Skip to content

junos_then_action_conflicts: resolve next-term vs next-policy precedence #190

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dhalperi merged 1 commit into from
May 20, 2026
Merged

junos_then_action_conflicts: resolve next-term vs next-policy precedence #190

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 36 additions & 10 deletions snapshots/junos_then_action_conflicts/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ sender (AS 65001) --- dut (AS 65002) --- collector (AS 65003)
10.0.12.0 10.0.12.1 10.0.23.0 10.0.23.1
```

Sender originates 108 `/24` test prefixes, each tagged with a unique
Sender originates 112 `/24` test prefixes, each tagged with a unique
marker community `65001:<term-id>`. Dut's import policy has one term
per conflict shape. Collector observes what propagates (§5 flow-control
terms).
Expand Down Expand Up @@ -60,10 +60,12 @@ sequentially in source order (see below).
For any attribute family where Junos's data model holds at most one
value per route — origin, preference, tag, color, priority, next-hop
(IP form), source-class, external, local-preference, metric, metric2,
load-balance, install-nexthop, and the same-family `as-path-prepend×2`
or `as-path-expand×2` — when two actions in the same `then` target the
same attribute, the **last action wins** at commit time and the prior
is silently dropped. Identical duplicates collapse to one (dedup).
load-balance, install-nexthop, the same-family `as-path-prepend×2`
or `as-path-expand×2`, and the named-disposition family containing
both `next term` and `next policy` — when two actions in the same
`then` target the same attribute, the **last action wins** at commit
time and the prior is silently dropped. Identical duplicates collapse
to one (dedup).

Within numeric attributes (lp/metric/metric2), this absorbs every
combination of `set`/`add`/`subtract` and the metric-only `expression`
Expand Down Expand Up @@ -109,9 +111,20 @@ both commit time and runtime:
`accept; community add X` retains as `community add X; accept`.
2. **Same-family last-wins among bare terminators.** `accept; reject`
keeps `reject` only; `reject; accept` keeps `accept` only (§5
rows 4001, 4002). Different-family pairings (e.g.,
`default-action accept; bare reject`) keep both lines in retained
config.
rows 4001, 4002).
3. **`next term` and `next policy` are the same family.** A `then`
block holds at most one of them: dedup collapses `next term;
next term` to one `next term`, and `next policy; next policy` to
one `next policy` (rows 4011, 4012). When both forms appear in
the same `then`, last-wins applies — `next term; next policy`
retains `next policy`, and `next policy; next term` retains
`next term` (rows 4013, 4014). The retained line, not the
author's first line, is what runs.
4. **Different-family pairings.** `default-action accept` paired with
a bare `accept`/`reject` keeps both lines in retained config; the
bare terminator wins at runtime. `next term`/`next policy` paired
with a bare `accept`/`reject` keeps both lines as well; the
`next term`/`next policy` wins at runtime.

**Runtime ordering** observable from §5's collector RIB:

Expand All @@ -120,6 +133,12 @@ both commit time and runtime:
- `next term` beats bare `accept` regardless of source order — both
lines exist in retained config but the route falls through (rows
4003, 4004 do not propagate to collector).
- `next term` (alone or as the surviving NT/NP collapse) jumps to the
next term, where `REJECT-OTHER` drops the route — no propagation
to collector (rows 4011, 4014).
- `next policy` (alone or as the surviving NT/NP collapse) returns
the route to BGP processing; with no further policies, the route
is accepted and propagates to collector (rows 4012, 4013).
