FPGA-based multi-template quintuple rule matching method and device

Abstract

The application discloses a five-tuple rule matching method and device based on FPGA (Field Programmable Gate Array) multi-rule templates, and a plurality of rule templates are stored in a high-bandwidth memory, the rule templates are cascaded, and when rule matching is performed on five-tuple information in a to-be-processed message, a non-cascaded / cascaded mode is adopted to match the rule templates, so that an action strategy of the to-be-processed message is acquired. Each template matching information is flexible and configurable, complex matching functions are realized through inter-template cascading, the number of templates is effectively reduced, and system resources are reduced.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a five-tuple rule matching method and apparatus based on FPGA multi-rule templates. Background Technology

[0002] Network devices can typically be configured with certain rules and corresponding actions. Packets matching these rules are processed according to the assigned actions. In related technical solutions, after receiving a packet, the network device extracts the five-tuple information and performs rule matching using a fixed-template mask five-tuple matching method. This method results in inflexible rule matching. Furthermore, as the number of packets that network devices need to process increases, using a fixed-template five-tuple matching solution requires configuring a large number of matching rules, thus consuming significant system resources and increasing equipment costs. Summary of the Invention

[0003] The purpose of this application is to provide a quintuple rule matching method based on FPGA with multiple rule templates. It provides flexible mask quintuple rule templates, each template mask is flexibly configurable, and templates can be cascaded, which effectively increases the complexity of rules, reduces the number of rule templates, and reduces system resources.

[0004] In a first aspect, this application provides a quintuple rule matching method based on FPGA multi-rule templates, characterized in that the FPGA includes a high-bandwidth memory (HBM), the HBM includes multiple storage areas, any one of the multiple storage areas is configured as any one of the multiple rule templates, the storage address in the storage area stores a rule configuration information of the corresponding rule template, the rule configuration information includes a mask quintuple, priority, and action, and the method includes:

[0005] Retrieve the quintuple information from the message to be processed;

[0006] For each rule template, the quintuple information is ANDed with the template mask corresponding to the rule template to obtain the masked quintuple. The masked quintuple is then hashed to obtain the corresponding hash value.

[0007] For each hash value, the hash value is used as the storage address of the corresponding storage area. The five-tuple information is matched with the mask five-tuple corresponding to the storage address to output the matching result corresponding to the rule template. The matching result carries at least one of the following: miss, non-cascade hit, rule pool cascade hit, and same rule number cascade hit.

[0008] For each matching result corresponding to the obtained rule template, among which,

[0009] If there are multiple matching results carrying non-cascaded hit indicators, obtain the first action corresponding to the mask quintuple with the highest priority;

[0010] If there are multiple matching results carrying rule pool cascade hit indicators, the first mask quintuple and the second mask quintuple with cascade matching relationship are matched and searched to obtain the corresponding second action;

[0011] If there are multiple matching results carrying the same rule number cascaded hit indication, in response to multiple mask quintuples with the same rule number, obtain the third action corresponding to the mask quintuple with the highest priority;

[0012] From the first action, the second action, and the third action, select the action with the highest priority as the message processing action for the message to be processed.

[0013] Optionally, for each rule template, the quintuple information is ANDed with the template mask corresponding to that rule template to obtain a masked quintuple. A hash operation is then performed on this masked quintuple to obtain the corresponding hash value, including:

[0014] Obtain the five-tuple information from the message to be processed, wherein the five-tuple information includes the source IP address, destination IP address, source port, destination port, and protocol number;

[0015] For each rule template, the quintuple information and the template mask corresponding to the rule template are logically ANDed bitwise to obtain the masked quintuple. The masked quintuple is then hashed to obtain the corresponding hash value. The value of each bit in the template mask indicates whether the same bit in the quintuple information is valid.

[0016] For each hash value, use that hash value as the storage address of the corresponding storage area, including:

[0017] For each storage area, the hash values ​​corresponding to the rule template configured for that storage area are obtained through the address bus and data bus of that storage area, and each hash value is used as the storage address of that storage area. Each storage area in the HBM has an independent address bus and data bus.

[0018] Optionally, the FPGA further includes a first on-chip memory area, a second on-chip memory area, and a third on-chip memory area. The first and second on-chip memory areas have the same depth, and the third on-chip memory area has a greater depth than the first on-chip memory area.

[0019] For each storage address in the first on-chip storage area, the processing action corresponding to the first concatenation pool is configured in the storage space corresponding to the storage address, and the storage address is used as the first storage address corresponding to the first concatenation pool. The first concatenation pool includes multiple mask quintuples with common characteristics.

[0020] For each storage address in the second intra-storage area, the processing action corresponding to the second concatenation pool is configured in the storage space corresponding to the storage address, and the storage address is used as the second storage address corresponding to the second concatenation pool. The first concatenation pool includes multiple mask quintuples with common characteristics.

[0021] The address obtained by combining the first storage address and the second storage address is used as the storage address of the third internal storage area. The processing actions corresponding to the first cascade pool and the second cascade pool with a cascade relationship are configured in the storage space corresponding to the storage address.

[0022] Optionally, for each storage address in any storage area, that storage address is configured as a rule configuration information for the corresponding rule template. This rule configuration information includes a mask 5-tuple, a cascading enable field, a cascading rule type field, a cascading pool type field, a rule identifier field, a priority field, and an action field.

[0023] The concatenation enable field is used to characterize whether the mask quintuple corresponding to the storage address supports concatenation rules. A concatenation enable field of 1 indicates that the mask quintuple is a concatenation rule, and a concatenation enable field of 0 indicates that the mask quintuple is a non-concatenation rule.

[0024] When the cascading enable field is configured as a cascading rule, the cascading rule type field is configured as rule pool cascading or cascading with the same rule number.

[0025] When the cascading enable field is configured as a cascading rule and the cascading rule type field is configured as a rule pool cascading, the cascading pool type field is configured as a first cascading pool or a second cascading pool. If the cascading pool type field is configured as a first cascading pool, the rule identifier field is configured as a first storage address. If the cascading pool type field is configured as a second cascading pool, the rule identifier field is configured as a second storage address.

[0026] When the cascading enable field is configured as a non-cascading rule, or when the cascading enable field is configured as a cascading rule and the cascading rule type field is configured as cascading with the same rule number, the rule identifier field is configured as a rule number.

