Correctness and Performance for Stateful Chained Network Functions
Junaid KhalidW,G and Aditya AkellaW
1
*This work does not have any affiliation with Google
Stateful Chained Network Functions Junaid Khalid W,G and Aditya - - PowerPoint PPT Presentation
Correctness and Performance for Stateful Chained Network Functions Junaid Khalid W,G and Aditya Akella W 1 *This work does not have any affiliation with Google Network Function Virtualization (NFV) Hardware NF software NF over commodity
Junaid KhalidW,G and Aditya AkellaW
1
*This work does not have any affiliation with Google
2
Intrusion detection system (IDS)
2
Caching proxy Intrusion detection system (IDS)
2
Firewall Caching proxy Intrusion detection system (IDS)
2
Firewall Caching proxy Intrusion detection system (IDS) WAN
2
Firewall Caching proxy Intrusion detection system (IDS) WAN
2
Firewall Caching proxy Intrusion detection system (IDS) WAN
2
3
3
3
Intrusion detection system (IDS) WAN
4
5
5
5
6
6
7
7
1. NF statefulness
7
1. NF statefulness
7
1. NF statefulness
8
1. NF statefulness
8
1. NF statefulness 2. Consistent state updates
updating shared state
9
1. NF statefulness 2. Consistent state updates
9
1. NF statefulness 2. Consistent state updates 3. Dependency between different NF instances
FTP SSH
9
1. NF statefulness 2. Consistent state updates 3. Dependency between different NF instances
SSH
10
balance load or handle traffic spikes
10
state transfer
balance load or handle traffic spikes
10
state transfer
balance load or handle traffic spikes
10
state transfer
balance load or handle traffic spikes
10
state transfer
11
state transfer
tolerance, that state needs to be recovered
11
state transfer
12
state transfer
slow NF)
12
state transfer
slow NF)
12
different NF instances
different NF instances
13
different NF instances
state transfer
Framework State availability State transfer Consistent shared state Duplicate suppression Chain-wide
Split/Merge[NSDI’13] OpenNF[SIGCOMM’14] FTMB [SIGCOMM’ 15] S6 [NSDI’18] Pico Rep.[SOCC’13] StatelessNF[NSDI’17]
14
Framework State availability State transfer Consistent shared state Duplicate suppression Chain-wide
Split/Merge[NSDI’13] OpenNF[SIGCOMM’14] FTMB [SIGCOMM’ 15] S6 [NSDI’18] Pico Rep.[SOCC’13] StatelessNF[NSDI’17]
14
Incomplete support → restricted functionality
15
16
16
16
Datastore
16
Datastore
16
Root splitter Datastore
17
NF state is stored in an in-memory external state store (similar to statelessNF)
18
NF state is stored in an in-memory external state store (similar to statelessNF)
and concurrency control across instances
18
External store
NF state is stored in an in-memory external state store (similar to statelessNF)
and concurrency control across instances Naively externalizing the state can degrade NF performance
18
External store
19
State
20
State per-flow cross-flow
20
State per-flow cross-flow Any Instance-local caching w/ periodic nonblocking flush
20
State per-flow cross-flow Any Write rarely (read heavy) Instance-local caching w/ periodic nonblocking flush Instance-local caching w/ callbacks
20
State per-flow cross-flow Any Write rarely (read heavy) Write mostly Read rarely Instance-local caching w/ periodic nonblocking flush Instance-local caching w/ callbacks
20
State per-flow cross-flow Any Write rarely (read heavy) Write mostly Read rarely Write/read
Instance-local caching w/ periodic nonblocking flush Instance-local caching w/ callbacks
20
State per-flow cross-flow Any Write rarely (read heavy) Write mostly Read rarely Write/read
Instance-local caching w/ periodic nonblocking flush Instance-local caching w/ callbacks
20
Operation offloading
21
Operation Description Increment/Decrement a value Increment or decrement the value stored at key by the given value Push/pop a value to/from list Push or pop the value in/from the list stored at the given key Compare and update Update the value, if the condition is true
21
Operation Description Increment/Decrement a value Increment or decrement the value stored at key by the given value Push/pop a value to/from list Push or pop the value in/from the list stored at the given key Compare and update Update the value, if the condition is true
21
The datastore serializes operations issued by different instances for the same shared state object and applies them in the background
