OpenNF: Enabling Innovation in Network Function Control Aaron - - PowerPoint PPT Presentation

▶
opennf enabling innovation in network function control
SMART_READER_LITE
LIVE PREVIEW

OpenNF: Enabling Innovation in Network Function Control Aaron - - PowerPoint PPT Presentation

Nov 17, 2022 10 likes •775 views

OpenNF: Enabling Innovation in Network Function Control Aaron Gember-Jacobson , Chaithan Prakash, Raajay Viswanathan, Robert Grandl, Junaid Khalid, Sourav Das, Aditya Akella 1 Network functions (NFs) Perform sophisticated stateful actions

slide-1
SLIDE 1

Aaron Gember-Jacobson, Chaithan Prakash, Raajay Viswanathan, Robert Grandl, Junaid Khalid, Sourav Das, Aditya Akella

1

OpenNF: Enabling Innovation in Network Function Control

slide-2
SLIDE 2

Network functions (NFs)

  • Perform sophisticated stateful

actions on packets/flows

2

Intrusion detection system (IDS) Caching proxy WAN

  • ptimizer
slide-3
SLIDE 3

NF trends

  • NFV → dynamically allocate NF instances

3

Xen/KVM

slide-4
SLIDE 4

NF trends

  • NFV → dynamically allocate NF instances

3

Xen/KVM

slide-5
SLIDE 5

NF trends

  • NFV → dynamically allocate NF instances
  • SDN → dynamically reroute flows

3

Xen/KVM

slide-6
SLIDE 6

NF trends

  • NFV → dynamically allocate NF instances
  • SDN → dynamically reroute flows

3

Xen/KVM

slide-7
SLIDE 7

NF trends

  • NFV → dynamically allocate NF instances
  • SDN → dynamically reroute flows

Dynamic reallocation

  • f packet processing

3

Xen/KVM

slide-8
SLIDE 8

Example: elastic NF scaling

4

slide-9
SLIDE 9

Example: elastic NF scaling

  • 1. Satisfy performance SLAs

4

slide-10
SLIDE 10

Example: elastic NF scaling

  • 1. Satisfy performance SLAs

4

CPU Packet loss

slide-11
SLIDE 11

Example: elastic NF scaling

  • 1. Satisfy performance SLAs

4

CPU Packet loss

slide-12
SLIDE 12

Example: elastic NF scaling

  • 1. Satisfy performance SLAs
  • 2. Minimize operating costs

4

CPU Packet loss

slide-13
SLIDE 13

Example: elastic NF scaling

  • 1. Satisfy performance SLAs
  • 2. Minimize operating costs

4

CPU Packet loss

slide-14
SLIDE 14

Example: elastic NF scaling

  • 1. Satisfy performance SLAs
  • 2. Minimize operating costs
  • 3. Accurately monitor traffic

4

CPU Packet loss

slide-15
SLIDE 15
  • 1. Satisfy performance SLAs
  • 2. Minimize operating costs
  • 3. Accurately monitor traffic

5

To simultaneously…

Problem: NFV+SDN is insufficient

Cannot effectively implement new services or abstractions!

slide-16
SLIDE 16

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows

[Stratos - arXiv:1305.0209]

Reroute existing flows

[SIMPLE - SIGCOMM ‘13]

Wait for flows to die

[Stratos - arXiv:1305.0209]

6

Packet loss

slide-17
SLIDE 17

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows

[Stratos - arXiv:1305.0209]

Reroute existing flows

[SIMPLE - SIGCOMM ‘13]

Wait for flows to die

[Stratos - arXiv:1305.0209]

6

Packet loss SLA: <1%

slide-18
SLIDE 18

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows

[Stratos - arXiv:1305.0209]

Reroute existing flows

[SIMPLE - SIGCOMM ‘13]

Wait for flows to die

[Stratos - arXiv:1305.0209]

6

?

Packet loss SLA: <1%

slide-19
SLIDE 19

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows

[Stratos - arXiv:1305.0209]

Reroute existing flows

[SIMPLE - SIGCOMM ‘13]

Wait for flows to die

[Stratos - arXiv:1305.0209]

6

?

