A method and apparatus for offloading flow table rules for network interface cards (NICs)

Abstract

An embodiment of the present invention provides a method and device for unloading flow table rules for data packets of a network card, by obtaining a first native flow table rule; the first native flow table rule includes a first native action domain; the first native action domain includes connection tracking action information; a first hardware flow table rule for the first native flow table rule before executing connection tracking is determined through the connection tracking action information; a second hardware flow table rule for the first native flow table rule after executing connection tracking is determined through the first hardware flow table rule; based on the first hardware flow table rule and the second hardware flow table rule, the flow table rule for the data packet is unloaded to the network card, which can avoid unloading the flow table rule for the data packet to the network card in the form of a merged flow table, thereby simplifying the logic of the unloading process and improving the efficiency of unloading the flow table rules for the data packet of the network card.

Description

Technical Field

[0001] The present invention relates to the technical field of flow table rule unloading for data packets of a network card, and in particular to a flow table rule unloading method for data packets of a network card, a flow table rule unloading device for data packets of a network card, a network card, an electronic device and a computer-readable storage medium. Background Art

[0002] There is a hardware flow table in the smart NIC hardware. When a data packet fails to match the hardware flow table, it will be sent to the software OVS to generate flow table rules. The flow table rules include a match field and an action field. The match field consists of the packet message information, and the action field specifies the action that the packet should perform. After the generated flow table rules are converted and written into the hardware, the data packet matches the hardware flow table and is directly forwarded, thus realizing hardware unloading.

[0003] Therefore, how to improve the efficiency of unloading flow table rules for data packets of a network card has become a technical problem that those skilled in the art need to overcome. Summary of the invention

[0004] The embodiment of the present invention provides a method, device, network card, electronic device and computer-readable storage medium for unloading flow table rules of data packets of a network card to solve the problem of how to improve the efficiency of unloading flow table rules of data packets of the network card.

[0005] The embodiment of the present invention discloses a method for unloading flow table rules of a data packet of a network card, which may include:

[0006] Obtain a first native flow table rule; the first native flow table rule includes a first native action field; the first native action field includes connection tracking action information;

[0007] Determine, by using the connection tracking action information, a first hardware flow table rule for the first native flow table rule before executing the connection tracking;

[0008] Determine, by using the first hardware flow table rule, a second hardware flow table rule for the first native flow table rule after connection tracking is performed;

[0009] The flow table rule for the data packet is unloaded to the network card based on the first hardware flow table rule and the second hardware flow table rule.

[0010] Optionally, the first native flow table rule includes a first native matching domain, the first native matching domain includes first regular message information and initial recycling information, the first native action domain includes first other action information, and the step of determining a first hardware flow table rule for the first native flow table rule before performing connection tracking through the connection tracking action information may include:

[0011] Determine a first insertion position identifier for characterizing an insertion position of the first hardware flow table rule;

[0012] Determine a first hardware matching domain for the first hardware flow table rule through the first regular message information;

[0013] Generate a first jump coefficient for the first hardware flow table rule by using the first insertion position identifier and first flag information of the first native flow table rule before executing connection tracking;

[0014] Determine a first jump position identifier for representing a jump position of the first hardware flow table rule by using the first jump coefficient;

[0015] Calculating a first Hash value for a first hardware flow table rule through the first regular message information, and generating a first association tag using the first Hash value;

[0016] Determine a first hardware action domain for the first hardware flow table rule by using the first jump position identifier and the first association tag;

[0017] The first hardware flow table rule is determined using the first hardware matching domain and the first hardware action domain.

[0018] Optionally, the step of determining, by using the first hardware flow table rule, a second hardware flow table rule for the first native flow table rule after performing connection tracking may include:

[0019] Obtain a second native flow table rule corresponding to the first native flow table rule; the second native flow table rule includes a second native matching domain, the second native matching domain and the first native action domain include the same target recycling information, and the target recycling information is used to associate the second native flow table rule with the first native flow table rule;

[0020] Generate a first insertion coefficient through the initial recycling information and the second flag information of the first native flow table rule after performing connection tracking;

[0021] Determine a second insertion position identifier for characterizing an insertion position of the second hardware flow table rule by using the first insertion coefficient;

[0022] Determine a second hardware matching domain for the second hardware flow table rule using the first association tag;

[0023] generating a second jump coefficient by using the target recycling information and third flag information for the second native flow table rule;

[0024] Determine a second jump position identifier for characterizing a jump position of the second hardware flow table rule by using the second jump coefficient;

[0025] Calculating a second Hash value for a second hardware flow table rule by using the target recycling information and the first regular message information, and generating a second association tag by using the second Hash value;

[0026] Determine a second hardware action domain for the second hardware flow table rule by using the second jump position identifier, the second association tag, and the first other action information;

[0027] The second hardware matching domain and the second hardware action domain are used to determine the second hardware flow table rule.

[0028] Optionally, it may also include:

[0029] Obtain connection tracking five-tuple information for the first native flow table rule;

[0030] Determine a connection tracking quintuple information matching domain through the connection tracking quintuple information, and determine a connection tracking quintuple information action domain using the first insertion coefficient;

[0031] Based on the connection tracking quintuple information matching domain and the connection tracking quintuple information action domain, a connection tracking quintuple flow table rule for the connection tracking quintuple information is determined, and the first jump coefficient is used as the second insertion coefficient to determine a third insertion position identifier for characterizing the insertion position of the connection tracking quintuple flow table rule.

[0032] Optionally, the second native flow table rule includes a second native action field, the second native matching field includes second regular message information and uninstalled tracking action state information; the second native action field includes second other action information, and may further include:

[0033] Determine a third hardware matching domain using the second conventional message information;

[0034] Determine a third hardware action domain using the second other action information;

[0035] A third hardware flow table rule is determined based on the third hardware matching domain and the third hardware action domain, and a fourth insertion position identifier for characterizing an insertion position of the third hardware flow table rule is determined using the second jump coefficient as a third insertion coefficient.

[0036] Optionally, the target second hardware flow table rule has a corresponding counter, and the counter is used to count the first native flow table rule.

[0037] Optionally, the connection tracking five-tuple flow table rule has a corresponding first connection information database, the second hardware flow table rule has a corresponding second connection information database, and the third hardware flow table rule has a corresponding third connection information database. The method is applied to a hardware unloading module, and the hardware unloading module has a corresponding flow table rule unloading software OVS-DPDK. The step of unloading the flow table rule for the data packet to the network card based on the first hardware flow table rule and the second hardware flow table rule may include:

[0038] marking the data packet with the first association tag based on the first hardware action field;

[0039] When the first association mark is read, jumping to the first connection information database based on a first jump position identifier corresponding to the first association mark;

[0040] When the first connection information database does not have a connection tracking five-tuple flow table rule corresponding to the data packet, the data packet marked with the first association tag is sent to the flow table rule unloading software OVS-DPDK, and the flow table rule unloading software OVS-DPDK is used to execute the first native flow table rule on the data packet marked with the first association tag, so as to unload the flow table rule for the data packet to the network card;

[0041] When the first connection information database has a connection tracking five-tuple flow table rule corresponding to the data packet, jump to the second connection information database based on the connection tracking five-tuple information action field;

[0042] When the second connection information database has a second hardware flow table rule corresponding to the data packet, the first other action information is executed based on the second hardware matching domain and the second hardware action domain, the data packet is marked with the second association tag, and the data packet is jumped to the third connection information database based on a second jump position identifier corresponding to the second association tag;

[0043] When the third connection information database has a third hardware flow table rule corresponding to the data packet, the flow table rule for the data packet is unloaded to the network card based on the third hardware flow table rule;

[0044] When the third connection information database does not have a third hardware flow table rule corresponding to the data packet, the data packet marked with the second association tag is sent to the flow table rule unloading software OVS-DPDK, and the flow table rule unloading software OVS-DPDK is used to execute the second native flow table rule on the data packet marked with the second association tag to unload the flow table rule for the data packet to the network card.

[0045] The embodiment of the present invention further discloses a flow table rule unloading device for a data packet of a network card, which may include:

[0046] A first native flow table rule acquisition module, configured to acquire a first native flow table rule; the first native flow table rule comprises a first native action field; the first native action field comprises connection tracking action information;

[0047] A first hardware flow table rule determination module, configured to determine, through the connection tracking action information, a first hardware flow table rule for the first native flow table rule before executing the connection tracking;

[0048] A second hardware flow table rule determination module, configured to determine, through the first hardware flow table rule, a second hardware flow table rule for the first native flow table rule after connection tracking is performed;

[0049] A flow table rule unloading module is used to unload the flow table rule for the data packet to the network card based on the first hardware flow table rule and the second hardware flow table rule.

[0050] Optionally, the first native flow table rule includes a first native matching domain, the first native matching domain includes first regular message information and initial recycling information, the first native action domain includes first other action information, and the first hardware flow table rule determination module may include:

[0051] A first insertion position identifier determination submodule, used to determine a first insertion position identifier used to characterize an insertion position of the first hardware flow table rule;

[0052] A first hardware matching domain determining submodule, configured to determine a first hardware matching domain for the first hardware flow table rule through the first conventional message information;

[0053] A first jump coefficient generating submodule, configured to generate a first jump coefficient for the first hardware flow table rule by using the first insertion position identifier and first flag information of the first native flow table rule before connection tracking is performed;

[0054] A first jump position identifier determining submodule, configured to determine a first jump position identifier for characterizing a jump position of the first hardware flow table rule by using the first jump coefficient;

[0055] a first association tag generating submodule, configured to calculate a first hash value for a first hardware flow table rule through the first regular message information, and generate a first association tag using the first hash value;

[0056] A first hardware action domain determination submodule, configured to determine a first hardware action domain for the first hardware flow table rule by using the first jump position identifier and the first association tag;

[0057] The first hardware flow table rule determination submodule is used to determine the first hardware flow table rule by using the first hardware matching domain and the first hardware action domain.

[0058] Optionally, the second hardware flow table rule determination module may include:

[0059] A second native flow table rule acquisition submodule, used to acquire a second native flow table rule corresponding to the first native flow table rule; the second native flow table rule includes a second native matching domain, the second native matching domain and the first native action domain contain the same target recycling information, and the target recycling information is used to associate the second native flow table rule with the first native flow table rule;

[0060] A first insertion coefficient generating submodule, configured to generate a first insertion coefficient through the initial recycling information and the second flag information of the first native flow table rule after performing connection tracking;

[0061] A second insertion position identifier determination submodule, used to determine a second insertion position identifier used to characterize an insertion position of the second hardware flow table rule by using the first insertion coefficient;

[0062] A second hardware matching domain determining submodule, configured to determine a second hardware matching domain for the second hardware flow table rule by using the first association tag;

[0063] A second jump coefficient generating submodule, configured to generate a second jump coefficient by using the target recycling information and the third flag information for the second native flow table rule;

[0064] A second jump position identifier determining submodule, used to determine a second jump position identifier for characterizing a jump position of the second hardware flow table rule by using the second jump coefficient;

[0065] a second association tag determination submodule, configured to calculate a second Hash value for a second hardware flow table rule by using the target recycling information and the first regular message information, and generate a second association tag by using the second Hash value;

[0066] A second hardware action domain determination submodule, configured to determine a second hardware action domain for the second hardware flow table rule by using the second jump position identifier, the second association tag, and the first other action information;

[0067] The second hardware flow table rule determination submodule is used to determine the second hardware flow table rule by using the second hardware matching domain and the second hardware action domain.

[0068] Optionally, it may also include:

[0069] A connection tracking five-tuple information acquisition module, used to obtain connection tracking five-tuple information for the first native flow table rule;

[0070] a connection tracking quintuple information action domain determining module, configured to determine a connection tracking quintuple information matching domain through the connection tracking quintuple information, and determine the connection tracking quintuple information action domain using the first insertion coefficient;

[0071] A connection tracking quintuple flow table rule determination module is used to determine the connection tracking quintuple flow table rule for the connection tracking quintuple information based on the connection tracking quintuple information matching domain and the connection tracking quintuple information action domain, and use the first jump coefficient as the second insertion coefficient to determine the third insertion position identifier used to characterize the insertion position of the connection tracking quintuple flow table rule.

[0072] Optionally, the second native flow table rule includes a second native action field, the second native matching field includes second regular message information and uninstalled tracking action state information; the second native action field includes second other action information, and may further include:

[0073] A third hardware matching domain determining module, configured to determine a third hardware matching domain using the second conventional message information;

[0074] A third hardware action domain determining module, configured to determine a third hardware action domain using the second other action information;

[0075] The third hardware flow table rule determination module is used to determine the third hardware flow table rule based on the third hardware matching domain and the third hardware action domain, and use the second jump coefficient as the third insertion coefficient to determine the fourth insertion position identifier used to characterize the insertion position of the third hardware flow table rule.

[0076] Optionally, the target second hardware flow table rule has a corresponding counter, and the counter is used to count the first native flow table rule.

[0077] Optionally, the connection tracking five-tuple flow table rule has a corresponding first connection information database, the second hardware flow table rule has a corresponding second connection information database, the third hardware flow table rule has a corresponding third connection information database, the device is applied to a hardware unloading module, the hardware unloading module has a corresponding flow table rule unloading software OVS-DPDK, and the flow table rule unloading module includes:

[0078] a data packet marking submodule, configured to mark the data packet with the first association mark based on the first hardware action domain;

[0079] a first jump submodule, configured to jump to the first connection information database based on a first jump position identifier corresponding to the first association mark when the first association mark is read;

[0080] A first data packet sending submodule, configured to send the data packet marked with the first association tag to the flow table rule unloading software OVS-DPDK when the first connection information database does not have a connection tracking five-tuple flow table rule corresponding to the data packet, wherein the flow table rule unloading software OVS-DPDK is configured to execute the first native flow table rule on the data packet marked with the first association tag, so as to unload the flow table rule for the data packet to the network card;

[0081] a second jump submodule, configured to jump to the second connection information database based on the connection tracking quintuple information action field when the first connection information database has a connection tracking quintuple flow table rule corresponding to the data packet;

[0082] a third jump submodule, configured to execute the first other action information based on the second hardware matching domain and the second hardware action domain, mark the data packet with the second association tag, and jump to the third connection information database based on a second jump position identifier corresponding to the second association tag when the second connection information database has a second hardware flow table rule corresponding to the data packet;

[0083] a flow table rule unloading submodule, configured to unload the flow table rule for the data packet to the network card based on the third hardware flow table rule when the third connection information database has a third hardware flow table rule corresponding to the data packet;

[0084] The second data packet sending submodule is used to send the data packet marked with the second association tag to the flow table rule unloading software OVS-DPDK when the third connection information database does not have a third hardware flow table rule corresponding to the data packet. The flow table rule unloading software OVS-DPDK is used to execute the second native flow table rule on the data packet marked with the second association tag to unload the flow table rule for the data packet to the network card.

[0085] The embodiment of the present invention further discloses a network card, wherein the network card is configured with a flow table rule unloading system for data packets of the network card, and the flow table rule unloading system is used to implement the method described in the embodiment of the present invention.

[0086] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0087] The memory is used to store computer programs;

[0088] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0089] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0090] The embodiments of the present invention include the following advantages:

[0091] The embodiment of the present invention obtains a first native flow table rule; the first native flow table rule includes a first native action domain; the first native action domain includes connection tracking action information; a first hardware flow table rule is determined for the first native flow table rule before connection tracking is performed through the connection tracking action information; a second hardware flow table rule is determined for the first native flow table rule after connection tracking is performed through the first hardware flow table rule; based on the first hardware flow table rule and the second hardware flow table rule, the flow table rule for the data packet is unloaded to the network card, which can avoid unloading the flow table rule for the data packet to the network card in the form of a merged flow table, thereby simplifying the logic of the unloading process and improving the efficiency of unloading the flow table rule for the data packet to the network card. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] Figure 1 It is a flowchart of the steps of a method for unloading flow table rules of a data packet of a network card provided in an embodiment of the present invention;

[0093] Figure 2 is a structural diagram of a connection information database provided in an embodiment of the present invention;

[0094] Figure 3 It is a structural block diagram of a flow table rule unloading device for a data packet of a network card provided in an embodiment of the present invention;

[0095] Figure 4 It is a hardware structure block diagram of an electronic device provided in each embodiment of the present invention. DETAILED DESCRIPTION

[0096] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0097] Reference Figure 1 , shows a flowchart of a method for unloading flow table rules for a data packet of a network card provided in an embodiment of the present invention, which may specifically include the following steps:

[0098] Step 101, obtaining a first native flow table rule; the first native flow table rule includes a first native action field; the first native action field includes connection tracking action information;

[0099] Step 102, determining a first hardware flow table rule for the first native flow table rule before executing connection tracking through the connection tracking action information;

[0100] Step 103, determining a second hardware flow table rule for the first native flow table rule after connection tracking is performed through the first hardware flow table rule;

[0101] Step 104: Unload the flow table rule for the data packet to the network card based on the first hardware flow table rule and the second hardware flow table rule.

[0102] In a specific implementation, an embodiment of the present invention can be applied to a flow table rule unloading system for data packets of a network card. The flow table unloading system of an embodiment of the present invention can be integrated into a network card. The flow table unloading system of an embodiment of the present invention may include a flow table unloading module and a hardware unloading module. The flow table unloading module can be used to obtain a first native flow table rule, determine a first hardware flow table rule for the first native flow table rule before executing connection tracking through connection tracking action information, and determine a second hardware flow table rule for the first native flow table rule after executing connection tracking through the first hardware flow table rule, so that when the data packet passes through the hardware unloading module, the flow table can be unloaded to the network card based on the first hardware flow table rule and the second hardware flow table rule.

[0103] In practical applications, KVM (kernel-based virtual machine) is a complete virtualization solution. Using KVM, you can run multiple virtual machines of unmodified Linux or Windows images, each of which has its own virtualized hardware: network card, disk, graphics adapter, etc.

[0104] The network card in the embodiment of the present invention may be a smart network card, which may include but is not limited to a smart network card loaded in a KVM virtual machine.

