From b84d6a4a9ea644b4a085b06771438a26d4ddb513 Mon Sep 17 00:00:00 2001
From: Andreas Scholdan <andreas@scholdan.net>
Date: Wed, 14 Oct 2026 20:32:49 +0200
Subject: [PATCH] BGP: Add gshut command for graceful shutdown (RFC 8326)

Operators draining a router before maintenance want to attach the
well-known GRACEFUL_SHUTDOWN community (65535, 0) to all routes exported
to a neighbor, so the neighbor can deprefer them before the session is
taken down. Until now this needed a filter condition on a define and a
reconfigure for what is really a runtime state change.

Add a per-protocol runtime flag toggled by "gshut [off] <proto>", modelled
on the existing per-peer community handling in export. While set,
bgp_update_attrs() adds the community to every exported route and the
channels are refed so the change goes out immediately. The flag is kept
across reconfiguration of a running instance, also when the instance is
restarted, and is inherited by sessions spawned from a dynamic BGP
listener. It is shown in "show protocols all".

This covers the outbound signalling of the RFC 8326 procedure. Lowering
the preference of received routes carrying the community stays in import
filters, and shutting the session down afterwards stays with the
operator, as the command deliberately does not touch the session.

Target: minor
---
 doc/bird.sgml      | 18 +++++++++++++++++
 proto/bgp/attrs.c  | 10 ++++++++++
 proto/bgp/bgp.c    | 49 +++++++++++++++++++++++++++++++++++++++++++++-
 proto/bgp/bgp.h    |  4 ++++
 proto/bgp/config.Y |  8 +++++++-
 5 files changed, 87 insertions(+), 2 deletions(-)

diff --git a/doc/bird.sgml b/doc/bird.sgml
index 660ea4c..e9d2071 100644
--- a/doc/bird.sgml
+++ b/doc/bird.sgml
@@ -1544,6 +1544,24 @@ This argument can be omitted if there exists only a single instance.
 	Enable, disable or restart a given protocol instance, instances matching
 	the <cf><m/pattern/</cf> or <cf/all/ instances.
 
+	<tag><label id="cli-gshut">gshut [off] <m/name/|"<m/pattern/"|all</tag>
+	Start (or, with <cf/off/, stop) graceful shutdown (RFC 8326) of a given
+	BGP protocol instance, instances matching the <cf><m/pattern/</cf> or
+	<cf/all/ BGP instances. While active, all routes exported to the neighbor
+	carry the well-known GRACEFUL_SHUTDOWN community (65535, 0), so the
+	neighbor can deprefer them before the session is taken down. The session
+	itself is not affected; use <cf/disable/ once traffic has moved, or
+	<cf/gshut off/ to resume. The command covers the outbound part of the
+	RFC 8326 procedure only; depreferring routes received with this community
+	is a matter of import filters, and shutting the session down is left to
+	the operator. The state is kept across reconfiguration of a running
+	instance, including one that restarts it. It is not kept across a restart
+	of BIRD itself, nor when an instance that is down is replaced by
+	reconfiguration. For dynamic BGP, the state of the listener is
+	inherited by sessions spawned afterwards, while already running sessions
+	are separate instances and have to be selected by name or pattern.
+	Protocols other than BGP are ignored.
+
 	<tag><label id="cli-reload">reload [in|out] <m/name/|"<m/pattern/"|all</tag>
 	Reload a given protocol instance, that means re-import routes from the
 	protocol instance and re-export preferred routes to the instance. If
diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c
index 32bd3a9..d77173e 100644
--- a/proto/bgp/attrs.c
+++ b/proto/bgp/attrs.c
@@ -2090,6 +2090,16 @@ bgp_update_attrs(struct bgp_proto *p, struct bgp_channel *c, rte *e, ea_list *at
       bgp_set_attr_u32(&attrs, pool, BA_ONLY_TO_CUSTOMER, 0, p->public_as);
   }
 
