Network Function Control Aaron Gember-Jacobson , Chaithan Prakash, - PowerPoint PPT Presentation

OpenNF: Enabling Innovation in Network Function Control Aaron Gember-Jacobson , Chaithan Prakash, Raajay Viswanathan, Robert Grandl, Junaid Khalid, Sourav Das, Aditya Akella 1

Network functions (NFs) • Perform sophisticated stateful actions on packets/flows WAN optimizer Caching proxy Intrusion detection system (IDS) 2

NF trends • Network Functions Virtualization (NFV) WAN optimizer Caching proxy Intrusion detection system (IDS) 3

NF trends • Network Functions Virtualization (NFV) → dynamically allocate NF instances Hypervisor 3

NF trends • Network Functions Virtualization (NFV) → dynamically allocate NF instances • Software-defined Networking → dynamically reroute flows Hypervisor 3

NF trends • Network Functions Virtualization (NFV) → dynamically allocate NF instances • Software-defined Networking → dynamically reroute flows Dynamic reallocation Hypervisor of packet processing 3

Example: elastic NF scaling 1. Satisfy performance SLAs 4

Example: elastic NF scaling 1. Satisfy performance SLAs CPU Packet loss 4

Example: elastic NF scaling 1. Satisfy performance SLAs CPU Packet loss 4

Example: elastic NF scaling 1. Satisfy performance SLAs CPU Packet loss 4

Example: elastic NF scaling 1. Satisfy performance SLAs 2. Minimize operating costs CPU Packet loss 4

Example: elastic NF scaling 1. Satisfy performance SLAs 2. Minimize operating costs CPU Packet loss 4

Example: elastic NF scaling 1. Satisfy performance SLAs 2. Minimize operating costs 3. Accurately monitor traffic CPU Packet loss 4

Problem: NFV+SDN is insufficient To simultaneously … 1. Satisfy performance SLAs 2. Minimize operating costs 3. Accurately monitor traffic 5

Why NFV + SDN falls short Packet loss 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 6

Why NFV + SDN falls short Packet loss SLA: <1% 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 6

Why NFV + SDN falls short ? Packet loss SLA: <1% 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 6

Why NFV + SDN falls short ? Packet loss SLA: <1% 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 6

Why NFV + SDN falls short ? Packet loss 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 6

Why NFV + SDN falls short ? Packet loss 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 6

Why NFV + SDN falls short ? Packet loss 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 6

Why NFV + SDN falls short ? Packet loss 1. SLAs 2. Cost 3. Accuracy Reroute new flows Reroute existing flows Wait for flows to die 6

SLAs + cost + accuracy: What do we need? • Quickly move, copy, or share internal NF state alongside updates to network forwarding state • Guarantees: loss-free, order- preserving, …    … 1 2 3 … Also applies to other scenarios 7

Outline • Motivation and requirements • Challenges • OpenNF architecture – State export/import – State operations – Guarantees • Evaluation 8

Challenges 1. Supporting many NFs with minimal changes 2. Dealing with race conditions 3. Bounding overhead 9

Existing approaches • Virtual machine replication – Cannot combine → limited rebalancing • Split/Merge [NSDI’13] – State allocations and accesses occur via library – Addresses a specific problem → limited suitability – Packets may be dropped or re-ordered → wrong NF behavior 10

OpenNF overview Control Application move/copy/share state OpenNF NF State Manager Flow Manager Controller export/import State 11

NF state taxonomy State created or updated by an NF applies to either a single flow or a collection of flows Multi-flow state Per-flow state TcpAnalyzer Connection HttpAnalyzer ConnCount Connection TcpAnalyzer All-flows state HttpAnalyzer Statistics 12

NF API: export/import state • Functions: get , put , delete put Per Scope Multi All Filter get NF No need to expose/change internal state organization! 13

Control operations: move Control Application Flow Manager NF State Manager Bro 1 Bro 2 14

Control operations: move Control Application Flow Manager move (port=80, Bro 1 , Bro 2 ) NF State Manager Bro 1 Bro 2 14

Control operations: move Control Application Flow Manager move (port=80, Bro 1 , Bro 2 ) NF State Manager get(per, port=80) Bro 1 Bro 2 14

Control operations: move Control Application Flow Manager move (port=80, Bro 1 , Bro 2 ) NF State Manager get(per, port=80) [Chunk1] [Chunk2] Bro 1 Bro 2 14

Control operations: move Control Application Flow Manager move (port=80, Bro 1 , Bro 2 ) NF State Manager get(per, port=80) [Chunk1] del(per, port=80) [Chunk2] Bro 1 Bro 2 14

Control operations: move Control Application Flow Manager move (port=80, Bro 1 , Bro 2 ) NF State Manager get(per, port=80) put (per, Chunk1) [Chunk1] del(per, port=80) put (per, Chunk2) [Chunk2] Bro 1 Bro 2 14

