Nothing Special   »   [go: up one dir, main page]

skip to main content
research-article

A Framework for eBPF-Based Network Functions in an Era of Microservices

Published: 01 March 2021 Publication History

Abstract

By moving network functionality from dedicated hardware to software running on end-hosts, Network Functions Virtualization (NFV) pledges the benefits of cloud computing to packet processing. While most of the NFV frameworks today rely on kernel-bypass approaches, no attention has been given to kernel packet processing, which has always proved hard to evolve and to program. In this article, we present Polycube, a software framework whose main goal is to bring the power of NFV to in-kernel packet processing applications, enabling a level of flexibility and customization that was unthinkable before. Polycube enables the creation of arbitrary and complex network function chains, where each function can include an efficient in-kernel data plane and a flexible user-space control plane with strong characteristics of isolation, persistence, and composability. Polycube network functions, called Cubes, can be dynamically generated and injected into the kernel networking stack, without requiring custom kernels or specific kernel modules, simplifying the debugging and introspection, which are two fundamental properties in recent cloud environments. We validate the framework by showing significant improvements over existing applications, and we prove the generality of the Polycube programming model through the implementation of complex use cases such as a network provider for Kubernetes.

References

[1]
C. Hopps. (Sep.2019). Katran: A High Performance Layer 4 Load Balancer. [Online]. Available: xxhttps://github.com/facebookincubator/katran
[2]
N. Kattaet al., “Clove: Congestion-aware load balancing at the virtual edge,” in Proc. 13th Int. Conf. Emerg. Netw. Exp. Technol. (CoNEXT), 2017, pp. 323–335. [Online]. Available: https://doi.org/10.1145/3143361.3143401
[3]
K. Heet al., “PRESTO: Edge-based load balancing for fast datacenter networks,” in Proc. ACM Conf. Special Interest Group Data Commun. (SIGCOMM), 2015, pp. 465–478. [Online]. Available: https://doi.org/10.1145/2785956.2787507
[4]
T. Barbetteet al., “A high-speed load-balancer design with guaranteed per-connection-consistency,” in Proc. 17th USENIX Symp. Netw. Syst. Design Implement. (NSDI), Feb. 2020, pp. 667–683. [Online]. Available: https://www.usenix.org/conference/nsdi20/presentation/barbette
[5]
M. Alizadehet al., “CONGA: Distributed congestion-aware load balancing for datacenters,” in Proc. ACM Conf. SIGCOMM, 2014, pp. 503–514. [Online]. Available: https://doi.org/10.1145/2619239.2626316
[6]
V. Jeyakumar, M. Alizadeh, D. Mazières, B. Prabhakar, A. Greenberg, and C. Kim, “EyeQ: Practical network performance isolation at the edge,” in presented at the 10th USENIX Symp. Netw. Syst. Design Implement. (NSDI), 2013, pp. 297–311. [Online]. Available: https://www.usenix.org/conference/nsdi13/technical-sessions/presentation/jeyakumar
[7]
M. Nasimi, M. A. Habibi, B. Han, and H. D. Schotten, “Edge-assisted congestion control mechanism for 5G network using software-defined networking,” in Proc. 15th Int. Symp. Wireless Commun. Syst. (ISWCS), 2018, pp. 1–5.
[8]
S. Miano, R. Doriguzzi-Corin, F. Risso, D. Siracusa, and R. Sommese, “Introducing smartNICs in server-based data plane processing: The DDoS mitigation use case,” IEEE Access, vol. 7, pp. 107161–107170, 2019.
[9]
G. Siracusano and R. Bifulco, “Is it a SmartNIC or a key-value store? both!” in Proc. SIGCOMM Posters Demos (SIGCOMM), 2017, pp. 138–140. [Online]. Available: http://doi.acm.org/10.1145/3123878.3132014
[10]
K. Lazri, A. Blin, J. Sopena, and G. Muller, “Toward an in-kernel high performance key-value store implementation,” in Proc. 38th Symp. Rel. Distrib. Syst. (SRDS), 2019, pp. 268–2680.