[0105] OVS-DPDK: DPDK is a collection of libraries and drivers for fast packet processing on the X86 platform. OVS (Open vSwitch) has been widely used in cloud environments as a multi-layer virtual switch with its rich functions. The main function of Open vSwitch is to provide network access for VMs on physical machines. Compared with physical switches, it is more suitable for complex and changeable cloud network environments. Software OVS uses the CPU to receive, process, and forward data packets. As the number of packets increases and the complexity of packet processing increases, the processing power of the software CPU has brought performance bottlenecks.

[0106] First packet: The first data packet sent from the client to the server.

[0107] Exemplarily, the first native flow table rule FLOW A of the native flow table for sending the first packet to OVS-DPDK connection tracking can be obtained, wherein the first native flow table rule FLOW A can be a native flow table rule for the data packet, and the first native flow table rule FLOW A can include a first native matching domain and a first native action domain corresponding thereto.

[0108] Exemplarily, FLOW A includes: a FLOW A matching domain and a FLOW A action domain, wherein the FLOW A matching domain includes the first regular message information M1 and the initial recycling information recirc_id(0), and the FLOW A action domain includes: ct+recirc(idA)+ACT1 (other actions). The first native action domain of an embodiment of the present invention may include connection tracking action information ct.

[0109] OVS CT connection tracking: Ct (conntrack) is like a third-party module for OVS, which reuses the kernel's conntrack module. The kernel tracks all connection states and sessions of a machine, intercepts and analyzes every data packet flowing through the machine, and establishes the connection information database conntrack table on the machine, which is continuously updated. The stateless firewall filters data packets based on the five-tuple. The stateful firewall can filter data packets based on the connection state in addition to the five-tuple.

[0110] The connection tracking action information ct may be used to express the connection tracking state for the data packet.

[0111] An embodiment of the present invention can determine the first hardware flow table rule RTE_FLOW_A1 for the first native flow table rule FLOW A before executing connection tracking through the connection tracking action information ct, and determine the second hardware flow table rule RTE_FLOW_A2 for the first native flow table rule FLOW A after executing connection tracking through the first hardware flow table rule RTE_FLOW_A1.

[0112] Exemplarily, after receiving the first native flow table rule FLOW A, the flow table unloading module can enter the flow table unloading ct branch because the action domain of the first native flow table rule FLOW A contains the ct action, and split the first native flow table rule FLOWA into two hardware flow tables RTE_FLOW_A1 and RTE_FLOW_A2: RTE_FLOW_A1 can be the flow table rule before searching the CT connection table, and RTE_FLOW_A2 can be the flow table rule after searching the CT connection table.

[0113] After determining the first hardware flow table rule RTE_FLOW_A1 and the second hardware flow table rule RTE_FLOW_A2, the embodiment of the present invention can offload the flow table to the network card based on the first hardware flow table rule RTE_FLOW_A1 and the second hardware flow table rule RTE_FLOW_A2.

[0114] In actual applications, the flow table rules for data packets are unloaded to the network card in the form of merged flow table rules. The counts for native flow table rules are also calculated based on the merged flow table rules. Each statistical count requires finding the association relationship for calculation, which makes the logic complex.

[0115] The embodiment of the present invention obtains a first native flow table rule; the first native flow table rule includes a first native action domain; the first native action domain includes connection tracking action information; a first hardware flow table rule is determined for the first native flow table rule before connection tracking is performed through the connection tracking action information; a second hardware flow table rule is determined for the first native flow table rule after connection tracking is performed through the first hardware flow table rule; based on the first hardware flow table rule and the second hardware flow table rule, the flow table rule for the data packet is unloaded to the network card, which can avoid unloading the flow table rule for the data packet to the network card in the form of a merged flow table, thereby simplifying the logic of the unloading process and improving the efficiency of unloading the flow table rule for the data packet to the network card.

[0116] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0117] In an optional embodiment of the present invention, the first native flow table rule includes a first native matching field, the first native matching field includes first regular message information and initial recycling information, the first native action field includes first other action information, and the step of determining a first hardware flow table rule for the first native flow table rule before performing connection tracking by using the connection tracking action information includes:

[0118] Determine a first insertion position identifier for characterizing an insertion position of the first hardware flow table rule;

[0119] Determine a first hardware matching domain for the first hardware flow table rule through the first regular message information;

[0120] Generate a first jump coefficient for the first hardware flow table rule by using the first insertion position identifier and first flag information of the first native flow table rule before executing connection tracking;

[0121] Determine a first jump position identifier for representing a jump position of the first hardware flow table rule by using the first jump coefficient;

[0122] Calculating a first Hash value for a first hardware flow table rule through the first regular message information, and generating a first association tag using the first Hash value;

[0123] Determine a first hardware action domain for the first hardware flow table rule by using the first jump position identifier and the first association tag;

[0124] The first hardware flow table rule is determined using the first hardware matching domain and the first hardware action domain.

[0125] In a specific implementation, the first native flow table rule FLOW A of an embodiment of the present invention may include a first native matching domain, the first native matching domain includes first regular message information M1 and initial recycling information recirc_id(0), the matching domain of the hardware flow table rule can use the corresponding table_id(N) to represent that the flow table rule should be inserted into the Nth hardware table entry (connection information database table), and jump(N) is used in the action domain to represent jumping to the Nth hardware table entry (connection information database table). At the same time, mark(id) can be used as a software-sent matching item identifier to indicate that RTE_FLOW_A1 and RTE_FLOW_A2 belong to FLOW A.

[0126] The embodiment of the present invention can determine a first insertion position identifier table_id(0) for characterizing an insertion position of a first hardware flow table rule RTE_FLOW_A1. After determining the first insertion position identifier table_id(0), the first hardware matching domain for the first hardware flow table rule RTE_FLOW_A1 can be determined as M1 through the first regular message information M1, and a first jump coefficient N1 for the first hardware flow table rule RTE_FLOW_A1 can be generated through the first insertion position identifier table_id(0) and the first flag information flag(ct_pre) of the first native flow table rule FLOW A before executing connection tracking; after determining the first jump coefficient N1, the embodiment of the present invention can use the first jump coefficient N1 to determine a first jump position identifier jump(N1) for characterizing a jump position of the first hardware flow table rule RTE_FLOW_A1; calculate a first hash value hash(id1) for the first hardware flow table rule RTE_FLOW_A1 through the first regular message information M1, and use the first hash value h ash(id1) generates a first associated mark mark(id1); using the first jump position identifier jump(N1) and the first associated mark mark(id1), determine the first hardware action domain jump(N1)+mark(id1) for the first hardware flow table rule RTE_FLOW_A1; using the first hardware matching domain M1 and the first hardware action domain jump(N1)+mark(id1) to determine the first hardware flow table rule RTE_FLOW_A1, the first insertion position identifier for the first hardware matching domain M1 is table_id(0).

[0127] For example, because RTE_FLOW_A1 is the first flow table rule that the data packet passes through, its table_id can be 0, and the other matching domain M1 is retained. Use the recirc_id(0) of the FLOW A matching domain and the flag before ct(ct_pre) to generate N1, and then calculate hash(id1) according to M1, RTE_FLOW_A1: table_id(0), the first hardware matching domain match: M1, and the first hardware action domain action: jump(N1)+mark(id1).

[0128] According to an embodiment of the present invention, a first insertion position identifier for characterizing an insertion position of the first hardware flow table rule is determined; a first hardware matching domain for the first hardware flow table rule is determined through the first regular message information; a first jump coefficient for the first hardware flow table rule is generated through the first insertion position identifier and the first flag information of the first native flow table rule before executing connection tracking; a first jump position identifier for characterizing a jump position of the first hardware flow table rule is determined using the first jump coefficient; a first hash value for the first hardware flow table rule is calculated through the first regular message information, and a first association tag is generated using the first hash value; a first hardware action domain for the first hardware flow table rule is determined using the first jump position identifier and the first association tag; the first hardware matching domain and the first hardware action domain are used to determine the first hardware flow table rule, so that the first hardware flow table rule for the first native flow table rule before executing connection tracking is efficiently determined, and a first hardware matching domain including a first jump position identifier jump(N1) and an insertion position of the first hardware flow table rule in a connection information database table are determined, thereby providing a basis for subsequent unloading of flow table rules in the form of a jump table.

[0129] In an optional embodiment of the present invention, the step of determining, by using the first hardware flow table rule, a second hardware flow table rule for the first native flow table rule after executing connection tracking comprises:

[0130] Obtain a second native flow table rule corresponding to the first native flow table rule; the second native flow table rule includes a second native matching domain, the second native matching domain and the first native action domain include the same target recycling information, and the target recycling information is used to associate the second native flow table rule with the first native flow table rule;

[0131] Generate a first insertion coefficient through the initial recycling information and the second flag information of the first native flow table rule after performing connection tracking;

[0132] Determine a second insertion position identifier for characterizing an insertion position of the second hardware flow table rule by using the first insertion coefficient;

[0133] Determine a second hardware matching domain for the second hardware flow table rule using the first association tag;

[0134] generating a second jump coefficient by using the target recycling information and third flag information for the second native flow table rule;

[0135] Determine a second jump position identifier for characterizing a jump position of the second hardware flow table rule by using the second jump coefficient;

[0136] Calculating a second Hash value for a second hardware flow table rule by using the target recycling information and the first regular message information, and generating a second association tag by using the second Hash value;

[0137] Determine a second hardware action domain for the second hardware flow table rule by using the second jump position identifier, the second association tag, and the first other action information;

[0138] The second hardware matching domain and the second hardware action domain are used to determine the second hardware flow table rule.

