ssh: add integration test for configurable listen_addresses by pkawatkar14 · Pull Request #27679 · sonic-net/sonic-mgmt

pkawatkar14 · 2026-09-02T18:41:11Z

Why I did it

Adds an integration test for Feature 29390131 (configurable OpenSSH ListenAddress support), validating the SSH_SERVER|POLICIES > listen_addresses runtime behavior implemented in sonic-net/sonic-host-services (see linked PR) end-to-end on a live DUT.

How I did it

tests/ssh/test_ssh_listen_addresses.py:

Restricted to t0/t0-* topologies since the test requires a VLAN with an assigned IPv4 gateway address; other topologies would only reach a skip.
Picks currently-assigned management/loopback addresses to keep, and an assigned VLAN gateway address to intentionally omit. Skips (rather than failing) when no VLAN gateway address is available.
Configures listen_addresses restricted to the kept addresses.
Confirms sshd binds (via ss -lntp) exactly to the configured addresses, via _sshd_bindings_match polled by wait_until at each call site.
Confirms SSH succeeds through every configured address.
Confirms SSH fails through the omitted VLAN address with a connection-refused-style error (NoValidConnectionsError/socket.timeout/OSError), scoped narrowly so an AuthenticationException regression is not silently swallowed.
Removes listen_addresses and confirms both IPv4/IPv6 wildcard listeners are restored, including reachability of the previously omitted address.
Restores original SSH_SERVER policies in a fixture teardown (even on failure), so the DUT is never left inaccessible. Teardown waits for the actual expected binding set (restored addresses or wildcard) to converge and logs a warning rather than raising if it times out, so teardown never masks a failure from the test body.

Review feedback addressed

Narrowed pytest.mark.topology('any') to topology('t0', 't0-*').
pytest.skip(...) (instead of pytest_assert) when no VLAN gateway address is available.
Renamed _wait_for_sshd_bindings to _sshd_bindings_match, removed its internal wait_until (it now returns a bool directly) so callers control polling instead of nesting two 30s waits.
Fixed a teardown logic bug where the wait short-circuited to True immediately whenever the original config had listen_addresses set, without ever confirming the restored bindings converged. This also resolved the CodeQL "return/break in finally" alert on the same block.
Narrowed with pytest.raises(Exception) to (paramiko.ssh_exception.NoValidConnectionsError, socket.timeout, OSError).

How to verify it

Run tests/ssh/test_ssh_listen_addresses.py against a t0-topology testbed.

Related PRs:

hostcfgd: support configurable SSH listen_addresses sonic-host-services#431 (runtime implementation)
sonic-net/sonic-buildimage (YANG model changes)

Add tests/ssh/test_ssh_listen_addresses.py to validate the new SSH_SERVER|POLICIES listen_addresses feature end-to-end on a live DUT: - Configure listen_addresses restricted to currently-assigned management/loopback addresses, omitting an assigned VLAN gateway address. - Confirm sshd binds (via ss) exactly to the configured addresses. - Confirm SSH succeeds through every configured address. - Confirm SSH fails through the intentionally omitted VLAN address, and that this is because sshd isn't listening there (not a routing/ACL issue). - Remove listen_addresses and confirm both IPv4/IPv6 wildcard listeners are restored, including on the previously omitted address. - Restore original SSH_SERVER policies in a fixture teardown, even on failure, so the DUT is never left inaccessible. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pooja Kawatkar <pkawatkar@microsoft.com>

linux-foundation-easycla · 2026-09-02T18:41:18Z

The committers listed above are authorized under a signed CLA.

✅ login: Copilot / name: Copilot (8c7324e)
✅ login: pkawatkar14 / name: Pooja Kawatkar (8c7324e)

azure-pipelines · 2026-09-02T18:41:20Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

mssonicbld · 2026-09-02T18:41:29Z

/azp run

azure-pipelines · 2026-09-02T18:41:47Z

Azure Pipelines: Successfully started running 1 pipeline(s).

mssonicbld · 2026-09-03T01:51:06Z

Hi, there are workflow run(s) waiting for approval, you may be first-time contributor. I will notify maintainers to help approve once PR is approved. Thanks!

_{---Powered by SONiC BuildBot}

pkawatkar14 · 2026-09-03T18:26:45Z

/azpw run Azure.sonic-buildimage

mssonicbld · 2026-09-03T18:26:48Z

⚠️ Notice: /azpw run only runs failed jobs now. If you want to trigger a whole pipline run, please rebase your branch or close and reopen the PR.
💡 Tip: You can also use /azpw retry to retry failed jobs directly.

