Making Network Functions Software-Defined

Transcription

1 Making Network Functions Software-Defined Yotam Harchol VMware Research / The Hebrew University of Jerusalem Joint work with Anat Bremler-Barr and David Hay Appeared in ACM SIGCOMM 2016 THE HEBREW UNIVERSITY OF JERUSALEM This research was supported by the European Research Council ERC Grant agreement no , the Israeli Centers of Research Excellence (I-CORE) program (Center No. 4/11), and the Neptune Consortium.

2 Network Functions (Middleboxes) Firewall Monolithic closed black-boxes High cost Limited provisioning and scalability Load Balancer Network Function Virtualization (NFV): Reduce cost (by moving to software) Improve provisioning and scalability (by virtualizing software NFs) Intrusion Prevention System 2

3 Network Functions (Middleboxes) High cost Limited provisioning and scalability Limited and separate management Different vendors No standards Separate control plane 3

4 Network Functions (Middleboxes) Actually, many of these black-boxes are very modular High cost Limited provisioning and scalability Limited and separate management Network Function Limited functionality and limited innovation (High entry barriers) Similar complex processing steps, no re-use 4

5 OpenBox github.com/openboxproject OpenBox: A new software-defined framework for network functions Decouples network function control from their data plane Unifies data plane of multiple network functions Benefits: ü Easier, unified control ü Better performance ü Scalability ü Flexible deployment ü Inter-tenant isolation ü Innovation OpenBox Controller

6 Software Defined Networking High cost of middleboxes switches Limited provisioning and scalability of middleboxes switches Limited management of middleboxes switches Limited functionality and limited innovation Complex processing steps distributed algorithms OpenFlow Controller OpenBox Controller 40%-60% of the appliances in large-scale networks are middleboxes! [Sherry & Ratnasamy, 12] 6

7 The OpenBox Framework Northbound API Network Functions: OpenBox Applications Logically-Centralized OpenBox Controller Control Plane Data Plane OpenBox Protocol OpenBox Service Instances Additionally: ü Isolation between NFs / multiple tenants ü Support for hardware accelerators ü Dynamically extend the protocol 7

8 Observation: Most network functions do very similar processing steps But there is no re-use The design the OpenBox framework is based on this observation 8

9 Network Function Decomposition Firewall: Drop Read Packets Classifier Output Alert Load Balancer: Read Packets Classifier Rewrite Output Intrusion Prevention System: Drop Read Packets Classifier Alert Output 9

10 Northbound API Firewall Load Balancer Intrusion Prevention System Drop Drop Read Packets Classifier Output Read Packets Classifier Output Read Packets Classifier Alert Output Alert Rewrite OpenBox Applications Specify processing graph and block configuration NB API OpenBox Controller Events, Load information Control Plane Data Plane OpenBox Protocol OpenBox Service Instances 10

11 Logically-Centralized Controller Multiple tenants run multiple applications for multiple policies in the same network Isolation between applications and tenants enforced by NB API NB API OpenBox Applications Network-wide view Automatic scaling, provisioning, placement, and steering Control Plane Data Plane OpenBox Protocol OpenBox Controller SDN Protocol SDN Controller OpenBox Service Instances SDN Switches 11

12 Naïve Graph Merge Firewall: Read Packets Classifier Concatenated Processing Graph: Drop Drop Alert Output Read Packets Classifier Alert (Firewall) 10μs 2μs Intrusion Prevention 30μs System: Classifier 30μs Total: 134μs 50μs Performance Diameter of Graph (# of classifiers) Drop Drop Alert (IPS) 10μs Output 2μs Read Packets Classifier Alert Output 12

13 Graph Merge Algorithm Merged Processing Graph: Alert (Firewall) Algorithm and details are in the paper Alert (Firewall) Read Packets 2μs Classifier 30μs Alert (Firewall) Alert (Firewall) 10μs 50μs Alert (IPS) 10μs Drop Output 2μs Shorter Diameter (less classifiers) Total: 104μs (22% improvement) 13

14 OpenBox Data Plane Processing Read Packets Store Packet Alert HTML Normalizer Output Drop Terminals Classifier Restore Packet Caching Log Reporting JavaScript Normalizer XML Normalizer Normalization Classification FIFO Queue Front Drop Queue Gzip Decompress Gzip Compress De/compression VLAN Push VLAN Pop Rewrite Modification Leaky Bucket RED Queue Queue Management Commit Transaction Begin Transaction Transactions Rollback Transaction 14

15 OpenBox Data Plane Processing Read Packets Store Packet Alert HTML Normalizer Output Drop Terminals Classifier Restore Packet Caching Log Reporting JavaScript Normalizer XML Normalizer Normalization Gzip Decompress Classification FIFO Queue OpenBox Service Instance Leaky Bucket Virtual or Physical Front Drop Queue RED Queue Queue Management Gzip Compress Begin Transaction Provides data plane VLAN Push services to realize the logic of network functions De/compression Rewrite Commit Rollback Controlled by the logically-centralized OpenBox controller Transaction Transaction VLAN Pop Transactions Modification 15

