4 SXP (Source-Group Tag eXchange Protocol) project is an effort to enhance OpenDaylight platform with IP-SGT (IP Address to Source Group Tag) bindings that can be learned from connected SXP-aware network nodes. The current implementation supports SXP protocol version 4 according to the Smith, Kandula - SXP https://tools.ietf.org/html/draft-smith-kandula-sxp-04[IETF draft] and grouping of peers and creating filters based on ACL/Prefix-list syntax for filtering outbound and inbound IP-SGT bindings. All protocol legacy versions 1-3 are supported as well. Additionally, version 4 adds bidirectional connection type as an extension of a unidirectional one.
7 The SXP Server manages all connected clients in separate threads and a common SXP protocol agreement is used between connected peers. Each SXP network peer is modelled with its pertaining class, e.g., SXP Server represents the SXP Speaker, SXP Listener the Client. The server program creates the ServerSocket object on a specified port and waits until a client starts up and requests connect on the IP address and port of the server. The client program opens a Socket that is connected to the server running on the specified host IP address and port.
9 The SXP Listener maintains connection with its speaker peer. From an opened channel pipeline, all incoming SXP messages are processed by various handlers. Message must be decoded, parsed and validated.
11 The SXP Speaker is a counterpart to the SXP Listener. It maintains a connection with its listener peer and sends composed messages.
13 The SXP Binding Handler extracts the IP-SGT binding from a message and pulls it into the SXP-Database. If an error is detected during the IP-SGT extraction, an appropriate error code and sub-code is selected and an error message is sent back to the connected peer. All transitive messages are routed directly to the output queue of SXP Binding Dispatcher.
15 The SXP Binding Dispatcher represents a selector that will decides how many data from the SXP-database will be sent and when. It is responsible for message content composition based on maximum message length.
17 The SXP Binding Filters handles filtering of outgoing and incoming IP-SGT bindings according to BGP filtering using ACL and Prefix List syntax for specifying filter or based on Peer-sequence length.
19 The SXP Domains feature provides isolation of SXP peers and bindings learned between them, also exchange of Bindings is possible across SXP-Domains by ACL, Prefix List or Peer-Sequence filters
22 The OpenDaylight Karaf distribution comes pre-configured with baseline SXP configuration.
23 Configuration of SXP Nodes is also possible via NETCONF.
25 - *22-sxp-controller-one-node.xml* (defines the basic parameters)
27 === Administering or Managing SXP
28 By RPC (response is XML document containing requested data or operation status):
31 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:get-connections
34 <input xmlns:xsi="urn:opendaylight:sxp:controller">
35 <domain-name>global</domain-name>
36 <requested-node>0.0.0.100</requested-node>
40 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:add-connection
43 <input xmlns:xsi="urn:opendaylight:sxp:controller">
44 <requested-node>0.0.0.100</requested-node>
45 <domain-name>global</domain-name>
48 <peer-address>172.20.161.50</peer-address>
49 <tcp-port>64999</tcp-port>
50 <!-- Password setup: default | none leave empty -->
51 <password>default</password>
52 <!-- Mode: speaker/listener/both -->
54 <version>version4</version>
55 <description>Connection to ASR1K</description>
56 <!-- Timers setup: 0 to disable specific timer usability, the default value will be used -->
59 <hold-time-min-acceptable>45</hold-time-min-acceptable>
60 <keep-alive-time>30</keep-alive-time>
64 <peer-address>172.20.161.178</peer-address>
65 <tcp-port>64999</tcp-port>
66 <!-- Password setup: default | none leave empty-->
67 <password>default</password>
68 <!-- Mode: speaker/listener/both -->
70 <version>version4</version>
71 <description>Connection to ISR</description>
