bgp: T7760: deprecate per bgp vrf instance system-as node

Originating from the bug in T7665. To avoid potential issues down the line - and
given that there's no compelling technical reason to retain the system-as CLI
node under per-VRF BGP configuration, which cannot be achieved through
alternative means - the maintainers have collectively decided to deprecate the
following command:

set vrf name <name> protocols bgp system-as <asn>

Starting with VyOS 1.4.4, this CLI command will be considered deprecated. While
it will still be accepted, it will no longer have any operational effect. A
deprecation warning will be displayed at commit time, indicating that the BGP
ASN from the global BGP configuration is now used instead.

A migration script will handle the transition and perform the following actions:
* Ensure a global BGP configuration exists; if not, initialize one.
* Iterate over all configured VRFs to determine whether a BGP instance exists
* For any insance, update the configuration to use the global system-as
  and apply the local-as ASN no-prepend replace-as option on all affected
  neighbors to preserve existing behavior.
* If a neighbor is already configured with a local-as directive, that neighbor
  will be excluded from the migration process, as it already follows a custom
  configuration.
* Add allowas-in per neighbor option. Required to not deny prefix received
  updates due to as-path contains our own global ASN.

1 files changed, 18 insertions, 44 deletions

diff --git a/smoketest/scripts/cli/test_protocols_bgp.py b/smoketest/scripts/cli/test_protocols_bgp.py
index 43bf00238..630e26709 100755
--- a/smoketest/scripts/cli/test_protocols_bgp.py
+++ b/smoketest/scripts/cli/test_protocols_bgp.py
@@ -230,7 +230,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
     def create_bgp_instances_for_import_test(self):
         table = '1000'
         self.cli_set(import_vrf_base + [import_vrf, 'table', table])
-        self.cli_set(import_vrf_base + [import_vrf, 'protocols', 'bgp', 'system-as', ASN])
+        self.cli_set(import_vrf_base + [import_vrf, 'protocols', 'bgp'])
 
     def verify_frr_config(self, peer, peer_config, frrconfig):
         # recurring patterns to verify for both a simple neighbor and a peer-group
@@ -1050,7 +1050,6 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         for vrf in vrfs:
             vrf_base = ['vrf', 'name', vrf]
             self.cli_set(vrf_base + ['table', table])
-            self.cli_set(vrf_base + ['protocols', 'bgp', 'system-as', ASN])
             self.cli_set(vrf_base + ['protocols', 'bgp', 'parameters', 'router-id', router_id])
             table = str(int(table) + 1000)
 
@@ -1192,31 +1191,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f' neighbor {peer_group} peer-group', frrconfig)
         self.assertIn(f' neighbor {peer_group} remote-as {remote_asn}', frrconfig)
 
-    def test_bgp_15_local_as_ebgp(self):
-        # https://vyos.dev/T4560
-        # local-as allowed only for ebgp peers
-
-        neighbor = '192.0.2.99'
-        remote_asn = '500'
-        local_asn = '400'
-
-        self.cli_set(base_path + ['neighbor', neighbor, 'remote-as', ASN])
-        self.cli_set(base_path + ['neighbor', neighbor, 'local-as', local_asn])
-
-        # check validate() - local-as allowed only for ebgp peers
-        with self.assertRaises(ConfigSessionError):
-            self.cli_commit()
-
-        self.cli_set(base_path + ['neighbor', neighbor, 'remote-as', remote_asn])
-
-        self.cli_commit()
-
-        frrconfig = self.getFRRconfig(f'router bgp {ASN}', endsection='^exit')
-        self.assertIn(f'router bgp {ASN}', frrconfig)
-        self.assertIn(f' neighbor {neighbor} remote-as {remote_asn}', frrconfig)
-        self.assertIn(f' neighbor {neighbor} local-as {local_asn}', frrconfig)
-
-    def test_bgp_16_import_rd_rt_compatibility(self):
+    def test_bgp_15_import_rd_rt_compatibility(self):
         # Verify if import vrf and rd vpn export
         # exist in the same address family
         self.create_bgp_instances_for_import_test()
@@ -1229,7 +1204,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         with self.assertRaises(ConfigSessionError):
             self.cli_commit()
 
-    def test_bgp_17_import_rd_rt_compatibility(self):
+    def test_bgp_16_import_rd_rt_compatibility(self):
         # Verify if vrf that is in import vrf list contains rd vpn export
         self.create_bgp_instances_for_import_test()
         self.cli_set(
@@ -1252,7 +1227,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         with self.assertRaises(ConfigSessionError):
             self.cli_commit()
 
-    def test_bgp_18_deleting_import_vrf(self):
+    def test_bgp_17_deleting_import_vrf(self):
         # Verify deleting vrf that is in import vrf list
         self.create_bgp_instances_for_import_test()
         self.cli_set(
@@ -1269,7 +1244,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         with self.assertRaises(ConfigSessionError):
             self.cli_commit()
 
-    def test_bgp_19_deleting_default_vrf(self):
+    def test_bgp_18_deleting_default_vrf(self):
         # Verify deleting existent vrf default if other vrfs were created
         self.create_bgp_instances_for_import_test()
         self.cli_commit()
@@ -1281,7 +1256,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         with self.assertRaises(ConfigSessionError):
             self.cli_commit()
 
-    def test_bgp_20_import_rd_rt_compatibility(self):
+    def test_bgp_19_import_rd_rt_compatibility(self):
         # Verify if vrf that has rd vpn export is in import vrf of other vrfs
         self.create_bgp_instances_for_import_test()
         self.cli_set(
@@ -1303,7 +1278,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         with self.assertRaises(ConfigSessionError):
             self.cli_commit()
 
