JP5900352B2 - Packet processing apparatus, packet processing method and program - Google Patents

Description

(Description of related applications)
The present invention is based on the priority claim of Japanese patent application: Japanese Patent Application No. 2011-022303 (filed on Feb. 4, 2011), the entire contents of which are incorporated herein by reference. Shall.

  The present invention relates to a packet processing device, a packet processing method, and a program, and more particularly, to a packet processing device, a packet processing method, and a program that transmit and receive packets using a plurality of processors.

  With the increase in Internet traffic, the speed and performance of packet processing devices that support it are increasing. In recent years, high-speed network interface cards have become widespread, and it is possible to speed up packet processing by using the network interface card even in general-purpose servers. On the other hand, the speed-up of the processor due to the higher clock speed has become the limit due to the increase in power consumption. Therefore, the performance improvement by the multi-core and multi-processor is progressing. ing.

  When a packet processing apparatus is realized using a general-purpose OS such as Linux (registered trademark), if a high-speed network card is installed, processor processing in transmission / reception becomes a bottleneck, and communication at a wire rate becomes impossible. It becomes difficult. Even if a multi-core processor is used, bottlenecks will occur due to the concentration of packet processing on a single processor (core) that is the interrupt destination from the network interface card, and sufficient load distribution will be performed. There is a problem that can not be.

  In order to solve this problem, in Patent Document 1, a processor that processes a packet is uniquely determined from a plurality of processors based on header information of the packet to be processed. Specifically, a hash value is calculated from a partial field of the packet header, and a modulo operation is performed on the obtained hash value by the number of processors (number of cores) to obtain a processor number. Then, the processor having the obtained processor number is made to process the packet. Here, since the modulo operation is performed by the number of processors (the number of cores), the processor number is uniquely obtained by the operation. That is, if the remainder (that is, the processor number) obtained from the hash value is different, the processor to be processed is also different, and packet processing can be distributed among a plurality of processors (cores). Therefore, load distribution can be realized without the processing by a single processor (core) becoming a bottleneck.

  Hereinafter, the processor and the processor core are collectively referred to as a “processor”.

Special table 2002-538724 gazette

Nick McKeown and 7 others, “OpenFlow: Enabling Innovation in Campus Networks,” [online], [December 17, 2010 search], Internet <URL: http: // www. openflowswitch. org // documents / openflow-wp-latest. pdf>. “OpenFlow Specification Version 1.0.0. (Wire Protocol 0x01),” [searched on December 17, 2010], Internet <URL: http: // www. openflowswitch. org / documents / openflow-spec-v1.0.0. pdf>.

  The disclosures of the above-mentioned patent documents and non-patent documents are incorporated herein by reference. The following analysis was made by the present inventors.

  In the packet processing device described in Patent Document 1, as described above, a processor that processes a packet is uniquely determined based on a partial field of the header of the packet. Therefore, if the hash values calculated from some fields of the header are the same, the processor number obtained from the modulo operation is always the same, and the processor that processes the packet is fixed. Therefore, there is a problem that a processor that executes packet processing cannot be flexibly selected.

  Therefore, in a packet transfer apparatus including a plurality of processors, it becomes an issue to be able to select a processor that executes packet processing flexibly and at high speed from among the plurality of processors. The objective of this invention is providing the packet processing apparatus, the packet processing method, and program which solve this subject.

The packet processing device according to the first aspect of the present invention provides:
A rule table holding rules for associating information stored in a packet, an action indicating a first process for the packet, and a processor identifier for identifying a processor performing the second process for the packet;
A rule extraction unit that extracts a rule corresponding to information stored in a target packet, which is a packet to be processed, from the rule table;
A rule applying unit that executes the first process according to the action for the target packet based on the extracted rule, and requests the second process to the processor corresponding to the processor identifier; It has.

The packet processing method according to the second aspect of the present invention is:
A rule in which one of a plurality of processors associates information stored in a packet, an action indicating a first process for the packet, and a processor identifier for identifying a processor performing the second process for the packet Extracting a rule corresponding to information stored in a target packet, which is a packet to be processed, from a rule table holding
The one processor performs, based on the extracted rule, the execution of the first process according to the action for the target packet and the request for the second process to the processor corresponding to the processor identifier. And including.

The program according to the third aspect of the present invention is:
A packet to be processed from a rule table that holds information stored in the packet, an action indicating the first process for the packet, and a rule that associates a processor identifier for identifying the processor that performs the second process for the packet. A process for extracting a rule corresponding to information stored in the target packet,
Based on the extracted rule, a process of executing the first process according to the action on the target packet and requesting the second process to the processor corresponding to the processor identifier is a plurality of processes. One of the processors is executed.

  The program may be provided as a program product recorded on a non-transient computer-readable storage medium.

  According to the packet processing device, the packet processing method, and the program according to the present invention, the information stored in the packet, the processing rule indicating the first processing for the packet, and the processor performing the second processing for the packet are identified. Since a rule table for associating processor identifiers with each other is provided, by setting a processor identifier in the rule table, a processor that executes packet processing can be flexibly selected from a plurality of processors.

