sonic: enforce per-key ownership of ACL tables

[ideaship]

Problem

ACL_TABLE and ACL_RULE are owned by more than one control-plane section helper (SSH, SNMP, gNMI). The ownership model settled in the generate_sonic_config docstring covers whole-table ownership but not how several helpers share one owned table. The open ACL PRs each rebind the whole table — config["ACL_TABLE"] = {...} — so whichever helper runs second drops the first's entries, leaving SSH or SNMP/gNMI unrestricted. Each PR passes its own tests because neither calls the other helper, so the collision is invisible when the PRs are reviewed in isolation.

Change

Co-owned tables must be merged per named entry, never rebound. The rule is locked in code rather than left to review, so a divergent PR fails CI before it can merge:

• MULTI_OWNER_OWNED_TABLE_KEYS lists ACL_TABLE/ACL_RULE.
• A static guard (TestMultiOwnerTableGuard) parses the generator source and fails on every form that rebinds a listed table wholesale on config: config["X"] = <expr>, config.update({"X": ...}), config |= {"X": ...}, and config = {**config, "X": ...}. These mirror the wholesale-write forms the existing mutation backstop recognizes, so no analyzable write can rebind a listed table without being caught.
• In-place forms that mutate the table dict are left alone: config["X"]["k"] = ..., config["X"].update(...), config["X"] |= ..., and config.setdefault("X", {}). Synthetic-source detector tests prove the guard catches each rebind form and passes the in-place forms, so it cannot pass vacuously.

The tables are listed ahead of the helpers that introduce them, so the first ACL helper to land is forced onto the per-key pattern rather than establishing the unsafe one. Two invariants tie the list to the rest of the model: a referenced multi-owner table must also be in OWNED_TABLE_KEYS (so the central up-front drop clears it and no stale entry survives the merge), and multi-owner tables must not be inherited or image-consumed (those regimes are not dropped). Both hold now and after the ACL helpers add ACL_TABLE/ACL_RULE to ON_DEMAND_OWNED_TABLE_KEYS.

Note for the ACL PRs

This guard is dormant until a helper references the tables. When the control-plane ACL work lands, each helper must merge its own keys and the PR must add ACL_TABLE/ACL_RULE to ON_DEMAND_OWNED_TABLE_KEYS in the same change (the test_referenced_multi_owner_tables_are_owned invariant enforces this).

Related

• SONiC config_db.json ownership model: open decisions + a hidden PR collision #2340
• sonic: Enforce config table ownership statically #2339
• sonic: Restrict SSH to the OOB management network #2337
• Restrict SONiC SNMP and gNMI access to the OOB management network #2338

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}