Optimizing header-based action selection

Abstract

A network element includes one or more ports and a packet processor. The one or more ports are to transmit and receive packets over a network. The packet processor is to apply a plurality of rules to the packets, each rule specifying (i) expected values for each header field of a group of header fields of the packets, including, for a given header field in the group, at least a set of multiple expected values, (ii) a group ID associated with the set, and (iii) an action to be applied to the packets whose header fields match the expected values.

Description

FIELD OF THE INVENTION

The present invention relates generally to communication networks, and particularly to efficient determination of communication packet actions based on the packet header.

BACKGROUND OF THE INVENTION

In communication networks, actions may be applied to communication packets according to the contents of one or more header fields of the packets.

In “Hierarchical trie packet classification algorithm based on expectation-maximization clustering”, by Bi and Zhao (Jul. 13, 2017; doi.org/10.1371/journal.pone. 0181049), the authors assert that packet classification algorithms which are able to deal with large-scale rule sets are in urgent need, and explain that packet classification algorithms based on a hierarchical trie have become important because of their widely practical use, despite the shortcomings of the hierarchical trie such as the existence of backtracking and empty nodes. The authors next propose a new packet classification algorithm based on Expectation-Maximization Clustering (HTEMC) that not only adopts trie path compression to eliminate backtracking, but also is said to solve the problem of low efficiency of trie updates, which greatly improves the performance of the algorithm.

In “Scalable Packet Classification”, by Barboescu and Varghese (IEEE/ACM Transactions on Networking, vol. 13, no. 1, February 2005), the authors assert that packet classification reported in the literature scales poorly in either time or space as filter databases grow in size, while hardware solutions such as TCAMs do not scale to large classifiers. The paper seeks to exploit this observation to produce a scalable packet classification scheme called Aggregated Bit Vector (ABV), which takes the bit vector search algorithm (BV) (which takes linear time) and adds two new ideas—recursive aggregation of bit maps and filter rearrangement—to an ABV that can take logarithmic time for many databases.

Lastly, techniques to increase the efficiency of TCAMs in packet classification are described, for example, in “Algorithms for Advanced Packet Classification with Ternary CAMs,” by Lakshminarayanan et al. (ACM SIGCOMM 2005).

SUMMARY OF THE INVENTION

An embodiment of the present invention that is described herein provides a network element including one or more ports and a packet processor. The one or more ports are to transmit and receive packets over a network. The packet processor is to apply a plurality of rules to the packets, each rule specifying (i) expected values for each header field of a group of header fields of the packets, including, for a given header field in the group, at least a set of multiple expected values, (ii) a group ID associated with the set, and (iii) an action to be applied to the packets whose header fields match the expected values.

In some embodiments, the expected values of the header fields include a “do-not-care” indication. In some embodiments, the expected values for the given header field include a “do-not-care” indication.

In an embodiment, the packet processor includes a Ternary Content-Addressable Memory (TCAM) to store the rules, including the group ID. In another embodiment, the packet processor comprises a Random-Access Memory (RAM) and ancillary logic to store the rules, including the group ID. In a disclosed embodiment, the given header field specifies a destination port. In an example embodiment, the given header field specifies a source port.

There is additionally provided, in accordance with an embodiment of the present invention, a method including transmitting and receiving packets over a network by a network element. A plurality of rules is applied to the packets in the network element, each rule specifying (i) expected values for each header field of a group of header fields of the packets, including, for a given header field in the group, at least a set of multiple expected values, (ii) a group ID associated with the set, and (iii) an action to be applied to the packets whose header fields match the expected values.

The present invention will be more fully understood from the following detailed description of the embodiments thereof, taken together with the drawings in which:

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram that schematically illustrates a network element, in accordance with an embodiment of the present invention;

FIG. 2 is a table that schematically illustrates a ruleset, in accordance with an embodiment of the present invention;

FIG. 3 is a table that schematically illustrates the operation of a group-ID circuit, in accordance with an embodiment of the present invention;

FIG. 4 is a table that schematically illustrates a shorter representation of the ruleset illustrated in FIG. 2, in accordance with an embodiment of the present invention;

FIG. 5A is a table that schematically illustrates an example sequence of ingress packets, in accordance with an embodiment of the present invention;

FIG. 5B is a table that schematically illustrates the ingress packets with an added group-ID column and with a selected action, in accordance with an embodiment of the present invention;

FIG. 6 is a block diagram that schematically illustrates the structure of an Action Select Circuit (ASC), in accordance with an embodiment of the present invention; and

FIG. 7 is a flowchart that schematically illustrates a method for efficient action selection in a packet processor, in accordance with an embodiment of the present invention.

