State Replication for Programmable Stateful Data Planes in SDN

Transcription

1 State Replication for Programmable Stateful Data Planes in SDN Paolo Giaccone Giuseppe Bianchi, Andrea Bianco, Marco Bonola, Abubakar Muqaddas, Janvi Palan, German Sviridov, Angelo Tulumello Workshop on P4 Milano, February 2 nd

2 Outline Stateful SDN LODGE framework optimal state replication implementation P4 and Open Packet Processor (OPP) Related topics on SDN 2

3 Stateful SDN dataplane Openflow / vanilla SDN stateless switches, all the states in the controller limited reactivity due to the (logically) centralized approach OpenState, OpenPacketProcessor (OPP), P4 allow some level of stateful processing (e.g., finite state machines) within switches enabled by new generation of hardware 6.5Tbps Tofino Barefoot Networks 3

4 State description SNAP as abstraction to describe a network application proposed in [A] dependency graph to describe the relation between different states Figure 3: The equivalent xfdd for [A] "SNAP: Stateful network-wide abstractions for packet processing" in ACM SIGCOMM, August

5 Placement of global states in SNAP, single copy for each global state all the flows affecting one global state must pass through the node storing the state possible network bottleneck state placement and traffic routing problem given a sequence of states affected by each flow find: where to place a state and how to route data traffic in order to minimize the total traffic in the network 5

6 Our contributions LODGE local decisions at the switches based on global states multiple replicas for each global state Optimization problem optimal replication of global states where to place each copy of a state and how to route the flow to any replica of a state Integer Linear Programming (ILP) formalization approximation algorithm Implementation design of the architecture proof of concept in P4 and OPP 6

7 Copies for state replication state replication requires synchronization traffic between the nodes storing the states few copies of the same state highest data traffic, lowest synch traffic tradeoff between data and synch traffic X X 1 and X 2 : copies of the same state X X 1 X 2 data traffic synch traffic 7

8 Optimal state replication find optimal number of copies per state placement of the copies for each state flow routing such that the max congestion on any link is minimized traffic on link = data traffic + synch traffic 9

9 Implementation abstractions P4 Open Packet Processor (OPP) stateful data plane abstraction allows the definition of per-flow extended Finite State Machine (XFSM) directly in the data plane stage n (stateless) stage n+1 (stateful) match action DROP OUT1.. flow key state 12ef fa3baa match current state action next state DROP OUT1 1.. Fig. 1: Example of Open Packet Processor (OPP) pipeline 14

10 Practical design issues / 1 generation of synchronization traffic self-triggered / periodic not available in P4 or OPP controller-triggered updates controller sends a triggering message limited temporal precision impairs the scalability of the controller traffic-triggered updates triggered by packet reception events once every p packets in P4 the first packet after T time in OPP 15

11 Practical design issues / 2 consistency model among replicas strong vs eventual consistency if tolerated by the network application, eventual consistency is preferred to strong consistency higher reactivity format of update packets (key,value) representation for each state key is an integer value set by the controller ad-hoc layer 3 packet format in P4 MPLS header in OPP propagation of state updates multicast distribution tree 16

12 Experimental setup network emulated through mininet stateful switches: SW1, SW2, SW3, SW4 DDoS from 4 AS to internal server clusters server cluster 1 ASN1 ASN2 R1 SW1 R2 SW4 SW2 server cluster 4 R4 SW3 R3 server cluster 2 ASN4 ASN3 server cluster 3 17

13 Distributed Detection of DDoS each switch individually evaluates the total traffic entering the whole network exploit temporal correlation between evil traffic entering from neighbor networks pseudocode at each switch s L locally measured traffic s R remotely measured traffic s G global traffic in the whole network s G =s L +s R if s G > threshold, then network is under attack 18

14 Detection in P4/OPP Packets/time s G at SW1 s L at SW1 s R at SW1 s G at SW3 s L at SW3 s R at SW Time [seconds] 19

15 Data vs synch traffic tradeoff between data and synchronization traffic P4 and OPP behave the same P4 Data Sync Packets/time 1c 2c 4c 1c 2c 4c 1c 2c 4c 1c 2c 4c 1c 2c 4c 1c 2c 4c 1c 2c 4c 1c 2c 4c R1-SW1 SW1-R2 R2-SW2 SW2-R3 R3-SW3 SW3-R4 R4-SW4 SW4-R1 20

16 Conclusions State replication for stateful SDN approach optimal state placement Efficient implementation in P4 and OPP is feasible approach applicable to other distributed network applications 21

17 Other related topics stateful SDN approach traffic classification caching in ICN networks SDN ONOS inter-controller traffic misbehaving controllers 22

18 OpenState and traffic monitoring minimize the amount of packets to inspect in Traffic Classifier by installing a proper finite state machine in the OpenState switch 23

19 OpenState and ICN node each Information Centric Networks (ICN) node supports local caching of contents we implemented the cache controller accessing the Content Store (CS) and the Pending Interest Table (PIT) though OpenState S/N-DN Node Host P1 P3 Switch P2 P1 P4 P3 P2 P4 Agent P2 Server Cache UDP ports UDP payl 24

20 Inter-controller traffic in ONOS synchronization traffic between shared data structures in clusters of controllers depends on the adopted protocol to support eventual/strong consistency experimental model to estimate exactly the control traffic exchanged between controllers useful for network planning and optimal controller location inter-controller traffic can be quite large! 25

21 Misbehaving controllers we implemented a behavioral check module (BeCHeck) to compare the messages from different controllers and identify misbehaviors 7'$<== 7'$<== 7'$<==!"#$%"&&'% (!"#$%"&&'%)*!"#$%"&&'%)+ >.7) 4"#$%"&&'%?!"#$%"&&'% 3/#6&'% 7'$8"%5) 3/#6&'% 12)$/0&',-.)$/0&'!3'45'% 9'!3'45 :"6;&' 7'$8"%5 26

22 References 1. German Sviridov, Marco Bonola, Angelo Tulumello, Paolo Giaccone, Andrea Bianco, Giuseppe Bianchi, LODGE: LOcal Decisions on Global states in programmable data planes, under submission, 2. Ahsan Mahmood, Claudio Casetti, Carla Fabiana Chiasserini, Paolo Giaccone, Jerome Harri, Efficient Caching through Stateful SDN in Named Data Networking, Transaction on Emerging Telecommunication Tecnologies, in press 3. Tianzhu Zhang, Andrea Bianco, Paolo Giaccone, Aliakbar Payandehdari Nezhad, Dealing with misbehaving controllers in SDN networks, IEEE Globecom, Singapore, Dec Tianzhu Zhang, Paolo Giaccone, Andrea Bianco, Samuele De Domenico, The Role of the Inter-Controller Consensus in the Placement of Distributed SDN Controllers, Computer Communications (Elsevier), Nov Abubakar Siddique Muqaddas, Paolo Giaccone, Andrea Bianco, Guido Maier, Inter-controller Traffic to Support Consistency in ONOS Clusters, IEEE Transactions on Network and Service Management, Jul Otherrelated publicationsare available on 27