[0027] The priority field is used to characterize the rule priority corresponding to the mask quintuple;

[0028] The action field is used to characterize the processing action of the corresponding message to be processed when the mask 5-tuple is hit. The processing action includes dropping, forwarding, and modifying.

[0029] Optionally, the multi-rule template includes a source IP address template, a destination IP address template, a source IP address + destination IP address + protocol number template, a source port template, a destination port template, a source IP address + source port template, a destination IP address + destination port template, and a 5-tuple template.

[0030] Optionally, the quintuple information is matched with the mask quintuple corresponding to the storage address using a rule to output at least one matching result corresponding to the rule template, including:

[0031] When the mask quintuple corresponding to the storage address is configured to support cascading rules, and the cascading rule type is rule pool cascading, and is configured as the first cascading pool, if the quintuple information matches the rule of the mask quintuple, the first matching result is output. The first matching result includes the rule pool cascading hit indication, the first cascading pool, the first storage address, and the priority.

[0032] Using the first storage address as the read address of the first intra-chip storage area, obtain the processing action corresponding to the read address, mark the processing action as the fourth action, and use the priority in the first matching result as the priority of the fourth action;

[0033] And / or,

[0034] When the mask quintuple corresponding to the storage address is configured to support cascading rules, and the cascading rule type is rule pool cascading, and is configured as a second cascading pool, if the quintuple information matches the rule of the mask quintuple, a second matching result is output. The second matching result includes a rule pool cascading hit indication, a second cascading pool, a second storage address, and a priority.

[0035] Using the second storage address as the read address of the second on-chip memory area, obtain the processing action corresponding to the read address, identify the processing action as the fifth action, and use the priority in the second matching result as the priority of the fifth action.

[0036] Optionally, if multiple matching results carrying rule pool cascade hit indicators exist, the first mask quintuple and the second mask quintuple with cascade matching relationship are matched and searched to obtain the corresponding second action, including:

[0037] If both a first matching result and a second matching result exist in the various matching results, the address obtained by combining the first storage address and the second storage address is used as the read address of the third intra-slice storage area. The processing action corresponding to the read address is obtained, and the processing action is identified as the second action. The priority of the second action is taken from the priority of the first matching result or the second matching result.

[0038] Optionally, the quintuple information is matched with the mask quintuple corresponding to the storage address using a rule to output at least one matching result corresponding to the rule template, including:

[0039] When the mask quintuple corresponding to the storage address is configured to support cascading rules, and the cascading rule type is cascading with the same rule number, if the quintuple information matches the rule of the mask quintuple, a third matching result is output. The third matching result includes the same rule number cascading hit indication, rule number, action, and priority.

[0040] Among the multiple third matching results corresponding to multiple rule modules, the priority of each mask quintuple with the same rule number is obtained, and the action corresponding to the mask quintuple with the highest priority is taken as the third action.

[0041] And / or,

[0042] When the mask quintuple corresponding to the storage address is configured as a non-cascaded rule, if the quintuple information matches the rule of the mask quintuple, a fourth matching result is output. The fourth matching result includes a non-cascaded hit indication, rule number, action, and priority.

[0043] If there are multiple fourth matching results, the action corresponding to the mask quintuple with the highest priority is taken as the first action.

[0044] Optionally, from the first action, the second action, and the third action, the action with the highest priority is selected as the message processing action for the message to be processed, including:

[0045] From the priorities of the first action, the second action, the third action, the fourth action, and the fifth action, determine the highest priority, and use the action corresponding to the highest priority as the message processing action for the message to be processed.

[0046] and / or;

[0047] If any of the priorities of the first, second, third, fourth, and fifth actions are equal, the message processing action for the pending message will be executed based on the following priority arbitration method:

[0048] The second action has a higher priority than the third action, the third action has a higher priority than the fourth action, the fourth action has a higher priority than the fifth action, and the fifth action has a higher priority than the first action.

[0049] Secondly, this application provides a 5-tuple rule matching device based on FPGA multi-rule templates, characterized in that the FPGA includes a high-bandwidth memory (HBM), the HBM includes multiple storage areas, any one of the multiple storage areas is configured as any one of the multiple rule templates, the storage address in the storage area stores a rule configuration information of a rule in the corresponding rule template, the rule configuration information includes a mask 5-tuple, priority, and action, and the device includes:

[0050] The acquisition module is used to acquire the five-tuple information in the message to be processed;

[0051] The calculation module is used to perform a bitwise AND operation on the quintuple information and the template mask corresponding to the rule template for each rule template to obtain the masked quintuple, and then perform a hash operation on the masked quintuple to obtain the corresponding hash value.

[0052] The matching module is used to perform rule matching on the five-tuple information and the mask five-tuple corresponding to the storage address for each hash value, using the hash value as the storage address of the corresponding storage area, so as to output the matching result corresponding to the rule template. The matching result carries at least one of the following: miss, non-cascade hit, rule pool cascade hit, and same rule number cascade hit.

[0053] The arbitration module is used to process the matching results corresponding to each of the acquired rule templates.

[0054] If there are multiple matching results carrying non-cascaded hit indicators, obtain the first action corresponding to the mask quintuple with the highest priority;

[0055] If there are multiple matching results carrying rule pool cascade hit indicators, the first mask quintuple and the second mask quintuple with cascade matching relationship are matched and searched to obtain the corresponding second action;

[0056] If there are multiple matching results carrying the same rule number cascaded hit indication, in response to multiple mask quintuples with the same rule number, obtain the third action corresponding to the mask quintuple with the highest priority;

[0057] From the first action, the second action, and the third action, select the action with the highest priority as the message processing action for the message to be processed.

[0058] This application configures a rule template for each memory area of ​​the HBM in the FPGA. Each rule template supports flexible 5-tuple mask configuration, and the number of entries for this type of rule can be expanded by configuring multiple template 5-tuple masks with the same value. The matching rules support non-cascaded rules, rule pool cascaded rules, and cascaded rules with the same rule number. By cascading rules to achieve complex matching rules, the number of template types is reduced, FPGA system resources are reduced, and hardware costs are lowered. Attached Figure Description

[0059] Figure 1 A first flowchart of a quintuple rule matching method based on FPGA multi-rule templates provided in an embodiment of this application;

[0060] Figure 2 A second flowchart of the 5-tuple rule matching method based on FPGA multi-rule templates provided in this application embodiment;

[0061] Figure 3 A system block diagram of a 5-tuple rule matching device based on FPGA multi-rule templates is provided for embodiments of this application;

[0062] Figure 4 This is a system block diagram of a communication device provided in an embodiment of this application. Detailed Implementation

[0063] The present application will be described in detail below with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present application. Any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the protection scope of the present application.