DETAILED DESCRIPTION OF EMBODIMENTS

Overview

Network elements, such as network switches and routers, receive packets from ingress ports and forward the packets to egress ports, according to forwarding, routing and security rules. The network element typically comprises ingress and egress ports that communicate packets over a communication network (e.g., Ethernet or InfiniBand™), and a packet processor, which processes and routes the packets according to a set of rules that are typically based on values in certain fields of the packet headers. (In a TCP/IP packet, for example, the header fields include the source address, L4 source port, protocol, destination address and L4 destination port. These header fields are collectively known as an L4 5-tuple.)

The set of rules, (which is sometimes called an Action Table or a Match-Action-Table) comprises a plurality of actions, and, for each action, the corresponding values of the header fields of the packet upon which the action should be applied. Typically, the values of the packet header fields specified for each rule comprise “don't care” fields; for example, if a given action should be applied to all packets having a given ingress port value, irrespectively of the values of the other header fields, the corresponding rule will comprise the given ingress port value of the ingress port header field, and “don't care” for all other header fields.

In practice, there may be multiple rules that specify the same action and differ by the value of a single header field. For example, in some cases, the same action should be taken for packets that have a given set of values in four of the header fields if the value of the fifth header field is one of a group of 50 preset values. In this case, the number of required rules will be 50. In some cases, there may be two or more groups of preset values of the same header field that point to the same action; and, in other cases, a second given set of values in the four header fields, combined with the same (or with a different) group of values of the fifth header field, will point to the same action.

The scenario described above may result in a huge number of rules, which may slow the packet processing and/or require a large amount of circuitry, including a large amount of memory. When the rule matching is done using a Ternary Content-Addressable Memory (TCAM), the TCAM size may be very large and/or not all rules may fit in the TCAM. (TCAM has the advantage of concurrently searching for all rules, and the disadvantage of large area and high power-consumption.)

Embodiments of the present invention that are disclosed herein provide an apparatus and methods that efficiently locate a rule based on the values of the packet header fields. In an embodiment, the values of one or more of the header fields are first sorted into groups, wherein each of the group is assigned a unique ID; and a new field, which specifies expected values of the group ID, is added to the headers. In some embodiments, when a TCAM is used for rule matching, the TCAM uses an additional search field in which the value of the group ID is specified. Thus, in the present embodiments, the number of rules may be substantially reduced, decreasing the size and/or increasing the speed of the rule matching.

System Description

FIG. 1 is a block diagram that schematically illustrates a network element 100, in accordance with an embodiment of the present invention. Network element 100 may be a switch, such as a bridge or router, for example, or a network interface controller (NIC). The network element comprises a packet processor 102, which exchanges packets with a network through ports 104 (which typically serve as both ingress and egress ports). Ports 104 typically comprise physical layer (PHY) and media access control (MAC) interface circuits, as are known in the art. Packet processor 102 comprises digital logic and memory circuits, as will be described below in greater detail. Other components of network element 100 are omitted for the sake of simplicity.

Packet processor 102 receives ingress packets from the network through ports 104; the packets typically comprise a packet header and a packet body. The packet header comprises header fields, for example including a source address, a source L4 port, a protocol, a destination address, and a destination L4 port. Packet processor 102 extracts the packet headers from each packet and stores the headers in header registers 105. According to the example embodiment illustrated in FIG. 1, one of the header fields is a grouped header, which is stored in a grouped-header register 106. A grouped header is a packet header fields for which groups of values are defined; for example, the grouped header may be the L4 destination port header, wherein a first (ID=1) group of values {50,72,1947}, a second (ID=2) group of values {80,443,8020} and a third (ID=3) group of values {1,11,19,99} are defined.

Packet processor 102 further comprises a group-ID circuit 108, which compares the value of the grouped header with the defined groups of values, and outputs the preset ID of the group for which the value matches. For example, with the three example groups defined above, the group-ID table will indicate ID=2 for a grouped-header value of 443, and ID=3 for a grouped-header-value of 99. In some embodiments some of the groups may overlap, and, hence, more than one ID may be indicated for the same grouped header.

Packet processor 102 further comprises an Action Select Circuit (ASC) 110, which selects an action to be applied to the packet according to search inputs of the ASC. In an embodiment, ASC 110 comprises a TCAM. Alternatively or additionally, ASC 110 may comprise other types of memory together with suitable logic circuits. The outputs of header registers 105 and of group-ID circuit 108 are coupled to the search inputs of ASC 110, which store a set of rules. Each rule comprises expected values (including “don't-care” fields and individual “don't-care” bits within fields) for the headers and for the group IDs, and a specified action to be applied to packets whose headers match the expected values.

