Network Function Control Aaron Gember-Jacobson , Chaithan Prakash, - PowerPoint PPT Presentation

OpenNF: Enabling Innovation in Network Function Control Aaron Gember-Jacobson , Chaithan Prakash, Raajay Viswanathan, Robert Grandl, Junaid Khalid, Sourav Das, Aditya Akella 1

Network functions (NFs) • Perform sophisticated stateful actions on packets/flows • Important goals: 1. Satisfy SLAs 2. Minimize costs 3. Act correctly 2

NF trends • Network Functions Virtualization (NFV) WAN optimizer Caching proxy Intrusion detection system (IDS) 3

NF trends • Network Functions Virtualization (NFV) → dynamically allocate NF instances Hypervisor 3

NF trends • Network Functions Virtualization (NFV) → dynamically allocate NF instances • Software-defined Networking → dynamically reroute flows Hypervisor 3

NF trends • Network Functions Virtualization (NFV) → dynamically allocate NF instances • Software-defined Networking → dynamically reroute flows Dynamic reallocation Hypervisor of packet processing e.g., elastic NF scaling 3

Why NFV + SDN falls short Packet loss 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 4

Why NFV + SDN falls short Packet loss SLA: <1% 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 4

Why NFV + SDN falls short ? Packet loss SLA: <1% 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 4

Why NFV + SDN falls short ? Packet loss SLA: <1% 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 4

Why NFV + SDN falls short ? Packet loss 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 4

Why NFV + SDN falls short ? Packet loss 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 4

Why NFV + SDN falls short ? Packet loss 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 4

SLAs + cost + accuracy: What do we need? • Quickly move, copy, or share internal NF state alongside updates to network forwarding state • Guarantees: loss-free, order- preserving, …    … 1 2 3 … Also applies to other scenarios 5

Outline • Motivation and requirements • Challenges • OpenNF architecture • Evaluation 6

Challenges 1. Supporting many NFs with minimal changes 2. Dealing with race conditions 3. Bounding overhead 7

OpenNF overview Control Application move/copy/share state OpenNF NF State Manager Flow Manager Controller export/import State 8

NF state taxonomy State created or updated by an NF applies to either a single flow or a collection of flows Multi-flow state Per-flow state TcpAnalyzer Connection HttpAnalyzer ConnCount Connection TcpAnalyzer All-flows state HttpAnalyzer Statistics 9

NF API: export/import state • Functions: get , put , delete put Per Scope Multi All Filter get NF No need to expose/change internal state organization! 10

Control operations: move Control Application Flow Manager move (port=80, IDS 1 , IDS 2 ) NF State Manager IDS 1 IDS 2 11

Control operations: move Control Application Flow Manager move (port=80, IDS 1 , IDS 2 ) NF State Manager get(per, port=80) [Chunk1] [Chunk2] IDS 1 IDS 2 11

Control operations: move Control Application Flow Manager move (port=80, IDS 1 , IDS 2 ) NF State Manager get(per, port=80) [Chunk1] del(per, port=80) [Chunk2] IDS 1 IDS 2 11

Control operations: move Control Application Flow Manager move (port=80, IDS 1 , IDS 2 ) NF State Manager get(per, port=80) put (per, Chunk1) [Chunk1] del(per, port=80) put (per, Chunk2) [Chunk2] IDS 1 IDS 2 11

Control operations: move Control Application Flow Manager move (port=80, IDS 1 , IDS 2 ) forward(port=80, IDS 2 ) NF State Manager get(per, port=80) put (per, Chunk1) [Chunk1] del(per, port=80) put (per, Chunk2) [Chunk2] IDS 1 IDS 2 Also provide copy and share 11

Lost updates during move Malware hash move(red,Bro 1 ,Bro 2 ) check R1 B1 IDS 1 IDS 2 12

Lost updates during move Malware hash move(red,Bro 1 ,Bro 2 ) check R1 B1 IDS 1 IDS 2 12

Lost updates during move Malware hash move(red,Bro 1 ,Bro 2 ) check Missing R1 state B1 R2 IDS 1 IDS 2 12

Lost updates during move Malware hash move(red,Bro 1 ,Bro 2 ) check Missing R2 R1 state B1 IDS 1 IDS 2 12

Lost updates during move Malware hash move(red,Bro 1 ,Bro 2 ) check Missing R2 R1 state B1 IDS 1 IDS 2 12

Lost updates during move Malware hash move(red,Bro 1 ,Bro 2 ) check Missing Missing R2 R1 state updates B1 R3 IDS 1 IDS 2 12

Lost updates during move Malware hash move(red,Bro 1 ,Bro 2 ) check Missing Missing R2 R1 state updates B1 R3 IDS 1 IDS 2 Loss-free: All state updates should be reflected in the transferred state, and all packets should be processed 12

NF API: observe/prevent updates using events NF R1 Only need to change an NF’s receive packet function! 13

Use events for loss-free move R1 IDS 1 IDS 2 14

Use events for loss-free move 1. enableEvents(red,noproc) on IDS 1 R1 NoProc IDS 1 IDS 2 14

Use events for loss-free move 1. enableEvents(red,noproc) on IDS 1 2. get / delete on IDS 1 NoProc IDS 1 IDS 2 R1 14

Use events for loss-free move 1. enableEvents(red,noproc) on IDS 1 2. get / delete on IDS 1 NoProc R2 IDS 1 IDS 2 R1 14

Use events for loss-free move 1. enableEvents(red,noproc) on IDS 1 2. get / delete on IDS 1 3. Buffer events at controller NoProc IDS 1 IDS 2 R1 R2 14

Use events for loss-free move 1. enableEvents(red,noproc) on IDS 1 2. get / delete on IDS 1 3. Buffer events at controller 4. put on IDS 2 R1 NoProc IDS 1 IDS 2 R2 14

Use events for loss-free move 1. enableEvents(red,noproc) on IDS 1 2. get / delete on IDS 1 3. Buffer events at controller 4. put on IDS 2 5. Flush packets in events to IDS 2 R1,R2 R1 NoProc IDS 1 IDS 2 14

Use events for loss-free move 1. enableEvents(red,noproc) on IDS 1 2. get / delete on IDS 1 3. Buffer events at controller 4. put on IDS 2 5. Flush packets in events to IDS 2 R1,R2 R1 NoProc 6. Update IDS 1 IDS 2 forwarding 14

Use events for loss-free move 1. enableEvents(red,noproc) on IDS 1 2. get / delete on IDS 1 3. Buffer events at controller 4. put on IDS 2 5. Flush packets in events to IDS 2 R1,R2,R3 R1,R2 R1 NoProc 6. Update IDS 1 IDS 2 forwarding 14

Implementation • Controller ( 3.8K lines of Java ) • Communication library (2.6K lines of C) • Modified NFs (3-8% increase in code) Bro IDS iptables Squid Cache PRADS 15

Evaluation: benefits for elastic scaling • Bro IDS processing 10K pkts/sec – At 180 sec: move HTTP flows (489) to new IDS – At 360 sec: move back to old IDS • SLAs: 260ms to move (loss-free) • Accuracy: same log entries as using one IDS – VM replication: incorrect log entries • Cost: scale in after state is moved – Wait for flows to die: scale in delayed 25+ minutes 16

Conclusion • Realizing SLAs + cost + accuracy requires quick, safe control of internal network function state • OpenNF provides flexible and efficient control with few modifications to NFs Learn more and try it! http://opennf.cs.wisc.edu 17