Retrying failed(or canceled) jobs...

mssonicbld · 2026-09-03T18:26:51Z

Retrying failed(or canceled) stages in build 1209962:

✅Stage Test:

Job impacted-area-kvmtest-multi-asic-t1 by Elastictest: retried.
Job impacted-area-kvmtest-t2 by Elastictest: retried.
Job impacted-area-kvmtest-t1-lag by Elastictest: retried.
Job impacted-area-kvmtest-t0 by Elastictest: retried.

pkawatkar14 · 2026-09-03T19:33:57Z

/azpw run Azure.sonic-buildimage

mssonicbld · 2026-09-03T19:34:00Z

⚠️ Notice: /azpw run only runs failed jobs now. If you want to trigger a whole pipline run, please rebase your branch or close and reopen the PR.
💡 Tip: You can also use /azpw retry to retry failed jobs directly.

Retrying failed(or canceled) jobs...

mssonicbld · 2026-09-03T19:34:02Z

No failed(or canceled) jobs found in completed stages. Only failed(or canceled) jobs in completed stages can be retried.

Stages in progress: Test. Please wait for the stages to complete and then retry again.

Address PR review feedback: minimal VS topologies without VLAN interfaces should skip this test rather than fail it, since there is no address available to use as the intentionally-omitted target. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pooja Kawatkar <pkawatkar@microsoft.com>

mssonicbld · 2026-09-11T11:48:46Z

/azp run

azure-pipelines · 2026-09-11T11:49:04Z

Azure Pipelines: Successfully started running 1 pipeline(s).

pkawatkar14 · 2026-09-11T19:17:41Z

/azpw run Azure.sonic-mgmt

mssonicbld · 2026-09-11T19:17:44Z

⚠️ Notice: /azpw run only runs failed jobs now. If you want to trigger a whole pipline run, please rebase your branch or close and reopen the PR.
💡 Tip: You can also use /azpw retry to retry failed jobs directly.

Retrying failed(or canceled) jobs...

mssonicbld · 2026-09-11T19:17:46Z

Retrying failed(or canceled) stages in build 1217821:

✅Stage Test:

Job impacted-area-kvmtest-t0 by Elastictest: retried.

mssonicbld · 2026-09-15T15:48:50Z

/azp run

azure-pipelines · 2026-09-15T15:49:09Z

Azure Pipelines: Successfully started running 1 pipeline(s).

- Narrow topology marker to t0/t0-* since the test requires a VLAN gateway address; broader topologies just reach a skip. - Rename _wait_for_sshd_bindings to _sshd_bindings_match and drop its internal wait_until so callers control polling instead of doubling the wait at every call site. - Fix teardown short-circuit: wait for the actual expected binding set (restored addresses or wildcard) and log a warning instead of silently succeeding whenever original_listen_addresses was set; this also resolves the CodeQL 'return/break in finally' style concern since the finally block's result is no longer discarded silently. - Narrow pytest.raises(Exception) to the specific connection-refused failure modes (NoValidConnectionsError, socket.timeout, OSError) so an AuthenticationException regression is not silently swallowed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Pooja Kawatkar <pkawatkar@microsoft.com>

mssonicbld · 2026-09-15T15:55:44Z

/azp run

azure-pipelines · 2026-09-15T15:56:02Z

Azure Pipelines: Successfully started running 1 pipeline(s).

The kvmtest-t0 CI job was failing: sonic-mgmt's test runner only has network reachability to the DUT's management network, not to VLAN/ data-plane addresses. The test was opening a live SSH connection to the omitted VLAN gateway address both to confirm it's rejected (masked by catching connection errors for the wrong reason) and, after restoring wildcard listeners, to confirm it's reachable again - that second connection attempt always failed regardless of sshd's actual bind state, since the address was never routable from the test runner in the first place. Replaced both live connection attempts with ss-based bind-state checks on the DUT (already used elsewhere in the test), which verify sshd's listen state without requiring the test runner to route to the VLAN network. Signed-off-by: Pooja Kawatkar <pkawatkar@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

mssonicbld · 2026-09-18T15:55:10Z

/azp run

azure-pipelines · 2026-09-18T15:55:26Z

Azure Pipelines: Successfully started running 1 pipeline(s).

mssonicbld · 2026-09-18T15:57:04Z

/azp run

azure-pipelines · 2026-09-18T15:57:21Z

Azure Pipelines: Successfully started running 1 pipeline(s).

mssonicbld · 2026-09-21T15:40:41Z

/azp run

azure-pipelines · 2026-09-21T15:41:00Z

Azure Pipelines: Successfully started running 1 pipeline(s).

mssonicbld · 2026-09-21T15:43:47Z

/azp run

azure-pipelines · 2026-09-21T15:44:06Z

Azure Pipelines: Successfully started running 1 pipeline(s).