[0064] Please refer to Figure 1 This application provides a quintuple rule matching method based on FPGA multi-rule templates. The FPGA includes a high-bandwidth memory (HBM), which includes multiple storage areas. Any one of the multiple storage areas is configured as any one of the rule templates in the multi-rule templates. The storage address in the storage area stores a rule configuration information of the corresponding rule template. The rule configuration information includes a mask quintuple, priority, and action. The method includes steps S101-S105.

[0065] S101, obtain the quintuple information from the message to be processed.

[0066] The FPGA receives the message to be processed, parses it, and obtains the 5-tuple information from the message. The 5-tuple information includes the source IP address, destination IP address, source port, destination port, and protocol number.

[0067] S102, for each rule template, the quintuple information is ANDed with the template mask corresponding to the rule template to obtain the masked quintuple, and the corresponding hash value is obtained by performing a hash operation on the masked quintuple.

[0068] After performing a bitwise AND operation between the quintuple information and the template mask corresponding to each rule template, the masked quintuple is obtained. A hash operation is then performed on the masked quintuple to obtain the corresponding hash value. In this way, the hash values ​​corresponding to each rule template can be obtained.

[0069] S103. For each hash value, the hash value is used as the storage address of the corresponding storage area. The five-tuple information is matched with the mask five-tuple corresponding to the storage address to output the matching result corresponding to the rule template of the storage area. The matching result carries at least one of the following: miss, non-cascade hit, rule pool cascade hit, and same rule number cascade hit.

[0070] HBM comprises multiple storage areas, each of which is configured as any one of the multiple rule templates. That is, the rule templates stored in a storage area are not fixed and can be configured according to the user's actual needs. The hash value calculated above is used as the storage address of the storage area.

[0071] For any hash value, using that hash value as the storage address of the corresponding storage area, the 5-tuple information is matched against the mask 5-tuple corresponding to that storage address using rules. The matching result corresponding to the rule template is output. Based on the rule configuration information corresponding to that storage address, the output matching result carries at least one of the following: miss, non-cascaded hit, rule pool cascaded hit, and same rule number cascaded hit. A miss indicates that the 5-tuple information and the corresponding mask 5-tuple did not match successfully. A non-cascaded hit indicates that the mask 5-tuple corresponding to that storage address is of a non-cascaded type. A rule pool cascaded hit indicates that the mask 5-tuple corresponding to that storage address is of a rule pool cascaded type. A same rule number cascaded hit indicates that the mask 5-tuple corresponding to that storage address is of a same rule number cascaded type.

[0072] S104. For each matching result corresponding to the acquired rule template, if there are multiple matching results carrying non-cascaded hit indicators, obtain the first action corresponding to the highest priority mask quintuple; if there are multiple matching results carrying rule pool cascaded hit indicators, match and search the first and second mask quintuples with cascaded matching relationships to obtain the corresponding second action; if there are multiple matching results carrying cascaded hit indicators with the same rule number, in response to multiple mask quintuples with the same rule number, obtain the third action corresponding to the highest priority mask quintuple.

[0073] By matching the 5-tuple information with the rule templates of each storage area, the matching results corresponding to each rule template can be obtained. Based on the different information carried by each matching result, corresponding processing is performed to determine the action strategy for the message to be processed. For multiple matching results carrying non-cascading hit indicators, arbitration is performed based on the rule priority of the mask 5-tuple. Based on the priority of the mask 5-tuple corresponding to each matching result, the highest priority mask 5-tuple is selected, and the first action corresponding to that mask 5-tuple is obtained. For multiple matching results carrying rule pool cascading hit indicators, the first and second mask 5-tuples with cascading matching relationships are matched and searched to obtain the corresponding second action. For multiple cascading hit indicators carrying the same rule number, in response to multiple mask 5-tuples with the same rule number, the third action corresponding to the highest priority mask 5-tuple is obtained.

[0074] S105: Select the highest priority action from the first action, the second action, and the third action as the message processing action for the message to be processed.

[0075] Based on the priority of the first action, the priority of the second action, and the priority of the third action, the action with the highest priority is selected as the message processing action for the message to be processed.

[0076] In this embodiment, each storage area of ​​HBM is configured with a rule template. Each rule template supports flexible mask quintuple configuration, and the rule entries of a single template can be expanded by cascading. Each mask quintuple supports non-cascaded rules, rule pool cascaded rules, and cascading of the same rule number. By cascading rule templates, the number of rule matches is reduced, FPGA system resources are reduced, and hardware costs are lowered.

[0077] In one embodiment of this application, the multiple rule templates include a source IP address template, a destination IP address template, a source IP address + destination IP address + protocol number template, a source port template, a destination port template, a source IP address + source port template, a destination IP address + destination port template, and a 5-tuple template. The mask 5-tuple configured in each rule template uses a bit-level mask configuration, with the same number of bits, only the positions of the mask bits differ. The mask 5-tuple includes the source IP address, destination IP address, source port, destination port, and protocol number. Each storage area of ​​the HBM corresponds to one rule template. The number of bits in the mask 5-tuple in the rule template is the same; that is, the number of bits in the mask 5-tuple stored at a storage address in each storage area is the same. Therefore, each storage area of ​​the HBM does not need to be configured with a fixed rule template; the mask of the corresponding rule template can be flexibly configured according to the user's needs.