[0139] In a specific implementation, an embodiment of the present invention can obtain a second native flow table rule FLOW B corresponding to the first native flow table rule FLOW A; the second native flow table rule FLOW B can be a native flow table rule associated with the first native flow table rule FLOW A. In practical applications, the second native matching domain and the first native action domain can contain the same target recycling information recirc(idA). Therefore, the second native flow table rule FLOW B of an embodiment of the present invention may include a second native matching domain, and the second native matching domain and the first native action domain contain the same target recycling information recirc(idA), and the target recycling information recirc(idA) is used to associate the second native flow table rule FLOW B with the first native flow table rule FLOW A.

[0140] For example, the first native matching domain of FLOW A may be M1, recirc_id(0), the first native action domain may be ct+recirc(idA)+ACT1(other actions), the second native matching domain of FLOW B may be M2, recirc(idA), ct_state(+est), and the second native matching domain action domain may be ACT2.

[0141] After acquiring the second native flow table rule, the embodiment of the present invention can generate a first insertion coefficient N2 through the initial recirculation information recirc_id(0) and the second flag information flag(ct_after) of the first native flow table rule FLOW A after executing connection tracking, and then use the first insertion coefficient N2 to determine the second insertion position identifier table_id(N2) for characterizing the insertion position of the second hardware flow table rule RTE_FLOW_A2; use the first association mark mark(id1) to determine the second hardware matching domain mark(id1) for the second hardware flow table rule RTE_FLOW_A2; use the target recirculation information recirc(idA) and the second native flow table rule FLOW A to generate a first insertion coefficient N2. The third flag information flag(flow) of B generates a second jump coefficient N3; the second jump coefficient N3 is used to determine the second jump position identifier jump(N3) used to characterize the jump position of the second hardware flow table rule RTE_FLOW_A2; the second hash value hash(id2) for the second hardware flow table rule RTE_FLOW_A2 is calculated through the target recycling information recirc(idA) and the first regular message information M1, and the second hash value hash(id2) is used to generate a second association mark(id2); the second jump position identifier j is used ump(N3), the second association mark mark(id2) and the first other action information ACT1, determine the second hardware action domain jump(N3)+mark(id2)+ACT1 for the second hardware flow table rule RTE_FLOW_A2; use the second hardware matching domain mark(id1) and the second hardware action domain jump(N3)+mark(id2)+ACT1 to determine the second hardware flow table rule RTE_FLOW_A2, and the second insertion position identifier for the second hardware matching domain mark(id1) is table_id(N2).

[0142] Exemplarily, RTE_FLOW_A2 uses recirc_id(0) of the FLOW A matching domain and the flag after ct(ct_after) to generate N2 as table_id, uses the action domain recirc(idA) and the next type flag(flow) to generate N3, and then calculates hash(id1) according to M1, recirc(idA) and M1 calculate hash(id2), and obtains RTE_FLOW_A2: table_id(N2), the second hardware matching domain match: mark(id1), and the second hardware action domain action: jump(N3)+mark(id2)+ACT1.

[0143] In an embodiment of the present invention, a second native flow table rule corresponding to the first native flow table rule is obtained; the second native flow table rule includes a second native matching domain, the second native matching domain and the first native action domain contain the same target recycling information, and the target recycling information is used to associate the second native flow table rule with the first native flow table rule; a first insertion coefficient is generated through the initial recycling information and the second flag information of the first native flow table rule after performing connection tracking; the first insertion coefficient is used to determine a second insertion position identifier for characterizing the insertion position of the second hardware flow table rule; the first association mark is used to determine a second hardware matching domain for the second hardware flow table rule; a second jump coefficient is generated through the target recycling information and the third flag information for the second native flow table rule; the second jump coefficient is used to determine A second jump position identifier for characterizing the jump position of the second hardware flow table rule; calculating a second hash value for the second hardware flow table rule through the target recycling information and the first regular message information, and using the second hash value to generate a second association tag; using the second jump position identifier, the second association tag and the first other action information to determine the second hardware action domain for the second hardware flow table rule; using the second hardware matching domain and the second hardware action domain to determine the second hardware flow table rule, efficiently determining the second hardware flow table rule for the first native flow table rule before executing connection tracking, and determining the second hardware matching domain including the second jump position identifier jump (N3), as well as the insertion position of the second hardware flow table rule in the connection information database table, providing an implementation basis for the subsequent unloading of the flow table rule in the form of a jump table.

[0144] In an optional embodiment of the present invention, it also includes:

[0145] Obtain connection tracking five-tuple information for the first native flow table rule;

[0146] Determine a connection tracking quintuple information matching domain through the connection tracking quintuple information, and determine a connection tracking quintuple information action domain using the first insertion coefficient;

[0147] Based on the connection tracking quintuple information matching domain and the connection tracking quintuple information action domain, a connection tracking quintuple flow table rule for the connection tracking quintuple information is determined, and the first jump coefficient is used as the second insertion coefficient to determine a third insertion position identifier for characterizing the insertion position of the connection tracking quintuple flow table rule.

[0148] In a specific implementation, an embodiment of the present invention can obtain a connection tracking quintuple CONN A for a first native flow table rule FLOW A, CONN A can have corresponding CONN A connection tracking quintuple information M_CONN, for example, source IP, destination IP, protocol, source port, and destination port, and the connection tracking quintuple information matching domain can be determined as M_CONN and through the connection tracking quintuple information M_CONN, and the connection tracking quintuple information action domain can be determined as jump(N2) using the first insertion coefficient N2; the connection tracking quintuple flow table rule RTE_FLOW_CONN for the connection tracking quintuple CONN A is determined based on the connection tracking quintuple information matching domain M_CONN and the connection tracking quintuple information action domain jump(N2), and due to the first jump coefficient N1, the first jump coefficient N1 can be used as the second insertion coefficient to determine a third insertion position identifier for characterizing the insertion position of the connection tracking quintuple flow table rule, that is, the third insertion position identifier for the connection tracking quintuple information matching domain M_CONN can be table_id(N1).

[0149] Exemplarily, the flow table unloading module receives CONN A, sets its recirc_id to 0, calculates N1 and N2 according to flag (ct_pre) and flag (ct_after), extracts the quintuple (source IP, destination IP, protocol, source port, destination port) as the matching domain M_CONN, obtains table_id (N1), connection tracking quintuple information matching domain match: M_CONN, connection tracking quintuple information action domain action: jump (N2).

[0150] The embodiment of the present invention obtains the connection tracking quintuple information for the first native flow table rule; determines the connection tracking quintuple information matching domain through the connection tracking quintuple information, and uses the first insertion coefficient to determine the connection tracking quintuple information action domain; determines the connection tracking quintuple flow table rule for the connection tracking quintuple information based on the connection tracking quintuple information matching domain and the connection tracking quintuple information action domain, and uses the first jump coefficient as the second insertion coefficient to determine the third insertion position identifier for characterizing the insertion position of the connection tracking quintuple flow table rule, thereby efficiently determining the connection tracking quintuple flow table rule, and determining the connection tracking quintuple information action domain jump (N2), as well as the insertion position of the connection tracking quintuple flow table rule in the connection information database table, thereby providing an implementation basis for the subsequent unloading of the flow table rule in the form of a jump table.

[0151] In an optional embodiment of the present invention, the second native flow table rule includes a second native action field, the second native matching field includes second regular message information and uninstalled tracking action state information; the second native action field includes second other action information, and further includes:

[0152] Determine a third hardware matching domain using the second conventional message information;

[0153] Determine a third hardware action domain using the second other action information;

[0154] A third hardware flow table rule is determined based on the third hardware matching domain and the third hardware action domain, and a fourth insertion position identifier for characterizing an insertion position of the third hardware flow table rule is determined using the second jump coefficient as a third insertion coefficient.

[0155] In a specific implementation, the second native flow table rule FLOW B of the embodiment of the present invention may include a second native action field, and the second native matching field may include second regular message information M2, target recycling information recirc(idA) and uninstalled tracking action state information ct_state(+est).

[0156] The embodiment of the present invention can use the second regular message information M2 to determine the third hardware matching domain M2; use the second other action information ACT2 to determine the third hardware action domain ACT2; based on the third hardware matching domain M2 and the third hardware action domain ACT2, determine the third hardware flow table rule RTE_FLOW_B, and since the second jump coefficient is N3, use the second jump coefficient N3 as the third insertion coefficient to determine the fourth insertion position identifier for characterizing the insertion position of the third hardware flow table rule RTE_FLOW_B, that is, the fourth insertion position identifier for the third hardware flow table rule RTE_FLOW_B can be table_id(N3).

[0157] Exemplarily, the flow table unloading module receives FLOW B, generates N3 as the table_id of RTE_FLOW_B according to its matching domain recirc(idA) and flag(flow), and obtains RTE_FLOW_B: table_id(N3), the third hardware matching domain match: M2, and the third hardware action domain action: ACT2.

