From 78384be75594fe3d670927c4a4899dd20c78a203 Mon Sep 17 00:00:00 2001 From: Xichen96 Date: Wed, 22 Jul 2026 16:12:34 +0000 Subject: [PATCH] [dhcp_server] Wait for caclmgrd-owned docker0 syslog rule on start/stop Step 3 of 3 of moving the dhcp_server docker0 syslog INPUT exception ownership to caclmgrd (fixes sonic-net/sonic-buildimage#27584). PR1 (#28328) removed the container-side add/del; PR2 (sonic-net/sonic-host-services#412) made caclmgrd own the rule. This replaces the removed add/del with feature-gated bounded waits that synchronize with caclmgrd: - preStartAction: when FEATURE|dhcp_server is enabled, wait up to 10s for the docker0 tcp/2514 ACCEPT rule to be present before the container starts, so the RELP client's first connection is not dropped by the control-plane catch-all DROP. - stop(): when FEATURE|dhcp_server is disabled, wait up to 10s for the rule to be removed. Plain restarts / shutdown / CONFIG_DB-down skip the wait (positive-state gate). The iptables -C existence check matches the canonical stored form of the rule caclmgrd installs (identical to `iptables -S INPUT` output), so the wait observes the rule reliably across iptables variants. Signed-off-by: Xichen96 --- files/build_templates/docker_image_ctl.j2 | 29 +++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/files/build_templates/docker_image_ctl.j2 b/files/build_templates/docker_image_ctl.j2 index bb18bea1343..4ca535544dc 100644 --- a/files/build_templates/docker_image_ctl.j2 +++ b/files/build_templates/docker_image_ctl.j2 @@ -131,6 +131,21 @@ function preStartAction() echo "Cannot fetch system eeprom information. Setting chassis serial number to N/A." $SONIC_DB_CLI STATE_DB HSET 'DEVICE_METADATA|localhost' chassis_serial_number "N/A" fi +{%- elif docker_container_name == "dhcp_server" %} + # dhcp_server runs in bridge mode; its rsyslog is sent over docker0 to + # host rsyslog via RELP (tcp/2514). caclmgrd owns the matching INPUT ACCEPT rule + # (gated on FEATURE|dhcp_server) and re-installs it on every control-plane ACL rebuild. + # When the feature is enabled, wait (bounded) for caclmgrd to install the rule before + # the container starts, so the RELP client's first connection is not dropped by the + # control-plane catch-all DROP. + if [ "$($SONIC_DB_CLI CONFIG_DB HGET 'FEATURE|dhcp_server' state 2>/dev/null)" = "enabled" ]; then + for i in $(seq 1 10); do + iptables -w 1 -C INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment "dhcp_server_syslog" -j ACCEPT 2>/dev/null && break + sleep 1 + done + iptables -w 1 -C INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment "dhcp_server_syslog" -j ACCEPT 2>/dev/null || \ + echo "Warning: caclmgrd-owned dhcp_server docker0 syslog ACCEPT rule still absent after the bounded wait; syslog to host may be dropped until caclmgrd installs it." + fi {%- else %} : # nothing {%- endif %} @@ -900,6 +915,20 @@ stop() { /usr/local/bin/container stop $DOCKERNAME {%- endif %} fi +{%- if docker_container_name == "dhcp_server" %} + # caclmgrd removes the docker0 syslog ACCEPT rule when FEATURE|dhcp_server is disabled. + # On an explicit feature disable, wait (bounded) for the rule to be removed so the + # control-plane ACL state is consistent before we return. Plain container restarts and + # shutdown (state not "disabled", or CONFIG_DB unreachable) skip the wait. + if [ "$($SONIC_DB_CLI CONFIG_DB HGET 'FEATURE|dhcp_server' state 2>/dev/null)" = "disabled" ]; then + for i in $(seq 1 10); do + iptables -w 1 -C INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment "dhcp_server_syslog" -j ACCEPT 2>/dev/null || break + sleep 1 + done + iptables -w 1 -C INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment "dhcp_server_syslog" -j ACCEPT 2>/dev/null && \ + echo "Warning: caclmgrd-owned dhcp_server docker0 syslog ACCEPT rule still present after the bounded wait despite dhcp_server feature disabled." + fi +{%- endif %} {%- endif %} }