summaryrefslogtreecommitdiff
path: root/python
diff options
context:
space:
mode:
authorAlex Kudentsov <43482574+alexk37@users.noreply.github.com>2026-06-20 20:38:51 +0700
committerAlex Kudentsov <43482574+alexk37@users.noreply.github.com>2026-06-20 20:51:25 +0700
commit23649ea9dec442795997aac3da148e3312018d75 (patch)
treebf3299599652b8c4f5e9e1ec97fb165a3bd17654 /python
parent6c0fd99099a6251a12bc2287d5ba2ab115cd8015 (diff)
downloadvyos-1x-23649ea9dec442795997aac3da148e3312018d75.tar.gz
vyos-1x-23649ea9dec442795997aac3da148e3312018d75.zip
T8990: bgp: fix VPNv4/VPNv6 leaked routes flapping on every commit
VRF route leaking via VPNv4/VPNv6 caused all imported (leaked) routes to be withdrawn and reinstalled on every commit - even commits unrelated to BGP, VRF or routing - briefly blackholing traffic that depends on them. Root cause: the BGP address-family template rendered the route-target using the "route-target vpn ..." alias. FRR accepts that alias on input but its config writer only ever emits the canonical "rt vpn ..." form. frr-reload.py diffs the generated config against FRR's running config line by line and has no normalisation for this, so the route-target lines never matched and were deleted and re-added on every reload. Re-applying the route-target runs FRR's vpn_leak_prechange()/postchange(), a non-atomic withdraw-all then reinstall-all of every leaked route. Emit the canonical "rt vpn" keyword so the rendered config round-trips through frr-reload unchanged. FRR also folds an identical import+export route-target into "both" (an order-sensitive, byte-identical match), so do the same to stay idempotent; reordered or differing lists stay split on both sides. Add test_bgp_33_vpn_route_target_idempotency covering both / identical export+import / asymmetric route-target, reading the generated FRR config (getFRRconfig/vtysh returns FRR's already-canonical form and cannot catch the alias).
Diffstat (limited to 'python')
0 files changed, 0 insertions, 0 deletions