ospfd: RFC 4222 R4 per-neighbor LSA gap pacing

[raviravindran123]

Implements RFC 4222 Recommendation 4: per-neighbor LSA gap pacing.

When enabled on an interface, outbound LSAs are queued per-neighbor
and metered at a configurable inter-packet gap rather than sent
back-to-back. The gap adapts using MIMD: grows multiplicatively when
the unacknowledged LSA count exceeds a high-watermark, shrinks
multiplicatively when it falls below a low-watermark.

New commands (all interface-scoped):
ip ospf lsa-pacing
ip ospf lsa-pacing min-gap max-gap
ip ospf lsa-pacing initial-gap
ip ospf lsa-pacing factor
ip ospf lsa-pacing adjust-interval
ip ospf lsa-pacing max-lsas-per-update
ip ospf lsa-pacing low-watermark high-watermark

Defaults: min/initial gap 20 ms, max 1000 ms, factor 2,
adjust-interval 1000 ms, high-water 100, low-water 2, max-lsas 1.

This feature is independent of R5 adjacency pacing (also on this
branch) — neither gates the other.

Topotests added under tests/topotests/ospf_rfc4222_r4/:

• CLI persist/reload
• Gap metering (functional)
• Opaque LSA pacing
• MIMD adaptation under congestion

[raviravindran123]

@greptile

[greptile-apps]

Greptile Summary

This PR implements RFC 4222 Recommendation 4 (per-neighbor LSA gap pacing) in ospfd, alongside R5 adjacency pacing. When enabled on an interface, outbound LSAs are queued per-neighbor and metered at a configurable inter-packet gap that adapts via MIMD based on unACKed LSA watermarks.

• R4 LSA pacing: new per-neighbor r4_send_queue, a paced send timer (ospf_r4_nbr_send_timer), MIMD gap adjustment (pace_maybe_adjust_gap), and per-packet sent_lsas tracking for the ls_rxmt_unacked counter.
• R5 adjacency pacing: per-interface ospf_adj_pacing struct with static/dynamic modes, MIMD limit adjustment via ospf_adj_dyn_adjust_timer, and throttle hooks in nsm_twoway_received/nsm_adj_ok.
• CLI and topotests: seven new interface-scoped ip ospf lsa-pacing sub-commands with persistence/reload and functional MIMD congestion tests.

Confidence Score: 2/5

Not safe to merge as-is: the ls_rxmt_unacked counter permanently accumulates on LSA re-origination, and disabling R4 pacing on a live interface silently drops LSAs not yet recorded in the retransmit list.

The ls_rxmt_unacked counter is the sole feedback signal driving both MIMD algorithms. When ospf_ls_retransmit_add supersedes an older LSA version it discards the old node without decrementing the counter, so after each re-origination cycle the counter can only grow. In a production network with frequent topology changes this permanently disables the gap-shrink and adjacency-increase halves of both algorithms. Separately, toggling no ip ospf lsa-pacing while a flood is in progress abandons LSAs queued for initial delivery that have no retransmit record, causing LSDB divergence.

ospfd/ospf_flood.c (ospf_ls_retransmit_add around line 1143) and ospfd/ospf_interface.c (ospf_rec4_recompute_effective) need fixes before this is safe to enable in production.