  Further, according to the packet processing device and the packet processing method according to the present invention, based on the rule corresponding to the packet to be processed, extracted from the rule table, the first process is performed on the packet and the packet is processed. Since the processor selection is executed as one process, packet processing can be performed at high speed.

It is a block diagram which shows roughly the structure of the packet processing apparatus concerning this invention. It is a block diagram which shows the structure of the packet processing apparatus which concerns on 1st Embodiment. It is a figure which shows the rule table in the packet processing apparatus which concerns on 1st Embodiment. It is a flowchart which shows operation | movement of the packet processing apparatus which concerns on 1st Embodiment. It is a block diagram which shows the structure of the packet processing apparatus which concerns on 2nd Embodiment. It is a figure which shows the rule table in the packet processing apparatus which concerns on 2nd Embodiment. It is a flowchart which shows the transmission process by the packet processing apparatus which concerns on 2nd Embodiment. It is a flowchart which shows the reception process by the packet processing apparatus which concerns on 2nd Embodiment. It is a flowchart which shows the reception process by the packet processing apparatus which concerns on 2nd Embodiment. It is a block diagram which shows the structure of the packet processing apparatus which concerns on 3rd Embodiment. It is a figure which shows the rule table in the packet processing apparatus which concerns on 3rd Embodiment. It is a block diagram which shows the structure of the packet processing apparatus which concerns on 4th Embodiment. It is a figure which shows the entry of the flow table of OpenFlow. It is a figure which shows the action of OpenFlow.

  First, the outline of the present invention will be described. Note that the reference numerals of the drawings attached to this summary are merely examples for facilitating understanding, and are not intended to limit the present invention to the illustrated embodiment.

  Referring to FIG. 1, the packet processing apparatus according to the present invention includes information stored in a packet, a processing rule indicating a first process for the packet, and a processor identifier for identifying a processor that performs the second process for the packet. A rule table (110) that holds rules for associating each other with each other, a rule extraction unit (130) that extracts rules that match information stored in a target packet that is a packet to be processed, from the rule table (110), and an extraction A rule applying unit (140) for requesting execution of a first process according to the processing rule for the target packet and a second process for a processor corresponding to the processor identifier based on the determined rule. ing.

  The packet processing apparatus according to the present invention includes a rule table (110) that holds a rule that associates a matching condition for a packet with a processor that processes the packet. Therefore, by directly setting the matching condition and the processor identifier for the rule in the rule table (110), the processor that processes the packet can be flexibly selected. A processor that processes a packet group having information is not uniquely fixed according to a predetermined calculation rule. Also, according to the packet processing apparatus of the present invention, the user can easily change the rules for selecting a processor for processing a packet by rewriting the rules stored in the rule table (110).

  Further, the rules of the rule table (110) in the packet processing device of the present invention include information stored in a packet, a processing rule indicating a first process for the packet, and a processor that performs a second process for the packet. Associate the identifying processor identifiers with each other. Therefore, when the rule corresponding to the target packet is extracted by the rule extraction unit (130), not only the content of the first process to be executed on the packet is specified, but also the second process for the packet is performed. A processor to execute is also specified. Therefore, according to the packet processing device of the present invention, the processing rule indicating the processing for the packet is specified by referring to the table, and the processing of the packet is performed at a higher speed than when the processor for executing the processing for the packet is specified separately. be able to.

  As described above, according to the packet processing apparatus of the present invention, in a packet transfer apparatus including a plurality of processors, a processor that executes packet processing can be selected flexibly and at high speed.

  In the present invention, the following modes are possible.

[Form 1]
The packet processing apparatus according to the first aspect is as described above.

[Form 2]
The first process is a process for determining whether or not to discard the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. In some cases, it may be a lower layer process for the target packet.

[Form 3]
The rule application unit may request the processor to perform the second process on the target packet when the target packet is not a packet to be discarded in the first process.

[Form 4]
The rule table defines information stored in a packet, a processing rule indicating a first process for the packet, a processor identifier for identifying a processor that performs a second process for the packet, and a flow including the packet Holds rules that associate flow definition fields that represent fields with each other,
When a plurality of processor identifiers are included in the extracted rule, the rule application unit refers to the flow definition field, and selects one of a plurality of processors corresponding to the plurality of processor identifiers. Thus, the second process may be requested for all target packets included in the same flow.

[Form 5]
When the rule table does not hold a rule corresponding to the information stored in the target packet, the rule extraction unit sets a rule that matches the information in a rule setting device capable of setting the rule. You may make it request.

[Form 6]
The first process is a process of determining a destination of the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. In some cases, it may be a lower layer process for the target packet.

[Form 7]
When the target packet is a packet to be received by the packet processing device and the destination of the target packet is the packet processing device, the rule application unit performs the second processing on the target packet. You may make it ask the said processor.

