When Export Policy is configured, withdrawn NLRI can only ever contain routes allowed by Export Policy

[taspelund]

   1886         if let ImportExportPolicy::Allow(ref policy) =
   1887             lock!(self.session).allow_export
   1888         {
   1889             let message_policy = policy
   1890                 .iter()
   1891                 .filter_map(|x| match x {
   1892                     rdb::Prefix::V4(x) => Some(x),
   1893                     _ => None,
   1894                 })
   1895                 .map(|x| crate::messages::Prefix::from(*x))
   1896                 .collect::<BTreeSet<crate::messages::Prefix>>();
   1897
   1898             update.nlri.retain(|x| message_policy.contains(x));
   1899             update.withdrawn.retain(|x| message_policy.contains(x));
   1900         };

bgp/src/session.rs

Line 1899 is only retaining routes in the withdrawn nlri list that pass the export policy.
This means that reconfiguring the export policy will not result in previously-allowed routes getting withdrawn.