Merge branch 'main' into otg-rt-5.14

Author: mihaitomaro

.github/workflows/test_gap_analysis.yaml

@@ -1,4 +1,3 @@
-# .github/workflows/test_gap_analysis.yaml
 name: FNT Gap Analysis
 
 on:
@@ -10,29 +9,36 @@ permissions: {}
 jobs:
   gap_analysis_test:
     runs-on: ubuntu-latest
+    env:
+      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
     permissions:
       contents: read
       pull-requests: read
     steps:
+      - name: Show skip message
+        if: ${{ env.GEMINI_API_KEY == '' }}
+        run: echo "No access to Gemini, skipping test."
       - name: Checkout code
+        if: ${{ env.GEMINI_API_KEY != '' }}
         uses: actions/checkout@v4
         with:
           fetch-depth: 0 # Needed for changed-files action to diff against base branch
 
       - name: Set up Go
+        if: ${{ env.GEMINI_API_KEY != '' }}
         uses: actions/setup-go@v5
         with:
           go-version: '1.21'
 
       - name: Get changed files
+        if: ${{ env.GEMINI_API_KEY != '' }}
         id: changed-files-pr
         uses: tj-actions/changed-files@v44
         with:
           separator: ','
 
       - name: Run Gap Analysis Script
-        env:
-          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+        if: ${{ env.GEMINI_API_KEY != '' }}
         run: |
           echo "--- Building and Running FNT Gap Analysis ---"
           go build -o gap-analyzer tools/gap-analyzer/read_fnttests.go

feature/acl/otg_tests/acl_large_scale/acl_large_scale_test.go

@@ -918,7 +918,7 @@ func testv4AddressScale(t *testing.T, dut *ondatra.DUTDevice, ate *ondatra.ATEDe
 	}
 
 	for _, acl := range aclConfigs {
-		if deviations.ConfigAclOcUnsupported(dut) {
+		if deviations.ConfigACLOcUnsupported(dut) {
 			switch dut.Vendor() {
 			case ondatra.ARISTA:
 				aclTarfficPolicy := cfgplugins.ACLTrafficPolicyParams{
@@ -945,7 +945,7 @@ func testv4AddressScale(t *testing.T, dut *ondatra.DUTDevice, ate *ondatra.ATEDe
 	}
 
 	// Verification of ACL on interfaces as Ingress & Egress
-	if !deviations.ConfigAclOcUnsupported(dut) {
+	if !deviations.ConfigACLOcUnsupported(dut) {
 		var expectedACLs = []struct {
 			Name    string
 			Ingress bool
@@ -1152,7 +1152,7 @@ func testv6AddressScale(t *testing.T, dut *ondatra.DUTDevice, ate *ondatra.ATEDe
 	}
 
 	for _, acl := range aclConfigs {
-		if deviations.ConfigAclOcUnsupported(dut) {
+		if deviations.ConfigACLOcUnsupported(dut) {
 			switch dut.Vendor() {
 			case ondatra.ARISTA:
 				aclTarfficPolicy := cfgplugins.ACLTrafficPolicyParams{
@@ -1179,7 +1179,7 @@ func testv6AddressScale(t *testing.T, dut *ondatra.DUTDevice, ate *ondatra.ATEDe
 	}
 
 	// Verify ACL is applied on the interfaces
-	if !deviations.ConfigAclOcUnsupported(dut) {
+	if !deviations.ConfigACLOcUnsupported(dut) {
 		var expectedACLs = []struct {
 			Name    string
 			Ingress bool
@@ -1317,7 +1317,7 @@ func testv6AddressScale(t *testing.T, dut *ondatra.DUTDevice, ate *ondatra.ATEDe
 }
 
 func testv4PrefixList(t *testing.T, dut *ondatra.DUTDevice, ate *ondatra.ATEDevice, otgConfig *otg.OTG, config gosnappi.Config) {
-	if !deviations.ConfigAclOcUnsupported(dut) {
+	if !deviations.ConfigACLOcUnsupported(dut) {
 		// Remove the ACL configs from interface
 		removeAClOnInterface(t, dut, "port1")
 		removeAClOnInterface(t, dut, "port2")

feature/afts/otg_tests/afts_atomic/afts_atomic_test.go

@@ -241,6 +241,9 @@ func (tc *testCase) waitForISISAdjacency(t *testing.T) error {
 	}
 
