Flow rule determination method and intelligent network card

Abstract

The invention provides a flow rule determination method and an intelligent network card, the method is applied to the intelligent network card, and the method comprises the following steps: receiving a target data packet; according to the packet header of the target data packet, determining a precise key and a wildcard key to obtain a target precise key and a target wildcard key; searching flow rule information according to the target precision key to obtain a first search result; searching flow rule information according to the target wildcard key to obtain a second search result; and determining a target action corresponding to the target data packet according to the first search result and the second search result. By adopting the method, the packet header of the data packet can be firstly compressed, and then the flow rule can be determined according to the compression result, so that the size of the search information or the bit length occupied by the field can be reduced, and the determination efficiency of the flow rule can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet, in particular to a flow rule determination method and an intelligent network card. BACKGROUND

[0002] With the continuous development of Internet technology, the number of devices and the amount of data in the network are increasing, so that the number of flow rules used is also increasing. Since different data packets may need to use different flow rules, it is necessary to determine the flow rule corresponding to the data packet. The flow rule can be determined by matching the field value of the field in the packet header of the data packet. However, since the field of the packet header of the data packet occupies a relatively long bit, the matching speed is slow, so that the determination speed of the flow rule is low. SUMMARY

[0003] Therefore, it is necessary to provide a flow rule determination method and an intelligent network card to improve the determination efficiency of the flow rule.

[0004] In a first aspect, the present application further provides a flow rule determination method, which is applied to an intelligent network card and includes the following steps.

[0005] Receiving a target data packet;

[0006] Determining an accurate key and a wildcard key according to the packet header of the target data packet, to obtain a target accurate key and a target wildcard key;

[0007] Searching for flow rule information according to the target accurate key, to obtain a first search result;

[0008] Searching for flow rule information according to the target wildcard key, to obtain a second search result;

[0009] Determining a target action corresponding to the target data packet according to the first search result and the second search result.

[0010] In some embodiments, the intelligent network card includes a ternary content addressable memory (TCAM) module, the TCAM module includes a plurality of TCAM sub-modules, each of the plurality of TCAM sub-modules includes an accurate key value and a plurality of wildcard key values, and the step of determining an accurate key and a wildcard key according to the packet header of the target data packet to obtain a target accurate key and a target wildcard key includes the following steps.

[0011] Extracting a field value of a preset field from the packet header of the target data packet;

[0012] Determining a target TCAM sub-module corresponding to the target data packet;

[0013] Determining that the accurate key corresponding to the target data packet is a key of the accurate key value in the target TCAM sub-module;

[0014] determining a key of the wildcard key value matching the value in the target TCAM sub-module and the field value, to obtain a target wildcard key.

[0015] In some embodiments, the method further comprises:

[0016] dividing the TCAM module into the plurality of TCAM sub-modules;

[0017] adding an exact key value and a plurality of wildcard key values in each of the plurality of TCAM sub-modules.

[0018] In some embodiments, the dividing the TCAM module into the plurality of TCAM sub-modules comprises:

[0019] dividing the TCAM module into the plurality of TCAM sub-modules according to a processing function, a type of data packet, or a priority of data packet.

[0020] In some embodiments, the intelligent network card comprises a rule table module, the rule table module comprising an exact table and a wildcard table, and the searching for flow rule information according to the target exact key to obtain a first search result comprises:

[0021] searching for flow rule information from the exact table according to the target exact key to obtain a first search result;

[0022] the searching for flow rule information according to the target wildcard key to obtain a second search result comprises:

[0023] searching for flow rule information from the wildcard table according to the target wildcard key to obtain a second search result.

[0024] In some embodiments, the rule table module further comprises an action table, and the determining a target action corresponding to the target data packet according to the first search result and the second search result comprises:

[0025] determining target flow rule information according to the first search result and the second search result;

[0026] searching for an action corresponding to the target flow rule information from the action table to obtain the target action corresponding to the target data packet.

[0027] In some embodiments, the determining target flow rule information according to the first search result and the second search result comprises:

[0028] in a case where the first search result is first flow rule information and the second search result is not found, determining the target flow rule information as the first flow rule information.

[0029] In a case where the first lookup result is no lookup result and the second lookup result is second flow rule information, the target flow rule information is determined as the second flow rule information.

[0030] In a case where the first lookup result is first flow rule information and the second lookup result is second flow rule information, the target flow rule information is determined as the first flow rule information.

[0031] In a second aspect, the present application further provides an intelligent network card, comprising a ternary content addressable memory (TCAM) module and a rule table module.

[0032] The TCAM module is connected to the rule table module, configured to receive a target data packet, determine an exact key and a wildcard key according to a packet header of the target data packet, and obtain a target exact key and a target wildcard key.

[0033] The rule table module is configured to search for flow rule information according to the target exact key, obtain a first lookup result, search for flow rule information according to the target wildcard key, obtain a second lookup result, and determine a target action corresponding to the target data packet according to the first lookup result and the second lookup result.

[0034] In some embodiments, the TCAM module comprises a plurality of TCAM sub-modules, each of the plurality of TCAM sub-modules comprising an exact key value and a plurality of wildcard key values.

[0035] The TCAM module is configured to extract a field value of a preset field from the packet header of the target data packet, determine a target TCAM sub-module corresponding to the target data packet, determine a target exact key as a key of the exact key value in the target TCAM sub-module, and determine a target wildcard key as a key of a wildcard key value in the target TCAM sub-module that matches the field value.

[0036] In some embodiments, the TCAM module is further configured to divide the TCAM module into the plurality of TCAM sub-modules, and add an exact key value and a plurality of wildcard key values to each of the plurality of TCAM sub-modules.

[0037] In some embodiments, the TCAM module is configured to:

[0038] According to a processing function, a type of data packet, or a priority of a data packet, divide the TCAM module into the plurality of TCAM sub-modules.

[0039] In some embodiments, the rule table module comprises an exact table and a wildcard table.

[0040] The rule table module is configured to find flow rule information from the exact table according to the target exact key to obtain a first finding result, and find flow rule information from the wildcard table according to the target wildcard key to obtain a second finding result.

[0041] In the embodiments of the present application, the intelligent network card receives a target data packet, determines an exact key and a wildcard key according to a packet header of the target data packet to obtain a target exact key and a target wildcard key, finds flow rule information according to the target exact key to obtain a first finding result, finds flow rule information according to the target wildcard key to obtain a second finding result, and determines a target action corresponding to the target data packet according to the first finding result and the second finding result. As can be seen, the packet header of the data packet can be compressed into the exact key and the wildcard key, the flow rule information can be found according to the exact key, the flow rule information can be found according to the wildcard key, and the action corresponding to the data packet can be determined according to the finding results corresponding to the exact key and the wildcard key. Since the packet header of the data packet is compressed before the flow rule is determined, the size or the bit length of the field of the finding information can be reduced, and thus the determination efficiency of the flow rule can be improved. In addition, since the flow rule information is found according to the exact key and the flow rule information is found according to the wildcard key, the action corresponding to the data packet can be determined according to the finding results corresponding to the exact key and the wildcard key. Since two ways of determining the flow rule are used, the success rate of determining the flow rule can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other related drawings can be obtained by those skilled in the art without any creative effort.

[0043] Figure 1 is a flowchart of a flow rule determination method provided by an embodiment of the present application;

[0044] Figure 2 is a flowchart of another flow rule determination method provided by an embodiment of the present application;

[0045] Figure 3 is a structural schematic diagram of an intelligent network card provided by an embodiment of the present application;

[0046] Figure 4 is a structural schematic diagram of another intelligent network card provided by an embodiment of the present application;

[0047] Figure 5 is a structural schematic diagram of another intelligent network card provided by an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0049] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-described drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein.

[0050] The present application provides a flow rule determination method and an intelligent network card, which can improve the determination efficiency of flow rules.

[0051] In order to better understand the present application, the related terms will be described first as follows.

[0052] Flow rules are the core concept in network traffic management, which are used to define the matching conditions and processing actions of data packets. Processing actions are operations that should be performed after data packets match flow rules. Processing actions can be discarded, receive side scaling (RSS), forwarding, marking, queuing, counting, checking, encapsulation, etc.

[0053] Ternary Content Addressable Memory (TCAM) is a special memory mainly used for fast lookup and matching of data, and is widely used in network devices for routing table lookup, access control list (ACL) matching, etc.

[0054] Field-Programmable Gate Array (FPGA) is a programmable integrated circuit chip.

[0055] Data Plane Development Kit (DPDK) is an open source high-performance packet processing toolset, mainly used for optimizing the processing performance of network packets, especially suitable for high-throughput and low-latency network scenarios.

[0056] The rte_flow interface is an Application Programming Interface (API) interface in DPDK for configuring hardware flow classification and packet processing rules.

[0057] In order to better understand the embodiments of the present application, the related art will be described first.

[0058] With the continuous development of Internet technology, the number of connected devices and the amount of transmitted data in the network are increasing year by year, leading to increasingly complex network applications and limited data processing speed. DPDK can address these challenges by optimizing data packet processing in high-speed network applications, including offloading processing tasks to smart network cards (Network Interface Cards, NICs) using the rte_flow interface, which allows configuring NICs with specific flow rules.

[0059] However, as the complexity of network applications increases, the number of flow rules used is also rapidly growing, which poses a challenge to building network systems that can efficiently process a large number of flow rules. However, related technologies either focus on data flow processing on FPGA-based smart network cards but lack integration of flow rule processing, or provide comprehensive research on data planes and control planes, but custom flow rules have compatibility issues, limiting integration with diversified network applications.

[0060] Figure 1 is a flowchart of a flow rule determination method provided by an embodiment of the present application. The flow rule determination method can be applied to a smart network card, which is a smart network card based on an FPGA architecture. As shown in Figure 1 The flow rule determination method can include the following steps.

[0061] 101, receiving a target data packet.

[0062] The target data packet is any data packet received by the smart network card.

[0063] The smart network card can include or be provided with a physical interface and a bus interface. The physical interface can be a physical layer interface or other physical interfaces. The bus interface can be a Peripheral Component Interconnect Express (PCIE) interface or other bus interfaces.

[0064] The smart network card can receive the target data packet from the network through the physical interface, or receive the target data packet from the host through the bus interface. The host is the host where the smart network card is currently located.

[0065] 102. Determine the exact key and wildcard key according to the header of the target data packet, to obtain a target exact key and a target wildcard key.

[0066] The data packet can include a header and data. The header of the data packet can include routing and control information, which can ensure that the data packet can be correctly and efficiently transmitted from the source end to the destination end.

[0067] The exact key refers to specifying which fields are completely consistent in flow rule matching, i.e., specifying which fields need to be matched exactly, and the key must be 100% matched with the value to be matched successfully. For example, in Internet Protocol (IP) address matching, an exact IP address corresponding key can be defined as an exact key.

[0068] The wildcard key refers to allowing the use of wildcards or mask bits to represent "not concerned" in flow rule matching, so that the key can match multiple values. The wildcard is a symbol representing fuzzy matching, which can be X, *,?, etc. The mask bit is a binary pattern that can be implemented by performing bitwise logical operations with data, which can be 0 or 1.

[0069] For example, in an ACL rule, an IP address range can be defined, and some bits of the IP address can use the wildcard "X".

[0070] Since the header of the data packet includes a large number of bits, the header of the data packet can be compressed to obtain the exact key and the wildcard key, so as to reduce the number of bits used to determine the flow rule, so as to improve the efficiency of determining the flow rule.

[0071] Since the headers of data packets are different, the flow rules corresponding to the data packets can be different. Therefore, the exact key and the wildcard key can be determined according to the header of the target data packet, to obtain a target exact key and a target wildcard key.

[0072] The exact key and the wildcard key are keys obtained by compressing the header of the data packet according to different rules.

[0073] 103. Find the flow rule information according to the target exact key to obtain a first search result.

[0074] The flow rule information can be found according to the target exact key to obtain a first search result. The flow rule information is information of the flow rule, which can uniquely identify the flow rule.

