Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added acl rules for srl 24.3+ #1968

Merged
merged 3 commits into from
Apr 4, 2024
Merged

Added acl rules for srl 24.3+ #1968

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cdd0f89
added acl rules for srl 24.3+
hellt Apr 2, 2024
aa0f7ac
remove unused receiver
hellt Apr 2, 2024
fecbbf8
added a json-rpc test over http
hellt Apr 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions docs/manual/kinds/srl.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -425,6 +425,15 @@ A:srl# info system dns

If you wish to turn off the automatic DNS provisioning, set the `servers` list to an empty value in the [node configuration](../nodes.md#dns).

### ACL configuration

Starting with SR Linux 24.3.1 release, containerlab adds CPM filter rules to the default factory configuration to allow the following traffic:

* HTTP access over port 80 for v4 and v6
* Telnet access over port 23 for v4 and v6

These protocols were removed from the default factory configuration in SR Linux 24.3.1 as a security hardening measure, but they are valuable for lab environments, hence containerlab adds them back.

## Host Requirements

SR Linux is a containerized NOS, therefore it depends on the host's kernel and CPU. It is recommended to run a kernel v4 and newer, though it might also run on the older kernels.
Expand Down
2 changes: 2 additions & 0 deletions nodes/srl/srl.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -528,6 +528,8 @@ type srlTemplateData struct {
SNMPConfig string
// GRPCConfig is a string containing GRPC configuration
GRPCConfig string
// ACLConfig is a string containing ACL configuration
ACLConfig string
}

// tplIFace template interface struct.
Expand Down
2 changes: 2 additions & 0 deletions nodes/srl/srl_default_config.go.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
{{ .ACLConfig }}

set / system tls server-profile clab-profile
set / system tls server-profile clab-profile key "{{ .TLSKey }}"
set / system tls server-profile clab-profile certificate "{{ .TLSCert }}"
Expand Down
41 changes: 40 additions & 1 deletion nodes/srl/version.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,39 @@ set / system grpc-server clab network-instance mgmt
set / system grpc-server clab trace-options [ request response common ]
set / system grpc-server clab unix-socket admin-state enable
set / system grpc-server clab admin-state enable`

// aclConfig contains the ACL configuration for srlinux versions >= 24.3 to enable
// non secure telnet and http access to the router which are useful for labs.
aclConfig = `set / acl acl-filter cpm type ipv4 entry 88 description "Containerlab-added rule: Accept incoming Telnet when the other host initiates the TCP connection"
set / acl acl-filter cpm type ipv4 entry 88 match ipv4 protocol tcp
set / acl acl-filter cpm type ipv4 entry 88 match transport source-port operator eq
set / acl acl-filter cpm type ipv4 entry 88 match transport source-port value 23
set / acl acl-filter cpm type ipv4 entry 88 action accept
set / acl acl-filter cpm type ipv4 entry 98 description "Containerlab-added rule: Accept incoming Telnet when this router initiates the TCP connection"
set / acl acl-filter cpm type ipv4 entry 98 match ipv4 protocol tcp
set / acl acl-filter cpm type ipv4 entry 98 match transport destination-port operator eq
set / acl acl-filter cpm type ipv4 entry 98 match transport destination-port value 23
set / acl acl-filter cpm type ipv4 entry 98 action accept
set / acl acl-filter cpm type ipv4 entry 158 description "Containerlab-added rule: Accept incoming HTTP(JSON-RPC) when the other host initiates the TCP connection"
set / acl acl-filter cpm type ipv4 entry 158 match ipv4 protocol tcp
set / acl acl-filter cpm type ipv4 entry 158 match transport destination-port operator eq
set / acl acl-filter cpm type ipv4 entry 158 match transport destination-port value 80
set / acl acl-filter cpm type ipv4 entry 158 action accept
set / acl acl-filter cpm type ipv6 entry 128 description "Containerlab-added rule: Accept incoming Telnet when the other host initiates the TCP connection"
set / acl acl-filter cpm type ipv6 entry 128 match ipv6 next-header tcp
set / acl acl-filter cpm type ipv6 entry 128 match transport source-port operator eq
set / acl acl-filter cpm type ipv6 entry 128 match transport source-port value 23
set / acl acl-filter cpm type ipv6 entry 128 action accept
set / acl acl-filter cpm type ipv6 entry 138 description "Containerlab-added rule: Accept incoming Telnet when this router initiates the TCP connection"
set / acl acl-filter cpm type ipv6 entry 138 match ipv6 next-header tcp
set / acl acl-filter cpm type ipv6 entry 138 match transport destination-port operator eq
set / acl acl-filter cpm type ipv6 entry 138 match transport destination-port value 23
set / acl acl-filter cpm type ipv6 entry 138 action accept
set / acl acl-filter cpm type ipv6 entry 188 description "Containerlab-added rule: Accept incoming HTTP(JSON-RPC) when the other host initiates the TCP connection"
set / acl acl-filter cpm type ipv6 entry 188 match ipv6 next-header tcp
set / acl acl-filter cpm type ipv6 entry 188 match transport destination-port operator eq
set / acl acl-filter cpm type ipv6 entry 188 match transport destination-port value 80
set / acl acl-filter cpm type ipv6 entry 188 action accept`
)