Important Files Changed

Filename	Overview
ospfd/ospf_packet.c	Core of the R4 pacing implementation: per-neighbor send queue, paced send timer, MIMD gap adjustment, ospf_count_sent_lsa tracking; redundant retransmit-add on the retransmit path can reset ls_rxmt_list entry timing on concurrent re-origination.
ospfd/ospf_flood.c	Adds R4 pacing hooks in ospf_flood_through_interface and ospf_ls_retransmit_delete; the unchanged ospf_ls_retransmit_add does not decrement ls_rxmt_unacked when superseding an older LSA, causing the MIMD counter to permanently drift upward.
ospfd/ospf_interface.c	Adds R4 effective-param caching (ospf_rec4_recompute_effective) and R5 adjacency pacing init; disabling R4 pacing on a live interface does not drain r4_send_queue, silently abandoning unflooded LSAs on the initial-flood path.
ospfd/ospf_nsm.c	Implements R5 adjacency pacing: queue init/flush, MIMD dynamic adjustment, throttle hooks in nsm_twoway_received and nsm_adj_ok, in_progress tracking in nsm_change_state; logic is sound.
ospfd/ospf_vty.c	Adds CLI for R4 LSA-pacing and R5 adjacency-pacing; config-write correctly guards sub-parameters behind gap_pacing_enable.
ospfd/ospf_interface.h	Adds R4 pacing parameter defaults and runtime fields to ospf_if_params and ospf_interface; R5 adjacency pacing structs also added.
ospfd/ospf_neighbor.h	Adds per-neighbor R4 pacing fields (lsu_gap_ms, next_send_ms, r4_send_queue, ls_rxmt_unacked) and R5 queue linkage.
ospfd/ospf_lsdb.h	Adds counted_sent bool to ospf_lsdb_linked_node for unACKed LSA tracking; minimal, correct addition.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Flood as ospf_flood_through_interface
    participant Q as r4_send_queue
    participant Timer as ospf_r4_nbr_send_timer
    participant Send as ospf_ls_upd_queue_send
    participant Write as ospf_write
    participant Count as ospf_count_sent_lsa
    participant RxmtDB as nbr->ls_rxmt
    participant MIMD as pace_maybe_adjust_gap
    Flood->>Q: ospf_r4_nbr_enqueue(nbr, lsa)
    Note over Q: skips ls_retransmit_add
    Timer->>Send: ospf_ls_upd_queue_send(oi, r4_send_queue, nbr)
    Send->>RxmtDB: ospf_ls_retransmit_add(dst_nbr, lsa)
    Send->>Write: ospf_packet_add(oi, op)
    Write->>Count: ospf_count_sent_lsa(oi, dst, lsa)
    Count->>RxmtDB: "lookup counted_sent=false, ls_rxmt_unacked++"
    Note over MIMD: ACK arrives
    MIMD->>RxmtDB: ospf_ls_retransmit_delete, ls_rxmt_unacked--
    MIMD->>MIMD: "pace_maybe_adjust_gap U<=L shrink gap"

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Flood as ospf_flood_through_interface
    participant Q as r4_send_queue
    participant Timer as ospf_r4_nbr_send_timer
    participant Send as ospf_ls_upd_queue_send
    participant Write as ospf_write
    participant Count as ospf_count_sent_lsa
    participant RxmtDB as nbr->ls_rxmt
    participant MIMD as pace_maybe_adjust_gap
    Flood->>Q: ospf_r4_nbr_enqueue(nbr, lsa)
    Note over Q: skips ls_retransmit_add
    Timer->>Send: ospf_ls_upd_queue_send(oi, r4_send_queue, nbr)
    Send->>RxmtDB: ospf_ls_retransmit_add(dst_nbr, lsa)
    Send->>Write: ospf_packet_add(oi, op)
    Write->>Count: ospf_count_sent_lsa(oi, dst, lsa)
    Count->>RxmtDB: "lookup counted_sent=false, ls_rxmt_unacked++"
    Note over MIMD: ACK arrives
    MIMD->>RxmtDB: ospf_ls_retransmit_delete, ls_rxmt_unacked--
    MIMD->>MIMD: "pace_maybe_adjust_gap U<=L shrink gap"

Loading

Comments Outside Diff (1)

1. ospfd/ospf_flood.c, line 1142-1163 (link)

   ls_rxmt_unacked leaks on LSA version supersession

   When ospf_ls_retransmit_add replaces an older LSA version with a newer one (the ospf_lsa_more_recent(old, lsa) < 0 branch), it frees the old ospf_lsdb_linked_node but never checks whether that node had counted_sent = true. If it did, nbr->ls_rxmt_unacked is NOT decremented, even though the tracked retransmit entry no longer exists.

   Concrete failure: each time a re-originated LSA instance (new sequence number) supersedes an older one that was already counted-sent, the counter grows by one and is never reclaimed — not even when the new version is ACKed (which calls ospf_ls_retransmit_delete once for the new version only). After enough re-originations the MIMD watermark U > L is permanently satisfied, so the gap never shrinks to its minimum and R5 dynamic adjacency pacing always perceives congestion.

   Fix: in the if (old) block (around line 1143) check ls_rxmt_node->counted_sent and decrement nbr->ls_rxmt_unacked before calling ospf_lsdb_delete.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: ospfd/ospf_flood.c
   Line: 1142-1163
   
   Comment:
   **`ls_rxmt_unacked` leaks on LSA version supersession**
   
   When `ospf_ls_retransmit_add` replaces an older LSA version with a newer one (the `ospf_lsa_more_recent(old, lsa) < 0` branch), it frees the old `ospf_lsdb_linked_node` but never checks whether that node had `counted_sent = true`. If it did, `nbr->ls_rxmt_unacked` is NOT decremented, even though the tracked retransmit entry no longer exists.
   
   Concrete failure: each time a re-originated LSA instance (new sequence number) supersedes an older one that was already counted-sent, the counter grows by one and is never reclaimed — not even when the new version is ACKed (which calls `ospf_ls_retransmit_delete` once for the new version only). After enough re-originations the MIMD watermark `U > L` is permanently satisfied, so the gap never shrinks to its minimum and R5 dynamic adjacency pacing always perceives congestion.
   
   Fix: in the `if (old)` block (around line 1143) check `ls_rxmt_node->counted_sent` and decrement `nbr->ls_rxmt_unacked` before calling `ospf_lsdb_delete`.
   
   How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
ospfd/ospf_flood.c:1142-1163
**`ls_rxmt_unacked` leaks on LSA version supersession**

When `ospf_ls_retransmit_add` replaces an older LSA version with a newer one (the `ospf_lsa_more_recent(old, lsa) < 0` branch), it frees the old `ospf_lsdb_linked_node` but never checks whether that node had `counted_sent = true`. If it did, `nbr->ls_rxmt_unacked` is NOT decremented, even though the tracked retransmit entry no longer exists.

Concrete failure: each time a re-originated LSA instance (new sequence number) supersedes an older one that was already counted-sent, the counter grows by one and is never reclaimed — not even when the new version is ACKed (which calls `ospf_ls_retransmit_delete` once for the new version only). After enough re-originations the MIMD watermark `U > L` is permanently satisfied, so the gap never shrinks to its minimum and R5 dynamic adjacency pacing always perceives congestion.

Fix: in the `if (old)` block (around line 1143) check `ls_rxmt_node->counted_sent` and decrement `nbr->ls_rxmt_unacked` before calling `ospf_lsdb_delete`.

_{Reviews (2): Last reviewed commit: "tests: add RFC4222 R4 LSA pacing topotes..." | Re-trigger Greptile}

[raviravindran123]

Force-pushed an update addressing a defect found in further testing of the paced retransmit path:

• The retransmit timer could enqueue duplicate copies of an unacked LSA whenever queue residence exceeded the retransmit interval (unbounded queue growth under congestion — precisely the regime R4 pacing targets). Each retransmission-list entry now tracks its queued copy (r4_qnode); the timer reschedules instead of duplicating, ACKs and newer instances purge stale queued copies in O(1), and disabling pacing at runtime hands never-transmitted queued LSAs to the regular retransmission machinery instead of dropping them.
• Moved the live pacing-parameter propagation hunks from the tests commit into the ospfd commit where they belong; the tests commit is now purely tests.
• Added a heavy-load regression topotest (test_ospf_lsa_pacing_congested.py::test_congested_heavy_load_no_duplicate_retransmits): 20 LSAs paced at 500 ms under a 13 s ACK blackout with a 3 s retransmit interval — asserts the adjacency holds throughout and the retransmission list converges to zero promptly once ACKs resume.

[riw777]

Can we get the linter error fixed? Thanks!