frr: Strictly validate isolate BGP ASN - #29227
Open
ashutosh-agrawal wants to merge 7 commits into
Open
ashutosh-agrawal wants to merge 7 commits into
ashutosh-agrawal wants to merge 7 commits into
Conversation
Ensure the isolate and unisolate scripts render a numeric BGP ASN before passing their command streams to vtysh. Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
ashutosh-agrawal
requested review from
StormLiangMS and
lguohan
as code owners
August 27, 2026 18:09
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
ashutosh-agrawal
changed the title
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Member
Author
|
/azpw run |
Collaborator
|
Retrying failed(or canceled) jobs... |
Collaborator
|
Retrying failed(or canceled) stages in build 1204992: ✅Stage Test:
|
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
20 tasks
qiluo-msft
pushed a commit
that referenced
this pull request
Sep 18, 2026
Why I did it Several Python components need to apply the same validation when processing BGP ASNs. Keeping those checks in each component makes it easy for their behavior to drift. Work item tracking Microsoft ADO (number only): How I did it Added a common validate_asn() helper to sonic-py-common. The helper accepts decimal strings and integer values, rejects booleans and other representations, and checks the 32-bit BGP ASN range. Handling of missing values or component-specific sentinel values remains with the caller. Added unit coverage for accepted values, range boundaries, invalid types, and invalid decimal representations. Current consumers being updated to use this helper: bgpcfgd: Validate DEVICE_METADATA BGP ASN #29226 validates the DEVICE_METADATA BGP ASN before caching it. frr: Strictly validate isolate BGP ASN #29227 uses it as the sonic-cfggen filter for BGP isolation templates. frrcfgd: Validate BGP table key components #29230 uses it for BGP ASN fields processed by frrcfgd. How to verify it Run: PYTHONPATH=src/sonic-py-common pytest -q --noconftest src/sonic-py-common/tests/test_bgp.py Result: 22 passed.
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
The isolate and unisolate templates expect
DEVICE_METADATA|localhostbgp_asnto be numeric, but currently render its value directly into their generated routing command streams. Strictly validate the value during template rendering so malformed input stops rendering instead of being coerced into a different BGP instance.Work item tracking
How I did it
sonic-cfggen.isolate.j2andunisolate.j2.(missing ASN, JSON null, or the existing case-insensitive
none/nullsentinels).
out-of-range, Unicode, oversized, and sentinel-lookalike values fail
rendering for both templates.
How to verify it
cd src/sonic-bgpcfgd && pytest -q tests/test_sonic-cfggen.py::test_isolate_templates_validate_bgp_asnResult:
1 passed.Which release branch to backport (provide reason below if selected)
Tracking issue/work item for backport/cherry-pick request (GitHub issue or Microsoft ADO):
Failure type: other
Tested branch
Test result
1 passed)Description for the changelog
Strictly validate the BGP ASN when rendering the isolate and unisolate scripts.
Link to config_db schema for YANG module changes
N/A - no YANG or CONFIG_DB schema change.
A picture of a cute animal (not mandatory but encouraged)