Page MenuHomeVyOS Platform

Problems with backslash character in policy as-path-lists
Not ApplicablePublicBUG

Description

I tried to create a bogon as-path list within vyos and stumbled over the problem that you cannot use the backspace character within a regex expression.

Steps to reproduce:

  • install a fresh VyOS 1.5-rolling (2025-11-11)
  • add the following config and commit:
set policy as-path-list bogon rule 10 regex '\s'
set policy as-path-list bogon rule 10 action permit

The following error appears:

[ policy ]
[3962|mgmtd] sending configuration [3963|zebra] sending configuration
[3964|ripd] sending configuration [3965|ripngd] sending configuration
[3966|ospfd] sending configuration [3967|ospf6d] sending configuration
[3968|ldpd] sending configuration [3969|bgpd] sending configuration
[3970|isisd] sending configuration [3964|ripd] done [3972|nhrpd] sending
configuration [3965|ripngd] done [3962|mgmtd] done [3974|babeld] sending
configuration [3966|ospfd] done Invalid character in as-path access-list
\s line 3: Failure to communicate[13] to bgpd, line: bgp as-path access-
list bogon seq 10 permit \s  [3976|fabricd] sending configuration
[3977|watchfrr] sending configuration [3969|bgpd] Configuration
file[/etc/frr/frr.conf] processing failure: 13 [3963|zebra] done
[3972|nhrpd] done [3968|ldpd] done [3970|isisd] done [3967|ospf6d] done
[3979|staticd] sending configuration [3980|bfdd] sending configuration
[3977|watchfrr] done Waiting for children to finish applying config...
[3983|pim6d] sending configuration [3976|fabricd] done [3980|bfdd] done
[3979|staticd] done [3974|babeld] done [3983|pim6d] done [3987|mgmtd]
sending configuration [3988|zebra] sending configuration [3989|ripd]
sending configuration [3990|ripngd] sending configuration [3991|ospfd]
sending configuration [3992|ospf6d] sending configuration [3993|ldpd]
sending configuration [3994|bgpd] sending configuration [3987|mgmtd]
done [3995|isisd] sending configuration [3989|ripd] done [3993|ldpd]
done [3997|nhrpd] sending configuration [3990|ripngd] done [3999|babeld]
sending configuration [3988|zebra] done [4001|fabricd] sending
configuration [3991|ospfd] done [3992|ospf6d] done [4002|watchfrr]
sending configuration [3995|isisd] done Invalid character in as-path
access-list \s line 3: Failure to communicate[13] to bgpd, line: bgp as-
path access-list bogon seq 10 permit \s  Invalid character in as-path
access-list \s line 11: Failure to communicate[13] to bgpd, line: bgp
as-path access-list bogon seq 10 permit \s  [3997|nhrpd] done
[4004|staticd] sending configuration [4005|bfdd] sending configuration
[3999|babeld] done [3994|bgpd] Configuration file[/etc/frr/frr.conf]
processing failure: 13 Waiting for children to finish applying config...
[4008|pim6d] sending configuration [4001|fabricd] done [4002|watchfrr]
done [4005|bfdd] done [4004|staticd] done [4008|pim6d] done
[[policy]] failed
Commit failed

To me it looks like the single quotation characters (') gets converted to double quotation marks (") and maybe the backslash gets interpreted then?

Tested on different rolling release version including the latest one.

The problem here is that with regex it's essential to have the backslash usable.

Details

Version
VyOS 2025.11.11-0020-rolling
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

It seems more like a problem of FRR.
I went through the Jinja template for that part and in my case it would generate

bgp as-path access-list bogon seq 10 permit \s

When trying this directly in vtysh I get the error:
Invalid character in as-path access-list \s

I have not found so far a information for FRR how it handles the backslash or if it must be encoded in some way.

adestis updated the task description. (Show Details)

I think we can close this issue.
It seems as FRR has a special implementation of regex, even when they say POSIX 1003.2 regex compatibility because some things are different, like the _ character.

For anybody else stumbling on it:
Go to vtysh and try the regex there, e.g. sh ip bgp regexp (_[0-9]+){5,}

adestis closed this task as Not Applicable.Wed, Nov 12, 8:00 AM
adestis claimed this task.