-    def test_bgp_21_import_unspecified_vrf(self):
+    def test_bgp_20_import_unspecified_vrf(self):
         # Verify if vrf that is in import is unspecified
         self.create_bgp_instances_for_import_test()
         self.cli_set(
@@ -1312,7 +1287,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         with self.assertRaises(ConfigSessionError):
             self.cli_commit()
 
-    def test_bgp_22_interface_mpls_forwarding(self):
+    def test_bgp_21_interface_mpls_forwarding(self):
         interfaces = Section.interfaces('ethernet', vlan=False)
         for interface in interfaces:
             self.cli_set(base_path + ['interface', interface, 'mpls', 'forwarding'])
@@ -1324,7 +1299,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
             self.assertIn(f'interface {interface}', frrconfig)
             self.assertIn(f' mpls bgp forwarding', frrconfig)
 
-    def test_bgp_23_vrf_interface_mpls_forwarding(self):
+    def test_bgp_22_vrf_interface_mpls_forwarding(self):
         self.create_bgp_instances_for_import_test()
         interfaces = Section.interfaces('ethernet', vlan=False)
         for interface in interfaces:
@@ -1339,7 +1314,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
             self.assertIn(f' mpls bgp forwarding', frrconfig)
             self.cli_delete(['interfaces', 'ethernet', interface, 'vrf'])
 
-    def test_bgp_24_srv6_sid(self):
+    def test_bgp_23_srv6_sid(self):
         locator_name = 'VyOS_foo'
         sid = 'auto'
         nexthop_ipv4 = '192.0.0.1'
@@ -1386,7 +1361,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f' sid vpn export {sid}', afiv6_config)
         self.assertIn(f' nexthop vpn export {nexthop_ipv6}', afiv6_config)
 
-    def test_bgp_25_ipv4_labeled_unicast_peer_group(self):
+    def test_bgp_24_ipv4_labeled_unicast_peer_group(self):
         pg_ipv4 = 'foo4'
         ipv4_max_prefix = '20'
         ipv4_prefix = '192.0.2.0/24'
@@ -1411,7 +1386,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f'  neighbor {pg_ipv4} activate', afiv4_config)
         self.assertIn(f'  neighbor {pg_ipv4} maximum-prefix {ipv4_max_prefix}', afiv4_config)
 
-    def test_bgp_26_ipv6_labeled_unicast_peer_group(self):
+    def test_bgp_25_ipv6_labeled_unicast_peer_group(self):
         pg_ipv6 = 'foo6'
         ipv6_max_prefix = '200'
         ipv6_prefix = '2001:db8:1000::/64'
@@ -1437,7 +1412,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f'  neighbor {pg_ipv6} activate', afiv6_config)
         self.assertIn(f'  neighbor {pg_ipv6} maximum-prefix {ipv6_max_prefix}', afiv6_config)
 
-    def test_bgp_27_route_reflector_client(self):
+    def test_bgp_26_route_reflector_client(self):
         int_neighbors = ['192.0.2.2', '192.0.2.3', '192.0.2.4', '192.0.2.5']
         int_interfaces = ['dum0', 'dum1', 'dum2', 'dum3']
         int_pg_names = ['SMOKETESTINT0', 'SMOKETESTINT1', 'SMOKETESTINT2']
@@ -1472,7 +1447,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
             interface_cmd = ['interface'] if neighbor.startswith('dum') else []
             self.cli_set(base_path + ['neighbor', neighbor, 'address-family', 'ipv4-unicast', 'route-reflector-client'])
             self.cli_set(base_path + ['neighbor', neighbor] + interface_cmd + ['remote-as', remote_as_type])
-            
+
         set_neighbor_funcs = [_set_neighbor_0, _set_neighbor_1, _set_neighbor_2, _set_neighbor_3]
         for remote_as_type in remote_as_types:
             for func_count, set_neighbor_func in enumerate(set_neighbor_funcs):
@@ -1484,7 +1459,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
                         self.cli_discard()
                     else:
                         self.cli_commit()
-        
+
         frrconfig = self.getFRRconfig(f'router bgp {ASN}', endsection='^exit', substring=' address-family ipv4 unicast', endsubsection='^ exit-address-family')
         neighbor_has_rr_client = [
             int_neighbors[0], int_neighbors[3],
@@ -1497,7 +1472,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         self.cli_delete(['interfaces', 'dummy'])
         self.cli_commit()
 
-    def test_bgp_28_peer_group_member_all_internal_or_external(self):
+    def test_bgp_27_peer_group_member_all_internal_or_external(self):
         def _common_config_check(conf, include_ras=True):
             if include_ras:
                 self.assertIn(f'neighbor {int_neighbors[0]} remote-as {ASN}', conf)
@@ -1589,13 +1564,12 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f'neighbor OVERLAY remote-as {int(ASN) + 1}', conf)
         self.assertIn(f'neighbor OVERLAY local-as {int(ASN) + 1}', conf)
 
-    def test_bgp_30_import_vrf_routemap(self):
+    def test_bgp_30_import_vrf_route_map(self):
         router_id = '127.0.0.3'
         table = '1000'
         vrf = 'red'
         vrf_base = ['vrf', 'name', vrf]
         self.cli_set(vrf_base + ['table', table])
-        self.cli_set(vrf_base + ['protocols', 'bgp', 'system-as', ASN])
         self.cli_set(
             vrf_base + ['protocols', 'bgp', 'parameters', 'router-id',
                         router_id])
@@ -1682,4 +1656,4 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f'bmp connect {target_address} port {target_port} min-retry {min_retry} max-retry {max_retry}', frrconfig)
 
 if __name__ == '__main__':
-    unittest.main(verbosity=2)
+    unittest.main(verbosity=2, failfast=True)