Some rules may specify the same action but have different header field values that belong to the same group. According to the embodiment illustrated in FIG. 1, such rules may be consolidated into a single rule, with the corresponding group ID. Thus, the size of the rule table may shrink considerably.

Packet processor 102 may comprise additional components, most notably one or more processors; for the sake of simplicity, however, such components are not shown in FIG. 1.

The structure of network element 100 and packet processor 102 illustrated in FIG. 1 and described hereinabove are examples that are cited for the sake of conceptual clarity. Other structures may be used in alternative embodiments. For example, in some embodiments, the grouped header is also registered in one of header registers 105. In another embodiment, more than one grouped header fields may be used, and, in some embodiments, grouped-header register 106 may comprise groups of values of an aggregation of two or more headers.

Reference is now made to FIGS. 2 through 5B, which illustrate an example of a ruleset with grouping of one of the header fields, in accordance with an embodiment of the invention. The example shows the updated ruleset that is obtained when header grouping is applied and the application of the updated ruleset to a sequence of ingress packets. In the present example, the grouped header field is the destination L4 port. Other header fields may be grouped in alternative embodiments, including, for example, the source L4 port header field or any other suitable header field.

FIG. 2 is a table that schematically illustrates a ruleset 200, in accordance with an embodiment of the present invention. No grouped header field is used, and the table defines an action 202 by comparing a source IP header field with source-IP rules 204, a source L4 port header field with source-port rules 206, a protocol header field with protocol rules 208, a destination IP header field with destination-IP rules 210, and a destination L4 port header field with destination port rules 212. Each rule is represented by a row in table 200, including, for each header field, an expected value for the corresponding rule and a corresponding action 202. Although the actions in the example embodiment illustrated in FIG. 2 can be either “Allow” or “Deny”, other types of actions may be used in alternative embodiments. Furthermore, although table 200 is short for the sake of simplicity of illustrations, in practical embodiments the size of the rule table is much larger.

The rules in table 200 are designated R1 through R7. As can be observed, rules R1, R2 and R3 differ only in the destination L4 port value, which can be any member of the group {80,443,8080}. Likewise, rules R4 and R5 share the same values of all header fields except the destination L4 port, which may be any member of the group {20,21}.

FIG. 3 is a table that schematically illustrates the operation of group-ID circuit 108 (FIG. 1), in accordance with an embodiment of the present invention. The group-ID circuit comprises a destination-port table 302, which comprises possible values of the destination-port header, and a grouped-header-ID table 304, which indicates a group-ID for each of the values in destination-port table 302. In the example embodiment illustrated in FIG. 3, group-ID circuit 108 allocates the group ID=binary 10 to destination-port values in the group {80,443,8080}, and the group ID=binary 01 to destination-port values in the group {20,21}. The group-ID circuit is further configured to assign a group ID=binary 00 to all other destination-port values.

FIG. 4 is a table that schematically illustrates a ruleset 400, which is a shortened representation of ruleset 200 (FIG. 2), in accordance with an embodiment of the present invention. Ruleset 400 selects an action from an action set 402 by comparing headers of the packets to source-IP rules 404, source-port rules 406, protocol rules 408, destination-IP rules 410, destination-port rules 412, and grouped-header rules 414, which are invoked by group-ID circuit 108 (FIGS. 1 and 3), responsively to the value in the destination-port header field.

According to the example embodiment illustrated in FIG. 4, each of rules 314 comprises a two-bit group ID, designated PG1 and PG2. Group-ID circuit 108 (FIG. 3) sets PG1=1 and PG0=0 if the destination-port header field value of the packet is one of {80, 443, 808), sets PG1=0 and PG0=1 if this value is one of {20, 31}, and sets PG1=PG0=0 if the destination-port header field value is not in either of the two groups. Thus, the seven rules in table 200 (FIG. 2) can be reduced to four rules in table 400—Rules 1,2,3 of table 200 merge to a rule RA 416 of table 400, and rules R4, R5 merge to a rule RB 418.

It should be noted that the group-IDs in the example embodiment illustrated in FIGS. 3 and 4 are orthogonal (that is—only one of bits PG1, PG0 may be set to logical 1). This allows group overlap when the same grouped header is part of more than one group; however, if many groups are defined, the group-ID field will be large. In alternative embodiments, the group-ID is not orthogonal, and hence may be shorter (e.g., 4 bits for 16 groups, versus 16 bits for orthogonal representation), at the cost of a more complex group-ID circuit, and with the restriction that groups should not overlap.

