Skip to content

frrcfgd: Validate BGP table key components - #29230

Open
ashutosh-agrawal wants to merge 10 commits into
sonic-net:masterfrom
ashutosh-agrawal:validate-frrcfgd-bgp-keys
Open

ashutosh-agrawal wants to merge 10 commits into
sonic-net:masterfrom
ashutosh-agrawal:validate-frrcfgd-bgp-keys

Conversation

@ashutosh-agrawal

@ashutosh-agrawal ashutosh-agrawal commented Aug 27, 2026

Copy link
Copy Markdown
Member

Why I did it

Ensure BGP table keys, ASN attributes, and peer-group references are validated
consistently before entering frrcfgd command processing, queues, or caches.

Work item tracking
  • Microsoft ADO (number only): N/A

How I did it

  • Validate VRF names using the shared swsscommon validator.
  • Parse and normalize IP neighbor addresses.
  • Validate interface neighbors using the shared interface-name check.
  • Validate complete composite key shapes and allow only supported AFI/SAFI values.
  • Require local, remote, and confederation ASN values and lists to be within the modeled 32-bit range.
  • Validate peer-group references with the same command-safe identifier rule used for key components.
  • Reject control characters in neighbor and peer-group command fields while preserving printable free text and the structured command transport's literal-quote behavior.
  • Route runtime updates and unified startup replay through one validation boundary, then revalidate every queued entry before cache or FRR mutation so dependent-table reapply cannot bypass the checks.
  • Validate startup-loaded state and runtime DEVICE_METADATA updates while preserving the last known-good value.
  • Add coverage for accepted boundaries, normalized keys, rejected live updates, unsafe peer-group references, and rejected replay entries.
  • Update sonic-swss-common to include [common]: Add shared VRF name validation sonic-swss-common#1242.

How to verify it

Run from src/sonic-frr-mgmt-framework:

python3 -m pytest --no-cov -q tests

Result: 20 passed.

Which release branch to backport (provide reason below if selected)

  • 202305
  • 202311
  • 202405
  • 202411
  • 202505
  • 202511
  • 202512
  • 202605
  • 202608

Tracking issue/work item for backport/cherry-pick request:
Failure type:

Tested branch

  • master
  • 202305
  • 202311
  • 202405
  • 202411
  • 202505
  • 202511
  • 202512
  • 202605
  • 202608
  • N/A

Test result

  • python3 -m pytest --no-cov -q tests
  • Result: 20 passed

Description for the changelog

Validate BGP table keys, ASN values, and peer-group references before generating FRR configuration.

Link to config_db schema for YANG module changes

N/A

A picture of a cute animal (not mandatory but encouraged)

Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run Azure.sonic-buildimage

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Validate runtime metadata, confederation ASN values, complete BGP table key shapes, and AFI/SAFI components before queue or cache mutation.

Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run Azure.sonic-buildimage

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run Azure.sonic-buildimage

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run Azure.sonic-buildimage

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

…p-keys

Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>

# Conflicts:
#	src/sonic-swss-common
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run Azure.sonic-buildimage

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run Azure.sonic-buildimage

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Comment thread src/sonic-py-common/sonic_py_common/bgp.py Outdated
Comment thread src/sonic-frr-mgmt-framework/frrcfgd/frrcfgd.py Outdated
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run Azure.sonic-buildimage

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

@ashutosh-agrawal

Copy link
Copy Markdown
Member Author

/azpw run

@mssonicbld

Copy link
Copy Markdown
Collaborator

⚠️ Notice: /azpw run only runs failed jobs now. If you want to trigger a whole pipline run, please rebase your branch or close and reopen the PR.
💡 Tip: You can also use /azpw retry to retry failed jobs directly.

Retrying failed(or canceled) jobs...

@mssonicbld

Copy link
Copy Markdown
Collaborator

Retrying failed(or canceled) stages in build 1221392:

✅Stage Test:

  • Job impacted-area-kvmtest-dualtor-aa-vpp by Elastictest: retried.

@deepak-singhal0408

Copy link
Copy Markdown
Contributor

this would also need #29447 to be merged first followed by rebase.

qiluo-msft pushed a commit that referenced this pull request Sep 18, 2026
Why I did it
Several Python components need to apply the same validation when processing BGP ASNs. Keeping those checks in each component makes it easy for their behavior to drift.

Work item tracking
Microsoft ADO (number only):
How I did it
Added a common validate_asn() helper to sonic-py-common.

The helper accepts decimal strings and integer values, rejects booleans and other representations, and checks the 32-bit BGP ASN range. Handling of missing values or component-specific sentinel values remains with the caller.

Added unit coverage for accepted values, range boundaries, invalid types, and invalid decimal representations.

Current consumers being updated to use this helper:

bgpcfgd: Validate DEVICE_METADATA BGP ASN #29226 validates the DEVICE_METADATA BGP ASN before caching it.
frr: Strictly validate isolate BGP ASN #29227 uses it as the sonic-cfggen filter for BGP isolation templates.
frrcfgd: Validate BGP table key components #29230 uses it for BGP ASN fields processed by frrcfgd.
How to verify it
Run:

PYTHONPATH=src/sonic-py-common pytest -q --noconftest src/sonic-py-common/tests/test_bgp.py

Result: 22 passed.
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run Azure.sonic-buildimage

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants