CS434/534: Topics in Networked (Networking) Systems

Transcription

1 CS434/534: Topics in Networked (Networking) Systems High-Level Language for Programmable Networks: A Blackbox Approach Yang (Richard) Yang Computer Science Department Yale University 208A Watson yry@cs.yale.edu

2 Outline Admin and recap Datapath programming 2

3 Recap: Datapath Model A fundamental data structure of networking systems devices is lookup tables What are potential lookup attributes matchattr1 matchattr2 matchattrn out What are values of lookup attributes? 3

4 Recap: Datapath Model Low-level TCAM based computing model with limited resources 4

5 Recap: Populating Datapath (Tables) Traditional network Distributed protocols Vendor manual configuration Programmable network Controller setup 5

6 Outline Admin and recap Datapath model content programming 6

7 Programmable Network logically centralized data store Program Network View Service/ Policy NE Datapath NE Datapath 7

8 Discussion How one may automate the generation of datapath model content? 8

9 Outline Admin and recap Datapath model content programming Higher-level logic driven user programming 9

10 An Example Higher-Level Logic badport = 22 // policy hosttbl = {A:1,B:2, C:3,D:4} // net view def onpacketin(p): if badport == p.tcp_dst: drop else: forward([hosttbl(p.eth_dst)]) Logic: - Assume only packets to A,B,C,D can appear - Block traffic to SSH (port 22) A B C D 10

11 Higher-Level Logic with Datapath Generation hosttbl = {A:1,B:2,C:3,D:4} def onpacketin(p): if 22 == p.tcp_dst: drop installrule({ match':{'tcp_dst':22}, action :[]}) else: forward([hosttbl(p.eth_dst)]) match does not support logic negation installrule({ match : { eth_dst :p.eth_dst, tcp_dst!=22}, action :[hosttbl(p.eth_dst)]}) 11

12 Higher-Level Logic with Datapath Generation hosttbl = {A:1,B:2,C:3,D:4} def onpacketin(p): if 22 == p.tcp_dst: drop installrule({ priority :1, match :{'tcp_dst':22}, action :[]}) else: forward([hosttbl(p.eth_dst)]) installrule({ priority :0, match : { eth_dst :p.eth_dst}, action :[hosttbl(p.eth_dst)]}) 12

13 Does the Program Work? Switch EthDst:A, TcpDst:80 {`priority`:0, match :{ eth_dst :A},'action':[1]} A security bug! EthDst:A, TcpDst:22 def onpacketin(p): if 22 == p.tcp_dst: // drop Controller installrule({`priority`:1, match :{ tcp_dst':22},'action':[]}) else: installrule({`priority`:0, match :{ eth_dst :p.eth_dst}, 'action':[hosttbl(p.eth_dst)]}) // forward([hosttbl(p.eth_dst)]) 13

14 Outline Admin and recap Datapath model content programming Higher-level logic driven user programming Higher-level logic driven automatic programming 14

15 Goal Programmers write only the logic (=> data path independent) code: def onpacketin(p) if 22 == p.tcp_dst: drop else: forward([hosttbl(p.eth_dst)]) System automatically generate correct, highlyoptimized data path 15

16 Programming Model: Programmer s View Conceptually programmer s network control function f is invoked on every packet entering the network. f expressed in an existing, general purpose language (e.g., Java, Python), describing how a packet should be routed, not how data path flow tables are configured f: packet route 16

17 Discussion: How to turn this program automatically into datapath flow rules? Route f(packet p) { if (p.tcpdstis(22)) return null(); else { Location sloc = hosttable(p.ethsrc()); Location dloc = hosttable(p.ethdst()); Route path = myroutingalg(topology(), sloc,dloc); return path; } } Route myroutingalg(topology topo, Location sloc, Location dloc) { if ( issensitive(sloc) issensitive(dloc) ) return secureroutingalg(topo, sloc, dloc); else return standardroutingalg(topo, sloc, dloc); } Example High-level Program Does not specify anything on flow tables! 17

18 Two Types of Approaches Compiler based Blackbox Although the decision function f does not specify how flow tables are configured, if for a given decision (e.g., drop), we know the dependency of the decision, we can construct the flow tables (aka, memorization tables). 18

19 Basic Idea Only requirement: Program f uses a simple library to access pkt attributes: Library provides both convenience and more importantly, decision dependency! 19

20 Policy EthSrc:1, EthDst:2, TcpDst:80 Route f(packet p) { if (p.tcpdstis(22)) Assert: TcpDst==22 return null(); false else { Location sloc = hosttable(p.ethsrc()); Location dloc = hosttable(p.ethdst()); EthSrc 1 EthDst } } Route path = myroutingalg( topology(),sloc,dloc); return path; 2 path1 Q: What rules do we generate for this execution? 20

21 Policy EthDst:1, TcpDst:22 Route f(packet p) { if (p.tcpdstis(22)) Assert: TcpDst==22 Assert: TcpDst==22 true return null(); null true false else { Location sloc = hosttable(p.ethsrc());? EthSrc Location dloc = hosttable(p.ethdst()); 1 EthDst } Route path = myroutingalg( topology(),sloc,dloc); return path; 2 path1 21