We will now show how an example sequence of ingress packets is handled by packet processor 102, assuming ASC 110 and Group-ID circuit 108 are configured to the example values illustrated in FIGS. 2, 3 and 4.

FIG. 5A is a table 500 that schematically illustrates an example sequence of ingress packets 512, in accordance with an embodiment of the present invention. The table comprises a source-IP column 502, a source-port column 504, a protocol column 506, a destination-IP column 508 and a destination-port column 510, which specify the values of the corresponding header fields, for packets 512 (designated P1 through P4).

FIG. 5B is a table 550 that schematically illustrates ingress packets 512 with an added group-ID column 552 and with selection actions 554, in accordance with an embodiment of the present invention. Column 552 lists the grouped header IDs that grouped-ID circuit 108 generates for each of the packets (see FIG. 3). Action column 554 lists the selected action for each of the packets, according to the ruleset illustrated in FIG. 2.

FIG. 6 is a block diagram that schematically illustrates the internal structure of ASC 110, in accordance with an embodiment of the present invention. In some embodiments, ASC 110 may comprise a TCAM; in other embodiments, other implementation techniques may be used, including RAM-based implementation, and implementations that include combinations of RAM and TCAM.

ASC 110 receives the contents of the packet headers (e.g., from packet-header registers 105, FIG. 1) and one or more group IDs (e.g., from group-ID circuit 108). The ASC comprises a plurality of rule-rows 612, which compare the headers and the group IDs with prestored expected values, and trigger a corresponding action upon detecting a match.

Each rule-row 612 comprises a plurality of compare circuits 614, to compare the headers and the group-ID inputs to prestored values. The prestored values may include “don't care” fields. If all compare circuits 614 of a rule-row 612 match, a match is indicated on a match line 616. In some embodiments, wired-AND logic is used by compare circuits 614, wherein any compare circuit for which there is no match between the corresponding header (or group-ID value) and the prestored compare-value, pulls the match line low. The match line will be high only all the compare units detect a match. If the match line indicates a match, the rule-row will output the value stored in an action register 618.

In some cases, more than one action may be output when multiple rule-rows 612 indicate a match. In some embodiments ASC 110 outputs only the highest-priority action from all output actions. In an embodiment, the priority of the actions is set according to the physical location of the rule-rows within the integrated circuit.

The structure of ASC 110 described above is cited by way of example. Action-select circuits in accordance with the disclosed techniques are not limited to the implementation described hereinabove. In alternative embodiments, for example, the Action-Select circuit comprises a TCAM which stores the most-frequently used rules, and, when a packet does not fit any of the rules in the TCAM, the action-select circuit searches for an action in a RAM (which typically comprises a larger number of entries). In some embodiments the ASC comprises a random-access memory (RAM) such as a static random-access memory (SRAM), a dynamic random-access memory (DRAM); in yet other embodiments the ASC comprises a combination of one or more SRAMs, DRAMs and/or TCAMs.

FIG. 7 is a flowchart 700 that schematically illustrates a method for efficient action selection in a packet processor, in accordance with an embodiment of the present invention. The flowchart is executed by ASC 110 (FIG. 1).

We assume that ASC 110 comprises a rule-num variable, which points to the rule being processed, and a header-num variable, which points to the header field being compared. We will use the notation rule-num{header-num} to indicate the value of the header-num^th header field corresponding to the rule-num^th rule.

The flowchart starts at an Initialize step 702, wherein the ASC sets the rule-num and the header-num variables to an initial value of 1 (to point to a first header of a first rule). Next, the ASC, in a Compare-Header step 704, compares the expected and the actual values of rule-num{header-num}. If the values match, the ASC proceeds to a Check-Grouped-Header step 706. If the header is a grouped header, the ASC next, in a Find Group-ID step 708, finds a group ID for the grouped-header (e.g., by activating Group-ID Circuit 108, FIG. 1), and then enters a Compare-Group-ID step 710.

In step 710, the ASC compares the group ID that corresponds to rule-num{header-num} to its expected value. If the values match, the comparison associated with the current rule-num{header-num} is successfully completed. This is also the case if the header was not a grouped header, as determined in step 706 (the No output). In both cases, the ASC will enter a check-last-header step 712, and check whether the current header-num points to the last header (e.g., for a 5-tuple, if header-num equals 5). If header-num does not point to the last header, the ASC will, in an Increment Header-num step 714, increment header-num, and then reenter step 704 to process the next header of the current rule.

If, in step 712, header-num is the last header, all comparisons for the current rule (rule-num) have been successfully completed (e.g., match line 616, FIG. 6. indicates a match). The ASC then enters a Set-Action step 716, and selects the action corresponding to rule-num. The flowchart will then end. (We assume that the action priority corresponds to the rule number; hence, if a match is found for rule-num=n, it is not necessary to look for matches at higher rule-num values.)