[0158] The embodiment of the present invention determines the third hardware matching domain by adopting the second regular message information; determines the third hardware action domain by adopting the second other action information; determines the third hardware flow table rule based on the third hardware matching domain and the third hardware action domain, and adopts the second jump coefficient as the third insertion coefficient to determine the fourth insertion position identifier used to characterize the insertion position of the third hardware flow table rule, determines the third hardware flow table rule RTE_FLOW_B that has a corresponding relationship with the first native flow table rule and can be targeted at the hardware, and determines the insertion position of the third hardware flow table rule RTE_FLOW_B in the connection information database table, which provides an implementation basis for the subsequent unloading of the flow table rules in the form of a jump table.

[0159] In an optional embodiment of the present invention, the target second hardware flow table rule RTE_FLOW_A2 has a corresponding counter, and the counter is used to count the first native flow table rule FLOW A.

[0160] In a specific implementation, an embodiment of the present invention can maintain a separate counter for each hardware flow table and connection. Since the software and hardware flow tables correspond to each other, the software flow table and the connection can directly obtain the hardware counter and directly age. Since the native software flow table rules have corresponding flow table rules in the hardware and each hardware flow table has a separate counter, the software flow table count can be directly obtained from the hardware, simplifying the statistical counting and aging process.

[0161] In an optional embodiment of the present invention, the connection tracking five-tuple flow table rule has a corresponding first connection information database, the second hardware flow table rule has a corresponding second connection information database, and the third hardware flow table rule has a corresponding third connection information database. The method is applied to a hardware unloading module, and the hardware unloading module has a corresponding flow table rule unloading software OVS-DPDK. The step of unloading the flow table rule for the data packet to the network card based on the first hardware flow table rule and the second hardware flow table rule includes:

[0162] marking the data packet with the first association tag based on the first hardware action field;

[0163] When the first association mark is read, jumping to the first connection information database based on a first jump position identifier corresponding to the first association mark;

[0164] When the first connection information database does not have a connection tracking five-tuple flow table rule corresponding to the data packet, the data packet marked with the first association tag is sent to the flow table rule unloading software OVS-DPDK, and the flow table rule unloading software OVS-DPDK is used to execute the first native flow table rule on the data packet marked with the first association tag, so as to unload the flow table rule for the data packet to the network card;

[0165] When the first connection information database has a connection tracking five-tuple flow table rule corresponding to the data packet, jump to the second connection information database based on the connection tracking five-tuple information action field;

[0166] When the second connection information database has a second hardware flow table rule corresponding to the data packet, the first other action information is executed based on the second hardware matching domain and the second hardware action domain, the data packet is marked with the second association tag, and the data packet is jumped to the third connection information database based on a second jump position identifier corresponding to the second association tag;

[0167] When the third connection information database has a third hardware flow table rule corresponding to the data packet, the flow table rule for the data packet is unloaded to the network card based on the third hardware flow table rule;

[0168] When the third connection information database does not have a third hardware flow table rule corresponding to the data packet, the data packet marked with the second association tag is sent to the flow table rule unloading software OVS-DPDK, and the flow table rule unloading software OVS-DPDK is used to execute the second native flow table rule on the data packet marked with the second association tag to unload the flow table rule for the data packet to the network card.

[0169] In practical applications, a connection information database (conntrack table) can be established based on ct. The established connection information database can be used to store corresponding flow table rules. Since the insertion positions of the first hardware flow table rule RTE_FLOW_A1, the second hardware flow table rule RTE_FLOW_A2, the connection tracking five-tuple flow table rule RTE_FLOW_CONN, and the third hardware flow table rule RTE_FLOW_B in the connection information database have been previously determined, the connection tracking five-tuple flow table rule RTE_FLOW_CONN can have a corresponding first connection information database, the second hardware flow table rule RTE_FLOW_A2 can have a corresponding second connection information database, and the third hardware flow table rule RTE_FLOW_B can have a corresponding third connection information database. The hardware flow table rule can be a flow table rule with a prefix of RTE. The use of table_id(n) in the hardware flow table rule matching domain can represent inserting the flow table into the Nth hardware table entry, and the use of jump(n) in the hardware flow table rule action domain can represent jumping to the Nth hardware table entry.

[0170] The embodiment of the present invention can be applied to a hardware unloading module, and the hardware unloading module has a corresponding flow table rule unloading software OVS-DPDK. After determining id1 and id2, the embodiment of the present invention can store id1 and id2 in OVS-DPDK, and OVS-DPDK records id1 and id2, and the statuses are respectively FLOW A not executed and FLOW A executed. If a data packet carrying id1 is subsequently received and the corresponding hardware flow table rule cannot be queried, and it is necessary to execute flow table rule unloading based on OVS-DPDK, FLOW A can be re-executed through OVS-DPDK based on id1. If a data packet with id2 is received, the data packet can be sent to the OVS-DPDK pipeline of recirc(idA), and OVS-DPDK will look up the table and execute FLOW B.

[0171] Specifically, an embodiment of the present invention can tag a data packet with id1, and mark the data packet with a first associated mark mark(id1) based on the first hardware action domain jump(N1)+mark(id1); when the first associated mark mark(id1) is read, jump to the first connection information database based on the first jump position identifier jump(N1) corresponding to the first associated mark mark(id1); when the first connection information database does not have a connection tracking five-tuple flow table rule RTE_FLOW_CONN corresponding to the data packet, the data packet marked with the first associated mark mark(id1) is sent to the software flow table unloading module, and the software flow table unloading module is used to execute the first native flow table rule FLOWA on the data packet marked with the first associated mark mark(id1) to unload the flow table of the data packet to the network card; when the first connection information database has a connection tracking five-tuple flow table rule RTE_FLOW_CONN corresponding to the data packet, jump to the second connection information database based on the connection tracking five-tuple information action domain jump(N2); when When the second connection information database has a second hardware flow table rule RTE_FLOW_A2 corresponding to the data packet, the first other action information ACT1 is executed based on the second hardware matching domain mark(id1) and the second hardware action domain jump(N3)+mark(id2)+ACT1, the data packet is marked with the second association mark mark(id2), and the data packet is jumped to the third connection information database based on the second jump position identifier jump(N3) corresponding to the second association mark mark(id2); when the third connection information database has a third hardware flow table rule RTE_FLOW_B corresponding to the data packet, the flow table of the data packet is unloaded to the network card based on the third hardware flow table rule RTE_FLOW_B; when the third connection information database does not have a third hardware flow table rule RTE_FLOW_B corresponding to the data packet, the data packet marked with the second association mark mark(id2) is sent to the software flow table unloading module, and the software flow table unloading module is used to execute the second native flow table rule FLOW B on the data packet marked with the second association mark mark(id2) to unload the flow table of the data packet to the network card.

[0172] For example, reference Figure 2 , Figure 21 is a structural diagram of a connection information database provided in an embodiment of the present invention, wherein the connection information database 201 may be an initial connection information database table0, and the initial connection information database table 0 is used to store a first hardware flow table rule RTE_FLOW_A1 whose first hardware matching domain is M1 and whose first hardware action domain action is jump(N1)+mark(id1); the connection information database 202 is a first connection information database table N1, and the first connection information database table N1 may be used to store a connection tracking five-tuple information matching domain M_CONN and a connection tracking five-tuple information action domain jump(N2) and a connection tracking five-tuple flow table rule RTE_FLOW_CONN; the connection information database 203 is a second connection information database table N2, and the second connection information database table N2 is used to store a second hardware flow table rule RTE_FLOW_A2 whose second hardware matching domain is mark(id1) and whose second hardware action domain action is jump(N3)+mark(id2)+ACT1; the connection information database 204 may be a third connection information database table N3, and the third connection information database table N3 may be used to store a third hardware flow table rule RTE_FLOW_B whose third hardware matching field is M2 and whose third hardware action field is ACT2.

[0173] The data packet is labeled with id1. When the data packet passes through the hardware unloading module, it will first match the RTE_FLOW_A1 corresponding to the connection information database 201, and then jump to the table entry of the connection information database 202 to connect and search for the matching RTE_FLOW_CONN; if the M_CONN of RTE_FLOW_CONN is found in the connection information database 202 and can match the five-tuple in the data packet, then jump to the connection information database 203; if the M_CONN of RTE_FLOW_CONN is not found in the connection information database 202 and can match the five-tuple in the data packet, then it is sent to the OVS-DPDK software with id1 for processing. At this time, the hardware flow table counter will not increase, and the OVS-DPDK software will re-execute FLOW A.

[0174] If the mark (id1) of RTE_FLOW_A2 matches the mark of the data packet in the connection information database 203, the remaining actions of FLOW A are executed and the label of id2 is added, and then the connection information database 204 is jumped;

[0175] In the connection information database 204, M2 is matched according to the information of the data packet. If the search is successful, action ACT2 of RTE_FLOW_B is executed. If the search fails, the data packet carrying id2 is sent to the OVS-DPDK software, and the OVS-DPDK software executes FLOW B.

[0176] In order to enable those skilled in the art to better understand the embodiments of the present invention, the embodiments of the present invention are described below using a complete example.

