Delta-net: Real-time Network Verification Using Atoms

Transcription

1 Delta-net: Real-time Network Verification Using Atoms Alex Horn 1, Ali Kheradmand 2 and Mukul R. Prasad 1 1 Fujitsu Labs of America 2 University of Illinois at Urbana-Champaign (Internship) NSDI 2017, Boston, March 29

2 Context: Network Verification 1 Control Plane Network [Canini et al., NSDI 2012], NICE [Ball et al., PLDI 2014], VeriCon [Fayaz et., NSDI 2016], BUZZ [Stoenescu et al., SIGCOMM 2016], SymNet [Fogel et al., NSDI 2015], Batfish [Lopes et al., NSDI 2015], NoD in Z3 Staged, or actual data plane [Khurshid et al., NSDI 2013], Veriflow [Kazemian et al., NSDI 2013], NetPlumber [Yang and Lam, ICNP 2013], AP Verifier Goal: detect network outages before they occur

3 Context: Network Verification 2 Undecidable Control Plane Network [Canini et al., NSDI 2012], NICE [Ball et al., PLDI 2014], VeriCon [Fayaz et., NSDI 2016], BUZZ [Stoenescu et al., SIGCOMM 2016], SymNet [Fogel et al., NSDI 2015], Batfish [Lopes et al., NSDI 2015], NoD in Z3 Decidable Staged, or actual data plane [Khurshid et al., NSDI 2013], Veriflow [Kazemian et al., NSDI 2013], NetPlumber [Yang and Lam, ICNP 2013], AP Verifier Goal: detect network outages before they occur

4 Big Picture of Real-time Network Verification 2 Properties + e.g., forwarding loop Staged, or actual data plane Forwarding Table Data Plane Checker Priority IP Prefix Action Next Hop /31 Forward Forwarding Rule z z z Errors

5 Taxonomy Real-time Network Verification Packet Equivalence Classes [Khurshid et al., NSDI 2013] [Kazemian et al., NSDI 2013] [Yang and Lam, ICNP 2013] Incremental Network Verification [Khurshid et al., NSDI 2013] 4

6 Taxonomy New Local Similarity Real-time Network Verification Packet Equivalence Classes [Khurshid et al., NSDI 2013] [Kazemian et al., NSDI 2013] [Yang and Lam, ICNP 2013] Incremental Network Verification [Khurshid et al., NSDI 2013] 5

7 Incremental Network Verification 5 Data plane 2 Control Plane Data plane 2 1 Data plane 2 2 Network Data plane k

8 Incremental Network Verification 6 Data plane 2 Control Plane Data plane 2 1 Possibly a lot of overlap 2 Data plane 2 Network Data plane k

9 Incremental Network Verification 7 Data plane 2 Control Plane Data plane 2 1 Possibly a lot of overlap 2 Data plane 2 Network Data plane k Problem: disruptive changes (e.g. outages) are still challenging to analyze in real-time.

10 Our Contribution: Delta-net 9 delta of deltas Exploit similarity among forwarding behavior of packets through parts of the network, rather than its entirety. Experiments: x faster on network-wide use cases Example next...

11 Forwarding Graphs Per Equivalence Class 10 s 2 r 2 s 3 r 4 Highest priority s 1 r 4 s 4 r 2 Lowest priority range of IP addresses

12 Forwarding Graphs Per Equivalence Class 11 s 2 r 2 s 3 r 4 s 1 r 4 s 4 r 2

13 Forwarding Graphs Per Equivalence Class 12 s 2 r 2 s 3 r 4 s 1 r 4 s 4 r 2

14 Forwarding Graphs Per Equivalence Class 13 s 2 r 2 s 3 r 4 s 1 r 4 s 4 r 2

15 Our Contribution: Delta-net 14 delta of deltas α 2, α = α 1 α 3 α 2, α 3, α 4 Rather than re-computing forwarding graphs incrementally maintain a single edge-labelled graph; represents all packet flows.

16 Our Contribution: Delta-net 15 delta of deltas α 2, α = α 1 α 3 α 2, α 3, α 4 Rather than re-computing forwarding graphs incrementally maintain a single edge-labelled graph; represents all packet flows. Single graph data structure to answer reachability queries, exposed through a simple C++ API.

