OVS Orbit by Ben Pfaff

October 31, 2017 Faucet and OpenFlow at Allied Telesis, with Tony Van der Peet

Tony van der Peet is Chief Architect at Allied Telesis. In this episode,

he speaks about using OpenFlow on Allied Telesis networking hardware for

enterprise SDN.

The Allied Telesis implementation of OpenFlow is based on Open vSwitch.

According to Tony:

“We've tried really from the word `go' to develop the

most generic OpenFlow switch that we can, and obviously Open vSwitch is a

very fully featured version of OpenFlow. The trick, then, is how to

integrate that with your hardware solution. The solution we've come up

with is to let Open vSwitch do what it does best, which is to manage the

tables, and to work out what needs to happen to a particular flow, and

for us to then take that and to translate it as best we can into our

hardware tables.”

Most Open vSwitch downstream projects use an official Open vSwitch

release as their base, but Allied Telesis uses the tip of master:

“I discovered a long time ago that all the good stuff was on master, so

we had a policy very early on of going to the tip of master at the time

we felt it was right to do an upgrade from upstream. Sometimes that

means we take a bit of rough with the smooth, but we're prepared for

that.”

Allied Telesis has a policy of staying close to upstream and pushing back

changes:

“We do have an active policy of pushing patches upstream on any of the

projects we're associated with. We have done a couple of patches back up

to Open vSwitch and we do have a bunch more, and I've already discussed

with you the idea that we might push up some of our patches we've done

recently to give us conformance to the ONF official conformance

program.”

Tony describes Allied Telesis's experience of the ONF conformance testing

process. They began by writing their own versions of all 300+ tests that

the process includes. Writing the tests took about 1 hour per test, on

average, so this was a significant investment in time. The investment

paid off because it gave Tony and Allied Telesis experience with the

tests and enough information to intelligently argue with the conformance

lab.

Tony became involved with Faucet because of the New Zealand connection:

both Tony and Faucet are based there. Allied Telesis appreciates how

Faucet as an open source project allows a way to show an OpenFlow use

case for its switches.

Allied Telesis is also involved with OpenDaylight and other controllers.

Allied Telesis will likely join the nascent Faucet

Foundation.

For more information about OpenFlow at Allied Telesis, visit the Allied Telesis website.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

28 min

October 24, 2017 Cocoon-2, with Leonid Ryzhyk from VMware Research

Leonid

Ryzhyk is a senior researcher at VMware Research in Palo Alto. He

focuses on applying formal methods to improve operating systems and

networks.

This episodes discusses Cocoon-2, a system that

Leonid is building to automate the tedious tasks involved in SDN

programming. One problem that it aims to solve is incrementality, that

is, the need to avoid recomputing all of the state in an SDN system given

a small change to its configuration.

Numerous academic SDN programming languages exist. Many of these think

of the network in terms of an automaton. NetKAT is a good example,

which regards the network as a finite state machine that manipulates

network packets. Other languages take a contrary view of the network as

a collection of database tables and compute state via views and queries

on these tables. Cocoon's innovation is that it takes both views: it

supports a relational model with a Datalog engine for reasoning about

computation and an imperative language for describing the data plane, and

allows the programmer to decide the most appropriate tool for any given

part of the implementation.

A publication for Cocoon-2 is planned for submission to SIGCOMM 2018.

Until then, you can look at the Cocoon2 Github repository,

including a simple

example. For information on the prior Cocoon work, consult the NSDI

2017 paper.

For more information on the view of a network as a database, you might

listen to Episode 5, about the

nlog database language.

You can contact Leonid via email at [email protected].

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

30 min

October 03, 2017 Fuzzing Frameworks, with Bhargava Shastry from TU Berlin

Bhargava

Shastry is a Ph.D. student in the Chair

for Security in Telecommunications at Technical University

Berlin. Bhargava develops tools that enable early detection and

fixing of security vulnerabilities.

