Magellan: Automatic SDN Pipelining from Algorithmic Policies - PowerPoint PPT Presentation

Magellan: Automatic SDN Pipelining from Algorithmic Policies Presenter: Qiao Xiang Work by S. Chen, A. Voellmy, T. Wang, R. Yang* Systems Networking Lab (SNLab) June 3, 2016 Authors are ordered alphabetically. NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016

Outline • Background: algorithmic SDN programming • Maple • Magellan • Summary NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 2

Background: High-Level Algorithmic SDN Programming Goal: Can we let programmers write the most obvious SDN code? consider each pkt as a request - Network control expressed in general purpose language, (logically) invoked on each pkt - A network control function returns how a pkt traverses network, not how datapath (flow tables) are configured. NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 3

Example Algorithmic Policy in Java Route f(Packet p) { if (p.tcpDstIs(22)) return null(); else { Location sloc = hostTable(p.ethSrc()); Location dloc = hostTable(p.ethDst()); Route path = myRoutingAlg(topology(), sloc,dloc); return path; } } Route myRoutingAlg(Topology topo, Location sLoc, Location dloc) { if ( isSensitive(sLoc) || isSensitive(dLoc) ) return secureRoutingAlg(topo, sloc, dloc); else return standardRoutingAlg(topo, sloc, dloc); } Does not specify anything on flow tables! NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 4

Challenge • Naïve solution of processing each packet at controller is not possible • Key challenge: How to use data-path (flow tables) from data-path oblivious algorithmic policies? NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016

Outline • Background: algorithmic SDN programming • Maple: dynamic tracing NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 6

Maple: Basic Idea • There are two representations of computation – A sequence of instructions – Memorization tables • Although the decision function f does not specify how flow tables are configured, if for a given decision (e.g., drop), we know the dependency of the decision, we can construct the flow tables (aka, memorization tables). NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 7

Maple: Realizing the Basic Idea • Only requirement: Program f uses a simple library to access pkt attributes: • Library provides both convenience and more importantly, decision dependency! NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 8

Dynamic Tracing: Abstraction to Flow Tables 1 . Observes decision dependency of f on pkt attributes. 2 . Builds a trace tree (TT) , a universal (general), partial 3 . Compile trace tree to decision tree representation generate flow tables (FTs). of any f. NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 9

Policy EthSrc:1, EthDst:2, TcpDst:80 Route f(Packet p) { Assert: if (p.tcpDstIs(22)) TcpDst==22 return null(); false else { Read: Location sloc = EthSrc hostTable(p.ethSrc()); 1 Location dloc = Read: hostTable(p.ethDst()); EthDst 2 Route path = myRoutingAlg( topology(),sloc,dloc); path1 return path; } } NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 10

Trace Tree Policy EthDst:1, TcpDst:22 Route f(Packet p) { Assert: Assert: if (p.tcpDstIs(22)) TcpDst==22 TcpDst==22 true true false return null(); null else { Location sloc = Read: ? hostTable(p.ethSrc()); EthSrc 1 Location dloc = hostTable(p.ethDst()); Read: EthDst Route path = 2 myRoutingAlg( topology(),sloc,dloc); path1 return path; } } NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 11

Trace Tree Policy EthDst:1, TcpDst:22 Route f(Packet p) { Assert: Assert: if (p.tcpDstIs(22)) TcpDst==22 TcpDst==22 true true false return null(); null else { Location sloc = Read: null hostTable(p.ethSrc()); EthSrc 1 Location dloc = hostTable(p.ethDst()); Read: EthDst Route path = 2 myRoutingAlg( topology(),sloc,dloc); path1 return path; } } NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 12

Trace Tree => Flow Table tcpDst ==22 True False ethDst drop match:{tcpDst==22} 4 2 drop ethSrc match:{tcpDst!=22, 6 ethDst:2} port 30 match:{tcpDst!=22, ethDst:4,ethSrc:6} NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 13

Trace Tree => Flow Table tcpDst ==22 True False ethDst drop match:{tcpDst==22} 4 2 drop ethSrc match:{tcpDst!=22, 6 ethDst:2} port 30 barrier rule: match:{tcpDst!=22, ethDst:4,ethSrc:6} match:{tcpDst==22} action:ToController Priority NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 14

Trace Tree => Flow Table Simple, classical in-order tree traversal generates flow table rules! tcpDst 3 ==22 1 True False 2 ethDst drop match:{tcpDst==22} 4 2 drop ethSrc match:{tcpDst!=22, 6 ethDst:2} port 30 barrier rule: match:{tcpDst!=22, ethDst:4,ethSrc:6} match:{tcpDst==22} action:ToController Priority NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 15

