Add ENABLE_FRR_SNMP_AGENT build option to disable BGP4-MIB

dockers/docker-fpm-frr/Dockerfile.j2

@@ -43,7 +43,9 @@ RUN chown -R ${frr_user_uid}:${frr_user_gid} /etc/frr/
 
 COPY ["frr", "/usr/share/sonic/templates"]
 COPY ["docker_init.sh", "/usr/bin/"]
+{% if enable_frr_snmp_agent == "y" %}
 COPY ["snmp.conf", "/etc/snmp/frr.conf"]
+{% endif %}
 COPY ["TSA", "/usr/bin/TSA"]
 COPY ["TSB", "/usr/bin/TSB"]
 COPY ["TSC", "/usr/bin/TSC"]

dockers/docker-fpm-frr/frr/bgpd/bgpd.conf.j2

@@ -12,7 +12,9 @@
 !
 {% include "common/daemons.common.conf.j2" %}
 !
+{% if not (constants is defined and constants.frr is defined and constants.frr.enable_snmp_agent is defined and not constants.frr.enable_snmp_agent) %}
 agentx
+{% endif %}
 !
 {% if DEVICE_METADATA['localhost']['type'] == "SpineChassisFrontendRouter" %}
 {%  include "bgpd.spine_chassis_frontend_router.conf.j2" %}

dockers/docker-fpm-frr/frr/frr.conf.j2

@@ -9,7 +9,9 @@
 {% include "common/daemons.common.conf.j2" %}
 {% from "common/functions.conf.j2" import get_ipv4_loopback_address, get_ipv6_loopback_address %}
 !
+{% if not (constants is defined and constants.frr is defined and constants.frr.enable_snmp_agent is defined and not constants.frr.enable_snmp_agent) %}
 agentx
+{% endif %}
 !
 {% include "zebra/zebra.interfaces.conf.j2" %}
 !

dockers/docker-fpm-frr/frr/supervisord/supervisord.conf.j2

@@ -1,3 +1,4 @@
+{% set _snmp = not (constants is defined and constants.frr is defined and constants.frr.enable_snmp_agent is defined and not constants.frr.enable_snmp_agent) %}
 [supervisord]
 logfile_maxbytes=1MB
 logfile_backups=2
@@ -43,7 +44,7 @@ dependent_startup=true
 dependent_startup_wait_for=rsyslogd:running
 
 [program:zebra]
-command=/usr/lib/frr/zebra -A 127.0.0.1 -s 90000000 -M dplane_fpm_sonic -M snmp --asic-offload=notify_on_offload
+command=/usr/lib/frr/zebra -A 127.0.0.1 -s 90000000 -M dplane_fpm_sonic{{ ' -M snmp' if _snmp else '' }} --asic-offload=notify_on_offload
 priority=4
 autostart=false
 autorestart=false
@@ -101,9 +102,9 @@ dependent_startup_wait_for=zebra:running
 {% if FEATURE is defined and
       (FEATURE.frr_bmp is defined and FEATURE.frr_bmp.state is defined and FEATURE.frr_bmp.state == "enabled") or
       (FEATURE.bmp is defined and FEATURE.bmp.state is defined and FEATURE.bmp.state == "enabled") %}
-command=/usr/lib/frr/bgpd -A 127.0.0.1 -P 0 -M snmp -M bmp
+command=/usr/lib/frr/bgpd -A 127.0.0.1 -P 0{{ ' -M snmp' if _snmp else '' }} -M bmp
 {% else %}
-command=/usr/lib/frr/bgpd -A 127.0.0.1 -P 0 -M snmp
+command=/usr/lib/frr/bgpd -A 127.0.0.1 -P 0{{ ' -M snmp' if _snmp else '' }}
 {% endif %}
 priority=5
 stopsignal=KILL
@@ -119,7 +120,7 @@ dependent_startup_wait_for=zsocket:exited
 
 {% if DEVICE_METADATA.localhost.frr_mgmt_framework_config is defined and DEVICE_METADATA.localhost.frr_mgmt_framework_config == "true" %}
 [program:ospfd]
-command=/usr/lib/frr/ospfd -A 127.0.0.1 -P 0 -M snmp
+command=/usr/lib/frr/ospfd -A 127.0.0.1 -P 0{{ ' -M snmp' if _snmp else '' }}
 priority=5
 stopsignal=KILL
 autostart=false