[0078] For example, the source IP address template is configured to match the source IP address, where the source IP address in the mask 5-tuple is the configured value, and the destination IP address, source port, destination port, and protocol number are all 0. The destination IP address template is configured to match the destination IP address, where the destination IP address in the mask 5-tuple is the configured value, and the source IP address, source port, destination port, and protocol number are all 0. The source IP address + destination IP address + protocol number template is configured to match source IP address + destination IP address + protocol number, where the source IP address + destination IP address + protocol number in the mask 5-tuple is the configured value, and the source port and destination port are both 0. The source port template is configured to match the source port, where the source port in the mask 5-tuple is the configured value, and the source IP address, destination IP address, destination port, and protocol number are all 0. The destination port template is configured to match the destination port, where the destination port in the mask 5-tuple is the configured value, and the source IP address, destination IP address, source port, and protocol number are all 0. The `Source IP Address + Source Port` template is configured to match `Source IP Address + Source Port`. In this template, the source IP address and source port in the mask 5-tuple are configured values, while the destination IP address, destination port, and protocol number are all 0. The `Destination IP Address + Destination Port` template is configured to match `Destination IP Address + Destination Port`. In this template, the destination IP address and destination port in the mask 5-tuple are configured values, while the source IP address, source port, destination port, and protocol number are all 0. The `5-tuple` template is configured to match all 5-tuples. In this template, the source IP address, destination IP address, source port, destination port, and protocol number in the mask 5-tuple are all configured values.

[0079] One embodiment of this application, such as Figure 2 As shown, for each rule template, the quintuple information is ANDed with the template mask corresponding to that rule template to obtain the masked quintuple, i.e., the masked quintuple. A hash operation is then performed on this masked quintuple to obtain the corresponding hash value, including:

[0080] S201, Obtain the 5-tuple information from the message to be processed;

[0081] S202, for each rule template, perform a logical AND operation on the quintuple information and the template mask corresponding to the rule template according to the bits to obtain the masked quintuple, and perform a hash operation on the masked quintuple to obtain the corresponding hash value.

[0082] S203: For each storage area, obtain the hash value corresponding to the rule template configured for that storage area through the address bus and data bus corresponding to that storage area, and use the hash value as the storage address of that storage area.

[0083] Each rule template corresponds to a template mask. The value of each bit in the template mask indicates whether the same bits in the 5-tuple information are valid. For example, in the template mask corresponding to the source IP address template, all source IP addresses are 1s, while the destination IP address, source port, destination port, and protocol number are all 0s. In the template mask corresponding to the destination source IP address template, all destination IP addresses are 1s, while the source IP address, source port, destination port, and protocol number are all 0s. And so on, the template masks corresponding to the rule templates in the above embodiments can be obtained.

[0084] For any rule template, perform a logical AND operation between the quintuple information and the template mask corresponding to the rule template according to the bits to obtain the masked quintuple. Perform a hash operation on the masked quintuple to obtain the corresponding hash value, and thus obtain the hash value corresponding to each rule template.

[0085] Each storage area in HBM has its own independent address bus and data bus. Therefore, for each storage area, the hash value of the rule template corresponding to the storage area can be input into the storage area through the address bus and data bus of the storage area. Then, the hash value is used as the storage address of the storage area, i.e., the read address, so that the mask quintuple information stored in the storage address can be read.

[0086] In one embodiment of this application, the FPGA further includes a first on-chip memory region, a second on-chip memory region, and a third on-chip memory region. The first and second on-chip memory regions have the same depth, and the third on-chip memory region has a greater depth than the first on-chip memory region.

[0087] For each storage address in the first intra-storage area, the processing action corresponding to the first concatenated pool is configured in the storage space corresponding to the storage address, and the storage address is used as the first storage address corresponding to the first concatenated pool. The first concatenated pool includes multiple mask quintuples with common characteristics.

[0088] For each storage address in the second internal storage area, the processing action corresponding to the second concatenation pool is configured in the storage space corresponding to the storage address, and the storage address is used as the second storage address corresponding to the second concatenation pool. The first concatenation pool includes multiple mask quintuples with common characteristics.

[0089] The address obtained by combining the first storage address and the second storage address is used as the storage address of the third internal storage area. The processing actions corresponding to the first cascade pool and the second cascade pool with a cascade relationship are configured in the storage space corresponding to the storage address.

[0090] One application scenario of this embodiment is that if data streams from multiple source IP addresses have the same forwarding path or processing action, multiple source IP addresses can be used as a first concatenation pool. The processing action corresponding to the first concatenation pool is configured at a storage address in the first slice's internal storage area. Users can set up multiple first concatenation pools according to actual needs, configuring corresponding processing actions at different storage addresses in the first slice's internal storage area. For example, if a user uses multiple source IP addresses 192.168.1.1~192.168.1.5 as a first concatenation pool, assuming the processing action is forwarding, and the first storage address is 0x01, then the processing action corresponding to address 0x01 in the first slice's internal storage area is forwarding.

[0091] One application scenario of this embodiment is that if data streams from multiple destination IP addresses have the same receiving and processing actions, multiple destination IP addresses can be used as a second concatenation pool. The processing action corresponding to the second concatenation pool is configured at a storage address in the second intra-slice storage area. Users can set up multiple second concatenation pools according to actual needs, configuring corresponding processing actions at different storage addresses in the second intra-slice storage area. For example, if a user uses multiple destination IP addresses 200.3.5.1~200.3.5.20 as a second concatenation pool, assuming the processing action is forwarding, and the second storage address is 0x02, then the processing action corresponding to address 0x02 in the second intra-slice storage area is forwarding.

[0092] One application scenario of this embodiment is that if data sent from any one of multiple source IP addresses to any one of multiple destination IP addresses requires the same processing action, then multiple source IP addresses and multiple destination IP addresses are concatenated and bound together. This involves concatenating and binding the first concatenation pool and the second concatenation pool, and configuring the corresponding processing action at a specified storage address in the third slice's internal storage area. For example, in the above embodiment, the first concatenation pool and the second concatenation pool have a concatenation binding relationship, and the processing action configured at storage address 0x0102 in the third slice's internal storage area is forwarding.

[0093] In this embodiment, five-tuple information with the same message processing method can be cascaded and bound according to the user's needs, without having to set the processing rules for each message individually, thus achieving batch processing of messages.

[0094] In one embodiment of this application, for each storage address in any storage area, the storage address is configured as a rule configuration information of the corresponding rule template. The rule configuration information includes a mask quintuple, a cascading enable field, a cascading rule type field, a cascading pool type field, a rule identifier field, a priority field, and an action field.