- `default-action *` is overridden by any bare terminator in the same
`then`. `accept; default-action reject` → route propagates (accept
fires, default-action reject is a no-op when a terminator already
Expand Down Expand Up @@ -281,6 +300,10 @@ next-hop-map NAME { ... }` to be defined (not the more obvious
| 4008 | 10.50.167.0 | FC-REJECT-THEN-DEFAULT-ACTION-ACCEPT | community add MARK-A; reject; community add MARK-B; default-action accept | community add MARK-A; community add MARK-B; default-action accept; reject | partial collapse |
| 4009 | 10.50.168.0 | FC-ACCEPT-THEN-SIDE-EFFECT | community add MARK-A; accept; community add MARK-B | community add MARK-A; community add MARK-B; accept | all retained |
| 4010 | 10.50.169.0 | FC-TWO-SIDE-EFFECTS-THEN-ACCEPT | community add MARK-A; community add MARK-B; accept | community add MARK-A; community add MARK-B; accept | all retained |
| 4011 | 10.50.170.0 | FC-NEXT-TERM-DEDUP | community add MARK-A; next term; community add MARK-B; next term | community add MARK-A; community add MARK-B; next term | dedup |
| 4012 | 10.50.171.0 | FC-NEXT-POLICY-DEDUP | community add MARK-A; next policy; community add MARK-B; next policy | community add MARK-A; community add MARK-B; next policy | dedup |
| 4013 | 10.50.172.0 | FC-NEXT-TERM-THEN-NEXT-POLICY | community add MARK-A; next term; community add MARK-B; next policy | community add MARK-A; community add MARK-B; next policy | last-wins |
| 4014 | 10.50.173.0 | FC-NEXT-POLICY-THEN-NEXT-TERM | community add MARK-A; next policy; community add MARK-B; next term | community add MARK-A; community add MARK-B; next term | last-wins |

### §6

Expand All @@ -300,8 +323,11 @@ next-hop-map NAME { ... }` to be defined (not the more obvious

- **Source configs (post-push, full)**:
`source/configs/{dut,sender,collector}.cfg` — what the lab device
actually loaded, with the 7 commit-rejected terms preserved as
`/* COMMIT-REJECTED */` comment blocks.
actually loaded. Any commit-rejected terms would be preserved as
`/* COMMIT-REJECTED */` comment blocks (none on the current
vJunos-router build; the BGP-OUTPUT-QUEUE-PRIORITY actions are
dropped at load time, not commit time, so the term itself commits
with only its `accept` surviving).
- **Bootstrap configs (minimal)**:
`source/build/bootstrap/{dut,sender,collector}.cfg` — what
containerlab boots with. The full IMPORT/EXPORT terms are pushed
Expand Down
4 changes: 2 additions & 2 deletions snapshots/junos_then_action_conflicts/configs/collector/show_configuration_|_display_set.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
set version 25.4R1.12
set system host-name collector
set system root-authentication encrypted-password "$6$UCQdHt3z$mnBkidyllnUwzvy7C.uGkr8z0WGu4/CCfcse0ZraVJG/ifny78BEtFx8Pwxks4eon8RWjpK2SFeUt7My7G6X1."
set system root-authentication encrypted-password "$6$5ThV9Pk1$2Kk5GNukpXn1aR/cpAR.1QOW4UHaohU0AVGwPt7Oa.HMb6NVhTQVusF1H1l2qU7xx9KZLCuymEH27yyN3pkdv."
set system login user admin uid 2000
set system login user admin class super-user
set system login user admin authentication encrypted-password "$6$kl.yc4ER$lTXycrxiQc8zebRcQwDTuEqCqS6YOcGJwbmmiFZDZiSisvPFUqXAnMMO7TefjcnBvE.oZl24.Z5CFZvvEykhn."
