feat: Change proxy shared secret support for TACACS+ proxy clients to be based on loopback or cli config not upstream

[Rod-Persky]

This pull request adds support for configuring the expected obfuscation policy for downstream TACACS+ proxy traffic, based on either the highest-priority filtered local proxy endpoint or a new --proxy-shared-secret CLI flag. It also refactors the configuration filter logic to propagate this policy and updates related tests accordingly.

Configuration and Obfuscation Policy Handling:

• Introduced a new CLI flag --proxy-shared-secret in cli.rs, allowing operators to specify a shared secret for raw TACACS+ proxy clients when not in SONiC mode. This flag is required if --proxy-endpoint is set and conflicts with --sonic.
• Updated the configuration filter logic in config_filter.rs to:
  • Track and propagate the expected downstream obfuscation policy (ProxyDownstreamObfuscation) alongside the filtered TACACS+ configuration, using a new FilteredTacacsPlus struct.
  • When local proxy endpoint rows are filtered, the policy is derived from the highest-priority matching row's shared secret, or falls back to the CLI flag if present. [1] [2]
  • Updated the filter constructors and trait implementations to support the new policy propagation. [1] [2]

Documentation:

• Expanded the README.md to clarify how the proxy obfuscation policy is selected, how the new CLI flag interacts with configuration, and what is expected from local clients under various scenarios.

Testing:

• Refactored and extended tests in config_filter.rs to verify that the correct obfuscation policy is applied and propagated for various configurations, including edge cases where no shared secret is present. [1] [2] [3] [4] [5] [6] [7]

[Copilot]

Pull request overview

This PR updates the raw TACACS+ proxy path so the downstream (client→proxy) obfuscation policy is configured locally (via filtered loopback proxy rows or a new --proxy-shared-secret flag) rather than implicitly inheriting the upstream server shared secret. It also refactors the agentd config filtering pipeline to propagate this downstream policy into the running proxy service and extends tests/docs accordingly.

Changes:

• Add a downstream obfuscation policy (ProxyDownstreamObfuscation) to agent service configuration, keep it hot-reloadable, and wire it into the raw proxy bridge.
• Refactor tacacsrs-agentd TACACS+ config filtering to return both filtered upstream config and downstream proxy obfuscation policy; add --proxy-shared-secret CLI support.
• Update docs/tests; additionally, SONiC ConfigDB mapping changes server priority ordering (review comments note a likely semantic regression vs repo docs).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
libraries/tacacsrs_sonic/src/mapping.rs	Changes SONiC server ordering / default priority behavior and updates mapping tests.
libraries/tacacsrs_agent/src/services/tacacs_proxy/upstream_bridge/mod.rs	Uses shared downstream obfuscation policy when reading/writing raw proxy packets.
libraries/tacacsrs_agent/src/services/tacacs_proxy/service.rs	Plumbs shared downstream obfuscation state into the proxy service/bridge.
libraries/tacacsrs_agent/src/runtime/client_service.rs	Stores downstream obfuscation policy in shared state and updates reload flow to apply it.
libraries/tacacsrs_agent/src/lib.rs	Re-exports ProxyDownstreamObfuscation.
libraries/tacacsrs_agent/src/config.rs	Introduces ProxyDownstreamObfuscation and adds it to ServiceConfig.
executables/tacacsrs_agentd/src/main.rs	Integrates new filter output and applies downstream obfuscation policy on initial load + reload.
executables/tacacsrs_agentd/src/config_filter.rs	Refactors filtering to return FilteredTacacsPlus including downstream obfuscation policy.
executables/tacacsrs_agentd/src/cli.rs	Adds --proxy-shared-secret flag with clap constraints.
executables/tacacsrs_agentd/README.md	Documents downstream proxy obfuscation selection rules and CLI behavior.