Control operations: move Control Application Flow Manager move (port=80, Bro 1 , Bro 2 ) forward(port=80, Bro 2 ) NF State Manager get(per, port=80) put (per, Chunk1) [Chunk1] del(per, port=80) put (per, Chunk2) [Chunk2] Bro 1 Bro 2 14

Control operations: move Control Application Flow Manager move (port=80, Bro 1 , Bro 2 ) forward(port=80, Bro 2 ) NF State Manager get(per, port=80) put (per, Chunk1) [Chunk1] del(per, port=80) put (per, Chunk2) [Chunk2] Bro 1 Bro 2 Also provide copy and share 14

Challenges 1. Supporting many NFs with minimal changes 2. Dealing with race conditions 3. Bounding overhead 15

Lost updates during move detect- MHR Bro 1 Bro 2 16

Lost updates during move detect- MHR R1 B1 Bro 1 Bro 2 16

Lost updates during move detect- move(red,Bro 1 ,Bro 2 ) MHR R1 B1 Bro 1 Bro 2 16

Lost updates during move detect- move(red,Bro 1 ,Bro 2 ) MHR R1 B1 Bro 1 Bro 2 16

Lost updates during move detect- move(red,Bro 1 ,Bro 2 ) MHR Missing R1 state B1 R2 Bro 1 Bro 2 16

Lost updates during move detect- move(red,Bro 1 ,Bro 2 ) MHR Missing R2 R1 state B1 Bro 1 Bro 2 16

Lost updates during move detect- move(red,Bro 1 ,Bro 2 ) MHR Missing R2 R1 state B1 Bro 1 Bro 2 16

Lost updates during move detect- move(red,Bro 1 ,Bro 2 ) MHR Missing Missing R2 R1 state updates B1 R3 Bro 1 Bro 2 16

Lost updates during move detect- move(red,Bro 1 ,Bro 2 ) MHR Missing Missing R2 R1 state updates B1 R3 Bro 1 Bro 2 16

Lost updates during move detect- move(red,Bro 1 ,Bro 2 ) MHR Missing Missing R2 R1 state updates B1 R3 Bro 1 Bro 2 Loss-free: All state updates should be reflected in the transferred state, and all packets should be processed • Split/Merge [NSDI ‘13] : pause traffic, buffer packets – Packets in-transit when buffering starts are dropped 16

NF API: observe/prevent updates using events NF R1 Only need to change an NF’s receive packet function! 17

Use events for loss-free move R1 Bro 1 Bro 2 18

Use events for loss-free move 1. enableEvents(red,drop) on Bro 1 R1 Drop Bro 1 Bro 2 18

Use events for loss-free move 1. enableEvents(red,drop) on Bro 1 2. get / delete on Bro 1 Drop Bro 1 Bro 2 R1 18

Use events for loss-free move 1. enableEvents(red,drop) on Bro 1 2. get / delete on Bro 1 Drop R2 Bro 1 Bro 2 R1 18

Use events for loss-free move 1. enableEvents(red,drop) on Bro 1 2. get / delete on Bro 1 3. Buffer events at controller Drop Bro 1 Bro 2 R1 R2 18

Use events for loss-free move 1. enableEvents(red,drop) on Bro 1 2. get / delete on Bro 1 3. Buffer events at controller 4. put on Bro 2 R1 Drop Bro 1 Bro 2 R2 18

Use events for loss-free move 1. enableEvents(red,drop) on Bro 1 2. get / delete on Bro 1 3. Buffer events at controller 4. put on Bro 2 5. Flush packets in events to Bro 2 R1,R2 R1 Drop Bro 1 Bro 2 18

Use events for loss-free move 1. enableEvents(red,drop) on Bro 1 2. get / delete on Bro 1 3. Buffer events at controller 4. put on Bro 2 5. Flush packets in events to Bro 2 R1,R2 R1 Drop 6. Update Bro 1 Bro 2 forwarding 18

Use events for loss-free move 1. enableEvents(red,drop) on Bro 1 2. get / delete on Bro 1 3. Buffer events at controller 4. put on Bro 2 5. Flush packets in events to Bro 2 R1,R2,R3 R1,R2 R1 Drop 6. Update Bro 1 Bro 2 forwarding 18

Re-ordering of packets • False positives from Bro’s weird script Switch Bro 2 Bro 1 Controller 19

Re-ordering of packets • False positives from Bro’s weird script Switch Bro 2 Bro 1 Controller 5. Flush buffer R2 R2 R2 19

Re-ordering of packets • False positives from Bro’s weird script Switch Bro 2 Bro 1 Controller 5. Flush buffer R2 6. Request R2 forwarding update R2 19