Segment routing in container networks Ben de Graaff Supervisor: - PowerPoint PPT Presentation

RP95 Segment routing in container networks Ben de Graaff Supervisor: Marijke Kaat (SURFnet/UvA)

Best path Background A B

Arbitrary paths Background 1 1 2 A 3 B 4 4 5 A > 1 > 4 > B

Pure IPv6 (SRv6) Background 2000:1:: 2000:2:: 2000:1::2 1 2 2000:1::A 2000:1::3 2000:B:: A 3 B 2000:A:: 2000:3:: 4 5 2000:4:: 2000:5::

Container networks Background Internet

Platform independent Background Internet LXC

Multi-tenancy Background Internet

Example: load balancer Background Internet Transit policy LB

Research State of segment routing in IPv6 Proof of concept: Container networking Network functions

Network programming src dst dst 4 1 1 2 1 A 4 3 B dst 4 5 src > 1 > 4 > dst

Segment routing header Header Segments left Segment 0 . . . Segment N Extensions

Proof of concept Validate policy Apply policy

Multi-tenancy Results Internet 2000:A:: 1000:1 2000:B:: 1000:2 2000:C:: 1000:3 Segment ID 2000:B:: 1000:1 2000:B:: 1000:2 2000:B:: 1000:3 2000:C:: 1000:1 2000:C:: 1000:3

Container discovery/mobility Results Routing opaque addresses 2: NF Compute final hop 1: Inject SRH Topology ::1:2:3:4 ::a:b:c:d 3: Deliver

Implementation Results Hardware/software

Linux kernel 4.10+ Results Basic routing/policy Limited extension support Implementation quirks…

SRv6 availability Results Hardware Software Vector Packet Processing The Fast Data Project NCS 5500

Technical implementation Technical stuff http://www.story-stick.net/event/here-be-dragons

Virtual topology Results Container VM Container VM VPP VPP Container Network function VPP

eBPF Results myprog.c + LLVM = Latest & greatest bytecode ⇓ Process directly in kernel bpf() syscall Fast, powerful ⇓ Kernel network stack

eBPF Results Validate policy ✗ bpf_redirect Ingress eBPF eth0 veth Container Control app ✗ Egress eBPF tc filter bpf Apply policy

Linux do-it-yourself Results Tun/tap AF_PACKET ip rule iptables fwmark PF_RING ...

Linux do-it-yourself Results Validate policy Raw socket Ingress app AF_PACKET eth0 veth Container ip rule tun Egress app Apply policy

Summary Results Validate policy Apply policy

Ingress policy enforcement? Discussion Internet Ingress veth Container FW eth0 Egress

Future work Ingress path control Linux segment routing Netlink API Develop useful extensions

Conclusion Proof of concept: works SDN easy, at cost of overhead Hardware not strictly required

Related work Cisco, Bell Canada, Comcast, et al, technical workshops @ www.segment-routing.net NFV with SRv6, with SRH unaware hosts (NetSoft 2017, presented today )

RP95 Segment routing in container networks Segment routing is effective at Check out the report for a full list of references enabling SDN and network http://rp.delaat.net/2016-2017/p95/report.pdf functions between containers However, it is not yet widely supported in hardware, software

Backup slides

Security/RH0 Enforce policy at network edges SIDs must be explicitly enabled HMAC: check at ingress

Simplify the network Discussion Remove protocols Remove state https://xkcd.com/927/

MPLS Background 101 102 No LDP, RSVP 202 1 2 required 210 203 111 A 3 B 110 103 4 5 104 105

Multi-tenancy Discussion Layer 2 and 3 cross-connects Multi-tenancy: Segment ID or extension?