+  /* Graceful shutdown, RFC 8326 - attach GRACEFUL_SHUTDOWN community */
+  if (p->gshut)
+  {
+    a = bgp_find_attr(attrs, BA_COMMUNITY);
+    ad = a ? a->u.ptr : NULL;
+    if (!int_set_contains(ad, BGP_COMM_GRACEFUL_SHUTDOWN))
+      bgp_set_attr_ptr(&attrs, pool, BA_COMMUNITY, a ? a->flags : 0,
+		       int_set_add(pool, ad, BGP_COMM_GRACEFUL_SHUTDOWN));
+  }
+
   /*
    * Presence of mandatory attributes ORIGIN and AS_PATH is ensured by above
    * conditions. Presence and validity of quasi-mandatory NEXT_HOP attribute
diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c
index 096dbd7..f29d53d 100644
--- a/proto/bgp/bgp.c
+++ b/proto/bgp/bgp.c
@@ -1120,7 +1120,12 @@ bgp_spawn(struct bgp_proto *pp, ip_addr remote_ip, ip_addr local_ip, struct ifac
   if (pc)
     rem_node(&pc->n);
 
-  return SKIP_BACK(struct bgp_proto, p, proto_spawn(sym->proto, 0));
+  struct bgp_proto *p = SKIP_BACK(struct bgp_proto, p, proto_spawn(sym->proto, 0));
+
+  /* Dynamic sessions inherit graceful shutdown state from the listener */
+  p->gshut = pp->gshut;
+
+  return p;
 }
 
 static int
@@ -2505,6 +2510,10 @@ bgp_shutdown(struct proto *P)
 
   BGP_TRACE(D_EVENTS, "Shutdown requested");
 
+  /* Hack: pass graceful shutdown state to the new instance through its config */
+  if (P->cf_new && (P->cf_new->protocol == &proto_bgp))
+    ((struct bgp_config *) P->cf_new)->gshut = p->gshut;
+
   switch (P->down_code)
   {
   case PDC_CF_REMOVE:
@@ -2611,6 +2620,10 @@ bgp_init(struct proto_config *CF)
   if (cf->c.parent)
     cf->remote_ip = IPA_NONE;
 
+  /* Hack: We use cf->gshut just to pass graceful shutdown state from bgp_shutdown() */
+  p->gshut = cf->gshut;
+  cf->gshut = 0;
+
   /* Add all BGP channels */
   struct bgp_channel_config *cc;
   BGP_CF_WALK_CHANNELS(cf, cc)
@@ -3588,6 +3601,37 @@ bgp_show_capabilities(struct bgp_proto *p UNUSED, struct bgp_caps *caps)
     cli_msg(-1006, "      Role: %s", bgp_format_role_name(caps->role));
 }
 
+/* Toggle graceful shutdown (RFC 8326), see bgp_update_attrs() */
+void
+bgp_cmd_gshut(struct proto *P, uintptr_t arg, int cnt UNUSED)
+{
+  struct bgp_proto *p = (void *) P;
+  int on = !!arg;
+
+  if (P->proto != &proto_bgp)
+  {
+    cli_msg(-8, "%s: not a BGP protocol", P->name);
+    return;
+  }
+
+  if (p->gshut == on)
+  {
+    cli_msg(-8, "%s: graceful shutdown already %s", P->name, on ? "active" : "inactive");
+    return;
+  }
+
+  log(L_INFO "Graceful shutdown of protocol %s %s", P->name, on ? "started" : "stopped");
+  p->gshut = on;
+
+  /* Re-export routes with updated communities */
+  struct channel *c;
+  WALK_LIST(c, P->channels)
+    if (c->channel_state == CS_UP)
+      channel_request_feeding(c);
+
+  cli_msg(-9, "%s: graceful shutdown %s", P->name, on ? "started" : "stopped");
+}
+
 static void
 bgp_show_proto_info(struct proto *P)
 {
@@ -3609,6 +3653,9 @@ bgp_show_proto_info(struct proto *P)
   if (p->gr_active_num)
     cli_msg(-1006, "    Neighbor graceful restart active");
 