[0177] In practical applications, the OVS connection tracking (conntrack) module can match and act on connections by extracting the five-tuple information of the data packet (source IP, destination IP, protocol, source port, destination port) and maintaining the connection status. The different stages of the connection are marked by the connection status, and the common statuses are: new, est. Because each time a data packet passes through the conntrack module, OVS will recirculate the pipeline (recirc), and each recirc will form a flow table, so a data packet will form several flow tables when passing through the connection tracking module.

[0178] Since connection tracking is relatively complex to implement, hardware usually only offloads traffic in the est state. The existing technology usually uses software to merge flow table rules to implement connection tracking offloading: all flow tables formed by a data packet through connection tracking are merged, and the merged flow table does not carry the connection state and ct action, and is finally offloaded to the hardware.

[0179] Disadvantages of existing solutions:

[0180] 1) The software merging flow table solution requires significant changes to the software OVS, and needs to maintain the relationship between the merged flow table and the native flow table, which increases memory consumption and has poor compatibility.

[0181] 2) The software native flow table and the merged flow table are in a many-to-many relationship. Since only the merged flow table exists in the hardware, the count of the software native flow table needs to be calculated based on each merged flow table. Each statistical count needs to find the association relationship for calculation, which is logically complex.

[0182] 3) Since the logic of merging flow tables and establishing associations needs to be added during unloading, the time consumption of unloading a connection track increases, which reduces the unloading speed.

[0183] Therefore, a flow table rule unloading system for network card data packets can be designed, including an OVS-DPDK flow table unloading module and a hardware unloading module to overcome the above problems.

[0184] Specifically, the native flow table and connection tracking of the first packet sent to OVS-DPDK connection tracking are as follows:

[0185] FLOW A, including: matching domain M1, recirc_id(0), action domain: ct+recirc(idA)+ACT1(other actions)

[0186] CONN A: connect five-tuple

[0187] FLOW B: matching domain M2, recirc(idA), ct_state(+est), action domain: ACT2.

[0188] The software flow table unloading module can be used to enter the flow table unloading ct branch when receiving FLOW A because its action field contains the ct action, and split it into two hardware flow tables RTE_FLOW_A1 and RTE_FLOW_A2: A1 is before searching the CT connection table, and A2 is after searching the CT connection table. The reason for the split is that when the hardware unloading module searches the table, it can distinguish whether the failure is caused by not finding the connection or not finding FLOW B. In the hardware flow table match field, table_id(N) is used to represent inserting the flow table into the Nth hardware table entry, and jump(N) is used in the action field to represent jumping to the Nth hardware table entry. Mark(id) is used as the software upload match item to identify that A1 and A2 belong to FLOW A. The count of FLOW A uses the hardware counter of RTE_FLOW_A2; because RTE_FLOW_A1 is the first flow table that the data packet passes through, its table_id is 0, and other matching fields M1 are retained. Use recirc_id(0) of the FLOW A match domain and the flag before ct(ct_pre) to generate N1. Finally, calculate hash(id1) based on M1 to get RTE_FLOW_A1: table_id(0), match: M1, action: jump(N1)+mark(id1); RTE_FLOW_A2 uses recirc_id(0) of the FLOW A match domain and the flag after ct(ct_after) to generate N2 as table_id, and uses the action domain recirc(idA) and the next type flag(flow) to generate N3. Calculate hash(id1) based on M1, recirc(idA) and M1 calculate hash(id2), get RTE_FLOW_A2: table_id(N2), match: mark(id1), action: jump(N3)+mark(id2)+ACT1; OVS-DPDK records id1 and id2, and the status is FLOW A not executed and FLOW A executed, respectively. If a data packet with id1 is received, FLOW A is re-executed; if a data packet with id2 is received, the data packet is sent to the OVS-DPDK pipeline of recirc(idA), and OVS-DPDK looks up the table and executes FLOW B.

[0189] The flow table unloading module can also be used to set the recirc_id to 0 when receiving CONN A, calculate N1 and N2 according to flag (ct_pre) and flag (ct_after), extract the five-tuple (source IP, destination IP, protocol, source port, destination port) as the matching domain M_CONN, and obtain RTE_FLOW_CONN: table_id (N1), match: M_CONN, action: jump (N2).

[0190] The flow table unloading module can also be used to generate N3 as the table_id of RTE_FLOW_B according to its matching domain recirc(idA) and flag(flow) when receiving FLOW B, and obtain RTE_FLOW_B: table_id(N3), match: M2, action: ACT2.

[0191] The hardware offload module can be used for data packets passing through the hardware offload module. The data packets will first be matched to the corresponding RTE_FLOW_A1, and the data packets will be labeled with id1, and then jump to the table entry of N1 for connection search;

[0192] The M_CONN of RTE_FLOW_CONN is found in N1 and can match the five-tuple in the data packet, and jump to the N2 table. If it is not found, it is sent to OVS-DPDK with id1 for processing. At this time, the hardware flow table counter will not increase, and OVS-DPDK will re-execute FLOW A;

[0193] In N2, find that the mark (id1) of RTE_FLOW_A2 matches the mark of the data packet. After executing the remaining actions of FLOW A and adding the label of id2, jump to N3.

[0194] In N3, M2 is matched according to the information of the data packet. If the search is successful, action ACT2 of RTE_FLOW_B is executed. If the search fails, id2 is sent to OVS-DPDK, and OVS-DPDK executes FLOW B.

[0195] In the above manner, instead of using a combined table, the software flow table is directly converted and unloaded to the hardware. There is no need to maintain the relationship between the combined flow table and the native flow table, thus saving software memory.

[0196] Since native software flow tables have corresponding flow tables in the hardware and each hardware flow table has a separate counter, the software flow table counts can be obtained directly from the hardware, simplifying the statistical counting and aging process.

[0197] The merged flow table needs to wait until the last flow table passed by the data packet is generated before unloading; however, the unloading process of each flow table in the present invention is independent of each other, and the unloading operation can be initiated while the flow table is generated, splitting the original serial operation into multiple parallel operations, thereby increasing the unloading speed.

[0198] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0199] An embodiment of the present invention also discloses a network card, which is configured with a flow table rule unloading system for data packets of the network card. The flow table rule unloading system is used to implement the various processes of the above-mentioned flow table rule unloading method embodiment for data packets of the network card during execution, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0200] Reference Figure 3 , shows a structural block diagram of a flow table rule unloading device for a data packet of a network card provided in an embodiment of the present invention, which may specifically include the following modules:

[0201] A first native flow table rule acquisition module 301 is used to acquire a first native flow table rule; the first native flow table rule includes a first native action field; the first native action field includes connection tracking action information;

[0202] A first hardware flow table rule determination module 302, configured to determine, through the connection tracking action information, a first hardware flow table rule for the first native flow table rule before executing the connection tracking;

[0203] A second hardware flow table rule determination module 303, configured to determine, through the first hardware flow table rule, a second hardware flow table rule for the first native flow table rule after connection tracking is performed;

[0204] The flow table rule unloading module 304 is used to unload the flow table rule for the data packet to the network card based on the first hardware flow table rule and the second hardware flow table rule.

[0205] Optionally, the first native flow table rule includes a first native matching domain, the first native matching domain includes first regular message information and initial recycling information, the first native action domain includes first other action information, and the first hardware flow table rule determination module may include:

[0206] A first insertion position identifier determination submodule, used to determine a first insertion position identifier used to characterize an insertion position of the first hardware flow table rule;

[0207] A first hardware matching domain determining submodule, configured to determine a first hardware matching domain for the first hardware flow table rule through the first conventional message information;

[0208] A first jump coefficient generating submodule, configured to generate a first jump coefficient for the first hardware flow table rule by using the first insertion position identifier and first flag information of the first native flow table rule before connection tracking is performed;

[0209] A first jump position identifier determining submodule, configured to determine a first jump position identifier for characterizing a jump position of the first hardware flow table rule by using the first jump coefficient;

[0210] a first association tag generating submodule, configured to calculate a first hash value for a first hardware flow table rule through the first regular message information, and generate a first association tag using the first hash value;

[0211] A first hardware action domain determination submodule, configured to determine a first hardware action domain for the first hardware flow table rule by using the first jump position identifier and the first association tag;

[0212] The first hardware flow table rule determination submodule is used to determine the first hardware flow table rule by using the first hardware matching domain and the first hardware action domain.

[0213] Optionally, the second hardware flow table rule determination module may include:

[0214] A second native flow table rule acquisition submodule, used to acquire a second native flow table rule corresponding to the first native flow table rule; the second native flow table rule includes a second native matching domain, the second native matching domain and the first native action domain contain the same target recycling information, and the target recycling information is used to associate the second native flow table rule with the first native flow table rule;

[0215] A first insertion coefficient generating submodule, configured to generate a first insertion coefficient through the initial recycling information and the second flag information of the first native flow table rule after performing connection tracking;

[0216] A second insertion position identifier determination submodule, used to determine a second insertion position identifier used to characterize an insertion position of the second hardware flow table rule by using the first insertion coefficient;

[0217] A second hardware matching domain determining submodule, configured to determine a second hardware matching domain for the second hardware flow table rule by using the first association tag;

[0218] A second jump coefficient generating submodule, configured to generate a second jump coefficient by using the target recycling information and the third flag information for the second native flow table rule;

[0219] A second jump position identifier determining submodule, used to determine a second jump position identifier for characterizing a jump position of the second hardware flow table rule by using the second jump coefficient;

[0220] a second association tag determination submodule, configured to calculate a second Hash value for a second hardware flow table rule by using the target recycling information and the first regular message information, and generate a second association tag by using the second Hash value;

[0221] A second hardware action domain determination submodule, configured to determine a second hardware action domain for the second hardware flow table rule by using the second jump position identifier, the second association tag, and the first other action information;

[0222] The second hardware flow table rule determination submodule is used to determine the second hardware flow table rule by using the second hardware matching domain and the second hardware action domain.