[0075] The first search result can be that the flow rule information is not found, or the first flow rule information is found. The first flow rule information is information of the first flow rule.

[0076] 104. Find the flow rule information according to the target wildcard key to obtain a second search result.

[0077] The second lookup result can be that the flow rule information is not found, or can be second flow rule information found. The first flow rule information and the second flow rule information can be the same or different.

[0078] The step 103 and the step 104 can be executed in parallel.

[0079] 105. Determine the target action corresponding to the target data packet according to the first lookup result and the second lookup result.

[0080] The target action corresponding to the target data packet can be determined according to the first lookup result and the second lookup result.

[0081] In the case that the first lookup result and the second lookup result are both that the flow rule information is not found, it is indicated that there is no action corresponding to the target data packet, and the target data packet can be directly discarded, so that the storage resources of the intelligent network card can be saved.

[0082] In the case that the first lookup result and / or the second lookup result is that the flow rule information is found, the target action corresponding to the target data packet can be determined according to the first lookup result and the second lookup result.

[0083] In the case that the first lookup result and the second lookup result are both that the flow rule information is not found, it is indicated that there is no action corresponding to the target data packet, and the target data packet can be directly discarded, so that the storage resources of the intelligent network card can be saved. Figure 1 In the flow rule determination method shown in the figure, the intelligent network card receives a target data packet, determines a target exact key and a target wildcard key according to a packet header of the target data packet, finds flow rule information according to the target exact key to obtain a first lookup result, finds flow rule information according to the target wildcard key to obtain a second lookup result, and determines a target action corresponding to the target data packet according to the first lookup result and the second lookup result. It can be seen that the packet header of the data packet can be compressed into an exact key and a wildcard key first, the flow rule information can be found according to the exact key, the flow rule information can be found according to the wildcard key, and the action corresponding to the data packet can be determined according to the lookup results corresponding to the exact key and the wildcard key. Since the packet header of the data packet is compressed before the flow rule is determined, the size or the bit length of the field of the lookup information can be reduced, so that the determination efficiency of the flow rule can be improved. In addition, since the flow rule information is found according to the exact key and the wildcard key, the action corresponding to the data packet can be determined according to the lookup results corresponding to the exact key and the wildcard key. Since two ways of determining the flow rule are used, the success rate of determining the flow rule can be improved.

[0084] Figure 2is a flow rule determination method provided by an embodiment of the present application. The flow rule determination method can be applied to an intelligent network card based on an FPGA architecture. The intelligent network card can include a TCAM module and a rule table module. As shown in Figure 2 the flow rule determination method can include the following steps.

[0085] 201. divide the TCAM module into a plurality of TCAM sub-modules, and add an exact key value and a plurality of wildcard key values to each of the plurality of TCAM sub-modules.

[0086] Since there are many data packets transmitted in the network, if there is no rule in determining the exact key and the wildcard key corresponding to the data packet, the processing will be chaotic, and the processing efficiency will be low. Therefore, in order to improve the determination efficiency of the flow rule corresponding to the data packet, the data packet can be grouped and processed, and the processing rules of different groups of data packets can be different.

[0087] According to the grouping rule of the data packet, the TCAM module can be divided into a plurality of TCAM sub-modules, so that the TCAM module can group the input data packet through the plurality of TCAM sub-modules, that is, the TCAM module can compress the packet header of the input data packet through the plurality of TCAM sub-modules to obtain an exact key and a wildcard key, which can shorten the bit length of the flow rule search information, thereby improving the flow rule determination efficiency. The number of TCAM sub-modules is the same as the number of data packet groups, that is, each TCAM sub-module corresponds to a data packet group.

[0088] Different packet grouping methods require different TCAM module partitioning methods. The principle behind grouping is to group common packet header field values ​​into different groups, while less common packet header field values ​​can be grouped together. This grouping process can be customized based on the specific needs of each application. For example, let's take the type / length field (EtherType) in the Layer 2 header of an Ethernet packet as an example. EtherType is a 16-bit field that identifies the protocol encapsulated in the payload. In network applications, the primary protocols processed are Internet Protocol version 4 (IPv4), Internet Protocol version 6 (IPv6), Address Resolution Protocol (ARP), and Virtual Local Area Network (VLAN). Therefore, only five TCAM submodules are required: one for IPv4, IPv6, ARP, VLAN, and all other protocols. This approach reduces the EtherType field from 16 bits to 3 bits.

[0089] The grouping principle may also be other principles. The following describes in detail the division method of the TCAM module.

[0090] In some embodiments, the TCAM module may be divided into multiple TCAM sub-modules according to processing functions.

[0091] The TCAM module can be divided into multiple TCAM sub-modules based on the packet processing function. That is, the TCAM module can be divided into multiple TCAM sub-modules based on the functional requirements of the TCAM module in the system. For example, the TCAM module can be divided into two TCAM sub-modules based on the packet processing function. One TCAM sub-module processes packets used for route lookup at the network layer, and the other TCAM sub-module processes packets used for ACL matching at the transport layer.

[0092] In other embodiments, the TCAM module may be divided into multiple TCAM sub-modules according to the type of the data packet.

[0093] The TCAM module can be divided into multiple TCAM sub-modules according to the type of data packet, that is, the type of traffic, that is, the type of protocol used by the data packet, so that different TCAM sub-modules can process different types of data packets, thereby realizing parallel processing of data packets, improving the efficiency of determining precise keys and wildcard keys, and thus improving the efficiency of flow rule determination.

[0094] The type of the data packet can be Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Protocol (IP), etc.

[0095] In yet some embodiments, the TCAM module can be divided into multiple TCAM sub-modules according to the priority of the data packet.

[0096] The priority of the data packet can be determined according to a security policy, a Quality of Service (QoS) requirement, a business criticality, etc.

[0097] In one case, the TCAM module can be divided into three TCAM sub-modules according to the priority of the data packet, one TCAM sub-module processes high-priority data packets, another TCAM sub-module processes medium-priority data packets, and yet another TCAM sub-module processes low-priority data packets.

[0098] In another case, the TCAM module can be divided into two TCAM sub-modules according to the priority of the data packet, one TCAM sub-module processes high-priority data packets, and another TCAM sub-module processes low-priority data packets.

[0099] Since the data packets are grouped according to the priority, the fast processing of the high-priority data packets can be guaranteed, i.e., the fast determination of the exact key and wildcard key values corresponding to the high-priority data packets, so that the fast determination of the flow rules of the high-priority data packets can be guaranteed.

[0100] After the TCAM module is divided into multiple TCAM sub-modules, an exact key value and multiple wildcard key values can be added to each of the multiple TCAM sub-modules.

[0101] The exact key value refers to that in the flow rule matching, it is clear which fields are completely consistent matching, i.e., it is clear which fields need to be matched exactly, and the key must be 100% matched with the value to match successfully. For example, in the IP address matching, an exact IP address can be defined as the exact key value.

[0102] The wildcard key value refers to that in the flow rule matching, some fields allow using wildcard or mask bit to represent "not concerned", so that one wildcard key can match multiple values. The wildcard is a symbol representing fuzzy matching, which can be X, *,?, etc. The mask bit is a binary pattern, which can be realized by performing bitwise logical operation with data, and can be 0 or 1. For example, for an IP address range 192.168.1.0 / 24, a wildcard key value can be generated, in which the first 24 bits are exact values and the last 8 bits are wildcard "X".

[0103] The data packet that each TCAM submodule can process can be determined, and then the packet header can be extracted from the network packet. The exact key can be determined according to the packet header of the data packet. The determined exact key and the corresponding field value in the packet header can be added to the corresponding TCAM submodule to form an exact key value. The wildcard key can be determined according to the packet header of the data packet. The determined wildcard key and the corresponding field value in the packet header can be added to the corresponding TCAM submodule to form a wildcard key value. After receiving the data packet subsequently, the packet header of the data packet can be compressed by the corresponding TCAM submodule, and the determination efficiency of the flow rule can be improved.

[0104] The fields of the packet header used to determine the exact key and the wildcard key can be the same or different. Taking the fields of the packet header used to determine the exact key as the first preset field and the fields of the packet header used to determine the wildcard key as the second preset field as an example for description.

[0105] The first preset field can be all fields in the packet header of the data packet, or part of the fields in the packet header of the data packet. Similarly, the second preset field can be all fields in the packet header of the data packet, or part of the fields in the packet header of the data packet.

[0106] The first preset field and the second preset field can be the same or different. For example, the first preset field and the second preset field can both be all fields in the packet header of the data packet. For example, the first preset field can be part of the fields in the packet header of the data packet, and the second preset field can be all fields in the packet header of the data packet.

[0107] The exact key values in different TCAM submodules are different. The wildcard key values in different TCAM submodules can be completely different or partially the same. The values in different wildcard key values in the same TCAM submodule can be different but the keys can be the same. The keys and values in different wildcard key values in the same TCAM submodule can all be different.

[0108] The value in the exact key value is the field value of the first preset field. The bits occupied by the key in the exact key value are determined according to the number of TCAM sub-modules. For example, when the number of TCAM sub-modules is 4, the key in the exact key value occupies 2 bits, and the key in the exact key value in the 4 TCAM sub-modules can be 00, 01, 10, and 11 respectively.

[0109] The value in the wildcard key value is the field value of the second preset field. The bits occupied by the key in the wildcard key value are determined according to the number of wildcard values.

[0110] 202, receiving a target data packet.

[0111] The detailed description of step 202 can refer to the description of step 101, which will not be repeated here.

[0112] 203, extracting the field value of the second preset field from the header of the target data packet, determining the target TCAM sub-module corresponding to the target data packet, determining the target exact key as the key of the exact key value in the target TCAM sub-module, and determining the target wildcard key as the key of the wildcard key value in the target TCAM sub-module that matches the field value of the second preset field.

[0113] The target TCAM sub-module corresponding to the target data packet can be determined first, and the target TCAM sub-module can be obtained. The values in the multiple wildcard key values in the target TCAM sub-module can be compared with the field value of the second preset field. When the value of the target wildcard key value in the target TCAM sub-module matches the field value of the second preset field, the target exact key can be determined as the key of the exact key value in the target TCAM sub-module, and the target wildcard key can be determined as the key of the target wildcard key value.

[0114] In some embodiments, the target data packet can carry information of the target data packet. According to the information of the target data packet, the target TCAM sub-module corresponding to the target data packet can be determined, the field value of the second preset field can be extracted from the header of the target data packet, and the values of the multiple wildcard key values in the target TCAM sub-module can be compared with the field value of the second preset field. When the value of one of the multiple wildcard key values in the target TCAM sub-module matches the field value of the second preset field, the target exact key can be determined as the key of the exact key value in the target TCAM sub-module, and the key of the wildcard key value in the target TCAM sub-module that matches the field value of the second preset field can be determined to obtain the target wildcard key.

[0115] The information of the target data packet can be a processing function corresponding to the target data packet, can be a type of the target data packet, or can be a priority of the target data packet.

[0116] It can be seen that since the TCAM module has been divided according to the grouping in advance, after receiving the data packet, the corresponding group, that is, the TCAM sub-module, can be directly determined according to the information of the data packet, which can reduce the time for determining the exact key and wildcard key, thereby improving the efficiency of determining the exact key and wildcard key.

[0117] In other embodiments, a packet header can be extracted from the target data packet, a field value of a first preset field can be extracted from the packet header of the target data packet to obtain a first field value, a field value of a second preset field can be extracted from the packet header of the target data packet to obtain a second field value, values ​​in precise key values ​​in multiple TCAM sub-modules can be matched with the first field value, and when the value of the precise key value of the target TCAM sub-module among multiple TCAM sub-modules matches the first field value, values ​​of multiple wildcard key values ​​in the target TCAM sub-module can be compared with the second field value, and when the value of the target wildcard key value in the target TCAM sub-module matches the second field value, the target precise key can be determined to be the key of the precise key value in the target TCAM sub-module, and the target wildcard key can be determined to be the key of the target wildcard key value in the target TCAM sub-module.

