WO2019000434A1 - 一种数据处理方法、网络接口卡及服务器 - Google Patents

一种数据处理方法、网络接口卡及服务器 Download PDF

Info

Publication number
WO2019000434A1
WO2019000434A1 PCT/CN2017/091278 CN2017091278W WO2019000434A1 WO 2019000434 A1 WO2019000434 A1 WO 2019000434A1 CN 2017091278 W CN2017091278 W CN 2017091278W WO 2019000434 A1 WO2019000434 A1 WO 2019000434A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
network interface
interface card
session entry
host
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/091278
Other languages
English (en)
French (fr)
Inventor
卢胜文
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP21193675.2A priority Critical patent/EP3995955B1/en
Priority to CA3066826A priority patent/CA3066826C/en
Priority to EP17915228.5A priority patent/EP3627781B1/en
Priority to JP2019572365A priority patent/JP7034187B2/ja
Priority to CN201780076601.2A priority patent/CN110050447B/zh
Priority to PCT/CN2017/091278 priority patent/WO2019000434A1/zh
Publication of WO2019000434A1 publication Critical patent/WO2019000434A1/zh
Priority to US16/728,180 priority patent/US11223579B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/35—Switches specially adapted for specific applications
    • H04L49/355—Application aware switches, e.g. for HTTP
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/90—Buffering arrangements
    • H04L49/9063—Intermediate storage in different physical parts of a node or terminal
    • H04L49/9068—Intermediate storage in different physical parts of a node or terminal in the network interface card
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/70—Virtual switches
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0245—Filtering by information in the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/30—Peripheral units, e.g. input or output ports

Definitions

  • the present application relates to the field of computers, and in particular, to a data processing method, a network interface card (English name: network interface card, abbreviated as: network interface card) and a server.
  • a network interface card (English name: network interface card, abbreviated as: network interface card) and a server.
  • VM virtual machine
  • VS virtual switch
  • OVS open vSwitch
  • SDN software-defined network controller
  • the hardware resources on each server need to support at least running multiple VMs, virtual switches, and virtual machine monitors (English name: virtual machine monitor, abbreviation: VMM).
  • the virtual machine monitor is also called virtual machine manager (English full name: Virtual machine manager, abbreviation: VMM) or hypervisor (English full name: hypervisor).
  • the hardware resources of each server are limited. If the virtual switch that is responsible for the data exchange task occupies too much hardware resources, it will easily affect the operation of the VM on the server and reduce the work efficiency.
  • the present application discloses a data processing method, a network interface card, and a server.
  • the action domain of a session entry is generated according to the action domain of the multiple flow entry associated with the data packet, and the processing function of the data packet is offloaded to the network interface card.
  • the application provides a server, where the server includes a host and a network interface card, and the host runs a virtual machine and a virtual switch.
  • the network interface card is connected to the host through the host interface and connected to the external network through the network interface.
  • the host is configured to receive the first data packet sent by the network interface card, and obtain at least two flow entries associated with the first data packet according to the matching information carried by the first data packet.
  • the host is further configured to generate the processing information according to the at least two flow entries, and send the processing information to the network interface card by using the host interface, where the processing information is used to instruct the virtual switch to use the at least two flow entries to the first data packet. Processing operations.
  • the network interface card is configured to generate an action domain of the first session entry according to the processing information, and is further configured to generate a matching domain of the first session entry according to the matching information of the first data packet, where the first session entry is used to record the network
  • the interface card processes the rules of the data packet that matches the first session entry.
  • the first data packet may be a data packet received by the network interface card from the virtual machine through the host interface or a data packet received from the external network through the network interface.
  • the server generates an action domain of the session entry according to the action domain of at least two flow entries associated with the data packet, and offloads the processing function of the data packet to the network interface card, thereby saving the hardware resources of the host.
  • the network interface card is further configured to receive the second data packet, and query, according to the matching information, the first session entry that matches the second data packet, and according to the first The action field of a session entry processes the second data packet.
  • the second data packet belongs to the same data stream as the first data packet and has the same matching information.
  • the network interface card only needs to query a session entry that matches the data packet, so that the processing operation of the data packet can be realized, thereby simplifying the data packet processing flow.
  • the network interface card before the host receives the first data packet sent by the network interface card, the network interface card is further configured to receive the first A data packet is used to query the recorded session entry according to the matching information, and send the first data packet to the host when the session entry matching the first data packet is not queried.
  • the network interface card maintains a session table. Different data streams have different matching information, and different data streams may have different processing manners, and each session entry corresponds to one data stream.
  • the network interface card queries the session table according to the matching information carried in the data packet. If a session entry matching the packet is found, the packet is processed according to the information recorded in the action field of the session entry. If the session entry corresponding to the data packet is not queried, the first data packet is the first data packet of the data flow in which the first data packet is located, or the first data packet is not the first data packet of the data flow.
  • the session entry corresponding to the data flow has been deleted in the session table, and the data interface card reports the first data packet to the virtual switch running on the host.
  • the network interface card is further configured to query a security group rule that matches the first data packet, and The security group rule writes the action domain of the first session entry.
  • the security group rule is used to implement the security filtering rule, and the security group rule is also offloaded to the network interface card.
  • the network interface card can perform multiple processing on the matched data packet according to the first session entry, thereby simplifying the processing of the data packet. Process.
  • the host is configured with the security group function; the host is further configured to query the security group rule that matches the first data packet, and The network interface card sends the security group rule that the first packet matches.
  • the host may query the security group rule of the first data packet according to the matching information of the first data packet, and pass the security group rule of the first data packet to the network interface card through the host interface.
  • the security group rule includes firewall rules that are allowed to pass in the forward and reverse directions
  • the network interface card is also used to create And a second session entry, and the matching session of the second session entry is generated according to the matching information of the first data packet, where the second session entry is a session entry that matches the reverse data flow of the first data packet.
  • the action field of the second session entry may be set to be uploaded to the host or set to be empty, and the action domain, the first session entry and the second session table of the second session table may be updated according to the actual processing of the reverse packet by the virtual switch.
  • the items can also be combined into one record.
  • the action field distinguishes between the forward and reverse fields. For example, the direction in which the VM is sent is forward, the direction from the network side is reversed, and the source node information is exchanged when the reverse table is checked. Destination node information.
  • the host is further configured to: after modifying one of the at least two flow entries, Sending a modification instruction to the network interface card, the modification instruction is used to instruct the host to modify the flow entry of the at least two flow entries; the network interface card is further configured to modify the first session entry according to the modification instruction.
  • the server can connect the session table necklace to the flow entry of the virtual switch according to the linked list technology, when the virtual switch When the entry is deleted or modified, the host will notify the network interface card to delete or modify the session table.
  • the seventh possible implementation manner of the first aspect if the first session entry is not accessed within a period of time that exceeds a preset time threshold, The network interface card is also used to delete the first session entry.
  • the storage space of the network interface card is limited, or the storage space allocated to the session table is limited, when a session entry is not accessed for a long time, the aging mechanism is started, and the session entry that has not been accessed for a period of time is deleted, thereby saving storage.
  • the network interface card after the network interface card deletes the first session entry, the network interface card is further configured to send a delete instruction to the host;
  • the delete command deletes at least two flow table entries.
  • the flow entries that are not accessed for a long time will be automatically aged out.
  • the session entries are deleted.
  • the session table is re-created and deleted.
  • the host can set the aging of the flow table. You can set a long aging time or no aging. After the session entry is aged (that is, deleted), the host can be notified that the flow entry corresponding to the session entry is aged.
  • the present application provides a data processing method, where a server includes a host running a virtual switch and a network interface card, and the method includes: receiving, by the host, a first data packet sent by the network interface card, and acquiring the first data packet. At least two flow entry items generate processing information according to at least two flow entry items, and send the processing information to the network interface card.
  • the network interface card generates an action domain of the first session entry according to the processing information, and generates a matching domain of the first session entry according to the matching information of the first data packet.
  • the first session entry is used to record a rule that the network interface card processes the data packet that matches the first session entry.
  • the method further includes: the network interface card receiving the second data packet, where the second data packet has the same matching information as the first data packet.
  • the network interface card queries the first session entry that matches the second data packet according to the matching information, and processes the second data packet according to the action domain of the first session entry.
  • the method before the receiving, by the host, the first data packet sent by the network interface card, the method further includes: a network interface card Receiving the first data packet, querying the recorded session entry according to the matching information, and sending the first data packet to the host when the session entry matching the first data packet is not queried.
  • the method further includes: the network interface card querying the security group rule that matches the first data packet, And write the security group rule to the action domain of the first session entry.
  • the host is configured with the security group function, and the method further includes: the host querying the security group rule that matches the first data packet, And sending the first packet-matched security group rule to the network interface card.
  • the method further includes: a network interface The card creates a second session entry, and generates a matching field of the second session entry according to the matching information of the first data packet, where the second session entry is a session entry that matches the reverse data flow of the first data packet.
  • the method further includes: modifying, by the host, one of the at least two flow entries After sending the repair to the network interface card Change the order.
  • the modification instruction is used to instruct the host to modify the flow entry of one of the at least two flow entries.
  • the network interface card modifies the first session entry according to the modification instruction.
  • the method further includes: if the first session entry is in a time period exceeding a preset time threshold The network interface card deletes the first session entry.
  • the method further includes: the network interface card sends a delete instruction to the host; Delete at least two flow entry entries according to the delete command.
  • the second aspect or the second aspect any one of the possible implementation manners of the first aspect or the first aspect, or any one of the possible implementation manners of the first aspect,
  • the description corresponds to any possible implementation of the second aspect or the second aspect, and details are not described herein again.
  • the present invention provides a data processing method, the method comprising: a network interface card transmitting a first data packet to a host.
  • the network interface card receives processing information from the host, and the processing information is used to instruct the host to perform processing operations on the first data packet according to at least two flow entry items that match the first data packet.
  • the network interface card generates an action domain of the first session entry according to the processing information, and generates a matching domain of the first session entry according to the matching information of the first data packet.
  • the first session entry is used to record a rule that the network interface card processes the data packet that matches the first session entry.
  • the method further includes: the network interface card receives the second data packet, where the second data packet has the same matching information as the first data packet.
  • the network interface card queries the first session entry that matches the second data packet according to the matching information, and processes the second data packet according to the action domain of the first session entry.
  • the method includes: the network interface card receives the first data packet, and queries the recorded session table according to the matching information. And, when the session entry matching the first data packet is not queried, the first data packet is sent to the host.
  • the method further includes: the network interface card querying the security group rule that matches the first data packet, And write the security group rule to the action domain of the first session entry.
  • the method further includes: creating a second network interface card A session entry, and a matching field of the second session entry is generated according to the matching information of the first data packet, where the second session entry is a session entry that matches the reverse data flow of the first data packet.
  • the method further includes: the network interface card interface card receives the modification instruction from the host, and the modification instruction is used. The operation of instructing the host to modify one of the at least two flow entries; the network interface card modifies the first session entry according to the modification instruction.
  • the method further includes: if the first session entry is in a time period exceeding a preset time threshold The network interface card deletes the first session entry.
  • the method further includes: the network interface card sends a delete command to the host, and deletes The instruction is used to instruct the host to delete at least two flow entry entries.
  • any one of the possible implementations of the third aspect or the third aspect is the first aspect or the first aspect of any one of the possible servers
  • the network interface card side method corresponding to the implementation manner, the first aspect or the description in any one of the possible implementation manners of the first aspect is applicable to the third aspect or any possible implementation manner of the third aspect, and details are not described herein again. .
  • the present invention provides a network interface card
  • the network interface card includes: a sending unit, configured to send a first data packet to the host, and a receiving unit, configured to receive processing information from the host, where the processing information is used to indicate The processing operation of the first data packet by the host according to the at least two flow entries matching the first data packet; the processing unit, configured to generate an action domain of the first session entry according to the processing information, and according to the matching of the first data packet The information generates a matching field of the first session entry, and the first session entry is used to record a rule that the network interface card processes the data packet that matches the first session entry.
  • the receiving unit is further configured to receive the second data packet, where the second data packet has the same matching information as the first data packet
  • the processing unit is further configured to: The matching information queries the first session entry that matches the second data packet, and processes the second data packet according to the action domain of the first session entry.
  • the receiving unit before the sending unit sends the first data packet to the host, the receiving unit is further configured to receive the first data packet.
  • the processing unit is further configured to query the recorded session entry according to the matching information; the sending unit is further configured to: when the processing unit does not query the session entry that matches the first data packet, send the first data packet to the host.
  • the processing unit is further configured to query a security group rule that matches the first data packet, and The group rule is written to the action field of the first session entry.
  • the processing unit is further configured to create a second session entry if the security group rule includes a firewall rule that is allowed to pass in the forward and reverse directions. And generating a matching field of the second session entry according to the matching information of the first data packet, where the second session entry is a session entry that matches the reverse data flow of the first data packet.
  • the receiving unit is further configured to receive a modification instruction from the host, where the modification instruction is used to indicate that the host is at least A modification operation of one of the two flow entry entries; the processing unit is further configured to modify the first session entry according to the modification instruction.
  • the processing unit is further configured to delete the first session entry.
  • the processing unit is further configured to send a delete instruction to the host, where the delete command is used to indicate the host Delete at least two flow entries.
  • a possible implementation manner of the fourth aspect or the fourth aspect is the network interface card corresponding to any possible server implementation of the first aspect or the first aspect, the first aspect or any possible implementation manner of the first aspect
  • the description in the description corresponds to any possible implementation of the fourth aspect or the fourth aspect, and details are not described herein again.
  • the present invention provides a network interface card, including: a host interface, a processor, and a memory; a host interface is used to connect to the host; the processor is configured to send the first data packet to the host through the host interface; the host interface is also used to Receiving, by the host interface, processing information from the host, where the processing information is used to indicate that the host performs processing operations on the first data packet according to the at least two flow entries that match the first data packet; the processor is further configured to generate the first information according to the processing information.
  • the action field of the session entry, and the matching domain of the first session entry is generated according to the matching information of the first data packet, where the first session entry is used to record the rule that the network interface card processes the data packet matching the first session entry
  • the memory is used to store the first session entry.
  • the network interface card further includes a network interface, where the network interface is used to connect to the external network, and the processor is further configured to receive the second data packet by using the host interface or the network interface.
  • the second data packet has the same matching information as the first data packet.
  • the processor is further configured to query, according to the matching information, the first session entry that matches the second data packet, and process the first session entry according to the action field of the first session entry. Two packets.
  • the network interface card further includes a network interface, the network interface is used to connect to the external network, and the processor passes the host interface.
  • the first data packet is received by the host interface or the network interface, and the recorded session entry is queried according to the matching information, and when the session entry matching the first data packet is not found, , the first data packet is sent to the host.
  • the processor is further configured to query a security group rule that matches the first data packet, and The group rule is written to the action field of the first session entry.
  • the processor is further configured to create a second session entry. And generating a matching field of the second session entry according to the matching information of the first data packet, where the second session entry is a session entry that matches the reverse data flow of the first data packet.
  • the processor is further configured to receive, by using a host interface, a modification instruction from the host, where the modification instruction is used to indicate The modifying operation of the flow entry of the flow table entry of the at least two flow entries; the processor is further configured to modify the first session entry according to the modification instruction.
  • the processor is further configured to delete the first session entry.
  • the processor is further configured to send a delete instruction to the host by using the host interface, The host is instructed to delete at least two flow entry entries.
  • a possible implementation manner of the fifth aspect or the fifth aspect is the network interface card corresponding to any possible server implementation of the first aspect or the first aspect, the first aspect or any possible implementation manner of the first aspect
  • the description in the description corresponds to any possible implementation of the fifth aspect or the fifth aspect, and details are not described herein again.
  • part of the operating pressure in the processing of the data packet is transferred to the network interface card, and the network interface card is used as a hardware device, which not only has high processing efficiency, but also does not need to occupy other resources of the hardware layer.
  • the virtual switch records the processing information of the data processing in a session entry according to the multiple flow entries, and the network interface card only needs one session entry to implement the processing of the matching data packet, which simplifies the processing flow.
  • FIG. 1 is a schematic diagram of a data center architecture
  • FIG. 2 is a schematic diagram of an organization structure of a server
  • FIG. 3 is a schematic diagram of an organization structure of a server according to an embodiment of the invention.
  • FIG. 4 is a schematic diagram showing the hardware structure of a server according to an embodiment of the invention.
  • FIG. 5 is a schematic flowchart of a data packet processing method according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of an organization structure of a server according to an embodiment of the invention.
  • FIG. 7 is a schematic flowchart diagram of a data packet processing method according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram showing the logical structure of a network interface card according to an embodiment of the invention.
  • FIG. 9 is a schematic diagram showing the hardware structure of a network interface card according to an embodiment of the invention.
  • the embodiments of the present invention use the terms first and second, etc. to distinguish each object, such as the first data packet and the second data packet, etc., but there is no logical or temporal dependency between the respective "first" and "second”. relationship.
  • the data packet is composed of matching information and a payload (English full name: payload).
  • the matching information is used to match the matching field of the flow table or the session table.
  • the hardware layer on the server is provided with a network interface card, a processor, an input/output device, and a storage device.
  • the part of the server other than the network interface card is called the host.
  • the virtual switch is a switching device implemented by software on a host running on the server, and is commonly used in SDN.
  • Common virtual switches include OVS.
  • the flow table is used to control the data flow in the SDN, and may also be referred to as an SDN flow table.
  • the flow table conforming to the OpenFlow protocol or the flow table conforming to other protocols may be used.
  • the flow entry of the flow table includes a matching domain and an action domain, and the matching domain is used to match the data packet, and the action domain is used to instruct the virtual switch to process the data packet according to the matching result.
  • the action field may include processing information for matching data packets, such as forwarding, discarding, and sending to the SDN controller, and may also include routing information of the data packet, such as a destination port identifier of the data packet.
  • the action domain of the flow table may include any action supported by the OpenFlow protocol, which is not limited by the present invention.
  • the flow table set accessible by the virtual switch includes at least two flow tables, and the virtual switch processes the data packet according to the flow table in the flow table set.
  • a data packet may be associated with multiple flow entries in multiple flow tables.
  • the virtual switch may query multiple flow entries associated with the data packet, and according to The plurality of flow entry items process the data packet in turn.
  • the session table is used for controlling the data flow by using a network interface card (English name: network interface card, abbreviation: NIC).
  • the session table entry of the session table includes a matching domain and an action domain, the matching domain is used to match the data packet, and the action domain is used to instruct the network interface card to process the matched data packet.
  • the action field of the session entry is generated based on the action domain of multiple flow entries associated with the packet.
  • the flow table set is generally stored in a storage device of the server, and the session table may be stored in a storage device of the server, or may be stored in a storage device inside the network interface card. If the flow table set and the session table are both stored in the storage device of the server, the server separately opens a storage space for the flow table set and the session table in its storage device.
  • the session table is stored in the network interface card as an example. A person skilled in the art can directly derive the case where the session table is stored in the storage device of the server.
  • the data stream (data flow) indicates a series of data packets carrying the same matching information.
  • the matching information of the data packet in the same data stream can match the matching domain of the matching field or the session entry of the flow entry corresponding to the data flow.
  • an exemplary network interface card using SR-IOV single-root I/O virtualization
  • SR-IOV single-root I/O virtualization
  • the flow entry associated with the data packet refers to a flow entry that needs to be used in the process of processing the data packet by the virtual switch.
  • the flow entry may be specifically an OVS forwarding flow entry.
  • the virtual switch first searches the flow table 1 for the flow entry 1 matching the data packet 1 according to the matching information of the data packet 1, and processes the data packet 1 according to the information recorded in the action field of the flow entry 1 Data packet 2, and then querying the flow table entry 2 matching the data packet 2 in the flow table 2 according to the matching information of the data packet 2, and processing the data packet 2 according to the information recorded in the action field of the flow entry 2
  • the flow entry 1 and the flow entry 2 are both data packets associated with the packet 1.
  • the virtual switch performs the modification operation on the data packet 1 according to the information recorded in the action field of the flow entry 1, the data packet 2 and the data packet 1 are different. If the virtual switch does not perform the data packet 1 according to the flow entry 1 The packet operation is the same as packet 1 when the operation is modified.
  • the hardware resources on each server in the data center need to support running multiple virtual machines, virtual switches, and virtual machine monitors.
  • the hardware resources of each server are limited. If the virtual switch that is responsible for the data exchange task occupies too many hardware resources, it will easily affect the operation of the virtual machine on the server and reduce the work efficiency. In order to reduce the burden on the server hardware, the service of the virtual switch can be offloaded to the network interface card.
  • the function of the virtual switch is very flexible.
  • the different processing operations of the data packet are recorded in different flow entries.
  • the virtual switch maintains multiple flow entries associated with the data packet. It is difficult to implement a large-scale flow table that supports mask matching because of hardware, and the search of multiple flow tables also affects performance. If the traffic on the virtual switch is directly offloaded to the network interface card, for example, the flow table of the virtual switch is directly copied to the network interface card, a large number of flow tables may cause the network interface card to be overloaded and cannot be optimized.
  • the action domain of a session entry is merged according to the action domain of multiple flow entry items associated with the data packet, and the processing function of the data packet is offloaded to the network interface card.
  • the network interface card only needs to query a session entry that matches the data packet, so that the processing operation of the data packet can be realized, thereby saving the hardware resources of the server and simplifying the processing flow of the data packet.
  • FIG. 1 is a schematic diagram of an SDN architecture according to an embodiment of the present invention.
  • FIG. 1 schematically adopts a centralized SDN controller.
  • an SDN controller may also be distributed to each server in a distributed manner.
  • Each host runs with its hardware layer supporting the virtual switch within the software layer and the operation of multiple virtual machines.
  • the host in each server establishes a communication connection with the network interface card, and the host communicates with the external network through the network interface card.
  • the network interface card first acquires the data packet from the external network, and then sends the data packet to the VM running on the host, and the host The packets sent by the running VM to the external network are also sent to the network interface card and sent to the external network through the network interface card.
  • the virtual switch matches the data packet with the flow table in the flow table set, and according to the indication of the matching flow entry, the data is processed and sent to the destination VM connected to the virtual switch. .
  • the main operating pressure in the data processing process is concentrated on the virtual switch, and the operation of the virtual switch depends on the resources of the hardware layer on the server, and the more resources of the processor and storage device occupied by the virtual switch.
  • the network interface card in the server 300 is from an external network. After receiving the data packet, if it is determined that the destination VM of the data packet runs on the server 300, the session table entry matching the data packet is searched in the session table, and according to the indication of the session entry matched by the data packet, The data is processed and sent to the destination VM connected to the network interface card.
  • the action field of the session entry is derived from the combination of the action fields of multiple flow table entries that match the data packet. If the network interface card does not query the session entry that matches the received data packet, the data packet is sent to the virtual switch, and the virtual switch queries multiple flow entries matching the data packet, according to the query. The flow entry processes the packet and sends processing information generated by the flow entry matching the packet to the network interface card.
  • the virtual switch does not query the flow entry that matches the data packet, request the SDN controller to obtain the flow entry corresponding to the data packet, and process the data packet according to the multiple flow entry obtained from the SDN controller. And sending the processing information generated according to the obtained flow entry to the network interface card.
  • the network interface card generates an action field of a session entry that matches the matching information of the data packet according to the processing information for subsequent use.
  • the virtual switch records the processing information of the data processing in a session entry according to the multiple flow entries, which simplifies the processing flow, and the network interface card only needs one session entry to implement the processing of the matched data packet.
  • all the VMs on the server 300 in FIG. 3 can be connected to the network interface card. In fact, only some VMs can be connected to the network interface card, and other VMs are connected to the virtual switch. The configuration is not limited to having to be all connected to the network interface card.
  • FIG. 4 is a schematic diagram showing the hardware structure of the server 300 according to an embodiment of the present invention.
  • the server 300 runs a virtual machine and a virtual switch.
  • the server 300 includes a processor 301 that is coupled to the system memory 308.
  • the processor 301 can be a central processing unit (CPU), an image processing unit (English name: graphics processing unit, GPU), a digital signal processor (English name: digital signal processor, abbreviation: DSP) or other forms of integrated circuits. .
  • the server 300 also includes a network interface card 303 for implementing communication between the virtual machine on the server 300 and the external network.
  • the bus 307 is used to transfer information between the components of the server 300.
  • the bus 307 can use a wired connection or a wireless communication method, which is not limited in this application.
  • the bus 307 can also be connected to an input/output interface 304, a secondary storage 305 and a communication interface 306.
  • the input/output interface 304 is connected to an input/output device for receiving input information and outputting an operation result.
  • the input/output device can be a mouse, a keyboard, a display, or an optical drive.
  • the storage medium of the auxiliary storage 305 may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, an optical disk), or a semiconductor medium (for example, a solid state disk (SSD)).
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, an optical disk
  • a semiconductor medium for example, a solid state disk (SSD)
  • Communication interface 306 implements communication with other devices or communication networks using transceivers such as, but not limited to, transceivers, which may be interconnected with the communication network in a wired or wireless form.
  • the communication network can be the Internet, an intranet (English: intranet), a local area network (English name: local area network, abbreviation: LAN), a wide area network (English full name: wide area network, abbreviation: WAN), a storage area network (English full name) :storage Area network, abbreviation: SAN), etc., or any combination of the above networks.
  • System memory 108 may include software such as an operating system (eg, Darwin, RTXC, LINUX, UNIX, OS X, WINDOWS, or embedded operating system (eg, Vxworks)), applications, and data processing modules.
  • operating system eg, Darwin, RTXC, LINUX, UNIX, OS X, WINDOWS, or embedded operating system (eg, Vxworks)
  • applications eg, Vxworks
  • the server runs at least one VM and a virtual switch.
  • the program code for implementing the method on the host side in the data processing method provided by the embodiment of the present invention is stored in the system memory 302 and executed by the processor 301.
  • the network interface card performs the method on the network interface card side in the data processing method provided by the embodiment of the present invention.
  • the present application further provides a data processing method, where the server in the foregoing SDN architecture executes the method during operation, and a schematic flowchart thereof is shown in FIG. 5.
  • FIG. 5 is a flowchart of a data processing method 500 according to an embodiment of the present invention.
  • the method 500 includes:
  • the network interface card receives the first data packet.
  • the first data packet carries the matching information and payload of the first data packet.
  • the first data packet may be a data packet sent by the virtual machine running on the server to the external network or a data packet sent by the external network to the virtual machine running on the server.
  • the method 500 further includes configuring a port where the virtual machine is interconnected with the network interface card.
  • the network interface card is interconnected with the virtual machine through the network interface card port, and one network interface card port can be connected to a VM running on the host through the SR-I/OV technology, and the network interface card port can be SR-I.
  • the port of the virtual function defined by /OV technology (English full name: virtual function, abbreviation: VF).
  • the network interface card may be interconnected with the virtual machine by using other technologies. The embodiment of the present invention does not limit the technology for interconnecting the network interface card and the virtual machine.
  • the network interface card can also be a network interface card that supports the function of the virtual machine device queue (English name: Virtual Machine Device Queues, abbreviated: VMDq).
  • the port where the server configures the virtual machine to be interconnected with the network interface card may include:
  • S5001 The host of the server establishes at least one virtual switch port on the virtual switch according to the configuration information of the virtual switch port, and each virtual switch port corresponds to a VM running on the host.
  • S5002 The host generates configuration information of the network interface card port, and sends the configuration information of the network interface card port to the network interface card of the server.
  • the host obtains the configuration information of the virtual switch port, and sends the configuration information of the virtual switch port to a network interface card driver running on the host, where the network interface card driver generates a network according to the configuration information of the virtual switch port.
  • the configuration information of the interface card port is sent to the network interface card.
  • the configuration information of the virtual switch port is similar to the configuration information of the network interface card port.
  • the network interface card driver converts the configuration information of the virtual switch port into the configuration information of the network interface card port, mainly for conforming to the network interface card driver and the network. Specification for interface card communication.
  • the network interface card configures at least one network interface card port on the network interface card according to the configuration information of the network interface card port, and each network interface card port is connected to a VM running on the host.
  • the network interface card port may specifically be a port of a virtual function (English name: virtual function, abbreviated: VF) defined by the SR-I/OV technology.
  • VF virtual function
  • Each port of the virtual switch corresponds to a VF of the network interface card, and the network interface card is interconnected with the virtual machine through the VF.
  • S5001-S5003 is an optional step, and S5001-S5003 is the configuration process of the virtual switch and the network interface card. It is not necessary to execute S5001-S5003 once before performing the subsequent steps of S5001-S5003.
  • the VM running on the host is connected to the network interface card through the network interface card port.
  • the VS port Since the VS port is in one-to-one correspondence with the VM, and the VM has a one-to-one correspondence with the network interface card port, the VS port has a one-to-one correspondence with the network interface card port.
  • the corresponding relationship between the VS port and the network interface card port is stored in the virtual switch and/or the corresponding relationship between the VS port and the network interface card port is stored in the network interface card.
  • the method 500 further includes configuring at least one queue that the virtual switch communicates with the network interface card, where the virtual switch returns a data packet received from the network interface card to the network interface card.
  • the configuration of the queue has various forms.
  • the virtual switch communicates with the network interface card through a queue, and the virtual switch sends all data packets that need to be sent to the network interface card to the queue.
  • the virtual switch and the virtual switch The network interface card communicates through n queues, where n is the number of VMs running on the host, and each queue corresponds to one VM.
  • the embodiment of the present invention does not limit the configuration form of the queue.
  • step S504 The network interface card searches, in the session table, whether there is a session entry that matches the first data packet according to the matching information of the first data packet. If there is a session entry matching the first data packet, step S506 is performed; if there is no session entry matching the first data packet, step S508 is performed.
  • the session entry includes a matching domain and an action domain, and the matching domain is used to match the matching information of the data packet, and the information recorded by the action domain is used to instruct the network interface card to process the data packet matching the session entry.
  • the matching information of the data packet may include source information of the data packet and/or destination information of the data packet.
  • the source information and the destination information may include an Internet Protocol (English full name: Internet Protocol, abbreviation: IP) address, a media access control address (English full name: Media Access Control, abbreviation: MAC), a port number (for example, a transmission control protocol ( English full name: Transmission Control Protocol (abbreviated as TCP) port, User Datagram Protocol (English Datagram Protocol, abbreviation: UDP) port, or other similar information used to identify the source and destination of the data.
  • IP Internet Protocol
  • MAC Media Access Control
  • port number for example, a transmission control protocol ( English full name: Transmission Control Protocol (abbreviated as TCP) port, User Datagram Protocol (English Datagram Protocol, abbreviation: UDP) port, or other similar information used to identify the source and destination of the data.
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • IP quintuple source IP + source port + protocol type + destination IP + destination port
  • IP triplet source IP + destination IP + protocol type
  • the addresses of different types of protocol configurations may be the same.
  • VM1 belongs to the IPV4 protocol
  • VM2 belongs to the IPV6 protocol.
  • two of them may have IP.
  • a session can be identified by adding an IP protocol (IPV4, IPV6) or a TCP protocol or the like.
  • the MAC table information can be used when constructing the session table.
  • the session table can be constructed using MAC information, IP information, and Layer 3 protocol types.
  • the session table can be constructed using MAC, IP, port, and Layer 3 and Layer 4 protocol types.
  • the information of the matching domain record of the session entry may be a field or a partial field of the matching information carried by the data packet matching the session entry.
  • the information of the matching field record of the session entry may also be the information processed by the field or the partial field of the matching information carried in the data packet.
  • the information of the matching domain record of the session entry may be the data packet matched by the session entry.
  • the embodiment of the present invention does not limit the correspondence between the matching field of the session entry and the matching information carried by the data packet.
  • the network interface card After receiving the data packet, the network interface card queries the session table according to the matching information carried in the data packet, and can query the session table entry according to the field carried in the matching information, or the result after processing the field according to the matching information (for example, a hash operation) to query a session table entry.
  • the matching information carried in the data packet
  • the network interface card queries the session table according to the matching information carried in the data packet, and can query the session table entry according to the field carried in the matching information, or the result after processing the field according to the matching information ( For example, a hash operation) to query a session table entry.
  • the first data packet is the first data packet of the data flow in which the first data packet is located, or the first data packet is not the first data packet.
  • the first packet of the data stream, but the session entry corresponding to the stream has been deleted in the session table.
  • S506 The network interface card processes the first data packet according to the session entry that matches the first data packet.
  • the network interface card processes the first data packet based on information recorded in the action field of the session entry that matches the first data packet.
  • the network interface card can process the data packet according to the action domain of the session entry, and the data packet is not reported to the virtual switch for processing. , which simplifies the data processing process and reduces the virtual switch's occupation of server hardware resources.
  • step S508 The network interface card queries whether the security group rule allows the first data packet to pass. If the security group rule allows the first data packet to pass, step S512 is performed; if the security group rule does not allow the first data packet to pass, step S510 is performed.
  • the method 500 may further include: the network interface card creates a first session entry that matches the first data packet, and creates a first session entry that matches the first data packet according to the matching information of the first data packet. a matching domain, the network interface card may write part or all of the matching information of the first data packet to the matching domain of the first session entry, and the network interface card may also part or all of the matching information of the first data packet.
  • the processing result is written in the matching domain of the first session entry.
  • the embodiment of the present invention does not limit the form of the matching domain of the first session entry.
  • the information of the action domain of the first session entry may be empty or reported to the virtual switch.
  • the security group rule can be established on the network interface card chip or on the host of the server. If the security group rule is established on the host, the host searches for the security group rule matched by the first data packet, and then sends the security group rule matched by the first data packet to the network interface card. Security group rules are used to implement security filtering rules to achieve access isolation between hosts or VMs.
  • S510 The network interface card discards the first data packet.
  • the method 500 may further include: deleting the created first session entry, or setting the aging time of the first session table to a shorter time to let it age quickly.
  • S512 The network interface card sends the first data packet to the host.
  • the network interface card sends the first data packet to the virtual switch running on the host.
  • the first packet does not have a matching session entry in the session table, and the security group rule allows the first packet to pass, and the network interface card will A packet is sent to the virtual switch running on the host for processing.
  • S514 The host acquires at least two flow entry items associated with the first data packet.
  • At least two flow entries associated with the first data packet may be obtained by a virtual switch running on the host.
  • the function of the virtual switch is very flexible.
  • the different processing operations of the data packet are recorded in different flow entries.
  • the virtual switch maintains multiple flow entries associated with one data packet.
  • the flow entry associated with the data packet refers to a flow entry that needs to be used in the process of processing the data by the virtual switch.
  • the data packet may change during the transmission from the source to the destination, but for convenience of description, the embodiment of the present invention uses a first data packet or a second data packet to express a data packet. The entire life cycle.
  • the virtual switch performs the modification operation on the data packet 1 according to the action field of the flow entry 1 to obtain the data packet 2, and the data packet 2 is different from the data packet 1.
  • the data packet is still Both 1 and 2 are called first packets or second packets.
  • the virtual switch may send the first data packet or the first data packet to the SDN controller after receiving the first data packet, and receive the SDN.
  • the flow entry corresponding to the data flow generated by the controller according to the first data packet.
  • S516 The host processes the first data packet according to the at least two flow entry items associated with the obtained first data packet.
  • the first data packet may be processed by the virtual switch running on the host according to the obtained at least two flow entry items associated with the first data packet. After processing the first data packet according to the at least two flow entries associated with the first data packet, the virtual switch forwards the processed data packet and the processing result to the network interface card, and the network interface card forwards the data packet.
  • S518 The host sends processing information to the network interface card.
  • processing information can be sent to the network interface card by the virtual switch running on the host.
  • the processing information is used to generate, according to the at least two flow entries, the virtual switch, according to the at least two flow entry pairs.
  • the processing operation of the first packet if the information recorded in the action domain of the at least two flow entries is a processing operation on the first data packet itself, the processing information may be an action domain record of the at least two flow entries.
  • the information of the action domain record of the first flow entry of the at least two flow entries is not processed by the first data packet itself, for example, the information of the action domain record of the first flow entry is the next search
  • the flow class table may not carry the information of the action domain record of the first flow entry in the processing information.
  • the processing information may include information recorded by the action domain of the at least two flow entries, or information integrated by the action domain records of the at least two flow entries.
  • S520 The network interface card generates an action domain of the first session entry according to the processing information sent by the host.
  • the first flow session entry includes a matching domain and an action domain, and the matching domain is used to match the matching information of the first data packet.
  • the first session entry is used to instruct the network interface card to process a data packet that matches the first session entry, that is, another data packet used to instruct the network interface card to process the data stream in which the first data packet is located.
  • step S520 if the network interface card receives the second data packet, and the second data packet belongs to the same data stream as the first data packet, that is, the second data packet carries the same matching information as the first data packet, the network interface The card queries the first session entry that matches the second data packet according to the matching information carried by the second data packet, and processes the second data packet according to the first session entry. More specifically, the network interface card processes the second data packet according to the action domain of the first session entry.
  • the method 500 further includes: the network interface card writing the security group rule matched by the first data packet to the action domain of the first session entry.
  • the network interface card can perform multiple processing on the matched data packet according to the first session entry, thereby simplifying the processing flow of the data packet.
  • the security group module modifies the security group rule of the first data packet, it may also send a modification instruction to the network interface card, where the instruction is used to instruct the security group module to modify the security group rule of the first data packet, and the network interface card Modifying the record of the action domain of the first session entry with respect to the security group rule according to the modification instruction.
  • the method 500 may further include: when the security group rule is used to implement the state firewall function, in a case where the processing result of the firewall function is that the source and destination forward and reverse data packets of the first data packet are allowed to pass, the network interface card Creating a second session entry according to the matching information of the first data packet, and generating a matching domain of the second session entry according to the matching information of the first data packet, where the second session entry is a reverse data flow with the first data packet.
  • the matching session entry indicates that the security action of the packet originating from the destination address of the first packet to the source address is also passed.
  • the network interface card may obtain, according to the matching information of the first data packet, matching information of the reverse data packet of the destination of the first data packet to the source of the first data packet, source information of the reverse data flow of the first data packet, and
  • the destination information is the destination information and source information of the first data packet.
  • the matching field of the second session entry may be configured according to a method similar to the first session entry, and details are not described herein again.
  • the action field of the second session entry can be set to be the upload host or set to null.
  • the action domain of the second session table is updated according to the actual processing of the reverse data packet by the virtual switch.
  • the specific solution flow is the first session in the following description.
  • the configuration process of the action field of an entry is similar.
  • the first session entry and the second session entry may also be combined into one record, and the action domain distinguishes between the forward and reverse domains. For example, the direction in which the VM is sent is forward, and the direction on the network side is reversed. Exchange source node information and destination node information when checking the reverse table.
  • the method 500 further includes: after the virtual machine virtual switch modifies any one of the at least two flow entries that match the matching information of the first data packet, the virtual switch sends a modification command to the network interface card, where The modification command is used to instruct the virtual switch to modify the flow entry, and the network interface card modifies the first session entry according to the modification instruction.
  • the server can connect the session table necklace to the flow entry of the virtual switch according to the linked list technology.
  • the host When the entry of the virtual switch is deleted or modified, the host notifies the network interface card to delete or modify the session table synchronously.
  • each flow entry and session entry has an index ID
  • the host establishes a mapping relationship between the flow entry index and the session entry index ID, and the host monitors the virtual switch flow table update status.
  • the network interface card is notified.
  • the network interface card updates the session entry according to the update operation of the flow entry.
  • the update of the security group rule is similar to that of the flow entry information update management, and is not described here.
  • the method 500 further includes: when the first session entry is not accessed within a time period exceeding a preset time threshold, the network interface card deletes the first session entry and sends a delete command to the virtual switch.
  • the virtual switch deletes at least two flow entries that match the matching information of the first data packet according to the deletion instruction.
  • the OVS flow table has an aging mechanism, the flow entries that are not accessed for a long time will be automatically aged out. After the flow entry expires, the session entries are deleted. In this case, the session table is continuously re-created and deleted.
  • the host can set the aging of the OVS flow table, and can set a long aging time or no aging.
  • the session entry can be configured with an aging mechanism. After the session entry is aged, the OVS can be notified of the flow corresponding to the session entry. The entry is aged.
  • the network interface card in order to prevent the SYN (synchronous) attack of the TCP (referring to the attack that urgent sends the link establishment request), can identify from the TCP request that the connection is established for the TCP connection request.
  • the request for the chain is set to a short aging time (for example, less than 5 seconds). If the entry is not accessed for a short period of time, the entry will be aged and deleted. This record is deleted as soon as possible to prevent the session table from being attacked.
  • SYN attacks exploit TCP protocol flaws and consume CPU and memory resources by sending a large number of semi-join requests. Once there is a new message, the session table will create a new session record. If not deleted, the space will be filled and new records cannot be created.
  • SYN is the handshake signal used when TCP/IP establishes a connection.
  • the client When a normal TCP network connection is established between the client and the server, the client first sends a SYN message, and the server uses the SYN+ACK response to indicate that the message is received. Finally, the client responds with an ACK message so that a reliable TCP connection can be established between the client and the server so that data can be passed between the client and the server.
  • the aging time can be set to a long aging time (for example, 30 minutes).
  • a short aging time is set when a session table is established for a unidirectional packet, and a long aging time is changed when a response packet is received.
  • the network interface card can delete the session entry to avoid occupying space.
  • FIG. 7 is a flowchart of a data processing method 700 according to an embodiment of the present invention.
  • the server 300 performs a method 700 in a method.
  • the network interface card needs to query the security of the first data packet according to the processing information of the virtual switch.
  • Group rules as shown in Figure 7, method 700 includes:
  • the network interface card receives the first data packet.
  • step S704 The network interface card searches, in the session table, whether there is a session entry that matches the first data packet according to the matching information of the first data packet. If there is a session entry that matches the first data packet, step S706 is performed; if there is no session entry matching the first data packet, step S708 is performed.
  • S706 The network interface card processes the first data packet according to the session entry that matches the first data packet.
  • steps S702-S706 refers to steps S502-S506, and details are not described herein again.
  • S708 The network interface card sends the first data packet to the host.
  • the method 700 may further include: the network interface card creates a first session entry that matches the first data packet, and creates a first session entry that matches the first data packet according to the matching information of the first data packet. a matching domain, the network interface card may write part or all of the matching information of the first data packet to the matching domain of the first session entry, and the network interface card may also part or all of the matching information of the first data packet.
  • the processing result is written in the matching domain of the first session entry.
  • the embodiment of the present invention does not limit the form of the matching domain of the first session entry.
  • the action field of the first session entry may be empty or reported to the virtual switch.
  • S710 The host acquires at least two flow entry items associated with the first data packet.
  • S712 The host processes the first data packet according to the at least two flow entry items associated with the obtained first data packet.
  • S714 The host sends processing information to the network interface card.
  • steps S708-S714 refers to steps S512-S518, and details are not described herein again.
  • step S716 The network interface card queries whether the security group rule allows the first data packet to pass. If security group rules allow If the first data packet passes, step S718 is performed; if the security group rule does not allow the first data packet to pass, step S720 is performed.
  • the network interface card queries the security group rule of the first data packet according to the processing information sent by the virtual switch.
  • the security group rule can be established on the network interface card chip or on the host of the server.
  • the network interface card generates an action domain of the first session entry according to the processing information sent by the host.
  • step S718 refers to step S520, and details are not described herein again.
  • S720 The network interface card discards the first data packet.
  • the network interface card discards the first packet.
  • the method 700 may further include: deleting the created first session table entry.
  • the network interface card needs to query the processing information of the first data packet according to the processing information sent by the virtual switch.
  • the method 700 is described in detail with reference to the method 500.
  • the matching information of the data packet is an IP quintuple
  • the IP address of the VM-1 is 12.5.3.1
  • the network interface card is connected through the VF1
  • the VM-1 accesses the IP address through the port 2351.
  • the access process is as follows:
  • the VM first initiates a TCP SYN packet, and the packet is directly sent to the network interface card through the VF1 of the network interface card.
  • the network interface card looks up the session entry with IP quintuple 12.5.3.1: 2351+TCP+52.5.13.5:80. For the first packet of the data stream, the network interface card cannot query the session entry.
  • the network interface card queries the security group table, assuming that the security group configuration rules allow 12.5.3.1 to access 52.5.13.5.
  • the network interface card sends the data packet to the host, and the virtual switch queries at least two flow entries matching the data packet, and forwards the result to the external port NET1 according to the processing result of the at least two flow entries.
  • the host sends processing information to the network interface card.
  • the network interface card creates a forward session entry with the matching domain of 12.5.3.1: 2351+TCP+52.5.13.5:80.
  • the action field of the forward session entry is to forward the data packet. Go to the external network port NET1.
  • the network interface card can also create a reverse session entry with the matching domain of 52.5.13.5:80+TCP+12.5.3.1:2351, and the action domain of the reverse session entry. Empty (send to the host) The forward session entry and the reverse session entry may also be one entry. The action domain distinguishes between the forward zone and the reverse zone. The forward direction is forwarded to the external network port, the reverse direction is empty, and the reverse source is used to exchange the source. Destination IP address and port number.
  • the session table records the SYN status and sequence number (each TCP request has a sequence number), and the aging time is a short aging time, for example, 3 seconds.
  • the session table is connected to the OVS hit flow entry and the security group hit security group entry, and the OVS flow table entry is aged (set to not aging, or the aging time is long).
  • the mapping between the session entry and the flow entry and the mapping between the session entry and the security group entry are established.
  • the host resends the data packet to the network interface card, and the network interface card sends the data packet out from the network port NET1.
  • the external server responds to the SYN+ACK message.
  • the network interface card queries the session table. Hit the reverse session entry, but the action field is empty, the network interface card sends the packet to the OVS for forwarding processing, the OVS queries the flow entry, determines that the packet is to be forwarded to port 1, and then the network interface card drives the query port and If the mapping between VF and VF1 is successful, the forwarding result is forwarded to VF1.
  • the host sends processing information to the network interface card.
  • the processing information indicates that the forwarding result is to forward the data packet to VF1.
  • the network interface card is updated according to the processing information. Reverse the action field of the session entry and send the message to VM-1 through VF1.
  • VM-1 After receiving the packet, VM-1 returns an ACK packet with the TCP sequence number. Then the network interface card determines the SYN status and sequence number of the session entry. If the sequence number matches, the system enters the setup state and changes the session entry to Long aging time, for example 30 minutes. The subsequent TCP data packet query session table can directly obtain the forwarding result, and no longer need to be sent to the host for OVS forwarding. If a flow entry or a security group rule is modified or deleted, the session entry is modified or deleted according to the associated index relationship.
  • the network interface card deletes the forward and reverse entries of the session table 12.5.3.1: 2351+TCP+52.5.13.5:80, and notifies the OVS and The mapping between the session entry and the flow entry is deleted, and the mapping between the session entry and the security group entry is deleted. The OVS flow table entry is allowed to age again.
  • the data packet may be reported to the OVS first, and then the security table rule is searched according to the processing information sent by the OVS, for example, if the processing result To forward the packet to VF1, the network interface card queries the security group rule configured on VF1. If the packet is forbidden, the device discards the packet and deletes the created session entry. If you do not need to perform security group check for the VM interface, you can check the security group table first. If you do not pass the direct discard, the host will not be sent to the OVS for forwarding.
  • FIG. 8 is a schematic diagram showing the hardware structure of a network interface card 800 according to an embodiment of the present invention.
  • the network interface card 800 includes a processor 802, a memory 804, a network interface 806, a host interface 808, and a bus 8100.
  • the host interface 808 is used to connect to the host.
  • the processor 802 is configured to send the first data packet to the host through the host interface 808, and receive the processing information from the host through the host interface 808, where the processing information is used to indicate that the host matches the at least two flow entries corresponding to the first data packet. a processing operation of the data packet, and generating an action domain of the first session entry according to the processing information, and generating a matching domain of the first session entry according to the matching information of the first data packet, where the first session entry is used to record the network interface
  • the card processes the rules of the packet that match the first session entry.
  • the processor 802 in the embodiment of the present invention may be any form of processing logic.
  • the processor 802 may be a central processing unit, an image processor, or a digital signal processor (English name: digital signal processor, abbreviation: DSP). Or other forms of integrated circuits.
  • the functions of the processor 802 may be implemented by an integrated circuit of hardware, or may be implemented by a processor executing code stored in the memory 804, which is not limited by the present invention.
  • the memory 804 is configured to store the first session entry.
  • the network interface card further includes a network interface 806 for connecting to the external network
  • the processor 802 is further configured to receive the second data packet through the host interface 808 or the network interface 806, where the second data packet has the same as the first data packet.
  • the matching information, 802 is further configured to query, according to the matching information, the first session entry that matches the second data packet, and process the second data packet according to the action domain of the first session entry.
  • the processor 802 is further configured to receive the first data packet through the host interface 808 or the network interface 806, query the recorded session entry according to the matching information, and query the recorded session entry. When a packet matches a session entry, the first packet is sent to the host.
  • the processor 802 is further configured to query a security group rule that matches the first data packet, and write the security group rule into an action domain of the first session entry. If the security group rule includes a firewall rule that is allowed to pass in the forward and reverse directions, the processor 802 is further configured to create a second session entry, and generate a matching domain of the second session entry according to the matching information of the first data packet, where the second session table is generated. The entry is a session entry that matches the reverse direction data flow of the first data packet.
  • the processor 802 is further configured to receive, by using the host interface 808, a modification instruction from the host, and modify the first session entry according to the modification instruction, where the modification instruction is used to instruct the host to use one of the at least two flow entries.
  • the modification operation of the item is further configured to receive, by using the host interface 808, a modification instruction from the host, and modify the first session entry according to the modification instruction, where the modification instruction is used to instruct the host to use one of the at least two flow entries.
  • the modification operation of the item is further configured to receive, by using the host interface 808, a modification instruction from the host, and modify the first session entry according to the modification instruction, where the modification instruction is used to instruct the host to use one of the at least two flow entries.
  • the processor 802 is further configured to delete the first session entry if the first session entry is not accessed within a period of time that exceeds the preset time threshold. After deleting the first session entry, the processor 802 is further configured to send a delete command to the host through the host interface 808, where the delete command is used to instruct the host to delete at least two flow entries.
  • the embodiment of the present invention is an apparatus embodiment of a network interface card, and the feature description of the other embodiments of the present invention is applicable to the embodiment of the present invention, and details are not described herein again.
  • FIG. 9 is a schematic diagram showing the logical structure of a network interface card 900 according to an embodiment of the present invention.
  • the network interface card 900 includes a sending unit 902, a receiving unit 904, and a processing unit 906.
  • the sending unit 904 is configured to send the first data packet to the host, and the receiving unit 902 is configured to receive processing information from the host, where the processing information is used to instruct the host to use the at least two flow entries that match the first data packet to the first data packet.
  • the processing unit 906 is configured to generate an action domain of the first session entry according to the processing information, and generate a matching domain of the first session entry according to the matching information of the first data packet, where the first session entry is used to record the network.
  • the interface card 900 processes the rules of the data packets that match the first session entry.
  • the receiving unit 902 is further configured to receive the second data packet, where the second data packet has the same matching information as the first data packet
  • the processing unit 906 is further configured to query, according to the matching information, the first session entry that matches the second data packet, And processing the second data packet according to the action domain of the first session entry.
  • the receiving unit 902 is further configured to receive the first data packet; the processing unit 906 is further configured to query the recorded session table item according to the matching information; the sending unit 904 is further configured to be in the processing unit 906.
  • the session entry matching the first data packet is not queried, the first data packet is sent to the host.
  • the processing unit 906 is further configured to query a security group rule that matches the first data packet, and write the security group rule into an action domain of the first session entry. If the security group rule includes a firewall rule that is allowed to pass in the forward and reverse directions, the processing unit 906 is further configured to create a second session entry, and generate a matching domain of the second session entry according to the matching information of the first data packet, where the second session table is generated. The entry is a session entry that matches the reverse direction data flow of the first data packet.
  • the receiving unit 902 is further configured to receive a modification instruction from the host, where the modification instruction is used to instruct the host to modify a flow entry of the at least two flow entries; the processing unit 906 is further configured to modify according to the modification instruction.
  • the first session entry is further configured to receive a modification instruction from the host, where the modification instruction is used to instruct the host to modify a flow entry of the at least two flow entries; the processing unit 906 is further configured to modify according to the modification instruction.
  • the first session entry is further configured to receive a modification instruction from the host, where the modification instruction is used to instruct the host to modify a flow entry of the at least two flow entries; the processing unit 906 is further configured to modify according to the modification instruction.
  • the first session entry is further configured to receive a modification instruction from the host, where the modification instruction is used to instruct the host to modify a flow entry of the at least two flow entries; the processing unit 906 is further configured to modify according to the modification instruction.
  • the first session entry is further configured to receive a modification instruction from the host,
  • the processing unit 906 is further configured to delete the first session entry, if the first session entry is not accessed within a time period that exceeds the preset time threshold. After the first session entry is deleted, the processing unit 906 is further configured to send a delete command to the host, where the delete command is used to instruct the host to delete at least two flow entries.