 	dutPort := tc.dut.Port(t, port1Name).Name()
+	if deviations.InterfaceRefInterfaceIDFormat(tc.dut) {
+		dutPort = dutPort + ".0"
+	}
 	adjPath := isisPath.Interface(dutPort).Level(2).AdjacencyAny()
 	if _, ok := gnmi.WatchAll(t, tc.dut, adjPath.AdjacencyState().State(), gnmiTimeout, verifyAdjacencyState).Await(t); !ok {
 		return fmt.Errorf("no ISIS adjacency formed for port1 (%s)", dutPort)

feature/afts/otg_tests/afts_atomic/metadata.textproto

@@ -41,6 +41,7 @@ platform_exceptions: {
     isis_level_enabled: true
     multipath_unsupported_neighbor_or_afisafi: true
     explicit_interface_in_default_vrf: true
+    interface_ref_interface_id_format: true
   }
 }
 

feature/afts/otg_tests/afts_reboot/afts_reboot_test.go

@@ -244,6 +244,9 @@ func (tc *testCase) waitForISISAdjacency(t *testing.T) error {
 		return state == oc.Isis_IsisInterfaceAdjState_UP
 	}
 	dutPort := tc.dut.Port(t, port1Name).Name()
+	if deviations.InterfaceRefInterfaceIDFormat(tc.dut) {
+		dutPort = dutPort + ".0"
+	}
 	adjPath := isisPath.Interface(dutPort).Level(2).AdjacencyAny()
 	if _, ok := gnmi.WatchAll(t, tc.dut, adjPath.AdjacencyState().State(), gnmiTimeout, verifyAdjacencyState).Await(t); !ok {
 		return fmt.Errorf("no ISIS adjacency formed for port1 (%s)", dutPort)

feature/afts/otg_tests/afts_reboot/metadata.textproto

@@ -41,5 +41,6 @@ platform_exceptions: {
     isis_level_enabled: true
     multipath_unsupported_neighbor_or_afisafi: true
     explicit_interface_in_default_vrf: true
+    interface_ref_interface_id_format: true
   }
 }