files/build_templates/constants.yml.j2

@@ -0,0 +1,80 @@
+constants:
+  deployment_id_asn_map:
+    "1" : 65432
+    "2" : 65433
+  bgp:
+    traffic_shift_community: 12345:12345
+    internal_community: 11111:11111
+    internal_fallback_community: 22222:22222
+    sentinel_community: 12345:12346
+    internal_community_match_tag: 201
+    local_anchor_route_community: 12345:555
+    anchor_route_community: 12345:666
+    anchor_contributing_route_community: 12345:777
+    route_do_not_send_appdb_tag: 202
+    route_eligible_for_fallback_to_default_tag: 203
+    hide_internal_community: 55555:55555
+    families:
+      - ipv4
+      - ipv6
+    use_deployment_id: false
+    use_neighbors_meta: false
+    graceful_restart:
+      enabled: true
+      restart_time: 240
+    multipath_relax:
+      enabled: true
+    maximum_paths:
+      enabled: true
+      ipv4: 514
+      ipv6: 514
+    allow_list:
+      enabled: true
+      default_action: "permit"   # or "deny"
+      drop_community: 5060:12345  # value of the community to identify a prefix to drop. Make sense only with allow_list_default_action equal to 'permit'
+      default_pl_rules:
+        v4:
+          - "deny 0.0.0.0/0 le 17"
+          - "permit 127.0.0.1/32"
+        v6:
+          - "deny 0::/0 le 59"
+          - "deny 0::/0 ge 65"
+    bbr:
+      enabled: true
+      default_state: "disabled"
+    peers:
+      general: # peer_type
+        db_table: "BGP_NEIGHBOR"
+        template_dir: "general"
+        bbr:
+          PEER_V4:
+            - ipv4
+          PEER_V6:
+            - ipv6
+      internal: # peer_type
+        db_table: "BGP_INTERNAL_NEIGHBOR"
+        template_dir: "internal"
+      monitors: # peer_type
+        enabled: true
+        db_table: "BGP_MONITORS"
+        peer_group: "BGPMON"
+        template_dir: "monitors"
+      dynamic: # peer_type
+        enabled: true
+        db_table: "BGP_PEER_RANGE"
+        peer_group: "BGP_SPEAKER"
+        template_dir: "dynamic"
+      voq_chassis: # peer_type
+        enabled: true
+        db_table: "BGP_VOQ_CHASSIS_NEIGHBOR"
+        template_dir: "voq_chassis"
+      sentinels: # peer_type
+        enabled: true
+        db_table: "BGP_SENTINELS"
+        template_dir: "sentinels"
+    prefix_list:
+      SUPPRESS_PREFIX:
+        ipv4_name: "SUPPRESS_IPV4_PREFIX"
+        ipv6_name: "SUPPRESS_IPV6_PREFIX"
+  frr:
+    enable_snmp_agent: {{ 'true' if ENABLE_FRR_SNMP_AGENT == 'y' else 'false' }}

files/build_templates/sonic_debian_extension.j2

@@ -798,7 +798,7 @@ sudo chmod 755 $FILESYSTEM_ROOT/usr/bin/rps.py
 sudo cp $IMAGE_CONFIGS/snmp/snmp.yml $FILESYSTEM_ROOT/etc/sonic/
 
 # Copy ASN configuration files
-sudo cp $IMAGE_CONFIGS/constants/constants.yml $FILESYSTEM_ROOT/etc/sonic/
+j2 files/build_templates/constants.yml.j2 | sudo tee $FILESYSTEM_ROOT/etc/sonic/constants.yml > /dev/null
 
 # Copy BMC network configuration file to share templates
 sudo cp $IMAGE_CONFIGS/constants/bmc.json $FILESYSTEM_ROOT_USR_SHARE_SONIC_TEMPLATES/

rules/config

@@ -144,6 +144,11 @@ FRR_USER_GID = 300
 # ENABLE_FRR_TCMALLOC - build FRR with gperftools tcmalloc support.
 ENABLE_FRR_TCMALLOC ?= y
 
+# ENABLE_FRR_SNMP_AGENT - enable SNMP AgentX support in FRR (BGP4-MIB via rfc1657).
+# When set to 'n', FRR is built without frr-snmp package and bgpd/zebra run without
+# the -M snmp module. This avoids snmpd memory issues caused by BGP4-MIB polling.
+ENABLE_FRR_SNMP_AGENT ?= y
+
 # DPKG cache allows the .deb files to be stored in the cache path. This allows the submodules
 # package to be cached and restored back if its commit hash is not modified and its dependencies are not modified.
 # SONIC_DPKG_CACHE_METHOD - Default method of deb package caching

rules/docker-fpm-frr.mk

@@ -7,10 +7,16 @@ DOCKER_FPM_FRR_DBG = $(DOCKER_FPM_FRR_STEM)-$(DBG_IMAGE_MARK).gz
 $(DOCKER_FPM_FRR)_PATH = $(DOCKERS_PATH)/$(DOCKER_FPM_FRR_STEM)
 $(DOCKER_FPM_FRR)_PYTHON_WHEELS += $(SONIC_BGPCFGD) $(SONIC_FRR_MGMT_FRAMEWORK)
 
