FlowTags: Enforcing Network-Wide Policies in the Presence of Dynamic Middlebox Actions Author: Seyed Kaveh Fayazbakhsh, Vyas Sekar, Minlan Yu and Jeffrey C. Mogul Conference: ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking(HotSDN), 2013 Presenter: Kuan-Chieh Feng Date: 2015/12/02 Department of Computer Science and Information Engineering National Cheng Kung University

Outline Introduction Motivation FlowTags Architecture Preliminary Result Conclusion National Cheng Kung University CSIE Computer & Internet Architecture Lab 2

Introduction A key advantage of SDN is the ability to consistently enforce and verify network-wide policies for network management tasks. Unfortunately, middleboxes make it challenging to enforce and verify such policies. National Cheng Kung University CSIE Computer & Internet Architecture Lab 3

Introduction The cause of this problem is that as packets traverse the network, their headers and contents may be dynamically modified by middleboxes. To this end, we propose FlowTags, an extended SDN architecture in which middleboxes add Tags to outgoing packets, to provide the necessary causal context. National Cheng Kung University CSIE Computer & Internet Architecture Lab 4

Motivation Traffic Attribution - 1 National Cheng Kung University CSIE Computer & Internet Architecture Lab 5

Motivation Traffic Attribution - 2 National Cheng Kung University CSIE Computer & Internet Architecture Lab 6

Motivation Dynamic Traffic Dependence National Cheng Kung University CSIE Computer & Internet Architecture Lab 7

Motivation Strawman Solutions Correlating flows Middlebox placement Consolidation Policy verification tools National Cheng Kung University CSIE Computer & Internet Architecture Lab 8

FlowTags Architecture Motivated by this observation, we propose FlowTags, an extended SDN architecture that incorporates the necessary visibility into middlebox actions in order to systematically enforce and verify policies. National Cheng Kung University CSIE Computer & Internet Architecture Lab 9

FlowTags Architecture In designing, we impose three constraints: Require minimal modifications to middleboxes Preserve existing switches as well as the switch- controller interface Avoid direct interactions between middleboxes and switches National Cheng Kung University CSIE Computer & Internet Architecture Lab 10

FlowTags Architecture – Overview FlowTags-enhanced middlebox will add new Tags based on the context. Switches use Tags to steer packets. New FlowTags APIs between controller and FlowTags-enhanced middlebox. New control applications that configure the tagging behavior of the middleboxes and switches, and that also leverage Tags to support policy enforcement and verification National Cheng Kung University CSIE Computer & Internet Architecture Lab 11

FlowTags Architecture - Overview National Cheng Kung University CSIE Computer & Internet Architecture Lab 12

FlowTags Architecture - Southbound API We define an interface between the enhanced SDN controller and FlowTags-enhanced middleboxes. Middleboxes are both producers as well as consumers of Tags. National Cheng Kung University CSIE Computer & Internet Architecture Lab 13

FlowTags Architecture - Southbound API Corresponding to these two roles we envision two configuration tables: TagsFlowTable TagsActionTable National Cheng Kung University CSIE Computer & Internet Architecture Lab 14

FlowTags Architecture - Southbound API Tag addition Mbox queries the controller via RqstTag(Pkt,{MboxContext}) The response from the controller is a two-tuple of the form Tag consumption Mbox queries the controller via RqstAction(Pkt,Tags) The controller responds with an appropriate Action, in the form of a tuple of the form National Cheng Kung University CSIE Computer & Internet Architecture Lab 15

FlowTags Architecture - Example As in traditional SDN, the controller maintains a global view of the network state, including switch FIBs. Additionally, the controller maintains a copy the TagsFlowTable and TagsActionTable for each middlebox. National Cheng Kung University CSIE Computer & Internet Architecture Lab 16

FlowTags Architecture - Example National Cheng Kung University CSIE Computer & Internet Architecture Lab 17

Preliminary Result FlowTags Proof-of-Concept Using Squid (> over 100,000 lines of code) About 30 lines of code to add FlowTags support Using ToS/DSCP field in IPv4 packet header Validated use-cases with examples National Cheng Kung University CSIE Computer & Internet Architecture Lab 18

Preliminary Result National Cheng Kung University CSIE Computer & Internet Architecture Lab 19

Supplement FlowTags needs minimal middlebox modifications National Cheng Kung University CSIE Computer & Internet Architecture Lab 20 MiddleboxTotal LOCModified LOC Squid216,00075 Snort336,00045 Balance2,00060 iptables42,00055 PRADS15,00025

Supplement FlowTags adds low overhead National Cheng Kung University CSIE Computer & Internet Architecture Lab 21 Breakdown of flow processing time (ms)

Conclusion Middleboxes make policy enforcement hard Dynamic modifications are hard to account for FlowTags can make “flow context” visible Minimal modifications to middleboxes No changes to switch/switch APIs Early promise, but many challenges remain E.g., How many bits? Control apps? National Cheng Kung University CSIE Computer & Internet Architecture Lab 22