1 / 35

Software Defined Networking COMS 6998- 8 , Fall 2013

Software Defined Networking COMS 6998- 8 , Fall 2013. Instructor: Li Erran Li ( lierranli@cs.columbia.edu ) http://www.cs.columbia.edu/ ~lierranli/coms6998-8SDNFall2013/ 10/1/2013: SDN Programming language and Verification. Outline. SDN programming language

bikita
Télécharger la présentation

Software Defined Networking COMS 6998- 8 , Fall 2013

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Software Defined NetworkingCOMS 6998-8, Fall 2013 Instructor: Li Erran Li (lierranli@cs.columbia.edu) http://www.cs.columbia.edu/~lierranli/coms6998-8SDNFall2013/ 10/1/2013: SDN Programming language and Verification

  2. Outline • SDN programming language • Maple: generic programming language syntax such as Java, Python (previous lecture) • Frenetic NetCore/NetKAT: domain specific programming language (previous lecture) • Pyretic by Josh Reich • SDN Verification • Verification of controller correctness (previous lecture) • Verification of network properties Software Defined Networking (COMS 6998-8)

  3. Review of Previous Lecture What is algorithmic policies • Function in a general purpose language that describes how a packet should be routed, not how flow tables are configured. • Conceptually invoked on every packet entering the network; may also access network environment state; hence it has the form: • Written in a familiar language such as Java, Python, or Haskell Software Defined Networking (COMS 6998-8) Source: Andreas Voellmy, Yale

  4. Example Algorithmic Policy in Java Review of Previous Lecture (Cont’d) Does not specify flow table configutation Route f(Packet p, Env e) { if (p.tcpDstIs(22)) returnnull(); else { Locationsloc = e.location(p.ethSrc()); Locationdloc = e.location(p.ethDst()); Path path = shortestPath(e.links(), sloc,dloc); returnunicast(sloc,dloc,path); } } Software Defined Networking (COMS 6998-8) Source: Andreas Voellmy, Yale

  5. Review of Previous Lecture (Cont’d) Certified NetKAT Controller • Each level of abstraction formalized in Coq • Machine-checked proofs that the transformations between levels preserve semantics • Code extracted to OCaml and deployed with real switch hardware NetKAT Compiler Flow tables Optimizer Run-time system OpenFlow messages Software Defined Networking (COMS 6998-8) Source: Nate Foster, Cornell

  6. Verification of Network Properties • Motivations • NetPlumber: Real time policy checking tool • How it works • How to check policy • How to parallelize • Evaluation on Google WAN • Conclusions Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  7. Network debugging is hard! • Forwarding state is hard to analyze! . . . . . . Rule Rule Rule Rule . . . Rule Rule Rule Rule Rule Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  8. Network debugging is hard! • Forwarding state is hard to analyze! • Distributed across multiple tables and boxes • Written to network by multiple independent writers (different protocols, network admins) • Presented in different formats by vendors • Not directly observable or controllable • Not constructed in a way that lend itself well to checking and verification Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  9. Header Space Analysis: Snapshot-based Checking a TA TD TC TB Can host a talk to host b? b Is there any forwarding loop in the network? Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  10. Real-Time Incremental Checking + - - + Time Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  11. Real-Time Incremental Checking Time Set of Policies/Invariants ? - + - + Yes/No • Prevent errors before they hit network • Report a violation as soon as it happens Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  12. Verification of Network Properties • Motivations • NetPlumber: Real time policy checking tool • How it works • How to check policy • How to parallelize • Evaluation on Google WAN • Conclusions Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  13. NetPlumber • The System for real time policy checking is called NetPlumber App App App App Controller Logically centralized location to observe the state changes State updates SNMP Trap NetPlumber Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  14. NetPlumber • The System we build for real time policy checking is called NetPlumber • Creates a dependency graph of all forwarding rules in the network and uses it to verify policy • Nodes: forwarding rules in the network • Directed Edges: next hop dependency of rules Switch 1 Switch 2 R1 R2 Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  15. NetPlumber– Nodes and Edges 0 X 1 X 1 0 0 1 1 0 X X S S Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  16. NetPlumber– Intra table dependency S S Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  17. NetPlumber– Computing Reachability A B Source Node S S ? Probe Node Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  18. NetPlumber– Computing Reachability with Updates Create directed edges A New rules installed B Source Node S S ? Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  19. NetPlumber– Computing Reachabilitywith Updates • Create directed edges • Route flows • Update intra-table dependency A B - Source Node S S ? Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  20. NetPlumber– Checking Policy Back-tracing to check if 0010 packets go through RED box A B Source Node S S ? Policy:packets go through RED box. Software Defined Networking (COMS 6998-8)

  21. NetPlumber– Checking Policy Back-tracing to check if 0010 packets go through RED box Update policy checking with rule deletion A B Source Node S S ? Policy:packets go through RED box. Software Defined Networking (COMS 6998-8)

  22. Checking Policy with NetPlumber Policy: Guests can not access Server S. G1 S G2 . . . . . . . . . . . . ? . . . . . . . . . . . . Software Defined Networking (COMS 6998-8)

  23. Checking Policy with NetPlumber Policy: http traffic from client C to server S doesn’t go through more than 4 hops. C S . . . . . . . . . . . . ? HTTP . . . . . . . . . . . . Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  24. Checking Policy with NetPlumber Policy: traffic from client C to server S should go through middle box M. C M S . . . . . . . . . . . . ? . . . . . . . . . . . . Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  25. Why the dependency graph helps • Incremental update • Only have to trace through dependency sub-graph affected by an update • Flexible policy expression • Probe and source nodes are flexible to place and configure • Parallelization • Can partition dependency graph into clusters to minimize inter-cluster dependences Software Defined Networking (COMS 6998-8)

  26. Distributed NetPlumber S ? Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  27. Dependency Graph Clustering S ? Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  28. ? ? Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  29. Verification of Network Properties • Motivations • NetPlumber: Real time policy checking tool • How it works • How to check policy • How to parallelize • Evaluation on Google WAN • Conclusions Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  30. Experiment On Google WAN • Google Inter-datacenter WAN. • Largest deployed SDN, running OpenFlow • ~143,000 OF rules Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  31. Experiment On Google WAN ? Policy check: all 52 edge switches can talk to each other More than 2500 pairwise reachability check Used two snapshots taken 6 weeks apart Used the first snapshot to create initial NetPlumber state and used the diff as a sequential update Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  32. Experiment On Google WAN Default/Aggregate Rules Run time with Hassel > 100s Not much more benefit! Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  33. Benchmarking Experiment For a single pairwise reachability check. Software Defined Networking (COMS 6998-8) Source: P. Kazemian, Stanford

  34. Conclusions • Designed a protocol-independent system for real time network policy checking • Key component: dependency graph of forwarding rule, capturing all flow paths • Incremental update • Flexible policy expressions • Parallelization by clustering Software Defined Networking (COMS 6998-8)

  35. Questions? Software Defined Networking (COMS 6998-8)

More Related