Implemen'ng IPv6 Segment Rou'ng in the Linux Kernel

Transcription

1 Implemen'ng IPv6 Segment Rou'ng in the Linux Kernel David Lebrun, Olivier Bonaventure ICTEAM, UCLouvain Work supported by ARC grant 12/ (ARC-SDN) and a Cisco grant

2 Agenda IPv6 Segment Rou'ng Implementa'on in the Linux kernel Performance evalua'on

3 What is Segment Rou'ng? The return of Source Rou'ng Each packet contains a loose route to encode any path inside the network Packet along shortest path to R5 R5->R2->R6 Normal IPv6 forwarding R3 R5->R2->R6 R5 Packet along shortest path to R2 R1 Packet along shortest path to R6 R2 R2->R6 ->R6 R7 ->R6 R6 Normal IPv6 forwarding

4 h`ps://tools.iec.org/html/drad-iec-6man-segment-rou'ng-header-06 IPv6 Segment Rou'ng Basic principles IGP distributes IPv6 prefixes and router loopback addresses Loose source route encoded inside IPv6 extension header containing a list of segments Main types of segments Node segment (router's loopback address) Adjacency segment (router outgoing interface) Virtual func'on (operator defined func'on) h'p://

5 The IPv6 Segment Rou'ng Header Remaining segments Index of last segment Each segment is one IPv6 address Extensibility

6 IPv6 Segment Rou'ng use cases Paths controlled by the endhosts Source adds SRH to all packets R1 R5->R2->R6->D R5->R2->R6->D R3 R2 R5->R2->R6->D R7 R5 R5->R2->R6->D R6 R5->R2->R6->D R5->R5->R6->D R5->R2->R6->D Des'na'on removes SRH from all packets

7 Network Func'on Virtualisa'on Force packets to pass through NFV FCT performed on R5 FCT R5->FCT->D R5->FCT->R6 R3 R5 R5->FCT->D R1 R5->FCT->D R6 R5->FCT->R6 R2 R7

8 Encap and decap Routers can also tunnel SRH packets Egress router decaps and removes SRH R1->R5->R7->R6 [->D] R1->R5->R7->R6 [->D] R3 R5 ->D ->D R1 R1->R5->R7->R6 [->D] R2 R7 R6 R1->R5->R7->R6 [->D] Ingress router encaps to R6 with SRH R1->R5->R7->R6 [->D]

9 Security: Learning from the past How to avoid past failures of source rou'ng?

10 The IPv6 SRH HMAC TLV Different keys and different hash func'ons can be used

11 U'lisa'on of the HMAC TLV All routers are configured with an HMAC key R3 R5 R1 R6 R2 R7 Clients receive SRH with HMAC key E.g. from SDN controlled Trusted servers configured with HMAC key

12 Agenda IPv6 Segment Rou'ng Implementa'on in the Linux kernel Performance evalua'on

13 Basics of Linux packet processing Forwarded packet Packet recvd for local process Packet sent by local process

14 Packet forwarding with IPv6 SR Router is one of the segments in the list SRH updated, Packet forwarded to next segment

15 Packet forwarding with IPv6 SR Egress router receiving encapsulated packet SRH processed encapsula'on removed

16 How to configure IPv6 SR? IPv6 SR implementa'on extends iproute2 Commands passed through rtnetlink Example Des'na'on match ip 6 route add fc42::/64 encap seg6 mode encap segs fc00::1,2001:db8::1,fc10::7 dev eth0 SRv6 encap Segments added in the encapsulated packet

17 SRH usage by applica'ons Endhosts can control the SRH on a per flow basis through the socket API

18 HMAC processing Three modes of opera'ons can be configured Ignore All packets are forwarded independently of the HMACs Verify Packets containing an HMAC are processed if HMAC is valid Packets without HMAC are processed Enforce Packets containing an HMAC are processed if HMAC is valid Packets without HMAC are processed

19 Agenda IPv6 Segment Rou'ng Implementa'on in the Linux kernel Performance evalua'on

20 Lab measurements 10 Gbps Ethernet 10 Gbps Ethernet Lab setup Intel Xeon X3440 processors (4 cores 8 threads at 2.53 GHz 16 GB of RAM two Intel Gbps Ethernet One queue per CPU, one IRQ per queue Linux kernel 4.11-rc3, TSO and GRO disabled Traffic generator Pktgen, in-kernel module sending UDP packets

21 First measurements with one CPU Baseline Plain IPv6 forwarding Why this gap? No difference between SRH forwarding and encap+forwarding

22 Performance limita'ons of the first implementa'on Route lookup Des'na'on cache was implemented for locally generated packets but not forwarded ones Fixed with a dest cache Issue with memory alloca'on Forced free to take a slow path involving spinlocks in case packet was processed by different CPU than NIC IRQ Fixed with a be`er u'lisa'on of the skb

23 Improved performance on one CPU IPv6 SRH forwarding and encap are now close to plain IPv6 packet fowarding performance

24 Does packet size affect performance? bytes 1000 bytes

25 Cost of HMAC Special intel instruc'ons Pure C code

26 Leveraging mul'ple cores Performance scales well with the number of physical CPUS

27 Conclusion IPv6 Segment Rou'ng has matured Stable specifica'on Various use cases Implementa'on in the Linux kernel Endhost func'ons for clients and servers Router func'ons Performance evalua'on Good forwarding and encap/decap performance Unsurprisingly HMAC TLV affects performance h'p://