[11]
Y. Leet al., “UNO: Uniflying host and smart NIC offload for flexible packet processing,” in Proc. Symp. Cloud Comput. (SoCC), 2017, pp. 506–519. [Online]. Available: http://doi.acm.org/10.1145/3127479.3132252
[12]
A. Bremler-Barr, Y. Harchol, and D. Hay, “OpenBox: A software-defined framework for developing, deploying, and managing network functions,” in Proc. ACM SIGCOMM Conf., 2016, pp. 511–524. [Online]. Available: https://doi.org/10.1145/2934872.2934875
[13]
M. Kablan, A. Alsudais, E. Keller, and F. Le, “Stateless network functions: Breaking the tight coupling of state and processing,” in Proc. 14th USENIX Symp. Netw. Syst. Design Implement. (NSDI), Mar. 2017, pp. 97–112. [Online]. Available: https://www.usenix.org/conference/nsdi17/technical-sessions/presentation/kablan
[14]
W. Zhanget al., “OpenNetVM: A platform for high performance network service chains,” in Proc. Workshop Hot Topics Middleboxes Netw. Function Virtualization (HotMIddlebox), 2016, pp. 26–31. [Online]. Available: https://doi.org/10.1145/2940147.2940155
[15]
G. P. Katsikas, T. Barbette, D. Kostić, R. Steinert, and G. Q. Maguire, Jr., “Metron: NFV service chains at the true speed of the underlying hardware,” in Proc. 15th USENIX Symp. Netw. Syst. Design Implement. (NSDI), Apr. 2018, pp. 171–186. [Online]. Available: https://www.usenix.org/conference/nsdi18/presentation/katsikas
[16]
R. Laufer, M. Gallo, D. Perino, and A. Nandugudi, “CliMB: Enabling network function composition with click middleboxes,” SIGCOMM Comput. Commun. Rev., vol. 46, no. 4, pp. 17–22, Dec. 2016. [Online]. Available: https://doi.org/10.1145/3027947.3027951
[17]
S. Palkaret al., “E2: A framework for NFV applications,” in Proc. 25th Symp. Oper. Syst. Principles (SOSP), 2015, pp. 121–136. [Online]. Available: https://doi.org/10.1145/2815400.2815423
[18]
A. Panda, S. Han, K. Jang, M. Walls, S. Ratnasamy, and S. Shenker, “NetBricks: Taking the V out of NFV,” in Proc. 12th USENIX Conf. Oper. Syst. Design Implement. (OSDI), 2016, pp. 203–216.
[19]
DPDK. (Jun.2018). Data Plane Development Kit. [Online]. Available: https://www.dpdk.org/
[20]
L. Rizzo, “NetMap: A novel framework for fast packet I/O,” in Proc. 21st USENIX Security Symp. (USENIX Security), 2012, pp. 101–112.
[21]
Cisco, “FD.io—Vector packet processing,” Intel, San Jose, CA, USA, White Paper, 2017. [Online]. Available: https://fd.io/docs/whitepapers/FDioVPPwhitepaperJuly2017.pdf
[22]
J. Martinset al., “ClickOS and the art of network function virtualization,” in Proc. 11th USENIX Conf. Netw. Syst. Design Implement. (NSDI), 2014, pp. 459–473.
[23]
M. Gallo and R. Laufer, “ClickNF: A modular stack for custom network functions,” in Proc. USENIX Annu. Tech. Conf. (USENIX ATC), Jul. 2018, pp. 745–757. [Online]. Available: https://www.usenix.org/conference/atc18/presentation/gallo
[24]
E. Kohler, R. Morris, B. Chen, J. Jannotti, and M. F. Kaashoek, “The click modular router,” ACM Trans. Comput. Syst., vol. 18, no. 3, pp. 263–297, Aug. 2000. [Online]. Available: https://doi.org/10.1145/354871.354874
[25]
L. Rizzo and G. Lettieri, “VALE, a switched Ethernet for virtual machines,” in Proc. 8th Int. Conf. Emerg. Netw. Exp. Technol. (CoNEXT), 2012, pp. 61–72. [Online]. Available: https://doi.org/10.1145/2413176.2413185
[26]
I. Marinos, R. N. Watson, and M. Handley, “Network stack specialization for performance,” in Proc. ACM Conf. SIGCOMM, 2014, pp. 175–186. [Online]. Available: https://doi.org/10.1145/2619239.2626311
[27]
S. Han, K. Jang, K. Park, and S. Moon, “PacketShader: A GPU-accelerated software router,” in Proc. ACM SIGCOMM Conf., 2010, pp. 195–206. [Online]. Available: https://doi.org/10.1145/1851182.1851207
[29]
G. Inc. (Jul.22, 2019). Kubernetes: Production-Grade Container Orchestration. [Online]. Available: https://kubernetes.io/