Packet loss SLA: <1%

slide-20
SLIDE 20

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows

[Stratos - arXiv:1305.0209]

Reroute existing flows

[SIMPLE - SIGCOMM ‘13]

Wait for flows to die

[Stratos - arXiv:1305.0209]

6

?

Packet loss

slide-21
SLIDE 21

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows

[Stratos - arXiv:1305.0209]

Reroute existing flows

[SIMPLE - SIGCOMM ‘13]

Wait for flows to die

[Stratos - arXiv:1305.0209]

6

?

Packet loss

slide-22
SLIDE 22

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows

[Stratos - arXiv:1305.0209]

Reroute existing flows

[SIMPLE - SIGCOMM ‘13]

Wait for flows to die

[Stratos - arXiv:1305.0209]

6

?

Packet loss

slide-23
SLIDE 23

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows

[Stratos - arXiv:1305.0209]

Reroute existing flows

[SIMPLE - SIGCOMM ‘13]

Wait for flows to die

[Stratos - arXiv:1305.0209]

6

?

Packet loss

slide-24
SLIDE 24

SLAs + cost + accuracy: What do we need?

  • Quickly move, copy, or share internal NF state

alongside updates to network forwarding state

  • Guarantees: loss-free, order-preserving, …

7

   … 1 2 3 …

Also applies to other scenarios

slide-25
SLIDE 25

Outline

  • Motivation and requirements
  • Challenges
  • OpenNF architecture

– State export/import – State operations – Guarantees

  • Evaluation

8

slide-26
SLIDE 26
  • 1. Supporting many NFs with minimal changes
  • 2. Dealing with race conditions
  • 3. Bounding overhead

Challenges

9

slide-27
SLIDE 27

OpenNF overview

10

NF State Manager Flow Manager

OpenNF Controller

Control Application

move/copy/share state export/import State

slide-28
SLIDE 28

State created or updated by an NF applies to either a single flow or a collection of flows

NF state taxonomy

11

Connection Connection TcpAnalyzer HttpAnalyzer TcpAnalyzer HttpAnalyzer

Per-flow state

ConnCount

Multi-flow state All-flows state

Statistics

slide-29
SLIDE 29

NF API: export/import state

  • Functions: get, put, delete

12

Filter

Per Multi All

Scope NF

slide-30
SLIDE 30

NF API: export/import state

  • Functions: get, put, delete

12

Filter

Per Multi All

Scope NF get

slide-31
SLIDE 31

NF API: export/import state

  • Functions: get, put, delete

12

Filter

Per Multi All

Scope NF get put

slide-32
SLIDE 32

NF API: export/import state

  • Functions: get, put, delete

12

No need to expose/change internal state organization! Filter

Per Multi All

Scope NF get put

slide-33
SLIDE 33

Control operations: move

13

NF State Manager Control Application

move (port=80, Bro1, Bro2)

Flow Manager Bro2 Bro1

slide-34
SLIDE 34

Control operations: move

13

NF State Manager Control Application

move (port=80, Bro1, Bro2) get(per, port=80)

Flow Manager Bro2 Bro1

slide-35
SLIDE 35

Control operations: move

13

NF State Manager Control Application

move (port=80, Bro1, Bro2) get(per, port=80) [Chunk1] [Chunk2]

Flow Manager Bro2 Bro1

slide-36
SLIDE 36

Control operations: move

13

NF State Manager Control Application

move (port=80, Bro1, Bro2) get(per, port=80) [Chunk1] del(per, port=80) [Chunk2]

Flow Manager Bro2 Bro1

slide-37
SLIDE 37

Control operations: move

13

NF State Manager Control Application

move (port=80, Bro1, Bro2) get(per, port=80) [Chunk1] put (per, Chunk1) del(per, port=80) [Chunk2] put (per, Chunk2)

Flow Manager Bro2 Bro1

slide-38
SLIDE 38

Control operations: move

13

NF State Manager Control Application

move (port=80, Bro1, Bro2) get(per, port=80) [Chunk1] put (per, Chunk1) del(per, port=80) [Chunk2] put (per, Chunk2) forward(port=80, Bro2)

