Skip authentication for UDS connections

[hdwhdw]

What I did

When --client_auth cert is configured, connections over Unix Domain Socket (UDS) fail authentication because ClientCertAuthenAndAuthor() requires TLS peer credentials that don't exist on Unix sockets.

This PR skips certificate authentication for all RPCs (gNMI and gNOI) when the connection arrives over a UDS. UDS access is already secured at the filesystem level via socket permissions (srw-rw---- root:root), making TLS auth redundant.

How I did it

Added a check at the top of authenticate() in server.go that detects UDS connections via peer.Addr.(*net.UnixAddr) and returns early, bypassing auth.

How to verify it

Unit tests:

=== RUN   TestAuthenticate
--- PASS: TestAuthenticate (0.00s)
=== RUN   TestAuthenticateUDS
--- PASS: TestAuthenticateUDS (0.00s)

On-device (vlab-01):

$ sudo grpcurl -plaintext unix:///var/run/gnmi/gnmi.sock gnoi.system.System/Time
{
  "time": "1773163799143468772"
}

Without sudo: permission denied at filesystem level (correct behavior — socket is 0660 root:root).

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

This PR adds an authentication bypass in the authenticate() function of the gNMI server, allowing gNOI RPCs made over Unix Domain Socket (UDS) connections to succeed even when the server is configured with certificate-only auth. The rationale is that UDS connections are already secured at the filesystem level via socket permissions (0750/0660), so requiring TLS peer credentials is redundant and would make UDS connections non-functional for gNOI services.

Changes:

• gnmi_server/server.go: Inserts a short-circuit at the top of authenticate() that returns immediately (with AuthEnabled = false) when target == "gnoi" and the connection is over a Unix socket.
• gnmi_server/server_test.go: Adds a CreateUDSCtx() helper and a TestAuthenticateGnoiUDS test covering gNOI read/write success over UDS and gNMI failure over UDS with cert-only auth.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
gnmi_server/server.go	Adds UDS auth bypass for target == "gnoi" in authenticate()
gnmi_server/server_test.go	Adds CreateUDSCtx helper and TestAuthenticateGnoiUDS unit test

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).