Signed-off-by: Pooja Kawatkar <pkawatkar@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The Loopback address(es) included in keep_addresses are not routable from the sonic-mgmt test runner in kvmtest topologies (same reachability constraint already documented for the omitted VLAN address), so attempting a live SSH connection to them fails for reasons unrelated to sshd's actual bind state, causing spurious test failures. Only the management address is now SSH-verified live; Loopback bind state is validated via ss, consistent with how the VLAN address is checked. Signed-off-by: Pooja Kawatkar <pkawatkar@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

mssonicbld · 2026-09-21T15:45:35Z

/azp run

azure-pipelines · 2026-09-21T15:45:53Z

Azure Pipelines: Successfully started running 1 pipeline(s).

github-actions Bot requested review from saiarcot895, xwjiang-ms and yutongzhang-microsoft September 2, 2026 18:41

pkawatkar14 mentioned this pull request Sep 2, 2026

sonic-yang-models: add optional listen_addresses to SSH_SERVER|POLICIES sonic-net/sonic-buildimage#29311

Open

qiluo-msft reviewed Sep 3, 2026

View reviewed changes

Comment thread tests/ssh/test_ssh_listen_addresses.py Outdated

github-advanced-security Bot found potential problems Sep 3, 2026

View reviewed changes

Comment thread tests/ssh/test_ssh_listen_addresses.py Fixed

qiluo-msft reviewed Sep 11, 2026

View reviewed changes

Comment thread tests/ssh/test_ssh_listen_addresses.py Outdated

qiluo-msft reviewed Sep 11, 2026

View reviewed changes

Comment thread tests/ssh/test_ssh_listen_addresses.py Outdated

qiluo-msft reviewed Sep 11, 2026

View reviewed changes

Comment thread tests/ssh/test_ssh_listen_addresses.py Outdated

qiluo-msft reviewed Sep 11, 2026

View reviewed changes

Comment thread tests/ssh/test_ssh_listen_addresses.py Outdated

pkawatkar14 force-pushed the dev_ado29390131_pk branch 2 times, most recently from 23c1c64 to 48e63d5 Compare September 15, 2026 15:55

qiluo-msft previously approved these changes Sep 15, 2026

View reviewed changes

pkawatkar14 dismissed qiluo-msft’s stale review via d75b0a4 September 18, 2026 15:54

pkawatkar14 force-pushed the dev_ado29390131_pk branch from b5f82f6 to 013f96b Compare September 21, 2026 15:43

pkawatkar14 and others added 2 commits September 21, 2026 15:45

ssh: dedup repeated bound-address computation into a helper

44226e7

Signed-off-by: Pooja Kawatkar <pkawatkar@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

pkawatkar14 force-pushed the dev_ado29390131_pk branch from 013f96b to 8411502 Compare September 21, 2026 15:45

Conversation

pkawatkar14 commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why I did it

How I did it

Review feedback addressed

How to verify it

Uh oh!

linux-foundation-easycla Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-pipelines Bot commented Sep 2, 2026

Uh oh!

mssonicbld commented Sep 2, 2026

Uh oh!

azure-pipelines Bot commented Sep 2, 2026

Uh oh!

mssonicbld commented Sep 3, 2026

Uh oh!

pkawatkar14 commented Sep 3, 2026

Uh oh!

mssonicbld commented Sep 3, 2026

Uh oh!

mssonicbld commented Sep 3, 2026

Uh oh!

pkawatkar14 commented Sep 3, 2026

Uh oh!

mssonicbld commented Sep 3, 2026

Uh oh!

mssonicbld commented Sep 3, 2026

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Sep 11, 2026

Uh oh!

azure-pipelines Bot commented Sep 11, 2026

Uh oh!

pkawatkar14 commented Sep 11, 2026

Uh oh!

mssonicbld commented Sep 11, 2026

Uh oh!

mssonicbld commented Sep 11, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Sep 15, 2026

Uh oh!

azure-pipelines Bot commented Sep 15, 2026

Uh oh!

mssonicbld commented Sep 15, 2026

Uh oh!

azure-pipelines Bot commented Sep 15, 2026

Uh oh!

mssonicbld commented Sep 18, 2026

Uh oh!

azure-pipelines Bot commented Sep 18, 2026

Uh oh!

mssonicbld commented Sep 18, 2026

Uh oh!

azure-pipelines Bot commented Sep 18, 2026

Uh oh!

mssonicbld commented Sep 21, 2026

Uh oh!

azure-pipelines Bot commented Sep 21, 2026

Uh oh!

mssonicbld commented Sep 21, 2026

Uh oh!

azure-pipelines Bot commented Sep 21, 2026

Uh oh!

mssonicbld commented Sep 21, 2026

Uh oh!

azure-pipelines Bot commented Sep 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

pkawatkar14 commented Sep 2, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Sep 2, 2026 •

edited

Loading