Add ASPA Support #285

tanneberger · 2024-01-29T18:04:41Z

Introduction

This PR introduces compatibility for RTR version 2 and handling of ASPA RTR PDUs as specified in draft-ietf-sidrops-8210bis-11, section 5.12 and adds AS_PATH verification according to draft-ietf-sidrops-aspa-verification-16, section 6.

Overview

This PR adds a new module called aspa which defines a new aspa_table organizing validated Autonomous System Provider Authorization data received from an RPKI-RTR cache server. The rtr module was enhanced to parse ASPA PDUs and update the aspa_table accordingly. Analogous to rtr_mgr_validate (prefixes/ROAs) and rtr_mgr_get_spki, we're introducing a new function rtr_mgr_verify_as_path for AS_PATH verification. rtrclient has gained a new option, -a, for printing ASPA data in addition to -p (prefixes) and -k.

Detailed Design

Storing ASPA Records

ASPA records are structs derived from RTR ASPA PDUs, each containing a customer ASN and a set of providers attested by the customer. The aspa_table consists of a linked list where each node holds a reference to an rtr_socket and an aspa_array⏤an ordered dynamic array of ASPA records. Each aspa_array is comprised of a contiguous block of memory of ASPA records ordered by their customer ASN, enabling faster lookups by binary searching the array of records.

Updating an ASPA Table

The ASPA table implements aggregated updating using an array of add record and remove record operations that will be performed sequentially on the ASPA table. This drastically decreases the number of iterations necessary on the existing aspa_array to 1. This PR implements two update mechanisms:

In-Place: The aspa_array is manipulated in-place in a single iteration, reducing new memory allocations while blocking callers wanting to verify an AS_PATH (therefore needing read access to the table).
Swap-In: A new aspa_array is created, incorporating both existing records and simultaneously adding new records in a single iteration. While this approach enables non-blocking updates, it's got a slightly higher memory demand.

Details: aspa_private.h

Alternatives Considered

Other Data Structures

splaytree-4
kbtree-4
dynarray (only sorted by cas)
binsearch (provider arrays and cas are sorted)

This plot shows how the different data structures compare in different benchmarks against each other:

AS_PATH Verification Algorithm Implementation

We tested several implementations of the verification algorithm: netd-tud/IETF-ASPA/hackathon. The algorithm integrated into this PR is an optimized version of the draft algorithm which avoids checking any AS hop twice.

Tests & Quality

This PR has test coverage for

ASPA PDUs,
modifications and search on an aspa_array,
updates to an aspa_table and rtr_sync with ASPA
AS_PATH verification
Interoperability tests with standard RTR-Cache Server implementations (Routinator) were successfully performed.

Additionally, we checked for memory leaks and other faulty memory access using valgrind --leak-check=full.

Stats

Based on ASRank relationships we estimate ~75K ASPA records inferred from BGP paths. As an upper limit we consider an ASPA record to take up 24 bytes of memory.

Update Mechanism Performance Measurements

We conducted performance tests on both update approaches:

Using the In-Place approach, adding 75K ASPA records in single update function call took ~100 ms on a reasonably sized laptop.
The Swap-In mechanism has almost no effect on the time read access is blocked due to the old array just being swapped out in exchange for the new one.

Ping: @waehlisch @mroethke @fho

waehlisch · 2024-02-28T22:41:04Z

@mroethke @fho do you have time to give some feedback on this PR? ASPA is getting momentum and it would be important to provide ASPA support in the RTRlib.

fho · 2024-02-29T19:28:04Z

@mroethke @fho do you have time to give some feedback on this PR? ASPA is getting momentum and it would be important to provide ASPA support in the RTRlib.

Yes, I'll have a look before end of next week.

fho

The implementation looks great to me, well structured, simple to follow and understand. The PR description was very helpful, it made it easy for me to get into it.
I could not find any issues, only trivial things that could be improved.
I was not able to verify every detail but everything I looked up is aligned with the draft.

rtrlib/rtr/packets.c

fho · 2024-03-03T14:56:30Z

rtrlib/rtr/packets.c

+		if (((struct pdu_aspa *)pdu)->afi_flags != 0b11)
+			RTR_DBG1("Warning: AFI flags of received ASPA PDU not set to 0x03");


I wonder if ignoring an unexpected value here might cause issue when afi_flags in the future also supports other values with a different meaning. But that probably only happens when the protocol version is also incremented and therefore it is safe to ignore it.

rtrlib/rtr/packets.c

rtrlib/aspa/aspa_array/aspa_array.h

rtrlib/aspa/aspa_array/aspa_array.c

rtrlib/aspa/aspa_verification.c

rtrlib/rtr_mgr.c

carl-tud · 2024-03-13T06:50:16Z

Thanks, @fho. I don’t really have time this week, but I’ll address the changes you requested next week

tanneberger · 2024-05-02T11:58:21Z

@fho Did you take a look at the new changes yet?

fho · 2024-05-02T13:45:10Z

@fho Did you take a look at the new changes yet?

