B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections. Squash of 94 local commits onto remote master.
2 KiB
| id | repo | severity | status | created |
|---|---|---|---|---|
| frrouting-0001 | FRRouting/frr | HIGH | PATCHED | 2026-03-23 |
Defect
File: ospfd/ospf_ti_lfa.c:72,114,227,278,285
Pattern: listnode_lookup(q_space->pc_path, vertex) — linear scan through post-convergence path list
Complexity: O(path_length²) per protected element during TI-LFA backup computation
Language: C
Description
FRRouting's TI-LFA (Topology Independent Loop-Free Alternates) implementation uses
listnode_lookup() — a linear scan through a doubly-linked list — to locate vertices in
the post-convergence path (pc_path) during backup tunnel construction. The function is
called 5 times in the same file. For each protected link or node, TI-LFA must find the
P-node and Q-node positions within the post-convergence path, performing O(path_length)
work per lookup. On a network with N routers and P protected elements, total TI-LFA
computation is O(P × path_length), where both P and path_length grow with N.
Note: The main OSPF SPF implementation (ospf_spf.c) is clean — it uses the
LSA_SPF_IN_SPFTREE pointer flag (O(1) membership) and a skip-list priority queue.
Only the TI-LFA extension has the defect.
Fix
Replace: listnode_lookup(pc_path, vertex) — O(n) linked-list scan
With: vertex index stored in the vertex struct, or a companion hash map vertex → listnode*
Data structure change: add struct listnode *pc_path_node to struct vertex so
lookup is O(1) via vertex->pc_path_node — set when path is built, nulled on cleanup.
Work required
- Patch in
defects/frrouting/patch/frrouting-0001-pc-path-index.patch - Unit test — asserts exact operation counts before/after (in
defects/frrouting/unit/) - Integration test (in
defects/frrouting/integration/) - Benchmark — before/after on network with V=50,100,200,400 routers with full mesh protection (in
defects/frrouting/bench/) - White paper section —
whitepaper/vectors/networking/frrouting.rst