[0095] The mask quintuple is used to configure the rule information for the mask quintuple. The cascading enable field indicates whether the mask quintuple corresponding to the storage address supports cascading rules. A cascading enable field of 1 indicates that the mask quintuple is a cascading rule, and a cascading enable field of 0 indicates that the mask quintuple is a non-cascading rule. When the cascading enable field is configured as a cascading rule, the cascading rule type field is configured as rule pool cascading or same rule number cascading. The cascading rule type field indicates the type of cascading rule to which the mask quintuple belongs. For example, if the cascading enable field is configured as 1 and the cascading rule type field is configured as 1, it indicates that the mask quintuple belongs to rule pool cascading; if the cascading rule type field is configured as 0, it indicates that the mask quintuple belongs to same rule number cascading.

[0096] When the cascading enable field is configured as a cascading rule and the cascading rule type field is configured as a rule pool cascading, the cascading pool type field is configured as either a first cascading pool or a second cascading pool. Specifically, if the cascading pool type field is configured as a first cascading pool, the rule identifier field is configured as a first storage address; if the cascading pool type field is configured as a second cascading pool, the rule identifier field is configured as a second storage address. The cascading pool type field indicates which type of rule pool cascading the mask quintuple belongs to. Cascading rule types include first cascading pool and second cascading pool. This cascading pool type field allows configuration of the rule pool cascading type corresponding to the mask quintuple according to actual needs. When the cascading pool type field is configured as a first cascading pool or a second cascading pool, the rule identifier field is configured as a first storage address or a second storage address. This allows the corresponding processing action to be read from the first internal storage area via the first storage address, or the corresponding processing action to be read from the second internal storage area via the second storage address. For example, if the cascading enable field is configured to 1 and the cascading rule type field is configured to 1, and the cascading pool type field is configured to 0, it indicates that the mask quintuple belongs to the first cascading pool; if the cascading pool type field is configured to 1, it indicates that the mask quintuple belongs to the second cascading pool. When the mask quintuple is configured for rule pool cascading, the action field in the corresponding rule configuration information does not need to be configured, because the processing action is configured through the first or second internal storage area.

[0097] When the cascading enable field is configured as a non-cascading rule, or when the cascading enable field is configured as a cascading rule and the cascading rule type field is configured to cascade with the same rule number, the rule identifier field is configured as the rule number. The rule number can be set according to user needs to identify a mask 5-tuple rule. The priority field indicates the rule priority corresponding to the mask 5-tuple. For example, the priority field ranges from 0 to 63, with smaller values ​​indicating higher priorities. The action field indicates the processing action corresponding to the packet to be processed when the mask 5-tuple is hit; processing actions include dropping, forwarding, and modifying.

[0098] One embodiment of this application involves performing rule matching between the quintuple information and the mask quintuple corresponding to the storage address to output at least one matching result corresponding to the rule template, including:

[0099] When the mask quintuple corresponding to the storage address is configured to support cascading rules, and the cascading rule type is rule pool cascading, and it is configured as the first cascading pool, if the quintuple information matches the rule of the mask quintuple, the first matching result is output. The first matching result includes the rule pool cascading hit indicator, the first cascading pool, the first storage address, and the priority. Using the first storage address as the read address of the first on-chip storage area, the processing action corresponding to the read address is obtained, and the processing action is marked as the fourth action. The priority in the first matching result is used as the priority of the fourth action.

[0100] For example, when multiple different rule templates output multiple first matching results, the mask 5-tuple with the highest priority is used as the rule that matches the message to be processed, and the priority of that mask 5-tuple is used as the priority of the fourth action. When multiple different rule templates output multiple first matching results, if there are mask 5-tuples with the same priority, the priority of the rule template with the smallest ID is used as the priority of the fourth action.

[0101] One embodiment of this application involves performing rule matching between the quintuple information and the mask quintuple corresponding to the storage address to output at least one matching result corresponding to the rule template, including:

[0102] When the mask quintuple corresponding to the storage address is configured to support cascading rules, and the cascading rule type is rule pool cascading, and it is configured as the second cascading pool, if the quintuple information matches the rule of the mask quintuple, a second matching result is output. The second matching result includes a rule pool cascading hit indicator, the second cascading pool, the second storage address, and a priority. Using the second storage address as the read address of the second on-chip storage area, the processing action corresponding to the read address is obtained, and this processing action is identified as the fifth action. The priority in the second matching result is used as the priority of the fifth action.

[0103] For example, when multiple different rule templates output multiple second matching results, the mask 5-tuple with the highest priority is used as the rule that matches the message to be processed, and the priority of that mask 5-tuple is used as the priority of the fifth action. When multiple different rule templates output multiple second matching results, if there are mask 5-tuples with the same priority, the priority of the rule template with the lowest ID is used as the priority of the fifth action.

[0104] In one embodiment of this application, if there are multiple matching results carrying rule pool cascade hit indicators, the first mask quintuple and the second mask quintuple with cascade matching relationship are matched and searched to obtain the corresponding second action, including: if the first matching result and the second matching result exist simultaneously in each matching result, the address of the combination of the first storage address and the second storage address is used as the read address of the third intra-slice storage area, the processing action corresponding to the read address is obtained, the processing action is identified as the second action, and the priority of the second action is used as the priority of the first matching result or the second matching result.

[0105] In this embodiment, for packets carrying a rule pool cascade hit indication and a matching result of the first cascade pool, the corresponding processing action is read from the first storage area via the first storage address to support the action strategy for subsequent packets to be processed. For packets carrying a rule pool cascade hit indication and a matching result of the second cascade pool, the corresponding processing action is read from the second storage area via the second storage address to support the action strategy for subsequent packets to be processed. In the case where both the first and second matching results exist, the address obtained by combining the first and second storage addresses is used as the read address of the third storage area to obtain the processing action corresponding to the read address. This allows the first and second cascade pools to be cascaded and bound, thereby realizing the action strategy for packets to be processed that conform to the mask 5-tuple matching rules of rule pool cascading.

[0106] One embodiment of this application involves performing rule matching between the quintuple information and the mask quintuple corresponding to the storage address to output at least one matching result corresponding to the rule template, including:

[0107] When the mask quintuple corresponding to the storage address is configured to support cascading rules, and the cascading rule type is cascading with the same rule number, if the quintuple information matches the rule of the mask quintuple, the third matching result is output. The third matching result includes the same rule number cascading hit indication, rule number, action, and priority. Among the multiple third matching results corresponding to multiple rule modules, it is determined whether the rule numbers are equal, the priority corresponding to each mask quintuple with equal rule numbers is obtained, and the action corresponding to the mask quintuple with the highest priority is used as the third action.

