bgpd: Replace the actual local-as when using replace-as with the confederation

[ton31337]

Closes #21537

[greptile-apps]

Greptile Summary

This PR fixes a bug where remove-private-AS all replace-AS incorrectly used bgp->as (the confederation member AS, e.g. 12345) as the replacement ASN instead of the confederation identifier (e.g. 64512) that external peers actually recognize. The fix introduces asn = peer->change_local_as ?: peer->local_as — since FRR already sets peer->local_as = bgp->confed_id for external peers in a confederation (see bgpd.c:2325), this correctly resolves to the confederation identifier in that case, and also properly honors any local-as X override via change_local_as. A new topotest validates the corrected AS path (64512 64512) seen by the external neighbor.

Confidence Score: 5/5

Safe to merge — targeted, correct fix with proper test coverage and no regression risk for non-confederation deployments.

The fix is minimal and surgically correct: peer->local_as is already set to bgp->confed_id for external confederation peers by the existing bgpd.c logic, so reusing it here is consistent with the rest of the codebase. Non-confederation behavior is unchanged (peer->local_as == bgp->as in that case). The unused bgp parameter is suppressed by FRR's -Wno-unused-parameter flag. All remaining findings are P2 or lower.

No files require special attention.

Important Files Changed

Filename	Overview
bgpd/bgp_route.c	Fixes bgp_peer_remove_private_as to use peer->local_as (which resolves to bgp->confed_id for external confederation peers) instead of bgp->as when replacing private AS numbers, correctly fixing the confederation + replace-AS interaction.
tests/topotests/bgp_confederation_stripped_to_external/test_bgp_confederation_stripped_to_external.py	New topotest that validates the fix: r2 (AS 12345, confederation identifier 64512) applies remove-private-AS all replace-AS toward r3, and r3 should see AS path "64512 64512" instead of "64512 12345".
tests/topotests/bgp_confederation_stripped_to_external/r2/frr.conf	r2 (AS 12345, confederation identifier 64512) is the node under test; applies remove-private-AS all replace-AS to external neighbor r3. Configuration correctly represents the bug scenario.
tests/topotests/bgp_confederation_stripped_to_external/r1/frr.conf	r1 (AS 65004, a private ASN) originates 10.0.0.1/32 and peers with r2 using remote-as 64512 (the confederation identifier). Configuration is correct.
tests/topotests/bgp_confederation_stripped_to_external/r3/frr.conf	r3 (AS 64515) is the external peer that validates the corrected AS path; has debug bgp neigh enabled (benign in test environments).

Sequence Diagram

sequenceDiagram
    participant r1 as r1 (AS 65004)
    participant r2 as r2 (AS 12345 / confed-id 64512)
    participant r3 as r3 (AS 64515)

    r1->>r2: UPDATE 10.0.0.1/32, AS_PATH: 65004
    note over r2: remove-private-AS all replace-AS toward r3
    note over r2: peer->local_as = bgp->confed_id = 64512<br/>(for external peer r3)
    note over r2: BEFORE fix: replaces 65004 with bgp->as=12345<br/>path: 64512 12345 (wrong)
    note over r2: AFTER fix: replaces 65004 with peer->local_as=64512<br/>path: 64512 64512 (correct)
    r2->>r3: UPDATE 10.0.0.1/32, AS_PATH: 64512 64512

Loading

_{Reviews (2): Last reviewed commit: "bgpd: Replace the actual local-as when u..." | Re-trigger Greptile}

[ton31337]

@greptileai seems you mixed something regarding regression... Please, re-evaluate carefully.