Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)

[rohit-rp]

System Test Plan see for more info: b/540867175

• Objective: Validate device-level hardware adherence to controller routing intent. If a programmed gRIBI tunnel next-hop goes down (invalid/disconnected), the device must strictly honor the programmed FIB route and blackhole the traffic, rather than autonomously falling back to a less-specific native route.
  • Interfaces Used: gRIBI, gNMI, BGP/ISIS
  • Expected Outcome Summary:
    • Traffic follows a specific gRIBI-injected tunnel route.
    • The physical port or interface associated with the tunnel's next-hop is brought down.
    • Because the gRIBI route was not explicitly withdrawn by the controller, it remains the longest prefix match in the hardware FIB.
    • Traffic matching the prefix is strictly blackholed (dropped) at the device level.
    • No autonomous fallback to an overlapping, less-specific BGP underlay route occurs.
    • gNMI AFT telemetry accurately reflects that the route remains programmed, but hardware counters reflect dropping packets.
  • Success Metrics:
    • 100% of affected traffic is blackholed with no leakage into the native BGP underlay.
    • Controller-programmed routing intent overrides default hardware behaviors.

[OpenConfigBot]

Pull Request Functional Test Report for #5993 / f1da792

Virtual Devices

Device	Test	Test Documentation	Job	Raw Log
Arista cEOS		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)	62e231db	Log
Cisco 8000E		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)	8e63271f	Log
Cisco XRd		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)	2289295c	Log
Juniper ncPTX		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)	0f87e811	Log
Nokia SR Linux		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)	e2d0b82d	Log
Openconfig Lemming		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)	f99e566f	Log

Hardware Devices

Device	Test	Test Documentation	Raw Log
Arista		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)
Cisco		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)
Juniper		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)
Nokia		TE-1.22: Traffic Blackhole on gRIBI Invalid Next-Hop (Strict FIB Precedence)

Help

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new system test plan designed to verify device-level hardware adherence to controller routing intent via gRIBI. The primary goal is to ensure that when a specific gRIBI tunnel next-hop is disabled, the device correctly blackholes the traffic rather than reverting to less-specific BGP underlay routes. This validates that controller-programmed routing intent takes precedence over default hardware behaviors.

Highlights

• New System Test Plan: Added a comprehensive test plan (TE-1.22) to validate strict FIB precedence when a gRIBI-programmed next-hop becomes invalid.
• Traffic Blackhole Validation: The test ensures that traffic is strictly blackholed by the device when the gRIBI next-hop is down, preventing autonomous fallback to native BGP underlay routes.
• Test Registry Update: Registered the new test case in the global test registry for tracking and execution.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a new test plan (TE-1.22) to validate traffic blackholing on gRIBI invalid next-hops under strict FIB precedence, adding a detailed README, metadata, and registering the test. The review feedback correctly identifies style guide violations and mathematical errors in the IPv4 prefix definitions within the test plan, specifically pointing out the use of disallowed IP blocks, incorrect subnetting logic for generating 1,000 distinct prefixes, and a typo in a destination IP address. The reviewer provided actionable suggestions to use the compliant 100.64.0.0/10 block and vary the second and third octets instead.

[AmrNJ]

LGTM.

[singhavnish2516]

LGTM