Among other topics, this episode discusses Bhargava's paper “Static

Exploration of Taint-Style Vulnerabilities Found by Fuzzing,” which

was presented at WOOT

'17, the Workshop on Offensive Technologies. The paper's abstract

is:

Taint-style vulnerabilities comprise a majority of fuzzer discovered

program faults. These vulnerabilities usually manifest as memory access

violations caused by tainted program input. Although fuzzers have

helped uncover a majority of taint-style vulnerabilities in software to

date, they are limited by (i) extent of test coverage; and (ii) the

availability of fuzzable test cases. Therefore, fuzzing alone cannot

provide a high assurance that all taint-style vulnerabilities have been

uncovered.

In this paper, we use static template matching to find recurrences of

fuzzer-discovered vulnerabilities. To compensate for the inherent

incompleteness of template matching, we implement a simple yet

effective match-ranking algorithm that uses test coverage data to focus

attention on matches comprising untested code. We prototype our

approach using the Clang/LLVM compiler toolchain and use it in

conjunction with afl-fuzz, a modern coverage-guided fuzzer. Using a

case study carried out on the Open vSwitch codebase, we show that our

prototype uncovers corner cases in modules that lack a fuzzable test

harness. Our work demonstrates that static analysis can effectively

complement fuzz testing, and is a useful addition to the security

assessment tool-set. Furthermore, our techniques hold promise for

increasing the effectiveness of program analysis and testing, and serve

as a building block for a hybrid vulnerability discovery framework.

You can tweet to Bhargava as @ibags or to the Security in

Telecommunications Research Group at @fgsect. Visit Bhargava's

TU Berlin home page for more contact information.

Episode 42 covered a different research effort fuzzing

Open vSwitch.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

36 min

September 22, 2017 FlowFuzz, with Nicholas Gray and Thomas Zinner from University of Würzburg

Nicholas Gray is a PhD student at the University of Würzburg, Germany,

where he also completed his Master's thesis in 2015. His research

interests include SDN/NFV architectures and their impact on network

security. Thomas Zinner received his Diploma and Ph.D degrees in

computer science from the University of Wurzburg, Germany, in 2007 and

2012, respectively. Nicholas is a member of the research group headed by

Thomas on “Next Generation Networks” at the Chair of Communication

Networks, University of Würzburg.

This episode is about FlowFuzz, a framework for fuzzing OpenFlow-enabled

software and hardware switches. It covers the material

presented by Nicholas at Black Hat Briefings on July 26, in a session

with the following abstract:

Software-defined Networking (SDN) is a new networking paradigm which

aims for increasing the flexibility of current network deployments by

separating the data from the control plane and by providing

programmable interfaces to configure the network. Resulting in a more

agile and eased network management and therefore in cost savings, SDN

is already deployed in live networks i.e. Google's B4 backbone and

NOKIA's cloud infrastructure. Despite these benefits, SDN broadens the

attack surface as additional networking devices and protocols are

deployed. Due their critical role within the softwarized management of

the network, these devices and protocols are high ranked targets for

potential attackers and thus require extensive testing and hardening.

In this work, we present FlowFuzz a fuzzing framework for SDN-enabled

software and hardware switches. In particular we focus on the OpenFlow

protocol which is currently the de facto standard communication

protocol between SDN-enabled switches and the central controlling

instance. Whereas the framework utilizes the output of conventional

tools such as AddressSanitizer for investigating software switches, it

also evaluates data obtained from side channels, i.e., processing times

and power consumption to identify unique code execution paths within

hardware switches to optimize the fuzzing process. Furthermore, we use

our framework implementation to perform a first evaluation of the Open

vSwitch and a total of four SDN-enabled hardware switches. We conclude

by presenting our findings and outline future extensions of the fuzzing

framework.

For more information on the group that produced this research, please

visit sardine-project.org.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

36 min

September 01, 2017 DPDK Introduction, with Harry van Haaren and Dave Hunt from Intel

Dave and Harry are developers who work at Intel on DPDK, the Data Plane Development Kit, which is

a library for high-performance packet processing in userspace. This

episode is an introduction to DPDK, its history, status, and its future,

and how it relates to Open vSwitch and the DPDK datapath included in Open

vSwitch.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

49 min

August 20, 2017 OpenStack Cyborg, with Howard (Zhipeng) Huang from Huawei

Howard is an IT standards engineer at Huawei. He has been working on

open source for about 6 years and attended the early Open vSwitch

conferences, including the earliest one held at Cisco in 2014. In this

episode of OVS Orbit, Howard talks about the OpenStack Cyborg project in

OpenStack, which was formerly called Nomad. Howard is the “caretaking”

PTL for the project.