22 Policy Trace Tree EthDst:1, TcpDst:22 Route f(packet p) { if (p.tcpdstis(22)) Assert: TcpDst==22 return null(); else { true false Location sloc = hosttable(p.ethsrc()); null EthSrc Location dloc = hosttable(p.ethdst()); 1 EthDst } Route path = myroutingalg( topology(),sloc,dloc); return path; 2 path1 22

23 Blackbox Program->Trace Tree true Assert: TcpDst==22 false A tree w/ 4 types of nodes T node: assertion on packet attributes V node: multi-way branching on a packet attribute L node: leaf node labeled w/ action? node: unknown? EthSrc 1 EthDst 2 path1 TT correctness: if TT records an answer for a given packet, the answer is the same as the original algorithm 23

24 Trace Tree => Datapath tcpdst ==22 True False drop match:{tcpdst==22} 2 ethdst 4 drop match:{tcpdst!=22, ethdst:2} ethsrc 6 port 30 match:{tcpdst!=22, ethdst:4,ethsrc:6} 24

25 Trace Tree => Datapath tcpdst ==22 True False drop match:{tcpdst==22} 2 ethdst 4 barrier rule: match:{tcpdst==22} action:tocontroller Priority drop match:{tcpdst!=22, ethdst:2} ethsrc 6 port 30 match:{tcpdst!=22, ethdst:4,ethsrc:6} 25

26 Trace Tree => Datapath Simple, classical inorder tree traversal generates datapath! 3 True tcpdst ==22 False 1 drop 2 ethdst match:{tcpdst==22} 2 4 barrier rule: match:{tcpdst==22} action:tocontroller Priority drop match:{tcpdst!=22, ethdst:2} ethsrc 6 port 30 match:{tcpdst!=22, ethdst:4,ethsrc:6} 26

27 Trace Tree => Datapath Potential inefficiencies? tcpdst ==22 True False drop Pri: 3 match:{tcpdst==22} 2 ethdst 4 barrier rule: Pri: 2 match:{tcpdst==22} action:tocontroller Priority drop Pri: 1 match:{tcpdst!=22, ethdst:2} ethsrc 6 port 30 Pri:0 match:{tcpdst!=22, ethdst:4,ethsrc:6} 27

28 Outline Admin and recap Datapath model content programming Higher-level logic driven user programming Higher-level logic driven automatic programming Basic idea Remove inefficiencies 28

29 Problem: How to Handle User Inefficiency, such as Redundant Trace? 29

30 Example: Trace Reduction 30

31 31

32 32

33 33

34 34

35 35

36 Problem: Simple In-order Traversal Generates Unstable Rules disjoint, could use same priority. 36

37 Solution: Minimizing Priority Levels: Increasing at T Nodes Only 37

38 Minimizing Priority Levels: Increasing at T Nodes Only 38

39 Anatomy of a Network Control Function Map<MAC, Location> hosttable; List<ACLItem> acls; Route f(packet p) { External process may change the states state hosttable.put(p.ethsrc(), p.ingressport()); if (!permit(p, acls) ) return drop; Location src = p.ingressport(); Location dst = hosttable.get( p.ethdst() ); Has f uses physical states f uses policy state Route path = myroutingalg(topology(), src, dst); return path; } 39

40 Implication A general AP is a general function of the form: f: (packet, state) (route, new-state, act) When state changes, decision may change too. If f() takes non-switch-implementable actions (e.g., causes state changes, sends packets), the packet should be punted back to the controller. 40

41 Outline Admin and recap Datapath model content programming Higher-level logic driven user programming Higher-level logic driven automatic programming Basic idea Remove inefficiencies Handle dynamism 41

42 Existing Approaches on Handling State Dependency Floodlight Wait for timeout of existing rules Problem: long delay; may not even be correct Pyretic Completely rerun (a declarative) program and then compare the differences Problem: extreme low efficiency 42

43 43 Simple Design Only requirement: Control program f uses simple library wrappers to access state variables Reason: Provides both convenient data structures and importantly, again, decision dependency!

44 44 Policy EthSrc:1, EthDst:2, TcpDst:80 Route f(packet p) { if (p.tcpdstis(22)) return null(); Assert: TcpDst==22 false else { Location sloc = hosttable(p.ethsrc()); Location dloc = hosttable(p.ethdst()); EthSrc 1 (hosttable, 1) Dependency table (aka inverted index) Component Traces } } Route path = myroutingalg( topology(),sloc,dloc); return path;

45 45 Policy EthSrc:1, EthDst:2, TcpDst:80 Route f(packet p) { if (p.tcpdstis(22)) return null(); Assert: TcpDst==22 false else { Location sloc = hosttable(p.ethsrc()); Location dloc = hosttable(p.ethdst()); EthSrc 1 (hosttable, 1) Dependency table (aka inverted index) Component Traces } } Route path = myroutingalg( topology(),sloc,dloc); return path; (hosttable,1) [false, 1]

