From d871fe9c4c65de87232802ed54b263c9b2824391 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Thu, 28 Aug 2025 14:46:48 +0200 Subject: bgp: T7760: deprecate per bgp vrf instance system-as node Originating from the bug in T7665. To avoid potential issues down the line - and given that there's no compelling technical reason to retain the system-as CLI node under per-VRF BGP configuration, which cannot be achieved through alternative means - the maintainers have collectively decided to deprecate the following command: set vrf name protocols bgp system-as Starting with VyOS 1.4.4, this CLI command will be considered deprecated. While it will still be accepted, it will no longer have any operational effect. A deprecation warning will be displayed at commit time, indicating that the BGP ASN from the global BGP configuration is now used instead. A migration script will handle the transition and perform the following actions: * Ensure a global BGP configuration exists; if not, initialize one. * Iterate over all configured VRFs to determine whether a BGP instance exists * For any insance, update the configuration to use the global system-as and apply the local-as ASN no-prepend replace-as option on all affected neighbors to preserve existing behavior. * If a neighbor is already configured with a local-as directive, that neighbor will be excluded from the migration process, as it already follows a custom configuration. * Add allowas-in per neighbor option. Required to not deny prefix received updates due to as-path contains our own global ASN. --- src/migration-scripts/bgp/6-to-7 | 108 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 108 insertions(+) create mode 100644 src/migration-scripts/bgp/6-to-7 (limited to 'src/migration-scripts') diff --git a/src/migration-scripts/bgp/6-to-7 b/src/migration-scripts/bgp/6-to-7 new file mode 100644 index 000000000..7a11bbf3a --- /dev/null +++ b/src/migration-scripts/bgp/6-to-7 @@ -0,0 +1,108 @@ +#!/usr/bin/env python3 +# +# Copyright VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# T7760: Remove per VRF setting for system-as option and replace it with +# local-as if required. + +from vyos.configtree import ConfigTree + +def migrate(config: ConfigTree) -> None: + vrf_base = ['vrf', 'name'] + bgp_base = ['protocols', 'bgp'] + + if not config.exists(vrf_base): + return + + global_asn = None + if config.exists(bgp_base + ['system-as']): + global_asn = config.return_value(bgp_base + ['system-as']) + + for vrf in config.list_nodes(vrf_base): + # bail out early if there is no per VRF BGP instance defined + vrf_bgp_base = vrf_base + [vrf] + bgp_base + if not config.exists(vrf_bgp_base): + continue + + # This is a mandatory node in the old design but keep it optional + # if one want's to load a weird config + if config.exists(vrf_bgp_base + ['system-as']): + system_as = config.return_value(vrf_bgp_base + ['system-as']) + config.delete(vrf_bgp_base + ['system-as']) + + # If there is no existing global BGP instance - start one + if not config.exists(bgp_base): + config.set(bgp_base + ['system-as'], value=system_as) + global_asn = system_as + + vrf_neighbor_base = vrf_bgp_base + ['neighbor'] + vrf_peer_group_base = vrf_bgp_base + ['peer-group'] + if config.exists(vrf_neighbor_base): + for neighbor in config.list_nodes(vrf_neighbor_base): + # Neighbor already has local-as option set, do not touch it + if config.exists(vrf_neighbor_base + [neighbor, 'local-as']): + #print(f'VRF {vrf} BGP neighbor {neighbor} has local-as set - do not migrate!') + continue + + # Check if the neighbor uses a peer-group which has the local-as + # option set, do not touch it either + peer_group = None + if config.exists(vrf_neighbor_base + [neighbor, 'peer-group']): + peer_group = config.return_value(vrf_neighbor_base + [neighbor, 'peer-group']) + # Check if the peer-group has a local-as option set + if config.exists(vrf_peer_group_base + [peer_group, 'local-as']): + #print(f'VRF {vrf} BGP neighbor {neighbor} uses peer-group {peer_group} which has local-as set - do not migrate!') + continue + + # BGP local-as option is only allowed for eBGP speakers + if global_asn == system_as: + continue + + config.set(vrf_neighbor_base + [neighbor, 'local-as', system_as, 'no-prepend', 'replace-as']) + config.set_tag(vrf_neighbor_base + [neighbor, 'local-as']) + + # We do also need to take care about BGP internas. When using local-as routes with our own AS + # previously in the path will get rejected: + # bgpd: x.x.x.x(Unknown) rcvd UPDATE about 192.0.2.0/24 IPv4 unicast -- DENIED due to: as-path contains our own AS; + # Set