Ensure that the SONiC SNMP/GNMI services are accessible only on the management network

[berendt]

Problem

The generated SONiC ConfigDB does not restrict which networks can reach the
switch's SNMP and gNMI/telemetry services:

• SNMP (UDP/161): _add_snmp_configuration already binds the agent to the
  OOB IP in the management VRF (SNMP_AGENT_ADDRESS_CONFIG →
  <oob_ip>|161|mgmt, config_generator.py:2168), but that is only the listen
  address — there is no source-network restriction.
• gNMI / telemetry (TELEMETRY table, config_db.json:458): shipped as a
  static "gnmi": {} with no generator code and no binding, so the gNMI server
  listens on all interfaces by default.

Both services must be reachable only from the out-of-band management
network, consistent with #2329 (SSH).

Goal

Generate, per switch, SONiC control-plane ACLs that permit SNMP and
gNMI/telemetry only from the device's management/OOB network and implicitly
drop them from everywhere else.

Proposed approach

Use SONiC control-plane ACLs handled by caclmgrd: ACL_TABLE entries of
type: CTRLPLANE bound to the respective services, plus ACL_RULEs that
ACCEPT the management subnet. When a CTRLPLANE table binds a service, caclmgrd
installs an implicit default-drop for that service, so any source outside the
permitted rules can no longer reach it.

The management subnet is already available in the generator:
get_device_oob_ip(device) returns (oob_ip, prefix_len); the network is
IPv4Network(f"{oob_ip}/{prefix_len}", strict=False) — the same data used for
MGMT_INTERFACE (config_generator.py:363-369).

Only the device's own OOB management subnet is permitted; SNMP polling stations
and telemetry collectors are assumed to live on the management network. No other
sources are added in this iteration.

Example (per device, subnet derived from the OOB IP):

"ACL_TABLE": {
    "SNMP_ONLY": {
        "policy_desc": "SNMP_ONLY",
        "type": "CTRLPLANE",
        "services": ["SNMP"]
    },
    "GNMI_ONLY": {
        "policy_desc": "GNMI_ONLY",
        "type": "CTRLPLANE",
        "services": ["EXTERNAL_CLIENT"]
    }
},
"ACL_RULE": {
    "SNMP_ONLY|RULE_1": {
        "PRIORITY": "9999",
        "PACKET_ACTION": "ACCEPT",
        "SRC_IP": "<oob_subnet>/<prefix>",
        "IP_TYPE": "IP"
    },
    "GNMI_ONLY|RULE_1": {
        "PRIORITY": "9999",
        "PACKET_ACTION": "ACCEPT",
        "SRC_IP": "<oob_subnet>/<prefix>",
        "IP_TYPE": "IP"
    }
}

Implementation notes

• Share the helper/wiring with Ensure that the SONiC SSH service is accessible only on the management network #2329. Suggested shape: a single
  _add_ctrlplane_acls helper (or per-service helpers reusing one builder)
  that emits the SSH_ONLY, SNMP_ONLY and GNMI_ONLY tables from the same
  OOB subnet, called from generate_sonic_config near the management-interface
  block, only when an OOB IP exists.
• The gNMI/telemetry control-plane service name (EXTERNAL_CLIENT above) is a
  caclmgrd-internal value, not modelled in the SONiC YANG. Verify it against
  the target SONiC build's caclmgrd ACL_SERVICES before relying on it; the
  service maps to the configured TELEMETRY|gnmi|port.
• Register ACL_TABLE and ACL_RULE as generator-owned tables
  (TOP_LEVEL_SCAFFOLD_KEYS / OWNED_TABLE_KEYS) so they are rebuilt from
  scratch on every regen and never carry stale entries.
• Permit only the local OOB subnet (oob_ip/prefix_len, normalised to the
  network address). This matches "only the management network".
• Validation: SONiC ACL_TABLE / ACL_RULE are not yet in the generated
  pydantic schema set (_generated/_schemas.py only models DASH_ACL_*), so
  the validator emits warnings, not errors, for these tables. Consider adding
  the sonic-acl YANG model and regenerating (relates to Cover Enterprise SONiC tables in the YANG model set #2258).
• Add unit tests under tests/unit/tasks/conductor/sonic/: ACLs generated when
  OOB IP present, correct (network-normalised) subnet in the rules, tables
  absent when no OOB IP.

Related

• Ensure that the SONiC SSH service is accessible only on the management network #2329 (SSH) — same control-plane-ACL mechanism; share the helper and
  owned-table wiring.