No, I was still waiting for an answer regarding the changed rtr_mgr_init signature + compatibility (#285 (comment))

fho · 2024-05-02T16:26:23Z

@tanneberger I think there is a confusion because you replied on another thread, that I did not meant. (or you reply was not related to my last comment).
The rtr_mgr_init discussion is still open (#285 (comment)).
That you changed the array allocation I saw (#285 (comment))

tanneberger · 2024-05-02T16:33:06Z

@fho yeah also just realized that, now the comment is in the correct thread.

tanneberger · 2024-05-02T21:43:11Z

@fho I went a head and quickly implemented by suggestion, see (6d1222b)

waehlisch · 2024-05-04T09:41:22Z

CI: rerun

waehlisch · 2024-05-04T09:45:43Z

can you rebase?

- add support for rtrv2 including aspa pdus - move rtr pdus to separate header - refactor undo-update logic - add aspa in-place and swap-in update mechanism Co-authored-by: mrzslz <[email protected]> Co-authored-by: carl <[email protected]>

- add `aspa_array`, an ordered dynamic array - add `aspa_table` for storing and managing aspa data - add aspa table update functions - add AS_PATH verification algorithm Co-authored-by: mrzslz <[email protected]> Co-authored-by: carl <[email protected]>

- add aspa_table to rtr_mgr functions - fix typos and format Co-authored-by: mrzslz <[email protected]> Co-authored-by: carl <[email protected]>

- add tests for AS_PATH verification - add tests for `aspa_array` - add tests for aspa pdu parsing and `aspa_table` updating - add tests for live interaction with rtr cache servers Co-authored-by: mrzslz <[email protected]> Co-authored-by: carl <[email protected]>

- update main cmake file Co-authored-by: mrzslz <[email protected]> Co-authored-by: carl <[email protected]>

- removing self-explanatory comments - renaming include guards of ASPA_ARRAY - removing double negation - moving pthread_unlock

tanneberger · 2024-05-04T14:12:45Z

CI: rerun

fho · 2024-05-11T10:55:32Z

Let's merge it as soon as @tanneberger gives the final go.

rtrlib/aspa/aspa_array/aspa_array.c

- adjusted tests and tools - added function rtr_mgr_setup_sockets with functionality that previously resided in rtr_mgr_init

- using lrtr_realloc instead of malloc & memcpy - decreasing the capacity of the array when possible

- added null ptr checks in pfx_validate, aspa_verify and spki_validate - added warnings if the user tries to validate objects where there is no table

tanneberger · 2024-05-20T15:28:57Z

@fho I also had to change the user interface: see 0dbb123

-> rtr_mgr_init also creates the sockets and copies the pointers to the (prefix/spki/aspa) table into the socket struct. This is problematic because at this point the various tables have not yet been initialized and the socket therefore only has null pointers.
-> By creating a new function rtr_mgr_setup_sockets which is called by the user after all correct table pointers have been copied to the sockets

I also added more validation to handle the new scenario that the user only initialized some tables. I added checks in the validation functions and in the update functions: See this commit: 7a2b951

fho · 2024-05-25T08:28:07Z

Link to aspa_array_reserve discussion: 6eed5ee#r142285681

I had a hard time to find it in the UI, GitHub has hidden after a small bubble symbol next to the commit

- updating README - up- and downscaling now uses an linear offset of 1000

tanneberger force-pushed the new-history branch from b4d73c9 to 958da6d Compare January 31, 2024 08:31

fho requested review from fho and mroethke February 29, 2024 19:31

fho assigned tanneberger Feb 29, 2024

fho linked an issue Feb 29, 2024 that may be closed by this pull request

ASPA support #278

Closed

fho mentioned this pull request Feb 29, 2024

[DRAFT] Vector Data-Structure #279

Closed

1 task

fho approved these changes Mar 10, 2024

View reviewed changes

tanneberger requested a review from fho March 13, 2024 22:07

tanneberger force-pushed the new-history branch from da42162 to 53775d3 Compare April 9, 2024 21:30

carl-tud mentioned this pull request Apr 15, 2024

rtr: Fix incomplete undo after failed table update #281

Open

tanneberger and others added 6 commits May 4, 2024 16:11

rtr: add support for aspa pdus

3377d3e

- add support for rtrv2 including aspa pdus - move rtr pdus to separate header - refactor undo-update logic - add aspa in-place and swap-in update mechanism Co-authored-by: mrzslz <[email protected]> Co-authored-by: carl <[email protected]>