[0108] In this embodiment, within the same rule template, each mask quintuple or its corresponding storage address has a unique rule number. This can be understood as follows: in the configuration of rules cascading with the same rule number, users can cascade two or more different mask quintuples with the same rule number in different rule templates according to their needs. If two or more mask quintuples with the same rule number are matched simultaneously, the packet is determined to have matched the rule. For example, in the first source IP address template, the cascading enable field is configured to be 1 and the cascading rule type field is configured to be 0 in the rule configuration information corresponding to rule number 2, indicating that the mask quintuple belongs to the cascading with the same rule number; in the first destination IP address template, the cascading enable field is configured to be 1 and the cascading rule type field is configured to be 0 in the rule configuration information corresponding to rule number 2, indicating that the mask quintuple belongs to the cascading with the same rule number. During mask 5-tuple rule matching, after each rule template matching, the third matching result is determined. The matching result contains a concatenated hit indicator for the same rule number, and the rule number is used to determine if the rule numbers match. If they match, the message to be processed is considered to have simultaneously hit all mask 5-tuples with equal rule numbers. If they do not match, the message to be processed is considered not to have hit any rules. The priority of each mask 5-tuple with equal rule numbers is obtained, and the action corresponding to the mask 5-tuple with the highest priority is used as the third action.

[0109] In one embodiment of this application, when the mask quintuple corresponding to the storage address is configured as a non-cascading rule, if the quintuple information matches the rule of the mask quintuple, a fourth matching result is output. The fourth matching result includes a non-cascading hit indication, a rule number, an action, and a priority. If there are multiple fourth matching results, the action corresponding to the mask quintuple with the highest priority is taken as the first action.

[0110] For example, when multiple different rule templates output multiple fourth matching results, the mask quintuple with the highest priority is used as the rule that matches the message to be processed, and the priority of that mask quintuple is used as the priority of the first action. When multiple different rule templates output multiple fourth matching results, if there are mask quintuples with the same priority, the priority of the rule template with the smallest ID is used as the priority of the first action.

[0111] In one embodiment of this application, selecting the highest priority action from the first action, the second action, and the third action as the message processing action for the message to be processed includes: determining the highest priority from the priorities of the first action, the second action, the third action, the fourth action, and the fifth action, and using the action corresponding to the highest priority as the message processing action for the message to be processed.

[0112] In one embodiment of this application, selecting the highest priority action from the first action, second action, and third action as the message processing action for the message to be processed includes: if there is an equal priority among the priorities of the first action, second action, third action, fourth action, and fifth action, the message processing action for the message to be processed is executed based on the following priority arbitration method, which includes:

[0113] The second action has a higher priority than the third action, the third action has a higher priority than the fourth action, the fourth action has a higher priority than the fifth action, and the fifth action has a higher priority than the first action.

[0114] In the priority arbitration process for rule matching, the priority of matching rules cascaded using rule pools is higher than the priority of matching rules cascaded with the same rule number, and the priority of matching rules cascaded with the same rule number is higher than the priority of non-cascaded matching rules.

[0115] Based on the same inventive concept, this application also provides a 5-tuple rule matching device based on FPGA multi-rule templates. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the 5-tuple rule matching device based on FPGA multi-rule templates provided below can be found in the above-described limitations of the 5-tuple rule matching method based on FPGA multi-rule templates, and will not be repeated here.

[0116] Please refer to Figure 3 This application provides a 5-tuple rule matching device based on FPGA multi-rule templates. The FPGA includes a high-bandwidth memory (HBM), which includes multiple storage areas. Any one of the storage areas is configured as any one of the multiple rule templates. The storage address in the storage area stores a rule configuration information of one rule in the corresponding rule template. The rule configuration information includes a mask 5-tuple, priority, and action. The device includes:

[0117] The acquisition module 301 is used to acquire the quintuple information in the message to be processed;

[0118] The calculation module 302 is used to perform a bitwise AND operation on the quintuple information and the template mask corresponding to the rule template for each rule template to obtain the masked quintuple, and then perform a hash operation on the masked quintuple to obtain the corresponding hash value.

[0119] The matching module 303 is used to perform rule matching on the five-tuple information and the mask five-tuple corresponding to the storage address for each hash value, using the hash value as the storage address of the corresponding storage area, so as to output the matching result corresponding to the rule template. The matching result carries at least one of the following: miss, non-cascade hit, rule pool cascade hit, and same rule number cascade hit.

[0120] Arbitration module 304 is used to handle the matching results corresponding to the various rule templates obtained, where...

[0121] If there are multiple matching results carrying non-cascaded hit indicators, obtain the first action corresponding to the mask quintuple with the highest priority;

[0122] If there are multiple matching results carrying rule pool cascade hit indicators, the first mask quintuple and the second mask quintuple with cascade matching relationship are matched and searched to obtain the corresponding second action;

[0123] If there are multiple matching results carrying the same rule number cascaded hit indication, in response to multiple mask quintuples with the same rule number, obtain the third action corresponding to the mask quintuple with the highest priority;

[0124] Select the action with the highest priority from the first, second, and third actions as the message processing action for the message to be processed.

[0125] As an example, please refer to Figure 4This diagram illustrates the structure of a communication device according to an embodiment of this application. The network device includes an FPGA-based multi-rule template 5-tuple rule matching device 401, a communication interface 402, a processor 403, a memory 404, and a bus 405. The processor 403, memory 404, communication interface 402, and FPGA-based multi-rule template 5-tuple rule matching device 401 are communicatively connected to each other via the bus 405. The memory 404 can be used to store computer programs, which may include instructions and data. In this embodiment, the memory 404 can be various types of storage media, such as random access memory, static random access memory, non-volatile RAM, DDR, etc. The memory 404 may include a hard disk and / or RAM. The processor 403 can be a general-purpose processor, which can be a processor that performs specific steps and / or operations by reading and executing the computer program stored in the memory (e.g., memory 404). The general-purpose processor is used to process the data output by the FPGA-based multi-rule template 5-tuple rule matching device 401. The general-purpose processor may be, for example, but is not limited to, a central processing unit. Furthermore, processor 403 can also be a dedicated processor, which can be a processor specifically designed to perform specific steps and / or operations. Dedicated processors can be, for example, but not limited to, ASICs and FPGAs. Additionally, processor 403 can be a combination of multiple processors, such as a multi-core processor. Communication interface 402 can include input / output interfaces, physical interfaces, and logical interfaces for interconnecting devices within the network device, as well as interfaces for interconnecting the network device with other devices (e.g., network devices). The physical interface can be a gigabit Ethernet interface, which can be used to interconnect the network device with other devices. The logical interface is an interface within the network device, which can be used to interconnect devices within the network device. Bus 405 can be of any type, used to interconnect processor 403, memory 404, communication interface 402, and the FPGA-based multi-rule template five-tuple rule matching device 401. For example, the structure of the system bus FPGA-based multi-rule template five-tuple rule matching device 401 can be referenced. Figure 3 The embodiments shown are not described in detail here. The interconnection of any device among the processor 403, memory 404 and communication interface 402 with the FPGA-based multi-rule template quintuple rule matching device 401 can specifically refer to the interconnection of any device with the devices in the FPGA-based multi-rule template quintuple rule matching device 401.

