ospfd: add instance shutdown command

[rzalamena]

Introduce the shutdown OSPFv2 instance command to temporally disable an instance and remove all state.

This new command also has the extended functionality when used with graceful restart: it sends grace LSAs to all OSPF enabled interfaces to enable non stop forwarding while the instance is shutdown.

[greptile-apps]

Greptile Summary

This PR introduces a shutdown VTY command for OSPFv2 instances that administratively disables the instance and clears all state, with optional graceful-restart support (grace LSAs sent before teardown to enable non-stop forwarding on helpers). The implementation is well-structured: it correctly guards ospf_if_up against re-entrancy during shutdown, blocks zebra route updates while shut down, adds an opaque-capability pre-check for the GR path, and includes a comprehensive topotest suite covering both plain and GR-assisted shutdown/restart cycles.

Confidence Score: 4/5

Mostly safe to merge; three P2 findings around ISM execution timing, GR timer/state interaction during shutdown, and excess AdjOK? events warrant review before landing.

All three findings are P2 (non-blocking style/correctness suggestions). The SCHEDULE→EXECUTE change in ospf_if_up is the most impactful as it affects all existing callers, not just the new shutdown path, and the interaction between the GR grace-period timer and the shutdown state could produce inelegant state-machine transitions. Score of 4 reflects that these are worth discussing before merge rather than hard blockers.

ospfd/ospf_interface.c (EXECUTE change scope), ospfd/ospfd.c (GR timer during shutdown), ospfd/ospf_ism.c (unconditional DR change during GR)

Important Files Changed

Filename	Overview
ospfd/ospfd.c	New ospf_shutdown() function: sets/clears OSPF_SHUTDOWN flag, tears down interfaces and LSDB on shutdown, spins up interfaces and reoriginates AS-external LSAs on restart. Grace-period timer interaction during extended shutdown is a concern.
ospfd/ospf_vty.c	New ospf_instance_shutdown DEFPY with opaque-capability guard for GR path, config-write support for the shutdown keyword, and proper no shutdown path.
ospfd/ospf_interface.c	Added OSPF_SHUTDOWN guard in ospf_if_up; also changed SCHEDULE→EXECUTE for ISM events, affecting all existing callers beyond the new shutdown feature.
ospfd/ospf_ism.c	Modified ospf_dr_election to always call ospf_dr_change when restart_in_progress; may generate excess AdjOK? events on every DR election across all interface types.
ospfd/ospf_gr.c	Extended ospf_gr_lsa_originate to treat OSPF_GR_SWITCH_CONTROL_PROCESSOR like OSPF_GR_UNKNOWN_RESTART for neighbor-count skip and unplanned flooding paths; correct per RFC 3623 §5.
ospfd/ospf_gr.h	Renamed enum value OSPF_GR_SWITCH_REDUNDANT_CARD → OSPF_GR_SWITCH_CONTROL_PROCESSOR; no remaining references to the old name were found in the codebase.
ospfd/ospf_asbr.c	New ospf_asbr_reoriginate() correctly iterates all external routes and instances, checking connectivity before reoriginating on no shutdown.
ospfd/ospf_zebra.c	Added OSPF_SHUTDOWN guard in ospf_zebra_read_route to suppress zebra route processing while the instance is shut down.
tests/topotests/ospf_shutdown/test_ospf_shutdown.py	New topotest covering basic shutdown, shutdown+no-shutdown adjacency recovery, and GR-assisted shutdown with grace LSA verification.

Sequence Diagram

sequenceDiagram
    participant Operator
    participant ospf_vty
    participant ospf_gr
    participant ospfd
    participant ospf_interface
    participant Zebra

