From 55a1ddaf1ceaa5e88364a4c44656d778c42781f9 Mon Sep 17 00:00:00 2001
From: Michal Ruprich <mruprich@redhat.com>
Date: Jan 08 2020 11:24:01 +0000
Subject: New version 7.2


---

diff --git a/.gitignore b/.gitignore
index 6060970..085010a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 /frr-7.1.tar.gz
+/frr-7.2.tar.gz
diff --git a/0000-remove-babeld-and-ldpd.patch b/0000-remove-babeld-and-ldpd.patch
index 676770f..cc19cc4 100644
--- a/0000-remove-babeld-and-ldpd.patch
+++ b/0000-remove-babeld-and-ldpd.patch
@@ -12,9 +12,9 @@ index 5be3264..33abc1d 100644
  include sharpd/subdir.am
  include pimd/subdir.am
 @@ -182,7 +180,6 @@ EXTRA_DIST += \
+ 	snapcraft/defaults \
  	snapcraft/helpers \
  	snapcraft/snap \
- 	\
 -	babeld/Makefile \
  	bgpd/Makefile \
  	bgpd/rfp-example/librfp/Makefile \
diff --git a/0002-enable-openssl.patch b/0002-enable-openssl.patch
index 37b094e..02398b5 100644
--- a/0002-enable-openssl.patch
+++ b/0002-enable-openssl.patch
@@ -1,36 +1,11 @@
-diff --git a/configure.ac b/configure.ac
-index 9f8b31b..38781da 100755
---- a/configure.ac
-+++ b/configure.ac
-@@ -529,6 +529,20 @@ AC_ARG_ENABLE([thread-sanitizer],
-   AS_HELP_STRING([--enable-thread-sanitizer], [enable ThreadSanitizer support for detecting data races]))
- AC_ARG_ENABLE([memory-sanitizer],
-   AS_HELP_STRING([--enable-memory-sanitizer], [enable MemorySanitizer support for detecting uninitialized memory reads]))
-+AC_ARG_WITH([crypto],
-+  AS_HELP_STRING([--with-crypto=<internal|openssl>], [choose between different implementations of cryptographic functions(default value is --with-crypto=internal)]))
-+
-+#if openssl, else use internal as default
-+AS_IF([test x"${with_crypto}" = x"openssl"], [
-+  AC_CHECK_LIB([crypto], [EVP_DigestInit], [LIBS="$LIBS -lcrypto"], [], [])
-+  if test "$ac_cv_lib_crypto_EVP_DigestInit" = no; then
-+    AC_MSG_ERROR([build with openssl has been specified but openssl library was not found on your system])
-+  else
-+    AC_DEFINE([CRYPTO_OPENSSL], [1], [Compile with openssl support])
-+  fi
-+], [test x"${with_crypto}" = x"internal" || test x"${with_crypto}" = x"" ], [AC_DEFINE([CRYPTO_INTERNAL], [1], [Compile with internal cryptographic implementation])
-+], [AC_MSG_ERROR([Unknown value for --with-crypto])]
-+)
- 
- AS_IF([test "${enable_clippy_only}" != "yes"], [
- AC_CHECK_HEADERS([json-c/json.h])
 diff --git a/lib/subdir.am b/lib/subdir.am
 index 0b7af18..0533e24 100644
 --- a/lib/subdir.am
 +++ b/lib/subdir.am
 @@ -41,7 +41,6 @@ lib_libfrr_la_SOURCES = \
- 	lib/libfrr.c \
  	lib/linklist.c \
  	lib/log.c \
+ 	lib/log_vty.c \
 -	lib/md5.c \
  	lib/memory.c \
  	lib/memory_vty.c \
@@ -44,9 +19,9 @@ index 0b7af18..0533e24 100644
  	lib/skiplist.c \
  	lib/sockopt.c \
 @@ -170,7 +170,6 @@ pkginclude_HEADERS += \
- 	lib/libospf.h \
  	lib/linklist.h \
  	lib/log.h \
+ 	lib/log_vty.h \
 -	lib/md5.h \
  	lib/memory.h \
  	lib/memory_vty.h \
@@ -59,228 +34,6 @@ index 0b7af18..0533e24 100644
  	lib/sigevent.h \
  	lib/skiplist.h \
  	lib/smux.h \
-diff --git a/lib/zebra.h b/lib/zebra.h
-index 22239f8e60..a308d46cc9 100644
---- a/lib/zebra.h
-+++ b/lib/zebra.h
-@@ -134,6 +134,11 @@ typedef unsigned char uint8_t;
- #endif
- #endif
- 
-+#ifdef CRYPTO_OPENSSL
-+#include <openssl/evp.h>
-+#include <openssl/hmac.h>
-+#endif
-+
- #include "openbsd-tree.h"
- 
- #include <netinet/in.h>
-diff --git a/ospfd/ospf_packet.c b/ospfd/ospf_packet.c
-index 6bc8c25153..b951e94ae6 100644
---- a/ospfd/ospf_packet.c
-+++ b/ospfd/ospf_packet.c
-@@ -33,7 +33,9 @@
- #include "log.h"
- #include "sockopt.h"
- #include "checksum.h"
-+#if  !defined(CRYPTO_OPENSSL) && !defined(HAVE_NETTLE)
- #include "md5.h"
-+#endif
- #include "vrf.h"
- #include "lib_errors.h"
- 
-@@ -332,7 +334,11 @@ static unsigned int ospf_packet_max(struct ospf_interface *oi)
- static int ospf_check_md5_digest(struct ospf_interface *oi,
- 				 struct ospf_header *ospfh)
- {
-+#ifdef CRYPTO_OPENSSL
-+	EVP_MD_CTX *ctx;
-+#else
- 	MD5_CTX ctx;
-+#endif
- 	unsigned char digest[OSPF_AUTH_MD5_SIZE];
- 	struct crypt_key *ck;
- 	struct ospf_neighbor *nbr;
-@@ -361,11 +367,21 @@ static int ospf_check_md5_digest(struct ospf_interface *oi,
- 	}
- 
- 	/* Generate a digest for the ospf packet - their digest + our digest. */
-+#ifdef CRYPTO_OPENSSL
-+	unsigned int md5_size = OSPF_AUTH_MD5_SIZE;
-+	ctx = EVP_MD_CTX_new();
-+	EVP_DigestInit(ctx, EVP_md5());
-+	EVP_DigestUpdate(ctx, ospfh, length);
-+	EVP_DigestUpdate(ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE);
-+	EVP_DigestFinal(ctx, digest, &md5_size);
-+	EVP_MD_CTX_free(ctx);
-+#elif CRYPTO_INTERNAL
- 	memset(&ctx, 0, sizeof(ctx));
- 	MD5Init(&ctx);
- 	MD5Update(&ctx, ospfh, length);
- 	MD5Update(&ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE);
- 	MD5Final(digest, &ctx);
-+#endif
- 
- 	/* compare the two */
- 	if (memcmp((caddr_t)ospfh + length, digest, OSPF_AUTH_MD5_SIZE)) {
-@@ -389,7 +404,11 @@ static int ospf_make_md5_digest(struct ospf_interface *oi,
- {
- 	struct ospf_header *ospfh;
- 	unsigned char digest[OSPF_AUTH_MD5_SIZE] = {0};
-+#ifdef CRYPTO_OPENSSL
-+	EVP_MD_CTX *ctx;
-+#else
- 	MD5_CTX ctx;
-+#endif
- 	void *ibuf;
- 	uint32_t t;
- 	struct crypt_key *ck;
-@@ -422,11 +441,21 @@ static int ospf_make_md5_digest(struct ospf_interface *oi,
- 	}
- 
- 	/* Generate a digest for the entire packet + our secret key. */
-+#ifdef CRYPTO_OPENSSL
-+	unsigned int md5_size = OSPF_AUTH_MD5_SIZE;
-+	ctx = EVP_MD_CTX_new();
-+	EVP_DigestInit(ctx, EVP_md5());
-+	EVP_DigestUpdate(ctx, ibuf, ntohs(ospfh->length));
-+	EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE);
-+	EVP_DigestFinal(ctx, digest, &md5_size);
-+	EVP_MD_CTX_free(ctx);
-+#elif CRYPTO_INTERNAL
- 	memset(&ctx, 0, sizeof(ctx));
- 	MD5Init(&ctx);
- 	MD5Update(&ctx, ibuf, ntohs(ospfh->length));
- 	MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE);
- 	MD5Final(digest, &ctx);
-+#endif
- 
- 	/* Append md5 digest to the end of the stream. */
- 	stream_put(op->s, digest, OSPF_AUTH_MD5_SIZE);
-diff --git a/ripd/ripd.c b/ripd/ripd.c
-index e0ff0430f8..b311ac5717 100644
---- a/ripd/ripd.c
-+++ b/ripd/ripd.c
-@@ -37,7 +37,9 @@
- #include "if_rmap.h"
- #include "plist.h"
- #include "distribute.h"
-+#if !defined(CRYPTO_OPENSSL) && !defined(HAVE_NETTLE)
- #include "md5.h"
-+#endif
- #include "keychain.h"
- #include "privs.h"
- #include "lib_errors.h"
-@@ -870,7 +872,11 @@ static int rip_auth_md5(struct rip_packet *packet, struct sockaddr_in *from,
- 	struct rip_md5_data *md5data;
- 	struct keychain *keychain;
- 	struct key *key;
-+#ifdef CRYPTO_OPENSSL
-+	EVP_MD_CTX *ctx;
-+#else
- 	MD5_CTX ctx;
-+#endif
- 	uint8_t digest[RIP_AUTH_MD5_SIZE];
- 	uint16_t packet_len;
- 	char auth_str[RIP_AUTH_MD5_SIZE] = {};
-@@ -934,11 +940,21 @@ static int rip_auth_md5(struct rip_packet *packet, struct sockaddr_in *from,
- 		return 0;
- 
- 	/* MD5 digest authentication. */
-+#ifdef CRYPTO_OPENSSL
-+	unsigned int md5_size = RIP_AUTH_MD5_SIZE;
-+	ctx = EVP_MD_CTX_new();
-+	EVP_DigestInit(ctx, EVP_md5());
-+	EVP_DigestUpdate(ctx, packet, packet_len + RIP_HEADER_SIZE);
-+	EVP_DigestUpdate(ctx, auth_str, RIP_AUTH_MD5_SIZE);
-+	EVP_DigestFinal(ctx, digest, &md5_size);
-+	EVP_MD_CTX_free(ctx);
-+#elif CRYPTO_INTERNAL
- 	memset(&ctx, 0, sizeof(ctx));
- 	MD5Init(&ctx);
- 	MD5Update(&ctx, packet, packet_len + RIP_HEADER_SIZE);
- 	MD5Update(&ctx, auth_str, RIP_AUTH_MD5_SIZE);
- 	MD5Final(digest, &ctx);
-+#endif
- 
- 	if (memcmp(md5data->digest, digest, RIP_AUTH_MD5_SIZE) == 0)
- 		return packet_len;
-@@ -1063,7 +1078,11 @@ static void rip_auth_md5_set(struct stream *s, struct rip_interface *ri,
- 			     size_t doff, char *auth_str, int authlen)
- {
- 	unsigned long len;
-+#ifdef CRYPTO_OPENSSL
-+	EVP_MD_CTX *ctx;
-+#else
- 	MD5_CTX ctx;
-+#endif
- 	unsigned char digest[RIP_AUTH_MD5_SIZE];
- 
- 	/* Make it sure this interface is configured as MD5
-@@ -1092,11 +1111,21 @@ static void rip_auth_md5_set(struct stream *s, struct rip_interface *ri,
- 	stream_putw(s, RIP_AUTH_DATA);
- 
- 	/* Generate a digest for the RIP packet. */
-+#ifdef CRYPTO_OPENSSL
-+	unsigned int md5_size = RIP_AUTH_MD5_SIZE;
-+	ctx = EVP_MD_CTX_new();
-+	EVP_DigestInit(ctx, EVP_md5());
-+	EVP_DigestUpdate(ctx, STREAM_DATA(s), stream_get_endp(s));
-+	EVP_DigestUpdate(ctx, auth_str, RIP_AUTH_MD5_SIZE);
-+	EVP_DigestFinal(ctx, digest, &md5_size);
-+	EVP_MD_CTX_free(ctx);
-+#elif CRYPTO_INTERNAL
- 	memset(&ctx, 0, sizeof(ctx));
- 	MD5Init(&ctx);
- 	MD5Update(&ctx, STREAM_DATA(s), stream_get_endp(s));
- 	MD5Update(&ctx, auth_str, RIP_AUTH_MD5_SIZE);
- 	MD5Final(digest, &ctx);
-+#endif
- 
- 	/* Copy the digest to the packet. */
- 	stream_write(s, digest, RIP_AUTH_MD5_SIZE);
-diff --git a/isisd/isis_tlvs.c b/isisd/isis_tlvs.c
-index 488dfedae4..862d675e84 100644
---- a/isisd/isis_tlvs.c
-+++ b/isisd/isis_tlvs.c
-@@ -22,7 +22,9 @@
-  */
- #include <zebra.h>
- 
-+#ifdef CRYPTO_INTERNAL
- #include "md5.h"
-+#endif
- #include "memory.h"
- #include "stream.h"
- #include "sbuf.h"
-@@ -2770,8 +2772,13 @@ static void update_auth_hmac_md5(struct isis_auth *auth, struct stream *s,
- 		safe_auth_md5(s, &checksum, &rem_lifetime);
- 
- 	memset(STREAM_DATA(s) + auth->offset, 0, 16);
-+#ifdef CRYPTO_OPENSSL
-+	uint8_t* result = (uint8_t*)HMAC(EVP_md5(), auth->passwd, auth->plength, STREAM_DATA(s), stream_get_endp(s), NULL, NULL);
-+	memcpy(digest, result, 16);
-+#elif  CRYPTO_INTERNAL
- 	hmac_md5(STREAM_DATA(s), stream_get_endp(s), auth->passwd,
- 		 auth->plength, digest);
-+#endif
- 	memcpy(auth->value, digest, 16);
- 	memcpy(STREAM_DATA(s) + auth->offset, digest, 16);
- 
-@@ -3310,8 +3317,13 @@ static bool auth_validator_hmac_md5(struct isis_passwd *passwd,
- 		safe_auth_md5(stream, &checksum, &rem_lifetime);
- 
- 	memset(STREAM_DATA(stream) + auth->offset, 0, 16);
-+#ifdef CRYPTO_OPENSSL
-+	uint8_t* result = (uint8_t*)HMAC(EVP_md5(), passwd->passwd, passwd->len, STREAM_DATA(stream), stream_get_endp(stream), NULL, NULL);
-+	memcpy(digest, result, 16);
-+#elif  CRYPTO_INTERNAL
- 	hmac_md5(STREAM_DATA(stream), stream_get_endp(stream), passwd->passwd,
- 		 passwd->len, digest);
-+#endif
- 	memcpy(STREAM_DATA(stream) + auth->offset, auth->value, 16);
- 
- 	bool rv = !memcmp(digest, auth->value, 16);
 diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c
 index 1991666..2e4fe55 100644
 --- a/isisd/isis_lsp.c
diff --git a/0003-disable-eigrp-crypto.patch b/0003-disable-eigrp-crypto.patch
index 21c9b63..cd43569 100644
--- a/0003-disable-eigrp-crypto.patch
+++ b/0003-disable-eigrp-crypto.patch
@@ -1,37 +1,3 @@
-diff --git a/eigrpd/eigrp_vty.c b/eigrpd/eigrp_vty.c
-index fc5bdbd..56ebac6 100644
---- a/eigrpd/eigrp_vty.c
-+++ b/eigrpd/eigrp_vty.c
