Skip authentication for UDS connections by hdwhdw · Pull Request #617 · sonic-net/sonic-gnmi

hdwhdw · 2026-03-10T17:24:49Z

What I did

When --client_auth cert is configured, connections over Unix Domain Socket (UDS) fail authentication because ClientCertAuthenAndAuthor() requires TLS peer credentials that don't exist on Unix sockets.

This PR skips certificate authentication for all RPCs (gNMI and gNOI) when the connection arrives over a UDS. UDS access is already secured at the filesystem level via socket permissions (srw-rw---- root:root), making TLS auth redundant.

How I did it

Added a check at the top of authenticate() in server.go that detects UDS connections via peer.Addr.(*net.UnixAddr) and returns early, bypassing auth.

How to verify it

Unit tests:

=== RUN   TestAuthenticate
--- PASS: TestAuthenticate (0.00s)
=== RUN   TestAuthenticateUDS
--- PASS: TestAuthenticateUDS (0.00s)

On-device (vlab-01):

$ sudo grpcurl -plaintext unix:///var/run/gnmi/gnmi.sock gnoi.system.System/Time
{
  "time": "1773163799143468772"
}

Without sudo: permission denied at filesystem level (correct behavior — socket is 0660 root:root).

When the server is configured with cert-only auth, UDS connections fail because ClientCertAuthenAndAuthor requires TLS peer credentials that don't exist on Unix sockets. Add a check at the top of authenticate() to bypass auth for gNOI requests on UDS connections, since UDS security is enforced at the file-system level via socket permissions (0750/0660). The bypass is scoped to gNOI only -- gNMI RPCs on UDS continue to follow existing auth rules. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

mssonicbld · 2026-03-10T17:24:57Z

/azp run

azure-pipelines · 2026-03-10T17:25:09Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

This PR adds an authentication bypass in the authenticate() function of the gNMI server, allowing gNOI RPCs made over Unix Domain Socket (UDS) connections to succeed even when the server is configured with certificate-only auth. The rationale is that UDS connections are already secured at the filesystem level via socket permissions (0750/0660), so requiring TLS peer credentials is redundant and would make UDS connections non-functional for gNOI services.

Changes:

gnmi_server/server.go: Inserts a short-circuit at the top of authenticate() that returns immediately (with AuthEnabled = false) when target == "gnoi" and the connection is over a Unix socket.
gnmi_server/server_test.go: Adds a CreateUDSCtx() helper and a TestAuthenticateGnoiUDS test covering gNOI read/write success over UDS and gNMI failure over UDS with cert-only auth.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`gnmi_server/server.go`	Adds UDS auth bypass for `target == "gnoi"` in `authenticate()`
`gnmi_server/server_test.go`	Adds `CreateUDSCtx` helper and `TestAuthenticateGnoiUDS` unit test

gnmi_server/server_test.go

gnmi_server/server.go

Remove the gnoi-only restriction so that both gNMI and gNOI RPCs skip certificate auth when the caller connects via Unix domain socket. UDS access is already gated by filesystem permissions on the socket. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

mssonicbld · 2026-03-11T22:16:25Z

/azp run

azure-pipelines · 2026-03-11T22:16:35Z

Azure Pipelines successfully started running 1 pipeline(s).

Includes sonic-net/sonic-gnmi#617: skip certificate authentication for connections over Unix domain sockets. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

What is the motivation for this PR When --client_auth cert is configured on the gNMI server, UDS connections fail auth because TLS peer creds are unavailable, blocking local services (e.g., device-ops-agent) from using gNMI/gNOI over UDS. How did you do it Updated sonic-gnmi submodule to include sonic-net/sonic-gnmi#617, adding a UDS detection check in authenticate() to skip cert auth for UDS (secured by socket permissions). How did you verify/test it On a device with --client_auth cert configured: $ sudo grpcurl -plaintext unix:///var/run/gnmi/gnmi.sock gnoi.system.System/Time {time: 1773163799143468772} Without sudo: permission denied at filesystem level. Unique Signed-off-by Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