The Cyborg project supports all kinds of hardware acceleration for

OpenStack. It spans networking, storage, and other areas, primarily

because users tend to think of acceleration as a single bucket of

features. Acceleration features across these multiple areas do require

common lifecycle management processes, supplied by Cyborg as as a common

management framework.

Open vSwitch relates to Cyborg on the network acceleration angle. Howard

says that OVS can benefit from lifecycle management for hardware

acceleration, especially when the DPDK datapath is involved. This could

allow users to ensure that OVS is always properly configured for the

local hardware. Even in the absence of special acceleration hardware,

DPDK requires NIC- and CPU-specific configuration and tuning that amounts

to a kind of software acceleration, which Cyborg can help to manage.

Howard says that the project is planning an initial release for September

2017, in time for the OpenStack developer meeting.

The Cyborg website

and master

slide deck are good basic resources for learning about Cyborg.

You can contact or follow Howard on Twitter as @nopainkiller.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

29 min

August 01, 2017 BigBug: Practical Concurrency Analysis for SDN, with Ahmed El-Hassany from ETH Zürich

Ahmed El-Hassany is a second-year Ph.D. student at ETH Zürich, who

researches ways to make networks more programmable and to verify the

correctness of programmable networks. I caught up with Ahmed at SOSR,

the Symposium on SDN Research, where he presented BigBug: Practical

Concurrency Analysis for SDN, a paper that he authored along with

Roman May, Laurent Vanbever, and Martin Vechev. The paper's abstract is:

By operating in highly asynchronous environments, SDN controllers often

suffer from bugs caused by concurrency violations. Unfortunately,

state-of-the-art concurrency analyzers for SDNs often report thousands

of true violations, limiting their effectiveness in practice.

This paper presents BigBug, an approach for automatically identifying

the most representative concurrency violations: those that capture the

cause of the violation. The two key insights behind BigBug are that:

(i) many violations share the same root cause, and (ii) violations with

the same cause share common characteristics. BigBug leverages these

observations to cluster reported violations according to the similarity

of events in them as well as SDN-specific features. BigBug then

reports the most representative violation for each cluster using a

ranking function.

We implemented BigBug and showed its practical effectiveness. In more

than 100 experiments involving different controllers and applications,

BigBug systematically produced 6 clusters or less, corresponding to a

median decrease of 95% over state-of-the-art analyzers. The number of

violations reported by BigBug also closely matched that of actual bugs,

indicating that BigBug is effective at identifying root causes of SDN

races.

For more information on BigBug, visit the SDNRacer website. You can find

contact information for Ahmed on his webpage.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

33 min

July 09, 2017 Control and Management Plane for IO Modules, with Fulvio Risso from Politecnico di Torino

Fulvio Risso is an associate professor at Politecnico di Torino in Turin,

Italy. His research is in the area of high-speed (10+ Gbps) packet

processing and especially in programmable networks. This interview was

prompted by Fulvio's presentation “A

Control and Management Plane for IO Modules” at the IO Visor Summit

held on Feb. 27 in Mountain View (see Quentin Monnet's excellent summary

of the summit for more information).

The episode begins with a few words about OSSN 2017, the

2nd International Workshop on Open-Source Software Networking, which

Fulvio co-chairs. The interview occurred long before the workshop, which

took place in early July. See also the workshop schedule.

An IO Module, according to Fulvio, is a kind of marketing term for an

eBPF program. In turn, eBPF is an abstract, portable, safe virtual

machine that Linux allows userspace programs to install into the kernel

to monitor, augment, or control kernel behavior. OVS Orbit has

previously covered eBPF in episode 4 on Cilium, episode 23 on the IO Visor project, and other episodes.

