Add iptables rules to drop all bgp packets destined for loopback1 IP addresses in dual ToR by yyynini · Pull Request #262 · sonic-net/sonic-host-services

yyynini · 2025-05-27T06:26:30Z

Why I did it
issue: https://msazure.visualstudio.com/One/_workitems/edit/32910131/
Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1.
This PR addresses the requirement to block BGP packets on lookback1 for both active-active and active-standby dual tor scenarios.

How I did it

Added iptable rules to drop all bgp packets destined for loopback1 IP addresses.
use -I to ensure its priority over all the other ACCEPT rules.

How to verify it

The DROP rule is at the top of the chain:
Sent 1000 bgp pkts from PTF, verified that all were dropped:

…esses

mssonicbld · 2025-05-27T06:26:38Z

/azp run

azure-pipelines · 2025-05-27T06:26:47Z

Azure Pipelines successfully started running 1 pipeline(s).

ZhaohuiS · 2025-05-27T11:33:55Z

@yyynini can you please add the description for this PR?

scripts/caclmgrd

ZhaohuiS · 2025-05-28T04:46:50Z

@yyynini Please check if it needs to update the test case in test_cacl_application for dualtor

…v4 and ipv6 addresses

mssonicbld · 2025-05-28T07:27:10Z

/azp run

azure-pipelines · 2025-05-28T07:27:18Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2025-06-03T04:47:46Z

/azp run

azure-pipelines · 2025-06-03T04:47:54Z

Azure Pipelines successfully started running 1 pipeline(s).

scripts/caclmgrd

tests/caclmgrd/caclmgrd_bgp_loopback1_test.py

…esses

lolyu

LGTM

lolyu · 2025-06-04T01:54:28Z

/azp run

azure-pipelines · 2025-06-04T01:54:37Z

Azure Pipelines successfully started running 1 pipeline(s).

StormLiangMS · 2025-06-04T08:46:42Z

hi @yyynini could you help to update the description part as we do in sonic-buildimage repo?
for example, sonic-net/sonic-buildimage#22508.

StormLiangMS · 2025-06-04T08:48:55Z

scripts/caclmgrd

+                    if iface_name.startswith(loopback1_name):
+                        loopback1_intf = ipaddress.ip_interface(iface_cidr)
+                        loopback1_addr = loopback1_intf.ip
+                        # Add iptables rules to drop all packets destined for loopback1 IP addresses


minor one, in the comment part, not all packets, but the BGP packets.

thanks, updated!

tests/caclmgrd/test_bgp_loopback1_vectors.py

prsunny

lgtm, few clarification questions.

prsunny · 2025-06-04T16:09:07Z

scripts/caclmgrd


        return allow_internal_docker_ip_cmds

+    def generate_block_bgp_loopback1(self, namespace, config_db_connector):


Can you confirm it covers both active-standy and active-active dualtor scenarios?

Yes, the BGP block rule is applied for both DualToR scenarios.

prsunny · 2025-06-04T16:11:58Z

scripts/caclmgrd

+                        loopback1_addr = loopback1_intf.ip
+                        # Add iptables rules to drop all packets destined for loopback1 IP addresses
+                        if isinstance(loopback1_addr, ipaddress.IPv4Address):
+                            drop_dulator_bgp_loopback1_cmds.append(self.iptables_cmd_ns_prefix[namespace] +


-I is good. Lets ensure that there are no other ACCEPT rules above this.

Yes, the DROP rule is at the top (rule 1).

…addresses

mssonicbld · 2025-06-05T03:02:14Z

/azp run

azure-pipelines · 2025-06-05T03:02:22Z

Azure Pipelines successfully started running 1 pipeline(s).

lolyu · 2025-06-06T06:15:39Z

/azp run

azure-pipelines · 2025-06-06T06:15:47Z

Azure Pipelines successfully started running 1 pipeline(s).

prsunny · 2025-06-09T21:44:14Z

@yejianquan , please take to 202505

yejianquan · 2025-06-11T00:14:43Z

@yejianquan , please take to 202505

Hi @prsunny , feature-labels work is after PR got merged

StormLiangMS · 2025-06-11T00:29:20Z

hi @yejianquan merged.

… dualtor (#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule.

… dualtor (sonic-net#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule.

mssonicbld · 2025-06-11T04:41:02Z

Cherry-pick PR to 202505: #269

… dualtor (sonic-net#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule.

… dualtor (#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule.

… dualtor (sonic-net#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule.

… dualtor (sonic-net#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule. Signed-off-by: opcoder0 <[email protected]>

… dualtor (sonic-net#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule. Signed-off-by: Aharon Malkin <[email protected]>

… dualtor (sonic-net#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule. Signed-off-by: Guy Shemesh <[email protected]>

… dualtor (sonic-net#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule.