[30]
Netronome. (Jan.2017). Avoid Kernel-Bypass in Your Network Infrastructure. [Online]. Available: https://web.archive.org/save/https://www.netronome.com/blog/avoid-kernel-bypass-in-your-network-infrastructure/
[31]
E. Jeonget al., “mTCP: A highly scalable user-level TCP stack for multicore systems,” in Proc. 11th USENIX Symp. Netw. Syst. Design Implement. (NSDI), Apr. 2014, pp. 489–502. [Online]. Available: https://www.usenix.org/conference/nsdi14/technical-sessions/presentation/jeong
[32]
K. Yasukata, M. Honda, D. Santry, and L. Eggert, “StackMap: Low-latency networking with the OS stack and dedicated NICs,” in Proc. USENIX Conf. Usenix Annu. Tech. Conf. (USENIX ATC), 2016, pp. 43–56.
[33]
B. Pfaffet al., “The design and implementation of OpenvSwitch,” in Proc. 12th USENIX Conf. Netw. Syst. Design Implement. (NSDI), 2015, pp. 117–130.
[34]
P. Authors. (Jan.2019). Polycube: EBPF/XDP-Based Software Framework for Fast Network Services Running in the Linux Kernel. Accessed: Oct.25, 2020. [Online]. Available: https://polycube.network
[36]
Cilium authors. (Jan.2019). Diagram of Kubernetes/Kube-Proxy Iptables Rules Architecture. [Online]. Available: https://web.archive.org/web/20200414131802/https://github.com/cilium/k8s-iptables-diagram
[37]
M. Majkowski. (Jul.2016). Why We Use the Linux Kernel’s TCP Stack. [Online]. Available: https://web.archive.org/web/20200210223048/https://blog.cloudflare.com/why-we-use-the-linux-kernels-tcp-stack/
[38]
T. Høiland-Jørgensenet al., “The express data path: Fast programmable packet processing in the operating system kernel,” in Proc. 14th Int. Conf. Emerg. Netw. Exp. Technol. (CoNEXT), 2018, pp. 54–66. [Online]. Available: http://doi.acm.org/10.1145/3281411.3281443
[39]
Cilium Authors. (Oct.2020). BPF and XDP Reference Guide. [Online]. Available: https://docs.cilium.io/en/latest/bpf/
[40]
Linux Programmer’s Manual. (Aug.2019). BPF—Perform a Command on an Extended BPF Map or Program. [Online]. Available: https://web.archive.org/web/20200428005645/http://man7.org/linux/man-pages/man2/bpf.2.html
[41]
S. Miano, G. Retvari, F. Risso, A. W. Moore, and G. Antichi, “Automatic optimization of software data planes,” in Proc. ACM SIGCOMM Conf. Posters Demos (SIGCOMM), 2020. [Online]. Available: https://conferences.sigcomm.org/sigcomm/2020/cf-posters.html
[42]
A. Zaostrovnykh, S. Pirelli, L. Pedrosa, K. Argyraki, and G. Candea, “A formally verified NAT,” in Proc. Conf. ACM Special Interest Group Data Commun. (SIGCOMM), 2017, pp. 141–154. [Online]. Available: https://doi.org/10.1145/3098822.3098833
[43]
R. Stoenescu, M. Popovici, L. Negreanu, and C. Raiciu, “SymNet: Scalable symbolic execution for modern networks,” in Proc. ACM SIGCOMM Conf. (SIGCOMM), 2016, pp. 314–327. [Online]. Available: https://doi.org/10.1145/2934872.2934881
[44]
L. Pedrosa, R. Iyer, A. Zaostrovnykh, J. Fietz, and K. Argyraki, “Automated synthesis of adversarial workloads for network functions,” in Proc. Conf. ACM Special Interest Group Data Commun. (SIGCOMM), 2018, pp. 372–385. [Online]. Available: https://doi.org/10.1145/3230543.3230573
[45]
R. Iyer, L. Pedrosa, A. Zaostrovnykh, S. Pirelli, K. Argyraki, and G. Candea, “Performance contracts for software network functions,” in Proc. 16th {USENIX} Symp. Netw. Syst. Design Implement. (NSDI), 2019, pp. 517–530.
[46]
F. Rathet al., “SymPerf: Predicting network function performance,” in Proc. SIGCOMM Posters Demos (SIGCOMM), 2017, pp. 34–36. [Online]. Available: https://doi.org/10.1145/3123878.3131977
[47]
S. Miano, M. Bertrone, F. Risso, M. Tumolo, and M. V. Bernal, “Creating complex network services with EBPF: Experience and lessons learned,” in Proc. IEEE 19th Int. Conf. High Perform. Switch. Routing (HPSR), 2018, pp. 1–8.
[48]