+  if (p->gshut)
+    cli_msg(-1006, "    Graceful shutdown active");
+
   if (P->proto_state == PS_START)
   {
     struct bgp_conn *oc = &p->outgoing_conn;
diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h
index 7beab8b..fa447f3 100644
--- a/proto/bgp/bgp.h
+++ b/proto/bgp/bgp.h
@@ -163,6 +163,7 @@ struct bgp_config {
   int require_gr;			/* Require remote support for graceful restart [RFC 4724] */
   int require_llgr;			/* Require remote support for long-lived graceful restart [RFC 9494] */
   struct bfd_options *bfd;		/* Use BFD for liveness detection */
+  u8 gshut;				/* Hack: carries graceful shutdown state over a restart, see bgp_shutdown() */
 };
 
 struct bgp_channel_config {
@@ -397,6 +398,7 @@ struct bgp_proto {
   u8 gr_ready;				/* Neighbor could do graceful restart */
   u8 llgr_ready;			/* Neighbor could do Long-lived GR, implies gr_ready */
   u8 gr_active_num;			/* Neighbor is doing GR, number of active channels */
+  u8 gshut;				/* Graceful shutdown active, exports get GRACEFUL_SHUTDOWN community [RFC 8326] */
   u8 channel_count;			/* Number of active channels */
   u8 summary_add_path_rx;		/* Summary state of ADD_PATH RX w.r.t active channels */
   u32 *afi_map;				/* Map channel index -> AFI */
@@ -622,6 +624,7 @@ void bgp_check_config(struct bgp_config *c);
 void bgp_error(struct bgp_conn *c, unsigned code, unsigned subcode, byte *data, int len);
 void bgp_close_conn(struct bgp_conn *c);
 void bgp_update_startup_delay(struct bgp_proto *p);
+void bgp_cmd_gshut(struct proto *P, uintptr_t arg, int cnt);
 void bgp_add_nbr(struct bgp_proto *pp, const net_addr_nbr *nbr);
 void bgp_remove_nbr(struct bgp_proto *pp, const net_addr_nbr *nbr);
 void bgp_conn_enter_openconfirm_state(struct bgp_conn *conn);
@@ -908,6 +911,7 @@ byte *bgp_create_end_mark_(struct bgp_channel *c, byte *buf);
 #define BGP_COMM_NO_ADVERTISE		0xffffff02	/* Don't export at all */
 #define BGP_COMM_NO_EXPORT_SUBCONFED	0xffffff03	/* NO_EXPORT even in local confederation */
 
+#define BGP_COMM_GRACEFUL_SHUTDOWN	0xffff0000	/* Graceful shutdown [RFC 8326] */
 #define BGP_COMM_LLGR_STALE		0xffff0006	/* Route is stale according to LLGR */
 #define BGP_COMM_NO_LLGR		0xffff0007	/* Do not treat the route according to LLGR */
 
diff --git a/proto/bgp/config.Y b/proto/bgp/config.Y
index c973481..de7a1ce 100644
--- a/proto/bgp/config.Y
+++ b/proto/bgp/config.Y
@@ -37,7 +37,7 @@ CF_KEYWORDS(BGP, LOCAL, NEIGHBOR, AS, HOLD, TIME, CONNECT, RETRY, KEEPALIVE,
 	FIRST, FREE, VALIDATE, BASE, ROLE, ROLES, PEER, PROVIDER, CUSTOMER,
 	RS_SERVER, RS_CLIENT, REQUIRE, BGP_OTC, OTC, GLOBAL, SEND, RECV, MIN, MAX,
 	AUTHENTICATION, NONE, MD5, AO, FORMAT, NATIVE, SINGLE, DOUBLE,
-	BGP_PMSI_TUNNEL)
+	BGP_PMSI_TUNNEL, GSHUT)
 
 CF_KEYWORDS(KEY, KEYS, SECRET, DEPRECATED, PREFERRED, ALGORITHM, CMAC, AES128)
 
@@ -572,6 +572,12 @@ term: ASPA_CHECK_UPSTREAM '(' rtable ')' { $$ =
   );
 }
 
+CF_CLI_HELP(GSHUT, ..., [[Graceful shutdown of BGP protocols (RFC 8326)]])
+CF_CLI(GSHUT, proto_patt, <protocol> | \"<pattern>\" | all, [[Start graceful shutdown, add GRACEFUL_SHUTDOWN community to exports]])
+{ proto_apply_cmd($2, bgp_cmd_gshut, 1, 1); } ;
+CF_CLI(GSHUT OFF, proto_patt, <protocol> | \"<pattern>\" | all, [[Stop graceful shutdown]])
+{ proto_apply_cmd($3, bgp_cmd_gshut, 1, 0); } ;
+
 CF_CODE
 
 CF_END
-- 
2.43.0