Flow Manager Bro2 Bro1

slide-39
SLIDE 39

Control operations: move

13

NF State Manager Control Application

move (port=80, Bro1, Bro2) get(per, port=80) [Chunk1] put (per, Chunk1) del(per, port=80) [Chunk2] put (per, Chunk2) forward(port=80, Bro2)

Flow Manager Bro2 Bro1 Also provide copy and share

slide-40
SLIDE 40

detect- MHR

Lost updates during move

14

Bro2 Bro1

slide-41
SLIDE 41

detect- MHR

Lost updates during move

14

B1 R1

Bro2 Bro1

slide-42
SLIDE 42

detect- MHR

Lost updates during move

14

B1 R1

Bro2 Bro1

move(red,Bro1 ,Bro2 )

slide-43
SLIDE 43

detect- MHR

Lost updates during move

14

B1 R1

Bro2 Bro1

move(red,Bro1 ,Bro2 )

slide-44
SLIDE 44

detect- MHR

Lost updates during move

14

B1 R1 R2

Missing state

Bro2 Bro1

move(red,Bro1 ,Bro2 )

slide-45
SLIDE 45

detect- MHR

Lost updates during move

14

B1 R1 R2

Missing state

Bro2 Bro1

move(red,Bro1 ,Bro2 )

slide-46
SLIDE 46

detect- MHR

Lost updates during move

14

B1 R1 R2

Missing state

Bro2 Bro1

move(red,Bro1 ,Bro2 )

slide-47
SLIDE 47

detect- MHR

Lost updates during move

14

B1 R1 R2

Missing state

Bro2 Bro1

move(red,Bro1 ,Bro2 ) Missing updates

R3

slide-48
SLIDE 48

detect- MHR

  • Split/Merge [NSDI ‘13]: pause traffic, buffer packets

– Packets in-transit when buffering starts are dropped

Lost updates during move

14

B1 R1 R2

Missing state

Bro2 Bro1

move(red,Bro1 ,Bro2 ) Missing updates

Loss-free: All state updates should be reflected in the transferred state, and all packets should be processed

R3

slide-49
SLIDE 49

NF API: observe/prevent updates using events

15

NF

slide-50
SLIDE 50

NF API: observe/prevent updates using events

15

NF

slide-51
SLIDE 51

NF API: observe/prevent updates using events

15

NF

slide-52
SLIDE 52

NF API: observe/prevent updates using events

15

R1

NF

slide-53
SLIDE 53

NF API: observe/prevent updates using events

15

R1

NF

slide-54
SLIDE 54

NF API: observe/prevent updates using events

15

Only need to change an NF’s receive packet function!

R1

NF

slide-55
SLIDE 55

Use events for loss-free move

16

Bro2 Bro1

R1

slide-56
SLIDE 56
  • 1. enableEvents(red,drop) on Bro1

Use events for loss-free move

16

Bro2 Bro1

Drop R1

slide-57
SLIDE 57
  • 1. enableEvents(red,drop) on Bro1
  • 2. get/delete on Bro1

Use events for loss-free move

16

Bro2 Bro1

Drop R1

slide-58
SLIDE 58
  • 1. enableEvents(red,drop) on Bro1
  • 2. get/delete on Bro1

Use events for loss-free move

16

Bro2 Bro1

Drop R1 R2

slide-59
SLIDE 59
  • 1. enableEvents(red,drop) on Bro1
  • 2. get/delete on Bro1
  • 3. Buffer events at controller

Use events for loss-free move

16

Bro2 Bro1

Drop R1 R2

slide-60
SLIDE 60
  • 1. enableEvents(red,drop) on Bro1
  • 2. get/delete on Bro1
  • 3. Buffer events at controller
  • 4. put on Bro2

