Partial specification of routing configurations WRiPE, 17 October 2011, Vancouver Alexander Gurney Limin Jia Anduo Wang Boon Thau Loo
full partial (Image: NASA Goddard Space Flight Center) Charlevoix map, 1744 (Image: U. South Carolina)
Partial specification in routing • We very often lack complete information about the network configuration. – What are our neighbors doing? – What are we doing? – How can I reason about parts of the network that are not configured yet? • Our theoretical tools must take account of this situation.
Convergence analysis workflow Design a network configuration no, try again Does it pass yes the safety test? Great!
Test incomplete configurations If the general idea is OK, then carry on to specify more details, refining the design, checking at each stage, until the configuration is finished.
Our paper • A modest extension to “stable paths problem” analysis. • Some path preferences are known, some are unknown (undecided). • The topology and protocol are fixed.
Stable paths CAd ≺ CABd ≺ CBd problem instance C Some paths don’t appear in the list: they are not permitted (like CBAd here) ABd ≺ ACBd ≺ Ad Bd ≺ BCAd ≺ BAd A B Path preferences for A: ABd is best, Ad is worst d The destination we are trying to reach
Partial CAd ≺ CABd ≺ CBd stable paths C problem instance Some paths don’t appear in the list: they are not permitted (like CBAd here) ABd ≺ ACBd ≺ Ad Bd ≺ BAd; {BCAd} A B Paths may be permitted Path preferences for A: but unranked, like BCAd ABd is best, Ad is worst here. We have not yet decided how good it is. d The destination we are trying to reach
Completing a PSPP • If we have Bd ≺ BAd, with BCAd unranked, there are three options. 1. BCAd ≺ Bd ≺ BAd 2. Bd ≺ BCAd ≺ BAd 3. Bd ≺ BAd ≺ BCAd • Each of these determines a full SPP.
Dispute wheels • A “bad” sub -configuration • Oscillation implies the presence of a wheel • If there are no wheels, then BGP converges • Cycle of nodes, each with a path to d . • Everybody would rather go round the cycle than go straight in. • These preferences are irreconcilable: d the nodes will never “agree” which one has to suffer and take the direct path.
Correctness property • We know what safety means for complete SPP instances ( ≈ BGP configurations) • For partial SPPs (PSPPs), safety means that there is at least one way of resolving the remaining preferences, so that the resulting complete SPP is safe . • How easy is this to check?
Where do dispute wheels lurk? known part unknown part
Where do dispute wheels lurk? known part unknown part There could already be a wheel – and this will not go away.
Where do dispute wheels lurk? known part unknown part In the unknown part, anything could happen.
Where do dispute wheels lurk? known part unknown part Could there be a partial configuration that has no wheel yet , but where every completion contains a wheel?
Unfortunately, yes • However, the good news is that we can detect this situation, without having to look at every possible completion. • We can follow a similar procedure as for ordinary dispute wheel checking.
A E ABd ≺ Ad C BCEd ≺ Bd {CAd, CEd} unranked EFd ≺ Ed B F FCAd ≺ Fd d If CAd ≺ CEd then A, B and C are in a dispute wheel. If CEd ≺ CAd then C, E and F are in a dispute wheel.
A E ABd ≺ Ad C BCEd ≺ Bd CAd ≺ CEd EFd ≺ Ed B F FCAd ≺ Fd d If CAd ≺ CEd then A, B and C are in a dispute wheel. If CEd ≺ CAd then C, E and F are in a dispute wheel.
A E ABd ≺ Ad C BCEd ≺ Bd CEd ≺ CAd EFd ≺ Ed B F FCAd ≺ Fd d If CAd ≺ CEd then A, B and C are in a dispute wheel. If CEd ≺ CAd then C, E and F are in a dispute wheel.
Use the “paths digraph” • Encodes the preference and topology information is a slightly different form. • As new preferences are added, we include new arcs in the paths digraph. • Dispute wheels correspond to cycles in the paths digraph.
A E ABd ≺ Ad BCEd ≺ Bd C {CAd, CEd} unranked EFd ≺ Ed B F FCAd ≺ Fd d
A E ABd ≺ Ad BCEd ≺ Bd C {CAd, CEd} unranked EFd ≺ Ed B F FCAd ≺ Fd d Fd FCAd CAd Ad EFd ABd d Ed CEd BCEd Bd
A E ABd ≺ Ad BCEd ≺ Bd C {CAd, CEd} unranked EFd ≺ Ed B F FCAd ≺ Fd d Fd FCAd CAd Ad EFd ABd d Ed CEd BCEd Bd
Observations • No need to define “dispute wheel” on PSPPs • Just look for cycles in the paths digraph • If there is already a cycle , adding new arcs will not make it go away. • If there is no cycle , we can topologically sort the digraph, and insert any new arcs in the direction of the sort. So in this case we can always avoid making a dispute wheel.
The configuration space • A partial configuration is implicitly associated with the set of its completions. • We now know how to see if at least one of these completions is safe. • What is the structure of the safe space? • Is there any way to choose an “optimal” completion, if there is more than one safe choice?
Our idea • In this paper, we look at safe completion for MED/IGP interaction. • We know everything except the IGP arc weights (and therefore the path preferences they induce). • Using PSPP theory, we can derive numeric safety constraints for these weights.
w R S w x y z safe x y z 1 5 4 12 no A B C 20 5 4 12 yes MED: 1 MED: 0 X Y 1 2 1 4 no d
Methodology • Construct a PSPP instance for the known preferences. • For unknown preferences, we know where the preference arc will be, but not which direction it will point. • Consider all ways of orienting those arcs that do not create a cycle in the paths digraph.
w R S x y z A B C MED: 1 MED: 0 X Y d
w R S x y z A B C MED: 1 MED: 0 X Y d
w R S x y z A B C MED: 1 MED: 0 X Y d
w R S x y z A B C MED: 1 MED: 0 X Y d (RSCYd ≺ RAXd ) or (RAXd ≺ RSCYd and RAXd ≺ RBYd) (w + z < x) or ( x < w + z and x < y )
Result • We obtain a logical formula over possible path preferences, something like: ( p ≺ q ) ∨ ( q ≺ p ∧ r ≺ s ) ∨ ( s ≺ r ∧ u ≺ t ) • Each preference corresponds to an integer inequality over the arc weights , like: p ≺ q if and only if a + b + c < d + e
Bounding the safe space • What we end up with is a collection of linear integer inequalities . • However, we have disjunctions. So the safe space is, in general, not convex. – Each clause in the DNF does determine a convex subspace • The actual safe space may be larger than we detect here.
Each inequality y > x + 2 defines a half-space.
The safe space can be y > 4 non-convex , due to the presence of disjunctions. x > 7
A common ¬ P ∧ Q pattern: P is enough but if we can’t have it, then P we need Q .
Idea: Use with LWO • Link weight optimization: Given traffic demand matrix, determine IGP weights that are in some way “good”. • These weights are also used in BGP, where they can cause instability. • Use our “safe space” predicate to bound the optimization process – find weight matrices that are optimal subject to the constraint.
Idea: Look at robustness • Is a given weight matrix close to the boundary of the safe space, or somewhere in the interior? • Are there good ways to transition from one safe matrix to another?
Idea: Identify solution regimes • Each disjunction is giving a different way to achieve safety – “Make w really big” – or “Make w + x + y smaller than f + h ” • Can we use PSPP exploration to identify families of solutions?
Some future work • Extend to “algebraic” model of routing • Consider more examples of partial specification – what else could be unknown? • Consider probabilistic models of partial information • Consider “policy privacy” issues
Joan Blaeu, 1664 Thank you!
Recommend
More recommend