If, in step 704, one of the headers does not match, or if, in step 710, the group-ID does not match, the checking of the current rule-num may end. The ASC enters a Check-Last-Rule step 718. If the rule is not the last one, the ASC, in an Increment rule-num step 720, increments rule-num and sets header-num=1, and then reenters step 704, to check the next rule. If, in step 718, the current rule-num is the last rule, the flowchart ends, and no action is found.

Thus, according to the example method shown in FIG. 7, ASC 110 may choose an action to be performed by the packet processor on an ingress packet, depending on the header fields of the packet and on a group ID of a grouped header of the packet.

Flowchart 700 illustrated in FIG. 7 and described above is an example that is cited for the sake of conceptual clarity. Other suitable flowcharts may be used in alternative embodiments. For example, in alternative embodiments, some or all the steps of flowchart 700 may be executed concurrently. In some embodiments, more than one action may be allowed, and the flowchart is modified accordingly.

The configuration of network element 102, including ASC 110 and group-ID circuit 108, as well as the structures of tables 200, 400, 500, 550 and the method for action selection in flowchart 700, are example configurations, tables and methods that are shown purely by way of illustration. Any other suitable configurations, tables and methods can be used in alternative embodiments.

In various embodiments, the various action selection and/or group ID selection tasks described hereinabove may be carried out by hardware, by software, or by a combination of hardware and software.

In various embodiments, the different elements of packet processor 102, including action selection and group-ID selection, may be implemented using suitable hardware, such as one or more Application-Specific Integrated Circuits (ASIC) or Field-Programmable Gate Arrays (FPGA), or a combination of ASIC and FPGA.

Packet Processor 102 typically comprises a general-purpose processor, which is programmed in software to carry out at least a part of the packet processing functions. The software may be downloaded to the processor in electronic form, over a network, for example, or it may, alternatively or additionally, be provided and/or stored on non-transitory tangible media, such as magnetic, optical, or electronic memory.

It will thus be appreciated that the embodiments described above are cited by way of example, and that the present invention is not limited to what has been particularly shown and described hereinabove. Rather, the scope of the present invention includes both combinations and sub-combinations of the various features described hereinabove, as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not disclosed in the prior art. Documents incorporated by reference in the present patent application are to be considered an integral part of the application except that to the extent any terms are defined in these incorporated documents in a manner that conflicts with the definitions made explicitly or implicitly in the present specification, only the definitions in the present specification should be considered.

Claims

1. A network element, comprising: one or more ports, to transmit and receive packets over a network; anda packet processor, to apply a plurality of rules to the packets, at least one of the rules specifying: expected values created as new values based on each header field of a group of header fields of the packets, including, for a given header field in the group, at least a set of multiple expected values, wherein one or more of the expected values for the set are created based on header fields comprising one or more of:a “do-not-care” indication,a group ID, andan action to be applied to the packets, when at least one given header field matches at least one of the expected values of the set.

2. The network element according to claim 1, wherein the expected values for the given header field comprise a “do-not-care” indication.

3. The network element according to claim 1, wherein the packet processor comprises a Ternary Content-Addressable Memory (TCAM) to store the rules, including the group ID.

4. The network element according to claim 1, wherein the packet processor comprises a Random-Access Memory (RAM) and ancillary logic to store the rules, including the group ID.

5. The network element according to claim 1, wherein the given header field specifies a destination port.

6. The network element according to claim 1, wherein the given header field specifies a source port.

7. A method, comprising: transmitting and receiving packets over a network by a network element; andapplying in the network element a plurality of rules to the packets, at least one of the rules specifying: expected values created as new values based on each header field of a group of header fields of the packets, including, for a given header field in the group, at least a set of multiple expected values, wherein one or more of the expected values for the set are created based on header fields comprising one or more of: a “do-not-care” indication,a group ID, andan action to be applied to the packets,when at least one given header field matches at least one of the expected values of the set.

8. The method according to claim 7, wherein the expected values for the given header field comprise a “do-not-care” indication.

9. The method according to claim 7, wherein applying the rules comprises storing the rules, including the group ID, in a Ternary Content-Addressable Memory (TCAM) in the network element.

10. The method according to claim 7, wherein applying the rules comprises storing the rules, including the group ID, in a Random-Access Memory (RAM) and ancillary logic in the network element.

11. The method according to claim 7, wherein the given header field specifies a destination port.

12. The method according to claim 7, wherein the given header field specifies a source port.