feature/bgp/otg_tests/bgp_disable_peer_as_filter_test/README.md

@@ -0,0 +1,164 @@
+# RT-1.71: BGP Disable Peer AS Filter (`disable-peer-as-filter`)
+
+## Summary
+
+Verifies BGP disable-peer-as-filter functionality for both IPv4 and IPv6 Unicast sessions. This feature ensures that a router can accept routes from an eBGP peer even if the receiving router's own AS is present in the AS-PATH.
+
+## Testbed type
+
+* [TESTBED_DUT_ATE_2LINKS](https://github.com/openconfig/featureprofiles/blob/main/topologies/ate_tests/base_2link_topology.testbed)
+
+## Topology
+
+```mermaid
+flowchart LR
+    subgraph ATE ["Automated Test Equipment"]
+        ATE1(["Port 1 AS 64496"])
+        ATE2(["Port 2 AS 64497"])
+    end
+
+    subgraph DUT_Domain ["Device Under Test"]
+        DUT(["DUT AS 64498"])
+    end
+
+    ATE1 <-->|eBGP| DUT
+    DUT <-->|eBGP| ATE2
+```
+
+* **ATE Port 1** (AS 64496) connects to the **DUT** (AS 64498) via eBGP.
+* **DUT** (AS 64498) connects to **ATE Port 2** (AS 64497) via eBGP.
+
+## Test environment setup
+
+1. Configure eBGP sessions (IPv4 and IPv6) between ATE Port 1, DUT, and ATE Port 2.
+2. Use the following RFC-compliant addresses:
+    * **Link 1 (ATE1 - DUT):** `192.0.2.0/30`, `2001:db8::1/126`
+    * **Link 2 (ATE2 - DUT):** `198.51.100.0/30`, `2001:db8::5/126`
+
+
+## Procedure
+
+### RT-1.71.1: Baseline Test (Default Filtering)
+
+1. Establish eBGP sessions (IPv4 and IPv6) between ATE Port 1, DUT, and ATE Port 2.
+2. Advertise a prefix (e.g., `192.0.2.100/32` and `2001:db8:64:64::1/64`) from ATE Port 1 with an AS-PATH containing the target peer's AS (`64497`) in the middle (e.g., AS-PATH: `64496 64497 64499`).
+3. Verify that the DUT **does not advertise** the route to ATE Port 2.
+4. Verify that ATE Port 2 **does not receive** the route.
+
+### RT-1.71.2: Test `disable-peer-as-filter = TRUE` (Transit AS)
+
+1. Enable `disable-peer-as-filter` on the DUT's neighbor/peer-group configuration towards ATE Port 2 (AS 64497).
+2. Re-advertise the prefixes from ATE Port 1 with the same AS-PATH (`64496 64497 64499`).
+3. Verify that the DUT **advertises** the route to ATE Port 2.
+4. Verify that ATE Port 2 **receives** the route.
+5. Validate for both IPv4 and IPv6 families.
+
+### RT-1.71.3: Test "Originating Peer AS"
+
+1. Ensure `disable-peer-as-filter` is enabled on the DUT's neighbor configuration towards ATE Port 2.
+2. Advertise a prefix from ATE Port 1 with an AS-PATH where the target peer's AS (`64497`) is the **originating AS** (e.g., AS-PATH: `64496 64499 64497`).
+3. Verify that the DUT **advertises** the route to ATE Port 2.
+4. Verify that ATE Port 2 **receives** the route.
+5. Validate session state and capabilities received on DUT using telemetry.
+
+
+### RT-1.71.4: Private AS Number Scenario
+
+```mermaid
+graph LR
+    subgraph ATE ["ATE"]
+        direction TB
+        ATE1["Port 1<br/>(AS 64496)"]
+        ATE2["Port 2<br/>(AS 64512)"]
+    end
+
+    subgraph DUT_Domain ["DUT"]
+        DUT["DUT<br/>(AS 64498)"]
+    end
+
+    %% Advertisement Flow for RT-1.71.4
+    ATE1 -- "Advertise Prefix<br/>(AS-PATH: 64496 64499 64512)" --> DUT
+    DUT -- "Propagate to Peer with<br/>AS 64512 in PATH" --> ATE2
+```
+
+1. Configure **ATE Port 2** with a private AS number (e.g., `64512`).
+2. Configure the **DUT** (AS `64498`) with `disable-peer-as-filter = TRUE` on the neighbor configuration towards ATE Port 2.
+3. Advertise a prefix from **ATE Port 1** with an AS-PATH that includes ATE Port 2's AS (e.g., AS-PATH: `64496 64499 64512`).
+4. Verify that the DUT **advertises** the route to ATE Port 2 (AS 64512).
+5. Verify that ATE Port 2 **receives** the route.
+
+### RT-1.71.5: Test "Peer-group and Neighbor level"
+
+Ensure the tests are performed for BGP configuration at the Peer-group as well as at the Neighbor levels
+
+## Canonical OC
+
+```json
+{
+  "network-instances": {
+    "network-instance": [
+      {
+        "name": "DEFAULT",
+        "config": {
+          "name": "DEFAULT"
+        },
+        "protocols": {
+          "protocol": [
+            {
+              "identifier": "BGP",
+              "name": "BGP",
+              "config": {
+                "identifier": "BGP",
+                "name": "BGP"
+              },
+              "bgp": {
+                "peer-groups": {
+                  "peer-group": [
+                    {
+                      "peer-group-name": "BGP-PEER-GROUP1",
+                      "config": {
+                        "peer-group-name": "BGP-PEER-GROUP1"
+                      },
+                      "as-path-options": {
+                        "config": {
+                          "disable-peer-as-filter": true
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
+```
+
+## OpenConfig Path and RPC Coverage
+
+```yaml
+paths:
+  ## Config paths
+  /network-instances/network-instance/protocols/protocol/bgp/peer-groups/peer-group/as-path-options/config/disable-peer-as-filter:
+  /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/as-path-options/config/disable-peer-as-filter:
+
+  ## State paths
+  /network-instances/network-instance/protocols/protocol/bgp/peer-groups/peer-group/as-path-options/state/disable-peer-as-filter:
+  /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/as-path-options/state/disable-peer-as-filter:
+  /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/state/session-state:
+
+rpcs:
+  gnmi:
+    gNMI.Set:
+      union_replace: true
+    gNMI.Subscribe:
+      on_change: true
+```
+
+## Required DUT platform
+
+* vRX - virtual router device
+