16 Distributed Data Plane Alert Classifier Metadata Rewrite OpenBox Service Instance Hardware (TCAM) E.g., an OpenFlow switch with encapsulation features (e.g., NSH, Geneve, FlowTags) OpenBox Service Instance Software

17 Split Processing Graph HW Instance: Read Packets Classifier Write Metadata Encapsulate Metadata Output Drop SW Instance: Drop Read Packets Decapsulate Metadata Read Metadata Alert Output 17

18 Distributed Data Plane OpenBox Applications OpenBox Controller 2 HW 3 4 VM 5 VM A 1 6 B 18

19 Extensible Data Plane Media Encoder NB API NEW APP OpenBox Controller Option 2: Software module injection Custom software module (signed) Control Plane Data Plane OpenBox Protocol On the fly No need to recompile No need to redeploy Option 1: OpenBox Service Instances New hardware implementation Supports encapsulation 19

20 Scalable & Reliable Data Plane Scalability Provisioning Reliability OpenBox Controller Hypervisor Hypervisor 20

21 OpenBox Protocol: Connection Setup Controller Hello SetParametersRequest SetParametersResponse Service Instance AddCustomModuleRequest AddCustomModuleResponse BarrierRequest SetProcessingGraphRequest SetProcessingGraphResponse BarrierRequest 21

22 OpenBox Protocol Block Definition 22

23 OpenBox Protocol: Block Hierarchy Abstract Processing Block Classifier TCAMClassifier TrieClassifier Service Instance Hello Supported implementations: Classifier: [TCAMClassifier, TrieClassifier] SetProcessingGraphRequest Use TCAMClassifier in graph Controller 23

24 Implementation github.com/openboxproject Control Plane Data Plane 7500 LoCs (Java) Software OpenBox Service Instance FW Java-based OpenBox Controller Northbound API REST client/server REST API Graph Aggregator Network Manager Generic wrapper for execution engines (Python) Translation Engine IPS Load Balancer... Management API REST 5500 LoCs (Python) Click-based execution engine (C++) 2400 LoCs for plugin (C++) (Plug here other execution engines. E.g., ClickNP) 24

25 Implementation github.com/openboxproject Control Plane Data Plane Software OpenBox Service Instance FW Java-based OpenBox Controller Northbound API REST client/server REST API Graph Aggregator Network Manager Generic wrapper for execution engines (Python) Translation Engine IPS Load Balancer... Management API REST Work in progress: Hybrid Click-based HW-SW execution engine engine (C++) using Click and an OpenFlow switch 25

26 OpenBox with OpenFlow Hardware OpenFlow Controller OpenFlow protocol OpenBox Controller OpenBox protocol Hybrid OpenFlow Switch SW Hardware switch provides: classification Alerting / logging (through OFC) Output / drop blocks Hybrid splits processing graph: Prefix with only the above blocks à To switch Suffix à To SW (using Click) (Work in progress) 26

27 Performance Improvement Without OpenBox VM1 Firewall VM2 IPS With OpenBox VM1 1: FW+IPS VM2 2: FW+IPS Standalone VM NF Pipeline Throughput [Mbps] Firewall IPS Latency [µs] Throughput [Mbps] Without 1 With 2 OpenBox OpenBox Latency [µs] 27

28 Dynamic Load Balancing Without OpenBox VM1 Firewall1 With OpenBox VM1 1 VM2 Firewall2 VM2 2 28

29 Dynamic Load Balancing Without OpenBox VM1 Firewall With OpenBox VM1 1 VM2 IPS VM2 2 29

30 Graph Merge Algorithm è Improved Performance Gateway Firewall Web Cache Dept. Firewall Load Balancer Servers WAN Overall Throughput 900 Throughput [Mbps] Naïve Merge Our Algorithm 30

31 Control Channel Controller Service Instance RTT: 20ms RTT: 25ms RTT: 1285ms Hard-coded 1000 ms delay in Click code (can be reduced) 31

32 Related Work Orthogonal to OpenBox: NF traffic steering (e.g., SIMPLE [SIGCOMM 14]) NF orchestration (e.g., Stratos, OpenMano, OpenStack) Runtime platforms (e.g., xomb [ANCS 12], ClickNP [SIGCOMM 16]) Similar Motivation: CoMb [NSDI 12] focuses on resource sharing and placement E2 [SOSP 15] composition framework for virtual NFs Slick [SOSR 15] focuses on the placement of data plane units Only OpenBox provides: Core processing decomposition and reuse Standardization and full decoupling of NF control and data planes 32

33 Conclusions Network functions are currently a real challenge in large scale networks OpenBox decouples the data plane processing from network function control logic and: Reduces costs Enhances performance Improves scalability Increases reliability Provides inter-tenant isolation Allows easier innovation Control Plane Data Plane NB API OpenBox Protocol OpenBox Applications OpenBox Controller OpenBox Service Instances 33

34 Questions? THANK YOU! Play with OpenBox on a Mininet VM: github.com/openboxproject/openbox-mininet 34