Problems of Maple Trace Tree • Quality: Compiles to only a single flow table • Latency: A reactive approach that waits for punted packets to begin unfolding the trace tree and generating rules NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 16

Why is Multi-Table Important for Quality (A Simple GBP Example)? Map<MAC, ConditionSet> hostTable; 0. Route onPacketIn(Packet p) { 1. ConditionSet srcCond = hostTable.get( p.ethSrc() ); 2. ConditionSet dstCond = hostTable.get( p.ethDst() ); 3. if (srcCond != null && dstCond != null && pass(srcCond, dstCond) ) 4. return port1; 5. else 6. return drop; } - Assume n hosts in hostTable Flow table from trace tree - TT after pingall among the n hosts ethSrc ethDst Action ethSrc a 1 a 1 a 1 p 1 a 1 a 2 p 2 ethDst ethDst .. … … a 1 a 1 a n a n a n a n p n2 n 2 entries; more if p p n2 p 1 p n under attacks NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 17

More Efficient Multi-Table (2 Tables) Design Table 1 Assume k condition ethSrc Action possibilities. a 1 reg srcCond =y 1 jump 2 a 2 reg srcCond =y 2 jump 2 .. … a n reg srcCond =y n jump 2 otherwise drop Table 2 regs rcSw ethDst Action y 1 a 1 p 1,1 n + kn entries y 1 a 2 p 1,2 .. … … y k a n p k,n otherwise drop NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 18

More Efficient Multi-Table (3 Tables) Design Assume k condition possibilities. Table 1 ethSrc Action Table 3 a 1 reg srcCond =y 1 jump 2 reg srcCond regs dstCond Action a 2 reg srcCond =y 2 jump 2 y 1 y 1 p 1,1 .. … y 1 y 2 p 1,2 a n reg srcCond =y n jump 2 .. … … otherwise drop y k y n p k,k Table 2 otherwise drop ethDst Action 2n + k 2 entries a 1 reg dstCond =y 1 jump 3 a 2 reg dstCond =y 2 jump 3 .. … a n reg dstCond =y n jump 3 otherwise drop NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 19

Comparison of 3 Designs Assume n = 4000, k = 100 Design #flow rules 1 table 16,000,000 = 16M 2 tables 4000+400,000 = 404K 3 tables 8000+10,000 = 18K NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 20

Outline • Background: algorithmic SDN programming • Maple • Magellan: automatic SDN pipelining NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 21

Magellan: Basic Idea • Basic idea: – Trace tree is a mostly blackbox approach, while Magellan starts with the other extreme---a whitebox approach. – Proactively explore the program and generate flow tables NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 22

Basic Insight: Per-Instruction Table (PIT) • Function f consists of a sequence of instructions I 1 , I 2 , …, I N • One can consider each instruction I a table: a mapping from input variable states to output variable states, represented as a table InVar(I) 1 InVar(I) 2 InVar(I) 3 OutVar(I) 1 1 1 OutVar(I)=I(1,1,1) … … InVar(I) 1 OutVar(I) InVar(I) 2 I InVar(I) 3 NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 23

Example Map<MAC, ConditionSet> hostTable; Route onPacketIn(Packet p) { I1. ConditionSet srcCond = hostTable.get( p.ethSrc() ); I2. ConditionSet dstCond = hostTable.get( p.ethDst() ); I3. branch [srcCond != null && dstCond != null && pass(srcCond, dstCond) ] I4 I5 I4. return port1 I5. return drop I3 I2 I1 reg srcCond reg dstCond Action p.ethDst Action p.ethSrc Action Reg dstCond 1 1 Reg srcCond srcCond 1 dstCond jump I4 =dstCond 1 =srcCond 1 1 jump I3 jump I2 … jump I5 2 2 … ... ... 2 48 Reg dstCond 2 48 Reg srcCond =dstCond 2^48 =srcCond 2^48 jump I3 jump I2 NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 25

Problems of PIT • Too large table size: Naïve construction of each instruction table is still not practical – Ins(var 1 , var 2, …, var N ) has |var 1 | x |var 2 | …x |var N | rows, where |var i | is the potential values of var i • Too many tables: a switching element allows only a small number of flow tables, and a program may have many more instructions NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 26

Outline • Background: algorithmic SDN programming • Maple • Magellan – Basic idea – Reduce table size: Compact-mappable instructions NSF DIMACS Workshop on SDN Algorithms, June 2-3, 2016 27