junos_commit_check: add lab and test for Junos prefix normalization enforcement#171
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #171 +/- ##
=======================================
Coverage 83.50% 83.50%
=======================================
Files 87 87
Lines 4165 4165
=======================================
Hits 3478 3478
Misses 687 687
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
…nforcement Add infrastructure to detect and regression-test which Junos configuration contexts reject unnormalized prefixes (host bits set) at commit time. Two layers: - infra/examples/junos-commit-check/: containerlab lab with commit_check_rejects and commit_check_accepts check types for empirical discovery on vJunos - snapshots/junos_commit_check/: CI regression test with per-host test_parse_warnings driven by validation/parse_warnings.yaml Empirical results from vJunos 25.4R1.12: Junos rejects host bits in static route, aggregate route, generate route, OSPF area-range, firewall from-address, firewall next-ip, and condition if-route-exists. Junos accepts host bits in prefix-list, route-filter, SNMP client-list, BGP allow, MPLS LSP install, interface address, and VGA tracking route. All 7 "rejects" cases are sickbayed pending Batfish implementation (batfish/batfish#9928 covers static routes only). Prompt: ``` Read batfish/batfish#9928. The underlying issue is the ability to easily detect, automatically, when Junos will reject a specific piece of syntax. Design a repeatable procedure to do this, and apply it to this problem. ``` commit-id:82759006
anothermattbrown
approved these changes
May 5, 2026
8e96af1 to
c3ae28b
Compare
dhalperi
pushed a commit
to batfish/batfish
that referenced
this pull request
May 6, 2026
Junos commit checks require that static route prefixes be normalized (i.e. not host bits set). Add a fatal red flag warning for that and several other known cases (batfish/lab-validation#171)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add infrastructure to detect and regression-test which Junos configuration
contexts reject unnormalized prefixes (host bits set) at commit time.
Two layers:
commit_check_rejects and commit_check_accepts check types for empirical
discovery on vJunos
test_parse_warnings driven by validation/parse_warnings.yaml
Empirical results from vJunos 25.4R1.12: Junos rejects host bits in
static route, aggregate route, generate route, OSPF area-range, firewall
from-address, firewall next-ip, and condition if-route-exists. Junos
accepts host bits in prefix-list, route-filter, SNMP client-list, BGP
allow, MPLS LSP install, interface address, and VGA tracking route.
All 7 "rejects" cases are sickbayed pending Batfish implementation
(batfish/batfish#9928 covers static routes only).
Prompt: