Commit 5dbd3e9da7 for frr

commit 5dbd3e9da7f2d9172a1e5dd84f26595de16c72db
Author: Abdul Wasey <w453y.me@gmail.com>
Date:   Mon Sep 14 07:22:05 2026 +0000

    bfdd: report authentication keys that did not reach the data plane

    A session and its keys are two messages, and the output queue can take
    the first and refuse the second. On registration that is already handled:
    `_bfd_dplane_add_session` drops the association, `bfd_dplane_add_session`
    returns non-zero, and the session runs in the daemon instead.

    A later update has no such recovery. The session is offloaded already,
    and four of the five callers of `bfd_dplane_update_session` discard what
    it returns, so a data plane could be left holding `SESSION_AUTH` with
    keys that no longer match the configuration and nothing anywhere would
    say so. A conforming data plane fails closed on that - keys it cannot
    use mean a session it must not run - so the visible symptom is a session
    that will not come up, with no reason given.

    Say so. Recovering is a larger question than this message: the protocol
    has no transaction, and a retry needs somewhere to hold the state until
    the queue drains.

    Signed-off-by: Abdul Wasey <w453y.me@gmail.com>

diff --git a/bfdd/dplane.c b/bfdd/dplane.c
index 1a9609b5f5..28d0d5784f 100644
--- a/bfdd/dplane.c
+++ b/bfdd/dplane.c
@@ -1416,9 +1416,22 @@ int bfd_dplane_update_session(const struct bfd_session *bs)
 	if (rv != 0)
 		return rv;

-	/* The keys follow the session they belong to. */
-	if (bs->kc)
+	/*
+	 * The keys follow the session they belong to, and the two are
+	 * separate messages: the output queue can take the first and refuse
+	 * the second. On registration that is handled, because
+	 * `_bfd_dplane_add_session` drops the association and the session
+	 * runs in the daemon instead. On a later update the session is
+	 * already offloaded and most callers discard this return, so say so
+	 * here rather than leaving a data plane holding `SESSION_AUTH` with
+	 * keys that no longer match the configuration.
+	 */
+	if (bs->kc) {
 		rv = bfd_dplane_send_session_auth(bs);
+		if (rv != 0)
+			zlog_err("%s: [%s] authentication keys were not sent to the data plane",
+				 __func__, bs_to_string(bs));
+	}

 	return rv;
 }