allowas-in option + allowas_in_numer = ['allowas-in', 'number'] + for afi in ['ipv4-labeled-unicast', 'ipv4-multicast', 'ipv4-unicast', 'ipv4-vpn', + 'ipv6-labeled-unicast', 'ipv6-multicast', 'ipv6-unicast', 'ipv6-vpn']: + afi_neighbor_base = vrf_neighbor_base + [neighbor, 'address-family', afi] + afi_peer_group_base = vrf_peer_group_base + [peer_group, 'address-family', afi] + + # No need to change anything on an AFI not in use + if not config.exists(afi_neighbor_base) and not config.exists(afi_peer_group_base): + continue + + allowas_in_value = 0 + print(neighbor, afi) + # Check if there is any allowas-in definition for a peer-group + if peer_group and config.exists(afi_peer_group_base + allowas_in_numer): + allowas_in_value = int(config.return_value(afi_peer_group_base + allowas_in_numer)) + #print(f'peer-group {peer_group} allowas-in for {afi} is {allowas_in_value}') + + # Per neighbor "allowas-in" definition takes higher precendence + if config.exists(afi_neighbor_base + allowas_in_numer): + allowas_in_value = int(config.return_value(afi_neighbor_base + allowas_in_numer)) + #print(f'neighbor {neighbor} allowas-in for {afi} is {allowas_in_value}') + + # Increment allowas-in by 1 as we now have one more entry + allowas_in_value += 1 + # Clip allowas-in to 10 - max supported by FRR platform + if allowas_in_value > 10: allowas_in_value = 10 + + # Set per neighbor allowas-in which always takes precedence over the peer-group definition + config.set(afi_neighbor_base + allowas_in_numer, value=allowas_in_value, replace=True) -- cgit v1.2.3 From 85fe32f0e1a91a47fe4a6d4a5cdd6ac516dcc3b9 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 9 Sep 2025 17:57:44 +0200 Subject: bgp: T7760: remove per vrf instance system-as node VyOS 1.5 and onwards will no longer have the following CLI node available: set vrf name protocols bgp system-as --- .../include/version/bgp-version.xml.i | 2 +- interface-definitions/vrf.xml.in | 12 --------- src/conf_mode/protocols_bgp.py | 8 ------ src/migration-scripts/bgp/7-to-8 | 30 ++++++++++++++++++++++ 4 files changed, 31 insertions(+), 21 deletions(-) create mode 100644 src/migration-scripts/bgp/7-to-8 (limited to 'src/migration-scripts') diff --git a/interface-definitions/include/version/bgp-version.xml.i b/interface-definitions/include/version/bgp-version.xml.i index 21fddf9ae..a283b9dd2 100644 --- a/interface-definitions/include/version/bgp-version.xml.i +++ b/interface-definitions/include/version/bgp-version.xml.i @@ -1,3 +1,3 @@ - + diff --git a/interface-definitions/vrf.xml.in b/interface-definitions/vrf.xml.in index 0d1033e25..3fa95076e 100644 --- a/interface-definitions/vrf.xml.in +++ b/interface-definitions/vrf.xml.in @@ -57,18 +57,6 @@ #include - - - Autonomous System Number (ASN) - DEPRECATED - - u32:1-4294967294 - Autonomous System Number - - - - - - diff --git a/src/conf_mode/protocols_bgp.py b/src/conf_mode/protocols_bgp.py index ab0e7e44a..4e7f09d0e 100755 --- a/src/conf_mode/protocols_bgp.py +++ b/src/conf_mode/protocols_bgp.py @@ -18,7 +18,6 @@ from sys import exit from sys import argv from vyos.base import Warning -from vyos.base import DeprecationWarning from vyos.config import Config from vyos.configverify import has_frr_protocol_in_dict from vyos.configverify import verify_prefix_list @@ -219,13 +218,6 @@ def verify(config_dict): if not system_as: raise ConfigError(ERR_MSG_GLOBAL_VRF_AS_MISSING) - if 'system_as' in bgp: - tmp_as = bgp['system_as'] - DeprecationWarning(f'CLI command "vrf name {vrf} protocols bgp system-as ' \ - f'{tmp_as}" is ignored and will be removed in VyOS 1.5! ' \ - f'\n\nGlobal "protocols bgp system-as {system_as}" option ' \ - 'applies, use per neighbor "local-as" option to override.') - elif 'system_as' not in bgp: raise ConfigError(ERR_MSG_GLOBAL_VRF_AS_MISSING) diff --git a/src/migration-scripts/bgp/7-to-8 b/src/migration-scripts/bgp/7-to-8 new file mode 100644 index 000000000..ced4f837e --- /dev/null +++ b/src/migration-scripts/bgp/7-to-8 @@ -0,0 +1,30 @@ +#!/usr/bin/env python3 +# +# Copyright VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# T7760: Remove per VRF setting for system-as option in VyOS 1.5 and onwards + +from vyos.configtree import ConfigTree + +def migrate(config: ConfigTree) -> None: + vrf_base = ['vrf', 'name'] + if not config.exists(vrf_base): + return + + for vrf in config.list_nodes(vrf_base): + # bail out early if there is no per VRF BGP instance defined + vrf_bgp_base = vrf_base + [vrf, 'protocols', 'bgp'] + if config.exists(vrf_bgp_base + ['system-as']): + config.delete(vrf_bgp_base + ['system-as']) -- cgit v1.2.3