M. Bjorklund. (2016). The YANG 1.1 Data Modeling Language. [Online]. Available: https://tools.ietf.org/html/rfc7950
[49]
A. Bierman, M. Björklund, and K. Watsen, “RESTCONF protocol,” IETF, RFC 8040, Jan. 2017. [Online]. Available: https://rfc-editor.org/rfc/rfc8040.txt
[50]
D. E. Eisenbudet al., “Maglev: A fast and reliable software network load balancer,” in Proc. 13th USENIX Symp. Netw. Syst. Design Implement. (NSDI), Santa Clara, CA, USA, 2016, pp. 523–535. [Online]. Available: https://www.usenix.org/conference/nsdi16/technical-sessions/presentation/eisenbud
[51]
S. Miano, M. Bertrone, F. Risso, M. V. Bernal, Y. Lu, and J. Pi, “Securing linux with a faster and scalable iptables,” SIGCOMM Comput. Commun. Rev., vol. 49, no. 3, pp. 2–17, Nov. 2019. [Online]. Available: https://doi.org/10.1145/3371927.3371929
[52]
BCC Authors. BPF Compiler Collection (BCC). Accessed: Oct.20, 2020. [Online]. Available: https://web.archive.org/web/20181106133143/https://www.iovisor.org/technology/bcc
[53]
DPDK. (Aug.2018). Pktgen Traffic Generator Using DPDK. [Online]. Available: http://dpdk.org/git/apps/pktgen-dpdk
[54]
P. Emmerich, S. Gallenmüller, D. Raumer, F. Wohlfart, and G. Carle, “Moongen: A scriptable high-speed packet generator,” in Proc. Internet Meas. Conf., 2015, pp. 275–287.
[55]
Intel. Flow Director and Memcached Performance. Accessed: Oct.20, 2020. [Online]. Available: https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/intel-ethernet-flow-director.pdf
[56]
T. Lakshman and D. Stiliadis, “High-speed policy-based packet forwarding using efficient multi-dimensional range matching,” ACM SIGCOMM Comput. Commun. Rev., vol. 28, no. 4, pp. 203–214, 1998.
[57]
D. E. Taylor and J. S. Turner, “ClassBench: A packet classification benchmark,” IEEE/ACM Trans. Netw., vol. 15, no. 3, pp. 499–511, Jun. 2007.
[58]
J. Matousek, G. Antichi, A. Lucansky, A. W. Moore, and J. Korenek, “ClassBench-NG: Recasting ClassBench after a decade of network evolution,” in Proc. ACM/IEEE Symp. Architect. Netw. Commun. Syst. (ANCS), 2017, pp. 204–216.
[60]
M. Karlsson and B. Töpel, “The path to DPDK speeds for AF XDP,” in Proc. Tech. Conf. Linux Netw. (Netdev), 2018. [Online]. Available: https://www.semanticscholar.org/paper/The-Path-to-DPDK-Speeds-for-AF_XDP-Karlsson/92abbc6c959f5ef71ad51a154ac8954995308712
[61]
S. G. Kulkarniet al., “NFVnice: Dynamic backpressure and scheduling for NFV service chains,” in Proc. Conf. ACM Special Interest Group Data Commun. (SIGCOMM), 2017, pp. 71–84. [Online]. Available: https://doi.org/10.1145/3098822.3098828
[62]
OpenNetVM authors. (Oct.2020). NFVnice Sample Bridge Application. [Online]. Available: https://github.com/sdnfv/openNetVM/tree/experimental/nfvnice-reinforce/examples/bridge
[63]
P. L. Consortium. (Oct.2020). p4Lang-P4C: P4 Reference Compiler. [Online]. Available: https://github.com/p4lang/p4c
[64]
R. Marchi. Polycube Extention of the P4C Compiler. Accessed: Oct.2020. [Online]. Available: https://github.com/richiMarchi/p4c/tree/polycube_translation
[65]
A. Starovoitov. (Mar.2014). Net: Filter: Rework/Optimize Internal BPF Interpreter’s Instruction Set. [Online]. Available: https://patchwork.ozlabs.org/patch/333456/
[66]
F. Sánchez and D. Brazewell, “Tethered linux CPE for IP service delivery,” in Proc. 1st IEEE Conf. Netw. Softw. (NetSoft), 2015, pp. 1–9.
[67]
Z. Ahmed, M. H. Alizai, and A. A. Syed, “InKeV: In-kernel distributed network virtualization for DCN,” SIGCOMM Comput. Commun. Rev., vol. 46, no. 3, pp. 1–6, Jul. 2018. [Online]. Available: https://doi.org/10.1145/3243157.3243161
[68]
A. Fabre. L4Drop: XDP DDoS Mitigations. Accessed: Oct.20, 2020. [Online]. Available: https://web.archive.org/web/20190927231336/
[69]
Cilium Authors. (2020). Cilium: API-Aware Networking and Security Using eBPF and XDP. [Online]. Available: https://github.com/cilium/cilium