  • the embodiment of the present invention is an apparatus embodiment of a network interface card, and the feature description of the other embodiments of the present invention is applicable to the embodiment of the present invention, and details are not described herein again.
  • the functions of the transmitting unit 902 and the receiving unit 904 of the embodiment of the present invention may be implemented by the processor 802 and the host interface 808 in the embodiment of FIG. 8, or by the processor 802, the memory 804, and the host interface 808.
  • transmitting unit 904 in the embodiment of the present invention may also be performed by the processor 802 in the embodiment of FIG. It is implemented with network interface 806 or by processor 802, memory 804 and network interface 806.
  • processing unit 904 of an embodiment of the present invention may be implemented by processor 802 in the FIG. 8 embodiment or by processor 802 executing code in memory 804.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明实施例提供了一种数据处理方法、网络接口卡及服务器。该方法包括：主机接收网络接口卡发送的第一数据包，获取与第一数据包关联的至少两个流表项，根据至少两个流表项生成处理信息，并向网络接口卡发送处理信息。网络接口卡根据处理信息生成第一会话表项的动作域，并根据第一数据包的匹配信息生成第一会话表项的匹配域。第一会话表项用于记录网络接口卡处理与第一会话表项匹配的数据包的规则。根据与数据包关联的多个流表项的动作域，合并一个会话表项的动作域，并将对数据包的处理功能卸载到网络接口卡实现，从而节约了服务器的硬件资源，且简化了对数据包的处理流程。

Description

一种数据处理方法、网络接口卡及服务器 技术领域
本申请涉及计算机领域，尤其涉及一种数据处理方法、网络接口卡(英文全称：network interface card，缩写：网络接口卡)及服务器。
背景技术
云计算环境中，需要对数量较高的用户提供服务，用于提供云服务的数据中心中的服务器的数量往往较多。每个服务器上运行多个虚拟机(英文全称：virtual machine，缩写：VM)，租户租借的虚拟机需要能够对外通信，并且与其它的虚拟机隔离。虚拟机与其他服务器上运行的虚拟机或同一服务器上的虚拟机之间通过虚拟交换机(英文全称：virtual switch，缩写：VS)通信，当前常见的虚拟交换机包括open vSwitch(OVS)。软件定义网络(英文全称：software defined networking，缩写：SDN)控制器通常通过OpenFlow协议定义的流表(英文全称：flow table)对各个虚拟交换机进行控制。
每个服务器上的硬件资源至少需要支持运行多个VM、虚拟交换机以及虚拟机监视器(英文全称：virtual machine monitor，缩写：VMM)，虚拟机监视器又称为虚拟机管理器(英文全称：virtual machine manager，缩写：VMM)或管理程序(英文全称：hypervisor)。每台服务器的硬件资源有限，如果负担了数据交换任务的虚拟交换机占用的硬件资源太多，则容易影响服务器上VM的运行，降低工作效率。
发明内容
有鉴于此，本申请公开了一种数据处理方法、网络接口卡及服务器。根据与数据包关联的多个流表项的动作域，生成一个会话表项的动作域，并将对数据包的处理功能卸载到网络接口卡实现。
第一方面，本申请提供了一种服务器，服务器包含主机和网络接口卡，主机上运行有虚拟机和虚拟交换机。网络接口卡通过主机接口与主机相连，通过网络接口与外部网络相连。主机用于接收网络接口卡发送的第一数据包，根据第一数据包携带的匹配信息获取与第一数据包关联的至少两个流表项。主机还用于根据该至少两个流表项生成处理信息，并通过主机接口向网络接口卡发送该处理信息，该处理信息用于指示虚拟交换机根据该至少两个流表项对第一数据包的处理操作。网络接口卡用于根据处理信息生成第一会话表项的动作域，还用于根据第一数据包的匹配信息生成第一会话表项的匹配域，其中，第一会话表项用于记录网络接口卡处理与第一会话表项匹配的数据包的规则。
其中第一数据包可以为网络接口卡通过主机接口从虚拟机接收的数据包或通过网络接口从外部网络接收的数据包。
服务器根据与数据包关联的至少两个流表项的动作域，生成一个会话表项的动作域，并将对数据包的处理功能卸载到网络接口卡实现，从而节省了主机的硬件资源。
根据第一方面，在第一方面第一种可能的实现方式中，网络接口卡还用于接收第二数据包，根据匹配信息查询与第二数据包匹配的第一会话表项，并根据第一会话表项的动作域处理第二数据包。其中，第二数据包与第一数据包属于相同的数据流，具有相同的匹配信息。
网络接口卡只需要查询与数据包匹配的一个会话表项，就可以实现对数据包的处理操作，从而简化了数据包处理流程。
根据第一方面或第一方面第一种可能的实现方式，在第一方面第二种可能的实现方式中，主机接收网络接口卡发送的第一数据包之前，网络接口卡还用于接收第一数据包，根据匹配信息查询记录的会话表项，并在没有查询到与第一数据包匹配的会话表项时，将第一数据包发送给主机。
网络接口卡维护有一个会话表。不同的数据流具有不同的匹配信息，且不同的数据流可能有不同的处理方式，每一个会话表项对应一个数据流。网络接口卡接收到数据包后，会根据数据包携带的匹配信息查询会话表。如果找到了与数据包匹配的会话表项，则根据会话表项动作域记载的信息处理该数据包。如果没有查询到与数据包对应的会话表项，则该第一数据包为该第一数据包所在的数据流的首个数据包，或该第一数据包不是该数据流的首个数据包，但该数据流对应的会话表项在会话表中已经被删除，数据接口卡将第一数据包上报给主机上运行的虚拟交换机处理。
根据第一方面或第一方面以上任一种可能的实现方式，在第一方面第三种可能的实现方式中，网络接口卡还用于查询与第一数据包匹配的安全组规则，并将安全组规则写入第一会话表项的动作域。
安全组规则用于实现安全过滤规则，将安全组规则也卸载到网络接口卡上，网络接口卡可以根据该第一会话表项对匹配的数据包进行多项处理，从而简化了数据包的处理流程。
根据第一方面第三种可能的实现方式，在第一方面第四种可能的实现方式中，主机配置有安全组功能；主机还用于查询与第一数据包匹配的安全组规则，并向网络接口卡发送第一数据包匹配的安全组规则。
如果安全组规则配置在主机上，则主机可以根据第一数据包的匹配信息查询第一数据包的安全组规则，并将第一数据包的安全组规则通过主机接口传递给网络接口卡。
根据第一方面第三种或第四种可能的实现方式，在第一方面第五种可能的实现方式中，如果安全组规则包含正反向允许通过的防火墙规则，网络接口卡还用于创建第二会话表项，并根据第一数据包的匹配信息生成第二会话表项的匹配域，第二会话表项为与第一数据包的反方向数据流匹配的会话表项。
第二会话表项的动作域可以设置为上传主机或者设置为空，后续会根据虚拟交换机对反向数据包的实际处理更新第二会话表的动作域，第一会话表项和第二会话表项也可以合并成一条记录，动作域区分正向和反向2个域，例如可以设定VM发出方向为正向，网络侧过来的方向为反向，查反向表时交换源节点信息和目的节点信息。
根据第一方面或第一方面以上任一种可能的实现方式，在第一方面第六种可能的实现方式中，主机还用于在修改至少两个流表项中的一个流表项后，向网络接口卡发送修改指令，修改指令用于指示主机对至少两个流表项中的一个流表项的修改操作；网络接口卡还用于根据修改指令修改第一会话表项。
服务器可以根据链表技术把会话表项链接到虚拟交换机的流表项，当虚拟交换机的 的表项删除或修改的时候，主机会通知网络接口卡去同步删除或者修改会话表。
根据第一方面或第一方面以上任一种可能的实现方式，在第一方面第七种可能的实现方式中，若第一会话表项在超过预设时间阈值的时间段内未被访问，网络接口卡还用于删除第一会话表项。