-@@ -968,6 +968,9 @@ DEFUN (eigrp_authentication_mode,
-        "Keyed message digest\n"
-        "HMAC SHA256 algorithm \n")
- {
-+	vty_out(vty, " EIGRP Authentication is disabled\n");
-+	return CMD_WARNING_CONFIG_FAILED;
-+
- 	VTY_DECLVAR_CONTEXT(interface, ifp);
- 	struct eigrp_interface *ei = ifp->info;
- 	struct eigrp *eigrp;
-@@ -1003,6 +1006,9 @@ DEFUN (no_eigrp_authentication_mode,
-        "Keyed message digest\n"
-        "HMAC SHA256 algorithm \n")
- {
-+	vty_out(vty, " EIGRP Authentication is disabled\n");
-+	return CMD_WARNING_CONFIG_FAILED;
-+
- 	VTY_DECLVAR_CONTEXT(interface, ifp);
- 	struct eigrp_interface *ei = ifp->info;
- 	struct eigrp *eigrp;
-@@ -1034,6 +1040,9 @@ DEFPY (eigrp_authentication_keychain,
-        "Autonomous system number\n"
-        "Name of key-chain\n")
- {
-+	vty_out(vty, " EIGRP Authentication is disabled\n");
-+	return CMD_WARNING_CONFIG_FAILED;
-+
- 	VTY_DECLVAR_CONTEXT(interface, ifp);
- 	struct eigrp_interface *ei = ifp->info;
- 	struct eigrp *eigrp;
 diff --git a/eigrpd/eigrp_packet.c b/eigrpd/eigrp_packet.c
 index bedaf15..8dc09bf 100644
 --- a/eigrpd/eigrp_packet.c
@@ -251,3 +217,36 @@ index 8db4903..2a4f0bb 100644
  #include "vty.h"
  #include "plist.h"
  #include "plist_int.h"
+diff --git a/eigrpd/eigrp_cli.c b/eigrpd/eigrp_cli.c
+index a93d4c8..b01e121 100644
+--- a/eigrpd/eigrp_cli.c
++++ b/eigrpd/eigrp_cli.c
+@@ -25,6 +25,7 @@
+ #include "lib/command.h"
+ #include "lib/log.h"
+ #include "lib/northbound_cli.h"
++#include "lib/libfrr.h"
+ 
+ #include "eigrp_structs.h"
+ #include "eigrpd.h"
+@@ -726,6 +726,20 @@ DEFPY(
+ 	"Keyed message digest\n"
+ 	"HMAC SHA256 algorithm \n")
+ {
++	//EIGRP authentication is currently broken in FRR
++	switch (frr_get_cli_mode()) {
++	case FRR_CLI_CLASSIC:
++		vty_out(vty, "%% Eigrp Authentication is disabled\n\n");
++		break;
++	case FRR_CLI_TRANSACTIONAL:
++		vty_out(vty,
++			"%% Failed to edit candidate configuration - "
++			"Eigrp Authentication is disabled.\n\n");
++		break;
++	}
++
++	return CMD_WARNING_CONFIG_FAILED;
++
+ 	char xpath[XPATH_MAXLEN], xpath_auth[XPATH_MAXLEN + 64];
+ 
+ 	snprintf(xpath, sizeof(xpath), "./frr-eigrpd:eigrp/instance[asn='%s']",
diff --git a/0004-fips-mode.patch b/0004-fips-mode.patch
index d071670..e8efeb7 100644
--- a/0004-fips-mode.patch
+++ b/0004-fips-mode.patch
@@ -100,4 +100,4 @@ index 5bb81ef..02a09ef 100644
 +
  	nb_cli_enqueue_change(vty, "./authentication-scheme/mode", NB_OP_MODIFY,
  			      strmatch(mode, "md5") ? "md5" : "plain-text");
- 	nb_cli_enqueue_change(vty, "./authentication-scheme/md5-auth-length",
+ 	if (strmatch(mode, "md5"))
diff --git a/0005-python-3.8-build.patch b/0005-python-3.8-build.patch
deleted file mode 100644
index 4675be6..0000000
--- a/0005-python-3.8-build.patch
+++ /dev/null
@@ -1,840 +0,0 @@
-From 45da32d7a417ea639a092029c37c7fcc3bbc7813 Mon Sep 17 00:00:00 2001
-From: David Lamparter <equinox@diac24.net>
-Date: Tue, 28 May 2019 00:35:24 +0200
-Subject: [PATCH] build: refactor & revamp python autoconf logic
-
-Signed-off-by: David Lamparter <equinox@diac24.net>
----
- configure.ac                                  | 129 ++------
- doc/developer/building-frr-for-centos6.rst    |   5 +-
- doc/developer/building-frr-for-debian8.rst    |   4 +-
- doc/developer/building-frr-for-debian9.rst    |   4 +-
- doc/developer/building-frr-for-fedora.rst     |   4 +-
- doc/developer/building-frr-for-freebsd10.rst  |   2 +-
- doc/developer/building-frr-for-freebsd11.rst  |   2 +-
- doc/developer/building-frr-for-freebsd9.rst   |   4 +-
- doc/developer/building-frr-for-netbsd6.rst    |   9 +-
- doc/developer/building-frr-for-netbsd7.rst    |   9 +-
- doc/developer/building-frr-for-ubuntu1404.rst |   2 +-
- doc/developer/building-frr-for-ubuntu1604.rst |   2 +-
- doc/developer/building-frr-for-ubuntu1804.rst |   2 +-
- doc/developer/packaging-redhat.rst            |   2 +-
- doc/subdir.am                                 |  11 +-
- doc/user/installation.rst                     |  21 ++
- m4/ax_python.m4                               | 284 ++++++++++++++++++
- redhat/frr.spec.in                            |   8 +-
- tests/subdir.am                               |   2 -
- 20 files changed, 361 insertions(+), 146 deletions(-)
- create mode 100644 m4/ax_python.m4
-
-diff --git a/configure.ac b/configure.ac
-index c228ff0c91..906006a974 100755
---- a/configure.ac
-+++ b/configure.ac
-@@ -183,15 +183,17 @@ AC_DEFUN([AC_LINK_IFELSE_FLAGS], [{
- 	AC_LINK_IFELSE(
- 		[$3],
- 		[
--			AC_MSG_RESULT([yes])
- 			CFLAGS="$ac_cflags_save"
- 			LIBS="$ac_libs_save"
--			$5
-+			m4_default([$5], [
-+				AC_MSG_RESULT([yes])
-+			])
- 		], [
--			AC_MSG_RESULT([no])
- 			CFLAGS="$ac_cflags_save"
- 			LIBS="$ac_libs_save"
--			$4
-+			m4_default([$4], [
-+				AC_MSG_RESULT([no])
-+			])
- 		])
- 	AC_LANG_POP([C])
- 	}])
-@@ -609,92 +611,30 @@ AM_CONDITIONAL([FPM], [test "x$enable_fpm" = "xyes"])
- # Python for clippy
- #
- 
--AC_DEFUN([FRR_PYTHON_CHECK_WORKING], [
--  AC_MSG_CHECKING([whether we found a working Python version])
--  AC_LINK_IFELSE_FLAGS([$PYTHON_CFLAGS], [$PYTHON_LIBS], [AC_LANG_PROGRAM([
--#include <Python.h>
--#if PY_VERSION_HEX < 0x02070000
--#error python too old
--#endif
--int main(void);
--],
--[
--{
--  Py_Initialize();
--  return 0;
--}
--])], [
--    # some python installs are missing the zlib dependency...