set system login user admin authentication encrypted-password "$6$8bxm1/Xb$HSqJ57a7S7IMzLkEfUbv7voOCvmRN5ewg0pgr6L49Rk/t22YllA/kepSRT.HU3ewPzPb4/XDuKIoxcZ9Vfrc.0"
set system services netconf ssh
set system services ssh root-login allow
set system management-instance
Expand Down
20 changes: 18 additions & 2 deletions snapshots/junos_then_action_conflicts/configs/dut/show_configuration_|_display_set.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
set version 25.4R1.12
set system host-name dut
set system root-authentication encrypted-password "$6$bnzmSlSK$wX4DmWSSCcmTQqVrwRwDid8c6EtRfV55M6USV71zaTfc3PvkvNdJfb3B6Wk.KS5kmIjlp8C/Bkkt9QGL74HDn1"
set system root-authentication encrypted-password "$6$vwpCs/Us$u.QipSxB/PtgHjOt2OFcmAwzVn/ag7Eais1jpaM5038Ys.H18zW3dHNSx/MPyQW1HSyZnAO0vG.Wh01.Z6GpX0"
set system login user admin uid 2000
set system login user admin class super-user
set system login user admin authentication encrypted-password "$6$dDOoC83.$1mGTdbqzHOFejDP0Mmzri4lvEj2IQw7J4ORDWTdHgPZlChJVZw/Ul80PNiNmIXTnUVr3xdSJjjHhnfGQZxsKY/"
set system login user admin authentication encrypted-password "$6$yse7ioXf$rGF6bBoSnRlNVhuQkNfIzF7Mthbr8eBjLWJGvjzz2Ud9hOFo45d4oxLBbZuGxtRT9qBvDMv5jz1obzFf94ASg0"
set system services netconf ssh
set system services ssh root-login allow
set system management-instance
Expand Down Expand Up @@ -369,6 +369,22 @@ set policy-options policy-statement IMPORT term FC-TWO-SIDE-EFFECTS-THEN-ACCEPT
set policy-options policy-statement IMPORT term FC-TWO-SIDE-EFFECTS-THEN-ACCEPT then community add MARK-A
set policy-options policy-statement IMPORT term FC-TWO-SIDE-EFFECTS-THEN-ACCEPT then community add MARK-B
set policy-options policy-statement IMPORT term FC-TWO-SIDE-EFFECTS-THEN-ACCEPT then accept
set policy-options policy-statement IMPORT term FC-NEXT-TERM-DEDUP from route-filter 10.50.170.0/24 exact
set policy-options policy-statement IMPORT term FC-NEXT-TERM-DEDUP then community add MARK-A
set policy-options policy-statement IMPORT term FC-NEXT-TERM-DEDUP then community add MARK-B
set policy-options policy-statement IMPORT term FC-NEXT-TERM-DEDUP then next term
set policy-options policy-statement IMPORT term FC-NEXT-POLICY-DEDUP from route-filter 10.50.171.0/24 exact
set policy-options policy-statement IMPORT term FC-NEXT-POLICY-DEDUP then community add MARK-A
set policy-options policy-statement IMPORT term FC-NEXT-POLICY-DEDUP then community add MARK-B
set policy-options policy-statement IMPORT term FC-NEXT-POLICY-DEDUP then next policy
set policy-options policy-statement IMPORT term FC-NEXT-TERM-THEN-NEXT-POLICY from route-filter 10.50.172.0/24 exact
set policy-options policy-statement IMPORT term FC-NEXT-TERM-THEN-NEXT-POLICY then community add MARK-A
set policy-options policy-statement IMPORT term FC-NEXT-TERM-THEN-NEXT-POLICY then community add MARK-B
set policy-options policy-statement IMPORT term FC-NEXT-TERM-THEN-NEXT-POLICY then next policy
set policy-options policy-statement IMPORT term FC-NEXT-POLICY-THEN-NEXT-TERM from route-filter 10.50.173.0/24 exact
set policy-options policy-statement IMPORT term FC-NEXT-POLICY-THEN-NEXT-TERM then community add MARK-A
set policy-options policy-statement IMPORT term FC-NEXT-POLICY-THEN-NEXT-TERM then community add MARK-B