[0223] Optionally, it may also include:

[0224] A connection tracking five-tuple information acquisition module, used to obtain connection tracking five-tuple information for the first native flow table rule;

[0225] a connection tracking quintuple information action domain determining module, configured to determine a connection tracking quintuple information matching domain through the connection tracking quintuple information, and determine the connection tracking quintuple information action domain using the first insertion coefficient;

[0226] A connection tracking quintuple flow table rule determination module is used to determine the connection tracking quintuple flow table rule for the connection tracking quintuple information based on the connection tracking quintuple information matching domain and the connection tracking quintuple information action domain, and use the first jump coefficient as the second insertion coefficient to determine the third insertion position identifier used to characterize the insertion position of the connection tracking quintuple flow table rule.

[0227] Optionally, the second native flow table rule includes a second native action field, the second native matching field includes second regular message information and uninstalled tracking action state information; the second native action field includes second other action information, and may further include:

[0228] A third hardware matching domain determining module, configured to determine a third hardware matching domain using the second conventional message information;

[0229] A third hardware action domain determining module, configured to determine a third hardware action domain using the second other action information;

[0230] The third hardware flow table rule determination module is used to determine the third hardware flow table rule based on the third hardware matching domain and the third hardware action domain, and use the second jump coefficient as the third insertion coefficient to determine the fourth insertion position identifier used to characterize the insertion position of the third hardware flow table rule.

[0231] Optionally, the target second hardware flow table rule has a corresponding counter, and the counter is used to count the first native flow table rule.

[0232] Optionally, the connection tracking five-tuple flow table rule has a corresponding first connection information database, the second hardware flow table rule has a corresponding second connection information database, the third hardware flow table rule has a corresponding third connection information database, the device is applied to a hardware unloading module, the hardware unloading module has a corresponding flow table rule unloading software OVS-DPDK, and the flow table rule unloading module includes:

[0233] a data packet marking submodule, configured to mark the data packet with the first association mark based on the first hardware action domain;

[0234] a first jump submodule, configured to jump to the first connection information database based on a first jump position identifier corresponding to the first association mark when the first association mark is read;

[0235] A first data packet sending submodule, configured to send the data packet marked with the first association tag to the flow table rule unloading software OVS-DPDK when the first connection information database does not have a connection tracking five-tuple flow table rule corresponding to the data packet, wherein the flow table rule unloading software OVS-DPDK is configured to execute the first native flow table rule on the data packet marked with the first association tag, so as to unload the flow table rule for the data packet to the network card;

[0236] a second jump submodule, configured to jump to the second connection information database based on the connection tracking quintuple information action field when the first connection information database has a connection tracking quintuple flow table rule corresponding to the data packet;

[0237] a third jump submodule, configured to execute the first other action information based on the second hardware matching domain and the second hardware action domain, mark the data packet with the second association tag, and jump to the third connection information database based on a second jump position identifier corresponding to the second association tag when the second connection information database has a second hardware flow table rule corresponding to the data packet;

[0238] a flow table rule unloading submodule, configured to unload the flow table rule for the data packet to the network card based on the third hardware flow table rule when the third connection information database has a third hardware flow table rule corresponding to the data packet;

[0239] The second data packet sending submodule is used to send the data packet marked with the second association tag to the flow table rule unloading software OVS-DPDK when the third connection information database does not have a third hardware flow table rule corresponding to the data packet. The flow table rule unloading software OVS-DPDK is used to execute the second native flow table rule on the data packet marked with the second association tag to unload the flow table rule for the data packet to the network card.

[0240] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0241] In addition, an embodiment of the present invention further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned flow table rule unloading method for data packets of a network card are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0242] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the above-mentioned flow table rule unloading method for a data packet of a network card is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0243] Figure 4 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0244] The electronic device 400 includes but is not limited to: a radio frequency unit 401, a network module 402, an audio output unit 403, an input unit 404, a sensor 405, a display unit 406, a user input unit 407, an interface unit 408, a memory 409, a processor 410, and a power supply 411. Those skilled in the art will appreciate that Figure 4 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. In the embodiments of the present invention, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0245] It should be understood that in the embodiment of the present invention, the radio frequency unit 401 can be used for receiving and sending signals during information transmission or communication. Specifically, after receiving downlink data from the base station, it is sent to the processor 410 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 401 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 401 can also communicate with the network and other devices through a wireless communication system.

[0246] The electronic device provides users with wireless broadband Internet access through the network module 402, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0247] The audio output unit 403 can convert the audio data received by the RF unit 401 or the network module 402 or stored in the memory 409 into an audio signal and output it as sound. Moreover, the audio output unit 403 can also provide audio output related to a specific function performed by the electronic device 400 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 403 includes a speaker, a buzzer, a receiver, etc.

[0248] The input unit 404 is used to receive audio or video signals. The input unit 404 may include a graphics processor (GPU) 4041 and a microphone 4042, and the graphics processor 4041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 406. The image frame processed by the graphics processor 4041 can be stored in the memory 409 (or other storage medium) or sent via the radio frequency unit 401 or the network module 402. The microphone 4042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 401 in the case of a telephone call mode.

[0249] The electronic device 400 also includes at least one sensor 405, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 4061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 4061 and / or the backlight when the electronic device 400 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 405 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0250] The display unit 406 is used to display information input by the user or information provided to the user. The display unit 406 may include a display panel 4061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0251] The user input unit 407 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 407 includes a touch panel 4071 and other input devices 4072. The touch panel 4071, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 4071 or near the touch panel 4071 using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 4071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into the contact point coordinates, and then sends it to the processor 410, receives the command sent by the processor 410 and executes it. In addition, the touch panel 4071 can be implemented using various types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch panel 4071, the user input unit 407 may also include other input devices 4072. Specifically, other input devices 4072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which are not described in detail here.

[0252] Furthermore, the touch panel 4071 may be overlaid on the display panel 4061. When the touch panel 4071 detects a touch operation on or near it, it is transmitted to the processor 410 to determine the type of the touch event. Then, the processor 410 provides a corresponding visual output on the display panel 4061 according to the type of the touch event. Figure 4 In the figure, the touch panel 4071 and the display panel 4061 are two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 4071 and the display panel 4061 can be integrated to realize the input and output functions of the electronic device, which is not limited here.

[0253] The interface unit 408 is an interface for connecting an external device to the electronic device 400. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 408 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 400 or may be used to transmit data between the electronic device 400 and an external device.

[0254] The memory 409 can be used to store software programs and various data. The memory 409 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 409 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0255] The processor 410 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. It executes various functions of the electronic device and processes data by running or executing software programs and / or modules stored in the memory 409, and calling data stored in the memory 409, so as to monitor the electronic device as a whole. The processor 410 may include one or more processing units; preferably, the processor 410 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 410.

[0256] The electronic device 400 may also include a power supply 411 (such as a battery) for supplying power to each component. Preferably, the power supply 411 may be logically connected to the processor 410 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system.

[0257] In addition, the electronic device 400 includes some functional modules not shown, which will not be described in detail here.

[0258] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0259] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0260] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0261] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0262] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0263] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0264] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0265] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0266] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0267] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for unloading flow table rules of a data packet of a network card, characterized in that: include: Obtain a first native flow table rule; the first native flow table rule includes a first native action field; the first native action field includes connection tracking action information; Determine, by using the connection tracking action information, a first hardware flow table rule for the first native flow table rule before executing the connection tracking; Determine, by using the first hardware flow table rule, a second hardware flow table rule for the first native flow table rule after connection tracking is performed; Unloading the flow table rule for the data packet to the network card based on the first hardware flow table rule and the second hardware flow table rule; The first native flow table rule includes a first native matching field, the first native matching field includes first regular message information and initial recycle information, the first native action field includes first other action information, and the step of determining a first hardware flow table rule for the first native flow table rule before performing connection tracking by using the connection tracking action information includes: Determine a first insertion position identifier for characterizing an insertion position of the first hardware flow table rule; Determine a first hardware matching domain for the first hardware flow table rule through the first regular message information; Generate a first jump coefficient for the first hardware flow table rule by using the first insertion position identifier and first flag information of the first native flow table rule before executing connection tracking; Determine a first jump position identifier for representing a jump position of the first hardware flow table rule by using the first jump coefficient; Calculating a first Hash value for a first hardware flow table rule through the first regular message information, and generating a first association tag using the first Hash value; Determine a first hardware action domain for the first hardware flow table rule by using the first jump position identifier and the first association tag; Determine the first hardware flow table rule using the first hardware matching domain and the first hardware action domain; The step of determining, by using the first hardware flow table rule, a second hardware flow table rule for the first native flow table rule after executing connection tracking comprises: Obtain a second native flow table rule corresponding to the first native flow table rule; the second native flow table rule includes a second native matching domain, the second native matching domain and the first native action domain include the same target recycling information, and the target recycling information is used to associate the second native flow table rule with the first native flow table rule; Generate a first insertion coefficient through the initial recycling information and the second flag information of the first native flow table rule after performing connection tracking; Determine a second insertion position identifier for characterizing an insertion position of the second hardware flow table rule by using the first insertion coefficient; Determine a second hardware matching domain for the second hardware flow table rule using the first association tag; generating a second jump coefficient by using the target recycling information and third flag information for the second native flow table rule; Determine a second jump position identifier for characterizing a jump position of the second hardware flow table rule by using the second jump coefficient; Calculating a second Hash value for a second hardware flow table rule by using the target recycling information and the first regular message information, and generating a second association tag by using the second Hash value; Determine a second hardware action domain for the second hardware flow table rule by using the second jump position identifier, the second association tag, and the first other action information; The second hardware matching domain and the second hardware action domain are used to determine the second hardware flow table rule.

