Skip to content

feat: Change proxy shared secret support for TACACS+ proxy clients to be based on loopback or cli config not upstream #224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Rod-Persky merged 2 commits into from
Jul 9, 2026
Merged

feat: Change proxy shared secret support for TACACS+ proxy clients to be based on loopback or cli config not upstream #224

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
873fc36
feat: add proxy shared secret support for TACACS+ proxy clients
Jul 9, 2026
4745d26
Fix docs
Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 17 additions & 15 deletions docs/sonic-configdb-integration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,33 +51,35 @@ TACPLUS|global
src_intf "Management0" # default source interface

TACPLUS_SERVER|192.0.2.10
priority "1" # lower = preferred (failover order)
priority "64" # higher = preferred; range is 1..64
tcp_port "49"
timeout "10" # overrides TACPLUS|global.timeout
passkey "..." # overrides TACPLUS|global.passkey
```

Each `TACPLUS_SERVER` row becomes one `TacacsPlusServer` in the YANG
configuration. Per-server fields fall back to the matching `TACPLUS|global`
field when absent. The synthesized YANG `name` for each server is
`sonic-server-<index>-<address>`.
field when absent. SONiC `priority` values are in the range `1..64`; higher
numbers are preferred and therefore appear earlier in the daemon's failover
order. The synthesized YANG `name` for each server is
`sonic-server-<address>`.

### Forward-compatible extension keys

Operators and SONiC schema maintainers can experiment with TLS-aware fields
ahead of upstream ConfigDB schema work by adding the following keys to
`TACPLUS_SERVER|<addr>`:

| Key | YANG field | Notes |
|---------------------|---------------------|------------------------------------------------------------------------------------------------|
| `use_tls` | `server-authentication: {}` | Accepts the same boolean forms as `sni_enabled`; also supported on `TACPLUS|global` as a default |
| `domain_name` | `domain-name` | Used as SNI hostname |
| `sni_enabled` | `sni-enabled` | `true`/`false`/`yes`/`no`/`1`/`0` |
| `single_connection` | `single-connection` | Boolean |
| `vrf_name` | `vrf-instance` | VRF name for outbound traffic |
| `src_ip` | `source-ip` | Mutually exclusive with `src_intf` |
| `src_intf` | `source-interface` | Falls back to the global TACPLUS row |
| `server_type` | `server-type` | Defaults to `all`; tokens accept `authentication`, `authorization`, `accounting`, or `all` |
| Key | YANG field | Notes |
|---------------------|-------------------------------|----------------------------------------------------------------------------------------------------|
| `use_tls` | `server-authentication: {}` | Accepts the same boolean forms as `sni_enabled`; also supported on the global TACPLUS row |
| `domain_name` | `domain-name` | Used as SNI hostname |
| `sni_enabled` | `sni-enabled` | `true`/`false`/`yes`/`no`/`1`/`0` |
| `single_connection` | `single-connection` | Boolean |
| `vrf_name` | `vrf-instance` | VRF name for outbound traffic |
| `src_ip` | `source-ip` | Mutually exclusive with `src_intf` |
| `src_intf` | `source-interface` | Falls back to the global TACPLUS row |
| `server_type` | `server-type` | Defaults to `all`; tokens accept `authentication`, `authorization`, `accounting`, or `all` |

Unknown fields are logged at `warn` level and ignored, so legacy operator
annotations on TACPLUS rows do not break the agent.
Expand Down Expand Up @@ -202,7 +204,7 @@ done
redis-cli -n 4 HSET 'TACPLUS|global' \
timeout 5 passkey shared-secret auth_type pap src_intf Management0
redis-cli -n 4 HSET 'TACPLUS_SERVER|192.0.2.10' \
priority 1 tcp_port 49 timeout 10 passkey server-secret \
priority 64 tcp_port 49 timeout 10 passkey server-secret \
domain_name tacacs-a.example.test sni_enabled true single_connection true
```

Expand All @@ -220,7 +222,7 @@ the expected delta:

```bash
redis-cli -n 4 HSET 'TACPLUS_SERVER|192.0.2.20' \
priority 2 tcp_port 49 passkey backup-secret
priority 32 tcp_port 49 passkey backup-secret
redis-cli -n 4 HSET 'TACPLUS_SERVER|192.0.2.10' timeout 20
redis-cli -n 4 DEL 'TACPLUS_SERVER|192.0.2.20'
redis-cli -n 4 HSET 'TACPLUS|global' timeout 7
Expand Down
13 changes: 13 additions & 0 deletions executables/tacacsrs_agentd/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,19 @@ this, the daemon removes upstream entries whose address and port parse or resolv
to the local TCP proxy endpoint, including loopback IPv4, loopback IPv6, and
hostnames such as `localhost`.

If one or more local proxy endpoint rows are removed this way, the raw proxy
uses the highest-priority matching row's resolved shared secret for downstream
TACACS+ obfuscation. This includes secrets inherited from global configuration.
If that highest-priority local proxy row has no shared secret, local clients are
expected to send unobfuscated TACACS+ packets to the proxy even when lower-
priority local rows or real upstream servers have shared secrets.

Outside SONiC mode, use `--proxy-shared-secret` with `--proxy-endpoint` when
raw TACACS+ proxy clients send obfuscated packets to the proxy. If the flag is
omitted, local proxy clients are expected to send unobfuscated packets. A
filtered local proxy endpoint row takes precedence over this CLI fallback if
both are present.

## TLS Client Certificates and Keys

Use `--client-certificate` and `--client-key` with `--use-tls` when the upstream TACACS+ server requires the daemon to present a TLS client identity.
Expand Down
4 changes: 4 additions & 0 deletions executables/tacacsrs_agentd/src/cli.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,10 @@ pub(crate) struct Cli {
#[arg(long)]
pub(crate) proxy_endpoint: Option<String>,

/// Shared secret expected from raw TACACS+ proxy clients.
#[arg(long, value_name = "SECRET", requires = "proxy_endpoint", conflicts_with = "sonic")]
pub(crate) proxy_shared_secret: Option<String>,

/// Runtime service mode. Defaults to client-api, or both when --proxy-endpoint is set.
#[arg(long, value_enum)]
pub(crate) service_mode: Option<ServiceMode>,
Expand Down
Loading
Loading