set policy-options policy-statement IMPORT term FC-NEXT-POLICY-THEN-NEXT-TERM then next term
set policy-options policy-statement IMPORT term FWD-LOAD-BALANCE-DUPLICATE-DIFF from route-filter 10.50.180.0/24 exact
set policy-options policy-statement IMPORT term FWD-LOAD-BALANCE-DUPLICATE-DIFF then load-balance consistent-hash
set policy-options policy-statement IMPORT term FWD-LOAD-BALANCE-DUPLICATE-DIFF then accept
Expand Down
28 changes: 26 additions & 2 deletions snapshots/junos_then_action_conflicts/configs/sender/show_configuration_|_display_set.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
set version 25.4R1.12
set system host-name sender
set system root-authentication encrypted-password "$6$oBQkSH1K$7HtBgvlCycZpvxPjwLfW7H1pg38nCvbCXhNIKTbqzX/7mSmPXzsSXeL.xvQxxaTVXyUwqRtpSMtqch40xstWN/"
set system root-authentication encrypted-password "$6$nUyU/vR0$6UWXdgRRshQavZ/laWtJsH.T80EEgf1H3aiu.nnT8VPo/YcmpE9S3Ch.M1qD4IrkrMPFVwkUlfi7nVtigVh3C0"
set system login user admin uid 2000
set system login user admin class super-user
set system login user admin authentication encrypted-password "$6$PQ/yQQ9p$dM2kx5L8c2j7mYXtuG5UTePOrevQ5TfzCKtoIaEksAwwx7lqjs7QMONlrEkluPwSrZdflk0wfpRF2dnVt8lM/."
set system login user admin authentication encrypted-password "$6$ApwNwNt7$WNnCfn4T.n6iyktszWwwJ3RRMIGDIL8xwtlV9OqKTxIZLQUiMT4X.L7k/36rfnXbZ9HekY3vuivswMbO4oypF1"
set system services netconf ssh
set system services ssh root-login allow
set system management-instance
Expand Down Expand Up @@ -438,6 +438,22 @@ set policy-options policy-statement EXPORT-TO-DUT term TAG-4010 from protocol st
set policy-options policy-statement EXPORT-TO-DUT term TAG-4010 from route-filter 10.50.169.0/24 exact
set policy-options policy-statement EXPORT-TO-DUT term TAG-4010 then community add MARK-4010
set policy-options policy-statement EXPORT-TO-DUT term TAG-4010 then accept
set policy-options policy-statement EXPORT-TO-DUT term TAG-4011 from protocol static
set policy-options policy-statement EXPORT-TO-DUT term TAG-4011 from route-filter 10.50.170.0/24 exact
set policy-options policy-statement EXPORT-TO-DUT term TAG-4011 then community add MARK-4011
set policy-options policy-statement EXPORT-TO-DUT term TAG-4011 then accept
set policy-options policy-statement EXPORT-TO-DUT term TAG-4012 from protocol static
set policy-options policy-statement EXPORT-TO-DUT term TAG-4012 from route-filter 10.50.171.0/24 exact
set policy-options policy-statement EXPORT-TO-DUT term TAG-4012 then community add MARK-4012
set policy-options policy-statement EXPORT-TO-DUT term TAG-4012 then accept
set policy-options policy-statement EXPORT-TO-DUT term TAG-4013 from protocol static
set policy-options policy-statement EXPORT-TO-DUT term TAG-4013 from route-filter 10.50.172.0/24 exact
set policy-options policy-statement EXPORT-TO-DUT term TAG-4013 then community add MARK-4013
set policy-options policy-statement EXPORT-TO-DUT term TAG-4013 then accept
set policy-options policy-statement EXPORT-TO-DUT term TAG-4014 from protocol static
set policy-options policy-statement EXPORT-TO-DUT term TAG-4014 from route-filter 10.50.173.0/24 exact
set policy-options policy-statement EXPORT-TO-DUT term TAG-4014 then community add MARK-4014
set policy-options policy-statement EXPORT-TO-DUT term TAG-4014 then accept