--    PYTHON_LIBS="${PYTHON_LIBS} -lz"
--    AC_LINK_IFELSE_FLAGS([$PYTHON_CFLAGS], [$PYTHON_LIBS], [AC_LANG_PROGRAM([
--#include <Python.h>
--#if PY_VERSION_HEX < 0x02070000
--#error python too old
--#endif
--int main(void);
--],
--[
--{
--  Py_Initialize();
--  return 0;
--}
--])], [
--      m4_if([$1], [], [
--        PYTHONCONFIG=""
--        unset PYTHON_LIBS
--        unset PYTHON_CFLAGS
--      ], [$1])
--    ])
--  ])
--])
--
- AS_IF([test "$host" = "$build"], [
--  PYTHONCONFIG=""
--
--  # ordering:
--  # 1.  try python3, but respect the user's preference on which minor ver
--  # 2.  try python, which might be py3 or py2 again on the user's preference
--  # 3.  try python2 (can really only be 2.7 but eh)
--  # 4.  try 3.6 > 3.5 > 3.4 > 3.3 > 3.2 > 2.7 through pkg-config (no user pref)
--  #
--  # (AX_PYTHON_DEVEL has no clue about py3 vs py2)
--  # (AX_PYTHON does not do what we need)
--
--  AC_CHECK_TOOLS([PYTHONCONFIG], [ \
--	python3-config \
--	python-config \
--	python2-config \
--	python3.6-config \
--	python3.5-config \
--	python3.4-config \
--	python3.3-config \
--	python3.2-config \
--	python2.7-config ])
--  if test -n "$PYTHONCONFIG"; then
--    PYTHON_CFLAGS="`\"${PYTHONCONFIG}\" --includes`"
--    PYTHON_LIBS="`\"${PYTHONCONFIG}\" --ldflags`"
--
--    FRR_PYTHON_CHECK_WORKING([])
--  fi
-+  FRR_PYTHON_DEV
-+], [
-+  FRR_PYTHON
-+])
- 
--  if test -z "$PYTHONCONFIG"; then
--    PKG_CHECK_MODULES([PYTHON], [python-3.6], [], [
--      PKG_CHECK_MODULES([PYTHON], [python-3.5], [], [
--        PKG_CHECK_MODULES([PYTHON], [python-3.4], [], [
--          PKG_CHECK_MODULES([PYTHON], [python-3.3], [], [
--            PKG_CHECK_MODULES([PYTHON], [python-3.2], [], [
--              PKG_CHECK_MODULES([PYTHON], [python-2.7], [], [
--                AC_MSG_FAILURE([could not find python-config or pkg-config python, please install Python development files from libpython-dev or similar])
--                ])])])])])])
-+FRR_PYTHON_MODULES([pytest])
- 
-+if test "${enable_doc}" != "no"; then
-+  FRR_PYTHON_MODULES([sphinx], , [
-+    if test "${enable_doc}" = "yes"; then
-+      AC_MSG_ERROR([Documentation was explicitly requested with --enable-doc but sphinx is not available for $PYTHON. Please disable docs or install sphinx.])
-+    fi
-+  ])
-+fi
-+AM_CONDITIONAL([DOC], [test "${enable_doc}" != "no" -a "$frr_py_mod_sphinx" != "false"])
-+AM_CONDITIONAL([DOC_HTML], [test "${enable_doc_html}" = "yes"])
- 
--    FRR_PYTHON_CHECK_WORKING([
--      AC_MSG_FAILURE([could not find python-config or pkg-config python, please install Python development files from libpython-dev or similar])
--    ])
--  fi
-+FRR_PYTHON_MOD_EXEC([sphinx], [--version], [
-+  PYSPHINX="-m sphinx"
-+], [
-+  PYSPHINX="-c 'import sys; from sphinx import main; sys.exit(main(sys.argv))'"
- ])
--AC_SUBST([PYTHON_CFLAGS])
--AC_SUBST([PYTHON_LIBS])
-+AC_SUBST([PYSPHINX])
- 
- #
- # Logic for protobuf support.
-@@ -1507,16 +1447,6 @@ FRR_INCLUDES
- #endif
- ])dnl
- 
--dnl disable doc check
--AC_CHECK_PROGS([SPHINXBUILD], [sphinx-build sphinx-build3 sphinx-build2], [/bin/false])
--if test "$SPHINXBUILD" = "/bin/false"; then
--  if test "${enable_doc}" = "yes"; then
--    AC_MSG_ERROR([Documentation was explicitly requested with --enable-doc but sphinx-build is not available. Please disable docs or install sphinx.])
--  fi
--fi
--AM_CONDITIONAL([DOC], [test "${enable_doc}" != "no" -a "$SPHINXBUILD" != "/bin/false"])
--AM_CONDITIONAL([DOC_HTML], [test "${enable_doc_html}" = "yes"])
--
- dnl --------------------
- dnl Daemon disable check
- dnl --------------------
-@@ -1666,6 +1596,7 @@ int main(void);
-   return 0;
- }
- ])], [
-+     AC_MSG_RESULT([no])
-      AC_MSG_ERROR([--enable-snmp given but not usable])])
-    case "${enable_snmp}" in
-      yes)
-@@ -2356,7 +2287,9 @@ zebra protobuf enabled  : ${enable_protobuf:-no}
- The above user and group must have read/write access to the state file
- directory and to the config files in the config file directory."
- 
--if test "${enable_doc}" != "no";then
--  AS_IF([test "$SPHINXBUILD" = /bin/false],
--     AC_MSG_WARN([sphinx-build is missing but required to build documentation]))
-+if test "${enable_doc}" != "no" -a "$frr_py_mod_sphinx" = false; then
-+  AC_MSG_WARN([sphinx is missing but required to build documentation])
-+fi
-+if test "$frr_py_mod_pytest" = false; then
-+  AC_MSG_WARN([pytest is missing, unit tests cannot be performed])
- fi
-diff --git a/doc/developer/building-frr-for-centos6.rst b/doc/developer/building-frr-for-centos6.rst
-index f1ec2ad3ea..ee0ffc2bf7 100644
---- a/doc/developer/building-frr-for-centos6.rst
-+++ b/doc/developer/building-frr-for-centos6.rst
-@@ -163,10 +163,9 @@ an example.)
