On the subject of "set comm-list xxx delete", The Fine Manual (page 61)
says:
"For communities value deletion, only permit community-list
is used. deny community-list is ignored."
AFAICS this is true "up to a point". What actually happens is that when
a "deny" entry in the community-list matches the communities, processing
of the community-list ceases. If the "deny" entry does not match, it is
(indeed) ignored.
I am not qualified to suggest whether this is a documentation or a code
SNAFU... but I guess it does what it does and everybody is used to that
?
Separately, it's understood that:
ip community-list 120 permit/deny internet
means permit/deny anything/everything (including an empty community
attribute)...
...but for "set comm-list xxx delete" the code will:
* "permit" => delete the internet community if it is there.
Should it delete everything ?
I'm not 100% convinced that the "internet" pseudo-value
should actually appear in your actual community attribute,
given that 0:0 to 0:65535 are all "reserved" ?
* "deny" => unconditionally terminate the community-list.
This seems consistent with the notion that everything which
remains should be kept (ie. not deleted).
FWIW, I note that the Cisco semantics for "deny" entries is fun. In
particular:
ip community-list 120 deny 100:50
ip community-list 120 permit 100:.*
may be expected to delete all 100:.* except for 100:50, which looks
useful and reasonably obvious ! But I guess it's too late to change
Quagga to do that now ?
BTW, running "100:.*" through the regular expression engine has the
happy, or possibly unhappy, effect of matching (inter alia) 100:10 and
32100:10. I guess that's what everybody expects/wants ?
I imagine that any old regex, say "(^| )(100|200|300):.*? 1234:\d*?666(
|$)", is expected to do exactly what it says (as currently implemented
by Quagga) ? But I note that it would do nothing at all if used with
"set comm-list xxx delete" (as currently implemented by Quagga). Or
does one expect that, say, "100:.* 200:.*" is actually a "wild-card"
version of "100:10 200:10" ?
Returning to the Fine Manual, it also says that with this configured:
ip community-list standard DEL permit 100:1 100:2
route-map RMAP permit 10
set comm-list DEL delete
"value 100:1 and 100:2 is removed"... which doesn't quite capture the
subtlety that 100:1 and 100:2 are both removed, iff *both* are present.
In this context, Cisco get twitchy about multiple community values in an
"ip community-list" when used with "set comm-list xxx delete", which I
have some sympathy with, simplicity-of-semantics-wise. Though it's not
clear what happens if you do use an inappropriate "ip community-list",
<sigh>.
Chris
PS: IMHO, I feel that using a regex for these things is rather like
using a machine-pistol to enforce discipline in a kindergarten: it'll
probably work, but you may not be completely happy with the result.
_______________________________________________
Quagga-dev mailing list
[email protected]
https://lists.quagga.net/mailman/listinfo/quagga-dev
