[redfish] Deliver bridged-container syslog to the host over docker0

[shreyansh-nexthop]

Why I did it

redfish runs bridge-networked, as docker_image_ctl.j2 already notes at the port-mapping block, so its 127.0.0.1 is not the host's and its rsyslog cannot reach the host over loopback. Logs emitted inside the container never reach the host /var/log/syslog, including a process going FATAL at startup, which is exactly when they are most needed.

Three pieces are missing for redfish, all of which dhcp_server already has:

1. Container target. RELP is sent to SYSLOG_TARGET_IP=127.0.0.1, which loops back inside the container. Only dhcp_server is pointed at the docker0 gateway.
2. Host listener not configured. docker0_ip is keyed on the dhcp_server FEATURE entry, which aspeed images do not have, so no docker0 input is generated for the host rsyslog.
3. Firewall. With a control-plane ACL configured, the syslog arrives on docker0 rather than lo, matches no ACCEPT, and is swept into caclmgrd's catch-all DROP. That side is handled by [caclmgrd] Own the redfish docker0 syslog INPUT exception sonic-host-services#429.

This extends #28580, which added the dhcp_server start and stop waits on the caclmgrd-owned rule.

How I did it

files/build_templates/docker_image_ctl.j2

• A bridged_containers list names the bridge-networked containers once, and the rule check, both waits, and the syslog target render from single parametrized blocks, so the dhcp_server and redfish copies cannot drift.
• SYSLOG_TARGET_IP points at the docker0 gateway for redfish, as it already does for dhcp_server.
• The rule check runs under sudo for redfish, since redfish.service runs as sonicadmin.
• BRIDGE_SYSLOG_WAIT_SECS replaces the hardcoded 10 second bound.
• The stop() warning read "rule not absent" and now reads "rule still present".

files/image_config/rsyslog/rsyslog-config.sh

• docker0_ip is populated when any bridged feature entry exists, so the host rsyslog binds its RELP listener on the docker0 gateway. The redfish entry is only appended on aspeed images, so other platforms are unaffected.
• The presence test was an unquoted command substitution; it is now a quoted -n test.

Both waits warn and continue rather than fail, as in #28580.

How to verify it

On an aspeed platform with redfish enabled:

1. The container is aimed at the docker0 gateway:

docker exec redfish env | grep SYSLOG_TARGET_IP
docker exec redfish grep -E 'omrelp|port=' /etc/rsyslog.conf

2. The host is listening on both loopback and the docker0 gateway, with no manual intervention:

ss -tlnp | grep 2514

3. The caclmgrd-owned exception is present:

sudo iptables -S INPUT | grep redfish_syslog

4. End to end, forcing a new RELP connection so that an existing conntrack ESTABLISHED entry cannot mask the result:

docker exec redfish supervisorctl restart rsyslogd
docker exec redfish logger -t probe HELLO
sudo grep probe /var/log/syslog

5. Runtime enable, starting from redfish disabled and without rebooting:

sudo config feature state redfish enabled
docker exec redfish logger -t probe RUNTIME
sudo grep RUNTIME /var/log/syslog

dhcp_server behaviour is unchanged: the rendered script for that container is equivalent to what #28580 produced, with the container name and the wait bound now supplied by the shared blocks.

Which release branch to port

• master

Description for the changelog

[redfish] Deliver bridged-container syslog to the host over the docker0 gateway, and render the bridged-container syslog handling in docker_image_ctl from a single list so dhcp_server and redfish cannot drift.

Link to config_db schema for YANG module changes

N/A, no schema change.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[mssonicbld]

/azp run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[yxieca]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
2 pipeline(s) were filtered out due to trigger conditions.

[yxieca]

Approve.

Generalizes the dhcp_server-specific docker0-syslog plumbing in docker_image_ctl.j2 and rsyslog-config.sh to a bridged_containers = ["dhcp_server", "redfish"] set, so redfish (bridge-networked) delivers its container syslog to the host over the docker0 gateway. This is the container-side counterpart to sonic-host-services#429.

Verified:

• Single source of truth: the bridged_containers list drives the rule check, both waits, and the syslog-target selection, so the dhcp_server and redfish paths can't drift.
• The container -C check and caclmgrd's -A rule resolve to the same kernel rule (iptables -C canonicalizes -p tcp and normalizes ordering); the redfish_syslog comment tag matches. If they ever diverge, the wait degrades to a warn-only timeout rather than a failure.
• Loop rewrite {0..10} -> for (( attempt=0; attempt<=BRIDGE_SYSLOG_WAIT_SECS; attempt++ )) is behavior-preserving (11 iterations, ~10s); the C-style form is needed to interpolate the parameterized bound.
• sudo iptables is correctly used for redfish's check (redfish.service runs as sonicadmin) while dhcp_server keeps plain iptables; SYSLOG_TARGET_IP points bridged containers at the docker0 gateway.

Non-blocking: the -C wait is warn-only, so early syslog can be dropped until the next caclmgrd rebuild lands the rule — same behavior as the existing dhcp_server path.

Reviewed with AI assistance on behalf of Ying.

[mssonicbld]

This PR is approved for branch msft-202608. No cherry pick PR has been created because of code conflict. @shreyansh-nexthop, please manually create the cherry pick PR.
If this change is already in msft-202608, please comment "already in msft-202608". Thanks!

_{---Powered by SONiC BuildBot}

[weiguo-nvidia]

Hi @shreyansh-nexthop ,

Could you help resolve the cherry-pick conflict to 202608 branch