[Form 8]
The rule extraction unit has a cache that temporarily holds the extracted rules, and extracts rules that match the information stored in the target packet from the cache,
The rule application unit, when the target packet is a packet to be received by the packet processing device, and when a rule that matches the target packet is extracted from the cache by the rule extraction unit, the rule application unit The second process may be requested from the processor.

[Form 9]
The first process is a process of specifying control information in a transport layer when transmitting / receiving the target packet;
When the target packet is a packet to be received by the packet processing device, the second process is a layer 4 reception process for the target packet using the specified control information. When the packet is to be transmitted by the packet processing device, it may be a layer 4 or lower transmission process for the target packet using the specified control information.

[Mode 10]
The rule table holds a plurality of rules sorted according to priority,
When a plurality of rules that match the information stored in the target packet are stored in the rule table, the rule extraction unit extracts a rule having a high priority from the plurality of rules. May be.

[Form 11]
The rules in the rule table may include at least one of a source address, a destination address, a source port number, and a destination port number as information stored in the packet.

[Form 12]
You may further provide the rule setting part which adds, changes, or deletes a rule with respect to the said rule table.

[Form 13]
The packet processing method according to the second aspect is as described above.

[Form 14]
Further, processing is performed from a rule table that holds information stored in a packet, a processing rule indicating a first process for the packet, and a rule that associates a processor identifier for identifying a processor that performs the second process for the packet. A process for extracting a rule corresponding to information stored in a target packet that is a packet to be processed;
A plurality of processes for executing the first process according to the processing rule for the target packet and performing a request for the second process to the processor corresponding to the processor identifier based on the extracted rule A program to be executed by one of the processors is provided.

(Embodiment 1)
The packet processing apparatus according to the first embodiment will be described with reference to the drawings. FIG. 2 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment. Referring to FIG. 2, the packet processing apparatus according to the present embodiment includes a rule table 10, a rule setting unit 20, a rule extraction unit 30, a rule application unit 40, a processing thread 50, a transmission reception unit 60, and a reception reception unit 70. It has.

  The packet processing apparatus according to the present embodiment includes an OS corresponding to a plurality of processors (or processor cores), is connected to a network via a network interface device, and processes packets represented by IP packets. The upper layer protocol processing is performed by software (including the OS). That is, each of the components shown in FIG. 2 can be realized by software. However, some or all of the components in FIG. 2 may be realized by hardware.

  The rule table 10 holds a filtering rule describing a filtering rule for transmission / reception packets and a dispatch rule describing a processor allocation rule. Filtering rules and dispatch rules are managed in a single table.

  FIG. 3 is a diagram illustrating the rule table 10 as an example. Referring to FIG. 3, the rule table 10 is managed for each reception / transmission. One rule corresponding to each row of the rule table 10 includes at least a matching condition, an action, and a processor identifier. Each rule in the rule table 10 may include a flow definition field.

  The matching condition represents a conditional expression regarding the header field of the L3 layer or higher of the packet. For example, the rule on the first line in FIG. 3 is a TCP protocol and represents a rule relating to a packet whose destination port number is 80. As a matching condition, not only the protocol number and port number shown in FIG. 3 but also conditions related to various fields such as an IP address, an AH header (Authentication Header), and an ESP (Encapsulating Security Payload) value such as SPI (Security Parameter Index) Can be described.

  The action indicates a first process (first process, basic process) for a transmission / reception packet. For the action, for example, ACCEPT for continuing the processing of the packet or DROP for discarding the packet is used. In addition to these two processes, a process for rewriting part of the data of the packet may be described as an action.

  The processing processor identifier represents a processor that processes a packet that matches the matching condition. The processing processor identifier can describe zero or more processor identifiers.

  The flow definition field represents a header field of a packet used for identifying whether or not the flow is the same. In the flow definition field, when a plurality of processor identifiers are described in the processing processor identifier, one processor among the descriptions in the processing processor identifier is selected so that packets belonging to the same flow are processed by the same processor. Used to select.

  The rules in the rule table 10 are preferably managed by arranging them in order of priority.

  The rule setting unit 20 sets rules such as adding, changing, and deleting rules with respect to the rule table 10. For example, the rule setting unit 20 operates as a user application and sets a rule by performing message communication between the user and the kernel.

  The rule extraction unit 30 collates the information stored in the transmission / reception packet with the collation conditions of the rule table 10 and searches for a matching rule. When a plurality of rules are matched, the rule extraction unit 30 returns, for example, the highest priority among matching rules as a search result.

  The rule application unit 40 includes a basic application unit 401 and a dispatch unit 402. When the rule application unit 40 receives the rule and the transmission / reception packet, the basic application unit 401 applies the filtering rule as the first process, and the dispatch unit 402 applies the dispatch rule. On the other hand, when the processing is canceled due to the application of the filtering rule, the dispatch rule is not applied in the dispatch unit 402, and the processing of the packet is terminated.

  The basic application unit 401 performs a process related to an action in the rule as the first process. When the rule action is DROP, the basic application unit 401 discards the transmission / reception packet. On the other hand, when the action is ACCEPT, the dispatch unit 402 determines a processing processor that processes the transmission / reception packet according to the processing processor identifier in the rule, and processes the packet to the processing thread 50 corresponding to the processor. Ask.