72 <!-- Timers setup: 0 to disable specific timer usability, the default value will be used -->
75 <reconciliation-time>120</reconciliation-time>
76 <hold-time>90</hold-time>
77 <hold-time-min>90</hold-time-min>
78 <hold-time-max>180</hold-time-max>
86 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:delete-connection
89 <input xmlns:xsi="urn:opendaylight:sxp:controller">
90 <requested-node>0.0.0.100</requested-node>
91 <domain-name>global</domain-name>
92 <peer-address>172.20.161.50</peer-address>
96 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:add-entry
99 <input xmlns:xsi="urn:opendaylight:sxp:controller">
100 <requested-node>0.0.0.100</requested-node>
101 <domain-name>global</domain-name>
102 <ip-prefix>192.168.2.1/32</ip-prefix>
106 * Update Binding Entry
107 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:update-entry
110 <input xmlns:xsi="urn:opendaylight:sxp:controller">
111 <requested-node>0.0.0.100</requested-node>
112 <domain-name>global</domain-name>
114 <ip-prefix>192.168.2.1/32</ip-prefix>
118 <ip-prefix>192.168.3.1/32</ip-prefix>
123 * Delete Binding Entry
124 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:delete-entry
127 <input xmlns:xsi="urn:opendaylight:sxp:controller">
128 <requested-node>0.0.0.100</requested-node>
129 <domain-name>global</domain-name>
130 <ip-prefix>192.168.3.1/32</ip-prefix>
136 This RPC gets particular device bindings. An SXP-aware node is identified with a unique Node-ID. If a user requests bindings
137 for a Speaker 20.0.0.2, the RPC will search for an appropriate path, which contains 20.0.0.2 Node-ID, within locally learnt
138 SXP data in the SXP database and replies with associated bindings.
139 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:get-node-bindings
142 <input xmlns:xsi="urn:opendaylight:sxp:controller">
143 <requested-node>20.0.0.2</requested-node>
144 <bindings-range>all</bindings-range>
145 <domain-name>global</domain-name>
149 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:get-binding-sgts
152 <input xmlns:xsi="urn:opendaylight:sxp:controller">
153 <requested-node>0.0.0.100</requested-node>
154 <domain-name>global</domain-name>
155 <ip-prefix>192.168.12.2/32</ip-prefix>
158 * Add PeerGroup with or without filters to node.
159 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:add-peer-group
162 <input xmlns="urn:opendaylight:sxp:controller">
163 <requested-node>127.0.0.1</requested-node>
169 <filter-type>outbound</filter-type>
171 <entry-type>deny</entry-type>
172 <entry-seq>1</entry-seq>
173 <sgt-start>1</sgt-start>
174 <sgt-end>100</sgt-end>
177 <entry-type>permit</entry-type>
178 <entry-seq>45</entry-seq>
187 * Delete PeerGroup with peer-group-name from node request-node.
188 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:delete-peer-group
191 <input xmlns="urn:opendaylight:sxp:controller">
192 <requested-node>127.0.0.1</requested-node>
193 <peer-group-name>TEST</peer-group-name>
196 * Get PeerGroup with peer-group-name from node request-node.
197 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:get-peer-group
200 <input xmlns="urn:opendaylight:sxp:controller">
201 <requested-node>127.0.0.1</requested-node>
202 <peer-group-name>TEST</peer-group-name>
205 * Add Filter to peer group on node request-node.
206 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:add-filter
209 <input xmlns="urn:opendaylight:sxp:controller">
210 <requested-node>127.0.0.1</requested-node>
211 <peer-group-name>TEST</peer-group-name>
213 <filter-type>outbound</filter-type>
215 <entry-type>deny</entry-type>
216 <entry-seq>1</entry-seq>
217 <sgt-start>1</sgt-start>
218 <sgt-end>100</sgt-end>
221 <entry-type>permit</entry-type>
222 <entry-seq>45</entry-seq>
230 * Delete Filter from peer group on node request-node.
231 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:delete-filter
234 <input xmlns="urn:opendaylight:sxp:controller">
235 <requested-node>127.0.0.1</requested-node>
236 <peer-group-name>TEST</peer-group-name>
237 <filter-type>outbound</filter-type>
240 * Update Filter of the same type in peer group on node request-node.
