Oko: Extending Open vSwitch with Stateful Filters

Paul Chaignon (1, 2) , Kahina Lazri (1) , Jerome Francois (2) , Thibault Delmas (1) , Olivier Festor (2, 3)

1 Orange Labs [Issy les Moulineaux]
2 RESIST - Resilience and Elasticity for Security and ScalabiliTy of dynamic networked systems
3 TELECOM Nancy

With the Software-Defined Networking paradigm, software switches emerged as the new edge of datacenter networks. The widely adopted Open vSwitch implements the OpenFlow forwarding model; its simple match-action abstraction eases network management, while providing enough flexibility to define complex forwarding pipelines. OpenFlow, however, cannot express the many packets processing algorithms required for traffic measurement, network security, or congestion diagnosis, as it lacks a persistent state and basic arithmetic and logic operations. This paper presents Oko, an extension of Open vSwitch that enables runtime integration of stateful filtering and monitoring functionalities based on Berkeley Packet Filter (BPF) programs into the OpenFlow pipeline. BPF programs attached to OpenFlow rules act as intelligent filters over packets, while leaving the packets unmodified. This approach enables the transparent extension of Open vSwitch’s flow caching architecture, retaining its high-performance benefits. Furthermore, the use of BPF allows for safe runtime extension and prevention of switch failures due to faulty programs. We compare our implementation based on Open vSwitchDPDK to existing approaches with comparable fault isolation properties and measure a near 2x improvement of performance.

Mots clés: Datacenter Networks; Programmable Networks; Software-Defined Networking

Domaines: Réseaux et télécommunications [cs.NI]

Paul Chaignon, Kahina Lazri, Jerome Francois, Thibault Delmas, Olivier Festor. Oko: Extending Open vSwitch with Stateful Filters. SOSR 2018 - ACM Symposium on SDN Research, Mar 2018, Los Angeles, United States. pp.1-13. ⟨hal-01939857⟩