T8990: bgp: fix VPNv4/VPNv6 leaked routes flapping on every commit

VRF route leaking via VPNv4/VPNv6 caused all imported (leaked) routes to
be withdrawn and reinstalled on every commit - even commits unrelated to
BGP, VRF or routing - briefly blackholing traffic that depends on them.

Root cause: the BGP address-family template rendered the route-target
using the "route-target vpn ..." alias. FRR accepts that alias on input
but its config writer only ever emits the canonical "rt vpn ..." form.
frr-reload.py diffs the generated config against FRR's running config
line by line and has no normalisation for this, so the route-target lines
never matched and were deleted and re-added on every reload. Re-applying
the route-target runs FRR's vpn_leak_prechange()/postchange(), a
non-atomic withdraw-all then reinstall-all of every leaked route.

Emit the canonical "rt vpn" keyword so the rendered config round-trips
through frr-reload unchanged. FRR also folds an identical import+export
route-target into "both" (an order-sensitive, byte-identical match), so
do the same to stay idempotent; reordered or differing lists stay split
on both sides.

Add test_bgp_33_vpn_route_target_idempotency covering both / identical
export+import / asymmetric route-target, reading the generated FRR config
(getFRRconfig/vtysh returns FRR's already-canonical form and cannot catch
the alias).

1 files changed, 12 insertions, 3 deletions

diff --git a/data/templates/frr/bgpd.frr.j2 b/data/templates/frr/bgpd.frr.j2
index 27d13c40c..c10aa2826 100644
--- a/data/templates/frr/bgpd.frr.j2
+++ b/data/templates/frr/bgpd.frr.j2
@@ -428,14 +428,23 @@ router bgp {{ system_as }} {{ 'vrf ' ~ vrf if vrf is vyos_defined }} {{ 'as-nota
 {%         if afi_config.rd.vpn.export is vyos_defined %}
   rd vpn export {{ afi_config.rd.vpn.export }}
 {%         endif %}
+{# T8990: emit FRR's canonical "rt vpn" keyword (not the "route-target vpn" #}
+{# alias), and fold an identical import+export into "both" exactly as FRR #}
+{# does. FRR only folds on an identical, order-sensitive match, which is #}
+{# what the string compare below tests - so reordered or differing RT lists #}
+{# stay split on both sides too. This keeps the rendered config #}
+{# byte-identical to FRR's running config, so frr-reload produces no diff #}
+{# that would otherwise flap leaked routes on every commit. #}
 {%         if afi_config.route_target.vpn.both is vyos_defined %}
-  route-target vpn both {{ afi_config.route_target.vpn.both }}
+  rt vpn both {{ afi_config.route_target.vpn.both }}
+{%         elif afi_config.route_target.vpn.export is vyos_defined and afi_config.route_target.vpn.export == afi_config.route_target.vpn.import %}
+  rt vpn both {{ afi_config.route_target.vpn.export }}
 {%         else %}
 {%             if afi_config.route_target.vpn.export is vyos_defined %}
-  route-target vpn export {{ afi_config.route_target.vpn.export }}
+  rt vpn export {{ afi_config.route_target.vpn.export }}
 {%             endif %}
 {%             if afi_config.route_target.vpn.import is vyos_defined %}
-  route-target vpn import {{ afi_config.route_target.vpn.import }}
+  rt vpn import {{ afi_config.route_target.vpn.import }}
 {%             endif %}
 {%         endif %}
 {%         if afi_config.route_target.both is vyos_defined %}