Parse failures causing later false positives

[bcavns01]

We're seeing parse failures for lines related to routing and firewall ACLs. When we later check for things like unusedStructures, we get results for things that are actually in use, but they are undetected because the structures using them failed to parse:

Examples of lines that failed parsing::

as-path-group
set policy-options policy-statement OVERFLOW-LOCAL-IN term import_overflow then local-preference subtract 10
set policy-options policy-statement REJECT-ROUTES term in_overflow_rib_5_3_4_0-24 from condition in-overflow-rib_5_3_4_0-24
set interfaces gr-0/1/10 unit 204 family inet address 10.255.0.9/32 destination 10.255.0.8
set firewall family inet filter NSP term SMALL filter SMALL-PACKETS

[dhalperi]

Hi @bcavns01 - I'm not quite sure I grok this.

E.g., I'm not sure how

set policy-options policy-statement OVERFLOW-LOCAL-IN term import_overflow then local-preference subtract 10

failing to parse (which it did!) causes a reference to be lost. That line doesn't reference anything else.

Other questions:

• What type of device is this? I can't find documentation for set firewall family inet filter NSP term SMALL filter SMALL-PACKETS, e.g., here: https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/term-firewall-filter-ex-series.html

• set policy-options policy-statement REJECT-ROUTES term in_overflow_rib_5_3_4_0-24 from condition in-overflow-rib_5_3_4_0-24 -- we don't model this yet, but also it should not lead to unused structures I think: the only reference here is to the condition in-overflow-rib_5_3_4_0-24, but those are not tracked for unused structures.

You can sync with us on Batfish Slack if you want a real-time interaction.

Thanks!

[bcavns01]

Hi @dhalperi ,

Thanks for the quick follow-up. Sorry for the ambiguity in the OP. I think I got too excited by the free-form format for posting issues to this repo. :)

Not all the examples in the OP were related to unused structures. They were just examples of failures to parse that would seem to directly impact routing and ACLs.

For the issue of unused structures, as-path-group will probably be one of the larger sources of trouble for us, so I'll try for a clearer example of that:

---

Related Issue seen:

(This seems to be the only related issue)

14,,"[configs/config:[1059, 4695]]",Parse warning,This feature is not currently supported,as-path-group 15133-PATH,[popsf_as_path_group pops_from pops_common pops_term po_policy_statement s_policy_options s_common statement set_line_tail set_line flat_juniper_configuration]

Example of what was seen as as unused:

63,as-path-group as-path,ap15133_13,configs/config:[7097]

What the config actually has: (ignore the XXXXXs, those are just redactions.)

        neighbor XXXXXX {
            import [ IMPORT-15133 ];

policy-statement IMPORT-15133 {
    ...
    term AS15133-IN {
        from policy 15133-AS-FILTER

policy-statement 15133-AS-FILTER {
    term EXEMPT {
        from as-path-group 15133-PATH;
        then reject;
    }
    
    
as-path-group 15133-PATH {
    ...
    as-path ap15133_13 "^15133.*(XXXXXXXXXXXXX)$";

---

It's possible that I'm misunderstanding something, but the ap15133_13 is definitely in use, and it looks like it's only being see as not in use because of the failure to parse as-path-group 15133-PATH.

To answer your other question, this is being tested on a QFX5100.

[dhalperi]

@bcavns01 -- thanks! This is very helpful.

Dumb question: is it legal to actually use the name ap15133_13 anywhere? I see you refer to as-path-group 15133-PATH in 15133-AS-FILTER term EXEMPT, but there's no way to directly refer to ap15133_13, right?

If so, the issue (with reference tracking) is that we need to call the ap15133_13 used as soon as it is defined.

[bcavns01]

Dumb question: is it legal to actually use the name ap15133_13 anywhere? I see you refer to as-path-group 15133-PATH in 15133-AS-FILTER term EXEMPT, but there's no way to directly refer to ap15133_13, right?

I wouldn't expect to be able to directly refer to it, but I'm not sure I've ever needed to try, so I can't say for sure. Looks like you've already merged in a potential fix for this, though. Great!

[dhalperi]

FYI as-path-group is now supported: #8613