-         --disable-ldpd \
-         --enable-fpm \
-         --with-pkg-git-version \
--        --with-pkg-extra-version=-MyOwnFRRVersion \
--        SPHINXBUILD=sphinx-build2.7
-+        --with-pkg-extra-version=-MyOwnFRRVersion
-     make
--    make check PYTHON=/usr/bin/python2.7
-+    make check
-     sudo make install
- 
- Create empty FRR configuration files
-diff --git a/doc/developer/building-frr-for-debian8.rst b/doc/developer/building-frr-for-debian8.rst
-index a26d055bc2..76f927853d 100644
---- a/doc/developer/building-frr-for-debian8.rst
-+++ b/doc/developer/building-frr-for-debian8.rst
-@@ -16,7 +16,7 @@ Add packages:
- ::
- 
-    sudo apt-get install git autoconf automake libtool make \
--      libreadline-dev texinfo libjson-c-dev pkg-config bison flex python-pip \
-+      libreadline-dev texinfo libjson-c-dev pkg-config bison flex python3-pip \
-       libc-ares-dev python3-dev python3-sphinx build-essential libsystemd-dev
- 
- Install newer pytest (>3.0) from pip
-@@ -24,7 +24,7 @@ Install newer pytest (>3.0) from pip
- 
- ::
- 
--    sudo pip install pytest
-+    sudo pip3 install pytest
- 
- .. include:: building-libyang.rst
- 
-diff --git a/doc/developer/building-frr-for-debian9.rst b/doc/developer/building-frr-for-debian9.rst
-index 2c5a9681af..e58c59f451 100644
---- a/doc/developer/building-frr-for-debian9.rst
-+++ b/doc/developer/building-frr-for-debian9.rst
-@@ -9,8 +9,8 @@ Add packages:
- ::
- 
-    sudo apt-get install git autoconf automake libtool make \
--     libreadline-dev texinfo libjson-c-dev pkg-config bison flex python-pip \
--     libc-ares-dev python3-dev python-pytest python3-sphinx build-essential \
-+     libreadline-dev texinfo libjson-c-dev pkg-config bison flex \
-+     libc-ares-dev python3-dev python3-pytest python3-sphinx build-essential \
-      libsystemd-dev
- 
- .. include:: building-libyang.rst
-diff --git a/doc/developer/building-frr-for-fedora.rst b/doc/developer/building-frr-for-fedora.rst
-index 204c185f56..d11da2d647 100644
---- a/doc/developer/building-frr-for-fedora.rst
-+++ b/doc/developer/building-frr-for-fedora.rst
-@@ -13,8 +13,8 @@ Installing Dependencies
- 
-    sudo dnf install git autoconf automake libtool make \
-      readline-devel texinfo net-snmp-devel groff pkgconfig json-c-devel \
--     pam-devel pytest bison flex c-ares-devel python3-devel python2-sphinx \
--     perl-core patch
-+     pam-devel python3-pytest bison flex c-ares-devel python3-devel \
-+     python3-sphinx perl-core patch
- 
- .. include:: building-libyang.rst
- 
-diff --git a/doc/developer/building-frr-for-freebsd10.rst b/doc/developer/building-frr-for-freebsd10.rst
-index 86c44f4d90..e85cb80053 100644
---- a/doc/developer/building-frr-for-freebsd10.rst
-+++ b/doc/developer/building-frr-for-freebsd10.rst
-@@ -17,7 +17,7 @@ is first package install and asked)
- ::
- 
-     pkg install git autoconf automake libtool gmake json-c pkgconf \
--        bison flex py27-pytest c-ares python3 py-sphinx
-+        bison flex py36-pytest c-ares python3.6 py36-sphinx
- 
- Make sure there is no /usr/bin/flex preinstalled (and use the newly
- installed in /usr/local/bin): (FreeBSD frequently provides a older flex
-diff --git a/doc/developer/building-frr-for-freebsd11.rst b/doc/developer/building-frr-for-freebsd11.rst
-index 5e56c8cd7a..b97538b763 100644
---- a/doc/developer/building-frr-for-freebsd11.rst
-+++ b/doc/developer/building-frr-for-freebsd11.rst
-@@ -17,7 +17,7 @@ is first package install and asked)
- .. code-block:: shell
- 
-    pkg install git autoconf automake libtool gmake json-c pkgconf \
--      bison flex py27-pytest c-ares python3 py36-sphinx texinfo
-+      bison flex py36-pytest c-ares python3.6 py36-sphinx texinfo
- 
- Make sure there is no /usr/bin/flex preinstalled (and use the newly
- installed in /usr/local/bin): (FreeBSD frequently provides a older flex
-diff --git a/doc/developer/building-frr-for-freebsd9.rst b/doc/developer/building-frr-for-freebsd9.rst
-index 59241d1d13..1e97749795 100644
---- a/doc/developer/building-frr-for-freebsd9.rst
-+++ b/doc/developer/building-frr-for-freebsd9.rst
-@@ -17,8 +17,8 @@ is first package install and asked)
- ::
- 
-     pkg install -y git autoconf automake libtool gmake \
--        pkgconf texinfo json-c bison flex py27-pytest c-ares \
--        python3 py-sphinx libexecinfo
-+        pkgconf texinfo json-c bison flex py36-pytest c-ares \
-+        python3 py36-sphinx libexecinfo
- 
- Make sure there is no /usr/bin/flex preinstalled (and use the newly
- installed in /usr/local/bin): (FreeBSD frequently provides a older flex
-diff --git a/doc/developer/building-frr-for-netbsd6.rst b/doc/developer/building-frr-for-netbsd6.rst
-index 49091c49b4..e50d11130a 100644
---- a/doc/developer/building-frr-for-netbsd6.rst
-+++ b/doc/developer/building-frr-for-netbsd6.rst
-@@ -23,7 +23,7 @@ Add packages:
- ::
- 
-     sudo pkg_add git autoconf automake libtool gmake openssl \
--       pkg-config json-c python27 py27-test python35 py-sphinx
-+       pkg-config json-c py36-test python36 py36-sphinx
- 
- Install SSL Root Certificates (for git https access):
- 
-@@ -33,13 +33,6 @@ Install SSL Root Certificates (for git https access):
-     sudo touch /etc/openssl/openssl.cnf
-     sudo mozilla-rootcerts install
- 
--Select default Python and py.test
--
--::
--
--    sudo ln -s /usr/pkg/bin/python2.7 /usr/bin/python
--    sudo ln -s /usr/pkg/bin/py.test-2.7 /usr/bin/py.test
--
- .. include:: building-libyang.rst
- 
- Get FRR, compile it and install it (from Git)
-diff --git a/doc/developer/building-frr-for-netbsd7.rst b/doc/developer/building-frr-for-netbsd7.rst
-index 64c462a5c8..32d1145edc 100644
---- a/doc/developer/building-frr-for-netbsd7.rst
-+++ b/doc/developer/building-frr-for-netbsd7.rst
-@@ -14,7 +14,7 @@ Install required packages
- ::
- 
-     sudo pkgin install git autoconf automake libtool gmake openssl \
--       pkg-config json-c python27 py27-test python35 py-sphinx
-+       pkg-config json-c python36 py36-test py36-sphinx
- 
- Install SSL Root Certificates (for git https access):
- 
-@@ -24,13 +24,6 @@ Install SSL Root Certificates (for git https access):
-     sudo touch /etc/openssl/openssl.cnf
-     sudo mozilla-rootcerts install
- 
--Select default Python and py.test
--
--::
--
--    sudo ln -s /usr/pkg/bin/python2.7 /usr/bin/python
--    sudo ln -s /usr/pkg/bin/py.test-2.7 /usr/bin/py.test
--
- .. include:: building-libyang.rst
- 
- Get FRR, compile it and install it (from Git)
-diff --git a/doc/developer/building-frr-for-ubuntu1404.rst b/doc/developer/building-frr-for-ubuntu1404.rst
-index 6e2765c1c8..569b3bded1 100644
---- a/doc/developer/building-frr-for-ubuntu1404.rst
-+++ b/doc/developer/building-frr-for-ubuntu1404.rst
-@@ -12,7 +12,7 @@ Installing Dependencies
-    apt-get update
-    apt-get install \
-       git autoconf automake libtool make libreadline-dev texinfo \
--      pkg-config libpam0g-dev libjson-c-dev bison flex python-pytest \
-+      pkg-config libpam0g-dev libjson-c-dev bison flex python3-pytest \
-       libc-ares-dev python3-dev python3-sphinx install-info build-essential \
-       libsnmp-dev perl
- 
-diff --git a/doc/developer/building-frr-for-ubuntu1604.rst b/doc/developer/building-frr-for-ubuntu1604.rst
-index a9a0a2f733..03852a62aa 100644
---- a/doc/developer/building-frr-for-ubuntu1604.rst
-+++ b/doc/developer/building-frr-for-ubuntu1604.rst
-@@ -12,7 +12,7 @@ Installing Dependencies
-    apt-get update
-    apt-get install \
-       git autoconf automake libtool make libreadline-dev texinfo \
--      pkg-config libpam0g-dev libjson-c-dev bison flex python-pytest \
-+      pkg-config libpam0g-dev libjson-c-dev bison flex python3-pytest \
-       libc-ares-dev python3-dev libsystemd-dev python-ipaddress python3-sphinx \
-       install-info build-essential libsystemd-dev libsnmp-dev perl
- 
-diff --git a/doc/developer/building-frr-for-ubuntu1804.rst b/doc/developer/building-frr-for-ubuntu1804.rst
-index 8bdc2b9c76..96c0efe02a 100644
---- a/doc/developer/building-frr-for-ubuntu1804.rst
-+++ b/doc/developer/building-frr-for-ubuntu1804.rst
-@@ -12,7 +12,7 @@ Installing Dependencies
-    sudo apt update
-    sudo apt-get install \
-       git autoconf automake libtool make libreadline-dev texinfo \
--      pkg-config libpam0g-dev libjson-c-dev bison flex python-pytest \
-+      pkg-config libpam0g-dev libjson-c-dev bison flex python3-pytest \
-       libc-ares-dev python3-dev libsystemd-dev python-ipaddress python3-sphinx \
-       install-info build-essential libsystemd-dev libsnmp-dev perl
- 
-diff --git a/doc/developer/packaging-redhat.rst b/doc/developer/packaging-redhat.rst
-index f6b9931156..d344046148 100644
---- a/doc/developer/packaging-redhat.rst
-+++ b/doc/developer/packaging-redhat.rst
-@@ -32,7 +32,7 @@ Tested on CentOS 6, CentOS 7 and Fedora 24.