[0118] In some cases, the first field value can be matched with a value in the precise key value in the first TCAM submodule. If the first field value matches the value in the precise key value in the first TCAM submodule, that is, if the first field value is the same as the value in the precise key value in the first TCAM submodule, the second field value can be matched with a value in multiple wildcard key values ​​in the first TCAM submodule. If the second field value matches the value of one wildcard key value among the multiple wildcard key values ​​in the first TCAM submodule, the target precise key can be determined to be the key of the precise key value in the first TCAM submodule, and the target wildcard key can be determined to be the key of the wildcard key value in the first TCAM submodule. If the first field value does not match the value in the precise key value in the first TCAM submodule, or if the second field value does not match the values ​​of multiple wildcard key values ​​in the first TCAM submodule, the first field value can be matched with a value in the precise key value in the second TCAM submodule, and so on, until a value of the precise key value matches the first field value and a value of the wildcard key value matches the second field value.

[0119] It can be seen that in the process of determining the exact key and wildcard key corresponding to the target data packet, multiple TCAM sub-modules are matched sequentially. In this way, when a TCAM sub-module is matched, other TCAM sub-modules do not need to be matched, which can reduce unnecessary processing processes and thus reduce the power consumption of the smart network card.

[0120] In some cases, the first field value and the second field value can be matched with the key value in the TCAM module at the same time. Since the TCAM module is matched at the same time, the exact key and the wildcard key corresponding to the target data packet can be quickly determined according to the matching results of the TCAM module, and the efficiency of determining the exact key and the wildcard key corresponding to the target data packet can be improved, thereby improving the efficiency of determining the flow rule.

[0121] Since the number of bits of the packet header of the data packet is long, the packet header of the data packet can be compressed into the exact key and the wildcard key after passing through the TCAM module, the number of bits of the key can be reduced, the processing data during determining the flow rule can be reduced, thereby reducing the consumption of FPGA resources and improving the efficiency of determining the flow rule.

[0122] 204. Find the flow rule information from the exact table according to the target exact key, and obtain a first search result.

[0123] The rule table module can include an exact table. The exact table is a table for searching the flow rule information based on the exact key. The exact table can include the flow rule information.

[0124] The flow rule information can be searched from the exact table according to the target exact key, and a first search result can be obtained.

[0125] In some embodiments, the exact table can be a table of exact keys and flow rule information, that is, the exact table can include the exact keys and the flow rule information. Therefore, the flow rule information can be directly searched from the exact table according to the target exact key, and a first search result can be obtained.

[0126] In other embodiments, in order to improve the efficiency of determining the flow rule, the flow rule information can be searched from the exact table according to the target exact key using a hash search method, a binary search method, a dictionary tree search method, a Bloom filter search method, etc. The hash search method is taken as an example for description.

[0127] The flow rule information can be searched using the hash search method according to the target exact key, and a first search result can be obtained.

[0128] The hash search method is a high-efficiency search algorithm based on a hash table. Therefore, the flow rule information corresponding to the target exact key can be searched using the hash search method, and a first search result can be obtained, so as to improve the efficiency of determining the flow rule.

[0129] The rule table module may also include a hash table. The precise table is a table of hash values ​​and flow rule information, that is, it includes hash values ​​and flow rule information. A hash function can be used to calculate the hash value of the target precise key. If the hash table includes the hash value, the hash value is returned to obtain the target hash value. The flow rule information can be searched from the precise table based on the target hash value. If the precise table includes the target hash value, a first search result for the first flow rule information corresponding to the target hash value can be returned. If the hash table does not include the hash value, or the precise table does not include the target hash value, a first search result in which no flow rule information is found can be returned.

[0130] Since hash lookup may result in hash collisions, hash collisions can be resolved through methods such as open lookup, chain addressing, and rehashing. The following example uses dynamically adjusting the length of the linked list to resolve hash collisions.

[0131] A hash table is constructed using the chain address method. Each slot in the hash table maintains a linked list to store conflicting elements. Each slot is assigned a fixed initial linked list length. A linked list length threshold T is defined. When the length of a linked list exceeds threshold T, a dynamic adjustment mechanism is triggered.

[0132] When the length of any linked list in the hash table is greater than a threshold T, the new hash table capacity can be calculated based on the current hash table load factor. The load factor is the ratio of the number of elements in the hash table to the number of slots in the hash table.

[0133] A new hash table can be created based on the new hash table capacity, and all elements in the original hash table can be reinserted into the new hash table. The rehashing process requires recalculating the hash value of each element and inserting it into the corresponding slot in the new hash table.

[0134] During the rehashing process, the elements in the original linked list are inserted into the new hash table one by one. If the length of a slot in the new hash table still exceeds the threshold T, the length of the linked list is adjusted again until the length of all linked lists is less than or equal to the threshold T.

[0135] To avoid performance fluctuations caused by a one-time capacity expansion, you can adopt an incremental capacity expansion strategy. For example, each capacity expansion increases by a certain percentage (e.g., 50%) instead of doubling the capacity.

[0136] 205. Search the wildcard table for flow rule information according to the target wildcard key to obtain a second search result.

[0137] The rule table module may also include a wildcard table. The wildcard table is a table for searching flow rule information based on wildcard keys. The wildcard table includes flow rule information.

[0138] The flow rule information can be searched from the wildcard table according to the target wildcard key, and a second search result is obtained.

[0139] The wildcard table can be a table of wildcard keys and flow rule information, and the flow rule information can be directly searched from the exact table according to the target wildcard key, and a second search result is obtained.

[0140] In order to improve the determination efficiency of the flow rule, the flow rule information can be searched from the wildcard table according to the target wildcard key using a TCAM method, a Masked Content-Addressable Memory (CAM), or the like, and a second search result is obtained.

[0141] The flow rule information corresponding to the target wildcard key can be searched from the wildcard table using a TCAM search method, and a second search result is obtained.

[0142] 206、According to the first search result and the second search result, the target action corresponding to the target data packet is determined.

[0143] The target action corresponding to the target data packet can be determined according to the first search result and the second search result.

[0144] In the case that the first search result and the second search result are both not found flow rule information, it is indicated that there is no action corresponding to the target data packet, and the target data packet can be directly discarded, so that the storage resources of the intelligent network card can be saved.