// SrlVersion represents an sr linux version as a set of fields.
Expand Down Expand Up @@ -57,7 +90,7 @@ func (n *srl) RunningVersion(ctx context.Context) (*SrlVersion, error) {
return n.parseVersionString(execResult.GetStdOutString()), nil
}

func (n *srl) parseVersionString(s string) *SrlVersion {
func (*srl) parseVersionString(s string) *SrlVersion {
re, _ := regexp.Compile(`v(\d{1,3})\.(\d{1,2})\.(\d{1,3})\-(\d{1,4})\-(\S+)`)

v := re.FindStringSubmatch(s)
Expand Down Expand Up @@ -93,6 +126,12 @@ func (n *srl) setVersionSpecificParams(tplData *srlTemplateData) {
tplData.SSHPubKeys = catenateKeys(n.sshPubKeys)
}

// in srlinux >= v24.3+ we add ACL rules to enable http and telnet access
// that are useful for labs and were removed as a security hardening measure.
if len(n.sshPubKeys) > 0 && (semver.Compare(v, "v24.3") >= 0 || n.swVersion.major == "0") {
tplData.ACLConfig = aclConfig
}

// in srlinux v23.10.x we need to enable GNMI unix socket services to enable
// communications over unix socket (e.g. NDK agents)
if semver.Compare(v, "v23.10") == 0 {
Expand Down
7 changes: 7 additions & 0 deletions tests/02-basic-srl/01-two-srls.robot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,13 @@ Ensure srl1 can ping srl2 over ethernet-1/1 interface
Should Be Equal As Integers ${rc} 0
Should Contain ${output} 0% packet loss

Verify JSON-RPC works over HTTP
${rc} ${output} = Run And Return Rc And Output
... curl 'http://admin:NokiaSrl1!@clab-${lab-name}-srl1/jsonrpc' -d '{"jsonrpc":"2.0","id":0,"method":"get","params":{"commands":[{"path":"/system/information/version","datastore":"state"}]}}'
Log ${output}
Should Be Equal As Integers ${rc} 0
Should Not Contain ${output} error

Verify TLS works with JSON-RPC with skipping certificate check
${rc} ${output} = Run And Return Rc And Output
... curl -k 'https://admin:NokiaSrl1!@clab-${lab-name}-srl1/jsonrpc' -d '{"jsonrpc":"2.0","id":0,"method":"get","params":{"commands":[{"path":"/system/information/version","datastore":"state"}]}}'
Expand Down
Loading