[0126] The embodiments disclosed in this application also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the quintuple rule matching method for multi-rule templates described in any of the above embodiments.

[0127] Although preferred embodiments of the present application have been disclosed for illustrative purposes, those skilled in the art will recognize that various modifications, additions, and substitutions are possible without departing from the scope and spirit of the present application as disclosed in the appended claims.

Claims

1. A quintuple rule matching method based on FPGA multi-rule templates, characterized in that, The FPGA includes a high-bandwidth memory (HBM), which includes multiple storage areas. Any one of these storage areas is configured as any one of the multiple rule templates. The storage address in each storage area stores a rule configuration information from the corresponding rule template. The rule configuration information includes a mask quintuple, priority, and action. The method includes: Retrieve the quintuple information from the message to be processed; For each rule template, the quintuple information is ANDed with the template mask corresponding to the rule template to obtain the masked quintuple. The masked quintuple is then hashed to obtain the corresponding hash value. For each hash value, the hash value is used as the storage address of the corresponding storage area. The five-tuple information is matched with the mask five-tuple corresponding to the storage address to output the matching result corresponding to the rule template. The matching result carries at least one of the following: miss, non-cascade hit, rule pool cascade hit, and same rule number cascade hit. For each matching result corresponding to the obtained rule template, among which, If there are multiple matching results carrying non-cascaded hit indicators, obtain the first action corresponding to the mask quintuple with the highest priority; If there are multiple matching results carrying rule pool cascade hit indicators, the first mask quintuple and the second mask quintuple with cascade matching relationship are matched and searched to obtain the corresponding second action; If there are multiple matching results carrying the same rule number cascaded hit indication, in response to multiple mask quintuples with the same rule number, obtain the third action corresponding to the mask quintuple with the highest priority; From the first action, the second action, and the third action, select the action with the highest priority as the message processing action for the message to be processed; The FPGA further includes a first on-chip memory area, a second on-chip memory area, and a third on-chip memory area. The first on-chip memory area and the second on-chip memory area have the same depth, and the third on-chip memory area has a greater depth than the first on-chip memory area. For each storage address in the first on-chip storage area, the processing action corresponding to the first concatenation pool is configured in the storage space corresponding to the storage address, and the storage address is used as the first storage address corresponding to the first concatenation pool. The first concatenation pool includes multiple mask quintuples with common characteristics. For each storage address in the second intra-storage area, the processing action corresponding to the second concatenation pool is configured in the storage space corresponding to the storage address, and the storage address is used as the second storage address corresponding to the second concatenation pool. The second concatenation pool includes multiple mask quintuples with common characteristics. The address obtained by combining the first storage address and the second storage address is used as the storage address of the third internal storage area. The processing actions corresponding to the first cascade pool and the second cascade pool with a cascade relationship are configured in the storage space corresponding to the storage address.

2. The 5-tuple rule matching method based on FPGA multi-rule templates according to claim 1, characterized in that, For each rule template, the quintuple information is ANDed with the template mask corresponding to that rule template to obtain the masked quintuple. A hash operation is then performed on this masked quintuple to obtain the corresponding hash value, including: Obtain the five-tuple information from the message to be processed, wherein the five-tuple information includes the source IP address, destination IP address, source port, destination port, and protocol number; For each rule template, the quintuple information and the template mask corresponding to the rule template are logically ANDed bitwise to obtain the masked quintuple. The masked quintuple is then hashed to obtain the corresponding hash value. The value of each bit in the template mask indicates whether the same bit in the quintuple information is valid. For each hash value, use that hash value as the storage address of the corresponding storage area, including: For each storage area, the hash value corresponding to the rule template configured for that storage area is obtained through the address bus and data bus of that storage area, and the hash value is used as the storage address of that storage area. Each storage area in the HBM has an independent address bus and data bus.

3. The quintuple rule matching method based on FPGA multi-rule templates according to claim 1, characterized in that, For each storage address in any given storage area, that storage address is configured as a rule configuration information for the corresponding rule template. This rule configuration information includes a mask 5-tuple, a cascading enable field, a cascading rule type field, a cascading pool type field, a rule identifier field, a priority field, and an action field. The concatenation enable field is used to characterize whether the mask quintuple corresponding to the storage address supports concatenation rules. A concatenation enable field of 1 indicates that the mask quintuple is a concatenation rule, and a concatenation enable field of 0 indicates that the mask quintuple is a non-concatenation rule. When the cascading enable field is configured as a cascading rule, the cascading rule type field is configured as rule pool cascading or cascading with the same rule number. When the cascading enable field is configured as a cascading rule and the cascading rule type field is configured as a rule pool cascading, the cascading pool type field is configured as a first cascading pool or a second cascading pool. If the cascading pool type field is configured as a first cascading pool, the rule identifier field is configured as a first storage address. If the cascading pool type field is configured as a second cascading pool, the rule identifier field is configured as a second storage address. When the cascading enable field is configured as a non-cascading rule, or when the cascading enable field is configured as a cascading rule and the cascading rule type field is configured as cascading with the same rule number, the rule identifier field is configured as a rule number. The priority field is used to characterize the rule priority corresponding to the mask quintuple; The action field is used to characterize the processing action of the corresponding message to be processed when the mask 5-tuple is hit. The processing action includes dropping, forwarding, and modifying.

