SDN-NOX原版完整課件

NOX:TowardsanOperatingSystemforNetworksNatashaGude,TeemuKoponen,JustinPettit,BenPfaff,MartínCasado,NickMcKeown,ScottShenkerSIGCOMMCCR,2008PresentedbyYeTianforCourseCS05112OverviewBackgroundandMotivationNOXOverviewProgrammingInterfaceExampleApplicationsReviewBackgroundEnterprisenetworkiscomplex,hardtomanageManydevicesDifferentvendorsVariousprotocolsVariousservices

and

requirementsAnAnalogywithOSInearlydays,programswerewritteninmachinelanguagesNocommonabstractionsfortheunderlyingphysicalresources.Programsarehardtowrite,

port,reasonabout,and

debug.ModernoperatingsystemsFacilitateprogram

developmentProvidecontrolledaccessto

high-levelabstractionsfor

resourcesPanasonic

HHC,1981MotivationNetworksaremanagedthroughlow-levelconfigurationofindividualcomponents.BlockingauserwithACL:needtoknowntheuser’scurrentIPaddressForcingport80traffictoHTTPproxyrequiresextensiveknowingthecurrentnetworktopologyAnenterprisenetworkresemblesacomputerwithoutanoperatingsystem,Network-dependentcomponentconfigurationissimilartohardware-dependentmachine-languageprogramming.MotivationNeedanetworkoperatingsystemprovidestheabilitytoobserveandcontrolanetwork.Doesnotmanagethenetworkitself,butprovidesaprogrammaticinterface.Applicationsimplementedontopofthenetworkoperatingsystemperformtheactualmanagementtasks. MotivationWhat’sthedifference?Presentsprogramswithacentralizedprogrammingmodel;programsarewrittenasiftheentirenetworkwerepresentonasinglemachine.Programsarewrittenintermsofhigh-levelabstractions(e.g.,userandhostnames),notlow-levelconfigurationparameters(e.g.,IPandMACaddresses).Thesolution:NOXAvailableat/noxrepo/OverviewBackgroundandMotivationNOXOverviewProgrammingInterfaceExampleApplicationsReviewComponentsPrimarycomponentsAsetofswitches:

supportOpenFlow

abstractionOneormorenetwork-

attachedservers:

runNOXsoftwares;

canbethoughtofas

involvingseveral

differentcontroller

processesandasingle

networkview.GranularityNOX’snetworkview:Theswitch-leveltopology;thelocationsofusers,hosts,middle-boxes,andothernetworkelements;andtheservices(e.g.,HTTPorNFS)beingoffered.Allbindingsbetweennamesandaddresses.DoesNOTincludethecurrentstateofnetworktraffic.Toodynamic,hardtomaintainControlGranularityChoosingthegranularityinvolvestradingoffbetweenscalabilityvs.flexibility.Acentralizedper-packetcontrol:infeasibletoimplementacrossanysizablenetwork.Noscalability.Prefix-basedroutingtable:notallowsufficientcontrol,sinceallpacketsbetweentwohostswouldhavetofollowthesamepath.Noflexibility.Anintermediateflow-basedgranularityOncecontrolisexertedonsomepacket,subsequentpacketswiththesameheaderaretreatedinthesameway.SwitchAbstractionIndependentoftheparticularswitchhardware.Supporttheflow-levelcontrolgranularity.Switchesarerepresentedbyflowtableswithentrieslike:

<header:counters;actions>Foreachpacketmatchingthespecifiedheader,thecountersareupdatedandtheappropriateactionstaken.Ifapacketmatchesmultipleflowentries,theentrywiththehighestpriorityischosen.SwitchAbstractionBasicsetofOpenFlowactionsForwardasdefault(i.e.,forwardasifNOXwerenotpresent)ForwardoutspecifiedinterfaceDenyForwardtoacontrollerprocessModifyvariouspacketheaderfields(e.g.,VLANtags,sourceanddestinationIPaddressandport).OperationAttheswitch,IfanincomingpacketmatchesaflowentryataswitchUpdatestheappropriatecountersandappliesthecorrespondingactions.Ifdoesn’tmatch:Forwardedtoacontrollerprocess.Twocases:ThesepacketsoftenarethefirstpacketofaflowThecontrollerprocessesmaychoosetoreceiveallpacketsfromcertainprotocols.(e.g.,DNS)OperationNOXapplicationsuseflow-initiationsandotherforwardedtraffictoObserve:Constructthenetworkview.

UseDNS,DHCP,LLDP,andflow-initiationstoconstructthenetworkview,includingboththenetworktopologyandthesetofname-addressbindings.Control:Determinewhethertoforwardtraffic,and,ifso,whichroute.

Access-controlandroutingapplicationsthatdetermineifaflowshouldbeallowed,computeanappropriateL2route,installflowentriesinalltheswitchesalongthepath,andthenreturnthepackettotheoriginatingswitchScalingEventsinNOXPacketarrivals:millionspersec.Flowinitiations:oneormoreordersofmagnitudelessthanthepacketarrivalrate.Changesinthenetworkview:tensofeventspersecondfornetworksofthousandsofhosts.Persistency:Theonlynetworkstatethatisglobalconsistentisthenetworkview,canbehandledbythecentralizedcontroller.Neitherpacketstatenorflowstatearepartofthenetworkview,canbekeptinlocalstorage.ScalingUseparallelismtohandleeventsthatoccuronrapidtimescalesAsinglecontrollerprocessrunningonagenericPCcancurrentlyhandle100,000flowinitiationspersecond,morethansufficientforthelargecampusnetworkswe’vemeasuredinpreviousworkImplementationstatusImplementedwithPythonandC++,32,000lines.Runinuserspace.Manageaninternalnetworkofroughly30hostsforover6months.OverviewBackgroundandMotivationNOXOverviewProgrammingInterfaceExampleApplicationsReviewProgrammaticInterfaceEventsUseasetofhandlersthatareregisteredtoexecutewhenaparticulareventhappens.SomeeventsaregenerateddirectlybyOpenFlowmessages.Packet_InOthereventsaregeneratedbyNOXapplicationsasaresultofprocessingtheselow-leveleventsand/orotherapplication-generatedevents.User_AutheiticationProgrammaticInterfaceNetworkViewandNamespaceAnumberof“base”applicationsthatconstructthenetworkviewandmaintainahigh-levelnamespacethatcanbeusedbyotherapplications.Allowapplicationstobewritteninatopologyindependentmanner.High-leveldeclarationscanbe“compiled”againstthenetworkviewtoproducelow-levellookupfunctionsthatareenforcedper-packet.Theworstresultofapoorlywrittenapplicationisperformancedegradation,notincorrectfunction.ProgrammaticInterfaceControlManagementapplicationsexertnetworkcontrolthroughOpenFlow.OpenFlowwillnotincludecustomper-packetprocessing(e.g.,deeppacketinspection).NOXapplicationscandirecttrafficthroughspecializedmiddle-boxesHigher-LevelServicesAsetof“systemlibraries”toprovideefficientimplementationsoffunctionscommontomanynetworkapplications.OverviewBackgroundandMotivationNOXOverviewProgrammingInterfaceExampleApplicationsReviewExample1:User-basedVLANTaggingVLANExample1:User-basedVLANTagging#Onuserauthentication,staticallysetupVLANtagging#rulesattheuser’sfirsthopswitchdefsetup_user_vlan(dp,user,port,host):vlanid=user_to_vlan_function(user)#Forpacketsfromtheuser,addaVLANtagattr_out[IN_PORT]=portattr_out[DL_SRC]=nox.reverse_resolve(host).macaction_out=[(nox.OUTPUT,(0,nox.FLOOD)),(nox.ADD_VLAN,(vlanid))]install_datapath_flow(dp,attr_out,action_out)#ForpacketstotheuserwiththeVLANtag,removeitattr_in[DL_DST]=nox.reverse_resolve(host).macattr_in[DL_VLAN]=vlanidaction_in=[(nox.OUTPUT,(0,nox.FLOOD)),(nox.DEL_VLAN)]install_datapath_flow(dp,attr_in,action_in)nox.register_for_user_authentication(setup_user_vlan)SimplisticScanDetectionCountthenumberofuniqueL2andL3destinationsahosttriestocontactthathavenotauthenticated.Detectscanninghostsbytrackingthenumberofunique,unknownL2andL3destinationsattemptedbyasinglehost.SimplisticScanDetectionscans=defaultdict(dict)defcheck_for_scans(dp,inport,packet):dstid=nox.resolve_host_dest(packet)ifdstid==None:scans[packet.l2.srcaddr][packet.l2.dstaddr]=1ifpacket.l3!=None:scans[packet.l2.srcaddr][packet.l3.dstaddr]=1