set policy-options policy-statement EXPORT-TO-DUT term TAG-5001 from protocol static
set policy-options policy-statement EXPORT-TO-DUT term TAG-5001 from route-filter 10.50.180.0/24 exact
set policy-options policy-statement EXPORT-TO-DUT term TAG-5001 then community add MARK-5001
Expand Down Expand Up @@ -556,6 +572,10 @@ set policy-options community MARK-4007 members 65001:4007
set policy-options community MARK-4008 members 65001:4008
set policy-options community MARK-4009 members 65001:4009
set policy-options community MARK-4010 members 65001:4010
set policy-options community MARK-4011 members 65001:4011
set policy-options community MARK-4012 members 65001:4012
set policy-options community MARK-4013 members 65001:4013
set policy-options community MARK-4014 members 65001:4014
set policy-options community MARK-5 members 65001:5
set policy-options community MARK-5001 members 65001:5001
set policy-options community MARK-5002 members 65001:5002
Expand Down Expand Up @@ -675,6 +695,10 @@ set routing-options static route 10.50.166.0/24 discard
set routing-options static route 10.50.167.0/24 discard
set routing-options static route 10.50.168.0/24 discard
set routing-options static route 10.50.169.0/24 discard
set routing-options static route 10.50.170.0/24 discard
set routing-options static route 10.50.171.0/24 discard
set routing-options static route 10.50.172.0/24 discard
set routing-options static route 10.50.173.0/24 discard
set routing-options static route 10.50.180.0/24 discard
set routing-options static route 10.50.181.0/24 discard
set routing-options static route 10.50.182.0/24 discard
Expand Down
32 changes: 16 additions & 16 deletions snapshots/junos_then_action_conflicts/show/collector/show_bgp_neighbor_|_display_json.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"attributes" : {"junos:style" : "detail"},
"peer-address" : [
{
"data" : "10.0.23.0+179"
"data" : "10.0.23.0+61140"
}
],
"peer-as" : [
Expand All @@ -17,7 +17,7 @@
],
"local-address" : [
{
"data" : "10.0.23.1+62704"
"data" : "10.0.23.1+179"
}
],
"local-as" : [
Expand Down Expand Up @@ -127,8 +127,8 @@
],
"elapsed-time" : [
{
"data" : "8:08",
"attributes" : {"junos:seconds" : "488"}
"data" : "6:20",
"attributes" : {"junos:seconds" : "380"}
}
],
"recv-ebgp-origin-validation-state" : [
Expand Down Expand Up @@ -287,17 +287,17 @@
],
"active-prefix-count" : [
{
"data" : "99"
"data" : "101"
}
],
"received-prefix-count" : [
{
"data" : "100"
"data" : "102"
}
],
"accepted-prefix-count" : [
{
"data" : "100"
"data" : "102"
}
],
"suppressed-prefix-count" : [
Expand Down Expand Up @@ -366,34 +366,34 @@
],
"bgp-nlri-recv-time" : [
{
"data" : "1"
"data" : "0"
}
]
}
],
"last-received" : [
{
"data" : "4"
"data" : "12"
}
],
"last-sent" : [
{
"data" : "2"
"data" : "25"
}
],
"last-checked" : [
{
"data" : "488"
"data" : "381"
}
],
"input-messages" : [
{
"data" : "115"
"data" : "113"
}
],
"input-updates" : [
{
"data" : "96"
"data" : "98"
}
],
"input-refreshes" : [
Expand All @@ -403,12 +403,12 @@
],
"input-octets" : [
{
"data" : "6095"
"data" : "6151"
}
],
"output-messages" : [
{
"data" : "19"
"data" : "15"
}
],
"output-updates" : [
Expand All @@ -423,7 +423,7 @@
],
"output-octets" : [
{
"data" : "365"
"data" : "289"
}
],
"bgp-output-queue" : [
Expand Down
Loading
Loading