  The processing thread 50 is a kernel thread prepared for each processor, and performs layer 3 and layer 4 reception processing for received packets and layer 3 and layer 2 transmission processing for transmission packets as second processing for packets. The processing thread 50 includes a reception processing unit 501 and a transmission processing unit 502, and holds a processing queue (not shown). The processing queue stores a packet and a processing classification (transmission / reception). The processing thread 50 sequentially takes out the packets stored in the processing queue, and when the processing classification is transmission, performs transmission processing by the transmission processing unit 502 on the packet. On the other hand, when the processing classification is reception, the processing thread 50 performs reception processing by the reception processing unit 501 on the packet. The transmission processing unit 502 performs layer 3 and layer 2 transmission processing on the transmission packet, and sends the packet to the network. On the other hand, the reception processing unit 501 performs layer 3 and layer 4 reception processing on the received packet, and performs processing of passing the received packet to the user application as necessary.

  The transmission reception unit 60 receives a transmission packet from the user application or the kernel, collates the transmission packet by the rule extraction unit 30, and passes the rule and the transmission packet obtained as a collation result to the rule application unit 40.

  The reception receiving unit 70 receives a received packet from the network, collates the received packet with the rule extracting unit 30, and passes the rule and the received packet obtained as a matching result to the rule applying unit 40.

  Next, the operation of the packet processing apparatus according to the present embodiment will be described with reference to the drawings. FIG. 4 is a flowchart showing an example of the operation of the packet processing apparatus according to the present embodiment.

  Referring to FIG. 4, when a packet arrives from the network, the received packet is delivered to reception reception unit 70. The reception accepting unit 70 that has received the received packet searches the rule table 10 for a rule that matches the received packet by the rule extracting unit 30 (step S1), and passes the result to the rule applying unit 40 together with the received packet.

  Next, when the rule applying unit 40 receives the rule and the received packet, the basic applying unit 401 applies an action as the first process (step S2). If the action in the rule is DROP (No in step S3), the basic application unit 401 discards the received packet (step S4) and completes the processing of the received packet.

  On the other hand, when the action is ACCEPT (Yes in step S3), the dispatch unit 402 selects a processing processor according to the processing processor identifier of the rule (Yes in step S5, S6). On the other hand, when the processing processor identifier is not specified in the rule (No in step S5), the dispatch unit 402 is currently executing the processor (that is, the processor executing the processing of the dispatch unit 402 itself). Is selected as a processing processor (step S7).

  Next, the dispatch unit 402 requests processing by queuing the reception processing of the upper protocol of the received packet in the processing queue of the processing thread 50 corresponding to the determined processing processor (step S8). The reception processing unit 501 of the processing thread 50 that has received the request executes a packet reception process (that is, a higher layer reception process for the received packet) as a second process for the packet.

  In step S6, when the flow definition field is used, a processing processor is determined from the processors specified by the processing processor identifier based on the hash value of the specified field. In particular, it is preferable to select a field that can identify the same flow as the flow definition field. Thereby, packets belonging to the same flow can be prevented from being distributed to a plurality of processors, and overhead caused by exclusive control and packet alignment can be reduced.

  In the packet transmission process, the same process is performed except that the rule matching is performed on the transmission packet at the time of packet transmission, and the processing thread that receives the request performs the packet transmission process. Therefore, description of the processing sequence at the time of packet transmission is omitted.

  In this embodiment, a dispatch rule (a matching condition and a processing processor identifier in FIG. 3) is determined in the rule table 10 in which filtering rules (a set of matching conditions and actions in FIG. 3) are described. And the flow definition field). Moreover, according to this embodiment, the rule to the rule table 10 can be set from the user side. Therefore, rules for selecting processing processors can be managed in a centralized manner, and flexible processor selection can be performed based on a user policy. Furthermore, since the filtering process for the packet and the selection of the processing processor that performs the second process for the packet are executed as one process, the processing time for the packet can be reduced.

(Embodiment 2)
A packet processing apparatus according to the second embodiment will be described with reference to the drawings. FIG. 5 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment. Referring to FIG. 5, the packet processing apparatus according to the present embodiment includes a rule table 11, a rule setting unit 21, a rule extraction unit 31, a rule application unit 41, a processing thread 50, a transmission reception unit 61, and a reception reception unit 71. I have.

  The rule table 11 includes a route rule for determining a transfer destination from a destination address of a transmission / reception packet and a dispatch rule for determining a processing processor from a destination address of a transmission packet or a transmission source address of a reception packet as one table. Hold.

  FIG. 6 is a diagram illustrating the rule table 11 as an example. Referring to FIG. 6, the rule table 11 holds a network address (address and netmask), a transfer destination gateway, an output interface, and a processing processor identifier in association with each other. Here, the correspondence relationship between the network address, the transfer destination gateway, and the output interface is used in the application of the route rule. Also, the correspondence between the network address and the processor identifier is used in the application of dispatch rules. The dispatch rule is interpreted as a rule for the destination address in the transmission packet and as a rule for the transmission source address in the reception packet.