What is the motivation for this PR When --client_auth cert is configured on the gNMI server, UDS connections fail auth because TLS peer creds are unavailable, blocking local services (e.g., device-ops-agent) from using gNMI/gNOI over UDS. How did you do it Updated sonic-gnmi submodule to include sonic-net/sonic-gnmi#617, adding a UDS detection check in authenticate() to skip cert auth for UDS (secured by socket permissions). How did you verify/test it On a device with --client_auth cert configured: $ sudo grpcurl -plaintext unix:///var/run/gnmi/gnmi.sock gnoi.system.System/Time {time: 1773163799143468772} Without sudo: permission denied at filesystem level. Unique Signed-off-by Signed-off-by: Dawei Huang <daweihuang@microsoft.com> Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com>

* Add db alias Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> * Fix a typo Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> * Remove redis-sysmondb alias Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> * Take care review comments from Aseem and Selva Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> * Update sonic-gnmi submodule to include UDS auth bypass (#26155) What is the motivation for this PR When --client_auth cert is configured on the gNMI server, UDS connections fail auth because TLS peer creds are unavailable, blocking local services (e.g., device-ops-agent) from using gNMI/gNOI over UDS. How did you do it Updated sonic-gnmi submodule to include sonic-net/sonic-gnmi#617, adding a UDS detection check in authenticate() to skip cert auth for UDS (secured by socket permissions). How did you verify/test it On a device with --client_auth cert configured: $ sudo grpcurl -plaintext unix:///var/run/gnmi/gnmi.sock gnoi.system.System/Time {time: 1773163799143468772} Without sudo: permission denied at filesystem level. Unique Signed-off-by Signed-off-by: Dawei Huang <daweihuang@microsoft.com> Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> * Remove exit based on Aseem's comments Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> * Add DCO sign-off for previous commit Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> * Reorg codes based on Ashwin's comments Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> * Update pythonscript name Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> --------- Signed-off-by: Eddie Ruan <eddie.ruan@alibaba-inc.com> Signed-off-by: Dawei Huang <daweihuang@microsoft.com> Co-authored-by: Dawei Huang <daweihuang@microsoft.com>

Copilot AI review requested due to automatic review settings March 10, 2026 17:24

Copilot started reviewing on behalf of hdwhdw March 10, 2026 17:25 View session

Copilot AI reviewed Mar 10, 2026

View reviewed changes

gnmi_server/server_test.go Outdated Show resolved Hide resolved

gnmi_server/server.go Outdated Show resolved Hide resolved

hdwhdw requested review from saiarcot895, vaibhavhd and xincunli-sonic March 11, 2026 17:07

hdwhdw changed the title ~~Allow gNOI access for UDS connections without certificate auth~~ Skip authentication for UDS connections Mar 11, 2026

vaibhavhd approved these changes Mar 12, 2026

View reviewed changes

hdwhdw merged commit 4946885 into sonic-net:master Mar 12, 2026
9 checks passed

hdwhdw deleted the allow-gnoi-uds-auth-bypass branch March 12, 2026 21:59

hdwhdw mentioned this pull request Mar 12, 2026

Update sonic-gnmi submodule to include UDS auth bypass sonic-net/sonic-buildimage#26155

Merged

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Skip authentication for UDS connections#617

Skip authentication for UDS connections#617
hdwhdw merged 2 commits intosonic-net:masterfrom
hdwhdw:allow-gnoi-uds-auth-bypass

hdwhdw commented Mar 10, 2026 •

edited

Loading

Uh oh!

mssonicbld commented Mar 10, 2026

Uh oh!

azure-pipelines bot commented Mar 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Mar 11, 2026

Uh oh!

azure-pipelines bot commented Mar 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

hdwhdw commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What I did

How I did it

How to verify it

Uh oh!

mssonicbld commented Mar 10, 2026

Uh oh!

azure-pipelines bot commented Mar 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Mar 11, 2026

Uh oh!

azure-pipelines bot commented Mar 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hdwhdw commented Mar 10, 2026 •

edited

Loading