46 46 Policy EthSrc:1, EthDst:2, TcpDst:80 Route f(packet p) { if (p.tcpdstis(22)) Assert: TcpDst==22 return null(); false else { } } Location sloc = hosttable(p.ethsrc()); Location dloc = hosttable(p.ethdst()); Route path = myroutingalg( topology(),sloc,dloc); return path; EthSrc EthDst 1 (hosttable, 1) 2 (hosttable, 2) Dependency table (aka inverted index) Component Traces (hosttable,1) [false, 1] (hosttable,2) [false, 1,2]

47 47 Policy EthSrc:1, EthDst:2, TcpDst:80 Route f(packet p) { if (p.tcpdstis(22)) return null(); Assert: TcpDst==22 false else { } } Location sloc = hosttable(p.ethsrc()); Location dloc = hosttable(p.ethdst()); Route path = myroutingalg( topology(),sloc,dloc); return path; EthSrc EthDst path1 1 (hosttable, 1) 2 (hosttable, 2) topology Dependency table (aka inverted index) Component Traces (hosttable,1) [false, 1] (hosttable,2) [false, 1,2] topology [false,1,2]

48 Example Dependency Table? true 1 (hosttable, 1) Assert: TcpDsd==22 EthSrc false 3 (hosttable, 3) Dependency table (aka inverted index) Component (hosttable,1) [false, 1] (hosttable,2) [false, 1,2] (hosttable,3) [false, 3] (hosttable,4) [false, 3,4] topology Traces [false,1,2],[false,3,4] EthDst 2 (hosttable, 2) (topology()) path1 EthDst 4 path2 (hosttable, 4) (topology()) 48

49 Tradeoffs Between Tracking Overhead and Precision true Assert: TcpDsd==22 false host 1 link[1]: 1 link[2]: 2? EthSrc 1 (hosttable, 1) 3 link[3]: 1 link[4]: 2 EthDst 2 (hosttable, 2) 2) (links, (topology()) {1,2,3}) path1 EthDst 4 path2 host 2 Assume Dijkstra. Dijkstra will visit only 3 links. There is no dependency on link[4]. 49

50 Using Dependency Table? true 1 (hosttable, 1) Assert: TcpDsd==22 EthSrc false 3 (hosttable, 3) Dependency table (aka inverted index) Component (hosttable,1) [false, 1] (hosttable,2) [false, 1,2] (hosttable,3) [false, 3] (hosttable,4) [false, 3,4] topology Traces [false,1,2],[false,3,4] EthDst 2 (hosttable, 2) (topology()) path1 EthDst 4 path2 (hosttable, 4) (topology()) host 4 changes location => - Uses dependency table to locate dependent entries 50

51 Using Dependency Table? true 1 (hosttable, 1) Assert: TcpDsd==22 EthSrc false 3 (hosttable, 3) Dependency table (aka inverted index) Component (hosttable,1) [false, 1] (hosttable,2) [false, 1,2] (hosttable,3) [false, 3] (hosttable,4) [false, 3,4] topology Traces [false,1,2],[false,3,4] EthDst 2 (hosttable, 2) (topology()) path1 EthDst 4 path2 (hosttable, 4) (topology()) host 4 changes location => - Uses dependency table to locate dependent entries 51

52 Using Dependency Table? true 1 (hosttable, 1) Assert: TcpDsd==22 EthSrc false 3 (hosttable, 3) Dependency table (aka inverted index) Component (hosttable,1) [false, 1] (hosttable,2) [false, 1,2] (hosttable,3) [false, 3] (hosttable,4) [false, 3,4] topology Traces [false,1,2],[false,3,4] EthDst 2 (hosttable, 2) (topology()) path1 EthDst 4 path2 (hosttable, 4) (topology()) host 4 changes location => - Uses dependency table to locate dependent entries 52

53 Using Dependency Table? true 1 (hosttable, 1) Assert: TcpDsd==22 EthSrc false 3 (hosttable, 3) Dependency table (aka inverted index) Component (hosttable,1) [false, 1] (hosttable,2) [false, 1,2] (hosttable,3) [false, 3] (hosttable,4) [false, 3,4] topology Traces [false,1,2],[false,3,4] EthDst 2 (hosttable, 2) (topology()) path1 EthDst 4 path2 (hosttable, 4) (topology()) host 4 changes location => - Uses dependency table to locate dependent entries - Strong consistency: immediately clean up all related entries. 53

54 Using Dependency Table? true 1 (hosttable, 1) Assert: TcpDsd==22 EthSrc false 3 (hosttable, 3) Dependency table (aka inverted index) Component (hosttable,1) [false, 1] (hosttable,2) [false, 1,2] (hosttable,3) [false, 3] (hosttable,4) [false, 3,4] topology Traces [false,1,2],[false,3,4] EthDst 2 (hosttable, 2) (topology()) path1 EthDst 4 path2 (hosttable, 4) (topology()) host 4 changes location => - Uses dependency table to locate dependent entries - Fast repair: saves trigger packets and uses background to repair 54

55 Problems of Trace Tree Quality: Compiles to only a single flow table Latency: A reactive approach that waits for punted packets to begin unfolding the trace tree and generating rules 55