Use events for loss-free move

16

Bro2 Bro1

Drop R1 R2

slide-61
SLIDE 61
  • 1. enableEvents(red,drop) on Bro1
  • 2. get/delete on Bro1
  • 3. Buffer events at controller
  • 4. put on Bro2
  • 5. Flush packets in

events to Bro2

Use events for loss-free move

16

Bro2 Bro1

Drop R1 R1,R2

slide-62
SLIDE 62
  • 1. enableEvents(red,drop) on Bro1
  • 2. get/delete on Bro1
  • 3. Buffer events at controller
  • 4. put on Bro2
  • 5. Flush packets in

events to Bro2

  • 6. Update

forwarding

Use events for loss-free move

16

Bro2 Bro1

Drop R1 R1,R2

slide-63
SLIDE 63
  • 1. enableEvents(red,drop) on Bro1
  • 2. get/delete on Bro1
  • 3. Buffer events at controller
  • 4. put on Bro2
  • 5. Flush packets in

events to Bro2

  • 6. Update

forwarding

Use events for loss-free move

16

Bro2 Bro1

Drop R1 R1,R2 R1,R2,R3

slide-64
SLIDE 64
  • False positives from Bro’s weird script

Re-ordering of packets

17

Controller Switch Bro2 Bro1

slide-65
SLIDE 65
  • False positives from Bro’s weird script

Re-ordering of packets

17

Controller Switch Bro2

  • 5. Flush buffer

Bro1

R2 R2 R2

slide-66
SLIDE 66
  • False positives from Bro’s weird script

Re-ordering of packets

17

Controller Switch Bro2

  • 5. Flush buffer
  • 6. Request

forwarding update Bro1

R2 R2 R2

slide-67
SLIDE 67
  • False positives from Bro’s weird script

Re-ordering of packets

17

Controller Switch Bro2

  • 5. Flush buffer
  • 6. Request

forwarding update Bro1

R2 R2 R3 R2 R3

slide-68
SLIDE 68
  • False positives from Bro’s weird script

Re-ordering of packets

17

Controller Switch Bro2

  • 5. Flush buffer
  • 6. Request

forwarding update Bro1

R2 R2 R4 R3 R2 R4 R3

slide-69
SLIDE 69
  • False positives from Bro’s weird script

Re-ordering of packets

17

Controller Switch Bro2

  • 5. Flush buffer
  • 6. Request

forwarding update Bro1

R2 R2 R4 R3 R3 R3 R2 R4 R3 R3

slide-70
SLIDE 70
  • False positives from Bro’s weird script

Re-ordering of packets

17

Order-preserving: All packets should be processed in the order they were forwarded by the switch

Controller Switch Bro2

  • 5. Flush buffer
  • 6. Request

forwarding update Bro1

R2 R2 R4 R3 R3 R3 R2 R4 R3 R3

slide-71
SLIDE 71
  • 1. Dealing with diversity
  • 2. Dealing with race conditions

OpenNF: SLAs + cost + accuracy

18

Export/import state based

  • n its association with flows

Events Lock-step forwarding updates

+

slide-72
SLIDE 72

Implementation

  • Controller (3.8K lines of Java)
  • Communication library (2.6K lines of C)
  • Modified NFs (3-8% increase in code)

19

Bro IDS iptables Squid Cache PRADS

slide-73
SLIDE 73

Overall benefits for elastic scaling

  • Bro IDS processing 10K pkts/sec

– At 180 sec: move HTTP flows (489) to new IDS – At 360 sec: move back to old IDS

  • SLAs: 260ms to move (loss-free)
  • Accuracy: same log entries as using one IDS

– VM replication: incorrect log entries

  • Cost: scale down after state is moved

– Stratos: scale down delayed 25+ minutes

20

[arXiv:1305.0209]

slide-74
SLIDE 74

Evaluation: state export/import

21

Serialization/deserialization costs dominate Cost grows with state complexity

slide-75
SLIDE 75

50 100 150 200 Average Maximum

Per-packet Latency Increase (ms)

100 200 300 400 500 NG NG PL LF PL+ER

Move Time (ms)

  • PRADS asset detector processing 5K pkts/sec
  • Move per-flow state for 500 flows

Evaluation: operations

22

Packets dropped! 686 462 881 packets in events

Operations are efficient, but guarantees come at a cost!

1120 pkts buffered 838 pkts in events +

NG NG PL LF PL+ER OP PL+ER

slide-76
SLIDE 76
  • Dynamic reallocation of packet

processing enables new services

  • Realizing SLAs + cost + accuracy requires

quick, safe control of internal NF state

  • OpenNF provides flexible and efficient

control with few NF modifications

Conclusion

23

http://opennf.cs.wisc.edu