  The rule setting unit 21 sets rules such as addition, change, and deletion of route rules and dispatch rules in the rule table 11. The rule setting unit 21 operates as a user application, for example, and sets a route rule by performing message communication between the user and the kernel.

  The rule extraction unit 31 collates the address stored in the packet with the network address in the rule table 11 and searches for a matching rule. The rule extraction unit 31 may include a route cache (not shown) that holds a part of recently searched search results and can be searched at high speed.

  The rule application unit 41 includes a basic application unit 411 and a dispatch unit 402. When the rule application unit 41 receives the route rule and the transmission / reception packet, the basic application unit 411 performs processing according to the route rule as the first processing. Specifically, the transmission packet is set to be transmitted from the output destination interface in the route rule to the gateway. When it is determined from the routing rule that the received packet is a packet addressed to another host, the basic application unit 411 performs a transfer process of the received packet. Since the operation of the dispatch unit 402 is the same as that of the first embodiment, detailed description thereof is omitted.

  Also, the operation of the processing thread 50 is the same as that in the first embodiment, and thus detailed description thereof is omitted.

  The transmission reception unit 61 receives a transmission packet from the user application or the kernel, searches the rule extraction unit 31 for a rule corresponding to the destination address of the transmission packet, and determines the rule and the transmission packet obtained as a search result as a rule application unit Pass to 41.

  The reception accepting unit 71 receives a received packet from the network, and the rule extracting unit 31 searches the routing rule from the destination address of the received packet and the dispatch rule from the transmission source address. The received packet is passed to the rule application unit 41. When the rule extraction unit 31 includes a route cache, the search for the dispatch rule may be performed using the route cache.

  Next, the operation of the packet processing apparatus according to the present embodiment will be described with reference to the drawings. FIG. 7 is a flowchart showing an example of transmission processing by the packet processing apparatus according to the present embodiment.

  Referring to FIG. 7, when a packet arrives from within the application or the kernel, the transmission packet is delivered to the transmission reception unit 61. Upon receiving the transmission packet, the transmission accepting unit 61 uses the rule extraction unit 31 to search the rule table 11 for a rule that matches the destination address of the transmission packet (step S11). When the rule extraction unit 31 includes a route cache, subsequent searches can be speeded up by holding the search results in the route cache. The transmission reception unit 61 passes the rule search result to the rule application unit 41 together with the transmission packet.

  Next, when the rule application unit 41 receives the retrieved rule and the transmission packet, the basic application unit 411 sets an output interface for the transmission packet as a first process based on the rule (step S12). ). If there is no corresponding route rule, the basic application unit 411 discards the transmission packet and completes the transmission process.

  On the other hand, the dispatch unit 402 selects a processing processor according to the processing processor identifier of the rule (Yes in step S13, S14). When the processing processor identifier is not specified in the dispatch rule (No in step S13), the dispatch unit 402 is the processor that is currently executing the processing (that is, the processor that is executing the processing of the dispatch unit 402 itself) ) Is selected as a processing processor (step S15).

  Then, the dispatch unit 402 requests processing by queuing the transmission processing of the upper protocol of the transmission packet in the processing queue of the processing thread 50 corresponding to the determined processing processor (step S16). The transmission processing unit 502 of the processing thread 50 that has received the request executes a packet transmission process (a lower layer transmission process for the packet) as a second process for the packet.

  FIG. 8 is a flowchart illustrating an example of reception processing by the packet processing device according to the present embodiment when the rule extraction unit 31 does not include a path cache. When the received packet arrives from the network, the reception accepting unit 71 searches the rule table 11 for a rule that matches the destination address of the received packet by the rule extracting unit 31 (step S21).

  If it is determined from the search result that the packet is not addressed to the packet processing device itself (No in step S22), the basic application unit 411 of the rule application unit 41 transfers the received packet and ends the process (step S23). ). On the other hand, when it is determined that the packet is addressed to the packet processing apparatus itself (Yes in step S22), the reception receiving unit 71 uses the rule extraction unit 31 to set a dispatch rule corresponding to the transmission source address of the received packet as a rule. Search from the table 11 (step S24).

  The dispatch unit 402 selects a processing processor according to the processing processor identifier of the rule (Yes in step S25, S26). On the other hand, when the processing processor identifier is not specified in the rule (No in step S25), the processor that is currently executing the processing (that is, the processor that is executing the processing of the dispatch unit 402) is selected as the processing processor. (Step S27).

  Then, the dispatch unit 402 requests processing by queuing the reception processing of the upper protocol of the received packet in the processing queue of the processing thread 50 corresponding to the selected processing processor (step S28). The reception processing unit 501 of the processing thread 50 that has received the request executes a packet reception process as a second process for the packet.

