Good Network Updates for Bad Packets Arne Ludwig, Matthias Rost, - - PowerPoint PPT Presentation

▶

good network updates for bad packets

Good Network Updates for Bad Packets Arne Ludwig, Matthias Rost, - - PowerPoint PPT Presentation

Mar 16, 2023 227 likes •709 views

Good Network Updates for Bad Packets Arne Ludwig, Matthias Rost, Damien Foucard, Stefan Schmid 1 Updates happen Network updates happen Changing security policies Network updates are challenging Even with global view Potential

slide-1

SLIDE 1

1

Good Network Updates for Bad Packets

Arne Ludwig, Matthias Rost, Damien Foucard, Stefan Schmid

slide-2

SLIDE 2

2

Updates happen

Network updates happen

– Changing security policies

Network updates are challenging

– Even with global view

Potential high damage if fail

– Security policy violation

slide-3

SLIDE 3

3

Example

slide-4

SLIDE 4

4

Example

slide-5

SLIDE 5

5

Example

Waypoint Enforcement (WPE)

slide-6

SLIDE 6

6

Example

Eventual consistency

slide-7

SLIDE 7

7

Example

✔ Eventual consistency ➢ Transient consistency?

Bad packet

slide-8

SLIDE 8

8

Example

✔ Eventual consistency ➢ Transient consistency?

slide-9

SLIDE 9

9

Example

✔ Eventual consistency ➢ Transient consistency?

slide-10

SLIDE 10

10

Example

✔ Eventual consistency ➢ Transient consistency?

slide-11

SLIDE 11

11

Example

✔ Eventual consistency ➢ Transient consistency?

slide-12

SLIDE 12

12

Example

✔ Eventual consistency ✗ Transient consistency

slide-13

SLIDE 13

13

Outline

What could possibly go wrong?
It's not a trivial thing!
But we present an optimal solution.

slide-14

SLIDE 14

14

Model and a Trivial Compression

Solid lines = current path

slide-15

SLIDE 15

15

Model and a Trivial Compression

Solid lines = current path Dashed lines = new path Flow-specific path

slide-16

SLIDE 16

16

Model and a Trivial Compression

Solid lines = current path Dashed lines = new path Flow-specific path

slide-17

SLIDE 17

17

Model and a Trivial Compression

Solid lines = current path Dashed lines = new path Flow-specific path Safe to be updated Safe to be left untouched

slide-18

SLIDE 18

18

Consistency Properties

WPE = every packet traverses the waypoint at

least once

LF = loop freedom

slide-19

SLIDE 19

19

Update all “simultaneously“?

slide-20

SLIDE 20

20

Update all “simultaneously“?

Not possible in practice! What could possibly go wrong?

slide-21

SLIDE 21

21

Update all “simultaneously“?

Not possible in practice! What could possibly go wrong? Update times can vary significantly (up to 10x higher than median [Dionysus – SIGCOMM'14])

slide-22

SLIDE 22

22

Update all “simultaneously“?

slide-23

SLIDE 23

23

Update all “simultaneously“?

Not waypoint enforced!

slide-24

SLIDE 24

24

Delay ?

slide-25

SLIDE 25

25

Delay ?

Not loop free!

slide-26

SLIDE 26

26

Update possible?

slide-27

SLIDE 27

27

Update possible?

slide-28

SLIDE 28

28

Update possible?

slide-29

SLIDE 29

29

Update possible?

Consistent transient states!

slide-30

SLIDE 30

30

Rounds

Round = set of parallel updates
➔ Minimize number of rounds / communication
verhead

slide-31

SLIDE 31

31

Greedy Update Fails

Greedy approach may:

– take up to times more rounds – fail to find solution

See paper!

slide-32

SLIDE 32

32

Greedy Update Fails

Greedy approach may:

– take up to times more rounds – fail to find solution

See paper!

slide-33

SLIDE 33

33

WPE - Update Algorithm

1.Switches < WP (new), > WP (old)

slide-34

SLIDE 34

34

WPE - Update Algorithm

1.Switches < WP (new), > WP (old)

slide-35

SLIDE 35

35

WPE - Update Algorithm

1.Switches < WP (new), > WP (old)

slide-36

SLIDE 36

36

WPE - Update Algorithm

1.Switches < WP (new), > WP (old) 2.Switches < WP (new), < WP (old)

slide-37

SLIDE 37

37

WPE - Update Algorithm

1.Switches < WP (new), > WP (old) 2.Switches < WP (new), < WP (old)

slide-38

SLIDE 38

38

WPE - Update Algorithm

1.Switches < WP (new), > WP (old) 2.Switches < WP (new), < WP (old) 3.Remaining switches

slide-39

SLIDE 39

39

WPE - Update Algorithm

1.Switches < WP (new), > WP (old) 2.Switches < WP (new), < WP (old) 3.Remaining switches Constant in 3 rounds, but not LF!

slide-40

SLIDE 40

40

LF and WPE Conflict

slide-41

SLIDE 41

41

LF and WPE Conflict

violate WPE; violate LF

slide-42

SLIDE 42

42

Mixed Integer Program

WPE LF Minimize Rounds

slide-43

SLIDE 43

43

Mixed Integer Program

Optimal solution Unclassified (stopped 600sec) Not solvable (provably) Mixed Integer Program

slide-44

SLIDE 44

44

Solvability Analysis

Greedy MIP Unclear No solution

% of solvable instances?
% of failed greedy?
1k random permutations per size
Max duration 600 seconds

slide-45

SLIDE 45

45

Solvability Analysis

Greedy MIP Unclear No solution

slide-46

SLIDE 46

46

Solvability Analysis

Greedy MIP Unclear No solution

slide-47

SLIDE 47

47

Solvability Analysis

Greedy MIP Unclear No solution

slide-48

SLIDE 48

48

Conclusion

Transient consistency is not easy to guarantee
LF and WPE might even conflict
Greedy can fail to find consistent updates

Dynamic WPE + LF updates are hard to find!