Pr3559 - #3583
Merged
Merged
Conversation
Add proto API for configuring TCP-AO for peers, and retrieval of peer-level TCP-AO state. Signed-off-by: Rastislav Szabo <rastislav.szabo@isovalent.com>
Add OpenConfig-based TCP-AO configuartion hooks for neighbors and peer-groups. We keep TCP-AO config at the neighbor and peer-group level (along with TTL security and BFD config), not in the TransportConfig, since transport changes cause peer re-configuration and TCP-AO preferred key can change frequently during the peer lifetime.
Wire TCP-AO peer proto API and OpenConfig configuration hooks.
The TCP-AO peer model marks send-id mandatory but leaves keychain optional, which is backwards. The keychain reference is what attaches a peer to a key set, and an empty keychain is what the Go side reads as "TCP-AO not configured". So the model demanded the leaf that only has meaning once a keychain is named, and allowed the one that enables the feature to be omitted. Both leaves sit inside the tcp-ao presence container, so RFC 7950 section 3 keeps the mandatory node from propagating past it and section 7.17 does not require a when statement on the augment. bgp_configs.go needs no regeneration because bgpyang2golang.py never reads mandatory. Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Whether a peer uses TCP-AO is decided by the keychain string alone. An empty keychain makes the conversion emit no API message, and a send-id set without a keychain is dropped with it. That rule lived only in an early return, where nothing stated it was deliberate. Send-id 0 needs pinning down for the same reason. RFC 5925 section 3.1 says "MKT IDs MUST support any value, 0-255 inclusive. There are no reserved ID values.", so 0 names the key with SendID 0 rather than standing in for "not set". Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
proto3 has no 8-bit integer, so send_id crosses the API as a uint32 and the conversion to the config model has to reject anything a KeyID cannot hold. RFC 5925 section 3.1 says "MKT IDs MUST support any value, 0-255 inclusive. There are no reserved ID values.", which puts the interesting cases right at the boundary: 0 and 255 must pass and 256 must not. Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
OverwriteNeighborConfigWithPeerGroup had no tests, so the peer group fallback for the new tcp-ao container was unverified. Dropping its overwriteConfig call would have gone unnoticed. The fallback also works per leaf, driven by which keys the config file actually set. A neighbor that names only a keychain still takes send-id from its peer group, which is worth stating because the two leaves read like one setting. Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.