[0145] In the case that the first search result and / or the second search result is found flow rule information, the target action corresponding to the target data packet can be determined according to the first search result and the second search result.

[0146] The rule table module can further include an action table. The target flow rule information can be determined according to the first search result and the second search result, and then the action corresponding to the target flow rule information can be searched from the action table, and the target action corresponding to the target data packet is obtained.

[0147] In the case that the first search result is the first flow rule information, and the second search result is not found flow rule information, the target flow rule information can be determined as the first flow rule information.

[0148] In the case that the first search result is not found flow rule information, and the second search result is the second flow rule information, the target flow rule information can be determined as the second flow rule information.

[0149] In the case that the first search result is the first flow rule information, and the second search result is the second flow rule information, the target flow rule information can be determined as the first flow rule information.

[0150] It can be seen that when the target exact key and the target wildcard key are matched to the flow rule information at the same time, the matching result of the target exact key is used as the basis, which can improve the accuracy of the determined flow rule.

[0151] The target action can then be performed on the target data packet.

[0152] exist Figure 2 In the flow rule determination method shown, a TCAM module can be first divided into multiple TCAM sub-modules. The TCAM sub-modules in the TCAM module can compress the packet header into an exact key and a wildcard key. Flow rule information can be searched from an exact table based on the exact key, and flow rule information can be searched from a wildcard table based on the wildcard key. The action corresponding to the packet can be determined based on the search results corresponding to the exact key and the wildcard key. Because the packet header is compressed before the flow rule is determined, the size of the search information or the length of the field ratio can be reduced, thereby improving the efficiency of flow rule determination. In addition, because the flow rule information is searched based on the exact key and the wildcard key, the action corresponding to the packet can be determined based on the search results corresponding to the exact key and the wildcard key. Since two methods of determining flow rules are used, the success rate, efficiency, and flexibility of flow rule determination can be improved.

[0153] In a distributed system, flow rules need to be consistent across multiple logical processing devices. A logical processing device is a computing entity running a DPDK driver that can independently cache and process flow rules. This application can employ a directory-based cache consistency protocol, maintaining a directory to record the cache status of flow rules across each logical processing device, thereby achieving efficient consistency management. The directory can be maintained by a server. The server can be a server or controller running a DPDK control plane process, and can be a standalone physical machine, container, or virtual machine.

[0154] The server may maintain a directory entry for each flow rule, recording the cache status of the flow rule in each logical processing device.

[0155] The directory service is a centralized directory service that is responsible for maintaining the directory table and providing functions for querying and updating the directory table.

[0156] In a case where a logical processing device needs to update a flow rule, the logical processing device can first send an update request to the server, the update request including a flow rule identifier and a new version number. After receiving the update request, the server can check the directory table to determine the cache state of the flow rule in other logical processing devices. If the flow rule is cached in other logical processing devices, the server can send an invalidate message to the logical processing devices to invalidate the local cache. The server updates the directory table to record the new version number and the cache state. After receiving the confirmation from the server, the logical processing device updates the local flow rule and writes the new flow rule to the local cache.

[0157] In a case where a logical processing device needs to read a flow rule, the logical processing device can first send a read request to the server, the read request including a flow rule identifier. After receiving the read request, the server can check the directory table to determine the latest version number and the cache state of the flow rule. If the local cache version of the logical processing device is consistent with the version in the directory table, the flow rule is read from the local cache directly. If the local cache version of the logical processing device is outdated, the server can send the latest rule data to the logical processing device and update the cache state in the directory table.

[0158] To avoid frequent invalidate messages, a lazy update strategy can be used. In a case where a logical processing device updates a flow rule, the logical processing device can not immediately notify other logical processing devices to invalidate the cache, but mark the flow rule as “dirty”. Only in a case where other logical processing devices need to read the flow rule, an invalidate message and data update are performed. In a case where multiple flow rules are updated simultaneously, multiple update requests can be combined into a batch update request to reduce the communication overhead of the server. To avoid version number conflicts, a globally unique version number generation mechanism can be used. For example, a timestamp or a distributed ID generation algorithm can be used.

[0159] It should be understood that the same or corresponding information in different embodiments can be referred to each other, and the contents and / or steps in different embodiments can be combined with each other.

[0160] It should be understood that some steps in the above embodiments can be omitted, and some steps can be combined.

[0161] Figure 3 FIG. 1 is a structural schematic diagram of an intelligent network card provided by an embodiment of the present application. As shown in FIG. 1, the intelligent network card can include a TCAM module and a rule table module. Figure 3 The TCAM module is connected to the rule table module, and is configured to receive a target data packet, determine an exact key and a wildcard key according to a packet header of the target data packet, and obtain a target exact key and a target wildcard key.

[0162] The TCAM module is connected to the rule table module, and is configured to receive a target data packet, determine an exact key and a wildcard key according to a packet header of the target data packet, and obtain a target exact key and a target wildcard key.

[0163] The rule table module is configured to search for flow rule information according to the target exact key to obtain a first search result, search for flow rule information according to the target wildcard key to obtain a second search result, and determine the target action corresponding to the target data packet according to the first search result and the second search result.

[0164] After the TCAM module receives the target data packet, the header of the target data packet can be compressed to obtain a target exact key and a target wildcard key corresponding to the target data packet, and then the target data packet, the target exact key and the target wildcard key can be sent to the rule table module.

[0165] After the rule table module receives the target data packet, the target exact key and the target wildcard key, the rule table module can search for flow rule information according to the target exact key to obtain a first search result, search for flow rule information according to the target wildcard key to obtain a second search result, and determine the target action corresponding to the target data packet according to the first search result and the second search result.

[0166] The detailed description of the TCAM module and the rule table module can be referred to the above related description, and will not be repeated here.