- 
-       cd frr
-       ./bootstrap.sh
--      ./configure --with-pkg-extra-version=-MyRPMVersion SPHINXBUILD=sphinx-build2.7
-+      ./configure --with-pkg-extra-version=-MyRPMVersion
-       make dist
- 
-    .. note::
-diff --git a/doc/subdir.am b/doc/subdir.am
-index 7d3792bf2b..a1297a4f81 100644
---- a/doc/subdir.am
-+++ b/doc/subdir.am
-@@ -4,7 +4,6 @@
- 
- # You can set these variables from the command line.
- SPHINXOPTS    ?=
--SPHINXBUILD   ?= sphinx-build
- PAPER         ?=
- 
- # Internal variables.
-@@ -32,20 +31,20 @@ am__v_MAKEINFO_1 =
- doc/%/_build/.doctrees/environment.pickle:
- 	$(AM_V_SPHINX) ( \
- 		subdoc="$@"; subdoc="$${subdoc#doc/}"; subdoc="doc/$${subdoc%%/*}"; \
--		$(SPHINXBUILD) -a -q -b text -d "$${subdoc}/_build/.doctrees" \
-+		$(PYTHON) $(PYSPHINX) -a -q -b text -d "$${subdoc}/_build/.doctrees" \
- 			$(ALLSPHINXOPTS) "$(top_srcdir)/$${subdoc}" "$${subdoc}/_build/text" \
- 	)
- doc/%/_build/html/.buildinfo: doc/%/_build/.doctrees/environment.pickle
- 	$(AM_V_SPHINX) ( \
- 		subdoc="$@"; subdoc="$${subdoc#doc/}"; subdoc="doc/$${subdoc%%/*}"; \
--		$(SPHINXBUILD) -q -b html -d "$${subdoc}/_build/.doctrees" \
-+		$(PYTHON) $(PYSPHINX) -q -b html -d "$${subdoc}/_build/.doctrees" \
- 			$(ALLSPHINXOPTS) "$(top_srcdir)/$${subdoc}" "$${subdoc}/_build/html" \
- 	)
- .PRECIOUS: doc/%/_build/texinfo/frr.texi
- doc/%/_build/texinfo/frr.texi: doc/%/_build/.doctrees/environment.pickle
- 	$(AM_V_SPHINX) ( \
- 		subdoc="$@"; subdoc="$${subdoc#doc/}"; subdoc="doc/$${subdoc%%/*}"; \
--		$(SPHINXBUILD) -q -b texinfo -d "$${subdoc}/_build/.doctrees" \
-+		$(PYTHON) $(PYSPHINX) -q -b texinfo -d "$${subdoc}/_build/.doctrees" \
- 			$(ALLSPHINXOPTS) "$(top_srcdir)/$${subdoc}" "$${subdoc}/_build/texinfo" \
- 	)
- doc/%/_build/texinfo/frr.info: doc/%/_build/texinfo/frr.texi
-@@ -54,7 +53,7 @@ doc/%/_build/man/man.stamp: doc/%/_build/.doctrees/environment.pickle
- 	$(AM_V_SPHINX) ( \
- 		subdoc="$@"; subdoc="$${subdoc#doc/}"; subdoc="doc/$${subdoc%%/*}"; \
- 		$(MKDIR_P) "$${subdoc}/_build/man"; touch $@.tmp; \
--		$(SPHINXBUILD) -a -q -b man -d "$${subdoc}/_build/.doctrees" \
-+		$(PYTHON) $(PYSPHINX) -a -q -b man -d "$${subdoc}/_build/.doctrees" \
- 			$(ALLSPHINXOPTS) "$(top_srcdir)/$${subdoc}" "$${subdoc}/_build/man" && \
- 			mv -f $@.tmp $@ \
- 	)
-@@ -80,7 +79,7 @@ $(M_SPHINXTARGETS): doc/%/_build/.doctrees/environment.pickle
- 		builder="$${target##*/}"; \
- 		subdoc="$${target#doc/}"; subdoc="doc/$${subdoc%%/*}"; \
- 		rm -rf "$@"; \
--		$(SPHINXBUILD) -q -b $${builder} -d $${subdoc}/_build/.doctrees \
-+		$(PYTHON) $(PYSPHINX) -q -b $${builder} -d $${subdoc}/_build/.doctrees \
- 			$(ALLSPHINXOPTS) $(top_srcdir)/$${subdoc} $@ \
- 	)
- 
-diff --git a/doc/user/installation.rst b/doc/user/installation.rst
-index 964297292f..6438c11413 100644
---- a/doc/user/installation.rst
-+++ b/doc/user/installation.rst
-@@ -347,6 +347,27 @@ compile directory:
-    ./configure --with-libyang-pluginsdir="`pwd`/yang/libyang_plugins/.libs" \
-                --with-yangmodelsdir="`pwd`/yang"
- 
-+Python dependency, documentation and tests
-+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-+
-+FRR's documentation and basic unit tests heavily use code written in Python.
-+Additionally, FRR ships Python extensions written in C which are used during
-+its build process.
-+
-+To this extent, FRR needs the following:
-+
-+* an installation of CPython, preferably version 3.2 or newer (2.7 works but
-+  is end of life and will stop working at some point.)
-+* development files (mostly headers) for that version of CPython
-+* an installation of `sphinx` for that version of CPython, to build the
-+  documentation
-+* an installation of `pytest` for that version of CPython, to run the unit
-+  tests
-+
-+The `sphinx` and `pytest` dependencies can be avoided by not building
-+documentation / not running ``make check``, but the CPython dependency is a
-+hard dependency of the FRR build process (for the `clippy` tool.)
-+
- .. _least-privilege-support:
- 
- Least-Privilege Support
-diff --git a/m4/ax_python.m4 b/m4/ax_python.m4
-new file mode 100644
-index 0000000000..32043c81ae
---- /dev/null
-+++ b/m4/ax_python.m4
-@@ -0,0 +1,288 @@
-+dnl FRR Python autoconf magic
-+dnl 2019 David Lamparter for NetDEF, Inc.
-+dnl SPDX-License-Identifier: GPL-2.0-or-later
-+
-+dnl the _ at the beginning will be cut off (to support the empty version string)
-+m4_define_default([_FRR_PY_VERS], [_3 _ _2 _3.7 _3.6 _3.5 _3.4 _3.3 _3.2 _2.7])
-+
-+dnl check basic interpreter properties (py2/py3)
-+dnl doubles as simple check whether the interpreter actually works
-+dnl also swaps in the full path to the interpreter
-+dnl arg1: if-true, arg2: if-false
-+AC_DEFUN([_FRR_PYTHON_INTERP], [dnl
-+AC_ARG_VAR([PYTHON], [Python interpreter to use])dnl
-+  AC_MSG_CHECKING([python interpreter $PYTHON])
-+  AC_RUN_LOG(["$PYTHON" -c 'import sys; open("conftest.pyver", "w").write(sys.executable or ""); sys.exit(not (sys.version_info.major == 2 and sys.version_info.minor >= 7))'])
-+  py2=$ac_status
-+  _py2_full="`cat conftest.pyver 2>/dev/null`"
-+  rm -f "conftest.pyver" >/dev/null 2>/dev/null
-+
-+  AC_RUN_LOG(["$PYTHON" -c 'import sys; open("conftest.pyver", "w").write(sys.executable or ""); sys.exit(not ((sys.version_info.major == 3 and sys.version_info.minor >= 2) or sys.version_info.major > 3))'])
-+  py3=$ac_status
-+  _py3_full="`cat conftest.pyver 2>/dev/null`"
-+  rm -f "conftest.pyver" >/dev/null 2>/dev/null
-+
-+  case "p${py2}p${py3}" in
-+  p0p1) frr_cv_python=python2
-+        _python_full="$_py2_full" ;;
-+  p1p0) frr_cv_python=python3
-+        _python_full="$_py3_full" ;;
-+  *)    frr_cv_python=none ;;
-+  esac
-+
-+  if test "$frr_cv_python" = none; then
-+    AC_MSG_RESULT([not working])
-+    $2
-+  else
-+    test -n "$_python_full" -a -x "$_python_full" && PYTHON="$_python_full"
-+    AC_MSG_RESULT([$PYTHON ($frr_cv_python)])
-+    $1
-+  fi
-+
-+  dnl return value
-+  test "$frr_cv_python" != none
-+])
-+
-+dnl check whether $PYTHON has modules available
-+dnl arg1: list of modules (space separated)
-+dnl arg2: if all true, arg3: if any missing
-+dnl also sets frr_py_mod_<name> to "true" or "false"
-+AC_DEFUN([FRR_PYTHON_MODULES], [
-+  result=true
-+  for pymod in $1; do
-+    AC_MSG_CHECKING([whether $PYTHON module $pymod is available])
-+    AC_RUN_LOG(["$PYTHON" -c "import $pymod"])
-+    sane="`echo \"$pymod\" | tr -c '[a-zA-Z0-9\n]' '_'`"
-+    if test "$ac_status" -eq 0; then
-+      AC_MSG_RESULT([yes])
-+      eval frr_py_mod_$sane=true
-+    else
-+      AC_MSG_RESULT([no])
-+      eval frr_py_mod_$sane=false
-+      result=false
-+    fi
-+  done
-+  if $result; then
-+    m4_default([$2], [:])
-+  else
-+    m4_default([$3], [:])
-+  fi
-+  $result
-+])
-+
-+dnl check whether $PYTHON has modules available
-+dnl arg1: list of modules (space separated)
-+dnl arg2: command line parameters for executing
-+dnl arg3: if all true, arg4: if any missing
-+dnl also sets frr_py_modexec_<name> to "true" or "false"
-+AC_DEFUN([FRR_PYTHON_MOD_EXEC], [
-+  result=true
-+  for pymod in $1; do
-+    AC_MSG_CHECKING([whether $PYTHON module $pymod is executable])
-+    AC_RUN_LOG(["$PYTHON" -m "$pymod" $2 > /dev/null])
-+    sane="`echo \"$pymod\" | tr -c '[a-zA-Z0-9\n]' '_'`"
-+    if test "$ac_status" -eq 0; then
-+      AC_MSG_RESULT([yes])
-+      eval frr_py_modexec_$sane=true
-+    else
-+      AC_MSG_RESULT([no])
-+      eval frr_py_modexec_$sane=false
-+      result=false
-+    fi
-+  done
-+  if $result; then
-+    m4_default([$3], [:])
-+  else
-+    m4_default([$4], [:])
-+  fi
-+  $result
-+])
-+
-+dnl check whether we can build & link python bits
-+dnl input: PYTHON_CFLAGS and PYTHON_LIBS
-+AC_DEFUN([_FRR_PYTHON_DEVENV], [
-+  result=true
-+  AC_LINK_IFELSE_FLAGS([$PYTHON_CFLAGS], [$PYTHON_LIBS], [AC_LANG_PROGRAM([
-+#include <Python.h>
-+#if PY_VERSION_HEX < 0x02070000
-+#error python too old
-+#endif
-+int main(void);
-+],
-+[
-+{
-+  Py_Initialize();
-+  return 0;
-+}
-+])], [
-+    # some python installs are missing the zlib dependency...
-+    PYTHON_LIBS="${PYTHON_LIBS} -lz"
-+    AC_LINK_IFELSE_FLAGS([$PYTHON_CFLAGS], [$PYTHON_LIBS], [AC_LANG_PROGRAM([
-+#include <Python.h>
-+#if PY_VERSION_HEX < 0x02070000
-+#error python too old
-+#endif
-+int main(void);
-+],
-+[
-+{
-+  Py_Initialize();
-+  return 0;
-+}
-+])], [
-+      result=false
-+      AC_MSG_RESULT([no])
-+    ], [:])
-+  ], [:])
-+
-+  if $result; then
-+    AC_LINK_IFELSE_FLAGS([$PYTHON_CFLAGS], [$PYTHON_LIBS], [AC_LANG_PROGRAM([
-+#include <Python.h>
-+#if PY_VERSION_HEX != $1
-+#error python version mismatch
-+#endif
-+int main(void);
-+],
-+[
-+{
-+  Py_Initialize();
-+  return 0;
-+}
-+])], [
-+      result=false
-+      AC_MSG_RESULT([version mismatch])
-+    ], [
-+      AC_MSG_RESULT([yes])
-+    ])
-+  fi
-+
-+  if $result; then
-+    m4_default([$2], [:])
-+  else
-+    m4_default([$3], [
-+      unset PYTHON_LIBS
-+      unset PYTHON_CFLAGS
-+    ])
-+  fi
-+])
-+
-+AC_DEFUN([_FRR_PYTHON_GETDEV], [dnl
-+AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-+
-+  py_abi="`   \"$1\" -c \"import sys; print(getattr(sys, 'abiflags', ''))\"`"
-+  py_hex="`   \"$1\" -c \"import sys; print(hex(sys.hexversion))\"`"
-+  py_ldver="` \"$1\" -c \"import sysconfig; print(sysconfig.get_config_var('LDVERSION') or '')\"`"
-+  py_ver="`   \"$1\" -c \"import sysconfig; print(sysconfig.get_config_var('VERSION') or '')\"`"
-+  py_bindir="`\"$1\" -c \"import sysconfig; print(sysconfig.get_config_var('BINDIR') or '')\"`"
-+  test -z "$py_bindir" || py_bindir="$py_bindir/"
-+  echo "py_abi=${py_abi} py_ldver=${py_ldver} py_ver=${py_ver} py_bindir=${py_bindir}" >&AS_MESSAGE_LOG_FD
-+
-+  py_found=false
-+
-+  for tryver in "${py_ldver}" "${py_ver}"; do
-+    pycfg="${py_bindir}python${tryver}-config"
-+    AC_MSG_CHECKING([whether ${pycfg} is available])
-+    if "$pycfg" --configdir >/dev/null 2>/dev/null; then
-+      AC_MSG_RESULT([yes])
-+
-+      PYTHON_CFLAGS="`\"$pycfg\" --includes`"
-+      if test x"${py_ver}" == x"3.8" || test x"{py_ver}" == x"3.9"; then
-+        PYTHON_LIBS="`\"$pycfg\" --ldflags --embed`"
-+      else
-+        PYTHON_LIBS="`\"$pycfg\" --ldflags`"
-+      fi
-+
-+      AC_MSG_CHECKING([whether ${pycfg} provides a working build environment])
