bgp: T4385: peer-group member cannot override remote-as of peer-group

2 files changed, 31 insertions, 1 deletions

diff --git a/smoketest/scripts/cli/test_protocols_bgp.py b/smoketest/scripts/cli/test_protocols_bgp.py
index f1db5350a..5fa4c2d69 100755
--- a/smoketest/scripts/cli/test_protocols_bgp.py
+++ b/smoketest/scripts/cli/test_protocols_bgp.py
@@ -882,5 +882,29 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
             self.assertIn(f'  rt vpn import {rt_import}', afi_config)
             self.assertIn(f' exit-address-family', afi_config)
 
+    def test_bgp_14_remote_as_peer_group_override(self):
+        # Peer-group member cannot override remote-as of peer-group
+        remote_asn = str(int(ASN) + 150)
+        neighbor = '192.0.2.1'
+        peer_group = 'bar'
+
+        self.cli_set(base_path + ['local-as', ASN])
+        self.cli_set(base_path + ['neighbor', neighbor, 'remote-as', remote_asn])
+        self.cli_set(base_path + ['neighbor', neighbor, 'peer-group', peer_group])
+        self.cli_set(base_path + ['peer-group', peer_group, 'remote-as', remote_asn])
+
+        # Peer-group member cannot override remote-as of peer-group
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+        self.cli_delete(base_path + ['neighbor', neighbor, 'remote-as'])
+
+        self.cli_commit()
+
+        frrconfig = self.getFRRconfig(f'router bgp {ASN}')
+        self.assertIn(f'router bgp {ASN}', frrconfig)
+        self.assertIn(f' neighbor {neighbor} peer-group {peer_group}', frrconfig)
+        self.assertIn(f' neighbor {peer_group} peer-group', frrconfig)
+        self.assertIn(f' neighbor {peer_group} remote-as {remote_asn}', frrconfig)
+
 if __name__ == '__main__':
-    unittest.main(verbosity=2, failfast=True)
+    unittest.main(verbosity=2)
diff --git a/src/conf_mode/protocols_bgp.py b/src/conf_mode/protocols_bgp.py
index 8d9d3e99a..a9173ab87 100755
--- a/src/conf_mode/protocols_bgp.py
+++ b/src/conf_mode/protocols_bgp.py
@@ -164,6 +164,12 @@ def verify(bgp):
                 if not verify_remote_as(peer_config, bgp):
                     raise ConfigError(f'Neighbor "{peer}" remote-as must be set!')
 
+                # Peer-group member cannot override remote-as of peer-group
+                if 'peer_group' in peer_config:
+                    peer_group = peer_config['peer_group']
+                    if 'remote_as' in peer_config and 'remote_as' in bgp['peer_group'][peer_group]:
+                        raise ConfigError(f'Peer-group member "{peer}" cannot override remote-as of peer-group "{peer_group}"!')
+
                 # Only checks for ipv4 and ipv6 neighbors
                 # Check if neighbor address is assigned as system interface address
                 vrf = None