feature/bgp/otg_tests/bgp_disable_peer_as_filter_test/metadata.textproto

@@ -0,0 +1,7 @@
+# proto-file: github.com/openconfig/featureprofiles/proto/metadata.proto
+# proto-message: Metadata
+
+uuid: "0a9bd744-53e0-4152-bb30-ef23d5c3fe78"
+plan_id: "RT-1.71"
+description: "BGP Disable Peer AS Filter (`disable-peer-as-filter`)"
+testbed: TESTBED_DUT_ATE_2LINKS

feature/bgp/otg_tests/bgp_remove_private_as/bgp_remove_private_as_test.go

@@ -140,9 +140,12 @@ func configureDUT(t *testing.T, dut *ondatra.DUTDevice) {
 func verifyPortsUp(t *testing.T, dev *ondatra.Device) {
 	t.Helper()
 	for _, p := range dev.Ports() {
-		status := gnmi.Get(t, dev, gnmi.OC().Interface(p.Name()).OperStatus().State())
-		if want := oc.Interface_OperStatus_UP; status != want {
-			t.Errorf("%s Status: got %v, want %v", p, status, want)
+		_, ok := gnmi.Watch(t, dev, gnmi.OC().Interface(p.Name()).OperStatus().State(), time.Minute, func(val *ygnmi.Value[oc.E_Interface_OperStatus]) bool {
+			state, ok := val.Val()
+			return ok && state == oc.Interface_OperStatus_UP
+		}).Await(t)
+		if !ok {
+			t.Errorf("Interface not UP for port %s", p.Name())
 		}
 	}
 }
@@ -254,11 +257,19 @@ func verifyPrefixesTelemetry(t *testing.T, dut *ondatra.DUTDevice, nbr string, w
 	t.Helper()
 	statePath := gnmi.OC().NetworkInstance(deviations.DefaultNetworkInstance(dut)).Protocol(oc.PolicyTypes_INSTALL_PROTOCOL_TYPE_BGP, "BGP").Bgp()
 	prefixesv4 := statePath.Neighbor(nbr).AfiSafi(oc.BgpTypes_AFI_SAFI_TYPE_IPV4_UNICAST).Prefixes()
-	if gotInstalled := gnmi.Get(t, dut, prefixesv4.Installed().State()); gotInstalled != wantInstalled {
-		t.Errorf("Installed prefixes mismatch on %v: got %v, want %v", nbr, gotInstalled, wantInstalled)
+	_, ok := gnmi.Watch(t, dut, prefixesv4.Installed().State(), 2*time.Minute, func(val *ygnmi.Value[uint32]) bool {
+		gotInstalled, ok := val.Val()
+		return ok && gotInstalled == wantInstalled
+	}).Await(t)
+	if !ok {
+		t.Errorf("Installed prefixes mismatch on %v, got %v, want %v", nbr, gnmi.Get(t, dut, prefixesv4.Installed().State()), wantInstalled)
 	}
-	if gotSent := gnmi.Get(t, dut, prefixesv4.Sent().State()); gotSent != wantSent {
-		t.Errorf("Sent prefixes mismatch on %v: got %v, want %v", nbr, gotSent, wantSent)
+	_, ok = gnmi.Watch(t, dut, prefixesv4.Sent().State(), 2*time.Minute, func(val *ygnmi.Value[uint32]) bool {
+		gotSent, ok := val.Val()
+		return ok && gotSent == wantSent
+	}).Await(t)
+	if !ok {
+		t.Errorf("Sent prefixes mismatch on %v:, got %v, want %v", nbr, gnmi.Get(t, dut, prefixesv4.Sent().State()), wantSent)
 	}
 }
 