4. The 5-tuple rule matching method based on FPGA multi-rule templates according to claim 3, characterized in that, The multi-rule templates include source IP address template, destination IP address template, source IP address + destination IP address + protocol number template, source port template, destination port template, source IP address + source port template, destination IP address + destination port template, and 5-tuple template.

5. The 5-tuple rule matching method based on FPGA multi-rule templates according to claim 3, characterized in that, The quintuple information is matched against the mask quintuple corresponding to the storage address using a rule to output the matching result corresponding to the rule template, including: When the mask quintuple corresponding to the storage address is configured to support cascading rules, and the cascading rule type is rule pool cascading, and is configured as the first cascading pool, if the quintuple information matches the rule of the mask quintuple, the first matching result is output. The first matching result includes the rule pool cascading hit indication, the first cascading pool, the first storage address, and the priority. Using the first storage address as the read address of the first intra-chip storage area, obtain the processing action corresponding to the read address, mark the processing action as the fourth action, and use the priority in the first matching result as the priority of the fourth action; And / or, When the mask quintuple corresponding to the storage address is configured to support cascading rules, and the cascading rule type is rule pool cascading, and is configured as a second cascading pool, if the quintuple information matches the rule of the mask quintuple, a second matching result is output. The second matching result includes a rule pool cascading hit indication, a second cascading pool, a second storage address, and a priority. Using the second storage address as the read address of the second on-chip memory area, obtain the processing action corresponding to the read address, identify the processing action as the fifth action, and use the priority in the second matching result as the priority of the fifth action.

6. The 5-tuple rule matching method based on FPGA multi-rule templates according to claim 5, characterized in that, If multiple matching results carrying rule pool cascade hit indicators exist, the first mask quintuple and the second mask quintuple with cascade matching relationship are matched and searched to obtain the corresponding second action, including: If both a first matching result and a second matching result exist in the various matching results, the address obtained by combining the first storage address and the second storage address is used as the read address of the third intra-slice storage area. The processing action corresponding to the read address is obtained, and the processing action is identified as the second action. The priority of the second action is taken from the priority of the first matching result or the second matching result.

7. The 5-tuple rule matching method based on FPGA multi-rule templates according to claim 6, characterized in that, The quintuple information is matched against the mask quintuple corresponding to the storage address using a rule to output at least one matching result corresponding to the rule template, including: When the mask quintuple corresponding to the storage address is configured to support cascading rules, and the cascading rule type is cascading with the same rule number, if the quintuple information matches the rule of the mask quintuple, a third matching result is output. The third matching result includes the same rule number cascading hit indication, rule number, action, and priority. Among the multiple third matching results corresponding to multiple rule modules, the priority of each mask quintuple with the same rule number is obtained, and the action corresponding to the mask quintuple with the highest priority is taken as the third action. And / or, When the mask quintuple corresponding to the storage address is configured as a non-cascaded rule, if the quintuple information matches the rule of the mask quintuple, a fourth matching result is output. The fourth matching result includes a non-cascaded hit indication, rule number, action, and priority. If there are multiple fourth matching results, the action corresponding to the mask quintuple with the highest priority is taken as the first action.

8. The 5-tuple rule matching method based on FPGA multi-rule templates according to claim 7, characterized in that, Selecting the highest priority action from the first, second, and third actions as the message processing action for the message to be processed includes: From the priorities of the first action, the second action, the third action, the fourth action, and the fifth action, determine the highest priority, and use the action corresponding to the highest priority as the message processing action for the message to be processed. and / or; If any of the priorities of the first, second, third, fourth, and fifth actions are equal, the message processing action for the pending message will be executed based on the following priority arbitration method: The second action has a higher priority than the third action, the third action has a higher priority than the fourth action, the fourth action has a higher priority than the fifth action, and the fifth action has a higher priority than the first action.

9. A quintuple rule matching device based on FPGA multi-rule templates, characterized in that, The FPGA includes a high-bandwidth memory (HBM), which includes multiple storage areas. Any one of these storage areas is configured as any one of the multiple rule templates. The storage address in each storage area stores a rule configuration information entry from the corresponding rule template. The rule configuration information includes a mask quintuple, priority, and action. The device includes: The acquisition module is used to acquire the five-tuple information in the message to be processed; The calculation module is used to perform a bitwise AND operation on the quintuple information and the template mask corresponding to the rule template for each rule template to generate a masked quintuple, and then perform a hash operation on the masked quintuple to obtain the corresponding hash value. The matching module is used to perform rule matching on the five-tuple information and the mask five-tuple corresponding to the storage address for each hash value, using the hash value as the storage address of the corresponding storage area, so as to output the matching result corresponding to the rule template. The matching result carries at least one of the following: miss, non-cascade hit, rule pool cascade hit, and same rule number cascade hit. The arbitration module is used to process the matching results corresponding to each of the acquired rule templates. If there are multiple matching results carrying non-cascaded hit indicators, obtain the first action corresponding to the mask quintuple with the highest priority; If there are multiple matching results carrying rule pool cascade hit indicators, the first mask quintuple and the second mask quintuple with cascade matching relationship are matched and searched to obtain the corresponding second action; If there are multiple matching results carrying the same rule number cascaded hit indication, in response to multiple mask quintuples with the same rule number, obtain the third action corresponding to the mask quintuple with the highest priority; From the first action, the second action, and the third action, select the action with the highest priority as the message processing action for the message to be processed; The FPGA further includes a first on-chip memory area, a second on-chip memory area, and a third on-chip memory area. The first on-chip memory area and the second on-chip memory area have the same depth, and the third on-chip memory area has a greater depth than the first on-chip memory area. For each storage address in the first on-chip storage area, the processing action corresponding to the first concatenation pool is configured in the storage space corresponding to the storage address, and the storage address is used as the first storage address corresponding to the first concatenation pool. The first concatenation pool includes multiple mask quintuples with common characteristics. For each storage address in the second intra-storage area, the processing action corresponding to the second concatenation pool is configured in the storage space corresponding to the storage address, and the storage address is used as the second storage address corresponding to the second concatenation pool. The second concatenation pool includes multiple mask quintuples with common characteristics. The address obtained by combining the first storage address and the second storage address is used as the storage address of the third internal storage area. The processing actions corresponding to the first cascade pool and the second cascade pool with a cascade relationship are configured in the storage space corresponding to the storage address.

Images