Page MenuHomeVyOS Platform

route-map allows both IPv4 and IPv6 in one rule which never match
Closed, InvalidPublicBUG

Description

Example - two prefix lists, one IPv4 and one IPv6:

set policy prefix-list LIST4 rule 10 action 'permit'
set policy prefix-list LIST4 rule 10 le '24'
set policy prefix-list LIST4 rule 10 prefix '192.0.2.0/23'
set policy prefix-list LIST4 rule 100 action 'deny'
set policy prefix-list LIST4 rule 100 le '32'
set policy prefix-list LIST4 rule 100 prefix '0.0.0.0/0'
set policy prefix-list6 LIST6 rule 10 action 'permit'
set policy prefix-list6 LIST6 rule 10 le '48'
set policy prefix-list6 LIST6 rule 10 prefix '2001:db8::/32'
set policy prefix-list6 LIST6 rule 100 action 'deny'
set policy prefix-list6 LIST6 rule 100 le '128'
set policy prefix-list6 LIST6 rule 100 prefix '::/0'

Trying to match IPv4 or IPv6 routes in a single rule, like this:

set policy route-map MAP rule 10 action 'permit'
set policy route-map MAP rule 10 match ip address prefix-list 'LIST4'
set policy route-map MAP rule 10 match ipv6 address prefix-list 'LIST6'

doesn't give any warning, but never matches any routes - to work as expected, it needs to be rewritten as:

set policy route-map MAP rule 10 action 'permit'
set policy route-map MAP rule 10 match ip address prefix-list 'LIST4'
set policy route-map MAP rule 20 action 'permit'
set policy route-map MAP rule 20 match ipv6 address prefix-list 'LIST6'

Silently never matching any routes (as if it was AND instead of OR between the two matches in the same rule) seems counter-intuitive.
Up to you to decide - please document this, make it OR instead of AND, or give a warning that it doesn't work to match both IPv4 and IPv6 prefix lists in the same rule.
Making it OR allows fewer rules in dual-stack configs, helpful if they also prepend AS path, set local preference etc. But I'm not sure what other router vendors do.
I've actually got bitten by this (made a mistake expecting both IPv4 and IPv6 to work in the same rule) when setting up peering with an IXP.

Details

Difficulty level
Easy (less than an hour)
Version
1.3.2
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Stricter validation
Issue type
Documentation update

Event Timeline

We use FRR as the backend and it uses logical AND for match entries