-+      _FRR_PYTHON_DEVENV([$py_hex], [
-+        py_found=true
-+        break
-+      ])
-+    else
-+      AC_MSG_RESULT([no])
-+    fi
-+
-+    pkg_failed=no
-+    AC_MSG_CHECKING([whether pkg-config python-${tryver} is available])
-+    unset PYTHON_CFLAGS
-+    unset PYTHON_LIBS
-+    pkg="python-${tryver}"
-+    pkg="${pkg%-}"
-+    _PKG_CONFIG([PYTHON_CFLAGS], [cflags], [${pkg}])
-+    _PKG_CONFIG([PYTHON_LIBS], [libs], [${pkg}])
-+    if test $pkg_failed = no; then
-+      AC_MSG_RESULT([yes])
-+
-+      PYTHON_CFLAGS=$pkg_cv_PYTHON_CFLAGS
-+      PYTHON_LIBS=$pkg_cv_PYTHON_LIBS
-+
-+      AC_MSG_CHECKING([whether pkg-config python-${tryver} provides a working build environment])
-+      _FRR_PYTHON_DEVENV([$py_hex], [
-+        py_found=true
-+        break
-+      ])
-+    else
-+      AC_MSG_RESULT([no])
-+    fi
-+  done
-+
-+  if $py_found; then
-+    m4_default([$2], [:])
-+  else
-+    unset PYTHON_CFLAGS
-+    unset PYTHON_LIBS
-+    m4_default([$3], [:])
-+  fi
-+])
-+
-+dnl just find python without checking headers/libs
-+AC_DEFUN([FRR_PYTHON], [
-+  dnl user override
-+  if test "x$PYTHON" != "x"; then
-+    _FRR_PYTHON_INTERP([], [
-+      AC_MSG_ERROR([PYTHON ($PYTHON) explicitly specified but not working])
-+    ])
-+  else
-+    for frr_pyver in _FRR_PY_VERS; do
-+      PYTHON="python${frr_pyver#_}"
-+      _FRR_PYTHON_INTERP([break])
-+      PYTHON=":"
-+    done
-+    if test "$PYTHON" = ":"; then
-+      AC_MSG_ERROR([no working python version found])
-+    fi
-+  fi
-+  AC_SUBST([PYTHON])
-+])
-+
-+dnl find python with checking headers/libs
-+AC_DEFUN([FRR_PYTHON_DEV], [dnl
-+AC_ARG_VAR([PYTHON_CFLAGS], [C compiler flags for Python])dnl
-+AC_ARG_VAR([PYTHON_LIBS], [linker flags for Python])dnl
-+
-+  dnl user override
-+  if test "x$PYTHON" != "x"; then
-+    _FRR_PYTHON_INTERP([], [
-+      AC_MSG_ERROR([PYTHON ($PYTHON) explicitly specified but not working])
-+    ])
-+    _FRR_PYTHON_GETDEV([$PYTHON], [], [
-+      AC_MSG_ERROR([PYTHON ($PYTHON) explicitly specified but development environment not working])
-+    ])
-+  else
-+    for frr_pyver in _FRR_PY_VERS; do
-+      PYTHON="python${frr_pyver#_}"
-+      _FRR_PYTHON_INTERP([
-+        _FRR_PYTHON_GETDEV([$PYTHON], [
-+          break
-+        ])
-+      ])
-+      PYTHON=":"
-+    done
-+    if test "$PYTHON" = ":"; then
-+      AC_MSG_ERROR([no working python version found])
-+    fi
-+  fi
-+
-+  AC_SUBST([PYTHON_CFLAGS])
-+  AC_SUBST([PYTHON_LIBS])
-+  AC_SUBST([PYTHON])
-+])
-diff --git a/redhat/frr.spec.in b/redhat/frr.spec.in
-index ebd9ac3f47..27042e197c 100644
---- a/redhat/frr.spec.in
-+++ b/redhat/frr.spec.in
-@@ -44,12 +44,6 @@
- # defines for configure
- %define     rundir  %{_localstatedir}/run/%{name}
- 
--# define for sphinx-build binary
--%if 0%{?rhel} && 0%{?rhel} < 7
--    %define sphinx sphinx-build2.7
--%else
--    %define sphinx sphinx-build
--%endif
- ############################################################################
- 
- #### Version String tweak
-@@ -360,7 +354,7 @@ developing OSPF-API and frr applications.
- %else
-     --disable-bfdd \
- %endif
--    SPHINXBUILD=%{sphinx}
-+    # end
- 
- make %{?_smp_mflags} MAKEINFO="makeinfo --no-split"
- 
-diff --git a/tests/subdir.am b/tests/subdir.am
-index ec5fea705e..10a78b98a0 100644
---- a/tests/subdir.am
-+++ b/tests/subdir.am
-@@ -2,8 +2,6 @@
- # tests
- #
- 
--PYTHON ?= python
--
- if BGPD
- TESTS_BGPD = \
- 	tests/bgpd/test_aspath \
diff --git a/0005-test-typelist-power.patch b/0005-test-typelist-power.patch
new file mode 100644
index 0000000..75680c2
--- /dev/null
+++ b/0005-test-typelist-power.patch
@@ -0,0 +1,30 @@
+diff --git a/tests/lib/test_typelist.h b/tests/lib/test_typelist.h
+index f20bbc52d..9039fa8a4 100644
+--- a/tests/lib/test_typelist.h
++++ b/tests/lib/test_typelist.h
+@@ -98,12 +98,13 @@ static void ts_hash(const char *text, const char *expect)
+ 	unsigned i = 0;
+ 	uint8_t hash[32];
+ 	char hashtext[65];
+-	uint32_t count;
++	uint32_t swap_count, count;
+ 
+-	count = htonl(list_count(&head));
++	count = list_count(&head);
++	swap_count = htonl(count);
+ 
+ 	SHA256_Init(&ctx);
+-	SHA256_Update(&ctx, &count, sizeof(count));
++	SHA256_Update(&ctx, &swap_count, sizeof(swap_count));
+ 
+ 	frr_each (list, &head, item) {
+ 		struct {
+@@ -115,7 +115,7 @@ static void ts_hash(const char *text, const char *expect)
+ 		};
+ 		SHA256_Update(&ctx, &hashitem, sizeof(hashitem));
+ 		i++;
+-		assert(i < count);
++		assert(i <= count);
+ 	}
+ 	SHA256_Final(hash, &ctx);
+ 
diff --git a/frr.spec b/frr.spec
index cc70020..4fcfea1 100644
--- a/frr.spec
+++ b/frr.spec
@@ -1,11 +1,11 @@
-%global frrversion	7.1
+%global frrversion	7.2
 %global frr_libdir /usr/lib/frr
 
 %global _hardened_build 1
 
 Name: frr
-Version: 7.1
-Release: 5%{?checkout}%{?dist}
+Version: 7.2
+Release: 1%{?checkout}%{?dist}
 Summary: Routing daemon
 License: GPLv2+
 URL: http://www.frrouting.org
@@ -33,7 +33,7 @@ Patch0001: 0001-use-python3.patch
 Patch0002: 0002-enable-openssl.patch
 Patch0003: 0003-disable-eigrp-crypto.patch
 Patch0004: 0004-fips-mode.patch
-Patch0005: 0005-python-3.8-build.patch
+Patch0005: 0005-test-typelist-power.patch
 
 %description
 FRRouting is free software that manages TCP/IP based routing protocols. It takes
@@ -176,6 +176,9 @@ make check PYTHON=%{__python3}
 #%%{_libdir}/frr/frr/libyang_plugins/*
 
 %changelog
+* Mon Dec 16 2019 Michal Ruprich <mruprich@redhat.com> - 7.2-1
+- New version 7.2
+
 * Tue Nov 12 2019 Michal Ruprich <mruprich@redhat.com> - 7.1-5
 - Rebuilding for new version of libyang
 
diff --git a/sources b/sources
index 2d1b1f3..e99c713 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (frr-7.1.tar.gz) = ee0be872a96737e45dd841b936f66c394db2bcd857c28437dfeeeabf70cf420e69212b4b744569cc1c9f6038e7ca66211c6294ec2e94855ed8131833985e32b0
+SHA512 (frr-7.2.tar.gz) = a99cd23ef9499e28fdf3b2d23993e4a9bcfea3c5eb4c8ddc33ad50b0afab961733729116e01397af9e77918b8c0de5598f6c22bbab92050b548fb5c21e5d81d8