rtrlib: add aspa to central management data structure

22bc099

- add aspa_table to rtr_mgr functions - fix typos and format Co-authored-by: mrzslz <[email protected]> Co-authored-by: carl <[email protected]>

tests: add aspa tests

4656303

- add tests for AS_PATH verification - add tests for `aspa_array` - add tests for aspa pdu parsing and `aspa_table` updating - add tests for live interaction with rtr cache servers Co-authored-by: mrzslz <[email protected]> Co-authored-by: carl <[email protected]>

tools: update rtrclient to support aspa

3eb8885

- update main cmake file Co-authored-by: mrzslz <[email protected]> Co-authored-by: carl <[email protected]>

rtrlib: incorperating suggestions from Fabian Holler

6eed5ee

- removing self-explanatory comments - renaming include guards of ASPA_ARRAY - removing double negation - moving pthread_unlock

tanneberger force-pushed the new-history branch from 6d1222b to a885aa1 Compare May 4, 2024 14:11

fho reviewed May 11, 2024

View reviewed changes

rtrlib/aspa/aspa_array/aspa_array.c Outdated Show resolved Hide resolved

fho reviewed May 11, 2024

View reviewed changes

rtrlib/aspa/aspa_array/aspa_array.c Show resolved Hide resolved

tanneberger force-pushed the new-history branch from bf69b70 to 2ae8867 Compare May 11, 2024 16:42

rtrlib: reworking user interface adding rtr_mgr_setup_sockets function

02f52d7

- adjusted tests and tools - added function rtr_mgr_setup_sockets with functionality that previously resided in rtr_mgr_init

tanneberger force-pushed the new-history branch from 2ae8867 to 02f52d7 Compare May 20, 2024 14:08

tanneberger added 3 commits May 20, 2024 16:20

rtrlib: apply proper formatting

0dbb123

rtrlib: optimizing aspa_array

48074d5

- using lrtr_realloc instead of malloc & memcpy - decreasing the capacity of the array when possible

rtrlib: extra checks for when user didn't initialize some tables

7a2b951

- added null ptr checks in pfx_validate, aspa_verify and spki_validate - added warnings if the user tries to validate objects where there is no table

ton31337 mentioned this pull request Dec 12, 2024

RPKI: ASPA support FRRouting/frr#13751

Closed

tanneberger force-pushed the new-history branch from 81ea44d to 3ba7a1c Compare February 5, 2025 01:49

waehlisch approved these changes Feb 5, 2025

View reviewed changes

tanneberger force-pushed the new-history branch 2 times, most recently from 2fa0c7f to 1de3677 Compare February 6, 2025 08:49

rtrlib: replace exponential up- and downscaling from aspa_array

35d45be

- updating README - up- and downscaling now uses an linear offset of 1000

tanneberger force-pushed the new-history branch from 1de3677 to 35d45be Compare February 6, 2025 09:00

tanneberger merged commit 295cb8e into rtrlib:master Feb 6, 2025

		if (((struct pdu_aspa *)pdu)->afi_flags != 0b11)
		RTR_DBG1("Warning: AFI flags of received ASPA PDU not set to 0x03");

Add ASPA Support #285

Add ASPA Support #285

Uh oh!

Conversation

tanneberger commented Jan 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Introduction

Overview

Detailed Design

Storing ASPA Records

Updating an ASPA Table

Alternatives Considered

Other Data Structures

AS_PATH Verification Algorithm Implementation

Tests & Quality

Stats

Update Mechanism Performance Measurements

Uh oh!

waehlisch commented Feb 28, 2024

Uh oh!

fho commented Feb 29, 2024

Uh oh!

fho left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fho Mar 3, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

carl-tud commented Mar 13, 2024

Uh oh!

tanneberger commented May 2, 2024

Uh oh!

fho commented May 2, 2024

Uh oh!

fho commented May 2, 2024

Uh oh!

tanneberger commented May 2, 2024

Uh oh!

tanneberger commented May 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

waehlisch commented May 4, 2024

Uh oh!

waehlisch commented May 4, 2024

Uh oh!

tanneberger commented May 4, 2024

Uh oh!

fho commented May 11, 2024

Uh oh!

Uh oh!

Uh oh!

tanneberger commented May 20, 2024

Uh oh!

fho commented May 25, 2024

Uh oh!

Uh oh!

tanneberger commented Jan 29, 2024 •

edited

Loading

fho left a comment •

edited

Loading

tanneberger commented May 2, 2024 •

edited

Loading