[0167] As can be seen, the header of the data packet can be compressed into an exact key and a wildcard key first, the flow rule information can be searched according to the exact key, the flow rule information can be searched according to the wildcard key, and the action corresponding to the data packet can be determined according to the search results corresponding to the exact key and the wildcard key. Since the header of the data packet is compressed before the flow rule is determined, the size or the bit length of the field of the search information can be reduced, so that the determination efficiency of the flow rule can be improved, and the consumption of the FPGA resource can be reduced. In addition, since the rule table module searches for the flow rule information according to the exact key and searches for the flow rule information according to the wildcard key, the action corresponding to the data packet can be determined according to the search results corresponding to the exact key and the wildcard key. Since two ways of determining the flow rule are used, the success rate of determining the flow rule can be improved.

[0168] In some embodiments, the TCAM module can include a plurality of TCAM sub-modules, and each TCAM sub-module of the plurality of TCAM sub-modules can include one exact key value and a plurality of wildcard key values.

[0169] The TCAM module is configured to extract a field value of a preset field from a header of a target data packet, determine a target TCAM sub-module corresponding to the target data packet, determine an exact key corresponding to the target data packet as a key of an exact key value in the target TCAM sub-module, determine a wildcard key value in the target TCAM sub-module whose value matches the field value, and obtain a target wildcard key.

[0170] The detailed description of the TCAM module can refer to the description of step 203, and will not be repeated here.

[0171] It can be seen that since the TCAM module is divided in advance according to the grouping, after receiving the data packet, the TCAM submodule corresponding to the data packet can be directly determined, the determination time of the exact key and the wildcard key can be reduced, and the determination efficiency of the exact key and the wildcard key can be improved.

[0172] In some embodiments, the TCAM module is further configured to divide the TCAM module into a plurality of TCAM submodules, and add an exact key value and a plurality of wildcard key values to each of the plurality of TCAM submodules.

[0173] The detailed description of the TCAM module can refer to the description of step 201, and will not be repeated here.

[0174] It can be seen that the TCAM module can be divided in advance according to the grouping, so that after receiving the data packet, the TCAM submodule corresponding to the data packet can be directly determined, the determination time of the exact key and the wildcard key can be reduced, and the determination efficiency of the exact key and the wildcard key can be improved.

[0175] In some embodiments, the TCAM module is specifically configured to divide the TCAM module into a plurality of TCAM submodules according to a processing function, a type of the data packet, or a priority of the data packet.

[0176] The detailed description of the TCAM module can refer to the description of step 201, and will not be repeated here.

[0177] It can be seen that the TCAM module can be divided according to different ways, and the flexibility of data packet processing can be improved.

[0178] In some embodiments, the rule table module can include an exact table and a wildcard table.

[0179] The rule table module is configured to find the flow rule information from the exact table according to the target exact key, to obtain a first search result, and find the flow rule information from the wildcard table according to the target wildcard key, to obtain a second search result.

[0180] The detailed description of the rule table module can refer to the description above, and will not be repeated here.

[0181] In some embodiments, the rule table module can further include an action table, and the rule table module is specifically configured to determine the target flow rule information according to the first search result and the second search result, find the action corresponding to the target flow rule information from the action table, and obtain the target action corresponding to the target data packet.

[0182] In some embodiments, the rule table module is specifically configured to:

[0183] In a case where the first lookup result is the first flow rule information and the second lookup result is not found, the target flow rule information is determined as the first flow rule information;

[0184] In a case where the first lookup result is not found and the second lookup result is the second flow rule information, the target flow rule information is determined as the second flow rule information;

[0185] In a case where the first lookup result is the first flow rule information and the second lookup result is the second flow rule information, the target flow rule information is determined as the first flow rule information.

[0186] It can be seen that, since the rule table module maintains the exact table and the wildcard table, the flow rule information can be looked up according to the exact key, and the flow rule information can be looked up according to the wildcard key, and the action corresponding to the data packet can be determined according to the lookup results corresponding to the exact key and the wildcard key. Since the two tables are used to determine the flow rule, the success rate, the efficiency and the flexibility of the determination of the flow rule can be improved.

[0187] Figure 4 is another structure schematic diagram of an intelligent network card provided by an embodiment of the present application. As shown in the figure, Figure 4 The intelligent network card can further include a header parser and an action execution module.

[0188] The header parser is connected to the TCAM module and is configured to receive a target data packet and extract a packet header from the target data packet.

[0189] The action execution module is connected to the rule table module and is configured to perform a target action on the data packet.

[0190] It can be seen that the intelligent network card can quickly determine the flow rule corresponding to the data packet and perform the processing action corresponding to the determined flow rule on the data packet, so that the efficiency of the data packet transmission can be improved.

[0191] Figure 5 is still another structure schematic diagram of an intelligent network card provided by an embodiment of the present application. As shown in the figure, Figure 5 The intelligent network card can include an inbound adapter, a first header parser, a first TCAM module, a first rule table module, a first action execution module, a second header parser, a second TCAM module, a second rule table module, a second action execution module and an outbound adapter.

[0192] The inbound adapter, the first header parser, the first TCAM module, the first rule table module and the first action execution module are sequentially connected. The second header parser, the second TCAM module, the second rule table module, the second action execution module and the outbound adapter are sequentially connected.

[0193] An inbound adapter receives a first target data packet from a network, determines a length of the first target data packet, verifies validity of the first target data packet, generates first metadata according to the length of the first target data packet and the verification result, the first metadata including the length of the first target data packet and the verification result, and sends the first target data packet and the first metadata to a first header parser.

[0194] After the first header parser receives the first target data packet and the first metadata, the first header parser extracts a packet header of the first target data packet to obtain a first packet header, and then sends the first target data packet, the first metadata and the first packet header to a first TCAM module. The first packet header can include all fields of the first packet header. For example, the first packet header can include all necessary fields covering layers 2, 3 and 4 of an Open Systems Interconnection (OSI) model.

[0195] After the first TCAM module receives the first target data packet, the first metadata and the first packet header, the first TCAM module determines a precise key and a wildcard key according to the first packet header, obtains a first target precise key and a first target wildcard key, and then sends the first target data packet, the first metadata, the first target precise key and the first target wildcard key to a first rule table module.

[0196] After the first rule table module receives the first target data packet, the first metadata, the first target precise key and the first target wildcard key, the first rule table module searches for flow rule information according to the first target precise key to obtain a first search result, searches for flow rule information according to the first target wildcard key to obtain a second search result, determines a target action corresponding to the first target data packet according to the first search result and the second search result, and then sends the first target data packet, the first metadata and the first target action to a first action execution module.

