Skip to content

bgpd: preserve cli configured VPN export RT on router-id update#22603

Open
kaffarell wants to merge 1 commit into
FRRouting:masterfrom
kaffarell:push-zotnxvvypwwz
Open

bgpd: preserve cli configured VPN export RT on router-id update#22603
kaffarell wants to merge 1 commit into
FRRouting:masterfrom
kaffarell:push-zotnxvvypwwz

Conversation

@kaffarell

@kaffarell kaffarell commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

rt vpn both is stored internally as separate import and export RT lists. On router-id updates, bgpd re-derives the VPN RD/RT and overwrites the export RT with an RT derived from the current export RD.

This broke configurations such as:

 rd vpn export 65000:6
 rt vpn both 65000:100

After a router-id update, the import RT stayed 65000:100, but the export RT was replaced with 65000:6. The running config then appeared as split import/export RTs and VPN import matching no longer worked as configured.

Add a "CLI set" flag for the VPN export RT, set/clear it from the RT CLI, and skip automatic export RT derivation when the export RT was explicitly configured. Also do the same thing to the VRF-to-VRF auto RT setup and last-unimport cleanup, so explicit (cli-set) RT/RD values survive removing and re-adding import vrf.

Note that the router-id import-vrf RT refresh still removes only the first RT value before merging the current export RT list. This behavior already existed beforehand (the old code also removed ecom->val only) so I left it unchanged.

Fixes: #22579

`rt vpn both` is stored internally as separate import and export RT
lists. On router-id updates, bgpd re-derives the VPN RD/RT and
overwrites the export RT with an RT derived from the current export RD.

This broke configurations such as:

 rd vpn export 65000:6
 rt vpn both 65000:100

After a router-id update, the import RT stayed `65000:100`, but the
export RT was replaced with `65000:6`. The running config then appeared
as split import/export RTs and VPN import matching no longer worked
as configured.

Add a "CLI set" flag for the VPN export RT, set/clear it from the
RT CLI, and skip automatic export RT derivation when the export RT
was explicitly configured. Also do the same thing to the VRF-to-VRF auto
RT setup and last-unimport cleanup, so explicit (cli-set) RT/RD values
survive removing and re-adding `import vrf`.

Note that the router-id import-vrf RT refresh still removes only the
first RT value before merging the current export RT list. This behavior
already existed beforehand (the old code also removed `ecom->val` only)
so I left it unchanged.

Fixes: FRRouting#22579
Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
@greptile-apps

greptile-apps Bot commented Jul 8, 2026

Copy link
Copy Markdown

Greptile Summary

This PR preserves manually configured VPN export RTs across bgpd refresh paths. The main changes are:

  • Adds an export RT CLI-owned flag to VPN policy state.
  • Sets and clears that flag from rt vpn export and rt vpn both CLI handling.
  • Skips automatic export RT re-derivation when the RT was configured by CLI.
  • Preserves CLI-owned export RT/RD values when the last import vrf is removed.

Confidence Score: 5/5

This looks safe to merge.

  • No blocking issues found in the changed code.

Important Files Changed

Filename Overview
bgpd/bgp_mplsvpn.c Adds CLI-owned RT checks to router-id refresh, import-vrf setup, and last-unimport cleanup.
bgpd/bgp_vty.c Sets and clears the new export RT ownership flag from RT CLI commands.
bgpd/bgpd.h Defines the new VPN policy flag used to mark CLI-configured export RTs.

Reviews (1): Last reviewed commit: "bgpd: preserve cli configured VPN export..." | Re-trigger Greptile

@routingrocks

Copy link
Copy Markdown
Contributor

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bgpd: rt vpn export overwritten with RD on daemon restart (same root cause as #18987)

2 participants