22
NF1
22
NF2 NF1
Datastore X=0 Without operation offload
NF1
22
NF2 NF1
Datastore X=0 Without operation offload
NF1
22
NF2 NF1
Datastore X=0 Without operation offload
NF1
22
NF2 NF1
Datastore X=0 X++ Without operation offload
NF1
22
NF2 NF1
Datastore X=0 X++ Without operation offload
NF1
22
NF2 NF1
Datastore X=0 X++ X++ Without operation offload
NF1
22
NF2 NF1
Datastore X=2 X=0 X++ X++ Without operation offload
NF1
22
NF2 NF1
Datastore X=2 X=0 X++ X++
NF2 NF1
Datastore X=0 Without operation offload With operation offload
NF1
22
NF2 NF1
Datastore X=2 X=0 X++ X++
NF2 NF1
Datastore X=0 Without operation offload With operation offload
NF1
22
NF2 NF1
Datastore X=2 X=0 X++ X++
NF2 NF1
Datastore X=0 Without operation offload With operation offload
NF1
22
NF2 NF1
Datastore X=2 X=0 X++ X++
NF2 NF1
Datastore X=0 Without operation offload With operation offload
NF1
22
NF2 NF1
Datastore X=2 X=0 X++ X++
NF2 NF1
Datastore X=0 X=2 Without operation offload With operation offload
State per-flow cross-flow Any Write rarely (read heavy) Write mostly Read rarely
23
Instance-local caching w/ periodic nonblocking flush Instance-local caching w/ callbacks
State per-flow cross-flow Any Write rarely (read heavy) Write mostly Read rarely Non-blocking
caching
23
Instance-local caching w/ periodic nonblocking flush Instance-local caching w/ callbacks
State per-flow cross-flow Any Write rarely (read heavy) Write mostly Read rarely Write/read
Non-blocking
caching Depends upon traffic
allows; flush periodically
23
Instance-local caching w/ periodic nonblocking flush Instance-local caching w/ callbacks
24
CHC adds a “root splitter” at the entry of a chain that:
Root splitter
25
CHC adds a “root splitter” at the entry of a chain that:
Root splitter
25
Adding logical clock
CHC adds a “root splitter” at the entry of a chain that:
Root splitter
25
Packet logging Adding logical clock
CHC adds a “root splitter” at the entry of a chain that:
CHC encodes state object’s ownership information and logical clock associated with state operations as metadata
Root splitter
25
Packet logging Adding logical clock State
Root splitter
26
Old instance
Root splitter
the new instance
26
Old instance Last pkt First pkt
Root splitter
the new instance
consistent handover of per-flow state
26
Old instance Last pkt First pkt
Root splitter
the new instance
consistent handover of per-flow state
is used to update it
26
Old instance Last pkt First pkt
27
27
28
28
28
28
28
28
29
datastore and duplicate packets at downstream NFs
29
datastore and duplicate packets at downstream NFs
29
datastore and duplicate packets at downstream NFs
29
suppressed state updates are suppressed
30
30
30
Traditional NF with infinite capacity
31
State variable Scope State Externalization Caching
Port mapping per-flow Total TCP pkt count cross flow Total IP pkt count cross low
Traditional NF with infinite capacity Externalized state operations
31
State variable Scope State Externalization Caching
Port mapping per-flow Total TCP pkt count cross flow Total IP pkt count cross low
Traditional NF with infinite capacity Externalized state operations State externalization with caching
31
State variable Scope State Externalization Caching
Port mapping per-flow Total TCP pkt count cross flow Total IP pkt count cross low
Traditional NF with infinite capacity Externalized state operations State externalization with caching State externalization with caching and asynchronous + offloaded updates
31
State variable Scope State Externalization Caching
Port mapping per-flow Total TCP pkt count cross flow Total IP pkt count cross low
Traditional NF with infinite capacity Externalized state operations State externalization with caching State externalization with caching and asynchronous + offloaded updates
31
Less than 0.6µs increase in the median per-NF packet processing latency
32
32
32
32
75th%-ile latency of CHC is 20 times lower than OpenNF
32
33
CHC
33
checkpointing every 200ms CHC FTMB
Ensuing Fault tolerance
33
checkpointing every 200ms CHC FTMB
Ensuing Fault tolerance
75th%-ile latency of CHC is 6 times lower than FTMB
33
checkpointing every 200ms CHC FTMB
Portscan detector Load Balancer NAT
CHC operates at line rate with an end-to-end median per packet processing overhead of 11.3us
Trojan detector
36