feature/bgp/policybase/otg_tests/link_bandwidth_test/link_bandwidth_test.go

@@ -277,11 +277,14 @@ func enableExtCommunityCLIConfig(t *testing.T, dut *ondatra.DUTDevice) {
 		var extCommunityEnableCLIConfig string
 		switch dut.Vendor() {
 		case ondatra.CISCO:
-			extCommunityEnableCLIConfig = fmt.Sprintf("router bgp %v instance BGP neighbor-group %v \n ebgp-recv-extcommunity-dmz \n ebgp-send-extcommunity-dmz\n", dutAS, cfgplugins.BGPPeerGroup1)
+			extCommunityEnableCLIConfig = fmt.Sprintf("router bgp %v instance BGP neighbor  %v \n ebgp-recv-extcommunity-dmz \n ebgp-send-extcommunity-dmz\n", dutAS, atePort1.IPv4)
+			helpers.GnmiCLIConfig(t, dut, extCommunityEnableCLIConfig)
+			time.Sleep(10 * time.Second)
+			extCommunityEnableCLIConfig = fmt.Sprintf("router bgp %v instance BGP neighbor  %v \n ebgp-recv-extcommunity-dmz \n ebgp-send-extcommunity-dmz\n", dutAS, atePort1.IPv6)
+			helpers.GnmiCLIConfig(t, dut, extCommunityEnableCLIConfig)
 		default:
 			t.Fatalf("Unsupported vendor %s for deviation 'BgpExplicitExtendedCommunityEnable'", dut.Vendor())
 		}
-		helpers.GnmiCLIConfig(t, dut, extCommunityEnableCLIConfig)
 	}
 }
 
@@ -333,6 +336,9 @@ func applyExportPolicyDut(t *testing.T, dut *ondatra.DUTDevice, policyName strin
 	root := &oc.Root{}
 	dni := deviations.DefaultNetworkInstance(dut)
 	removeImportAndExportPolicy(t, dut)
+	if deviations.ExplicitlyApplyAllowAllImportPolicy(dut) {
+		applyImportPolicyDut(t, dut, "allow-all")
+	}
 
 	// Apply ipv4 policy to bgp neighbour.
 	path := gnmi.OC().NetworkInstance(dni).Protocol(oc.PolicyTypes_INSTALL_PROTOCOL_TYPE_BGP, bgpName).Bgp().Neighbor(atePort2.IPv4).AfiSafi(oc.BgpTypes_AFI_SAFI_TYPE_IPV4_UNICAST).ApplyPolicy()
@@ -361,7 +367,7 @@ func applyExportPolicyDut(t *testing.T, dut *ondatra.DUTDevice, policyName strin
 func validateImportPolicyDut(t *testing.T, dut *ondatra.DUTDevice, td testData, policyName string) {
 	dni := deviations.DefaultNetworkInstance(dut)
 	path := gnmi.OC().NetworkInstance(dni).Protocol(oc.PolicyTypes_INSTALL_PROTOCOL_TYPE_BGP, bgpName).Bgp().Neighbor(atePort1.IPv4).AfiSafi(oc.BgpTypes_AFI_SAFI_TYPE_IPV4_UNICAST).ApplyPolicy()
-	_, ok := gnmi.Watch(t, dut, path.State(), 30*time.Second, func(v *ygnmi.Value[*oc.NetworkInstance_Protocol_Bgp_Neighbor_AfiSafi_ApplyPolicy]) bool {
+	_, ok := gnmi.Watch(t, dut, path.State(), 2*time.Minute, func(v *ygnmi.Value[*oc.NetworkInstance_Protocol_Bgp_Neighbor_AfiSafi_ApplyPolicy]) bool {
 		value, ok := v.Val()
 		if !ok {
 			return false
@@ -817,7 +823,20 @@ func configureExtCommunityRoutingPolicy(t *testing.T, dut *ondatra.DUTDevice) {
 		case ondatra.CISCO:
 			var communityCLIConfig string
 			communityCLIConfig = fmt.Sprintf("community-set %v\n dfa-regex '%v', \n match invert \n end-set", "regex_match_comm100", communitySet["regex_match_comm100"])
-			policySetCLIConfig := fmt.Sprintf("route-policy %v \n #statement-1 1-megabit-match \n if community is-empty then \n pass \n elseif community in %v then \n set extcommunity bandwidth %v \n endif \n pass \n #statement-2 accept_all_routes \n done \n  end-policy", "not_match_100_set_linkbw_1M", "regex_match_comm100", "linkbw_1M")
+			policySetCLIConfig := fmt.Sprintf(
+				"route-policy %v \n"+
+					" #statement-1 1-megabit-match \n"+
+					" if community in %v then \n"+
+					"  set extcommunity bandwidth %v \n"+
+					" endif \n"+
+					" pass \n"+
+					" #statement-2 accept_all_routes \n"+
+					" done \n"+
+					"end-policy",
+				"not_match_100_set_linkbw_1M",
+				"regex_match_comm100",
+				"linkbw_1M",
+			)
 			helpers.GnmiCLIConfig(t, dut, communityCLIConfig)
 			helpers.GnmiCLIConfig(t, dut, policySetCLIConfig)
 		default: