metrics: export each session's TCP connection figures

The kernel's view of a session's TCP connection, which the status page
shows on request since the last change, could not be looked at after
the fact: a feed that crawled overnight left no record of whether the
peer's window or our own side held it up.

This change samples it at every scrape of `/metricz`: for each
established session, one `NETLINK_SOCK_DIAG` round trip, and twenty
gauges labelled by peer, `bgp_peer_tcp_*`: smoothed, least and variance
of the round-trip time; the congestion window and segment size; the
peer's receive window and ours; the send queue, the part of it not yet
sent, the receive queue and the segments in flight; retransmitted and
lost segments; the busy time and the time held up by the peer's window
and by our send buffer, cumulative, so that their rates give the share
of time a session is held up; octets sent and received; and the
delivery and pacing rates. A session the kernel has no connection for
loses its series, as does one that ends.

`SessionHandle::metric_label` is the one place a peer's metric label is
made (its name, or its address), used by the advertiser's gauge and here.

Documentation: the metrics reference lists them; the monitoring guide
gives the query for the share of time a session is held up by the
neighbor's receive window, which is the question the overnight feed
raised.

Testing: a daemon in the Linux VM with one session shows the series and
drops them when the session ends; the lab's basics phase checks the
scrape for the FRR session's round-trip time; the workspace tests pass.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Cargo.toml

@@ -65,3 +65,10 @@ tokio-stream = { version = "0.1.19", features = ["sync"] }
 reqwest = { version = "0.13.5", default-features = false, features = ["json"] }
 # The daemon's memory allocator; see bin/bgp/src/main.rs.
 tikv-jemallocator = "0.7.0"
+
+# `cargo build --profile profiling`: the release build, with the line tables
+# a profiler needs to name functions. See scripts/profile/.
+[profile.profiling]
+inherits = "release"
+debug = "line-tables-only"
+strip = "none"

crates/bench/benches/full_table.rs

@@ -3,7 +3,8 @@
 //!
 //! Run with `cargo bench -p bgp-bench --bench full_table`. Set
 //! `BENCH_PEERS` (default 4) and `BENCH_SCALE_DOWN` (default 1; 10 makes the
-//! table ten times smaller) to change the size. The table is synthetic (see
+//! table ten times smaller) to change the size. `BENCH_PRESIZE=0` leaves
+//! the table to grow as it fills, as it does without `expected_routes`. The table is synthetic (see
 //! the crate documentation); `real_table` runs on a real one.
 //!
 //! This is a stopwatch around whole operations at full size, not a
@@ -148,6 +149,9 @@ fn main() {
 fn into_table(wire: &[Vec<BytesMut>], routes: usize, threads: usize) {
     let region = Region::begin();
     let table = RibTable::new(threads * 16);
+    if env("BENCH_PRESIZE", 1) == 1 {
+        table.expect_prefixes(routes / wire.len());
+    }
     let peers: Vec<PeerIndex> = (0..wire.len())
         .map(|peer| {
             table

crates/bench/benches/transit.rs

@@ -42,6 +42,7 @@ fn run(
         let server = TestServer::start_with(4_200_000_000, |config| {
             config.export = Arc::new(ExportPolicy {
                 learned_routes: !matches!(passing, Passing::Not),
+                all_paths: false,
                 marks: match passing {
                     Passing::Dressed => Marks::parse(&[], &["64601:7".to_string()], &[]).unwrap(),
                     _ => Marks::default(),

crates/bench/examples/feed.rs

@@ -0,0 +1,158 @@
+//! Feeds the synthetic Internet routing table (see the crate documentation)
+//! to a running daemon over TCP, as one or more peers would, and holds the
+//! sessions open afterwards. This is the load for profiling the daemon as
+//! it takes in a full table; `scripts/profile/full-table.sh` runs it under
+//! `perf`.
+//!
+//! Settings, from the environment:
+//!
+//! - `FEED_TO`: where the daemon listens (default `127.0.0.1:1790`).
+//! - `FEED_PEERS`: how many peers send the table (default 1).
+//! - `FEED_SCALE_DOWN`: as `BENCH_SCALE_DOWN`; 10 makes the table ten
+//!   times smaller (default 1).
+//! - `FEED_FROM`: the first three octets of an IPv4 /24, "192.0.2". Peer N
+//!   connects from .N, which is also the next hop of its IPv4 routes.
+//!   Without it, peers connect from wherever the system puts them.
+//! - `FEED_ASN`: the first peer's AS number (default 64513); the others
+//!   follow on from it.
+//! - `FEED_HOLD_SECS`: how long the sessions stay open after the table is
+//!   sent (default 30).
+//!
+//! What is printed: when the sessions are up and how long the writes took.
+//! The writes end when the kernel's socket buffers have taken the last
+//! bytes, which is before the daemon has read them: when the table is in
+//! is for the daemon's API to say.
+
+use std::net::{Ipv4Addr, SocketAddr};
+use std::time::{Duration, Instant};
+
+use bgp_bench::{Prefixes, Shape, announcements, encoded, env};
+use bgp_integration_tests::test_peer::TestPeer;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpSocket;
+use tokio::net::tcp::OwnedWriteHalf;
+
+/// A KEEPALIVE message: the marker, the length (19) and the type (4).
+const KEEPALIVE: [u8; 19] = {
+    let mut bytes = [0xff; 19];
+    bytes[16] = 0;
+    bytes[17] = 19;
+    bytes[18] = 4;
+    bytes
+};
+
+/// How often KEEPALIVEs go out while the sessions are held open: well
+/// inside the 90 s hold time.
+const KEEPALIVE_EVERY: Duration = Duration::from_secs(20);
+
+fn mib(bytes: usize) -> f64 {
+    bytes as f64 / (1024.0 * 1024.0)
+}
+
+#[tokio::main]
+async fn main() {
+    let to: SocketAddr = std::env::var("FEED_TO")
+        .unwrap_or_else(|_| "127.0.0.1:1790".into())
+        .parse()
+        .expect("FEED_TO is an address and port");
+    let peers = env("FEED_PEERS", 1) as u32;
+    let shape = Shape::INTERNET.scaled_down(env("FEED_SCALE_DOWN", 1));
+    let from = std::env::var("FEED_FROM").ok();
+    let first_asn = env("FEED_ASN", 64513) as u32;
+    let hold = Duration::from_secs(env("FEED_HOLD_SECS", 30) as u64);
+
+    let started = Instant::now();
+    let prefixes = Prefixes::generate(shape);
+    let tables: Vec<Vec<u8>> = (1..=peers)
+        .map(|peer| {
+            encoded(&announcements(&prefixes, shape, peer))
+                .iter()
+                .flat_map(|message| message.iter().copied())
+                .collect()
+        })
+        .collect();
+    let routes = shape.prefixes() * peers as usize;
+    let bytes: usize = tables.iter().map(Vec::len).sum();
+    println!(
+        "table: {} IPv4 + {} IPv6 prefixes from each of {peers} peer(s): {routes} routes, {:.1} MiB on the wire, made in {:.2} s",
+        shape.ipv4_prefixes,
+        shape.ipv6_prefixes,
+        mib(bytes),
+        started.elapsed().as_secs_f64()
+    );
+
+    let mut sessions = Vec::new();
+    for peer in 1..=peers {
+        let socket = TcpSocket::new_v4().expect("a socket");
+        if let Some(from) = &from {
+            let address: Ipv4Addr = format!("{from}.{peer}")
+                .parse()
+                .expect("FEED_FROM is the first three octets of an IPv4 address");
+            socket
+                .bind(SocketAddr::new(address.into(), 0))
+                .expect("the peer's address is ours to connect from");
+        }
+        let stream = socket.connect(to).await.expect("the daemon listens");
+        let mut session = TestPeer::from_stream(stream);
+        session
+            .handshake(
+                first_asn + peer - 1,
+                Ipv4Addr::new(10, 0, 0, peer as u8),
+                90,
+            )
+            .await
+            .expect("the daemon takes the session");
+        sessions.push(session.into_stream());
+    }
+    println!("{peers} session(s) established; sending");
+
+    let started = Instant::now();
+    let senders: Vec<_> = sessions
+        .into_iter()
+        .zip(tables)
+        .map(|(stream, table)| {
+            tokio::spawn(async move {
+                let (mut reader, mut writer) = stream.into_split();
+                // Whatever the daemon sends back, KEEPALIVEs as a rule, is
+                // read and dropped, so that its writer is never held up.
+                tokio::spawn(async move {
+                    let mut sink = [0u8; 65536];
+                    while let Ok(n) = reader.read(&mut sink).await {
+                        if n == 0 {
+                            break;
+                        }
+                    }
+                });
+                let started = Instant::now();
+                writer.write_all(&table).await.expect("the daemon reads");
+                (writer, started.elapsed())
+            })
+        })
+        .collect();
+    let mut writers: Vec<OwnedWriteHalf> = Vec::new();
+    for (index, sender) in senders.into_iter().enumerate() {
+        let (writer, took) = sender.await.expect("the sender runs");
+        println!(
+            "peer {}: table written in {:.3} s",
+            index + 1,
+            took.as_secs_f64()
+        );
+        writers.push(writer);
+    }
+    let elapsed = started.elapsed();
+    println!(
+        "all {routes} routes written in {:.3} s: {:.2} M routes/s into the sockets",
+        elapsed.as_secs_f64(),
+        routes as f64 / elapsed.as_secs_f64() / 1e6
+    );
+
+    let deadline = Instant::now() + hold;
+    while Instant::now() < deadline {
+        tokio::time::sleep(KEEPALIVE_EVERY.min(deadline - Instant::now())).await;
+        for writer in &mut writers {
+            // A session the daemon closed is left alone.
+            let _ = writer.write_all(&KEEPALIVE).await;
+        }
+    }
+    println!("sessions closed after {} s", hold.as_secs());
+}

crates/fib/src/kernel.rs

@@ -34,8 +34,11 @@ use crate::routes::KernelRoutes;
 use crate::topology::Topology;
 use crate::{Fib, FibConfig, FibError, Stop};
 
-/// How many best routes are taken from the routing table at a time.
-const BATCH: usize = 1024;
+/// How many best routes are taken from the routing table at a time. A
+/// poll of the table costs two binary searches and a lock in every shard,
+/// however few events it brings back; with a few hundred shards, a batch
+/// of a thousand had that overhead for every eight events a shard.
+const BATCH: usize = 16384;
 
 /// How many requests are sent to the kernel in one write.
 const WRITE_BATCH: usize = 512;

crates/fib/src/lib.rs

@@ -43,6 +43,7 @@ mod kernel;
 pub mod netlink;
 pub mod plan;
 pub mod routes;
+pub mod sockdiag;
 pub mod topology;
 
 use std::net::IpAddr;

crates/fib/src/plan.rs

@@ -317,6 +317,14 @@ pub struct Plan {
     unresolved_counts: [usize; Unresolved::ALL.len()],
     /// Prefixes whose route the kernel refused.
     refused: HashSet<IpPrefix>,
+    /// How many entries of `installed` are blackhole routes, and how many
+    /// are kept from an earlier run without having been confirmed. Kept in
+    /// step with the map by [`Plan::put`] and [`Plan::take`], so that
+    /// asking costs nothing however large the table: the kernel task asks
+    /// after every batch of changes, and a scan of a million entries each
+    /// time was a third of its work.
+    blackholes: usize,
+    kept_unconfirmed: usize,
 }
 
 impl Plan {
@@ -327,10 +335,38 @@ impl Plan {
 
     /// How many of the routes the kernel has drop their packets.
     pub fn blackholes(&self) -> usize {
-        self.installed
-            .values()
-            .filter(|entry| entry.target == Some(Target::Discard))
-            .count()
+        self.blackholes
+    }
+
+    /// What `entry` counts for: one if it is a blackhole route, and one if
+    /// it is kept from an earlier run without having been confirmed.
+    fn weigh(entry: &Entry) -> (usize, usize) {
+        (
+            usize::from(entry.target == Some(Target::Discard)),
+            usize::from(entry.kept && !entry.confirmed),
+        )
+    }
+
+    /// Puts `entry` in as the route of `prefix`, in place of what was
+    /// there, keeping the counts in step.
+    fn put(&mut self, prefix: IpPrefix, entry: Entry) {
+        let (blackhole, kept) = Self::weigh(&entry);
+        self.blackholes += blackhole;
+        self.kept_unconfirmed += kept;
+        if let Some(old) = self.installed.insert(prefix, entry) {
+            let (blackhole, kept) = Self::weigh(&old);
+            self.blackholes -= blackhole;
+            self.kept_unconfirmed -= kept;
+        }
+    }
+
+    /// Takes the route of `prefix` out, keeping the counts in step.
+    fn take(&mut self, prefix: &IpPrefix) -> Option<Entry> {
+        let old = self.installed.remove(prefix)?;
+        let (blackhole, kept) = Self::weigh(&old);
+        self.blackholes -= blackhole;
+        self.kept_unconfirmed -= kept;
+        Some(old)
     }
 
     /// How many prefixes have a best route that could not be given to the
@@ -383,7 +419,7 @@ impl Plan {
     /// have sent theirs again, and to remove everything meanwhile would
     /// stop the machine forwarding for as long as that takes.
     pub fn adopt(&mut self, prefix: IpPrefix, target: Option<Target>, keep: bool) {
-        self.installed.insert(
+        self.put(
             prefix,
             Entry {
                 target,
@@ -396,32 +432,36 @@ impl Plan {
     /// How many routes are being kept from an earlier run without the
     /// routing table having confirmed them.
     pub fn kept(&self) -> usize {
-        self.installed
-            .values()
-            .filter(|entry| entry.kept && !entry.confirmed)
-            .count()
+        self.kept_unconfirmed
     }
 
     /// The time for keeping unconfirmed routes of an earlier run is over:
     /// those the routing table still does not have go.
     pub fn release(&mut self) -> Vec<Op> {
         let mut stale = Vec::new();
+        let mut blackholes_gone = 0;
         self.installed.retain(|prefix, entry| {
             let goes = entry.kept && !entry.confirmed;
             entry.kept = false;
             if goes {
                 stale.push(Op::Remove { prefix: *prefix });
+                blackholes_gone += usize::from(entry.target == Some(Target::Discard));
             }
             !goes
         });
+        // What stays was confirmed, and is now not kept either.
+        self.kept_unconfirmed = 0;
+        self.blackholes -= blackholes_gone;
         stale
     }
 
     /// The whole table follows: nothing is known to be wanted until it is
     /// heard of again.
     pub fn reset(&mut self) {
+        self.kept_unconfirmed = 0;
         for entry in self.installed.values_mut() {
             entry.confirmed = false;
+            self.kept_unconfirmed += usize::from(entry.kept);
         }
         self.forget_unresolved_and_refused();
     }
@@ -442,20 +482,26 @@ impl Plan {
                     confirmed: true,
                     kept: false,
                 });
+                let before = Self::weigh(entry);
                 entry.confirmed = true;
-                if entry.target == Some(target) {
-                    return None;
-                }
+                let op = if entry.target == Some(target) {
+                    None
+                } else {
                     entry.target = Some(target);
                     Some(Op::Install { prefix, target })
+                };
+                let after = Self::weigh(entry);
+                self.blackholes += after.0;
+                self.blackholes -= before.0;
+                self.kept_unconfirmed += after.1;
+                self.kept_unconfirmed -= before.1;
+                op
             }
             Err(reason) => {
                 self.set_unresolved(prefix, Some(reason));
                 // Packets must not go on following a route that is no
                 // longer the best.
-                self.installed
-                    .remove(&prefix)
-                    .map(|_| Op::Remove { prefix })
+                self.take(&prefix).map(|_| Op::Remove { prefix })
             }
         }
     }
@@ -464,9 +510,7 @@ impl Plan {
     pub fn withdrawn(&mut self, prefix: IpPrefix) -> Option<Op> {
         self.set_unresolved(prefix, None);
         self.refused.remove(&prefix);
-        self.installed
-            .remove(&prefix)
-            .map(|_| Op::Remove { prefix })
+        self.take(&prefix).map(|_| Op::Remove { prefix })
     }
 
     /// The whole table has been given: what was not in it goes.
@@ -480,7 +524,7 @@ impl Plan {
         stale
             .into_iter()
             .map(|prefix| {
-                self.installed.remove(&prefix);
+                self.take(&prefix);
                 Op::Remove { prefix }
             })
             .collect()
@@ -495,7 +539,7 @@ impl Plan {
                 if self.installed.get(prefix)?.target != Some(*target) {
                     return None;
                 }
-                self.installed.remove(prefix);
+                self.take(prefix);
                 self.refused.insert(*prefix);
                 // What the kernel refused to replace, it still has.
                 Some(Op::Remove { prefix: *prefix })
@@ -508,6 +552,8 @@ impl Plan {
     /// Everything goes: the changes that empty the kernel of our routes.
     pub fn clear(&mut self) -> Vec<Op> {
         self.forget_unresolved_and_refused();
+        self.blackholes = 0;
+        self.kept_unconfirmed = 0;
         self.installed
             .drain()
             .map(|(prefix, _)| Op::Remove { prefix })
@@ -1163,6 +1209,60 @@ mod tests {
         ]
     }
 
+    /// What the counts would be if the entries were scanned.
+    fn scanned(plan: &Plan) -> (usize, usize) {
+        plan.installed
+            .values()
+            .map(Plan::weigh)
+            .fold((0, 0), |(b, k), (eb, ek)| (b + eb, k + ek))
+    }
+
+    #[test]
+    fn the_counts_keep_step_with_the_routes() {
+        let mut plan = Plan::default();
+        let p = |n: u8| prefix(&format!("203.0.113.{n}/32"));
+        let via = target("192.0.2.2", 2);
+        let check = |plan: &Plan| assert_eq!((plan.blackholes(), plan.kept()), scanned(plan));
+
+        // Adopted from an earlier run: two kept, one a blackhole.
+        plan.adopt(p(1), Some(Target::Discard), true);
+        plan.adopt(p(2), Some(via), true);
+        plan.adopt(p(3), Some(via), false);
+        check(&plan);
+        // Heard of again, as a blackhole and as a route by way of a
+        // gateway; one changes kind.
+        plan.best(p(1), Ok(Target::Discard));
+        plan.best(p(2), Ok(Target::Discard));
+        plan.best(p(4), Ok(Target::Discard));
+        check(&plan);
+        plan.best(p(4), Ok(via));
+        check(&plan);
+        // The whole table again: everything unconfirmed, then confirmed.
+        plan.reset();
+        check(&plan);
+        plan.best(p(1), Ok(Target::Discard));
+        plan.synced();
+        check(&plan);
+        plan.reset();
+        plan.release();
+        check(&plan);
+        // Gone for want of a next hop, withdrawn, refused, adopted over.
+        plan.best(p(1), Err(Unresolved::Missing));
+        plan.best(p(5), Ok(Target::Discard));
+        plan.withdrawn(p(5));
+        plan.best(p(6), Ok(Target::Discard));
+        plan.refused_by_kernel(&Op::Install {
+            prefix: p(6),
+            target: Target::Discard,
+        });
+        plan.adopt(p(7), Some(Target::Discard), true);
+        plan.adopt(p(7), Some(via), true);
+        check(&plan);
+        let had = plan.installed();
+        assert_eq!(plan.clear().len(), had);
+        assert_eq!((plan.blackholes(), plan.kept()), (0, 0));
+    }
+
     proptest! {
         /// Whatever happens to the best routes, and whatever an earlier
         /// run left behind, a kernel that does as it is asked ends up with

crates/fib/src/sockdiag.rs

@@ -0,0 +1,426 @@
+//! What the kernel knows about one of our TCP connections: the round-trip
+//! time, the windows, the queues and what has held the connection up,
+//! asked over the socket diagnostics netlink family (`NETLINK_SOCK_DIAG`,
+//! as `ss -ti` asks). For the status page, when someone wants to know
+//! why a session is slow.
+
+use std::io;
+use std::net::{IpAddr, SocketAddr};
+
+/// A TCP connection as the kernel sees it. Times are in microseconds,
+/// sizes in octets, rates in octets per second, unless said otherwise.
+/// Fields the running kernel does not report are zero.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct TcpConnection {
+    /// The TCP state, by its number (1 is ESTABLISHED); see
+    /// [`TcpConnection::state_name`].
+    pub state: u8,
+    /// The congestion control algorithm, if the kernel named it.
+    pub congestion: Option<String>,
+    /// Octets received and not yet read by us.
+    pub recv_queue: u32,
+    /// Octets written by us and not yet acknowledged by the peer.
+    pub send_queue: u32,
+    pub rtt: u32,
+    pub rtt_variance: u32,
+    pub min_rtt: u32,
+    pub rto: u32,
+    pub mss: u32,
+    pub pmtu: u32,
+    /// The congestion window, in segments.
+    pub cwnd: u32,
+    /// The slow start threshold, in segments; `None` if there is none.
+    pub ssthresh: Option<u32>,
+    /// What the peer lets us send: its receive window.
+    pub send_window: u32,
+    /// What we let the peer send.
+    pub receive_window: u32,
+    pub receive_space: u32,
+    pub receive_ssthresh: u32,
+    pub send_window_scale: u8,
+    pub receive_window_scale: u8,
+    /// Segments sent and not acknowledged.
+    pub unacked: u32,
+    /// Segments retransmitted and still out.
+    pub retrans: u32,
+    pub lost: u32,
+    pub total_retrans: u32,
+    pub bytes_retrans: u64,
+    /// Octets in the socket's buffer that are not sent yet.
+    pub not_sent: u32,
+    pub pacing_rate: u64,
+    pub delivery_rate: u64,
+    pub bytes_sent: u64,
+    pub bytes_acked: u64,
+    pub bytes_received: u64,
+    pub segments_out: u32,
+    pub segments_in: u32,
+    /// How long the connection had something to send.
+    pub busy: u64,
+    /// Of that, how long it was held up by the peer's receive window.
+    pub limited_by_receive_window: u64,
+    /// And how long by our own send buffer being full.
+    pub limited_by_send_buffer: u64,
+    pub delivered: u32,
+    pub reordering: u32,
+    /// Milliseconds since data was last sent, received, and since the
+    /// last acknowledgement came.
+    pub last_data_sent_ms: u32,
+    pub last_data_received_ms: u32,
+    pub last_ack_received_ms: u32,
+}
+
+impl TcpConnection {
+    pub fn state_name(&self) -> &'static str {
+        match self.state {
+            1 => "established",
+            2 => "syn-sent",
+            3 => "syn-received",
+            4 => "fin-wait-1",
+            5 => "fin-wait-2",
+            6 => "time-wait",
+            7 => "close",
+            8 => "close-wait",
+            9 => "last-ack",
+            10 => "listen",
+            11 => "closing",
+            _ => "unknown",
+        }
+    }
+}
+
+const SOCK_DIAG_BY_FAMILY: u16 = 20;
+const NLMSG_ERROR: u16 = 2;
+const NLM_F_REQUEST: u16 = 1;
+const IPPROTO_TCP: u8 = 6;
+const AF_INET: u8 = 2;
+const AF_INET6: u8 = 10;
+const INET_DIAG_INFO: u16 = 2;
+const INET_DIAG_CONG: u16 = 4;
+/// `idiag_ext` bits asking for those two.
+const EXTENSIONS: u8 = (1 << (INET_DIAG_INFO - 1)) | (1 << (INET_DIAG_CONG - 1));
+const NO_COOKIE: u32 = u32::MAX;
+const HEADER_LEN: usize = 16;
+const REQUEST_LEN: usize = HEADER_LEN + 56;
+const DIAG_MSG_LEN: usize = 72;
+
+/// The request for the connection from `local` to `peer`, with `sequence`.
+pub fn request(local: SocketAddr, peer: SocketAddr, sequence: u32) -> Vec<u8> {
+    let family = match local {
+        SocketAddr::V4(_) => AF_INET,
+        SocketAddr::V6(_) => AF_INET6,
+    };
+    let mut buf = Vec::with_capacity(REQUEST_LEN);
+    buf.extend_from_slice(&(REQUEST_LEN as u32).to_ne_bytes());
+    buf.extend_from_slice(&SOCK_DIAG_BY_FAMILY.to_ne_bytes());
+    buf.extend_from_slice(&NLM_F_REQUEST.to_ne_bytes());
+    buf.extend_from_slice(&sequence.to_ne_bytes());
+    buf.extend_from_slice(&0u32.to_ne_bytes());
+    // inet_diag_req_v2
+    buf.extend_from_slice(&[family, IPPROTO_TCP, EXTENSIONS, 0]);
+    buf.extend_from_slice(&u32::MAX.to_ne_bytes()); // any state
+    // inet_diag_sockid: ports in network order, addresses as 16 octets.
+    buf.extend_from_slice(&local.port().to_be_bytes());
+    buf.extend_from_slice(&peer.port().to_be_bytes());
+    buf.extend_from_slice(&address_octets(local.ip()));
+    buf.extend_from_slice(&address_octets(peer.ip()));
+    // The interface, which a socket on a link-local address is bound to
+    // and is found by.
+    let interface = match local {
+        SocketAddr::V6(v6) => v6.scope_id(),
+        SocketAddr::V4(_) => 0,
+    };
+    buf.extend_from_slice(&interface.to_ne_bytes());
+    buf.extend_from_slice(&NO_COOKIE.to_ne_bytes());
+    buf.extend_from_slice(&NO_COOKIE.to_ne_bytes());
+    debug_assert_eq!(buf.len(), REQUEST_LEN);
+    buf
+}
+
+fn address_octets(address: IpAddr) -> [u8; 16] {
+    let mut octets = [0u8; 16];
+    match address {
+        IpAddr::V4(v4) => octets[..4].copy_from_slice(&v4.octets()),
+        IpAddr::V6(v6) => octets = v6.octets(),
+    }
+    octets
+}
+
+/// What the kernel answered.
+#[derive(Debug, PartialEq, Eq)]
+pub enum Answer {
+    Connection(Box<TcpConnection>),
+    /// No such connection.
+    None,
+    /// The kernel refused, with this error number.
+    Refused(i32),
+}
+
+/// Reads the kernel's answer to a [`request`].
+pub fn parse(buf: &[u8]) -> io::Result<Answer> {
+    let header = buf
+        .get(..HEADER_LEN)
+        .ok_or_else(|| io::Error::other("short netlink answer"))?;
+    let length = ne_u32(&header[0..4]) as usize;
+    let message_type = ne_u16(&header[4..6]);
+    let message = buf
+        .get(HEADER_LEN..length.min(buf.len()))
+        .ok_or_else(|| io::Error::other("short netlink answer"))?;
+    if message_type == NLMSG_ERROR {
+        let errno = -(message
+            .first_chunk::<4>()
+            .map_or(0, |e| i32::from_ne_bytes(*e)));
+        // ENOENT: no such socket.
+        return Ok(if errno == 2 {
+            Answer::None
+        } else {
+            Answer::Refused(errno)
+        });
+    }
+    if message_type != SOCK_DIAG_BY_FAMILY || message.len() < DIAG_MSG_LEN {
+        return Err(io::Error::other("not a socket diagnostic"));
+    }
+    let mut connection = TcpConnection {
+        state: message[1],
+        recv_queue: ne_u32(&message[56..60]),
+        send_queue: ne_u32(&message[60..64]),
+        ..TcpConnection::default()
+    };
+    let mut attributes = &message[DIAG_MSG_LEN..];
+    while attributes.len() >= 4 {
+        let length = usize::from(ne_u16(&attributes[0..2]));
+        let kind = ne_u16(&attributes[2..4]);
+        if length < 4 || length > attributes.len() {
+            break;
+        }
+        let value = &attributes[4..length];
+        match kind {
+            INET_DIAG_INFO => fill_from_tcp_info(&mut connection, value),
+            INET_DIAG_CONG => {
+                let name = value.split(|b| *b == 0).next().unwrap_or(&[]);
+                connection.congestion = Some(String::from_utf8_lossy(name).into_owned());
+            }
+            _ => {}
+        }
+        attributes = &attributes[(length + 3) & !3..];
+    }
+    Ok(Answer::Connection(Box::new(connection)))
+}
+
+/// Fills in what `tcp_info` (linux/tcp.h) has, as far as the kernel sent
+/// it: the structure has grown over the years, and a field that is not
+/// there is left at zero.
+fn fill_from_tcp_info(c: &mut TcpConnection, info: &[u8]) {
+    let u32_at = |at: usize| info.get(at..at + 4).map_or(0, ne_u32);
+    let u64_at = |at: usize| info.get(at..at + 8).map_or(0, ne_u64);
+    c.send_window_scale = info.get(6).map_or(0, |b| b & 0x0f);
+    c.receive_window_scale = info.get(6).map_or(0, |b| b >> 4);
+    c.rto = u32_at(8);
+    c.mss = u32_at(16);
+    c.unacked = u32_at(24);
+    c.lost = u32_at(32);
+    c.retrans = u32_at(36);
+    c.last_data_sent_ms = u32_at(44);
+    c.last_data_received_ms = u32_at(52);
+    c.last_ack_received_ms = u32_at(56);
+    c.pmtu = u32_at(60);
+    c.receive_ssthresh = u32_at(64);
+    c.rtt = u32_at(68);
+    c.rtt_variance = u32_at(72);
+    c.ssthresh = Some(u32_at(76)).filter(|t| *t < 0x7fff_ffff);
+    c.cwnd = u32_at(80);
+    c.reordering = u32_at(88);
+    c.receive_space = u32_at(96);
+    c.total_retrans = u32_at(100);
+    c.pacing_rate = u64_at(104);
+    c.bytes_acked = u64_at(120);
+    c.bytes_received = u64_at(128);
+    c.segments_out = u32_at(136);
+    c.segments_in = u32_at(140);
+    c.not_sent = u32_at(144);
+    c.min_rtt = u32_at(148);
+    c.delivery_rate = u64_at(160);
+    c.busy = u64_at(168);
+    c.limited_by_receive_window = u64_at(176);
+    c.limited_by_send_buffer = u64_at(184);
+    c.delivered = u32_at(192);
+    c.bytes_sent = u64_at(200);
+    c.bytes_retrans = u64_at(208);
+    c.send_window = u32_at(228);
+    c.receive_window = u32_at(232);
+}
+
+fn ne_u16(bytes: &[u8]) -> u16 {
+    u16::from_ne_bytes([bytes[0], bytes[1]])
+}
+
+fn ne_u32(bytes: &[u8]) -> u32 {
+    u32::from_ne_bytes([bytes[0], bytes[1], bytes[2], bytes[3]])
+}
+
+fn ne_u64(bytes: &[u8]) -> u64 {
+    let mut array = [0u8; 8];
+    array.copy_from_slice(bytes);
+    u64::from_ne_bytes(array)
+}
+
+/// Asks the kernel about the TCP connection from `local` to `peer`.
+/// `Ok(None)` if there is no such connection, or on an operating system
+/// that cannot be asked.
+#[cfg(target_os = "linux")]
+pub async fn tcp_connection(
+    local: SocketAddr,
+    peer: SocketAddr,
+) -> io::Result<Option<TcpConnection>> {
+    use netlink_sys::protocols::NETLINK_SOCK_DIAG;
+    use netlink_sys::{AsyncSocket, AsyncSocketExt, TokioSocket};
+
+    let mut socket = TokioSocket::new(NETLINK_SOCK_DIAG)?;
+    socket
+        .socket_mut()
+        .bind(&netlink_sys::SocketAddr::new(0, 0))?;
+    let sequence = 1;
+    socket.send(&request(local, peer, sequence)).await?;
+    let mut buf = bytes::BytesMut::with_capacity(4096);
+    tokio::time::timeout(std::time::Duration::from_secs(2), socket.recv(&mut buf))
+        .await
+        .map_err(|_| io::Error::new(io::ErrorKind::TimedOut, "the kernel did not answer"))??;
+    match parse(&buf)? {
+        Answer::Connection(connection) => Ok(Some(*connection)),
+        Answer::None => Ok(None),
+        Answer::Refused(errno) => Err(io::Error::from_raw_os_error(errno)),
+    }
+}
+
+#[cfg(not(target_os = "linux"))]
+pub async fn tcp_connection(
+    _local: SocketAddr,
+    _peer: SocketAddr,
+) -> io::Result<Option<TcpConnection>> {
+    Ok(None)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A reply as the kernel writes it, for an established connection
+    /// with a `tcp_info` of the full modern length.
+    fn reply() -> Vec<u8> {
+        let mut info = vec![0u8; 248];
+        info[0] = 1; // established
+        info[6] = 0x7a; // snd_wscale 10, rcv_wscale 7
+        let put32 = |info: &mut Vec<u8>, at: usize, v: u32| {
+            info[at..at + 4].copy_from_slice(&v.to_ne_bytes())
+        };
+        let put64 = |info: &mut Vec<u8>, at: usize, v: u64| {
+            info[at..at + 8].copy_from_slice(&v.to_ne_bytes())
+        };
+        put32(&mut info, 16, 1448); // mss
+        put32(&mut info, 24, 12); // unacked
+        put32(&mut info, 68, 2300); // rtt
+        put32(&mut info, 76, 0x7fff_ffff); // no ssthresh
+        put32(&mut info, 80, 42); // cwnd
+        put32(&mut info, 144, 65536); // notsent
+        put64(&mut info, 176, 900_000); // rwnd limited
+        put64(&mut info, 168, 1_000_000); // busy
+        put32(&mut info, 228, 131072); // snd_wnd
+        put32(&mut info, 232, 262144); // rcv_wnd
+        let cong = b"cubic\0";
+        let mut message = vec![0u8; DIAG_MSG_LEN];
+        message[1] = 1;
+        message[60..64].copy_from_slice(&80_000u32.to_ne_bytes()); // wqueue
+        // attributes: INFO, then CONG
+        let mut attrs = Vec::new();
+        attrs.extend_from_slice(&((4 + info.len()) as u16).to_ne_bytes());
+        attrs.extend_from_slice(&INET_DIAG_INFO.to_ne_bytes());
+        attrs.extend_from_slice(&info);
+        attrs.extend_from_slice(&((4 + cong.len()) as u16).to_ne_bytes());
+        attrs.extend_from_slice(&INET_DIAG_CONG.to_ne_bytes());
+        attrs.extend_from_slice(cong);
+        while attrs.len() % 4 != 0 {
+            attrs.push(0);
+        }
+        let length = HEADER_LEN + message.len() + attrs.len();
+        let mut buf = Vec::new();
+        buf.extend_from_slice(&(length as u32).to_ne_bytes());
+        buf.extend_from_slice(&SOCK_DIAG_BY_FAMILY.to_ne_bytes());
+        buf.extend_from_slice(&[0, 0, 1, 0, 0, 0, 0, 0, 0, 0]);
+        buf.extend_from_slice(&message);
+        buf.extend_from_slice(&attrs);
+        buf
+    }
+
+    #[test]
+    fn a_reply_is_read_field_by_field() {
+        let Answer::Connection(c) = parse(&reply()).unwrap() else {
+            panic!("a connection");
+        };
+        assert_eq!(c.state_name(), "established");
+        assert_eq!(c.congestion.as_deref(), Some("cubic"));
+        assert_eq!(c.send_queue, 80_000);
+        assert_eq!((c.send_window_scale, c.receive_window_scale), (10, 7));
+        assert_eq!((c.mss, c.unacked, c.rtt, c.cwnd), (1448, 12, 2300, 42));
+        assert_eq!(c.ssthresh, None);
+        assert_eq!(c.not_sent, 65536);
+        assert_eq!((c.busy, c.limited_by_receive_window), (1_000_000, 900_000));
+        assert_eq!((c.send_window, c.receive_window), (131072, 262144));
+    }
+
+    #[test]
+    fn no_such_connection_and_a_refusal_are_told_apart() {
+        let error = |errno: i32| {
+            let mut buf = vec![0u8; 20];
+            buf[0..4].copy_from_slice(&20u32.to_ne_bytes());
+            buf[4..6].copy_from_slice(&NLMSG_ERROR.to_ne_bytes());
+            buf[16..20].copy_from_slice(&(-errno).to_ne_bytes());
+            buf
+        };
+        assert_eq!(parse(&error(2)).unwrap(), Answer::None);
+        assert_eq!(parse(&error(13)).unwrap(), Answer::Refused(13));
+    }
+
+    #[test]
+    fn a_request_names_the_connection() {
+        let local: SocketAddr = "[2001:db8::1]:179".parse().unwrap();
+        let peer: SocketAddr = "[2001:db8::2]:40000".parse().unwrap();
+        let request = request(local, peer, 7);
+        assert_eq!(request.len(), REQUEST_LEN);
+        assert_eq!(request[16], AF_INET6);
+        assert_eq!(&request[24..26], &179u16.to_be_bytes());
+        assert_eq!(&request[26..28], &40000u16.to_be_bytes());
+        assert_eq!(
+            &request[28..44],
+            &"2001:db8::1"
+                .parse::<std::net::Ipv6Addr>()
+                .unwrap()
+                .octets()
+        );
+    }
+
+    #[cfg(target_os = "linux")]
+    #[tokio::test]
+    async fn the_kernel_tells_of_a_connection_of_ours() {
+        use tokio::io::AsyncWriteExt;
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let mut client = tokio::net::TcpStream::connect(listener.local_addr().unwrap())
+            .await
+            .unwrap();
+        let (_server, _) = listener.accept().await.unwrap();
+        client.write_all(&[0u8; 1000]).await.unwrap();
+        let connection = tcp_connection(client.local_addr().unwrap(), client.peer_addr().unwrap())
+            .await
+            .unwrap()
+            .expect("the kernel knows it");
+        assert_eq!(connection.state_name(), "established");
+        assert!(connection.mss > 0 && connection.cwnd > 0);
+        assert!(connection.bytes_sent >= 1000 || connection.bytes_acked >= 1000);
+        let none = tcp_connection(
+            "127.0.0.1:1".parse().unwrap(),
+            "127.0.0.1:2".parse().unwrap(),
+        )
+        .await
+        .unwrap();
+        assert!(none.is_none());
+    }
+}

crates/integration-tests/src/test_peer.rs

@@ -51,6 +51,12 @@ impl TestPeer {
         }
     }
 
+    /// The connection itself, for a test or a tool that goes on without
+    /// the framing, once the handshake is done.
+    pub fn into_stream(self) -> TcpStream {
+        self.stream
+    }
+
     /// Our end of the connection: what the server sees the peer as.
     pub fn local_addr(&self) -> Result<SocketAddr> {
         Ok(self.stream.local_addr()?)

crates/integration-tests/src/test_server.rs

@@ -29,6 +29,9 @@ pub struct TestServer {
     handle: JoinHandle<Result<(), ServerError>>,
     /// The single IPv4 loopback address the server is bound to.
     pub addr: SocketAddr,
+    /// Every address it is bound to, in the order configured: `addr`
+    /// first.
+    pub addrs: Vec<SocketAddr>,
     /// The server's routing table.
     pub rib: Arc<RibTable>,
     /// Handle to the server's locally originated routes.
@@ -85,11 +88,8 @@ impl TestServer {
         customize(&mut config);
 
         let bound = BgpServer::bind(config).await?;
-        let addr = bound
-            .local_addrs()
-            .into_iter()
-            .next()
-            .expect("at least one listener");
+        let addrs = bound.local_addrs();
+        let addr = *addrs.first().expect("at least one listener");
         let rib = Arc::clone(&bound.rib);
         let local_rib = bound.local_rib.clone();
         let registry = bound.registry.clone();
@@ -102,6 +102,7 @@ impl TestServer {
         Ok(Self {
             handle,
             addr,
+            addrs,
             rib,
             local_rib,
             registry,

crates/integration-tests/tests/add_path.rs

@@ -1,21 +1,27 @@
 //! End-to-end tests of ADD-PATH (RFC 7911): a peer sending several routes
 //! for one prefix, told apart by path identifiers.
 
-use std::net::{Ipv4Addr, SocketAddr};
+use std::collections::BTreeMap;
+use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr};
+use std::sync::Arc;
 use std::time::Duration;
 
 use bgp_integration_tests::announcement::{Announcement, withdrawal};
 use bgp_integration_tests::test_peer::TestPeer;
 use bgp_integration_tests::test_server::TestServer;
 use bgp_integration_tests::{peer_config, prefix, wait_until};
-use bgp_packet::message::PathAttribute;
-use bgp_packet::open::{AddPathEntry, Capability, OpenMessage, SendReceive};
+use bgp_packet::message::{
+    AsPathAttribute, Message, MpReachNlriPathAttribute, NlriNextHop, OriginPathAttribute,
+    PathAttribute, UpdateMessage,
+};
+use bgp_packet::open::{AddPathEntry, Capability, ExtendedNextHopEntry, OpenMessage, SendReceive};
 use bgp_primitives::constants::AfiSafi;
+use bgp_primitives::constants::{Afi, Safi};
 use bgp_primitives::ip_prefix::Nlri;
 use bgp_rib::{LocalRoute, LocalRouteAttrs};
 use bgp_server::config::PeerConfig;
 use bgp_server::family::SUPPORTED;
-use bgp_server::policy::ImportPolicy;
+use bgp_server::policy::{ExportPolicy, ImportPolicy};
 use eyre::Result;
 use serde_json::Value;
 
@@ -242,3 +248,360 @@ async fn test_prefixes_are_sent_with_path_identifiers_when_agreed() -> Result<()
     assert_eq!(held(&server), [(0, vec![PEER_ASN], true)]);
     Ok(())
 }
+
+const COLLECTOR_ASN: u32 = 65100;
+
+/// What a collector holds: for each prefix and path identifier, the
+/// route's AS path.
+type Held = BTreeMap<(String, u32), Vec<u32>>;
+
+/// Reads what the collector is told, into `held`, until `done` says so.
+async fn told(
+    collector: &mut TestPeer,
+    held: &mut Held,
+    done: impl Fn(&Held) -> bool,
+) -> Result<()> {
+    while !done(held) {
+        let update = collector.recv_update().await?;
+        let path = update
+            .path_attributes
+            .iter()
+            .find_map(|attribute| match attribute {
+                PathAttribute::AsPath(path) => Some(path.segments[0].path.clone()),
+                _ => None,
+            })
+            .unwrap_or_default();
+        for nlri in &update.withdrawn_routes {
+            held.remove(&(nlri.prefix.to_string(), nlri.path_id));
+        }
+        for nlri in &update.announced_routes {
+            held.insert((nlri.prefix.to_string(), nlri.path_id), path.clone());
+        }
+        // And what came and went in the multiprotocol attributes.
+        for attribute in &update.path_attributes {
+            match attribute {
+                PathAttribute::MpReachNlri(reach) => {
+                    for nlri in &reach.prefixes {
+                        held.insert((nlri.prefix.to_string(), nlri.path_id), path.clone());
+                    }
+                }
+                PathAttribute::MpUnreachNlri(unreach) => {
+                    for nlri in &unreach.prefixes {
+                        held.remove(&(nlri.prefix.to_string(), nlri.path_id));
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+    Ok(())
+}
+
+/// The routes held for 203.0.113.0/24, by path identifier.
+fn paths(held: &Held) -> Vec<(u32, Vec<u32>)> {
+    held.iter()
+        .map(|((prefix, id), path)| {
+            assert_eq!(prefix, "203.0.113.0/24");
+            (*id, path.clone())
+        })
+        .collect()
+}
+
+/// A collector that agreed to be sent several routes for a prefix, and
+/// whose export policy says to send it every route, is told of every
+/// peer's route for a prefix, each with a path identifier of its own that
+/// stays with the route; a route that goes is withdrawn by its identifier.
+#[tokio::test]
+async fn test_every_route_goes_to_a_collector_told_apart_by_path_identifiers() -> Result<()> {
+    let server = TestServer::start_with(LOCAL_ASN, |c| {
+        // The collector is the configured peer at the IPv4 loopback
+        // address; the feeders come over IPv6 loopback as peers of no
+        // account.
+        c.listen_endpoints
+            .push(SocketAddr::new(Ipv6Addr::LOCALHOST.into(), 0));
+        c.peers = vec![PeerConfig {
+            add_path: Some(SendReceive::Send),
+            import: ImportPolicy::permissive(),
+            export: Arc::new(ExportPolicy {
+                learned_routes: true,
+                all_paths: true,
+                ..ExportPolicy::default()
+            }),
+            ..peer_config(
+                "collector",
+                SocketAddr::new(Ipv4Addr::LOCALHOST.into(), 1),
+                COLLECTOR_ASN,
+            )
+        }];
+        c.connect_retry = Duration::from_secs(3600);
+    })
+    .await?;
+    let route = |path: &[u32]| Announcement::of([prefix("203.0.113.0/24").into()], path);
+    let feeder = async |n: u32| -> Result<TestPeer> {
+        let mut peer = TestPeer::connect(server.addrs[1]).await?;
+        peer.handshake(PEER_ASN + n, Ipv4Addr::new(10, 0, 0, n as u8 + 1), 90)
+            .await?;
+        Ok(peer)
+    };
+    let mut a = feeder(0).await?;
+    let mut b = feeder(1).await?;
+    server.wait_for_sessions(2).await?;
+    a.announce(route(&[PEER_ASN, 64510])).await?;
+    b.announce(route(&[PEER_ASN + 1, 64510])).await?;
+    server.wait_for_routes(2).await?;
+
+    let mut capabilities = vec![Capability::FourByteAsn { asn: COLLECTOR_ASN }];
+    capabilities.extend(SUPPORTED.into_iter().map(Capability::multiprotocol));
+    capabilities.push(Capability::AddPath {
+        entries: vec![AddPathEntry {
+            afi: AfiSafi::IPV4_UNICAST.afi,
+            safi: AfiSafi::IPV4_UNICAST.safi,
+            send_recv: SendReceive::Receive,
+        }],
+    });
+    let mut collector = TestPeer::connect(server.addr).await?;
+    collector
+        .handshake_with(
+            COLLECTOR_ASN,
+            Ipv4Addr::new(10, 0, 0, 100),
+            90,
+            capabilities,
+        )
+        .await?;
+    collector.ctx.add_path = vec![AfiSafi::IPV4_UNICAST];
+
+    // Both routes, told apart.
+    let mut held = Held::new();
+    told(&mut collector, &mut held, |held| held.len() == 2).await?;
+    assert_eq!(
+        paths(&held),
+        [
+            (1, vec![LOCAL_ASN, PEER_ASN, 64510]),
+            (2, vec![LOCAL_ASN, PEER_ASN + 1, 64510]),
+        ]
+    );
+
+    // The second peer's route goes: withdrawn by its identifier, the
+    // first's untouched.
+    b.announce(withdrawal([prefix("203.0.113.0/24").into()]))
+        .await?;
+    told(&mut collector, &mut held, |held| held.len() == 1).await?;
+    assert_eq!(paths(&held), [(1, vec![LOCAL_ASN, PEER_ASN, 64510])]);
+
+    // The first peer's route changes: it goes out again with the same
+    // identifier. A third peer's route gets the lowest free one.
+    a.announce(route(&[PEER_ASN, 64511, 64510])).await?;
+    let mut c = feeder(2).await?;
+    server.wait_for_sessions(4).await?;
+    c.announce(route(&[PEER_ASN + 2, 64510])).await?;
+    let changed = |held: &Held| {
+        held.len() == 2
+            && held.get(&("203.0.113.0/24".to_string(), 1))
+                == Some(&vec![LOCAL_ASN, PEER_ASN, 64511, 64510])
+    };
+    told(&mut collector, &mut held, changed).await?;
+    assert_eq!(
+        paths(&held),
+        [
+            (1, vec![LOCAL_ASN, PEER_ASN, 64511, 64510]),
+            (2, vec![LOCAL_ASN, PEER_ASN + 2, 64510]),
+        ]
+    );
+    Ok(())
+}
+
+/// A collector that is connected before the table arrives is told the
+/// whole table, however large: the walk of the table that a new follower
+/// starts with takes many batches with a table of some size, and goes on
+/// while the feeders keep sending.
+#[tokio::test]
+async fn test_a_large_table_reaches_a_collector_that_was_there_first() -> Result<()> {
+    const PREFIXES: u32 = 40_000;
+    let server = TestServer::start_with(LOCAL_ASN, |c| {
+        c.listen_endpoints
+            .push(SocketAddr::new(Ipv6Addr::LOCALHOST.into(), 0));
+        c.peers = vec![PeerConfig {
+            add_path: Some(SendReceive::Send),
+            import: ImportPolicy::permissive(),
+            export: Arc::new(ExportPolicy {
+                learned_routes: true,
+                all_paths: true,
+                ..ExportPolicy::default()
+            }),
+            ..peer_config(
+                "collector",
+                SocketAddr::new(Ipv4Addr::LOCALHOST.into(), 1),
+                COLLECTOR_ASN,
+            )
+        }];
+        c.connect_retry = Duration::from_secs(3600);
+    })
+    .await?;
+    let mut capabilities = vec![Capability::FourByteAsn { asn: COLLECTOR_ASN }];
+    capabilities.extend(SUPPORTED.into_iter().map(Capability::multiprotocol));
+    capabilities.push(Capability::AddPath {
+        entries: vec![AddPathEntry {
+            afi: AfiSafi::IPV4_UNICAST.afi,
+            safi: AfiSafi::IPV4_UNICAST.safi,
+            send_recv: SendReceive::Receive,
+        }],
+    });
+    let mut collector = TestPeer::connect(server.addr).await?;
+    collector
+        .handshake_with(
+            COLLECTOR_ASN,
+            Ipv4Addr::new(10, 0, 0, 100),
+            90,
+            capabilities,
+        )
+        .await?;
+    collector.ctx.add_path = vec![AfiSafi::IPV4_UNICAST];
+    server.wait_for_sessions(1).await?;
+
+    // Two feeders, each sending the same prefixes a hundred to an UPDATE.
+    let nth = |n: u32| {
+        let [_, b, c, _] = (0x0a00_0000u32 + n * 256).to_be_bytes();
+        prefix(&format!("10.{b}.{c}.0/24"))
+    };
+    let mut feeders = Vec::new();
+    for n in 0..2u32 {
+        let mut peer = TestPeer::connect(server.addrs[1]).await?;
+        peer.handshake(PEER_ASN + n, Ipv4Addr::new(10, 0, 0, n as u8 + 1), 90)
+            .await?;
+        feeders.push(peer);
+    }
+    server.wait_for_sessions(3).await?;
+    for start in (0..PREFIXES).step_by(100) {
+        for (n, feeder) in feeders.iter_mut().enumerate() {
+            feeder
+                .announce(Announcement::of(
+                    (start..start + 100).map(|i| nth(i).into()),
+                    &[PEER_ASN + n as u32, 64510],
+                ))
+                .await?;
+        }
+    }
+    let mut held = Held::new();
+    told(&mut collector, &mut held, |held| {
+        held.len() == 2 * PREFIXES as usize
+    })
+    .await?;
+    let ids: std::collections::BTreeSet<u32> = held.keys().map(|(_, id)| *id).collect();
+    assert_eq!(ids.into_iter().collect::<Vec<_>>(), [1, 2]);
+    Ok(())
+}
+
+/// As a router at an exchange feeds a collector: one IPv6 session that
+/// carries both families, with ADD-PATH for both and IPv4 routes with
+/// IPv6 next hops (RFC 8950), and a table of some size from two feeders.
+#[tokio::test]
+async fn test_both_families_reach_a_collector_over_one_ipv6_session() -> Result<()> {
+    const V4: u32 = 20_000;
+    const V6: u32 = 1_000;
+    let server = TestServer::start_with(LOCAL_ASN, |c| {
+        c.listen_endpoints
+            .push(SocketAddr::new(Ipv6Addr::LOCALHOST.into(), 0));
+        c.peers = vec![PeerConfig {
+            add_path: Some(SendReceive::Send),
+            import: ImportPolicy::permissive(),
+            export: Arc::new(ExportPolicy {
+                learned_routes: true,
+                all_paths: true,
+                ..ExportPolicy::default()
+            }),
+            ..peer_config(
+                "collector",
+                SocketAddr::new(Ipv6Addr::LOCALHOST.into(), 1),
+                COLLECTOR_ASN,
+            )
+        }];
+        c.connect_retry = Duration::from_secs(3600);
+    })
+    .await?;
+    let mut capabilities = vec![Capability::FourByteAsn { asn: COLLECTOR_ASN }];
+    capabilities.extend(SUPPORTED.into_iter().map(Capability::multiprotocol));
+    capabilities.push(Capability::AddPath {
+        entries: [AfiSafi::IPV4_UNICAST, AfiSafi::IPV6_UNICAST]
+            .into_iter()
+            .map(|family| AddPathEntry {
+                afi: family.afi,
+                safi: family.safi,
+                send_recv: SendReceive::Receive,
+            })
+            .collect(),
+    });
+    capabilities.push(Capability::ExtendedNextHop {
+        entries: vec![ExtendedNextHopEntry {
+            afi: Afi::IPV4,
+            safi: Safi::UNICAST,
+            nh_afi: Afi::IPV6,
+        }],
+    });
+    let mut collector = TestPeer::connect(server.addrs[1]).await?;
+    collector
+        .handshake_with(
+            COLLECTOR_ASN,
+            Ipv4Addr::new(10, 0, 0, 100),
+            90,
+            capabilities,
+        )
+        .await?;
+    collector.ctx.add_path = vec![AfiSafi::IPV4_UNICAST, AfiSafi::IPV6_UNICAST];
+    server.wait_for_sessions(1).await?;
+    let session = &server.registry.list()[0];
+    assert!(session.extended_next_hop, "RFC 8950 agreed");
+    assert_eq!(session.add_path_send.iter().count(), 2);
+
+    let v4 = |n: u32| {
+        let [_, b, c, _] = (0x0a00_0000u32 + n * 256).to_be_bytes();
+        prefix(&format!("10.{b}.{c}.0/24"))
+    };
+    let v6 = |n: u32| prefix(&format!("2001:db8:{:x}::/48", 0x1000 + n));
+    let mut feeders = Vec::new();
+    for n in 0..2u32 {
+        let mut peer = TestPeer::connect(server.addr).await?;
+        peer.handshake(PEER_ASN + n, Ipv4Addr::new(10, 0, 0, n as u8 + 1), 90)
+            .await?;
+        feeders.push(peer);
+    }
+    server.wait_for_sessions(3).await?;
+    for start in (0..V4).step_by(100) {
+        for (n, feeder) in feeders.iter_mut().enumerate() {
+            feeder
+                .announce(Announcement::of(
+                    (start..start + 100).map(|i| v4(i).into()),
+                    &[PEER_ASN + n as u32, 64510],
+                ))
+                .await?;
+        }
+    }
+    for start in (0..V6).step_by(100) {
+        for (n, feeder) in feeders.iter_mut().enumerate() {
+            let update = UpdateMessage {
+                withdrawn_routes: vec![],
+                path_attributes: vec![
+                    PathAttribute::Origin(OriginPathAttribute::IGP),
+                    AsPathAttribute::from_asns(vec![PEER_ASN + n as u32, 64510]),
+                    PathAttribute::MpReachNlri(MpReachNlriPathAttribute {
+                        family: AfiSafi::IPV6_UNICAST,
+                        next_hop: NlriNextHop::Ipv6("2001:db8::9".parse().unwrap()),
+                        prefixes: (start..start + 100).map(|i| v6(i).into()).collect(),
+                    }),
+                ],
+                announced_routes: vec![],
+            };
+            feeder.send(&Message::Update(update)).await?;
+        }
+    }
+    let mut held = Held::new();
+    told(&mut collector, &mut held, |held| {
+        held.len() == 2 * (V4 + V6) as usize
+    })
+    .await?;
+    let v6_routes = held
+        .keys()
+        .filter(|(prefix, _)| prefix.contains(':'))
+        .count();
+    assert_eq!(v6_routes, 2 * V6 as usize);
+    Ok(())
+}

crates/integration-tests/tests/transit.rs

@@ -27,6 +27,7 @@ async fn transit(customize: impl FnOnce(&mut bgp_server::config::Config)) -> Res
     TestServer::start_with(LOCAL_ASN, |config| {
         config.export = Arc::new(ExportPolicy {
             learned_routes: true,
+            all_paths: false,
             ..ExportPolicy::default()
         });
         customize(config);
@@ -264,6 +265,7 @@ async fn test_communities_say_who_is_told() -> Result<()> {
         });
         config.export = Arc::new(ExportPolicy {
             learned_routes: true,
+            all_paths: false,
             marks: Marks::parse(&[], &["64601:7".to_string()], &[]).unwrap(),
             prepend: 1,
         });

crates/rib/src/table/mod.rs

@@ -193,13 +193,16 @@ impl Row {
             .position(|(index, path)| path.peer() == peer && self.path_id(index) == path_id)
     }
 
-    fn push(&mut self, path: Path, path_id: u32) {
+    /// Adds a route. `peers` is how many peers the table has: a prefix
+    /// that one of them announces, the others mostly announce too, so a
+    /// row is given room for that many at its first growth.
+    fn push(&mut self, path: Path, path_id: u32, peers: usize) {
         if path_id != 0 && self.path_ids.is_empty() {
             self.path_ids = vec![0; self.paths.len()];
         }
-        push_tight(&mut self.paths, path);
+        push_tight(&mut self.paths, path, peers);
         if !self.path_ids.is_empty() {
-            push_tight(&mut self.path_ids, path_id);
+            push_tight(&mut self.path_ids, path_id, peers);
         }
     }
 
@@ -670,6 +673,23 @@ impl RibTable {
         self.len() == 0
     }
 
+    /// Makes room for `prefixes` prefixes, spread over the shards, so that
+    /// a table of that size goes in without the shards growing as it
+    /// does. Growing a shard moves every row it has into a bigger table;
+    /// over a full table that was a seventh of what a session spent
+    /// taking it in. Room that is already there is kept.
+    pub fn expect_prefixes(&self, prefixes: usize) {
+        let each = prefixes.div_ceil(self.shards.len());
+        for shard in &self.shards {
+            let mut shard = write(shard);
+            let hasher = shard.hasher.clone();
+            let additional = each.saturating_sub(shard.rows.len());
+            shard
+                .rows
+                .reserve(additional, |row| hasher.hash_one(row.prefix));
+        }
+    }
+
     /// How many prefixes have at least one route.
     pub fn prefix_count(&self) -> usize {
         self.shards.iter().map(|shard| read(shard).rows.len()).sum()
@@ -838,12 +858,25 @@ fn spread(hash: u64, count: usize) -> usize {
     ((stirred * count as u64) >> 32) as usize
 }
 
+/// The most room a row is given at its first growth, however many peers
+/// there are: a route server's clients do not all announce every prefix.
+const FIRST_ROOM: usize = 8;
+
 /// Adds to a vector without the doubling that `push` does: a row of a few
-/// hundred routes should not hold room for as many again. Grows by a
-/// quarter, which keeps adding cheap on average.
-fn push_tight<T>(vec: &mut Vec<T>, value: T) {
+/// hundred routes should not hold room for as many again. The first
+/// growth is to `expected` (at most [`FIRST_ROOM`]), since with several
+/// full tables nearly every row gets that many routes, and growing a row
+/// one route at a time was a twelfth of what taking in four tables cost.
+/// After that it grows by a quarter, which keeps adding cheap on average.
+fn push_tight<T>(vec: &mut Vec<T>, value: T, expected: usize) {
     if vec.len() == vec.capacity() {
-        vec.reserve_exact((vec.len() / 4).max(1));
+        let first = expected.min(FIRST_ROOM);
+        let more = if vec.capacity() < first {
+            first - vec.len()
+        } else {
+            (vec.len() / 4).max(1)
+        };
+        vec.reserve_exact(more);
     }
     vec.push(value);
 }
@@ -885,7 +918,7 @@ impl Shard {
 
         let (outcome, best_changed) = match row.position(peer, path_id) {
             None => {
-                row.push(path, path_id);
+                row.push(path, path_id, self.peers.len());
                 self.routes += 1;
                 let outcome = Outcome {
                     added: 1,

crates/rib/src/table/tests.rs

@@ -957,13 +957,13 @@ fn a_row_can_hold_more_routes_than_a_sixteen_bit_index_counts() {
     let mut scratch = select::Scratch::default();
     let count = usize::from(u16::MAX) + 10;
     for path_id in 2..=count as u32 {
-        row.push(path(&worse), path_id);
+        row.push(path(&worse), path_id, peers.len());
     }
     // Equal routes from one peer: the lowest identifier is the best.
     assert!(!select::after_add(&mut row, &peers, &mut scratch));
     assert_eq!(row.best(), 0);
 
-    row.push(path(&better), count as u32 + 1);
+    row.push(path(&better), count as u32 + 1, peers.len());
     assert!(select::after_add(&mut row, &peers, &mut scratch));
     assert_eq!(row.best(), count);
     assert_eq!(row.route(row.best()).path_id, count as u32 + 1);
@@ -1002,3 +1002,31 @@ fn routes_can_be_picked_out_of_the_table() {
     );
     assert!(table.routes_where(0, |_| true).is_empty());
 }
+
+#[test]
+fn a_table_told_what_to_expect_has_the_room_before_the_routes_come() {
+    let table = RibTable::new(8);
+    table.expect_prefixes(100_000);
+    let room: usize = table
+        .shards
+        .iter()
+        .map(|shard| read(shard).rows.capacity())
+        .sum();
+    assert!(room >= 100_000, "room for {room} prefixes");
+    // Asking again for less, or for the same, takes nothing away.
+    table.expect_prefixes(10);
+    let still: usize = table
+        .shards
+        .iter()
+        .map(|shard| read(shard).rows.capacity())
+        .sum();
+    assert_eq!(still, room);
+    // And it is a table like any other.
+    let peer = table.add_peer(external(1)).unwrap();
+    let attrs = table
+        .attrs()
+        .intern(&Route::via(&[64512]).attributes(), None)
+        .unwrap();
+    table.announce(peer, &attrs, &[Nlri::from(prefix("192.0.2.0/24"))]);
+    assert_eq!(table.prefix_count(), 1);
+}

crates/server/proto/config.proto

@@ -407,7 +407,9 @@ message Peer {
   // the table with it, and shows an established session with fewer than
   // half as needing attention: a peer that is up but has sent next to
   // nothing looks, without this, exactly like one that is fine. Zero, the
-  // default, compares nothing.
+  // default, compares nothing. The routing table is also made with room
+  // for the largest of these from the start, so that it need not grow,
+  // and so use twice its memory for a moment, while the tables come in.
   uint32 expected_routes = 17;
 }
 
@@ -440,6 +442,14 @@ message ExportPolicy {
   // Pass on the best routes learned from other peers.
   bool learned_routes = 1;
 
+  // Pass on every route learned from other peers, not only the best of
+  // each prefix, each with a path identifier (ADD-PATH, RFC 7911). For a
+  // route collector, which wants to see every path. Needs learned_routes,
+  // and the peer's add_path to offer sending; for a family the peer did
+  // not agree to receive several routes for, the best goes as usual. The
+  // export policy and the limits apply to every route alike.
+  bool all_paths = 6;
+
   // Communities put on every route announced to the peer: which router
   // it went through, say. "64601:100", or a well-known name.
   repeated string add_communities = 2;

crates/server/src/advertise.rs

@@ -44,6 +44,7 @@ use bgp_primitives::parser::ParserContext;
 use bgp_rib::table::{AttrSet, DEFAULT_LOCAL_PREF, Event, PeerIndex, Reader, RibTable};
 use bgp_rib::{LocalRib, LocalRibEvent, LocalRoute};
 use bytes::BytesMut;
+use prometheus::IntGauge;
 use tokio::sync::broadcast::Receiver;
 use tokio::sync::broadcast::error::RecvError;
 use tokio::sync::{Notify, OwnedSemaphorePermit, Semaphore, watch};
@@ -54,7 +55,7 @@ use crate::error::SessionError;
 use crate::export::{self, Egress, Outgoing, Reflection, Source};
 use crate::family::FamilySet;
 use crate::marks::Control;
-use crate::metrics::ROUTES_EXPORTED;
+use crate::metrics::{PEER_ADVERTISED, ROUTES_EXPORTED};
 use crate::policy::PeerRole;
 use crate::session::{PeerId, SessionClosed, SessionEvent, SessionHandle, SessionRegistry};
 
@@ -154,11 +155,12 @@ impl Advertiser {
             changes: self.local_rib.subscribe(),
             local_rib: self.local_rib.clone(),
             // A follower of the best routes, if the peer is to be told
-            // of them: it is given the whole table first.
-            learned: session
-                .export
-                .learned_routes
-                .then(|| Learned::new(self.rib.reader())),
+            // of them, or of every route if it is to have them all and
+            // agreed to tell them apart: it is given the whole table first.
+            learned: session.export.learned_routes.then(|| {
+                let all_paths = session.export.all_paths && !session.add_path_send.is_empty();
+                Learned::new(self.learned_reader(all_paths), all_paths)
+            }),
             rib: Arc::clone(&self.rib),
             resyncs: Arc::clone(&self.resyncs),
             control: self.control,
@@ -172,6 +174,7 @@ impl Advertiser {
                 .as_ref()
                 .map(|_| session.families.clone()),
             converged: Some(self.converged.clone()).filter(|converged| !*converged.borrow()),
+            advertised_metric: PEER_ADVERTISED.with_label_values(&[&session.metric_label()]),
         };
         let running = Running {
             session: session.clone(),
@@ -183,6 +186,16 @@ impl Advertiser {
         self.exporters.insert(session.peer, running);
     }
 
+    /// A new follower of the table for an exporter: of every route, or of
+    /// the best ones.
+    fn learned_reader(&self, all_paths: bool) -> Reader {
+        if all_paths {
+            self.rib.reader_of_all_routes()
+        } else {
+            self.rib.reader()
+        }
+    }
+
     /// Makes the exporters match the sessions there are, after events were
     /// missed: sessions may have come and gone unheard, and peers may have
     /// asked for their routes again.
@@ -225,6 +238,8 @@ struct Exporter {
     /// Word of every peer having sent its routes since the start, until it
     /// comes.
     converged: Option<watch::Receiver<bool>>,
+    /// How many routes the peer holds from us, for whoever asks.
+    advertised_metric: IntGauge,
 }
 
 /// How many changes of best route are taken from the table at a time.
@@ -259,6 +274,13 @@ enum News {
         attrs: Arc<AttrSet>,
     },
     Withdrawn(IpPrefix),
+    /// All the routes of `prefix`, for a session that is told of every
+    /// route: who each is from, that peer's identifier for it, its
+    /// attributes, and whether it is the best.
+    Routes {
+        prefix: IpPrefix,
+        routes: Vec<(PeerIndex, u32, Arc<AttrSet>, bool)>,
+    },
 }
 
 /// What a learned route goes out as depends on: the attributes it came
@@ -272,9 +294,115 @@ struct Dressed {
     octets: usize,
 }
 
-/// What the peer is to end up with for each prefix heard of: the route as
-/// it goes out, or `None` for a prefix it is not to have.
-type Verdicts = HashMap<IpPrefix, Option<Arc<Dressed>>>;
+/// A route of a prefix as a session that sends every route tells it
+/// apart: the peer it is from, and that peer's identifier for it.
+type PathKey = (PeerIndex, u32);
+
+/// A route announced to a peer that is sent every route, and not
+/// withdrawn since.
+struct Sent {
+    key: PathKey,
+    /// The path identifier it went out with (ADD-PATH, RFC 7911), which
+    /// stays its own for as long as it is announced.
+    id: u32,
+    /// As it went out, to tell whether it has to go out again.
+    dressed: Arc<Dressed>,
+}
+
+/// What the peer is to end up with for a prefix.
+enum Verdict {
+    /// The best route as it goes out, or `None` for a prefix the peer is
+    /// not to have.
+    Best(Option<Arc<Dressed>>),
+    /// Every route that goes out, with what tells it apart; empty for a
+    /// prefix the peer is not to have.
+    All(Vec<(PathKey, Arc<Dressed>)>),
+}
+
+/// What the peer is to end up with for each prefix heard of.
+type Verdicts = HashMap<IpPrefix, Verdict>;
+
+/// The learned routes announced to the peer: our Adj-RIB-Out for it, as
+/// far as it needs keeping.
+enum Announced {
+    /// The prefixes, each with its best route.
+    Best(HashSet<IpPrefix>),
+    /// For each prefix, every route announced, and how many in all.
+    All {
+        routes: HashMap<IpPrefix, Vec<Sent>>,
+        count: usize,
+    },
+}
+
+impl Announced {
+    fn new(all_paths: bool) -> Self {
+        if all_paths {
+            Self::All {
+                routes: HashMap::new(),
+                count: 0,
+            }
+        } else {
+            Self::Best(HashSet::new())
+        }
+    }
+
+    /// How many routes the peer holds.
+    fn routes(&self) -> usize {
+        match self {
+            Self::Best(prefixes) => prefixes.len(),
+            Self::All { count, .. } => *count,
+        }
+    }
+
+    /// Takes everything out, leaving this empty, as what the peer holds
+    /// in doubt until it is heard of again.
+    fn take(&mut self) -> Self {
+        match self {
+            Self::Best(prefixes) => Self::Best(std::mem::take(prefixes)),
+            Self::All { routes, count } => Self::All {
+                routes: std::mem::take(routes),
+                count: std::mem::take(count),
+            },
+        }
+    }
+
+    /// Adds what `other` holds.
+    fn absorb(&mut self, other: Self) {
+        match (self, other) {
+            (Self::Best(prefixes), Self::Best(more)) => prefixes.extend(more),
+            (Self::All { routes, count }, Self::All { routes: more, .. }) => {
+                for (prefix, sent) in more {
+                    *count += sent.len();
+                    routes.insert(prefix, sent);
+                }
+            }
+            // Both are of one session, which is one or the other.
+            _ => {}
+        }
+    }
+
+    /// Everything, as withdrawals, by IP version.
+    fn withdrawals(self) -> [Vec<Nlri>; 2] {
+        let mut withdrawn: [Vec<Nlri>; 2] = Default::default();
+        match self {
+            Self::Best(prefixes) => {
+                for prefix in prefixes {
+                    withdrawn[version_index(prefix.address_family())].push(prefix.into());
+                }
+            }
+            Self::All { routes, .. } => {
+                for (prefix, sent) in routes {
+                    let withdrawn = &mut withdrawn[version_index(prefix.address_family())];
+                    withdrawn.extend(sent.iter().map(|sent| Nlri {
+                        prefix,
+                        path_id: sent.id,
+                    }));
+                }
+            }
+        }
+        withdrawn
+    }
+}
 
 /// What an exporter knows of the learned routes it has passed on.
 struct Learned {
@@ -283,13 +411,18 @@ struct Learned {
     /// until the table is all there; and the leave to keep them.
     gathered: Option<Verdicts>,
     permit: Option<OwnedSemaphorePermit>,
-    /// The prefixes announced to the peer and not withdrawn since.
-    announced: HashSet<IpPrefix>,
+    /// Whether every route goes, and not only the best of each prefix:
+    /// the reader is then one of all routes. Only for a session on which
+    /// routes are told apart by path identifiers for at least one family;
+    /// for a family they are not, the best goes all the same.
+    all_paths: bool,
+    /// What is announced to the peer and not withdrawn since.
+    announced: Announced,
     /// Whether the peer has been told of the whole table once.
     synced: bool,
     /// While the table is being gone through anew: what was announced
     /// before and has not been heard of again yet.
-    stale: Option<HashSet<IpPrefix>>,
+    stale: Option<Announced>,
     /// Routes as they go out, by the attributes they came with, who they
     /// came from and their IP version: a table's worth of routes share a
     /// few sets of attributes, and each is worked out once. The key holds
@@ -301,7 +434,16 @@ impl Learned {
     /// How many learned routes the peer holds from us: those announced,
     /// and those not heard of again yet since the table was reset.
     fn held_by_peer(&self) -> usize {
-        self.announced.len() + self.stale.as_ref().map_or(0, HashSet::len)
+        self.announced.routes() + self.stale.as_ref().map_or(0, Announced::routes)
+    }
+
+    /// The verdict that the peer is to have nothing for a prefix.
+    fn nothing(&self) -> Verdict {
+        if self.all_paths {
+            Verdict::All(Vec::new())
+        } else {
+            Verdict::Best(None)
+        }
     }
 
     /// Takes the next changes of best route from the table: all of what
@@ -325,8 +467,20 @@ impl Learned {
                         attrs: Arc::clone(attrs),
                     },
                     Event::Withdrawn { prefix } => News::Withdrawn(prefix),
-                    // Not given to a follower of the best routes.
-                    Event::Routes { .. } => return,
+                    Event::Routes { prefix, routes } => News::Routes {
+                        prefix,
+                        routes: routes
+                            .iter()
+                            .map(|route| {
+                                (
+                                    route.peer,
+                                    route.path_id,
+                                    Arc::clone(route.attrs),
+                                    route.best,
+                                )
+                            })
+                            .collect(),
+                    },
                 });
             });
             if progress.caught_up || progress.events == 0 {
@@ -336,12 +490,13 @@ impl Learned {
         news
     }
 
-    fn new(reader: Reader) -> Self {
+    fn new(reader: Reader, all_paths: bool) -> Self {
         Self {
             reader,
             gathered: None,
             permit: None,
-            announced: HashSet::new(),
+            all_paths,
+            announced: Announced::new(all_paths),
             synced: false,
             stale: None,
             dressed: HashMap::new(),
@@ -394,6 +549,24 @@ impl Learned {
     }
 }
 
+/// Who a route from `peer` is from, as the export policy sees it, asked
+/// of the table once for each peer and remembered in `sources`. `None` if
+/// the peer has gone, and its routes with it.
+fn source_of(
+    rib: &RibTable,
+    sources: &mut HashMap<PeerIndex, Option<Source>>,
+    peer: PeerIndex,
+) -> Option<Source> {
+    *sources.entry(peer).or_insert_with(|| {
+        rib.peer(peer).map(|info| Source {
+            peer,
+            ibgp: info.ibgp,
+            reflector_client: info.reflector_client,
+            router_id: info.router_id,
+        })
+    })
+}
+
 /// Waits until every peer has sent its routes since the start; for ever if
 /// that is not to be waited for.
 async fn converged(converged: &mut Option<watch::Receiver<bool>>) {
@@ -455,7 +628,11 @@ impl Exporter {
                     // Everything, again: a new follower starts with the
                     // whole table.
                     if let Some(learned) = &mut self.learned {
-                        learned.reader = self.rib.reader();
+                        learned.reader = if learned.all_paths {
+                            self.rib.reader_of_all_routes()
+                        } else {
+                            self.rib.reader()
+                        };
                     }
                 }
                 () = changed(&mut self.learned) => {
@@ -521,6 +698,15 @@ impl Exporter {
         }
     }
 
+    /// Notes how many routes the peer now holds from us, for the status
+    /// page and the metrics.
+    fn note_advertised(&self) {
+        let advertised =
+            self.own_announced.len() + self.learned.as_ref().map_or(0, Learned::held_by_peer);
+        self.session.counters.set_advertised(advertised);
+        self.advertised_metric.set(advertised as i64);
+    }
+
     /// The session as far as it decides what goes out on it and how.
     fn towards(&self) -> Towards {
         let session = &self.session;
@@ -565,13 +751,34 @@ impl Exporter {
         let mut synced = false;
         // Who the routes are from, asked of the table once for each.
         let mut sources: HashMap<PeerIndex, Option<Source>> = HashMap::new();
+        // Whether a learned route for `prefix` may go to the peer at all:
+        // what we originate ourselves is announced as that, and not as
+        // someone else's route for it.
+        let may_go = |prefix: &IpPrefix| {
+            session.families.carries(prefix)
+                && !self.own_announced.contains(prefix)
+                && limits.is_none_or(|limits| limits.allows(prefix))
+        };
         for item in news {
             match item {
                 News::Reset => {
+                    if learned.synced {
+                        // The table was changing faster than this exporter
+                        // read it, and the journal let the oldest changes
+                        // go: the whole table is gone through again, and
+                        // what is not heard of again is withdrawn then.
+                        info!(
+                            peer = %session.peer,
+                            "The table changed too fast to follow for the peer; going through it again"
+                        );
+                    }
                     // Whatever was announced and is not heard of again by
                     // the time the table is through is withdrawn then.
-                    let known = std::mem::take(&mut learned.announced);
-                    learned.stale.get_or_insert_default().extend(known);
+                    let known = learned.announced.take();
+                    learned
+                        .stale
+                        .get_or_insert_with(|| Announced::new(learned.all_paths))
+                        .absorb(known);
                     verdicts.clear();
                     synced = false;
                     // Gathering a table takes memory: only so many sessions
@@ -585,35 +792,45 @@ impl Exporter {
                     learned.permit = None;
                 }
                 News::Withdrawn(prefix) => {
-                    verdicts.insert(prefix, None);
+                    verdicts.insert(prefix, learned.nothing());
                 }
                 News::Best {
                     prefix,
                     peer,
                     attrs,
                 } => {
-                    let source = *sources.entry(peer).or_insert_with(|| {
-                        self.rib.peer(peer).map(|info| Source {
-                            peer,
-                            ibgp: info.ibgp,
-                            reflector_client: info.reflector_client,
-                            router_id: info.router_id,
-                        })
-                    });
-                    let dressed = match source {
+                    let dressed = match source_of(&self.rib, &mut sources, peer) {
                         // What we originate ourselves is announced as
                         // that, and not as someone else's route for it.
-                        Some(source)
-                            if session.families.carries(&prefix)
-                                && !self.own_announced.contains(&prefix)
-                                && limits.is_none_or(|limits| limits.allows(&prefix)) =>
-                        {
+                        Some(source) if may_go(&prefix) => {
                             learned.dressed(&attrs, source, prefix.address_family(), &egress)
                         }
                         // The peer has gone, and its routes with it.
                         _ => None,
                     };
-                    verdicts.insert(prefix, dressed);
+                    verdicts.insert(prefix, Verdict::Best(dressed));
+                }
+                News::Routes { prefix, routes } => {
+                    let version = prefix.address_family();
+                    // Where the peer did not agree to tell the routes of a
+                    // prefix apart, only the best goes, as plain BGP has it.
+                    let told_apart = session.add_path_send.contains(AfiSafi::unicast(version));
+                    let mut wanted = Vec::new();
+                    if may_go(&prefix) {
+                        for (peer, path_id, attrs, best) in routes {
+                            if !told_apart && !best {
+                                continue;
+                            }
+                            let Some(source) = source_of(&self.rib, &mut sources, peer) else {
+                                continue;
+                            };
+                            if let Some(dressed) = learned.dressed(&attrs, source, version, &egress)
+                            {
+                                wanted.push(((peer, path_id), dressed));
+                            }
+                        }
+                    }
+                    verdicts.insert(prefix, Verdict::All(wanted));
                 }
             }
         }
@@ -638,32 +855,90 @@ impl Exporter {
         let mut batches: HashMap<(usize, IpVersion), (Arc<Dressed>, Vec<Nlri>)> = HashMap::new();
         for (prefix, verdict) in verdicts {
             let version = prefix.address_family();
-            // Heard of again: no longer in doubt, whichever way it goes.
-            let was_stale = learned
-                .stale
-                .as_mut()
-                .is_some_and(|stale| stale.remove(&prefix));
-            match verdict {
-                Some(dressed) => {
-                    learned.announced.insert(prefix);
+            let withdrawn = &mut withdrawn[version_index(version)];
+            let mut announce = |dressed: Arc<Dressed>, nlri: Nlri| {
                 batches
                     .entry((Arc::as_ptr(&dressed) as usize, version))
                     .or_insert_with(|| (dressed, Vec::new()))
                     .1
-                        .push(prefix.into());
+                    .push(nlri);
+            };
+            match (verdict, &mut learned.announced, &mut learned.stale) {
+                (Verdict::Best(verdict), Announced::Best(announced), stale) => {
+                    // Heard of again: no longer in doubt, whichever way it
+                    // goes.
+                    let was_stale = match stale {
+                        Some(Announced::Best(stale)) => stale.remove(&prefix),
+                        _ => false,
+                    };
+                    match verdict {
+                        Some(dressed) => {
+                            announced.insert(prefix);
+                            announce(dressed, prefix.into());
                         }
                         None => {
-                    if learned.announced.remove(&prefix) || was_stale {
-                        withdrawn[version_index(version)].push(prefix.into());
+                            if announced.remove(&prefix) || was_stale {
+                                withdrawn.push(prefix.into());
                             }
                         }
                     }
                 }
+                (Verdict::All(wanted), Announced::All { routes, count }, stale) => {
+                    // What the peer has for the prefix: announced, or in
+                    // doubt since the table was reset.
+                    let mut had = routes.remove(&prefix).unwrap_or_default();
+                    *count -= had.len();
+                    if let Some(Announced::All { routes, count }) = stale
+                        && let Some(stale) = routes.remove(&prefix)
+                    {
+                        *count -= stale.len();
+                        had.extend(stale);
+                    }
+                    // A route it had keeps its identifier, and goes out
+                    // again only if it changed; a new one gets the lowest
+                    // identifier not in use for the prefix.
+                    let mut has: Vec<Sent> = Vec::with_capacity(wanted.len());
+                    for (key, dressed) in wanted {
+                        let id = match had.iter().position(|sent| sent.key == key) {
+                            Some(at) => {
+                                let sent = had.swap_remove(at);
+                                if Arc::ptr_eq(&sent.dressed, &dressed) {
+                                    has.push(sent);
+                                    continue;
+                                }
+                                sent.id
+                            }
+                            None => (1..)
+                                .find(|id| !had.iter().chain(&has).any(|sent| sent.id == *id))
+                                .expect("fewer routes than identifiers"),
+                        };
+                        announce(
+                            Arc::clone(&dressed),
+                            Nlri {
+                                prefix,
+                                path_id: id,
+                            },
+                        );
+                        has.push(Sent { key, id, dressed });
+                    }
+                    withdrawn.extend(had.iter().map(|sent| Nlri {
+                        prefix,
+                        path_id: sent.id,
+                    }));
+                    *count += has.len();
+                    if !has.is_empty() {
+                        routes.insert(prefix, has);
+                    }
+                }
+                // A verdict is of the kind the session's bookkeeping is.
+                _ => {}
+            }
+        }
         if synced {
             learned.synced = true;
             if let Some(stale) = learned.stale.take() {
-                for prefix in stale {
-                    withdrawn[version_index(prefix.address_family())].push(prefix.into());
+                for (version, routes) in withdrawn.iter_mut().zip(stale.withdrawals()) {
+                    version.extend(routes);
                 }
             }
         }
@@ -674,6 +949,12 @@ impl Exporter {
         if let Some(limit) = limits.and_then(|limits| limits.exceeded_by(routes)) {
             return Err(over_limit(session, limit, routes));
         }
+        // Counted as it goes out, not after: a whole table takes a while
+        // to reach a peer that reads it at the pace of the Internet.
+        let note = |announced: usize| {
+            self.session.counters.set_advertised(announced);
+            self.advertised_metric.set(announced as i64);
+        };
         for (version, routes) in [IpVersion::Ipv4, IpVersion::Ipv6]
             .into_iter()
             .zip(withdrawn)
@@ -688,6 +969,12 @@ impl Exporter {
                 session.send(Message::Update(update)).await?;
             }
         }
+        let before = routes
+            - batches
+                .values()
+                .map(|(_, routes)| routes.len())
+                .sum::<usize>();
+        let mut announced = 0;
         for ((_, version), (dressed, routes)) in batches {
             ROUTES_EXPORTED
                 .with_label_values(&["announced"])
@@ -702,7 +989,10 @@ impl Exporter {
             for update in updates {
                 session.send(Message::Update(update)).await?;
             }
+            announced += routes.len();
+            note(before + announced);
         }
+        self.note_advertised();
         Ok(())
     }
 
@@ -775,6 +1065,7 @@ impl Exporter {
         debug!(peer = %session.peer, prefix = %route.prefix, "Announcing local route");
         session.send(Message::Update(update)).await?;
         self.own_announced.insert(route.prefix);
+        self.note_advertised();
         Ok(())
     }
 
@@ -790,6 +1081,7 @@ impl Exporter {
                 self.session.extended_next_hop,
             )))
             .await?;
+        self.note_advertised();
         Ok(())
     }
 }
@@ -1568,6 +1860,7 @@ mod tests {
         );
         handle.export = Arc::new(crate::policy::ExportPolicy {
             learned_routes: true,
+            all_paths: false,
             ..crate::policy::ExportPolicy::default()
         });
         handle.reflector_client = true;
@@ -1740,6 +2033,7 @@ mod tests {
         handle.role = Some(PeerRole::Peer);
         handle.export = Arc::new(ExportPolicy {
             learned_routes: true,
+            all_paths: false,
             ..ExportPolicy::default()
         });
         handle.export_limits = Some(Arc::new(limits));

crates/server/src/config.rs

@@ -428,8 +428,12 @@ fn parse_prepend(prepend: u32) -> Option<u8> {
 }
 
 fn parse_export(export: &proto::ExportPolicy) -> Result<ExportPolicy, ExportProblem> {
+    if export.all_paths && !export.learned_routes {
+        return Err(ExportProblem::AllPathsWithoutLearnedRoutes);
+    }
     Ok(ExportPolicy {
         learned_routes: export.learned_routes,
+        all_paths: export.all_paths,
         marks: Marks::parse(
             &export.remove_communities,
             &export.add_communities,
@@ -1510,6 +1514,19 @@ mod tests {
 
     /// What a peer is expected to send is kept for the status page; zero,
     /// the default, is nothing to compare with.
+    #[test]
+    fn all_paths_needs_learned_routes() {
+        let without = "export { all_paths: true }";
+        let error = rejected(&format!("{BASE}\n{without}"));
+        assert!(
+            error.to_string().contains("all_paths needs learned_routes"),
+            "{error}"
+        );
+        let with = "export { learned_routes: true all_paths: true }";
+        let config = parse(&format!("{BASE}\n{with}")).expect("in order");
+        assert!(config.export.all_paths);
+    }
+
     #[test]
     fn expected_routes_are_kept_when_given() {
         let config = parse(&format!(

crates/server/src/connection.rs

@@ -43,8 +43,8 @@ use crate::family::FamilySet;
 use crate::fsm::{Action, Event, Fsm, FsmConfig, Negotiated, Received};
 use crate::holddown::{HeldDown, HoldDowns};
 use crate::metrics::{
-    EXPORT_LIMIT_EXCEEDED, MESSAGES_RECEIVED, MESSAGES_SENT, PEER_ROUTES, PREFIX_LIMIT_EXCEEDED,
-    SESSIONS_ESTABLISHED_TOTAL, UPDATE_ERRORS, message_type_name,
+    EXPORT_LIMIT_EXCEEDED, MESSAGES_RECEIVED, MESSAGES_SENT, PEER_ADVERTISED, PEER_ROUTES,
+    PEER_TCP, PREFIX_LIMIT_EXCEEDED, SESSIONS_ESTABLISHED_TOTAL, UPDATE_ERRORS, message_type_name,
 };
 use crate::panic::contained;
 use crate::policy::{self, ExportLimits, ExportPolicy, ImportPolicy, PeerRole};
@@ -315,6 +315,8 @@ async fn release_routes(
     // The peer has no session to count its routes for.
     // Fails only if the session never set it, which is nothing to do.
     let _ = PEER_ROUTES.remove_label_values(&[session.rejections.label()]);
+    let _ = PEER_ADVERTISED.remove_label_values(&[session.rejections.label()]);
+    PEER_TCP.remove(session.rejections.label());
     if *session.leave.borrow() == Some(Leave::Restart) {
         // The daemon is about to go, and its routes with it; the kernel
         // keeps its own. Taking them out first would only hold the

crates/server/src/error.rs

@@ -336,6 +336,8 @@ pub enum ExportProblem {
     Marks(#[from] crate::marks::MarksProblem),
     #[error("as_path_prepend of {value} is more than {max}")]
     Prepend { value: u32, max: u32 },
+    #[error("all_paths needs learned_routes")]
+    AllPathsWithoutLearnedRoutes,
 }
 
 /// What is wrong with one `originate` entry.

crates/server/src/export.rs

@@ -529,6 +529,7 @@ mod tests {
     fn all_routes() -> ExportPolicy {
         ExportPolicy {
             learned_routes: true,
+            all_paths: false,
             ..ExportPolicy::default()
         }
     }
@@ -922,6 +923,7 @@ mod tests {
             |texts: &[&str]| -> Vec<String> { texts.iter().map(|text| text.to_string()).collect() };
         let policy = ExportPolicy {
             learned_routes: true,
+            all_paths: false,
             marks: Marks::parse(&strings(&["64601:900"]), &strings(&["64601:5"]), &[]).unwrap(),
             prepend: 2,
         };

crates/server/src/metrics.rs

@@ -4,8 +4,8 @@ use std::sync::LazyLock;
 
 use bgp_packet::message::Message;
 use prometheus::{
-    IntCounter, IntCounterVec, IntGauge, IntGaugeVec, register_int_counter,
-    register_int_counter_vec, register_int_gauge, register_int_gauge_vec,
+    GaugeVec, IntCounter, IntCounterVec, IntGauge, IntGaugeVec, register_gauge_vec,
+    register_int_counter, register_int_counter_vec, register_int_gauge, register_int_gauge_vec,
 };
 
 pub static MESSAGES_SENT: LazyLock<IntCounterVec> = LazyLock::new(|| {
@@ -69,6 +69,148 @@ pub static PEER_ROUTES: LazyLock<IntGaugeVec> = LazyLock::new(|| {
     .expect("metric registration")
 });
 
+pub static PEER_ADVERTISED: LazyLock<IntGaugeVec> = LazyLock::new(|| {
+    register_int_gauge_vec!(
+        "bgp_peer_advertised_routes",
+        "Routes announced to an established peer and not withdrawn since",
+        &["peer"]
+    )
+    .expect("metric registration")
+});
+
+/// A session's TCP connection as the kernel reports it (`TCP_INFO`),
+/// sampled when the metrics are scraped. Seconds, octets, segments, and
+/// octets per second; the busy, limited and byte figures are cumulative
+/// over the connection's life.
+pub struct PeerTcp {
+    pub rtt_seconds: GaugeVec,
+    pub min_rtt_seconds: GaugeVec,
+    pub rtt_variance_seconds: GaugeVec,
+    pub cwnd_segments: IntGaugeVec,
+    pub mss_bytes: IntGaugeVec,
+    pub send_window_bytes: IntGaugeVec,
+    pub receive_window_bytes: IntGaugeVec,
+    pub send_queue_bytes: IntGaugeVec,
+    pub not_sent_bytes: IntGaugeVec,
+    pub receive_queue_bytes: IntGaugeVec,
+    pub unacked_segments: IntGaugeVec,
+    pub retransmitted_segments: IntGaugeVec,
+    pub lost_segments: IntGaugeVec,
+    pub busy_seconds: GaugeVec,
+    pub receive_window_limited_seconds: GaugeVec,
+    pub send_buffer_limited_seconds: GaugeVec,
+    pub sent_bytes: IntGaugeVec,
+    pub received_bytes: IntGaugeVec,
+    pub delivery_rate_bytes_per_second: IntGaugeVec,
+    pub pacing_rate_bytes_per_second: IntGaugeVec,
+}
+
+impl PeerTcp {
+    /// Forgets the peer's series, when its session has ended.
+    pub fn remove(&self, label: &str) {
+        for gauge in [
+            &self.rtt_seconds,
+            &self.min_rtt_seconds,
+            &self.rtt_variance_seconds,
+            &self.busy_seconds,
+            &self.receive_window_limited_seconds,
+            &self.send_buffer_limited_seconds,
+        ] {
+            let _ = gauge.remove_label_values(&[label]);
+        }
+        for gauge in [
+            &self.cwnd_segments,
+            &self.mss_bytes,
+            &self.send_window_bytes,
+            &self.receive_window_bytes,
+            &self.send_queue_bytes,
+            &self.not_sent_bytes,
+            &self.receive_queue_bytes,
+            &self.unacked_segments,
+            &self.retransmitted_segments,
+            &self.lost_segments,
+            &self.sent_bytes,
+            &self.received_bytes,
+            &self.delivery_rate_bytes_per_second,
+            &self.pacing_rate_bytes_per_second,
+        ] {
+            let _ = gauge.remove_label_values(&[label]);
+        }
+    }
+}
+
+pub static PEER_TCP: LazyLock<PeerTcp> = LazyLock::new(|| {
+    let seconds = |name: &str, help: &str| {
+        register_gauge_vec!(format!("bgp_peer_tcp_{name}"), help, &["peer"])
+            .expect("metric registration")
+    };
+    let count = |name: &str, help: &str| {
+        register_int_gauge_vec!(format!("bgp_peer_tcp_{name}"), help, &["peer"])
+            .expect("metric registration")
+    };
+    PeerTcp {
+        rtt_seconds: seconds(
+            "rtt_seconds",
+            "Smoothed round-trip time of the session's TCP connection",
+        ),
+        min_rtt_seconds: seconds(
+            "min_rtt_seconds",
+            "Least round-trip time seen on the connection",
+        ),
+        rtt_variance_seconds: seconds(
+            "rtt_variance_seconds",
+            "Round-trip time variance of the connection",
+        ),
+        cwnd_segments: count("cwnd_segments", "Congestion window, in segments"),
+        mss_bytes: count("mss_bytes", "Maximum segment size"),
+        send_window_bytes: count(
+            "send_window_bytes",
+            "The peer's receive window: what it lets us send",
+        ),
+        receive_window_bytes: count(
+            "receive_window_bytes",
+            "Our receive window: what we let the peer send",
+        ),
+        send_queue_bytes: count(
+            "send_queue_bytes",
+            "Octets written and not yet acknowledged by the peer",
+        ),
+        not_sent_bytes: count("not_sent_bytes", "Octets written and not yet sent"),
+        receive_queue_bytes: count("receive_queue_bytes", "Octets received and not yet read"),
+        unacked_segments: count("unacked_segments", "Segments sent and not yet acknowledged"),
+        retransmitted_segments: count(
+            "retransmitted_segments",
+            "Segments retransmitted over the connection's life",
+        ),
+        lost_segments: count("lost_segments", "Segments thought lost now"),
+        busy_seconds: seconds(
+            "busy_seconds",
+            "Time the connection had something to send, over its life",
+        ),
+        receive_window_limited_seconds: seconds(
+            "receive_window_limited_seconds",
+            "Of the busy time, time held up by the peer's receive window",
+        ),
+        send_buffer_limited_seconds: seconds(
+            "send_buffer_limited_seconds",
+            "Of the busy time, time held up by our send buffer being full",
+        ),
+        sent_bytes: count("sent_bytes", "Octets sent over the connection's life"),
+        received_bytes: count(
+            "received_bytes",
+            "Octets received over the connection's life",
+        ),
+        delivery_rate_bytes_per_second: count(
+            "delivery_rate_bytes_per_second",
+            "Delivery rate the kernel measured most recently",
+        ),
+        pacing_rate_bytes_per_second: count(
+            "pacing_rate_bytes_per_second",
+            "Rate the kernel paces the connection at",
+        ),
+    }
+});
+
 pub static PEER_MAX_PREFIXES: LazyLock<IntGaugeVec> = LazyLock::new(|| {
     register_int_gauge_vec!(
         "bgp_peer_max_prefixes",
@@ -228,6 +370,8 @@ pub fn init() {
     LazyLock::force(&RIB_JOURNAL_ENTRIES);
     LazyLock::force(&ROUTES_EXPORTED);
     LazyLock::force(&PEER_UP);
+    LazyLock::force(&PEER_ADVERTISED);
+    LazyLock::force(&PEER_TCP);
     BUILD_INFO
         .with_label_values(&[env!("CARGO_PKG_VERSION")])
         .set(1);

crates/server/src/policy.rs

@@ -266,6 +266,11 @@ pub struct ExportPolicy {
     /// Pass on the best routes learned from other peers, and not only
     /// what we originate.
     pub learned_routes: bool,
+    /// Pass on every route learned from other peers, not only the best
+    /// of each prefix, told apart by path identifiers (ADD-PATH, RFC
+    /// 7911), for the families the peer agreed to receive them for; a
+    /// route collector asks for this. For other families the best goes.
+    pub all_paths: bool,
     /// Communities taken off and put on every route announced.
     pub marks: Marks,
     /// How many more times our AS goes on the path.

crates/server/src/server.rs

@@ -118,7 +118,7 @@ impl BgpServer {
         for route in &config.originate {
             local_rib.announce(route.clone()).await?;
         }
-        let configured = config
+        let configured: Vec<ConfiguredPeer> = config
             .peers
             .iter()
             .map(|p| ConfiguredPeer {
@@ -134,6 +134,11 @@ impl BgpServer {
         // first routes are.
         let (rpki, rpki_client) = config.rpki.clone().map(Rpki::spawn).unzip();
         let rib = Arc::new(RibTable::new(table_shards()));
+        // Sized for the largest table a peer is expected to send: the
+        // prefixes of the others are mostly the same ones.
+        if let Some(expected) = configured.iter().filter_map(|p| p.expected_routes).max() {
+            rib.expect_prefixes(expected as usize);
+        }
         // Started now, so that a machine on which it cannot be done stops
         // the daemon from starting. There is nothing to install yet.
         let (kernel, kernel_task) = match config.kernel {

crates/server/src/session.rs

@@ -93,6 +93,10 @@ pub struct SessionCounters {
     /// Routes of the peer's kept from its last session, which it has not
     /// sent again yet (graceful restart).
     stale: AtomicU64,
+    /// Routes announced to the peer and not withdrawn since: what it
+    /// holds from us, every route counted where it is sent several for
+    /// a prefix.
+    advertised: AtomicU64,
 }
 
 impl SessionCounters {
@@ -112,6 +116,14 @@ impl SessionCounters {
         self.held.store(held as u64, Ordering::Relaxed);
     }
 
+    pub fn advertised(&self) -> u64 {
+        self.advertised.load(Ordering::Relaxed)
+    }
+
+    pub(crate) fn set_advertised(&self, advertised: usize) {
+        self.advertised.store(advertised as u64, Ordering::Relaxed);
+    }
+
     pub fn stale(&self) -> u64 {
         self.stale.load(Ordering::Relaxed)
     }
@@ -284,6 +296,14 @@ impl SessionHandle {
 
     /// Whether `other` is a handle to this same session, and not to another
     /// session with the same peer.
+    /// What the peer goes by in the metrics: its configured name, or its
+    /// address.
+    pub fn metric_label(&self) -> String {
+        self.name
+            .clone()
+            .unwrap_or_else(|| crate::address::PeerAddress::from(self.peer.addr).to_string())
+    }
+
     pub fn is_same_session(&self, other: &SessionHandle) -> bool {
         self.outbound.same_channel(&other.outbound)
     }

crates/web/src/api.rs

@@ -89,6 +89,8 @@ pub struct PeerView {
     /// How many routes the peer announced on this session that its import
     /// policy refused.
     pub rejected_routes: Option<u64>,
+    /// Routes announced to the peer and not withdrawn since.
+    pub advertised_routes: Option<u64>,
     /// How many of the peer's routes are held out of the table as invalid
     /// by the RPKI's data, to be taken if that changes.
     pub held_routes: Option<u64>,
@@ -159,6 +161,7 @@ impl From<&SessionHandle> for PeerView {
             add_path_send: Some(s.add_path_send.iter().map(|f| f.to_string()).collect()),
             routes: Some(s.counters.routes()),
             rejected_routes: Some(s.counters.rejected()),
+            advertised_routes: Some(s.counters.advertised()),
             held_routes: Some(s.counters.held()),
             expected_routes: None,
             role: s.role.map(PeerRole::as_str),
@@ -198,6 +201,7 @@ impl PeerView {
             add_path_send: None,
             routes: None,
             rejected_routes: None,
+            advertised_routes: None,
             held_routes: None,
             expected_routes: peer.expected_routes,
             role: peer.role.map(PeerRole::as_str),
@@ -1573,3 +1577,155 @@ mod tests {
         assert_eq!(other, expected);
     }
 }
+
+/// `GET /api/tcp?peer=ADDRESS:PORT`: what the kernel knows of the TCP
+/// connection of the session with that peer, as `/api/peers` names it.
+#[derive(Debug, Deserialize)]
+pub struct TcpQuery {
+    pub peer: String,
+}
+
+/// A session's TCP connection, as the kernel reports it (Linux only).
+/// Times in milliseconds, sizes in octets, rates in octets per second.
+#[derive(Debug, Serialize)]
+pub struct TcpView {
+    pub state: &'static str,
+    pub congestion: Option<String>,
+    pub rtt_ms: f64,
+    pub rtt_variance_ms: f64,
+    pub min_rtt_ms: f64,
+    pub rto_ms: f64,
+    pub mss: u32,
+    pub pmtu: u32,
+    pub cwnd_segments: u32,
+    pub ssthresh_segments: Option<u32>,
+    /// The peer's receive window: what it lets us send.
+    pub send_window: u32,
+    /// Our receive window: what we let the peer send.
+    pub receive_window: u32,
+    pub receive_space: u32,
+    pub send_window_scale: u8,
+    pub receive_window_scale: u8,
+    /// Octets written by us and not yet acknowledged, and of those the
+    /// octets not even sent yet.
+    pub send_queue: u32,
+    pub not_sent: u32,
+    pub recv_queue: u32,
+    pub unacked_segments: u32,
+    pub retrans_segments: u32,
+    pub lost_segments: u32,
+    pub total_retrans: u32,
+    pub bytes_retrans: u64,
+    pub pacing_rate: u64,
+    pub delivery_rate: u64,
+    pub bytes_sent: u64,
+    pub bytes_acked: u64,
+    pub bytes_received: u64,
+    pub segments_out: u32,
+    pub segments_in: u32,
+    /// How long the connection had something to send, and of that how
+    /// long it was held up by the peer's window and by our send buffer.
+    pub busy_ms: f64,
+    pub limited_by_receive_window_ms: f64,
+    pub limited_by_send_buffer_ms: f64,
+    /// The same two, as shares of the busy time, 0 to 1.
+    pub limited_by_receive_window_share: f64,
+    pub limited_by_send_buffer_share: f64,
+    pub last_data_sent_ms: u32,
+    pub last_data_received_ms: u32,
+    pub last_ack_received_ms: u32,
+}
+
+/// The answer to `/api/tcp`.
+#[derive(Debug, Serialize)]
+pub struct TcpAnswer {
+    /// Whether the kernel could be asked and knew the connection.
+    pub available: bool,
+    /// Why not, if not.
+    pub reason: Option<String>,
+    pub connection: Option<TcpView>,
+}
+
+pub async fn tcp(
+    State(state): State<AppState>,
+    Query(query): Query<TcpQuery>,
+) -> Result<Json<TcpAnswer>, QueryError> {
+    let session = state
+        .registry
+        .list()
+        .into_iter()
+        .find(|s| socket_text(s.peer.addr) == query.peer)
+        .ok_or_else(|| QueryError::Bad(format!("no session with {}", query.peer)))?;
+    let answer =
+        match bgp_fib::sockdiag::tcp_connection(session.local_addr, session.peer.addr).await {
+            Ok(Some(c)) => {
+                let ms = |us: u64| us as f64 / 1000.0;
+                let share = |part: u64| {
+                    if c.busy == 0 {
+                        0.0
+                    } else {
+                        part as f64 / c.busy as f64
+                    }
+                };
+                TcpAnswer {
+                    available: true,
+                    reason: None,
+                    connection: Some(TcpView {
+                        state: c.state_name(),
+                        congestion: c.congestion.clone(),
+                        rtt_ms: ms(c.rtt.into()),
+                        rtt_variance_ms: ms(c.rtt_variance.into()),
+                        min_rtt_ms: ms(c.min_rtt.into()),
+                        rto_ms: ms(c.rto.into()),
+                        mss: c.mss,
+                        pmtu: c.pmtu,
+                        cwnd_segments: c.cwnd,
+                        ssthresh_segments: c.ssthresh,
+                        send_window: c.send_window,
+                        receive_window: c.receive_window,
+                        receive_space: c.receive_space,
+                        send_window_scale: c.send_window_scale,
+                        receive_window_scale: c.receive_window_scale,
+                        send_queue: c.send_queue,
+                        not_sent: c.not_sent,
+                        recv_queue: c.recv_queue,
+                        unacked_segments: c.unacked,
+                        retrans_segments: c.retrans,
+                        lost_segments: c.lost,
+                        total_retrans: c.total_retrans,
+                        bytes_retrans: c.bytes_retrans,
+                        pacing_rate: c.pacing_rate,
+                        delivery_rate: c.delivery_rate,
+                        bytes_sent: c.bytes_sent,
+                        bytes_acked: c.bytes_acked,
+                        bytes_received: c.bytes_received,
+                        segments_out: c.segments_out,
+                        segments_in: c.segments_in,
+                        busy_ms: ms(c.busy),
+                        limited_by_receive_window_ms: ms(c.limited_by_receive_window),
+                        limited_by_send_buffer_ms: ms(c.limited_by_send_buffer),
+                        limited_by_receive_window_share: share(c.limited_by_receive_window),
+                        limited_by_send_buffer_share: share(c.limited_by_send_buffer),
+                        last_data_sent_ms: c.last_data_sent_ms,
+                        last_data_received_ms: c.last_data_received_ms,
+                        last_ack_received_ms: c.last_ack_received_ms,
+                    }),
+                }
+            }
+            Ok(None) => TcpAnswer {
+                available: false,
+                reason: Some(if cfg!(target_os = "linux") {
+                    "the kernel has no such connection".to_string()
+                } else {
+                    "only on Linux".to_string()
+                }),
+                connection: None,
+            },
+            Err(e) => TcpAnswer {
+                available: false,
+                reason: Some(format!("the kernel could not be asked: {e}")),
+                connection: None,
+            },
+        };
+    Ok(Json(answer))
+}

crates/web/src/lib.rs

@@ -144,6 +144,7 @@ pub fn router(state: AppState) -> Router {
         .route("/api/routes/rejected", get(api::rejected_routes))
         .route("/api/rpki", get(api::rpki))
         .route("/api/kernel", get(api::kernel))
+        .route("/api/tcp", get(api::tcp))
         .route("/api/events", get(events::stream))
         .route("/metricz", get(metrics::metricz))
         .with_state(state)

crates/web/src/metrics.rs

@@ -5,7 +5,7 @@ use axum::extract::State;
 use axum::http::{StatusCode, header};
 use axum::response::IntoResponse;
 use bgp_server::metrics::{
-    LOCAL_ROUTES, RIB_ATTRIBUTE_SETS, RIB_JOURNAL_ENTRIES, RIB_PREFIXES, RIB_ROUTES,
+    LOCAL_ROUTES, PEER_TCP, RIB_ATTRIBUTE_SETS, RIB_JOURNAL_ENTRIES, RIB_PREFIXES, RIB_ROUTES,
 };
 use prometheus::{Encoder, TextEncoder};
 
@@ -24,6 +24,7 @@ pub async fn metricz(State(state): State<AppState>) -> impl IntoResponse {
     RIB_PREFIXES.set(gauge(state.rib.prefix_count()));
     RIB_ATTRIBUTE_SETS.set(gauge(state.rib.attrs().len()));
     RIB_JOURNAL_ENTRIES.set(gauge(state.rib.journal_len()));
+    sample_tcp(&state).await;
 
     let mut buf = Vec::new();
     let encoder = TextEncoder::new();
@@ -37,3 +38,81 @@ pub async fn metricz(State(state): State<AppState>) -> impl IntoResponse {
         Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()).into_response(),
     }
 }
+
+/// Asks the kernel about every established session's TCP connection and
+/// sets the peer's gauges: one netlink round trip a session, at scrape
+/// time, so that there is history to look back on. A session the kernel
+/// has no connection for any more loses its series.
+async fn sample_tcp(state: &AppState) {
+    let tcp = &*PEER_TCP;
+    for session in state.registry.list() {
+        let label = session.metric_label();
+        let connection =
+            bgp_fib::sockdiag::tcp_connection(session.local_addr, session.peer.addr).await;
+        let Ok(Some(c)) = connection else {
+            tcp.remove(&label);
+            continue;
+        };
+        let seconds = |us: u64| us as f64 / 1e6;
+        let int = |n: u64| i64::try_from(n).unwrap_or(i64::MAX);
+        let label = [label.as_str()];
+        tcp.rtt_seconds
+            .with_label_values(&label)
+            .set(seconds(c.rtt.into()));
+        tcp.min_rtt_seconds
+            .with_label_values(&label)
+            .set(seconds(c.min_rtt.into()));
+        tcp.rtt_variance_seconds
+            .with_label_values(&label)
+            .set(seconds(c.rtt_variance.into()));
+        tcp.cwnd_segments
+            .with_label_values(&label)
+            .set(c.cwnd.into());
+        tcp.mss_bytes.with_label_values(&label).set(c.mss.into());
+        tcp.send_window_bytes
+            .with_label_values(&label)
+            .set(c.send_window.into());
+        tcp.receive_window_bytes
+            .with_label_values(&label)
+            .set(c.receive_window.into());
+        tcp.send_queue_bytes
+            .with_label_values(&label)
+            .set(c.send_queue.into());
+        tcp.not_sent_bytes
+            .with_label_values(&label)
+            .set(c.not_sent.into());
+        tcp.receive_queue_bytes
+            .with_label_values(&label)
+            .set(c.recv_queue.into());
+        tcp.unacked_segments
+            .with_label_values(&label)
+            .set(c.unacked.into());
+        tcp.retransmitted_segments
+            .with_label_values(&label)
+            .set(c.total_retrans.into());
+        tcp.lost_segments
+            .with_label_values(&label)
+            .set(c.lost.into());
+        tcp.busy_seconds
+            .with_label_values(&label)
+            .set(seconds(c.busy));
+        tcp.receive_window_limited_seconds
+            .with_label_values(&label)
+            .set(seconds(c.limited_by_receive_window));
+        tcp.send_buffer_limited_seconds
+            .with_label_values(&label)
+            .set(seconds(c.limited_by_send_buffer));
+        tcp.sent_bytes
+            .with_label_values(&label)
+            .set(int(c.bytes_sent));
+        tcp.received_bytes
+            .with_label_values(&label)
+            .set(int(c.bytes_received));
+        tcp.delivery_rate_bytes_per_second
+            .with_label_values(&label)
+            .set(int(c.delivery_rate));
+        tcp.pacing_rate_bytes_per_second
+            .with_label_values(&label)
+            .set(int(c.pacing_rate));
+    }
+}

crates/web/static/statusz.html

@@ -68,6 +68,14 @@ table.data th { background: var(--head); font-weight: bold; position: sticky; to
 table.data > tbody > tr:hover > td { background: var(--hover); }
 table.data td.num, table.data th.num { text-align: right; font-variant-numeric: tabular-nums; white-space: nowrap; }
 table.data tr.group > td { background: var(--band); font-weight: bold; padding: 3px 6px; }
+table.data tr.tcp-row > td { background: var(--band); padding: 6px 10px 8px 28px; }
+table.data td.attrs { cursor: pointer; }
+table.data td.attrs:hover { background: var(--hover); }
+table.data tr.route-detail > td { background: var(--band); padding: 6px 10px 8px 40px; }
+.tcp-grid { display: grid; grid-template-columns: max-content 1fr; gap: 1px 16px; font-size: 12px; }
+.tcp-grid > div:nth-child(odd) { color: var(--fg-soft); white-space: nowrap; }
+a.tcp-link { color: var(--dim); font-size: 11.5px; text-decoration: none; border: 1px solid var(--line); border-radius: 3px; padding: 0 4px; margin-left: 4px; }
+a.tcp-link:hover, a.tcp-link.open { color: var(--link); border-color: var(--link); }
 table.data tr.best > td { background: var(--best-bg); }
 table.data tr.dim td { color: var(--dim); }
 .asn { cursor: help; }
@@ -181,7 +189,7 @@ JSON: <a href="/api/status">status</a>, <a href="/api/peers">peers</a>, <a href=
 <span class="dim legend">Glyphs: <span class="g">v4</span><span class="g">v6</span> address families · <span class="g">GR</span> graceful restart · <span class="g">ENH</span> IPv4 with IPv6 next hops · <span class="g">AP</span> ADD-PATH · <span class="g amber">2B</span> two-octet AS numbers only · <span class="g">↑</span> provider <span class="g">↓</span> customer <span class="g">↔</span> peer <span class="g">RS</span> route server <span class="g">RSC</span> its client <span class="g">iBGP</span> our AS. Point at one for its meaning; click a peer's name to look at its routes.</span>
 </div>
 <table class="data">
-<thead><tr><th>name</th><th>peer</th><th>state</th><th>up for</th><th class="c-opt">our address (next hop)</th><th class="c-opt">session</th><th class="num">routes</th><th class="num" title="Announcements rejected by the import policy since the daemon started, and routes held out of the table as invalid or unreachable now">rejected · held</th><th>detail</th></tr></thead>
+<thead><tr><th>name</th><th>peer</th><th>state</th><th>up for</th><th class="c-opt">our address (next hop)</th><th class="c-opt">session</th><th class="num">routes</th><th class="num" title="Routes announced to the peer and not withdrawn since; with ADD-PATH, every route sent counts">sent</th><th class="num" title="Announcements rejected by the import policy since the daemon started, and routes held out of the table as invalid or unreachable now">rejected · held</th><th>detail</th></tr></thead>
 <tbody id="peers-body"></tbody>
 </table>
 
@@ -241,7 +249,7 @@ from <select id="lookup-peer"><option value="">any peer</option></select>
 
   const $ = id => document.getElementById(id);
   const esc = s => String(s).replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
-  const state = { status: null, peers: [], local: [], received: [], receivedPage: {}, rejected: [], rpki: null, kernel: null };
+  const state = { status: null, peers: [], local: [], received: [], receivedPage: {}, rejected: [], rpki: null, kernel: null, tcpOpen: new Set(), routeOpen: new Set() };
   const DASH = '<span class="dim">–</span>';
   const fmtCount = n => Number(n).toLocaleString('en-US');
   // A glyph: a small badge with its meaning as the tooltip.
@@ -532,7 +540,7 @@ from <select id="lookup-peer"><option value="">any peer</option></select>
     const down = peers.filter(p => peerRank(p) === 0).length;
     const waiting = peers.filter(p => p.state === 'Passive').length;
     $('peers-count').textContent = `${up} of ${peers.length} established` + (down ? `, ${down} down` : '') + (waiting ? `, ${waiting} waiting` : '');
-    if (!peers.length) { setHTML(b, '<tr><td colspan="9" class="dim">No peers configured and none connected.</td></tr>'); return; }
+    if (!peers.length) { setHTML(b, '<tr><td colspan="10" class="dim">No peers configured and none connected.</td></tr>'); return; }
     const problemsOnly = $('peers-problems').checked;
     // The IPv4 and IPv6 sessions of one neighbour, named <stem>-v4 and
     // <stem>-v6, are one neighbour to the reader: listed together, IPv6
@@ -549,7 +557,7 @@ from <select id="lookup-peer"><option value="">any peer</option></select>
       const expected = up && p.expected_routes > 0
         ? ` <span class="${short ? 'amber' : 'dim'}" title="${short ? 'Well under' : 'About'} the ${fmtCount(p.expected_routes)} routes this peer is expected to send (expected_routes)">of ~${fmtCount(p.expected_routes)}</span>` : '';
       const classes = [peerRank(p) === 3 ? 'dim' : '', pair || ''].filter(Boolean).join(' ');
-      return `<tr class="${classes}" data-peer-row="${esc(p.name || p.peer_addr)}">
+      return `<tr class="${classes}" data-peer-row="${esc(p.name || p.peer_addr)}" data-peer-addr="${esc(p.peer_addr)}">
         <td class="name">${sinceGlyph(p)}${name}</td>
         <td class="mono">${esc(p.peer_addr)} <span class="dim">AS${asn(p.peer_asn)}</span> ${roleGlyph(p)}</td>
         <td><span class="${STATE_CLASS[p.state] || ''}">${esc(p.state)}</span></td>
@@ -557,8 +565,9 @@ from <select id="lookup-peer"><option value="">any peer</option></select>
         <td class="mono c-opt">${up ? esc(p.local_addr) : DASH}</td>
         <td class="c-opt">${up ? sessionGlyphs(p) : DASH}</td>
         <td class="num">${up ? trendGlyph(p) + fmtCount(p.routes) + expected + stale : DASH}</td>
+        <td class="num">${up ? fmtCount(p.advertised_routes) : DASH}</td>
         <td class="num">${rejected}${held}</td>
-        <td>${peerDetail(p)}</td></tr>`;
+        <td>${peerDetail(p)}${up ? tcpLink(p) : ''}</td></tr>`;
     };
     // Rows for a sorted list, with the v4/v6 pairs in it marked.
     const rows = list => list.map((p, i) => {
@@ -574,23 +583,93 @@ from <select id="lookup-peer"><option value="">any peer</option></select>
     // they are to us.
     const problems = peers.filter(p => peerRank(p) <= 1).sort(byName);
     if (problems.length) {
-      html += `<tr class="group"><td colspan="9"><span class="red">Needing attention</span> (${problems.length})</td></tr>` + rows(problems);
+      html += `<tr class="group"><td colspan="10"><span class="red">Needing attention</span> (${problems.length})</td></tr>` + rows(problems);
     }
     if (!problemsOnly) {
       for (const group of ROLE_ORDER) {
         const members = peers.filter(p => peerRank(p) >= 2 && peerGroup(p) === group).sort(byName);
         if (!members.length) continue;
-        html += `<tr class="group"><td colspan="9">${GROUP_TITLE[group]} (${members.length})</td></tr>` + rows(members);
+        html += `<tr class="group"><td colspan="10">${GROUP_TITLE[group]} (${members.length})</td></tr>` + rows(members);
       }
     } else if (!problems.length) {
-      html += '<tr><td colspan="9" class="dim">Nothing needs attention.</td></tr>';
+      html += '<tr><td colspan="10" class="dim">Nothing needs attention.</td></tr>';
     }
     setHTML(b, html);
+    renderTcpRows();
     const marked = peers.filter(changedSince).length;
     setHTML($('since-ctl'), marked ? `${glyph('●', 'Rows that changed while this tab was in the background', 'since')} <span class="dim">${marked} changed since you last looked ·</span> <a href="#" id="since-clear">clear</a>` : '');
     renderPeerChoices();
   }
 
+  // The TCP connection of a session, as the kernel sees it: a link on the
+  // row, and a row below it while it is open, asked for afresh on every
+  // refresh.
+  function tcpLink(p) {
+    const open = state.tcpOpen.has(p.peer_addr);
+    return `<a href="#" class="tcp-link${open ? ' open' : ''}" data-peer="${esc(p.peer_addr)}" title="TCP_INFO for this session's socket">tcp</a>`;
+  }
+  const fmtOctets = n => n >= 1048576 ? `${(n / 1048576).toFixed(1)} MiB` : n >= 1024 ? `${(n / 1024).toFixed(1)} KiB` : `${n} B`;
+  const fmtBits = n => { const b = n * 8; return b >= 1e9 ? `${(b / 1e9).toFixed(2)} Gbit/s` : b >= 1e6 ? `${(b / 1e6).toFixed(1)} Mbit/s` : `${(b / 1e3).toFixed(0)} kbit/s`; };
+  const fmtMs = n => n >= 1000 ? `${(n / 1000).toFixed(1)} s` : `${n.toFixed(n < 10 ? 2 : 0)} ms`;
+  const ago = ms => ms >= 60000 ? `${Math.round(ms / 60000)}m` : ms >= 1000 ? `${(ms / 1000).toFixed(1)}s` : `${ms}ms`;
+  function tcpDetail(a) {
+    if (!a.available) return `<span class="dim">${esc(a.reason || 'n/a')}</span>`;
+    const c = a.connection;
+    const pct = share => `${(share * 100).toFixed(0)}%`;
+    const held = share => share > 0.5 ? 'red' : share > 0.1 ? 'amber' : '';
+    const kv = (k, v) => `<span class="dim">${k}</span> ${v}`;
+    const rows = [
+      ['state', `${esc(c.state.toUpperCase())} ${c.congestion ? esc(c.congestion) : ''}`],
+      ['rtt', `${fmtMs(c.rtt_ms)} ${kv('minrtt', fmtMs(c.min_rtt_ms))} ${kv('rttvar', fmtMs(c.rtt_variance_ms))} ${kv('rto', fmtMs(c.rto_ms))}`],
+      ['cwnd', `${fmtCount(c.cwnd_segments)} ${kv('mss', `${c.mss}`)} ${kv('=', fmtOctets(c.cwnd_segments * c.mss))} ${kv('ssthresh', c.ssthresh_segments == null ? '∞' : fmtCount(c.ssthresh_segments))} ${kv('pmtu', `${c.pmtu}`)}`],
+      ['snd_wnd', `${fmtOctets(c.send_window)} ${kv('wscale', `${c.send_window_scale}`)}`],
+      ['rcv_wnd', `${fmtOctets(c.receive_window)} ${kv('rcv_space', fmtOctets(c.receive_space))} ${kv('wscale', `${c.receive_window_scale}`)}`],
+      ['send-q', `${fmtOctets(c.send_queue)} ${kv('notsent', fmtOctets(c.not_sent))} ${kv('unacked', fmtCount(c.unacked_segments))}`],
+      ['recv-q', fmtOctets(c.recv_queue)],
+      ['retrans', `${fmtCount(c.retrans_segments)} ${kv('lost', fmtCount(c.lost_segments))} ${kv('total', `${fmtCount(c.total_retrans)} / ${fmtOctets(c.bytes_retrans)}`)}`],
+      ['rate', `${kv('delivery', fmtBits(c.delivery_rate))} ${kv('pacing', fmtBits(c.pacing_rate))}`],
+      ['limited', `${kv('busy', fmtMs(c.busy_ms))} <span class="${held(c.limited_by_receive_window_share)}">${kv('rwnd', pct(c.limited_by_receive_window_share))}</span> <span class="${held(c.limited_by_send_buffer_share)}">${kv('sndbuf', pct(c.limited_by_send_buffer_share))}</span>`],
+      ['bytes', `${kv('sent', fmtOctets(c.bytes_sent))} ${kv('acked', fmtOctets(c.bytes_acked))} ${kv('received', fmtOctets(c.bytes_received))} ${kv('segs', `${fmtCount(c.segments_out)}↑ ${fmtCount(c.segments_in)}↓`)}`],
+      ['last', `${kv('snd', ago(c.last_data_sent_ms))} ${kv('rcv', ago(c.last_data_received_ms))} ${kv('ack', ago(c.last_ack_received_ms))}`],
+    ];
+    return `<div class="tcp-grid mono">${rows.map(([k, v]) => `<div>${k}</div><div>${v}</div>`).join('')}</div>`;
+  }
+  async function renderTcpRows() {
+    for (const addr of state.tcpOpen) {
+      const tr = document.querySelector(`#peers-body tr[data-peer-addr="${CSS.escape(addr)}"]`);
+      if (!tr) continue;
+      let row = tr.nextElementSibling;
+      if (!row || !row.classList.contains('tcp-row')) {
+        row = document.createElement('tr');
+        row.className = 'tcp-row';
+        row.innerHTML = '<td colspan="10"><span class="dim">asking the kernel…</span></td>';
+        tr.after(row);
+      }
+      try {
+        const answer = await getJSON(`/api/tcp?peer=${encodeURIComponent(addr)}`);
+        row.innerHTML = `<td colspan="10">${tcpDetail(answer)}</td>`;
+      } catch (e) {
+        row.innerHTML = `<td colspan="10"><span class="red">${esc(String(e))}</span></td>`;
+      }
+    }
+  }
+  document.addEventListener('click', e => {
+    const link = e.target.closest('a.tcp-link');
+    if (!link) return;
+    e.preventDefault();
+    const addr = link.dataset.peer;
+    if (state.tcpOpen.has(addr)) {
+      state.tcpOpen.delete(addr);
+      link.classList.remove('open');
+      const tr = link.closest('tr'), next = tr && tr.nextElementSibling;
+      if (next && next.classList.contains('tcp-row')) next.remove();
+    } else {
+      state.tcpOpen.add(addr);
+      link.classList.add('open');
+      renderTcpRows();
+    }
+  });
+
   // The strip: what needs attention, in one line, or that nothing does.
   function renderStrip() {
     const items = [];
@@ -747,18 +826,70 @@ from <select id="lookup-peer"><option value="">any peer</option></select>
     if (!state.received.length) {
       setHTML(b, `<tr><td colspan="12" class="dim">${looking ? 'No route matches.' : 'No routes received from peers.'}</td></tr>`); return;
     }
-    setHTML(b, state.received.map(r => { const s = r.summary; return `<tr class="${r.best ? 'best' : ''}">
+    setHTML(b, state.received.map(r => { const s = r.summary; return `<tr class="${r.best ? 'best' : ''}" data-route="${esc(routeKey(r))}">
       <td class="nowrap">${rankGlyph(r)}${r.stale ? glyph('stale', 'Kept from a session of the peer’s that ended (graceful restart), and not sent again since', 'amber') : ''}</td>
       <td class="mono">${esc(r.prefix)}</td>
       <td class="mono">${r.peer_name ? `<a href="#received" class="peer-link" data-peer="${esc(r.peer_name)}">${esc(r.peer_name)}</a> ` : ''}<span class="dim">${esc(r.peer_addr)} AS${asn(r.peer_asn)}${r.path_id ? ` path ${r.path_id}` : ''}</span></td>
       <td class="mono path">${clamp(asPath(s.as_path))}</td>
       <td class="mono">${s.next_hop ? esc(s.next_hop) : DASH}</td><td>${s.origin ? esc(s.origin) : DASH}</td>
       <td class="num">${s.med ?? DASH}</td><td class="num">${s.local_pref ?? DASH}</td>
-      <td>${clamp(commList(s.communities))}</td><td>${clamp(commList(s.large_communities, true))}</td><td>${otherList(s.other)}</td>
+      <td>${clamp(commList(s.communities))}</td><td>${clamp(commList(s.large_communities, true))}</td><td class="attrs" title="all attributes">${otherList(s.other)}</td>
       <td class="nowrap">${validity('RPKI', r.rpki)} ${validity('ASPA', r.aspa)}</td></tr>`; }).join(''));
     markTall(b);
+    renderRouteDetails();
   }
 
+  // A route, in full, under its row: every attribute by its name, as the
+  // RFCs write it, opened by a click on the attrs cell.
+  const routeKey = r => `${r.prefix}|${r.peer_addr}|${r.path_id}`;
+  const ATTR_NAMES = {
+    'atomic aggregate': 'ATOMIC_AGGREGATE', 'aggregator': 'AGGREGATOR', 'extended communities': 'EXTENDED_COMMUNITIES',
+    'only to customer': 'OTC', 'originator ID': 'ORIGINATOR_ID', 'cluster list': 'CLUSTER_LIST',
+  };
+  function routeDetail(r) {
+    const s = r.summary;
+    const rows = [
+      ['ORIGIN', s.origin ? esc(s.origin) : DASH],
+      ['AS_PATH', s.as_path.length ? s.as_path.map(asn).join(' ') : '<span class="dim">(empty)</span>'],
+      ['NEXT_HOP', s.next_hop ? esc(s.next_hop) : DASH],
+      ['MED', s.med ?? DASH],
+      ['LOCAL_PREF', s.local_pref ?? DASH],
+      ['COMMUNITIES', s.communities.length ? s.communities.map(esc).join(' ') : DASH],
+      ['LARGE_COMMUNITIES', s.large_communities.length ? s.large_communities.map(esc).join(' ') : DASH],
+      ...(s.other || []).map(a => [esc(ATTR_NAMES[a.name] || a.name), esc(a.value) || 'present']),
+    ];
+    if (r.path_id) rows.push(['PATH_ID', `${r.path_id}`]);
+    rows.push(['selection', `${r.best ? 'best' : `rank ${r.rank}`}${r.stale ? ', stale' : ''}`]);
+    rows.push(['rpki', r.rpki ? esc(r.rpki) : DASH], ['aspa', r.aspa ? esc(r.aspa) : DASH]);
+    return `<div class="tcp-grid mono">${rows.map(([k, v]) => `<div>${k}</div><div>${v}</div>`).join('')}</div>`;
+  }
+  function renderRouteDetails() {
+    for (const key of state.routeOpen) {
+      const r = state.received.find(r => routeKey(r) === key);
+      const tr = document.querySelector(`#received-body tr[data-route="${CSS.escape(key)}"]`);
+      if (!r || !tr) continue;
+      const next = tr.nextElementSibling;
+      if (next && next.classList.contains('route-detail')) continue;
+      const row = document.createElement('tr');
+      row.className = 'route-detail';
+      row.innerHTML = `<td colspan="12">${routeDetail(r)}</td>`;
+      tr.after(row);
+    }
+  }
+  document.addEventListener('click', e => {
+    const cell = e.target.closest('#received-body td.attrs');
+    if (!cell || e.target.closest('a')) return;
+    const tr = cell.closest('tr'), key = tr.dataset.route;
+    if (state.routeOpen.has(key)) {
+      state.routeOpen.delete(key);
+      const next = tr.nextElementSibling;
+      if (next && next.classList.contains('route-detail')) next.remove();
+    } else {
+      state.routeOpen.add(key);
+      renderRouteDetails();
+    }
+  });
+
   const RPKI_STATE_CLASS = { synchronised: 'green', synchronising: 'amber', connecting: 'red' };
   function renderRpki() {
     const r = state.rpki, b = $('rpki-body');

docs/content/docs/development/testing.md

@@ -99,6 +99,7 @@ test phases.
 | `hijacks` | FRR advertises a local prefix, a route with BIRD as third-party next hop, and the exchange LAN prefix; all are rejected |
 | `nexthops` | A preferred route from FRR with an unresolvable next hop is held, and the route from BIRD is selected and installed; the selection changes when the next hop becomes resolvable, and reverts when it becomes unresolvable |
 | `transit` | FRR as customer and BIRD as provider: FRR's routes are advertised to BIRD with the local AS prepended; BIRD's routes are advertised to FRR with the OTC attribute; a control community prevents the advertisement of one FRR route to BIRD; traffic is forwarded between their networks |
+| `collector` | FRR as a route collector with ADD-PATH and `all_paths`: BIRD peers twice, FRR receives both of BIRD's routes for a prefix with distinct path identifiers, and one is withdrawn by its identifier when its session is disabled |
 | `v6only` | Exchange LAN without IPv4 addresses: one IPv6 session with each router for both address families; IPv4 routes with IPv6 next hops (RFC 8950) in BGP and in the kernel; IPv4 forwarding verified with `ping` |
 | `linklocal` | Exchange LAN with link-local addresses only, with the same addresses on a second interface: sessions with FRR (by interface, with radvd) and BIRD at `fe80::…%ix0`; both address families in BGP and in the kernel; forwarding verified with `ping`; interface disabled and enabled |
 
@@ -172,11 +173,85 @@ performance: approximately 1 million IPv4 prefixes, mostly /24, and
 in UPDATE messages; AS paths of several hops; and communities on most
 routes.
 
-Table 5 lists results on an Apple M-series computer with a release build.
+Table 5 lists `full_table` results on an Apple M-series computer with a
+release build: 1.23 million prefixes from each of four neighbors, 4.92
+million routes.
 
 | Measurement | Result |
 |---|---|
-| 1.23 million routes from one neighbor, accepted into the routing table | 0.47 seconds |
-| The same routes received by a second neighbor (`transit`) | 2.1 seconds, approximately 4 routes per UPDATE message |
-| 1 million IPv4 routes installed in the kernel (Linux virtual machine) | Slightly more than 1 second |
-| The same routes removed from the kernel | 0.5 seconds |
+| Decoding the UPDATE messages, one thread | 0.43 seconds, 11 million routes per second |
+| Decoding, interning attributes, inserting and selecting, one thread | 1.9 seconds, 2.5 million routes per second |
+| The same, 12 threads | 0.7 seconds, 6.9 million routes per second |
+| Four neighbors send the table over TCP to the in-process server | 0.9 seconds, 5.2 million routes per second |
+| Memory per route, attribute sets included (`--features count-memory`) | 77 bytes |
+
+## Profiling
+
+The `scripts/profile/full-table.sh` script measures the daemon itself, as
+built for production, while one or more neighbors send it a full routing
+table, and records where its CPU time goes. It requires Linux with `perf`,
+`inferno` (`cargo install inferno`), `curl`, `jq`, and `sudo`. On another
+operating system, run it in the Linux virtual machine:
+
+```bash
+scripts/linux-vm.sh scripts/profile/full-table.sh
+```
+
+The script builds the daemon with the `profiling` Cargo profile, which is
+the release profile with line tables, and with frame pointers, so that
+`perf` can attribute samples to functions. It starts the daemon in a
+network namespace of its own, connected by a virtual Ethernet pair to a
+second namespace in which the load generator
+(`crates/bench/examples/feed.rs`) connects as the neighbors and sends the
+synthetic table. Routes that the daemon installs go into the first
+namespace's routing table and do not affect the host. Table 6 lists the
+environment variables that control the run.
+
+| Variable | Effect | Default |
+|---|---|---|
+| `PEERS` | The number of neighbors that send the table | 1 |
+| `KERNEL` | `1` installs the best routes in the kernel; `0` keeps them in the routing table only | 1 |
+| `SCALE_DOWN` | Divides the size of the table | 1 |
+| `HOLD_SECS` | How long the sessions stay open after the table is sent | 30 |
+| `FREQ` | The sampling frequency in hertz | 1999 |
+| `OUT` | The directory for the results | `~/profile` |
+| `JEMALLOC_CONF` | jemalloc options for the daemon (its `MALLOC_CONF`), for example `thp:always` | none |
+
+When run through `scripts/linux-vm.sh`, pass the variables with `env`,
+because the virtual machine does not receive the host's environment:
+
+```bash
+scripts/linux-vm.sh env PEERS=4 KERNEL=0 scripts/profile/full-table.sh
+```
+
+The script prints how long the routes take to arrive in the routing table
+and in the kernel, and the daemon's resident memory. It writes the
+following files to the results directory:
+
+| File | Contents |
+|---|---|
+| `flame.svg` | An interactive flame graph of the daemon's threads |
+| `top-self.txt` | Functions by the time spent in their own code |
+| `top-children.txt` | Functions by the time spent in them and everything they call |
+| `stacks.folded` | The collapsed stacks the flame graph is drawn from |
+| `perf.data`, `daemon.log`, `feed.log` | The raw samples and the logs |
+
+Table 7 lists results in the Linux virtual machine (8 virtual CPUs on an
+Apple M-series computer) with the synthetic table of 1.23 million
+prefixes.
+
+| Measurement | Result |
+|---|---|
+| One neighbor; routes in the routing table | 0.8 seconds, 1.5 million routes per second |
+| One neighbor; the best routes installed in the kernel | 2.0 seconds after the first route |
+| One neighbor, without the kernel; routes in the routing table | 0.6 seconds, 2.0 million routes per second |
+| Four neighbors; 4.92 million routes in the routing table | 1.1 seconds, 4.4 million routes per second |
+| Four neighbors; the best routes installed in the kernel | 2.2 seconds after the first route |
+| Four neighbors; routes the kernel was asked to install | 1.25 million, for 1.23 million prefixes |
+| Resident memory with one neighbor's table installed | 440 MB |
+| Resident memory with four neighbors' tables installed | 630 MB |
+
+A session is processed on one thread, so one neighbor's table arrives at
+the rate of one CPU core, and several neighbors' tables arrive in
+parallel. Installing routes in the kernel takes longer than receiving
+them, and continues after the last route has arrived.

docs/content/docs/guides/passing-routes-on.md

@@ -398,12 +398,48 @@ Ferrix advertised (`announced`) and withdrew (`withdrawn`). Ferrix does not
 provide a view of the routes advertised to a neighbor (Adj-RIB-Out); to
 display them, use the neighbor's own tools.
 
+## Feeding a Route Collector
+
+A route collector, such as a looking glass or a measurement project, wants
+every route that a router has accepted, not only the best path for each
+prefix. ADD-PATH (RFC 7911) lets one session carry several routes for a
+prefix, each with a path identifier. To advertise every accepted route to
+a neighbor, configure ADD-PATH in the sending direction and enable
+`all_paths` in the neighbor's export policy:
+
+```textproto
+peers {
+  name: "collector"
+  endpoint { address: "203.0.113.10" }
+  remote_asn: 64496
+  role: PEER
+  add_path: ADD_PATH_SEND
+  export {
+    learned_routes: true
+    all_paths: true
+  }
+  export_limits {}
+}
+```
+
+Ferrix advertises every route for a prefix only for the address families
+for which the neighbor negotiated ADD-PATH receive. For other families it
+advertises the best path, as without `all_paths`. Each route is advertised
+with a path identifier that stays with the route for as long as it is
+advertised; a route that is withdrawn is withdrawn by its identifier, and
+a route whose attributes change is advertised again with the same
+identifier. The export policy, the BGP role rules, the well-known
+communities and the export limits apply to every route alike, and
+`max_prefixes` in `export_limits` counts every route advertised.
+
+A session with `all_paths` keeps a record of every route advertised and
+its identifier, which takes about 50 bytes for each route. For a full
+Internet table from several neighbors, this is some tens of megabytes.
+
 ## Limitations
 
 - Per-client best path selection for route servers is not supported. Every
   client receives the same best path.
-- ADD-PATH is not supported for advertisement; only the best path is
-  advertised.
 - Best path selection does not use ORIGINATOR_ID and CLUSTER_LIST as tie
   breakers (RFC 4456 Section 9).
 - UPDATE messages are generated separately for each session, even when

docs/content/docs/guides/peers.md

@@ -193,8 +193,11 @@ add_path: ADD_PATH_RECEIVE
 ```
 
 ADD-PATH is enabled for each address family and direction only if the
-neighbor also supports it. Ferrix negotiates `ADD_PATH_SEND` and
-`ADD_PATH_BOTH`, but it advertises only one path for each prefix.
+neighbor also supports it. With `ADD_PATH_SEND` or `ADD_PATH_BOTH`,
+Ferrix advertises routes with path identifiers. By default it still
+advertises one path for each prefix; to advertise every accepted route
+for a prefix, enable `all_paths` in the neighbor's export policy. See
+[Feeding a Route Collector](@/docs/guides/passing-routes-on.md#feeding-a-route-collector).
 
 ## Hold Timer
 
@@ -259,8 +262,11 @@ with this value. An established session with fewer than half the expected
 routes is listed under **Needing attention**, with the expected number
 beside the actual one. The comparison starts one minute after the session
 is established, so that a neighbor that is still sending its table is not
-reported. The value does not affect route processing; `max_prefixes` is
-the limit that Ferrix enforces.
+reported. The value does not affect which routes are accepted;
+`max_prefixes` is the limit that Ferrix enforces. Ferrix also sizes the
+routing table at startup for the largest `expected_routes` value among
+the neighbors, so that the table does not grow while the tables are
+received.
 
 ## Verifying BGP Sessions
 

docs/content/docs/operations/monitoring.md

@@ -37,8 +37,15 @@ Below the status line, the page displays the following information:
 
 - The configuration that was read at startup.
 - Each neighbor, with its session state, time established, next hop,
-  session properties, number of accepted routes, rejected announcements,
-  and held routes, and its last error. Neighbors that need attention are
+  session properties, number of accepted routes, number of routes
+  advertised to it (**sent**), rejected announcements, and held routes,
+  and its last error. The **tcp** link on an established session expands
+  a row with the connection as the kernel reports it: round-trip time,
+  congestion window, the neighbor's receive window and Ferrix's, queues,
+  retransmissions, throughput, and the share of time the connection was
+  held up by the neighbor's window or by the local send buffer. This
+  shows whether a slow advertisement of a table is paced by the neighbor.
+  Linux only. Neighbors that need attention are
   listed first; the others are grouped by role. The IPv4 and IPv6 sessions
   of one neighbor, named `NAME-v4` and `NAME-v6`, are listed together,
   IPv6 first, and joined by a bar. The **problems only** option hides the neighbors that
@@ -152,6 +159,12 @@ advertise the same routes can therefore have different counts. The number
 of routes currently held, because they are RPKI or ASPA invalid or their
 next hop is unreachable, is displayed in the neighbor table as **held**.
 
+In the received routes table, the **attrs** column shows the attributes
+that have no column of their own as badges. Clicking the cell expands a
+row below the route that lists every attribute of the route by its name,
+with the path identifier, the selection rank, and the RPKI and ASPA
+states.
+
 ```json
 [{"peer":"transit-a","total":3,"by_reason":{"RPKI invalid":2,"bogon prefix":1},
   "recent":[{"prefix":"203.0.113.0/24","reason":"RPKI invalid","as_path":[64496,64511]}]}]
@@ -238,6 +251,10 @@ Table 3 lists queries for a monitoring dashboard.
 |---|---|
 | Established sessions | `sum(bgp_peer_up)`, of `count(bgp_peer_up)` |
 | Routes by neighbor | `bgp_peer_routes` |
+| Routes advertised to each neighbor | `bgp_peer_advertised_routes` |
+| Share of time a session is held up by the neighbor's receive window | `rate(bgp_peer_tcp_receive_window_limited_seconds[5m]) / rate(bgp_peer_tcp_busy_seconds[5m])` |
+| Round-trip time to each neighbor | `bgp_peer_tcp_rtt_seconds` |
+| Octets queued towards a neighbor | `bgp_peer_tcp_send_queue_bytes` |
 | Prefixes with a best path | `bgp_rib_prefixes` |
 | Rejected routes by reason | `sum by (reason) (rate(bgp_routes_rejected_total[5m]))` |
 | UPDATE messages received and sent | `rate(bgp_messages_received_total{type="update"}[5m])`, `rate(bgp_messages_sent_total{type="update"}[5m])` |

docs/content/docs/reference/configuration.md

@@ -77,7 +77,7 @@ Statements for a BGP neighbor.
 | `role` <span class="type">[Role](#role)</span> | None | Specifies the BGP role of the neighbor (RFC 9234). Not permitted for IBGP neighbors. Required for every EBGP neighbor if any `export` statement enables `learned_routes`. |
 | `require_role` <span class="type">bool</span> | `false` | Rejects the session if the neighbor does not advertise a BGP role. Requires `role`. |
 | `passive` <span class="type">bool</span> | `false` | Prevents Ferrix from initiating connections to the neighbor. Ferrix accepts connections from the address of `endpoint`; the port of `endpoint` is not used. See [Passive Neighbors](@/docs/guides/peers.md#passive-neighbors). |
-| `expected_routes` <span class="type">uint32</span> | 0 | Specifies the approximate number of routes that the neighbor advertises in normal operation. The status page marks an established session with fewer than half this number of routes as needing attention. The value does not affect route processing. 0 disables the comparison. See [Expected Route Counts](@/docs/guides/peers.md#expected-route-counts). |
+| `expected_routes` <span class="type">uint32</span> | 0 | Specifies the approximate number of routes that the neighbor advertises in normal operation. The status page marks an established session with fewer than half this number of routes as needing attention. Ferrix also allocates the routing table with room for the largest `expected_routes` value among the neighbors at startup, which avoids the table growing, and briefly using twice its memory, while the tables are received. The value does not affect which routes are accepted. 0 disables the comparison. See [Expected Route Counts](@/docs/guides/peers.md#expected-route-counts). |
 | `export` <span class="type">[ExportPolicy](#exportpolicy)</span> | Top-level `export` | Specifies the export policy for the neighbor. Replaces the top-level `export` statement. |
 | `graceful_restart` <span class="type">[GracefulRestart](#gracefulrestart)</span> | Top-level `graceful_restart` | Specifies graceful restart for the neighbor. Each statement that is set replaces the corresponding top-level statement. |
 | `route_reflector_client` <span class="type">bool</span> | `false` | Makes the IBGP neighbor a route reflector client: Ferrix advertises to it the routes learned from other IBGP neighbors, and advertises its routes to them. Permitted only for IBGP neighbors. See [Route Reflection](@/docs/guides/passing-routes-on.md#route-reflection). |
@@ -154,6 +154,7 @@ Statements that determine which routes are advertised to a neighbor. See
 | Statement | Default | Description |
 |---|---|---|
 | `learned_routes` <span class="type">bool</span> | `false` | Enables the advertisement of learned routes, subject to BGP roles and communities. |
+| `all_paths` <span class="type">bool</span> | `false` | Advertises every accepted route for a prefix, not only the best path, each with a path identifier (ADD-PATH, RFC 7911). Requires `learned_routes`, and takes effect for an address family only if the neighbor negotiated ADD-PATH receive for it; otherwise the best path is advertised. Export policy and export limits apply to every route. See [Feeding a Route Collector](@/docs/guides/passing-routes-on.md#feeding-a-route-collector). |
 | `add_communities` <span class="type">string, repeated</span> | None | Specifies standard communities added to advertised routes. |
 | `add_large_communities` <span class="type">string, repeated</span> | None | Specifies large communities added to advertised routes. |
 | `remove_communities` <span class="type">string, repeated</span> | None | Specifies patterns of communities removed from advertised routes. Applied before communities are added. |

docs/content/docs/reference/http-api.md

@@ -37,6 +37,7 @@ server returns the following error statuses:
 | `/api/routes/rejected` | Rejected routes, by neighbor. |
 | `/api/rpki` | RPKI cache, data, and data age. |
 | `/api/kernel` | Kernel route installation state and interfaces. |
+| `/api/tcp` | The TCP connection of one session, as the kernel reports it. |
 | `/api/events` | Session and route changes, as server-sent events. |
 | `/metricz` | Prometheus metrics. See [Metrics Reference](@/docs/reference/metrics.md). |
 
@@ -61,6 +62,7 @@ neighbor:
   "add_path_send": [],
   "routes": 1,
   "rejected_routes": 1,
+  "advertised_routes": 2,
   "held_routes": 0,
   "expected_routes": null,
   "role": null,
@@ -84,6 +86,7 @@ neighbor:
 | `direction` | `inbound` if the neighbor initiated the connection, `outbound` otherwise. |
 | `routes` | Number of the neighbor's routes in the routing table. |
 | `rejected_routes` | Number of the neighbor's routes rejected by its import policy. |
+| `advertised_routes` | Number of routes advertised to the neighbor and not withdrawn since. With ADD-PATH and `all_paths`, every route advertised counts. |
 | `held_routes` | Number of held routes: routes rejected for a reason that can change without a new UPDATE, such as RPKI validity or next hop resolution. |
 | `expected_routes` | The `expected_routes` value from the configuration, or `null` if it is not set. |
 | `role_confirmed` | Whether the neighbor advertised a BGP role that matches the configured role. |
@@ -228,6 +231,74 @@ routes. To return the records for one neighbor, add `?peer=NAME`.
 | `refused` | Number of prefixes whose active route the kernel rejected. |
 | `errors` | Number of requests that the kernel rejected. |
 
+## TCP Connection
+
+`/api/tcp?peer=ADDRESS` returns what the kernel reports about the TCP
+connection of the session with the neighbor at `ADDRESS`, given as
+`peer_addr` in `/api/peers` shows it: the round-trip time, the congestion
+and receive windows, the queues, the retransmissions, and how long the
+connection has been held up by the neighbor's receive window or by the
+local send buffer. Linux only; on other systems, and for a session the
+kernel has no connection for, `available` is `false` and `reason` says
+why.
+
+```json
+{
+  "available": true,
+  "reason": null,
+  "connection": {
+    "state": "established",
+    "congestion": "cubic",
+    "rtt_ms": 0.62,
+    "rtt_variance_ms": 0.11,
+    "min_rtt_ms": 0.4,
+    "rto_ms": 201,
+    "mss": 1428,
+    "pmtu": 1500,
+    "cwnd_segments": 10,
+    "ssthresh_segments": null,
+    "send_window": 1048576,
+    "receive_window": 3145728,
+    "receive_space": 65536,
+    "send_window_scale": 7,
+    "receive_window_scale": 10,
+    "send_queue": 0,
+    "not_sent": 0,
+    "recv_queue": 0,
+    "unacked_segments": 0,
+    "retrans_segments": 0,
+    "lost_segments": 0,
+    "total_retrans": 0,
+    "bytes_retrans": 0,
+    "pacing_rate": 2309920000,
+    "delivery_rate": 184860000,
+    "bytes_sent": 312993,
+    "bytes_acked": 312994,
+    "bytes_received": 190,
+    "segments_out": 230,
+    "segments_in": 118,
+    "busy_ms": 41,
+    "limited_by_receive_window_ms": 0,
+    "limited_by_send_buffer_ms": 0,
+    "limited_by_receive_window_share": 0,
+    "limited_by_send_buffer_share": 0,
+    "last_data_sent_ms": 1234,
+    "last_data_received_ms": 1300,
+    "last_ack_received_ms": 1234
+  }
+}
+```
+
+Times are in milliseconds, sizes in octets, rates in octets per second.
+`send_window` is the neighbor's receive window, which bounds what Ferrix
+can send; `receive_window` is what Ferrix lets the neighbor send. The two
+`_share` values are the fractions of the busy time, 0 to 1, in which the
+connection was held up by the neighbor's window and by the local send
+buffer. A session that advertises a table to a neighbor that reads it
+slowly shows a high `limited_by_receive_window_share`. The status page
+shows the same information under the **tcp** link of each established
+session.
+
 ## Events
 
 `/api/events` is a stream of

docs/content/docs/reference/metrics.md

@@ -29,6 +29,20 @@ alerting rules based on these metrics, see
 | Metric | Type | Description |
 |---|---|---|
 | `bgp_peer_routes{peer}` | Gauge | Number of the neighbor's routes in the routing table. |
+| `bgp_peer_advertised_routes{peer}` | Gauge | Number of routes advertised to the neighbor and not withdrawn since. |
+| `bgp_peer_tcp_rtt_seconds{peer}` | Gauge | Smoothed round-trip time of the session's TCP connection. Also `bgp_peer_tcp_min_rtt_seconds` and `bgp_peer_tcp_rtt_variance_seconds`. Linux only; sampled from the kernel at each scrape, as are all `bgp_peer_tcp_*` metrics. |
+| `bgp_peer_tcp_cwnd_segments{peer}` | Gauge | Congestion window, in segments. `bgp_peer_tcp_mss_bytes` is the segment size. |
+| `bgp_peer_tcp_send_window_bytes{peer}` | Gauge | The neighbor's receive window: what it lets Ferrix send. Zero while the neighbor is not reading. |
+| `bgp_peer_tcp_receive_window_bytes{peer}` | Gauge | Ferrix's receive window: what it lets the neighbor send. |
+| `bgp_peer_tcp_send_queue_bytes{peer}` | Gauge | Octets written and not yet acknowledged by the neighbor; `bgp_peer_tcp_not_sent_bytes` is the part not yet sent. |
+| `bgp_peer_tcp_receive_queue_bytes{peer}` | Gauge | Octets received and not yet read. |
+| `bgp_peer_tcp_unacked_segments{peer}` | Gauge | Segments in flight. |
+| `bgp_peer_tcp_retransmitted_segments{peer}` | Gauge | Segments retransmitted over the connection's life. `bgp_peer_tcp_lost_segments` are those thought lost now. |
+| `bgp_peer_tcp_busy_seconds{peer}` | Gauge | Time the connection had data to send, over its life. |
+| `bgp_peer_tcp_receive_window_limited_seconds{peer}` | Gauge | Of the busy time, time the connection was held up by the neighbor's receive window. |
+| `bgp_peer_tcp_send_buffer_limited_seconds{peer}` | Gauge | Of the busy time, time the connection was held up by the local send buffer being full. |
+| `bgp_peer_tcp_sent_bytes{peer}` | Gauge | Octets sent over the connection's life. `bgp_peer_tcp_received_bytes` likewise. |
+| `bgp_peer_tcp_delivery_rate_bytes_per_second{peer}` | Gauge | Delivery rate the kernel measured most recently; `bgp_peer_tcp_pacing_rate_bytes_per_second` is the rate it paces the connection at. |
 | `bgp_peer_max_prefixes{peer}` | Gauge | Prefix limit of the neighbor (`import.max_prefixes`), if configured. |
 | `bgp_prefix_limit_exceeded_total{peer}` | Counter | Number of sessions torn down because the neighbor exceeded its prefix limit. |
 | `bgp_export_limit_exceeded_total{peer}` | Counter | Number of sessions torn down because the routes to be advertised to the neighbor exceeded its export limit (`export_limits.max_prefixes`). |

docs/content/docs/reference/rfcs.md

@@ -306,7 +306,7 @@ Version 2 is implemented from version 23 of the draft.
 |---------|--------|
 | Capability negotiation per family and direction | ✅ |
 | Receiving several routes for a prefix | ✅ |
-| Sending several routes for a prefix | ❌ (path identifiers are sent; one route each) |
+| Sending several routes for a prefix | ✅ with `all_paths` in the export policy; the best path only otherwise |
 
 ### RFC 4271 §9.1.2 / RFC 4486 / operational practice — import policy
 

scripts/interop/lab.sh

@@ -29,7 +29,7 @@ cd "$(dirname "$0")/../.."
 bgp="${CARGO_TARGET_DIR:-target}/release/bgp"
 work=/tmp/ferrix-lab
 pathspace=ferrixlab
-all_phases="basics roles rpki refresh flaps restart graceful scale limits hijacks nexthops transit leaks v6only linklocal"
+all_phases="basics roles rpki refresh flaps restart graceful scale limits hijacks nexthops transit collector leaks v6only linklocal"
 phases="${PHASES:-$all_phases}"
 scale_routes="${SCALE_ROUTES:-200000}"
 
@@ -319,9 +319,9 @@ frr_down() {
 
 # --- BIRD -----------------------------------------------------------------------
 
-# bird_config [extra-static-routes-file]
+# bird_config [extra-static-routes-file] [more-configuration]
 bird_config() {
-    local extra=${1:-}
+    local extra=${1:-} more=${2:-}
     cat > "$work/bird.conf" <<END
 log "$work/bird.log" all;
 router id 10.9.0.3;
@@ -355,6 +355,7 @@ protocol bgp dut6 from dut {
   source address 2001:db8:9::3;
   ipv6 { import all; export where source = RTS_STATIC; };
 }
+$more
 END
 }
 
@@ -488,6 +489,13 @@ phase_basics() {
     in_ns dut ping -q -c 2 -W 2 -I 2001:db8:1::1 2001:db8:2::1 >/dev/null || fail "no IPv6 ping to FRR's lan"
     in_ns dut ping -q -c 2 -W 2 -I 2001:db8:1::1 2001:db8:3::1 >/dev/null || fail "no IPv6 ping to BIRD's lan"
     ok "packets get through to both, over IPv4 and IPv6"
+
+    # The kernel's view of a session's connection, as the page asks for it.
+    frr4_addr=$(api /api/peers | jq -r '.[] | select(.name == "frr4") | .peer_addr')
+    api "/api/tcp?peer=$frr4_addr" | jq -e '.available and .connection.state == "established" and .connection.mss > 0' >/dev/null \
+        || fail "no TCP details for frr4: $(api "/api/tcp?peer=$frr4_addr")"
+    api /metricz | grep -q "^bgp_peer_tcp_rtt_seconds{peer=\"frr4\"}" || fail "no TCP metrics for frr4"
+    ok "the kernel tells of a session's TCP connection"
 }
 
 # RFC 9234: each end says what it is to the other, and routes are marked
@@ -959,6 +967,55 @@ control_communities: true'
     ok "back to normal"
 }
 
+# FRR is a route collector of ours, told every route with its path
+# identifier (ADD-PATH). BIRD talks to us from a second address too, so
+# that there are two routes for each of its prefixes; FRR is told both,
+# and holds them apart. One of BIRD's sessions goes, and so does one of
+# the two.
+phase_collector() {
+    dut_down TERM
+    in_ns bird ip addr add 10.9.0.4/24 dev ix0
+    dut_config CUSTOMER 2000000 "" 'add_path: ADD_PATH_SEND
+  export { learned_routes: true all_paths: true }' "" 'peers {
+  name: "bird4b" endpoint { address: "10.9.0.4" } remote_asn: 4200000003
+  address_families: IPV4_UNICAST
+  role: PROVIDER
+  import { accept_bogons: true max_prefixes: 2000000 }
+}'
+    bird_config "" 'protocol bgp dut4b from dut {
+  neighbor 10.9.0.1 as 64601;
+  source address 10.9.0.4;
+  ipv4 { import all; export where source = RTS_STATIC; };
+}'
+    bird_ctl configure >/dev/null
+    frr_configure "router bgp 64602" "neighbor 10.9.0.1 local-role customer"
+    dut_up
+    wait_for "five sessions" established 5
+    wait_for "BIRD's route from both its sessions" bash -c "sudo ip netns exec lab-dut curl -sf 'http://127.0.0.1:8080/api/routes/received?prefix=10.3.0.0/24' | jq -e '.routes | length == 2'"
+    peer_is frr4 '.add_path_send | index("IPv4 unicast") != null' >/dev/null \
+        || fail "ADD-PATH was not agreed with FRR: $(peer_is frr4 .add_path_send)"
+    wait_for "both routes at FRR, told apart" bash -c "sudo ip netns exec lab-frr vtysh -N $pathspace -c 'show bgp ipv4 unicast 10.3.0.0/24 json' 2>/dev/null | jq -e '.paths | length == 2 and all(.aspath.string == \"64601 4200000003\")'"
+    # Its two prefixes twice, and our own route: what the page and the
+    # metrics say it holds from us.
+    wait_for "the count of routes the collector holds" peer_is frr4 '.advertised_routes == 5'
+    ok "the collector is told both of BIRD's routes for a prefix, with path identifiers"
+
+    bird_ctl disable dut4b >/dev/null
+    wait_for "one route left at FRR" bash -c "sudo ip netns exec lab-frr vtysh -N $pathspace -c 'show bgp ipv4 unicast 10.3.0.0/24 json' 2>/dev/null | jq -e '.paths | length == 1'"
+    wait_for "the count of routes the collector holds" peer_is frr4 '.advertised_routes == 3'
+    ok "a route that goes is withdrawn from the collector by its identifier, the other stays"
+
+    frr_configure "router bgp 64602" "neighbor 10.9.0.1 local-role peer"
+    bird_config
+    bird_ctl configure >/dev/null
+    in_ns bird ip addr del 10.9.0.4/24 dev ix0
+    dut_down TERM
+    dut_config
+    dut_up
+    converged
+    ok "back to normal"
+}
+
 # A customer leaks, and the export limits hold. FRR, now our customer,
 # announces a route outside its address space and then more routes than
 # BIRD, our provider, is to be told of. A customer's routes go to

scripts/profile/full-table.sh

@@ -0,0 +1,171 @@
+#!/bin/bash
+# Profiles the daemon as it takes in a full Internet routing table, on a
+# Linux machine: a flame graph and a flat profile of where the CPU time
+# goes, and how long the table takes to arrive and to reach the kernel.
+#
+#   scripts/profile/full-table.sh                 one peer sends the table
+#   PEERS=4 scripts/profile/full-table.sh         four peers send it at once
+#   KERNEL=0 scripts/profile/full-table.sh        the routes stay in the table
+#   SCALE_DOWN=10 scripts/profile/full-table.sh   a tenth of the table
+#
+# From a machine that is not Linux: scripts/linux-vm.sh scripts/profile/full-table.sh
+#
+# The daemon runs in a network namespace of its own, so that nothing it
+# installs touches the machine's own routing, joined by a veth pair to a
+# second namespace where the load generator (crates/bench/examples/feed.rs)
+# plays the peers: neighbours on the link, as real peers would be. `perf`
+# samples the daemon's threads meanwhile. Needs perf, inferno (cargo
+# install inferno), curl and jq, and sudo for the namespaces and the
+# kernel's routing table.
+#
+# Results go to $OUT (default ~/profile): flame.svg, top-self.txt (functions
+# by their own time), top-children.txt (by the time of everything they
+# call), perf.data, and the daemon's and the load generator's logs.
+set -eu
+
+peers=${PEERS:-1}
+scale=${SCALE_DOWN:-1}
+kernel=${KERNEL:-1}
+hold=${HOLD_SECS:-30}
+freq=${FREQ:-1999}
+out=${OUT:-$HOME/profile}
+ns=ferrix-profile
+ns_peer=ferrix-profile-peer
+
+repository="$(cd "$(dirname "$0")/../.." && pwd)"
+target="${CARGO_TARGET_DIR:-$repository/target}"
+daemon_bin="$target/profiling/bgp"
+feed_bin="$target/profiling/examples/feed"
+
+fail() { echo "error: $*" >&2; exit 1; }
+for tool in perf inferno-collapse-perf inferno-flamegraph curl jq; do
+    command -v "$tool" >/dev/null || fail "$tool not found"
+done
+
+# Release code with line tables, and frame pointers for perf to walk the
+# stacks by (cheaper and more complete than DWARF unwinding here; the
+# allocator is built with them too).
+cd "$repository"
+export RUSTFLAGS="-C force-frame-pointers=yes" CFLAGS="-fno-omit-frame-pointer"
+cargo build --profile profiling --locked -p bgp --bin bgp
+cargo build --profile profiling --locked -p bgp-bench --example feed
+
+mkdir -p "$out"
+run() { sudo ip netns exec "$ns" "$@"; }
+peer() { sudo ip netns exec "$ns_peer" "$@"; }
+cleanup() {
+    sudo pkill -x bgp 2>/dev/null || true
+    sudo pkill -x feed 2>/dev/null || true
+    sudo ip netns del "$ns" 2>/dev/null || true
+    sudo ip netns del "$ns_peer" 2>/dev/null || true
+}
+trap cleanup EXIT
+cleanup
+sudo ip netns add "$ns"
+sudo ip netns add "$ns_peer"
+sudo ip link add bench0 netns "$ns" type veth peer name peer0 netns "$ns_peer"
+run ip link set lo up
+run ip addr add 192.0.2.254/24 dev bench0
+run ip -6 addr add 2001:db8::ffff/64 dev bench0
+run ip link set bench0 up
+peer ip link set lo up
+for n in $(seq "$peers"); do
+    peer ip addr add "192.0.2.$n/24" dev peer0
+    peer ip -6 addr add "2001:db8::$n/64" dev peer0
+done
+peer ip link set peer0 up
+peer ping -c 1 -W 2 192.0.2.254 > /dev/null || fail "the namespaces do not reach each other"
+
+# An AS number that is in none of the synthetic paths: a route with the
+# daemon's own AS in its path is refused as a loop.
+prefixes=$(( 1000000 / scale + 230000 / scale ))
+routes=$(( prefixes * peers ))
+cat > "$out/daemon.textpb" <<CONFIG
+router_id: "192.0.2.254"
+local_asn: 4200000000
+listen_endpoints { address: "192.0.2.254" port: 1790 }
+http_endpoint { address: "127.0.0.1" port: 8080 }
+CONFIG
+# The peers are configured as a router's would be, with how many routes
+# to expect of each. They have private AS numbers and the synthetic table
+# has a few bogon prefixes, so bogons are taken.
+for n in $(seq "$peers"); do
+    cat >> "$out/daemon.textpb" <<CONFIG
+peers {
+  name: "peer$n"
+  endpoint { address: "192.0.2.$n" port: 179 }
+  remote_asn: $(( 64512 + n ))
+  expected_routes: $prefixes
+  import { accept_bogons: true }
+}
+CONFIG
+done
+if [ "$kernel" = 1 ]; then
+    echo 'kernel { stale_seconds: 0 }' >> "$out/daemon.textpb"
+fi
+
+# `JEMALLOC_CONF`, if set, is jemalloc's MALLOC_CONF for the daemon:
+# "thp:always", say. The symbols are prefixed, hence the variable's name.
+run env _RJEM_MALLOC_CONF="${JEMALLOC_CONF:-}" "$daemon_bin" "$out/daemon.textpb" --level warn > "$out/daemon.log" 2>&1 &
+for _ in $(seq 100); do
+    run curl -sf http://127.0.0.1:8080/api/status > /dev/null 2>&1 && break
+    sleep 0.1
+done
+daemon_pid=$(pgrep -nx bgp) || fail "the daemon did not start; see $out/daemon.log"
+status() { run curl -sf "http://127.0.0.1:8080/api/$1" | jq -r "$2"; }
+now() { date +%s.%N; }
+since() { echo "$(now) - $1" | bc; }
+
+sudo perf record -F "$freq" -g -o "$out/perf.data" -p "$daemon_pid" > "$out/perf.log" 2>&1 &
+perf_pid=$!
+sleep 1
+
+peer env FEED_TO=192.0.2.254:1790 FEED_PEERS="$peers" FEED_SCALE_DOWN="$scale" \
+    FEED_FROM=192.0.2 FEED_HOLD_SECS="$hold" "$feed_bin" > "$out/feed.log" 2>&1 &
+feed_pid=$!
+feeding() { kill -0 "$feed_pid" 2>/dev/null || fail "the load generator stopped; see $out/feed.log"; }
+
+# The clock starts at the first route in, not when the load generator
+# starts: making the table takes it a while.
+while [ "$(status status .received_routes)" = 0 ]; do feeding; sleep 0.02; done
+start=$(now)
+# Routes the policy refuses (the synthetic table has a few bogons in it)
+# count as dealt with.
+dealt_with() {
+    status status .received_routes
+    status peers '[.[] | .rejected_routes // 0] | add // 0'
+}
+while [ "$(dealt_with | paste -sd+ | bc)" -lt "$routes" ]; do feeding; sleep 0.05; done
+arrived=$(since "$start")
+received=$(status status .received_routes)
+refused=$(status peers '[.[] | .rejected_routes // 0] | add // 0')
+echo "$routes routes dealt with after $arrived s ($(echo "$routes / $arrived / 1000000" | bc -l | cut -c1-4) M routes/s): $received taken, $refused refused"
+[ "$refused" = 0 ] || run curl -sf http://127.0.0.1:8080/api/rejections | jq -c '.' | cut -c1-400
+if [ "$kernel" = 1 ]; then
+    prefixes=$(status status .received_prefixes)
+    while [ "$(status kernel '.synced and .installed >= '"$prefixes")" != true ]; do feeding; sleep 0.05; done
+    installed=$(since "$start")
+    echo "$prefixes routes in the kernel after $installed s ($(echo "$prefixes / $installed / 1000" | bc -l | cut -c1-3) k routes/s)"
+fi
+rss=$(awk '/VmRSS/ { printf "%.0f", $2 / 1024 }' "/proc/$daemon_pid/status")
+echo "daemon: $rss MiB resident with the table in"
+run curl -sf http://127.0.0.1:8080/metricz | grep '^bgp_kernel_route_changes_total' | sed 's/^/kernel: /'
+sleep 1
+sudo kill -INT "$perf_pid"
+wait "$perf_pid" || true
+cat "$out/feed.log"
+
+sudo chown "$(id -u)" "$out/perf.data"
+# Without the period field, so that each sample counts one whatever event
+# perf sampled by (cpu-clock on a machine without performance counters).
+perf script -i "$out/perf.data" -F comm,pid,tid,time,event,ip,sym,dso 2> /dev/null \
+    | inferno-collapse-perf > "$out/stacks.folded"
+title="ferrix: $peers peer(s) send $prefixes prefixes each"
+[ "$kernel" = 1 ] && title="$title, into the kernel"
+inferno-flamegraph --title "$title" --countname samples --width 1600 "$out/stacks.folded" > "$out/flame.svg"
+perf report -i "$out/perf.data" --no-children --stdio --sort symbol --percent-limit 0.5 -g none 2> /dev/null \
+    | grep -v '^#' | grep -v '^$' | sed 's/  *$//' | head -80 > "$out/top-self.txt"
+perf report -i "$out/perf.data" --children --stdio --sort symbol --percent-limit 1 -g none 2> /dev/null \
+    | grep -v '^#' | grep -v '^$' | sed 's/  *$//' | head -80 > "$out/top-children.txt"
+echo "samples: $(awk '{ s += $NF } END { print s }' "$out/stacks.folded")"
+echo "results in $out: flame.svg top-self.txt top-children.txt"