Page MenuHomeVyOS Platform

route-map allows both IPv4 and IPv6 in one rule which never match
Closed, InvalidPublicBUG

Description

Example - two prefix lists, one IPv4 and one IPv6:

set policy prefix-list LIST4 rule 10 action 'permit'
set policy prefix-list LIST4 rule 10 le '24'
set policy prefix-list LIST4 rule 10 prefix '192.0.2.0/23'
set policy prefix-list LIST4 rule 100 action 'deny'
set policy prefix-list LIST4 rule 100 le '32'
set policy prefix-list LIST4 rule 100 prefix '0.0.0.0/0'
set policy prefix-list6 LIST6 rule 10 action 'permit'
set policy prefix-list6 LIST6 rule 10 le '48'
set policy prefix-list6 LIST6 rule 10 prefix '2001:db8::/32'
set policy prefix-list6 LIST6 rule 100 action 'deny'
set policy prefix-list6 LIST6 rule 100 le '128'
set policy prefix-list6 LIST6 rule 100 prefix '::/0'

Trying to match IPv4 or IPv6 routes in a single rule, like this:

set policy route-map MAP rule 10 action 'permit'
set policy route-map MAP rule 10 match ip address prefix-list 'LIST4'
set policy route-map MAP rule 10 match ipv6 address prefix-list 'LIST6'

doesn't give any warning, but never matches any routes - to work as expected, it needs to be rewritten as:

set policy route-map MAP rule 10 action 'permit'
set policy route-map MAP rule 10 match ip address prefix-list 'LIST4'
set policy route-map MAP rule 20 action 'permit'
set policy route-map MAP rule 20 match ipv6 address prefix-list 'LIST6'

Silently never matching any routes (as if it was AND instead of OR between the two matches in the same rule) seems counter-intuitive.
Up to you to decide - please document this, make it OR instead of AND, or give a warning that it doesn't work to match both IPv4 and IPv6 prefix lists in the same rule.
Making it OR allows fewer rules in dual-stack configs, helpful if they also prepend AS path, set local preference etc. But I'm not sure what other router vendors do.
I've actually got bitten by this (made a mistake expecting both IPv4 and IPv6 to work in the same rule) when setting up peering with an IXP.

Details

Version
1.3.2
Is it a breaking change?
Stricter validation
Issue type
Documentation update

Event Timeline

We use FRR as the backend and it uses logical AND for match entries