    Operator->>ospf_vty: shutdown (with GR)
    ospf_vty->>ospf_vty: check OSPF_OPAQUE_CAPABLE
    ospf_vty->>ospf_gr: ospf_gr_restart_enter(SWITCH_CONTROL_PROCESSOR, now+grace_period)
    ospf_gr->>ospf_gr: restart_in_progress=true, start grace timer
    ospf_vty->>ospf_gr: ospf_gr_unplanned_start_interface(oi) per interface
    ospf_gr-->>ospf_vty: Grace-LSAs flooded to all interfaces
    ospf_vty->>ospfd: ospf_shutdown(ospf, true)
    ospfd->>ospfd: SET_FLAG OSPF_SHUTDOWN
    ospfd->>ospf_interface: ospf_if_down(oi) per interface
    ospfd->>ospfd: ospf_area_lsdb_discard_delete + lsdb_delete_all
    Note over ospf_gr: Grace period timer running...
    Operator->>ospf_vty: no shutdown
    ospf_vty->>ospfd: ospf_shutdown(ospf, false)
    ospfd->>ospfd: UNSET_FLAG OSPF_SHUTDOWN
    ospfd->>ospf_interface: ospf_if_up(oi) per interface [EXECUTE]
    ospf_interface->>ospf_interface: ISM_InterfaceUp (synchronous)
    ospfd->>ospfd: ospf_asbr_reoriginate()
    ospfd-->>Zebra: AS-external LSAs re-flooded
    ospf_gr->>ospf_gr: GR completes when adjacencies restored or grace period expires

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: ospfd/ospf_interface.c
Line: 857-866

Comment:
**`OSPF_ISM_EVENT_EXECUTE` changes behavior for all existing callers**

The switch from `OSPF_ISM_EVENT_SCHEDULE` (`event_add_event`) to `OSPF_ISM_EVENT_EXECUTE` (`event_execute`) affects every call site of `ospf_if_up`, not just the new shutdown/restart path. Existing callers such as `ospf_router_id_update` (ospfd.c:1118) and the internal down→up cycle at ospf_interface.c:175 now run the ISM state machine synchronously and re-entrantly, whereas before each ISM transition was deferred to the next event-loop iteration. If any of those callers hold shared state that the ISM handler mutates (e.g., neighbor lists, adjacency state), the in-place execution could cause subtle ordering differences. The new `OSPF_SHUTDOWN` guard added on the same line is clearly necessary; the EXECUTE change should be split out and justified separately if intentional for all call sites.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: ospfd/ospfd.c
Line: 2408-2425

Comment:
**Grace period timer can fire while OSPF instance is still shut down**

When `shutdown` is issued with GR enabled, `ospf_gr_restart_enter` starts a grace-period countdown timer (`t_grace_period`). If `no shutdown` is never issued (or is delayed beyond the grace period), `ospf_gr_grace_period_expired` fires while `OSPF_SHUTDOWN` is set and calls `ospf_gr_restart_exit`. That function calls `ospf_router_lsa_update_area` on every area (LSDB was just cleared) and schedules `ospf_spf_calculate_schedule(ospf, SPF_FLAG_GR_FINISH)` while setting `gr_info.finishing_restart = true`. If `no shutdown` is then issued after the timer has already fired, the instance starts with `restart_in_progress = false` and `finishing_restart` potentially still set, causing the GR-finish SPF to race with normal startup SPF runs. Adding a guard in `ospf_gr_grace_period_expired` (or `ospf_gr_restart_exit`) that skips the restart-exit logic when `OSPF_SHUTDOWN` is set would make the state machine cleaner.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: ospfd/ospf_ism.c
Line: 232-234

Comment:
**`ospf_dr_change` triggered on every DR election during GR restart**

Adding `|| oi->ospf->gr_info.restart_in_progress` to the condition means `ospf_dr_change` (and consequently `ospf_nbr_adj_ok` for every neighbor) is called on every invocation of `ospf_dr_election` while the instance is in GR restart — even on point-to-point links or when there are no neighbors. On a busy topology this produces spurious AdjOK? events per DR election cycle until `restart_in_progress` is cleared. Consider narrowing the condition to broadcast/NBMA interfaces where DR election actually matters, or only triggering when neighbors are present (`ospf_interface_neighbor_count(oi) > 0`).

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (3): Last reviewed commit: "tests: topology test for OSPFv2 shutdown" | Re-trigger Greptile}

[rzalamena]

@greptileai

[rzalamena]

@greptileai

[riw777]

looks good