According to Fulvio, for NFV packet processing, IO Modules have three

primary advantages over other approaches. First, they cab directly

injected into a kernel. Second, potentially, IO Modules can be injected

at different layers, for example in the main networking stack or in a

networking driver. Third, eBPF programs are more portable than native

code, which can be an important advantage for heterogeneous telco

environment.

Fulvio gives an example of the use of IO Modules for implementing the

functionality of a residential network gateway. IO Modules implement

DHCP, routing, NAT, deep packet inspection, etc. The advantage of an IO

Module architecture over the traditional home gateway design is

modularity: the IO Module design can be easily changed and adapted to

suit a new use case.

The IO Modules

repository includes a controller named Hover that is the main method

proposed for IO Module deployment and (re)configuration. Northbound,

Hover provides a high-level REST API that accepts IO Modules or C code

that can be transformed into eBPF; southbound, it talks to the Linux

kernel to enable and connect IO Modules. In addition, it provides some

helpers that allow IO Modules to handle points of eBPF programming that

are currently tricky.

There is a clear analogy between Open vSwitch/OpenFlow and IO

Modules/Hover. In both cases, there is a kernel-based fast path, that

sometimes needs to consult a userspace-based slow path, which

occasionally needs to consult a controller over the network. Open

vSwitch uses OpenFlow for communication with the controller; for Hover,

the protocol is yet to be determined. Fulvio is considering whether to

use an existing controller such as ONOS.

Ben and Fulvio discuss how to divide the implementation between fast path

and slow path, with ARP as an example.

Fulvio briefly discusses the performance of IO Modules, which is

generally competitive with related technologies. The goal, however, is

not performance, but flexibility.

In the future, Fulvio plans to dedicate resources to bringing IO Modules

into the larger IO Visor community. Fulvio is also concerned that the IO

Visor community is tied too tightly to individual companies. He hopes

for the community to expand further into university and research

environments.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

49 min

June 12, 2017 New Approach to OVN Datapath Performance, with Jun Xiao from CloudNetEngine

Jun Xiao is the founder and CTO of CloudNetEngine, which is focused on

innovating a next generation “engine” for cloud virtual networking. He

has over 15 years experience in VMware, Huawei, Lucent, Sun Microsystem,

and other companies. His system design experience ranges from low-level

device drivers and network stacks to middleware and distributed systems.

This episode is a talk that Jun gave at OpenStack Boston during the Open

vSwitch Open Source Day on May 10, with the following abstract:

Jun presents a new high-performance datapath for OVN. OVN has many

advantages than other virtual networking solutions given its great

architecture thus performant/extensible/scale, and it becomes the best

virtual networking solution if you want to use OVS with openstack. In

this presentation, Jun will show how to deploy openstack/OVN with yet

another high performance OVS datapath, and deep dive on technical

solutions addressing OVS datapaths outstanding issues. Jun will also

give a live demo for the integration and present some performance

benchmarks.

Slides for this talk are available in PowerPoint

and PDF

formats. The PowerPoint version may be preferable because it preserves

the animations.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

31 min

June 11, 2017 Baker: Scaling OVN with Kubernetes API Server, with Han Zhou from eBay

Han Zhou is an architect working on highly scalable and reliable SDN

solutions for eBay's cloud infrastructure. He is an active contributor

in OpenStack and OVS/OVN. Before eBay, he has been working in networking

area for more than 10 years in Cisco and Nokia.

This episode is a talk that Han gave at OpenStack Boston during the Open

vSwitch Open Source Day on May 10, with the following abstract:

Han presents “Baker,” a new approach used by eBay to combine OVN with

Kubernetes API server to meet the scalability and availability goal in a

large scale production environment, and how it is integrated with Neutron

Security Group to achieve micro-segmentation. This allows OVN to scale

beyond the limits of OVSDB as the centralized data store.

Slides from this talk are available in PDF

format.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

23 min

Share OVS Orbit

Sign up to save your podcasts

OVS Orbit

OVS Orbit episodes

About OVS Orbit