-$(DOCKER_FPM_FRR)_DEPENDS += $(FRR) $(FRR_SNMP) $(SWSS) $(LIBYANG3)
+$(DOCKER_FPM_FRR)_DEPENDS += $(FRR) $(SWSS) $(LIBYANG3)
+ifeq ($(ENABLE_FRR_SNMP_AGENT),y)
+$(DOCKER_FPM_FRR)_DEPENDS += $(FRR_SNMP)
+endif
 $(DOCKER_FPM_FRR)_DBG_DEPENDS = $($(DOCKER_SWSS_LAYER_TRIXIE)_DBG_DEPENDS)
 $(DOCKER_FPM_FRR)_DBG_DEPENDS += $(SWSS_DBG) $(LIBSWSSCOMMON_DBG) \
-                                $(FRR_DBG) $(FRR_SNMP_DBG) $(LIBYANG3_DBG)
+                                $(FRR_DBG) $(LIBYANG3_DBG)
+ifeq ($(ENABLE_FRR_SNMP_AGENT),y)
+$(DOCKER_FPM_FRR)_DBG_DEPENDS += $(FRR_SNMP_DBG)
+endif
 
 $(DOCKER_FPM_FRR)_DBG_IMAGE_PACKAGES = $($(DOCKER_SWSS_LAYER_TRIXIE)_DBG_IMAGE_PACKAGES)
 

rules/frr.mk

@@ -12,18 +12,21 @@ $(FRR)_SRC_PATH = $(SRC_PATH)/sonic-frr
 SONIC_MAKE_DEBS += $(FRR)
 
 export ENABLE_FRR_TCMALLOC
+export ENABLE_FRR_SNMP_AGENT
 
 FRR_PYTHONTOOLS = frr-pythontools_$(FRR_VERSION)-sonic-$(FRR_SUBVERSION)_all.deb
 $(eval $(call add_extra_package,$(FRR),$(FRR_PYTHONTOOLS)))
 
 FRR_DBG = frr-dbgsym_$(FRR_VERSION)-sonic-$(FRR_SUBVERSION)_$(CONFIGURED_ARCH).deb
 $(eval $(call add_extra_package,$(FRR),$(FRR_DBG)))
 
+ifeq ($(ENABLE_FRR_SNMP_AGENT),y)
 FRR_SNMP = frr-snmp_$(FRR_VERSION)-sonic-$(FRR_SUBVERSION)_$(CONFIGURED_ARCH).deb
 $(eval $(call add_extra_package,$(FRR),$(FRR_SNMP)))
 
 FRR_SNMP_DBG = frr-snmp-dbgsym_$(FRR_VERSION)-sonic-$(FRR_SUBVERSION)_$(CONFIGURED_ARCH).deb
 $(eval $(call add_extra_package,$(FRR),$(FRR_SNMP_DBG)))
+endif
 
 export FRR FRR_PYTHONTOOLS FRR_DBG FRR_SNMP FRR_SNMP_DBG
 

rules/sonic-config.dep

@@ -4,7 +4,7 @@ SPATH       := $($(SONIC_CONFIG_ENGINE_PY3)_SRC_PATH)
 DEP_FILES   := $(SONIC_COMMON_FILES_LIST) rules/sonic-config.mk rules/sonic-config.dep   
 DEP_FILES   += $(SONIC_COMMON_BASE_FILES_LIST)
 DEP_FILES   += $(shell git ls-files $(SPATH)) $(SONIC_DEVICE_FILES_LIST)
-DEP_FILES   += files/image_config/interfaces/interfaces.j2 dockers/docker-orchagent/ports.json.j2 dockers/docker-dhcp-relay/wait_for_intf.sh.j2 dockers/docker-dhcp-relay/docker-dhcp-relay.supervisord.conf.j2 dockers/docker-lldp/lldpd.conf.j2 dockers/docker-orchagent/ipinip.json.j2 files/build_templates/qos_config.j2 dockers/docker-orchagent/switch.json.j2 dockers/docker-orchagent/vxlan.json.j2 files/image_config/constants/constants.yml dockers/docker-orchagent/orch_zmq_tables.conf.j2
+DEP_FILES   += files/image_config/interfaces/interfaces.j2 dockers/docker-orchagent/ports.json.j2 dockers/docker-dhcp-relay/wait_for_intf.sh.j2 dockers/docker-dhcp-relay/docker-dhcp-relay.supervisord.conf.j2 dockers/docker-lldp/lldpd.conf.j2 dockers/docker-orchagent/ipinip.json.j2 files/build_templates/qos_config.j2 dockers/docker-orchagent/switch.json.j2 dockers/docker-orchagent/vxlan.json.j2 files/build_templates/constants.yml.j2 dockers/docker-orchagent/orch_zmq_tables.conf.j2
 