[0197] After the first action execution module receives the first target data packet, the first metadata and the first target action, the first action execution module executes the first target action on the first target data packet, and sends the first target data packet and the first metadata after the first target action is executed to a host.

[0198] The second header parser receives a second target data packet from the host, extracts a packet header of the second target data packet to obtain a second packet header, and then sends the second target data packet and the second packet header to a second TCAM module.

[0199] After the second TCAM module receives the second target data packet and the second packet header, the second TCAM module can determine the exact key and the wildcard key according to the second packet header, obtain the second target exact key and the second target wildcard key, and then send the second target data packet, the second target exact key and the second target wildcard key to the second rule table module.

[0200] After the second rule table module receives the second target data packet, the second target exact key and the second target wildcard key, the second rule table module can search the flow rule information according to the second target exact key to obtain a third search result, search the flow rule information according to the second target wildcard key to obtain a fourth search result, determine the second target action corresponding to the second target data packet according to the third search result and the fourth search result, and then send the second target data packet and the second target action to the second action execution module.

[0201] After the second action execution module receives the second target data packet and the second target action, the second action execution module can execute the second target action on the second target data packet, and send the second target data packet after the second target action is executed to the outbound adapter.

[0202] After the outbound adapter receives the second target data packet after the second target action is executed, the outbound adapter can send the second target data packet after the second target action is executed to the network after the second target data packet is encapsulated.

[0203] The detailed description of each module can be referred to the above description, and will not be repeated here.

[0204] As can be seen, the intelligent network card includes a receive (RX) path and a transmit (TX) path, and can realize bidirectional transmission of data packets. The RX path is an inbound adapter-first header parser-first TCAM module-first rule table module-first action execution module, and the TX path is a second header parser-second TCAM module-second rule table module-second action execution module-outbound adapter.

[0205] The technical features of the above embodiments can be combined in any manner. To make the description concise, all possible combinations of the technical features in the above embodiments are not described, but as long as the combinations of the technical features do not exist, they should be considered as the scope of the present application.

[0206] The above-described embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A flow rule determination method, characterized in that: The method is applied to a smart network card, comprising: Receive target data packet; Determine the exact key and the wildcard key according to the header of the target data packet, and obtain the target exact key and the target wildcard key; Searching for flow rule information according to the target precise key to obtain a first search result; Searching for flow rule information according to the target wildcard key to obtain a second search result; A target action corresponding to the target data packet is determined according to the first search result and the second search result.

2. The method according to claim 1, characterized in that The smart network card includes a ternary content addressable memory (TCAM) module, the TCAM module includes multiple TCAM submodules, each of the multiple TCAM submodules includes an exact key value and multiple wildcard key values, and determining the exact key and the wildcard key according to the header of the target data packet to obtain the target exact key and the target wildcard key includes: Extracting a field value of a preset field from a packet header of the target data packet; Determine a target TCAM submodule corresponding to the target data packet; Determine that the precise key corresponding to the target data packet is a key of a precise key value in the target TCAM submodule; Determine a key of a wildcard key value whose value in the target TCAM submodule matches the field value to obtain a target wildcard key.

3. The method according to claim 2, characterized in that The method further comprises: Dividing the TCAM module into the multiple TCAM sub-modules; Each of the multiple TCAM sub-modules adds an exact key value and multiple wildcard key values.

4. The method according to claim 3, characterized in that The dividing the TCAM module into the plurality of TCAM sub-modules includes: The TCAM module is divided into the multiple TCAM sub-modules according to processing functions, data packet types or data packet priorities.

5. The method according to claim 1, wherein The smart network card includes a rule table module, the rule table module includes a precise table and a wildcard table, and searching the flow rule information according to the target precise key to obtain a first search result includes: Searching for flow rule information from the precise table according to the target precise key to obtain a first search result; The searching flow rule information according to the target wildcard key to obtain a second search result includes: Flow rule information is searched in the wildcard table according to the target wildcard key to obtain a second search result.

6. The method according to claim 5, characterized in that The rule table module further includes an action table, and determining a target action corresponding to the target data packet according to the first search result and the second search result includes: Determining target flow rule information according to the first search result and the second search result; The action corresponding to the target flow rule information is searched in the action table to obtain the target action corresponding to the target data packet.

7. The method according to claim 6, characterized in that The determining target flow rule information according to the first search result and the second search result includes: If the first search result is the first flow rule information and the second search result is that the target flow rule information is not found, determining that the target flow rule information is the first flow rule information; If the first search result is that no result is found and the second search result is the second flow rule information, determining that the target flow rule information is the second flow rule information; When the first search result is the first flow rule information and the second search result is the second flow rule information, the target flow rule information is determined to be the first flow rule information.

8. A smart network card, characterized in that: It includes a ternary content addressable memory TCAM module and a rule table module; The TCAM module is connected to the rule table module and is used to receive a target data packet, determine an exact key and a wildcard key according to a header of the target data packet, and obtain a target exact key and a target wildcard key; The rule table module is used to search for flow rule information according to the target precise key to obtain a first search result, search for flow rule information according to the target wildcard key to obtain a second search result, and determine the target action corresponding to the target data packet based on the first search result and the second search result.

9. The smart network card according to claim 8, wherein: The TCAM module includes a plurality of TCAM submodules, each of the plurality of TCAM submodules includes an exact key value and a plurality of wildcard key values; The TCAM module is used to extract the field value of a preset field from the packet header of the target data packet, determine the target TCAM sub-module corresponding to the target data packet, determine the key whose precise key corresponding to the target data packet is the precise key value in the target TCAM sub-module, determine the key of the wildcard key value whose value in the target TCAM sub-module matches the field value, and obtain the target wildcard key.

10. The smart network card according to claim 8, wherein: The rule table module includes a precise table and a wildcard table; The rule table module is configured to search the flow rule information from the precise table according to the target precise key to obtain a first search result, and search the flow rule information from the wildcard table according to the target wildcard key to obtain a second search result.

Images