diff options
| author | Alex Kudentsov <43482574+alexk37@users.noreply.github.com> | 2026-06-20 20:38:51 +0700 |
|---|---|---|
| committer | Alex Kudentsov <43482574+alexk37@users.noreply.github.com> | 2026-06-20 20:51:25 +0700 |
| commit | 23649ea9dec442795997aac3da148e3312018d75 (patch) | |
| tree | bf3299599652b8c4f5e9e1ec97fb165a3bd17654 /python | |
| parent | 6c0fd99099a6251a12bc2287d5ba2ab115cd8015 (diff) | |
| download | vyos-1x-23649ea9dec442795997aac3da148e3312018d75.tar.gz vyos-1x-23649ea9dec442795997aac3da148e3312018d75.zip | |
T8990: bgp: fix VPNv4/VPNv6 leaked routes flapping on every commit
VRF route leaking via VPNv4/VPNv6 caused all imported (leaked) routes to
be withdrawn and reinstalled on every commit - even commits unrelated to
BGP, VRF or routing - briefly blackholing traffic that depends on them.
Root cause: the BGP address-family template rendered the route-target
using the "route-target vpn ..." alias. FRR accepts that alias on input
but its config writer only ever emits the canonical "rt vpn ..." form.
frr-reload.py diffs the generated config against FRR's running config
line by line and has no normalisation for this, so the route-target lines
never matched and were deleted and re-added on every reload. Re-applying
the route-target runs FRR's vpn_leak_prechange()/postchange(), a
non-atomic withdraw-all then reinstall-all of every leaked route.
Emit the canonical "rt vpn" keyword so the rendered config round-trips
through frr-reload unchanged. FRR also folds an identical import+export
route-target into "both" (an order-sensitive, byte-identical match), so
do the same to stay idempotent; reordered or differing lists stay split
on both sides.
Add test_bgp_33_vpn_route_target_idempotency covering both / identical
export+import / asymmetric route-target, reading the generated FRR config
(getFRRconfig/vtysh returns FRR's already-canonical form and cannot catch
the alias).
Diffstat (limited to 'python')
0 files changed, 0 insertions, 0 deletions
