Encrypting OVN tunnels with IPsec - OVS OrbitIPsec Evaluation •Environment: StrongSwan5.3.5, Linux 4.4.0, Intel Xeon 2 GHz, 10 Gbps NIC •iperfgenerates TCP stream (window size:

Encrypting OVN tunnels with IPsec

Qiuyu Xiao ([email protected])

Ben Pfaff ([email protected])

Open Virtual Network (OVN)

Hypervisor 1 Hypervisor 2

VM1 VM2

VM8 VM3 VM4 VM9

VM6 VM7

VM5

Physical 1

OVN provides a logical network abstraction on top of a physical network

VM6 VM7

VM8 VM9

L-Switch

L-Switch

VM1 VM2

L-Switch

VM3 VM4 VM5

L-Router

Logical


VMs are oblivious to the physical network states

2


VM1 VM2

VM8 VM3 VM4 VM9

VM6 VM7

VM5

Physical

VM6 VM7

VM8 VM9

L-Switch

L-Switch

VM1 VM2

L-Switch

VM3 VM4 VM5

L-Router

Logical


Network appliances can be implemented and placed inthe logical network

3


VM1 VM2

VM8 VM3 VM4 VM9

VM6 VM7

VM5

Physical

VM6 VM7

VM8 VM9

L-Switch

Logical

L-Switch

VM1 VM2

L-Switch

VM3 VM4 VM5

L-Router

L-Firewall

L-LoadBalancer

OVN Tunnel Traffic

4


VM1 VM2

VM8 VM3 VM4 VM9

VM6 VM7

VM5

Inner EthernetHeader

Inner IP

HeaderPayload

OVN Tunnel Traffic

4


VM1 VM2

VM8 VM3 VM4 VM9

VM6 VM7

VM5

Outer EthernetHeader

Outer IP

Header

Outer UDP

Header

GeneveHeader


Inner IP

HeaderPayload

OVN Tunnel Traffic

4


VM1 VM2

VM8 VM3 VM4 VM9

VM6 VM7

VM5


Outer IP

Header

Outer UDP

Header

GeneveHeader


Inner IP

HeaderPayload

OVN Tunnel Traffic

4


VM1 VM2

VM8 VM3 VM4 VM9

VM6 VM7

VM5


Outer IP

Header

Outer UDP

Header

GeneveHeader


Inner IP

HeaderPayload

OVN Tunnel Traffic

4


VM1 VM2

VM8 VM3 VM4 VM9

VM6 VM7

VM5


Inner IP

HeaderPayload

The Needs for Tunnel Encryption

• VMs compute and communicate sensitive data, e.g., financial and health data• Physical network devices (e.g., router, switch) cannot be trusted or might be

compromisedq Traffic across datacentersq Router misconfigurationq Attackers breaking into internal networkq Phishing or social engineering attacks on administrators

5

Encrypting Tunnel Traffic with IPsec


Outer IP

Header

Outer UDP

Header

GeneveHeader


Inner IP

HeaderPayload

IPsec Encryption Outer

EthernetHeader

Outer IP

Header

ESPHeader

• Confidentiality• Integrity• Authenticity

6

IPsec in Linux

IKE daemon

IPsec kernel stack

security association

security policy

IKE protocol

ESP/AH protocol

User spaceKernel

7

IPsec in Linux

IKE daemon

IPsec kernel stack


security policy

IKE protocol

ESP/AH protocol

User spaceKernel

8

IKE daemon• Authentication• Negotiates cryptographic algorithms• Generates keying material

IPsec in Linux

IKE daemon

IPsec kernel stack


security policy

IKE protocolIKE daemon• Authentication• Negotiates cryptographic algorithms• Generates keying material• Installs security policy and security

associationESP/AH protocol

User spaceKernel

9

IPsec in Linux

IKE daemon

IPsec kernel stack


security policy



User spaceKernel

9

Which traffic to protect

IPsec in Linux

IKE daemon

IPsec kernel stack


security policy



User spaceKernel

9

How to protect the selected traffic

IPsec in Linux

IKE daemon

IPsec kernel stack


security policy

IKE protocol

ESP/AH protocol

IPsec kernel stack• Encryption and decryption• Checks integrity and authenticity User space