  FIG. 9 is a flowchart illustrating an example of reception processing by the packet processing device according to the present embodiment when the rule extraction unit 31 includes a route cache. In FIG. 9, steps S21 to S23 and steps S25 to S28 are the same as when the rule extraction unit 31 does not include a path cache (FIG. 8), and thus detailed description thereof is omitted. FIG. 9 differs from FIG. 8 in that step S29 and step S30 are included instead of step S24 in FIG.

  If the rule extraction unit 31 includes a route cache, the reception receiving unit 71 searches for a dispatch rule using the route cache (step S29).

  If no rule that matches the route cache is held (No in step S30), it is assumed that the processor identifier is not specified, and processing is performed. As described above, when a rule is held in a route cache that can be searched at high speed (Yes in step S30), the time required for the search can be reduced by using the dispatch rule (steps S25 to S27). Can do.

  The route cache is updated by route search in the transmission process (step S11 in FIG. 7). Therefore, if it is a received packet from an address that is periodically transmitted, a rule that matches the route cache is retained (Yes in step S30 in FIG. 9), and therefore the processor is selected based on the dispatch rule (FIG. 9). 9 steps S25 to S27) are possible.

  In the present embodiment, as shown in FIG. 6, a dispatch rule for determining a processing processor is set in the rule table 11. The filtering process in the first embodiment is not always required in packet processing. On the other hand, route search processing is indispensable for packet processing. Therefore, the packet processing apparatus according to the present embodiment can also be applied to packet forwarding when filtering processing is not performed, and performs flexible processor selection by setting rules in the rule table 11 from the user side. It is possible. In the transmission processing by the packet processing apparatus according to the present embodiment, the processing for setting the output interface for the transmission packet and the processing for selecting the processor that performs the second processing for the transmission packet are performed as one processing. As a result, the processing time for the transmission packet can be reduced.

(Embodiment 3)
A packet processing apparatus according to a third embodiment will be described with reference to the drawings. FIG. 10 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment. Referring to FIG. 10, the packet processing device according to the present embodiment includes a rule table 12, a user application 22, a rule extraction unit 32, a rule application unit 42, a processing thread 52, a transmission reception unit 62, and a reception reception unit 72. I have.

  The rule table 12 holds the correspondence between addresses, port numbers, and sockets. Here, the socket holds control data related to transport layer connection information represented by TCP, UDP, and the like, and a processor identifier associated with the control data.

  FIG. 11 is a diagram illustrating an example of the rule table 12 in the packet processing apparatus according to the present embodiment. Referring to FIG. 11, the rule table 12 includes a processing processor identifier as a socket, in addition to control data necessary for protocol processing.

  The user application 22 has a file descriptor for specifying a socket, and can set a processing processor identifier of the socket by using a system call (for example, setsockopt) using the file descriptor. Further, the user application 22 can send and receive data using a specific socket (connection) by specifying a file descriptor and using read and write system calls.

  The rule extraction unit 32 specifies a socket representing control information of the transport layer from a set of four of the transmission source address and port number and the transmission destination address and port number stored in the packet.

  The rule application unit 42 includes a basic application unit 421 and a dispatch unit 422. When the rule application unit 42 receives the transmission packet or the reception packet and the socket from the transmission reception unit 62 or the reception reception unit 72, the basic application unit 421 holds the transmission packet or the reception packet in the socket as the first processing. Use the transport layer control information to configure transmission or reception. In addition, the dispatch unit 422 selects a processor according to the processor identifier held in the socket, and performs the transmission process or the reception process of the transmission packet or the reception packet as the second process in the corresponding processing thread 52. Ask.

  The processing thread 52 is a kernel thread prepared for each processor, like the processing thread 50 in the first embodiment. However, this embodiment is different from the first embodiment in that the reception processing unit 521 performs layer 4 reception processing on the received packet, and the transmission processing unit 522 performs layer 4 or lower transmission processing on the transmission packet. . The reception processing unit 521 finally delivers the received packet to the user application 22.

  The transmission receiving unit 62 receives a file descriptor and a transmission packet from the user application 22. When receiving the file descriptor and the transmission packet, the transmission reception unit 62 specifies the socket indicated by the file descriptor and passes it to the rule application unit 42.

  The reception receiving unit 72 receives a received packet from the network, and searches the rule table 12 with the address and port number. Also, the reception accepting unit 72 passes the search result socket and the received packet to the rule applying unit 42.

  Next, transmission / reception processing by the packet processing apparatus according to the present embodiment will be described.

  The operation of the transmission process is as follows. First, the user application 22 calls a send system call using a file descriptor for identifying a socket and a transmission packet as arguments. When the file descriptor and the transmission packet are received by the send system call, the transmission reception unit 62 specifies the socket from the file descriptor. Next, as a first process, the basic application unit 421 of the rule application unit 42 sets transmission for the transmission packet using the control information of the transport layer held in the specified socket. Further, the dispatch unit 422 selects the corresponding processing thread 52 from the processor identifier held in the socket, and requests transmission processing of the transmission packet as the second processing.

  On the other hand, the operation of the reception process is as follows. When a received packet arrives from the network, the reception accepting unit 72 specifies a corresponding socket from the rule table 12 based on the address and port number of the received packet. Next, the basic application unit 421 of the rule application unit 42 sets the reception process of the received packet using the control information of the transport layer held in the specified socket as the first process. In addition, the dispatch unit 422 selects the corresponding processing thread 52 from the processor identifier held in the socket, and requests the reception processing of the reception packet as the second processing.

  According to the packet processing device according to the present embodiment, the socket holds the control data related to the transport layer connection information and the processing processor in association with each other, thereby setting the transmission or reception for the transmission or reception packet, and the transmission or reception. Since the selection of the processor that performs the second process on the received packet is executed as one process, the processing time for the transmitted or received packet can be reduced. Further, by using an existing system call such as setsockopt, the user application 22 can easily set a processor for performing the second process, and flexible processor selection can be performed.

(Embodiment 4)
A packet processing apparatus according to a fourth embodiment of the present invention will be described with reference to the drawings. FIG. 12 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment. Referring to FIG. 12, the packet processing apparatus according to this embodiment includes a rule table 13, a rule extraction unit 33, a rule application unit 40, a processing thread 50, a transmission reception unit 60, and a reception reception unit 70. Among the components of the present embodiment shown in FIG. 12, the operations of those denoted by the same reference numerals as those in FIG. 2 are the same as the operations of the components in the first embodiment, and thus the description thereof is omitted.

  Rules are set in the rule table 13 by a rule setting device 23 provided outside the packet processing device. As an example, the open flow (OpenFlow) technique described in Non-Patent Document 1 can be adopted for the rule table 13 and the rule setting device 23.

  OpenFlow captures communication as an end-to-end flow and performs path control, failure recovery, load balancing, and optimization on a per-flow basis. The OpenFlow Switch (OFS: OpenFlow Switch) functioning as a forwarding node has a secure channel for communication with an OpenFlow Controller (OFC: OpenFlow Controller) positioned in the control server, and an appropriate addition or rewrite instruction is given from the OpenFlow Controller. It operates according to the flow table.

  The packet processing device, the rule setting device 23, the rule table 13, and the rule stored in the rule table 13 in the present embodiment are the OpenFlow switch, OpenFlow controller, Flow table, and Flow table in OpenFlow, respectively. Corresponds to an entry.

  FIG. 13 is a diagram illustrating an example of an OpenFlow flow table entry. Referring to FIG. 13, for each flow, a set of a collation condition to collate with a packet header, an action (actions) that defines processing contents, and flow statistical information (stats) is defined for each flow.

  FIG. 14 is a table showing an example of action names and action contents defined in Non-Patent Document 2. OUTPUT is an action to be output to a designated port (interface). SET_VLAN_VID to SET_TP_DST are actions for modifying the field of the packet header.

  When the OpenFlow switch receives the packet, the OpenFlow switch searches the flow table (FIG. 13) for an entry having a matching condition (FlowKey) that matches the header information of the received packet. When an entry that matches the received packet is found as a result of the search, the OpenFlow switch performs the processing content described in the action field of the entry on the received packet. On the other hand, if no entry matching the received packet is found as a result of the search, the OpenFlow switch forwards the received packet to the OpenFlow controller via the secure channel, and sends it to the source / destination of the received packet. Requests the determination of the route of the packet based on it, receives a flow entry that realizes this, and updates the flow table. In this way, the OpenFlow switch transfers a packet using the entry stored in the flow table as a processing rule.

  The rule table 13 (FIG. 12) of this embodiment has a collation condition field and an action (actions) field, as shown in FIG. In the collation condition field, collation conditions are stored as in the rule table 10 (FIG. 3) in the first embodiment. Further, the action field stores an action and a processor identifier as in the rule table 10 (FIG. 3) in the first embodiment.

  The rule extraction unit 33 refers to the rule table 13 and inquires the rule setting device 23 corresponding to the OpenFlow controller when there is no rule matching the processing target packet in the rule table 13. When receiving an inquiry from the rule extraction unit 13, the rule setting device 23 sets a rule associated with an action and a processor identifier as a rule in the rule table 10.

  As in this embodiment, by using a packet processing device having a plurality of processors as an OpenFlow OpenFlow switch, each OpenFlow switch can flexibly and flexibly select a processor that executes packet processing from among a plurality of processors. Can be selected at high speed.

  Within the scope of the entire disclosure (including claims) of the present invention, the embodiment can be changed and adjusted based on the basic technical concept. Various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. . That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the entire disclosure including the claims and the technical idea.

10 to 13, 110 Rule table 20, 21 Rule setting unit 22 User application 23 Rule setting device 30 to 33, 130 Rule extraction unit 40, 41, 42, 140 Rule application unit 401, 411, 421 Basic application unit 402, 422 Dispatch Units 50 and 52 Processing threads 501 and 521 Reception processing units 502 and 522 Transmission processing units 60 to 62 Transmission reception units 70 to 72 Reception reception units

Claims (20)

A rule table holding rules for associating information stored in a packet, an action indicating a first process for the packet, and a processor identifier for identifying a processor performing the second process for the packet;
A rule extraction unit that extracts a rule corresponding to information stored in a target packet, which is a packet to be processed, from the rule table;
A rule applying unit that executes the first process according to the action on the target packet based on the extracted rule and requests the second process to the processor corresponding to the processor identifier; A packet processing apparatus comprising: The first process is a process for determining whether or not to discard the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. The packet processing device according to claim 1, wherein in some cases, the processing is a lower layer process for the target packet.   The rule applying unit requests the processor to perform the second process on the target packet when the target packet is not a packet to be discarded in the first process. The packet processing apparatus as described. The rule table includes information stored in a packet, an action indicating a first process for the packet, a processor identifier for identifying a processor performing a second process for the packet, and a field defining a flow including the packet Maintains a rule that associates flow definition fields that indicate
When a plurality of processor identifiers are included in the extracted rule, the rule application unit refers to the flow definition field, and selects one of a plurality of processors corresponding to the plurality of processor identifiers. The packet processing apparatus according to claim 2, wherein the second processing is requested for all target packets included in the same flow.   When the rule table does not hold a rule corresponding to the information stored in the target packet, the rule extraction unit sets a rule that matches the information in a rule setting device capable of setting the rule. The packet processing device according to claim 2, wherein the packet processing device is requested as follows. The first process is a process of determining a destination of the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. The packet processing device according to claim 1, wherein in some cases, the processing is a lower layer process for the target packet.   When the target packet is a packet to be received by the packet processing device and the destination of the target packet is the packet processing device, the rule application unit performs the second processing on the target packet. The packet processing apparatus according to claim 6, wherein the packet processing apparatus requests the processor. The rule extraction unit has a cache that temporarily holds the extracted rules, and extracts rules that match the information stored in the target packet from the cache,
The rule application unit, when the target packet is a packet to be received by the packet processing device, and when a rule that matches the target packet is extracted from the cache by the rule extraction unit, the rule application unit The packet processing device according to claim 6, wherein the packet processing device requests the processor to perform a second process. The first process is a process of specifying control information in a transport layer when transmitting / receiving the target packet;
When the target packet is a packet to be received by the packet processing device, the second process is a layer 4 reception process for the target packet using the specified control information. The packet processing device according to claim 1, wherein when the packet is to be transmitted by the packet processing device, the packet processing device is a layer 4 or lower transmission processing for the target packet using the specified control information. . The rule table holds a plurality of rules sorted according to priority,
The rule extraction unit, when a plurality of rules that match the information stored in the target packet is stored in the rule table, to extract a rule having a high priority among the plurality of rules. The packet processing device according to claim 1, wherein the packet processing device is characterized by:   The rule of the rule table includes at least one of a source address, a destination address, a source port number, and a destination port number as information stored in a packet. 2. The packet processing device according to 1.   The packet processing device according to claim 1, further comprising a rule setting unit that adds, changes, or deletes rules with respect to the rule table. A rule in which one of a plurality of processors associates information stored in a packet, an action indicating a first process for the packet, and a processor identifier for identifying a processor performing the second process for the packet Extracting a rule corresponding to information stored in a target packet, which is a packet to be processed, from a rule table holding
Based on the extracted rule, the one processor executes the first process according to the action for the target packet and requests the processor corresponding to the processor identifier for the second process. And a packet processing method. The first process is a process for determining whether or not to discard the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. 14. The packet processing method according to claim 13, wherein the packet processing is a lower layer process for the target packet in some cases. The first process is a process of determining a destination of the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. 14. The packet processing method according to claim 13, wherein the packet processing is a lower layer process for the target packet in some cases. The first process is a process of specifying control information in a transport layer when transmitting / receiving the target packet;
When the target packet is a packet to be received by the packet processing device, the second process is a layer 4 reception process for the target packet using the specified control information. 14. The packet processing method according to claim 13, wherein when the packet is to be transmitted by the packet processing device, the packet processing method is a layer 4 or lower transmission process for the target packet using the specified control information. . A packet to be processed from a rule table that holds information stored in the packet, an action indicating the first process for the packet, and a rule that associates a processor identifier for identifying the processor that performs the second process for the packet. A process for extracting a rule corresponding to information stored in the target packet,
Based on the extracted rule, a process of executing the first process according to the action on the target packet and requesting the second process to the processor corresponding to the processor identifier is a plurality of processes. A program that is executed by one of the processors. The first process is a process for determining whether or not to discard the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. The program according to claim 17, wherein in some cases, the processing is a lower layer process for the target packet. The first process is a process of determining a destination of the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. The program according to claim 17, wherein in some cases, the processing is a lower layer process for the target packet. The first process is a process of specifying control information in a transport layer when transmitting / receiving the target packet;
When the target packet is a packet to be received by the packet processing device, the second process is a layer 4 reception process for the target packet using the specified control information. 18. The program according to claim 17, wherein if the packet is to be transmitted by the packet processing device, the program is a transmission process of layer 4 or lower for the target packet using the specified control information.

Images