Cited By

View all
  • (2024)NetEdit: An Orchestration Platform for eBPF Network Functions at ScaleProceedings of the ACM SIGCOMM 2024 Conference10.1145/3651890.3672227(721-734)Online publication date: 4-Aug-2024
  • (2024)Poster: Secure NFV Infrastructure based on Software Fault Isolation Considering Multi-Tenant EnvironmentProceedings of the 22nd Annual International Conference on Mobile Systems, Applications and Services10.1145/3643832.3661403(650-651)Online publication date: 3-Jun-2024
  • (2024)Merlin: Multi-tier Optimization of eBPF Code for Performance and CompactnessProceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 310.1145/3620666.3651387(639-653)Online publication date: 27-Apr-2024
  • Show More Cited By

Index Terms

  1. A Framework for eBPF-Based Network Functions in an Era of Microservices
        Index terms have been assigned to the content through auto-classification.

        Recommendations

        Comments

        Please enable JavaScript to view thecomments powered by Disqus.

        Information & Contributors

        Information

        Published In

        cover image IEEE Transactions on Network and Service Management
        IEEE Transactions on Network and Service Management  Volume 18, Issue 1
        March 2021
        1097 pages

        Publisher

        IEEE Press

        Publication History

        Published: 01 March 2021

        Qualifiers

        • Research-article

        Contributors

        Other Metrics

        Bibliometrics & Citations

        Bibliometrics

        Article Metrics

        • Downloads (Last 12 months)0
        • Downloads (Last 6 weeks)0
        Reflects downloads up to 17 Nov 2024

        Other Metrics

        Citations

        Cited By

        View all
        • (2024)NetEdit: An Orchestration Platform for eBPF Network Functions at ScaleProceedings of the ACM SIGCOMM 2024 Conference10.1145/3651890.3672227(721-734)Online publication date: 4-Aug-2024
        • (2024)Poster: Secure NFV Infrastructure based on Software Fault Isolation Considering Multi-Tenant EnvironmentProceedings of the 22nd Annual International Conference on Mobile Systems, Applications and Services10.1145/3643832.3661403(650-651)Online publication date: 3-Jun-2024
        • (2024)Merlin: Multi-tier Optimization of eBPF Code for Performance and CompactnessProceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 310.1145/3620666.3651387(639-653)Online publication date: 27-Apr-2024
        • (2024)Practicality of in-kernel/user-space packet processing empowered by lightweight neural network and decision treeComputer Networks: The International Journal of Computer and Telecommunications Networking10.1016/j.comnet.2024.110188240:COnline publication date: 1-Feb-2024
        • (2023)Automatic eBPF program generation method for performance monitoringProceedings of the 2023 6th International Conference on Artificial Intelligence and Pattern Recognition10.1145/3641584.3641773(1255-1261)Online publication date: 22-Sep-2023
        • (2023)Formal verification of eBPF program security based on PTLProceedings of the 2023 6th International Conference on Artificial Intelligence and Pattern Recognition10.1145/3641584.3641768(1225-1230)Online publication date: 22-Sep-2023
        • (2023)Accelerating 5G Service-Based Architecture with EbpfProceedings of the 2023 12th International Conference on Networks, Communication and Computing10.1145/3638837.3638883(200-209)Online publication date: 15-Dec-2023
        • (2023)HEELS: A Host-Enabled eBPF-Based Load Balancing SchemeProceedings of the 1st Workshop on eBPF and Kernel Extensions10.1145/3609021.3609307(77-83)Online publication date: 10-Sep-2023
        • (2023)SecCoProceedings of the 2023 International Conference on Research in Adaptive and Convergent Systems10.1145/3599957.3606222(1-6)Online publication date: 6-Aug-2023
        • (2023)Fast In-kernel Traffic Sketching in eBPFACM SIGCOMM Computer Communication Review10.1145/3594255.359425653:1(3-13)Online publication date: 20-Apr-2023
        • Show More Cited By

        View Options

        View options

        Login options

        Media

        Figures

        Other

        Tables

        Share

        Share

        Share this Publication link

        Share on social media