 ifeq ($(ENABLE_PY2_MODULES), y)
     $(SONIC_CONFIG_ENGINE_PY2)_CACHE_MODE  := GIT_CONTENT_SHA 

slave.mk

@@ -1331,6 +1331,7 @@ $(addprefix $(TARGET_PATH)/, $(DOCKER_IMAGES)) : $(TARGET_PATH)/%.gz : .platform
 		export include_system_eventd="$(INCLUDE_SYSTEM_EVENTD)"
 		export build_reduce_image_size="$(BUILD_REDUCE_IMAGE_SIZE)"
 		export enable_frr_tcmalloc="$(ENABLE_FRR_TCMALLOC)"
+		export enable_frr_snmp_agent="$(ENABLE_FRR_SNMP_AGENT)"
 		export sonic_asic_platform="$(patsubst %-$(CONFIGURED_ARCH),%,$(CONFIGURED_PLATFORM))"
 		$(eval export $(subst -,_,$(notdir $($*.gz_PATH)))_debs=$(shell printf "$(subst $(SPACE),\n,$(call expand,$($*.gz_DEPENDS),RDEPENDS))\n" | awk '!a[$$0]++'))
 		$(eval export $(subst -,_,$(notdir $($*.gz_PATH)))_pydebs=$(shell printf "$(subst $(SPACE),\n,$(call expand,$($*.gz_PYTHON_DEBS)))\n" | awk '!a[$$0]++'))
@@ -1706,6 +1707,7 @@ $(addprefix $(TARGET_PATH)/, $(SONIC_INSTALLERS)) : $(TARGET_PATH)/% : \
 	export include_bootchart="$(INCLUDE_BOOTCHART)"
 	export enable_bootchart="$(ENABLE_BOOTCHART)"
 	export enable_multidb="$(ENABLE_MULTIDB)"
+	export ENABLE_FRR_SNMP_AGENT="$(ENABLE_FRR_SNMP_AGENT)"
 	$(foreach docker, $($*_DOCKERS),\
 		export docker_image="$(docker)"
 		export docker_image_name="$(basename $(docker))"

src/sonic-config-engine/tests/data/constants.yml

@@ -0,0 +1,78 @@
+constants:
+  deployment_id_asn_map:
+    "1" : 65432
+    "2" : 65433
+  bgp:
+    traffic_shift_community: 12345:12345
+    internal_community: 11111:11111
+    internal_fallback_community: 22222:22222
+    sentinel_community: 12345:12346
+    internal_community_match_tag: 201
+    local_anchor_route_community: 12345:555
+    anchor_route_community: 12345:666
+    anchor_contributing_route_community: 12345:777
+    route_do_not_send_appdb_tag: 202
+    route_eligible_for_fallback_to_default_tag: 203
+    hide_internal_community: 55555:55555
+    families:
+      - ipv4
+      - ipv6
+    use_deployment_id: false
+    use_neighbors_meta: false
+    graceful_restart:
+      enabled: true
+      restart_time: 240
+    multipath_relax:
+      enabled: true
+    maximum_paths:
+      enabled: true
+      ipv4: 514
+      ipv6: 514
+    allow_list:
+      enabled: true
+      default_action: "permit"   # or "deny"
+      drop_community: 5060:12345  # value of the community to identify a prefix to drop. Make sense only with allow_list_default_action equal to 'permit'
+      default_pl_rules:
+        v4:
+          - "deny 0.0.0.0/0 le 17"
+          - "permit 127.0.0.1/32"
+        v6:
+          - "deny 0::/0 le 59"
+          - "deny 0::/0 ge 65"
+    bbr:
+      enabled: true
+      default_state: "disabled"
+    peers:
+      general: # peer_type
+        db_table: "BGP_NEIGHBOR"
+        template_dir: "general"
+        bbr:
+          PEER_V4:
+            - ipv4
+          PEER_V6:
+            - ipv6
+      internal: # peer_type
+        db_table: "BGP_INTERNAL_NEIGHBOR"
+        template_dir: "internal"
+      monitors: # peer_type
+        enabled: true
+        db_table: "BGP_MONITORS"
+        peer_group: "BGPMON"
+        template_dir: "monitors"
+      dynamic: # peer_type
+        enabled: true
+        db_table: "BGP_PEER_RANGE"
+        peer_group: "BGP_SPEAKER"
+        template_dir: "dynamic"
+      voq_chassis: # peer_type
+        enabled: true
+        db_table: "BGP_VOQ_CHASSIS_NEIGHBOR"
+        template_dir: "voq_chassis"
+      sentinels: # peer_type
+        enabled: true
+        db_table: "BGP_SENTINELS"
+        template_dir: "sentinels"
+    prefix_list:
+      SUPPRESS_PREFIX:
+        ipv4_name: "SUPPRESS_IPV4_PREFIX"
+        ipv6_name: "SUPPRESS_IPV6_PREFIX"