17 Our Contribution: Delta-net 16 delta of deltas atoms α 2, α = α 1 α 3 α 2, α 3, α 4 Rather than re-computing forwarding graphs incrementally maintain a single edge-labelled graph; represents all packet flows. Single graph data structure to answer reachability queries, exposed through a simple C++ API.

18 Atoms Complex Stuff = Σ Simpler Stuff Example: factorization into prime numbers, e.g = For IP prefix based networks, atoms: α 1 α 2 α 3 range of IP addresses 17

19 Compactness of Atoms 18 More compact than a Patricia tree, e.g. consider α 0 = [0 : 10): [0 : 8) = 00*** [0 : 8) [8 : 10) = 0100* 0 [8 : 10)

20 Atoms and Graph Transformation 19 s 2 s 3 r 2 α 1 α 2 α 3 r 4 s 1 s 4 r 2

21 Atoms and Graph Transformation 20 s 2 s 3 r 2 α 1 α 2 α 3 r 4 s 1 s 4 r 2 α 2, α 3 α 1, α 2, α 3 α 3

22 Atoms and Graph Transformation 21 s 2 s 3 r 2 α 1 α 4 α 2 α 3 r 4 s 1 r 4 s 4 r 2 α 2, α 3 α 1, α 2, α 3, α 4 α 3

23 Atoms and Graph Transformation 22 s 2 s 3 r 2 α 1 α 4 α 2 α 3 r 4 s 1 r 4 s 4 r 2 α 2, α 3 α 1, α 2, α 3, α 4 α 3

24 Atoms and Graph Transformation 23 s 2 s 3 r 2 α 1 α 4 α 2 α 3 r 4 s 1 r 4 s 4 r 2 α 2, α 3 α 2, α 3 α 1, α 2, α 3, α 4 α 3 α 1 α 3 Graph Transformation α 2, α 3, α 4

25 High-level Flowchart 24 Start Modify forwarding table New atoms required? Yes No Create new atoms Refine precision of abstraction Yes Transform edge-labelled graph Check properties More modifications? End No

26 All-Pairs Reachability 25 Essential for Datalog-style what-if queries: α 2, α 3 α 1, α 2 α 3 α 2, α 3 Adaptation of Floyd-Warshall Algorithm

27 All-Pairs Reachability 26 Essential for Datalog-style what-if queries: α 2 α 2, α 3 α 1, α 2 α 3 α 2, α 3 Adaptation of Floyd-Warshall Algorithm

28 All-Pairs Reachability 27 Essential for Datalog-style what-if queries: α 3 α 2 α 2, α 3 α 1, α 2 α 3 α 2, α 3 Adaptation of Floyd-Warshall Algorithm

29 Experimental Setup (2 Classes of Data Sets) 28 Synthetic data sets similar to [Zeng et al., NSDI 2014] Rocketfuel and Berkeley topologies from [Narayana et al., NSDI 2016] IP prefixes from RouteViews project SDN-IP [Lin et al., SIGCOMM 2013] in ONOS Globally deployed, ONOS flagship application

30 SDN-IP Experimental Setup 29

31 Data Sets 30 Hundreds of million IP prefix rule insertions + removals Synthetic SDN-IP

32 Experiments: Measuring Rule Updates 31 Find all forwarding loops introduced by a rule insertion.

33 Experiments: Measuring Rule Updates 32 Find all forwarding loops introduced by a rule insertion. Vast majority of rule updates analyzed in << 1 ms

34 Experiments: Beyond Network Updates 33 What parts of the network are affected by link failures? Query proposed by [Khurshid et al., NSDI 2013]. Summary: Delta-net can answer queries where Veriflow-RI times out.

35 Concluding Remarks 34 Delta-net, a new real-time data plane checker. Our research considers the delta of deltas. Opens up new Datalog-style use cases, previously out of reach. Data sets publically available now: For questions and comments, contact: ahorn@us.fujitsu.com. We are also looking for industry/academic partners, interns etc. Future work: Parallelization Multi-range support Avoid space/time trade-offs, at what cost for query expressiveness?