241 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:update-filter
244 <input xmlns="urn:opendaylight:sxp:controller">
245 <requested-node>127.0.0.1</requested-node>
246 <peer-group-name>TEST</peer-group-name>
248 <filter-type>outbound</filter-type>
250 <entry-type>deny</entry-type>
251 <entry-seq>1</entry-seq>
252 <sgt-start>1</sgt-start>
253 <sgt-end>100</sgt-end>
256 <entry-type>permit</entry-type>
257 <entry-seq>45</entry-seq>
265 * Add new SXP aware Node
266 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:add-node
269 <input xmlns="urn:opendaylight:sxp:controller">
270 <node-id>1.1.1.1</node-id>
271 <source-ip>0.0.0.0</source-ip>
273 <retry-open-time>5</retry-open-time>
274 <hold-time-min-acceptable>120</hold-time-min-acceptable>
275 <delete-hold-down-time>120</delete-hold-down-time>
276 <hold-time-min>90</hold-time-min>
277 <reconciliation-time>120</reconciliation-time>
278 <hold-time>90</hold-time>
279 <hold-time-max>180</hold-time-max>
280 <keep-alive-time>30</keep-alive-time>
282 <mapping-expanded>150</mapping-expanded>
284 <password>password</password>
286 <tcp-port>64999</tcp-port>
287 <version>version4</version>
288 <description>ODL SXP Controller</description>
289 <master-database></master-database>
292 * Delete SXP aware node
293 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:delete-node
296 <input xmlns="urn:opendaylight:sxp:controller">
297 <node-id>1.1.1.1</node-id>
300 * Add SXP Domain on node request-node.
301 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:add-domain
304 <input xmlns="urn:opendaylight:sxp:controller">
305 <node-id>1.1.1.1</node-id>
306 <domain-name>global</domain-name>
309 * Delete SXP Domain on node request-node.
310 POST http://127.0.0.1:8181/restconf/operations/sxp-controller:delete-domain
313 <input xmlns="urn:opendaylight:sxp:controller">
314 <node-id>1.1.1.1</node-id>
315 <domain-name>global</domain-name>
319 ==== Use cases for SXP
320 Cisco has a wide installed base of network devices supporting SXP. By including SXP in OpenDaylight, the binding of policy groups to IP addresses can be made available for possible further processing to a wide range of devices, and applications running on OpenDaylight. The range of applications that would be enabled is extensive. Here are just a few of them:
322 OpenDaylight based applications can take advantage of the IP-SGT binding information. For example, access control can be defined by an operator in terms of policy groups, while OpenDaylight can configure access control lists on network elements using IP addresses, e.g., existing technology.
324 Interoperability between different vendors. Vendors have different policy systems. Knowing the IP-SGT binding for Cisco makes it possible to maintain policy groups between Cisco and other vendors.
326 OpenDaylight can aggregate the binding information from many devices and communicate it to a network element. For example, a firewall can use the IP-SGT binding information to know how to handle IPs based on the group-based ACLs it has set. But to do this with SXP alone, the firewall has to maintain a large number of network connections to get the binding information. This incurs heavy overhead costs to maintain all of the SXP peering and protocol information. OpenDaylight can aggregate the IP-group information so that the firewall need only connect to OpenDaylight. By moving the information flow outside of the network elements to a centralized position, we reduce the overhead of the CPU consumption on the enforcement element. This is a huge savings - it allows the enforcement point to only have to make one connection rather than thousands, so it can concentrate on its primary job of forwarding and enforcing.
328 OpenDaylight can relay the binding information from one network element to others. Changes in group membership can be propagated more readily through a centralized model. For example, in a security application a particular host (e.g., user or IP Address) may be found to be acting suspiciously or violating established security policies. The defined response is to put the host into a different source group for remediation actions such as a lower quality of service, restricted access to critical servers, or special routing conditions to ensure deeper security enforcement (e.g., redirecting the host’s traffic through an IPS with very restrictive policies). Updated group membership for this host needs to be communicated to multiple network elements as soon as possible; a very efficient and effective method of propagation can be performed using OpenDaylight as a centralized point for relaying the information.
330 OpenDayLight can create filters for exporting and receiving IP-SGT bindings used on specific peer groups, thus can provide more complex maintaining of policy groups.
332 Although the IP-SGT binding is only one specific piece of information, and although SXP is implemented widely in a single vendor’s equipment, bringing the ability of OpenDaylight to process and distribute the bindings, is a very specific immediate useful implementation of policy groups. It would go a long way to develop both the usefulness of OpenDaylight and of policy groups.
Code Review / docs.git / blob