0 #18834

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 4 commits into from
Jul 4, 2025
Merged

Update iptables to block BGP (TCP 179) traffic on eth0 #18834

merged 4 commits into from
Jul 4, 2025

Conversation

gupurush
Copy link
Contributor

@gupurush gupurush commented Jun 5, 2025

Description of PR

Summary: This PR updates the iptables and ip6tables rules to block incoming BGP (TCP port 179) traffic on the eth0 interface. This change ensures that BGP sessions are only allowed on non-management interfaces.
Fixes: N/A

Type of change

  • Bug fix
  • Testbed and Framework(new/improvement)
  • New Test case
    • Skipped for non-supported platforms
  • Test case improvement

Back port request

  • 202205
  • 202305
  • 202311
  • 202405
  • 202411
  • 202505

Approach

What is the motivation for this PR?

To support test updates in this PR: sonic-host-services#197.
Additionally, it ensures BGP port 179 is not exposed on the management interface (eth0).

How did you do it?

How did you verify/test it?

On t0-64 testbed

Any platform specific information?

None

Supported testbed topology if it's a new test case?

N/A

Documentation

No new documentation required.

@mssonicbld
Copy link
Collaborator

/azp run

@azure-pipelines Azure Pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@gupurush
Copy link
Contributor Author

gupurush commented Jun 5, 2025

@ZhaohuiS please help review

@gupurush gupurush mentioned this pull request Jun 5, 2025
Merged
@ZhaohuiS
Copy link
Contributor

ZhaohuiS commented Jun 6, 2025

@gupurush did you verify it on latest master image? could you provide the test evidence on master image?
But make sure your change is built in master image.
And if your case can pass on master image, please also enable test_cacl_application in PR test, I disabled it yeslerday. #18785

@mssonicbld
Copy link
Collaborator

/azp run

@azure-pipelines Azure Pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@linux-foundation-easycla Linux Foundation: EasyCLA
Copy link

linux-foundation-easycla bot commented Jun 11, 2025 •
edited
Loading

CLA Signed

The committers listed above are authorized under a signed CLA.

@mssonicbld
Copy link
Collaborator

/azp run

@azure-pipelines Azure Pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@gupurush gupurush force-pushed the gupurush/caclmgrd branch from c743560 to e8e5314 Compare June 11, 2025 22:48
@mssonicbld
Copy link
Collaborator

/azp run

@azure-pipelines Azure Pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@gupurush
Copy link
Contributor Author

Hi @ZhaohuiS,
I have verified this on the latest master image — test_cacl_application passes successfully.

Full test log: test_cacl_application.log
Summarized test log: test_cacl_application_logs_summarized.log

I have also updated the PR to re-enable test_cacl_application.

Thanks!

@gupurush
Copy link
Contributor Author

Hi @ZhaohuiS
The tests were executed on an image that does not include the latest update to the sonic-host-services submodule. Once #22160 is merged, these tests will pass as expected—this is also reflected in the test logs.

Kindly requesting your review when you get a chance.
Thanks!

ZhaohuiS
ZhaohuiS approved these changes Jul 2, 2025
View reviewed changes
Copy link
Contributor

@ZhaohuiS ZhaohuiS left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

@ZhaohuiS
Copy link
Contributor

ZhaohuiS commented Jul 2, 2025

@gupurush could you please use "/azpw run" to trigger another run?

@ZhaohuiS
Copy link
Contributor

ZhaohuiS commented Jul 2, 2025

It is also included in 202505, need to cherry pick this change into 202505 branch as well.
https://github.com/sonic-net/sonic-host-services/blame/202505/scripts/caclmgrd

@ZhaohuiS
Copy link
Contributor

ZhaohuiS commented Jul 2, 2025

will close it to retrigger the PR test.

@ZhaohuiS ZhaohuiS closed this Jul 2, 2025
@ZhaohuiS
Copy link
Contributor

ZhaohuiS commented Jul 2, 2025

open it to trigger PR test

@ZhaohuiS ZhaohuiS reopened this Jul 2, 2025
@mssonicbld
Copy link
Collaborator

/azp run

@azure-pipelines Azure Pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld
Copy link
Collaborator

/azp run

@azure-pipelines Azure Pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@gupurush gupurush mentioned this pull request Jul 2, 2025
Merged
11 tasks
@gupurush
Copy link
Contributor Author

gupurush commented Jul 2, 2025

It is also included in 202505, need to cherry pick this change into 202505 branch as well. https://github.com/sonic-net/sonic-host-services/blame/202505/scripts/caclmgrd

PR for 202505 - #19351

yejianquan pushed a commit that referenced this pull request Jul 4, 2025
@gupurush
Update iptables to block BGP (TCP 179) traffic on eth0 and add back t…
643d808 
…est_cacl_application for PR test (#19351)

Description of PR
Summary: Original PR: #18834
This PR updates the iptables and ip6tables rules to block incoming BGP (TCP port 179) traffic on the eth0 interface. This change ensures that BGP sessions are only allowed on non-management interfaces.
Fixes: N/A

Type of change
 Bug fix
 Testbed and Framework(new/improvement)
 New Test case
 Skipped for non-supported platforms
 Test case improvement
Back port request
 202205
 202305
 202311
 202405
 202411
 202505
Approach
What is the motivation for this PR?
To support test updates in this PR: sonic-host-services#197.
Additionally, it ensures BGP port 179 is not exposed on the management interface (eth0).

How did you do it?
How did you verify/test it?
On t0-64 testbed
@yejianquan yejianquan merged commit 77ff783 into sonic-net:master Jul 4, 2025
18 checks passed
@mssonicbld
Copy link
Collaborator

@gupurush PR conflicts with 202505 branch

@yejianquan
Copy link
Collaborator

included in 202505

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ZhaohuiS ZhaohuiS ZhaohuiS approved these changes

Assignees
No one assigned
Labels
Approved for 202505 branch Included in 202505 branch Request for 202505 branch
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@gupurush @mssonicbld @ZhaohuiS @yejianquan