From 1ce75bdc5208b33538bb6854b754005f0c175b40 Mon Sep 17 00:00:00 2001
From: Monviech <79600909+Monviech@users.noreply.github.com>
Date: Mon, 3 Nov 2025 15:08:31 +0100
Subject: [PATCH] net/frr: Allow disabling enforce_first_as, which is a new
 default in frr10 (#5001)

---
 .../mvc/app/controllers/OPNsense/Quagga/forms/bgp.xml      | 7 +++++++
 .../src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml    | 4 ++++
 .../opnsense/service/templates/OPNsense/Quagga/bgpd.conf   | 3 +++
 3 files changed, 14 insertions(+)

diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/bgp.xml b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/bgp.xml
index 09288f285..5b1e02975 100644
--- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/bgp.xml
+++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/bgp.xml
@@ -54,6 +54,13 @@
         <advanced>true</advanced>
         <help>When enabled (default), BGP only announces networks set at 'Network' if they are present in the routers routing table (alternatively, you can also set a null-route via System -> Routes). If disabled, all configured networks will be announced.</help>
     </field>
+    <field>
+        <id>bgp.enforce_first_as</id>
+        <label>Enforce First AS</label>
+        <type>checkbox</type>
+        <advanced>true</advanced>
+        <help>Deny an update received from an external BGP (eBGP) peer that does not list its autonomous system number at the beginning of the AS_PATH in the incoming update.</help>
+    </field>
     <field>
         <id>bgp.logneighborchanges</id>
         <label>Log Neighbor Changes</label>
diff --git a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml
index a8df4dd41..732e5aa16 100644
--- a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml
+++ b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/BGP.xml
@@ -28,6 +28,10 @@
             <Default>1</Default>
             <Required>Y</Required>
         </networkimportcheck>
+        <enforce_first_as type="BooleanField">
+            <Default>1</Default>
+            <Required>Y</Required>
+        </enforce_first_as>
         <logneighborchanges type="BooleanField">
             <Default>0</Default>
             <Required>Y</Required>
diff --git a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf
index 2f30ec1b6..140a66cf2 100644
--- a/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf
+++ b/net/frr/src/opnsense/service/templates/OPNsense/Quagga/bgpd.conf
@@ -31,6 +31,9 @@
 router bgp {{ OPNsense.quagga.bgp.asnumber }}
 {%   if not helpers.empty('OPNsense.quagga.bgp.logneighborchanges') %}
  bgp log-neighbor-changes
+{%   endif %}
+{%   if OPNsense.quagga.bgp.enforce_first_as == '0' %}
+ no bgp enforce-first-as
 {%   endif %}
  no bgp default ipv4-unicast
  no bgp ebgp-requires-policy