Kernel

10

OVS IPsec Tunnel

IKE daemon

IPsec kernel stack

ovsdb ovs-monitor-ipsec

ovs datapath

User space

Kernel

11

OVS IPsec Tunnel

IKE daemon

IPsec kernel stack


ovs datapath

Configuring IPsec tunnel via ovsdb• Using pre-shared key User space

Kernel

12

For example:

OVS IPsec Tunnel

IKE daemon

IPsec kernel stack


ovs datapath

Configuring IPsec tunnel via ovsdb• Using pre-shared key • Using self-signed certificate

User space

Kernel

13

For example:

OVS IPsec Tunnel

IKE daemon

IPsec kernel stack


ovs datapath

Configuring IPsec tunnel via ovsdb• Using pre-shared key • Using self-signed certificate• Using CA-signed certificate

User space

Kernel

14

For example:

OVS IPsec Tunnel

IKE daemon

IPsec kernel stack


ovs datapath

Establishing IPsec tunnel• ovs-monitor-ipsec configures IKE

daemon


security policy

User space

Kernel

15

OVS IPsec Tunnel

IKE daemon

IPsec kernel stack


ovs datapath


daemon• IKE daemon sets up security policy

and security association security association

security policy

User space

Kernel

15

OVS IPsec Tunnel

IKE daemon

IPsec kernel stack


ovs datapath

For example (geneve tunnel):


daemon• IKE daemon sets up security policy

and security association security association

security policy

User space

Kernel

15

OVS IPsec Tunnel

IKE daemon

IPsec kernel stack


ovs datapath

User space

Kernel

IPsec kernel stack • Encryption and decryption• Checks integrity and authenticity

unencryptedpacket

encryptedpacket

16

OVN IPsecnorthbound db

ovn-northd

southbound db

ovn-controller …

ovsdb

ovn-controller

Hypervisor 1 Hypervisor n

17

vswitchd ovsdb vswitchd

OVN IPsecnorthbound db

ovn-northd

southbound db

ovn-controller … ovn-controller

Hypervisor 1 Hypervisor n

• In each hypervisor, configure ovsdb to use CA-signed certificate for authentication

• Enable IPsec by configuring northbound database

17

ovsdb vswitchd ovsdb vswitchd

For example:

IPsec Evaluation

• Environment: StrongSwan 5.3.5, Linux 4.4.0, Intel Xeon 2 GHz, 10 Gbps NIC• iperf generates TCP stream (window size: 85KB), which is encrypted in a single

core

0100020003000400050006000700080009000

10000

aes256-sha256 aes-gcm no encryption

Throughput (Mbps)

Throughput (Mbps)

0%10%20%30%40%50%60%70%80%90%

100%


CPU Usage

iperf-client iperf-server 18

IPsec Evaluation


core

0100020003000400050006000700080009000

10000


Throughput (Mbps)

Throughput (Mbps)

0%10%20%30%40%50%60%70%80%90%

100%


CPU Usage


IPsec Evaluation


core

0100020003000400050006000700080009000

10000


Throughput (Mbps)

Throughput (Mbps)

0%10%20%30%40%50%60%70%80%90%

100%


CPU Usage


IPsec Evaluation


core

0100020003000400050006000700080009000

10000


Throughput (Mbps)

Throughput (Mbps)

0%10%20%30%40%50%60%70%80%90%

100%


CPU Usage


Current Status• Compatible with StrongSwan and LibreSwan IKE daemon• Packages for Ubuntu and Fedora• Tutorials on using OVN IPsec• Need to use OVS upstream kernel module

19

Future Directions

More flexible tunnel encryption policies:• Only encrypting tunnel traffic between certain hypervisors • Only encrypting tunnel traffic from certain logical network

20

Q&A

Documents

Encrypting OVN tunnels with IPsec - OVS OrbitIPsec Evaluation •Environment: StrongSwan5.3.5, Linux 4.4.0, Intel Xeon 2 GHz, 10 Gbps NIC •iperfgenerates TCP stream (window size: