From b1f920457dc8ac62c36fae492cc3aa3ec10d051d Mon Sep 17 00:00:00 2001 From: Jose Phillips Date: Thu, 7 May 2026 11:40:42 -0500 Subject: T8823: validation of GE and LE according FRR instructions --- src/conf_mode/policy.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'src') diff --git a/src/conf_mode/policy.py b/src/conf_mode/policy.py index 689365724..4da884e3e 100755 --- a/src/conf_mode/policy.py +++ b/src/conf_mode/policy.py @@ -167,6 +167,23 @@ def verify(config_dict): if 'prefix' not in rule_config: raise ConfigError(f'A prefix {mandatory_error}') + mask_len = int(rule_config['prefix'].split('/')[1]) + ge = int(rule_config['ge']) if 'ge' in rule_config else None + le = int(rule_config['le']) if 'le' in rule_config else None + + if ge is not None and ge < mask_len: + raise ConfigError( + f'{policy_hr} {instance} rule {rule}: "ge" ({ge}) must be >= ' + f'prefix length ({mask_len})') + if le is not None and le < mask_len: + raise ConfigError( + f'{policy_hr} {instance} rule {rule}: "le" ({le}) must be >= ' + f'prefix length ({mask_len})') + if ge is not None and le is not None and ge > le: + raise ConfigError( + f'{policy_hr} {instance} rule {rule}: "ge" ({ge}) must be <= ' + f'"le" ({le})') + if rule_config in entries: raise ConfigError( f'Rule "{rule}" contains a duplicate prefix definition!') -- cgit v1.2.3 From 35d40d7f4d9d95e7754d41c3f97efd4ef20c0625 Mon Sep 17 00:00:00 2001 From: Jose Phillips Date: Thu, 7 May 2026 11:40:42 -0500 Subject: T8823: validation of GE and LE according FRR instructions --- smoketest/scripts/cli/test_policy.py | 1 + src/conf_mode/policy.py | 9 ++++++--- 2 files changed, 7 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/smoketest/scripts/cli/test_policy.py b/smoketest/scripts/cli/test_policy.py index eee04eb9b..304bbdbc8 100755 --- a/smoketest/scripts/cli/test_policy.py +++ b/smoketest/scripts/cli/test_policy.py @@ -709,6 +709,7 @@ class TestPolicy(VyOSUnitTestSHIM.TestCase): for rule in test_range: tmp = f'ip prefix-list {prefix_list} seq {rule} permit {prefix} le {rule}' self.assertIn(tmp, config) + def test_prefix_list_ge_le_validation(self): # FRR requires mask_length <= ge <= le for prefix-list rules base = base_path + ['prefix-list', 'getest', 'rule', '10'] diff --git a/src/conf_mode/policy.py b/src/conf_mode/policy.py index 4da884e3e..c9398848a 100755 --- a/src/conf_mode/policy.py +++ b/src/conf_mode/policy.py @@ -174,15 +174,18 @@ def verify(config_dict): if ge is not None and ge < mask_len: raise ConfigError( f'{policy_hr} {instance} rule {rule}: "ge" ({ge}) must be >= ' - f'prefix length ({mask_len})') + f'prefix length ({mask_len})' + ) if le is not None and le < mask_len: raise ConfigError( f'{policy_hr} {instance} rule {rule}: "le" ({le}) must be >= ' - f'prefix length ({mask_len})') + f'prefix length ({mask_len})' + ) if ge is not None and le is not None and ge > le: raise ConfigError( f'{policy_hr} {instance} rule {rule}: "ge" ({ge}) must be <= ' - f'"le" ({le})') + f'"le" ({le})' + ) if rule_config in entries: raise ConfigError( -- cgit v1.2.3 From 72bf69a9eaeeaecd86b39d536582a204029af72b Mon Sep 17 00:00:00 2001 From: Jose Phillips Date: Thu, 7 May 2026 15:12:07 -0500 Subject: T8823: Used dictionary search --- src/conf_mode/policy.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/conf_mode/policy.py b/src/conf_mode/policy.py index c9398848a..90ecc4a4c 100755 --- a/src/conf_mode/policy.py +++ b/src/conf_mode/policy.py @@ -168,8 +168,10 @@ def verify(config_dict): raise ConfigError(f'A prefix {mandatory_error}') mask_len = int(rule_config['prefix'].split('/')[1]) - ge = int(rule_config['ge']) if 'ge' in rule_config else None - le = int(rule_config['le']) if 'le' in rule_config else None + ge = dict_search('ge', rule_config) + le = dict_search('le', rule_config) + ge = int(ge) if ge is not None else None + le = int(le) if le is not None else None if ge is not None and ge < mask_len: raise ConfigError( -- cgit v1.2.3 From df2a81b27971ec9bb2596adfa25405e537516ac4 Mon Sep 17 00:00:00 2001 From: Jose Phillips Date: Thu, 7 May 2026 16:01:29 -0500 Subject: T8823: Removed nullchecks because dict_Search return None if value not set --- src/conf_mode/policy.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/conf_mode/policy.py b/src/conf_mode/policy.py index 90ecc4a4c..171ef23fd 100755 --- a/src/conf_mode/policy.py +++ b/src/conf_mode/policy.py @@ -170,20 +170,18 @@ def verify(config_dict): mask_len = int(rule_config['prefix'].split('/')[1]) ge = dict_search('ge', rule_config) le = dict_search('le', rule_config) - ge = int(ge) if ge is not None else None - le = int(le) if le is not None else None - if ge is not None and ge < mask_len: + if ge and int(ge) < mask_len: raise ConfigError( f'{policy_hr} {instance} rule {rule}: "ge" ({ge}) must be >= ' f'prefix length ({mask_len})' ) - if le is not None and le < mask_len: + if le and int(le) < mask_len: raise ConfigError( f'{policy_hr} {instance} rule {rule}: "le" ({le}) must be >= ' f'prefix length ({mask_len})' ) - if ge is not None and le is not None and ge > le: + if ge and le and int(ge) > int(le): raise ConfigError( f'{policy_hr} {instance} rule {rule}: "ge" ({ge}) must be <= ' f'"le" ({le})' -- cgit v1.2.3