… dualtor (sonic-net#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule. Signed-off-by: Guy Shemesh <[email protected]>

… dualtor (sonic-net#18766) What is the motivation for this PR? This PR updates the DualToR config to enforce the same loopback1 IP address for both ToRs. Based on a recent Incident 628608070 : [SONiC RCA][SLB_DNC] Gemini Tors dropping vip traffic, we need to block BGP from being established on loopback1. How did you do it? Assign the same loopback1 IP to both ToRs. Added an iptables rules to drop the packets sonic-net/sonic-host-services#262 How did you verify/test it? Confirmed both ToRs used the same loopback1 IP, and verify the drop rule. Signed-off-by: Yael Tzur <[email protected]>

Add iptables rules to drop all packets destined for loopback1 IP addr…

14a9419

…esses

lolyu reviewed May 28, 2025

View reviewed changes

scripts/caclmgrd Outdated Show resolved Hide resolved

scripts/caclmgrd Outdated Show resolved Hide resolved

scripts/caclmgrd Outdated Show resolved Hide resolved

Add iptables rules to drop all packets destined for both loopback1 ip…

eeede25

…v4 and ipv6 addresses

yyynini changed the title ~~Add iptables rules to drop all packets destined for loopback1 IP addresses~~ Add iptables rules to drop all bgp packets destined for loopback1 IP addresses in dual ToR May 30, 2025

prioritise iptables rule to drop TCP traffic on loopback 1

01d1adc

yyynini mentioned this pull request Jun 3, 2025

[DualToR] enforce same loopback ip and drop bgp pkts on loopback1 for dualtor sonic-net/sonic-mgmt#18766

Merged

11 tasks

lolyu reviewed Jun 3, 2025

View reviewed changes

scripts/caclmgrd Outdated Show resolved Hide resolved

tests/caclmgrd/caclmgrd_bgp_loopback1_test.py Outdated Show resolved Hide resolved

Add iptables rules to drop all packets destined for loopback1 IP addr…

7af31d6

…esses

lolyu approved these changes Jun 4, 2025

View reviewed changes

lolyu requested review from ZhaohuiS and prsunny June 4, 2025 01:52

StormLiangMS closed this Jun 4, 2025

StormLiangMS reopened this Jun 4, 2025

StormLiangMS reviewed Jun 4, 2025

View reviewed changes

lolyu reviewed Jun 4, 2025

View reviewed changes

tests/caclmgrd/test_bgp_loopback1_vectors.py Outdated Show resolved Hide resolved

prsunny approved these changes Jun 4, 2025

View reviewed changes

prsunny added the Request for 202505 Branch label Jun 4, 2025

Add iptables rules to drop all bgp packets destined for loopback1 IP …

c06b1b2

…addresses

StormLiangMS merged commit 04e49f8 into sonic-net:master Jun 11, 2025
5 checks passed

mssonicbld mentioned this pull request Jun 11, 2025

[action] [PR:18766] [DualToR] enforce same loopback ip and drop bgp pkts on loopback1 for dualtor sonic-net/sonic-mgmt#18912

Merged

11 tasks

mssonicbld mentioned this pull request Jun 11, 2025

[action] [PR:18766] [DualToR] enforce same loopback ip and drop bgp pkts on loopback1 for dualtor sonic-net/sonic-mgmt#18913

Closed

11 tasks

yejianquan added the Approved for 202505 Branch label Jun 11, 2025

mssonicbld mentioned this pull request Jun 11, 2025

[action] [PR:262] Add iptables rules to drop all bgp packets destined for loopback1 IP addresses in dual ToR #269

Merged

mssonicbld added the Created PR to 202505 Branch label Jun 11, 2025

mssonicbld added Included in 202505 Branch and removed Created PR to 202505 Branch labels Jun 11, 2025


		return allow_internal_docker_ip_cmds

		def generate_block_bgp_loopback1(self, namespace, config_db_connector):

Conversation

yyynini commented May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mssonicbld commented May 27, 2025

Uh oh!

azure-pipelines bot commented May 27, 2025

Uh oh!

ZhaohuiS commented May 27, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ZhaohuiS commented May 28, 2025

Uh oh!

mssonicbld commented May 28, 2025

Uh oh!

azure-pipelines bot commented May 28, 2025

Uh oh!

mssonicbld commented Jun 3, 2025

Uh oh!

azure-pipelines bot commented Jun 3, 2025

Uh oh!

Uh oh!

Uh oh!

lolyu left a comment

Choose a reason for hiding this comment

Uh oh!

lolyu commented Jun 4, 2025

Uh oh!

azure-pipelines bot commented Jun 4, 2025

Uh oh!

StormLiangMS commented Jun 4, 2025

Uh oh!

StormLiangMS Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

yyynini Jun 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

prsunny left a comment

Choose a reason for hiding this comment

Uh oh!

prsunny Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

yyynini Jun 5, 2025

Choose a reason for hiding this comment

Uh oh!

prsunny Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

yyynini Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mssonicbld commented Jun 5, 2025

Uh oh!

azure-pipelines bot commented Jun 5, 2025

Uh oh!

lolyu commented Jun 6, 2025

Uh oh!

azure-pipelines bot commented Jun 6, 2025

Uh oh!

prsunny commented Jun 9, 2025

Uh oh!

yejianquan commented Jun 11, 2025

Uh oh!

Uh oh!

StormLiangMS commented Jun 11, 2025

Uh oh!

mssonicbld commented Jun 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

yyynini commented May 27, 2025 •

edited

Loading

yyynini Jun 5, 2025 •

edited

Loading