Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introduction to OpenvSwitch

Hung-Wei Chiu
September 23, 2017

Introduction to OpenvSwitch

Hung-Wei Chiu

September 23, 2017
Tweet

More Decks by Hung-Wei Chiu

Other Decks in Technology

Transcript

  1. Hung Wei-Chu • Linker Networks Software Engineer ◦ Container/Virtualization •

    SDNDS-TW Co-Founder • Experiences ◦ Synology Network Software Engineer ◦ Open Source Contributor ▪ Mininet / Floodlight / ONOS / FRRouting ◦ Blog ▪ hwchiu.com
  2. Linux Bridge • Connect two Ethernet segments together. • Packets

    are forwarded based on Ethernet address. • Support filter and shape traffic ◦ ebtables ◦ Via Netfilter, TC
  3. Other functions • Packet filter ◦ iptables/ebtables • Traffic shape

    ◦ TC • 802.1Q ◦ Vlan • Bonding ◦ 802.3 ad/rr/alb/xor. etc
  4. System view User Space Kernel Space iptables ebtables TC Linux

    Kernel (Magic) br0 eth0 eth1 L2 forwarding L3 routing ACL/Firewall NAT/Port forwarding
  5. Linux Bridge • Full function provided by kernel network stack

    + bridge • Bridge only handle ◦ L2 forwarding ◦ STP/RSTP
  6. Introduction • 2008 ◦ First paper about OpenFlow (SDN) ◦

    Nicira company ▪ OpenvSwitch + Openflow = NVP (Network Virtualization Platform) • 2012 ◦ VMware buy Nicira ▪ NSX
  7. Introduction • Hypervisors need to bridge traffic. ◦ Linux Bridge

    • Why OpenvSwitch ? ◦ Targeted at multi-server virtualization. ◦ Responding to network dynamics ◦ Maintenance of logical tags ◦ Hardware Integration
  8. Features • IPv6 • LACP ◦ 802.3ad • STP/RSTP •

    VLAN • Overlay network ◦ GRE/VXLAN/STT/Geneve • OpenFlow
  9. System view User Space Kernel Space ovs-vsctl ovs-dpctl ovs-ofctl OpenvSwitch

    eth0 eth1 L2 forwarding L3 routing ACL/Firewall NAT/Port forwarding
  10. All in one • iptables/ebtables won’t work anymore. • Linux

    native function add complicated ◦ VLAN ◦ Bonding • OpenvSwitch try to handle provide features by itself.
  11. How • Handle packets via Openflow rules. • Handle port

    types ◦ Vlan ◦ Bonding • Some features are supported by linux kernel. ◦ Traffic Control ◦ Conntrack
  12. Openflow • One of the first SDN standards. • Defined

    the communication protocol in SDN. ◦ Controller to forwarding plane of network devices.
  13. Openflow rule L2 headers L3 headers L4 headers Switch port

    • Forward/Flood • Drop • Modify header • Local • Forward to Controller Packer bytes/counts Match Action Statistics
  14. Example • L2 forwarding src_MAC L3 headers L4 headers Switch

    port dst_MAC Action * * 00:11:32:aa:bb:cc * * Forward port 6 src_MAC L3 headers L4 headers Switch port dst_MAC Action * * * * * Normal
  15. Example • L3 forwarding L2 headers dst_ip L4 headers Switch

    port src_ip Action 1 * 140.113.123.234 140.114.123.234 * Forward port 4
  16. Controller • SDN Brain • Centralized control all SDN network

    devices. • Communicated via Northbound API ◦ Openflow/SNMP/OVSDB/NetConf.
  17. Control Plane Data Plane Network Devices (OVS) Controller (ONOS) NAT

    Routing Firewall Control Plane Data Plane Network Devices (OVS) Control Plane Data Plane Network Devices (OVS)
  18. OpenvSwitch • Support connection mode ◦ Controller ◦ Standalone ▪

    Default behavior is L2 forwarding • You can control openflow rules via ◦ Openflow controller ◦ OVS tools
  19. How to handle port type • Implement it by OVS

    itself • VLAN ◦ Match packet header. ◦ You can also push/pop vlan tags on openflow rules. • Bonding ◦ Active-backup ◦ balance-slb ◦ balance-tcp
  20. How to handle bonding • Active-backup ◦ Only backup. •

    Balance-slb ◦ Based on source MAC + vlan Tag ◦ Work with LACP • Balance-tcp ◦ Based on L2/L3/L4 headers ◦ Work with LACP
  21. The other features • Traffic Shape by queue ◦ Linux

    kernel TC • Conntrack ◦ Linux kernel conntrack module
  22. How to use OVS • Create ovs bridge (datapath) ◦

    ovs-vsctl add-br br0 • How to attach port ◦ ovs-vsctl add-port br0 eth0 • How to dump flows ◦ ovs-ofctl dump-flows br0
  23. Step by Step User Space Kernel Space ovs-vswitchd ovsdb br0

    eth0 eth1 Packets come from eth0/eth1 are fully controller by br0 now.
  24. First • We need to handle ARP request for gateway.

    ◦ table = 0, priority=65535, arp, arp_tpa=10.0.0.254, actions=LOCAL ◦ table = 0, priority=65535, arp, arp_tpa=20.0.0.254, actions=LOCAL ◦ table = 0, priority=65535, arp, arp_tpa=30.0.0.254, actions=LOCAL • System will reply ARP response for those ARP request.
  25. Second • We need to handle ARP reply from gateway.

    ◦ table = 0, priority=65535, arp, arp_spa=10.0.0.1, actions=output:1 ◦ table = 0, priority=65535, arp, arp_tpa=20.0.0.1, actions=output:2 ◦ table = 0, priority=65535, arp, arp_tpa=30.0.0.1, actions=output:3
  26. Final • We need to handle ICMP request/reply ◦ table

    = 0, icmp, nw_dst = 10.0.0.1, actions=mod_dl_dst=00:00:00:00:00:01,output:1 ◦ table = 0, icmp, nw_dst = 20.0.0.1, actions=mod_dl_dst=00:00:00:00:00:02,output:2 ◦ table = 0, icmp, nw_dst = 30.0.0.1, actions=mod_dl_dst=00:00:00:00:00:03,output:3