2. The method according to claim 1, characterized in that: Also includes: Obtain connection tracking five-tuple information for the first native flow table rule; Determine a connection tracking quintuple information matching domain through the connection tracking quintuple information, and determine a connection tracking quintuple information action domain using the first insertion coefficient; Based on the connection tracking quintuple information matching domain and the connection tracking quintuple information action domain, a connection tracking quintuple flow table rule for the connection tracking quintuple information is determined, and the first jump coefficient is used as the second insertion coefficient to determine a third insertion position identifier for characterizing the insertion position of the connection tracking quintuple flow table rule.

3. The method according to claim 2, characterized in that The second native flow table rule includes a second native action field, the second native matching field includes second regular message information and uninstalled tracking action state information; the second native action field includes second other action information, and further includes: Determine a third hardware matching domain using the second conventional message information; Determine a third hardware action domain using the second other action information; A third hardware flow table rule is determined based on the third hardware matching domain and the third hardware action domain, and a fourth insertion position identifier for characterizing an insertion position of the third hardware flow table rule is determined using the second jump coefficient as a third insertion coefficient.

4. The method according to claim 3, characterized in that The target second hardware flow table rule has a corresponding counter, and the counter is used to count the first native flow table rule.

5. The method according to claim 4, characterized in that The connection tracking five-tuple flow table rule has a corresponding first connection information database, the second hardware flow table rule has a corresponding second connection information database, and the third hardware flow table rule has a corresponding third connection information database. The method is applied to a hardware unloading module, and the hardware unloading module has a corresponding flow table rule unloading software OVS-DPDK. The step of unloading the flow table rule for the data packet to the network card based on the first hardware flow table rule and the second hardware flow table rule includes: marking the data packet with the first association tag based on the first hardware action field; When the first association mark is read, jumping to the first connection information database based on a first jump position identifier corresponding to the first association mark; When the first connection information database does not have a connection tracking five-tuple flow table rule corresponding to the data packet, the data packet marked with the first association tag is sent to the flow table rule unloading software OVS-DPDK, and the flow table rule unloading software OVS-DPDK is used to execute the first native flow table rule on the data packet marked with the first association tag, so as to unload the flow table rule for the data packet to the network card; When the first connection information database has a connection tracking five-tuple flow table rule corresponding to the data packet, jump to the second connection information database based on the connection tracking five-tuple information action field; When the second connection information database has a second hardware flow table rule corresponding to the data packet, the first other action information is executed based on the second hardware matching domain and the second hardware action domain, the data packet is marked with the second association tag, and the data packet is jumped to the third connection information database based on a second jump position identifier corresponding to the second association tag; When the third connection information database has a third hardware flow table rule corresponding to the data packet, the flow table rule for the data packet is unloaded to the network card based on the third hardware flow table rule; When the third connection information database does not have a third hardware flow table rule corresponding to the data packet, the data packet marked with the second association tag is sent to the flow table rule unloading software OVS-DPDK, and the flow table rule unloading software OVS-DPDK is used to execute the second native flow table rule on the data packet marked with the second association tag to unload the flow table rule for the data packet to the network card.

6. A flow table rule unloading device for a data packet of a network card, characterized in that: include: A first native flow table rule acquisition module, configured to acquire a first native flow table rule; the first native flow table rule comprises a first native action field; the first native action field comprises connection tracking action information; A first hardware flow table rule determination module, configured to determine, through the connection tracking action information, a first hardware flow table rule for the first native flow table rule before executing the connection tracking; A second hardware flow table rule determination module, configured to determine, through the first hardware flow table rule, a second hardware flow table rule for the first native flow table rule after connection tracking is performed; A flow table rule unloading module, used for unloading the flow table rule for the data packet to the network card based on the first hardware flow table rule and the second hardware flow table rule; The first native flow table rule includes a first native matching domain, the first native matching domain includes first regular message information and initial recycling information, the first native action domain includes first other action information, and the first hardware flow table rule determination module includes: A first insertion position identifier determination submodule, used to determine a first insertion position identifier used to characterize an insertion position of the first hardware flow table rule; A first hardware matching domain determining submodule, configured to determine a first hardware matching domain for the first hardware flow table rule through the first conventional message information; A first jump coefficient generating submodule, configured to generate a first jump coefficient for the first hardware flow table rule by using the first insertion position identifier and first flag information of the first native flow table rule before connection tracking is performed; A first jump position identifier determining submodule, configured to determine a first jump position identifier for characterizing a jump position of the first hardware flow table rule by using the first jump coefficient; a first association tag generating submodule, configured to calculate a first hash value for a first hardware flow table rule through the first regular message information, and generate a first association tag using the first hash value; A first hardware action domain determination submodule, configured to determine a first hardware action domain for the first hardware flow table rule by using the first jump position identifier and the first association tag; A first hardware flow table rule determination submodule, configured to determine the first hardware flow table rule by using the first hardware matching domain and the first hardware action domain; The second hardware flow table rule determination module includes: A second native flow table rule acquisition submodule, used to acquire a second native flow table rule corresponding to the first native flow table rule; the second native flow table rule includes a second native matching domain, the second native matching domain and the first native action domain contain the same target recycling information, and the target recycling information is used to associate the second native flow table rule with the first native flow table rule; A first insertion coefficient generating submodule, configured to generate a first insertion coefficient through the initial recycling information and the second flag information of the first native flow table rule after performing connection tracking; A second insertion position identifier determination submodule, used to determine a second insertion position identifier used to characterize an insertion position of the second hardware flow table rule by using the first insertion coefficient; A second hardware matching domain determining submodule, configured to determine a second hardware matching domain for the second hardware flow table rule by using the first association tag; A second jump coefficient generating submodule, configured to generate a second jump coefficient by using the target recycling information and the third flag information for the second native flow table rule; A second jump position identifier determining submodule, used to determine a second jump position identifier for characterizing a jump position of the second hardware flow table rule by using the second jump coefficient; a second association tag determination submodule, configured to calculate a second Hash value for a second hardware flow table rule by using the target recycling information and the first regular message information, and generate a second association tag by using the second Hash value; A second hardware action domain determination submodule, configured to determine a second hardware action domain for the second hardware flow table rule by using the second jump position identifier, the second association tag, and the first other action information; The second hardware flow table rule determination submodule is used to determine the second hardware flow table rule by using the second hardware matching domain and the second hardware action domain.

7. The device according to claim 6, characterized in that Also includes: A connection tracking five-tuple information acquisition module, used to obtain connection tracking five-tuple information for the first native flow table rule; a connection tracking quintuple information action domain determining module, configured to determine a connection tracking quintuple information matching domain through the connection tracking quintuple information, and determine the connection tracking quintuple information action domain using the first insertion coefficient; A connection tracking quintuple flow table rule determination module is used to determine the connection tracking quintuple flow table rule for the connection tracking quintuple information based on the connection tracking quintuple information matching domain and the connection tracking quintuple information action domain, and use the first jump coefficient as the second insertion coefficient to determine the third insertion position identifier used to characterize the insertion position of the connection tracking quintuple flow table rule.

8. The device according to claim 7, characterized in that The second native flow table rule includes a second native action field, the second native matching field includes second regular message information and uninstalled tracking action state information; the second native action field includes second other action information, and further includes: A third hardware matching domain determining module, configured to determine a third hardware matching domain using the second conventional message information; A third hardware action domain determining module, configured to determine a third hardware action domain using the second other action information; A third hardware flow table rule determination module, configured to determine a third hardware flow table rule based on the third hardware matching domain and the third hardware action domain, and to use the second jump coefficient as a third insertion coefficient to determine a fourth insertion position identifier for characterizing an insertion position of the third hardware flow table rule; Optionally, the target second hardware flow table rule has a corresponding counter, and the counter is used to count the first native flow table rule.

9. A network card, characterized in that: The network card is configured with a flow table rule unloading system for data packets of the network card, and the flow table rule unloading system is used to implement the method according to any one of claims 1-5.

10. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 5 when executing the program stored in the memory.

11. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 5.

Images