src/sonic-config-engine/tests/test_frr.py

@@ -50,7 +50,7 @@ def run_diff(self, file1, file2):
     def run_case(self, template, target, extra_data=None):
         template_dir = os.path.join(self.test_dir, '..', '..', '..', 'dockers', 'docker-fpm-frr', "frr")
         conf_template = os.path.join(template_dir, template)
-        constants = os.path.join(self.test_dir, '..', '..', '..', 'files', 'image_config', 'constants', 'constants.yml')
+        constants = os.path.join(self.test_dir, 'data', 'constants.yml')
         cmd = ['-m', self.t0_minigraph, '-p', self.t0_port_config, '-y', constants, '-t', conf_template, '-T', template_dir]
         if extra_data:
             cmd = ['-a', json.dumps(extra_data)] + cmd

src/sonic-config-engine/tests/test_j2files.py

@@ -877,8 +877,7 @@ def test_swss_switch_render_template(self):
             'switch.json.j2'
         )
         constants_yml = os.path.join(
-            self.test_dir, '..', '..', '..', 'files', 'image_config',
-            'constants', 'constants.yml'
+            self.test_dir, 'data', 'constants.yml'
         )
         test_list = {
             "t1": {
@@ -907,8 +906,7 @@ def test_swss_switch_render_template_multi_asic(self):
             'switch.json.j2'
         )
         constants_yml = os.path.join(
-            self.test_dir, '..', '..', '..', 'files', 'image_config',
-            'constants', 'constants.yml'
+            self.test_dir, 'data', 'constants.yml'
         )
         test_list = {
             "0": {
@@ -937,8 +935,7 @@ def test_swss_switch_render_template_t2(self):
             'switch.json.j2'
         )
         constants_yml = os.path.join(
-            self.test_dir, '..', '..', '..', 'files', 'image_config',
-            'constants', 'constants.yml'
+            self.test_dir, 'data', 'constants.yml'
         )
         test_list = {
             "0": {

src/sonic-config-engine/tests/test_j2files_t2_chassis_fe.py

@@ -43,7 +43,7 @@ def run_diff(self, file1, file2):
     def run_case(self, minigraph, template, target):
         template_dir = os.path.join(self.test_dir, '..', '..', '..', 'dockers', 'docker-fpm-frr', "frr")
         conf_template = os.path.join(template_dir, template)
-        constants = os.path.join(self.test_dir, '..', '..', '..', 'files', 'image_config', 'constants', 'constants.yml')
+        constants = os.path.join(self.test_dir, 'data', 'constants.yml')
         cmd = ["-m", minigraph, "-p", self.t2_chassis_fe_port_config, "-y", constants, "-t", conf_template, "-T", template_dir]
         self.run_script(cmd, output_file=self.output_file)
 

src/sonic-config-engine/tests/test_multinpu_cfggen.py

@@ -72,7 +72,7 @@ def run_diff(self, file1, file2):
     def run_frr_asic_case(self, template, target, asic, port_config):
         template_dir = os.path.join(self.test_dir, '..', '..', '..', 'dockers', 'docker-fpm-frr', "frr")
         conf_template = os.path.join(template_dir, template)
-        constants = os.path.join(self.test_dir, '..', '..', '..', 'files', 'image_config', 'constants', 'constants.yml')
+        constants = os.path.join(self.test_dir, 'data', 'constants.yml')
         cmd = ['-n', asic, '-m', self.sample_graph, '-p', port_config, '-y', constants, '-t', conf_template, '-T', template_dir]
         self.run_script(cmd, output_file=self.output_file)