因为网络接口卡的存储空间有限，或者分配给会话表的存储空间有限，当一个会话表项长时间未被访问时，则启动老化机制，即将一段时间未被访问的会话表项删除，从而节省存储空间。
根据第一方面第七种可能的实现方式，在第一方面第八种可能的实现方式中，网络接口卡删除第一会话表项后，还用于向主机发送删除指令；主机还用于根据删除指令删除至少两个流表项。
根据流表的老化机制，长时间不访问的流表项将会自动老化，流表项老化后，会话表项就会跟着删除，这样的话，会话表就不断的要重新创建、删除。主机可以对流表的老化进行设置，可以设置很长的老化时间或者不老化。当会话表项老化(即被删除)后，就可以通知主机将与会话表项对应的流表项进行老化。
第二方面，本申请提供了一种数据处理方法，服务器包含运行有虚拟交换机的主机和网络接口卡，该方法包括：主机接收网络接口卡发送的第一数据包，获取与第一数据包关联的至少两个流表项，根据至少两个流表项生成处理信息，并向网络接口卡发送处理信息。网络接口卡根据处理信息生成第一会话表项的动作域，并根据第一数据包的匹配信息生成第一会话表项的匹配域。第一会话表项用于记录网络接口卡处理与第一会话表项匹配的数据包的规则。
根据第二方面，在第二方面第一种可能的实现方式中，该方法还包括：网络接口卡接收第二数据包，第二数据包与第一数据包具有相同的匹配信息。网络接口卡根据匹配信息查询与第二数据包匹配的第一会话表项，并根据第一会话表项的动作域处理第二数据包。
根据第二方面或第二方面第一种可能的实现方式，在第二方面第二种可能的实现方式中，主机接收网络接口卡发送的第一数据包之前，该方法还包括：网络接口卡接收第一数据包，根据匹配信息查询记录的会话表项，并在没有查询到与第一数据包匹配的会话表项时，将第一数据包发送给主机。
根据第二方面或第二方面以上任一种可能的实现方式，在第二方面第三种可能的实现方式中，该方法还包括：网络接口卡查询与第一数据包匹配的安全组规则，并将安全组规则写入第一会话表项的动作域。
根据第二方面第三种可能的实现方式，在第二方面第四种可能的实现方式中，主机配置有安全组功能；该方法还包括：主机查询与第一数据包匹配的安全组规则，并向网络接口卡发送第一数据包匹配的安全组规则。
根据第二方面第三种或第四种可能的实现方式，在第二方面第五种可能的实现方式中，如果安全组规则包含正反向允许通过的防火墙规则，该方法还包括：网络接口卡创建第二会话表项，并根据第一数据包的匹配信息生成第二会话表项的匹配域，第二会话表项为与第一数据包的反方向数据流匹配的会话表项。
根据第二方面或第二方面以上任一种可能的实现方式，在第二方面第六种可能的实现方式中，该方法还包括：主机在修改至少两个流表项中的一个流表项后，向网络接口卡发送修 改指令。修改指令用于指示主机对至少两个流表项中的一个流表项的修改操作。网络接口卡根据修改指令修改第一会话表项。
根据第二方面或第二方面以上任一种可能的实现方式，在第二方面第七种可能的实现方式中，该方法还包括：若第一会话表项在超过预设时间阈值的时间段内未被访问，网络接口卡删除第一会话表项。
根据第二方面第七种可能的实现方式，在第二方面第八种可能的实现方式中，网络接口卡删除第一会话表项后，方法还包括：网络接口卡向主机发送删除指令；主机根据删除指令删除至少两个流表项。
第二方面或第二方面任一种可能的实现方式为第一方面或第一方面任一种可能的服务器实现方式对应的方法，第一方面或第一方面任一种可能的实现方式中的描述对应适用于第二方面或第二方面任一种可能的实现方式，在此不再赘述。
第三方面，本发明提供了一种数据处理方法，该方法包括：网络接口卡向主机发送第一数据包。网络接口卡接收来自主机的处理信息，处理信息用于指示主机根据与第一数据包匹配的至少两个流表项对第一数据包的处理操作。网络接口卡根据处理信息生成第一会话表项的动作域，并根据第一数据包的匹配信息生成第一会话表项的匹配域。第一会话表项用于记录网络接口卡处理与第一会话表项匹配的数据包的规则。
根据第三方面，在第三方面第一种可能的实现方式中，该方法还包括：网络接口卡接收第二数据包，第二数据包与第一数据包具有相同的匹配信息。网络接口卡根据匹配信息查询与第二数据包匹配的第一会话表项，并根据第一会话表项的动作域处理第二数据包。
根据第三方面或第三方面第一种可能的实现方式，在第三方面第二种可能的实现方式中，该方法包括：网络接口卡接收第一数据包，根据匹配信息查询记录的会话表项，并在没有查询到与第一数据包匹配的会话表项时，将第一数据包发送给主机。
根据第三方面或第三方面以上任一种可能的实现方式，在第三方面第三种可能的实现方式中，该方法还包括：网络接口卡查询与第一数据包匹配的安全组规则，并将安全组规则写入第一会话表项的动作域。
根据第三方面第三种可能的实现方式，在第三方面的第四种可能的实现中，如果安全组规则包含正反向允许通过的防火墙规则，该方法还包括：网络接口卡创建第二会话表项，并根据第一数据包的匹配信息生成第二会话表项的匹配域，第二会话表项为与第一数据包的反方向数据流匹配的会话表项。
根据第三方面或第三方面以上任一种可能的实现方式，在第三方面第五种可能的实现方式中，该方法还包括：网络接口卡接口卡接收来自主机的修改指令，修改指令用于指示主机对至少两个流表项中的一个流表项的修改操作；网络接口卡根据修改指令修改第一会话表项。
根据第三方面或第三方面以上任一种可能的实现方式，在第三方面第六种可能的实现方式中，该方法还包括：若第一会话表项在超过预设时间阈值的时间段内未被访问，网络接口卡删除第一会话表项。
根据第三方面第六种可能的实现方式，在第三方面的第七种可能的实现中，网络接口卡删除第一会话表项后，方法还包括：网络接口卡向主机发送删除指令，删除指令用于指示主机删除至少两个流表项。
第三方面或第三方面任一种可能的实现方式为第一方面或第一方面任一种可能的服务器 实现方式对应的网络接口卡侧方法，第一方面或第一方面任一种可能的实现方式中的描述对应适用于第三方面或第三方面任一种可能的实现方式，在此不再赘述。
第四方面，本发明提供了一种网络接口卡，该网络接口卡包括：发送单元，用于向主机发送第一数据包；接收单元，用于接收来自主机的处理信息，处理信息用于指示主机根据与第一数据包匹配的至少两个流表项对第一数据包的处理操作；处理单元，用于根据处理信息生成第一会话表项的动作域，并根据第一数据包的匹配信息生成第一会话表项的匹配域，第一会话表项用于记录网络接口卡处理与第一会话表项匹配的数据包的规则。
根据第四方面，在第四方面第一种可能的实现方式中，接收单元还用于接收第二数据包，第二数据包与第一数据包具有相同的匹配信息；处理单元还用于根据匹配信息查询与第二数据包匹配的第一会话表项，并根据第一会话表项的动作域处理第二数据包。
根据第四方面或第四方面第一种可能的实现方式，在第四方面第二种可能的实现方式中，发送单元向主机发送第一数据包之前，接收单元还用于接收第一数据包；处理单元还用于根据匹配信息查询记录的会话表项；发送单元还用于在处理单元没有查询到与第一数据包匹配的会话表项时，将第一数据包发送给主机。
根据第四方面或第四方面以上任一种可能的实现方式，在第四方面第三种可能的实现方式中，处理单元还用于查询与第一数据包匹配的安全组规则，并将安全组规则写入第一会话表项的动作域。
根据第四方面第三种可能的实现方式，在第四方面的第四种可能的实现中，如果安全组规则包含正反向允许通过的防火墙规则，处理单元还用于创建第二会话表项，并根据第一数据包的匹配信息生成第二会话表项的匹配域，第二会话表项为与第一数据包的反方向数据流匹配的会话表项。
根据第四方面或第四方面以上任一种可能的实现方式，在第四方面第五种可能的实现方式中，接收单元还用于接收来自主机的修改指令，修改指令用于指示主机对至少两个流表项中的一个流表项的修改操作；处理单元还用于根据修改指令修改第一会话表项。
根据第四方面或第四方面以上任一种可能的实现方式，在第四方面第六种可能的实现方式中，若第一会话表项在超过预设时间阈值的时间段内未被访问，处理单元还用于删除第一会话表项。
根据第四方面第六种可能的实现方式，在第四方面的第七种可能的实现中，处理单元删除第一会话表项后，还用于向主机发送删除指令，删除指令用于指示主机删除至少两个流表项。
第四方面或第四方面任一种可能的实现方式为第一方面或第一方面任一种可能的服务器实现方式对应的网络接口卡，第一方面或第一方面任一种可能的实现方式中的描述对应适用于第四方面或第四方面任一种可能的实现方式，在此不再赘述。
第五方面，本发明提供了一种网络接口卡，包括：主机接口、处理器、存储器；主机接口用于连接主机；处理器用于通过主机接口向主机发送第一数据包；主机接口还用于通过主机接口接收来自主机的处理信息，处理信息用于指示主机根据与第一数据包匹配的至少两个流表项对第一数据包的处理操作；处理器还用于根据处理信息生成第一会话表项的动作域，并根据第一数据包的匹配信息生成第一会话表项的匹配域，第一会话表项用于记录网络接口卡处理与第一会话表项匹配的数据包的规则；存储器用于存储第一会话表项。
根据第五方面，在第五方面第一种可能的实现方式中，网络接口卡还包括网络接口，网络接口用于连接外部网络；处理器还用于通过主机接口或网络接口接收第二数据包，第二数据包与第一数据包具有相同的匹配信息；处理器还用于根据匹配信息查询与第二数据包匹配的第一会话表项，并根据第一会话表项的动作域处理第二数据包。
根据第五方面或第五方面第一种可能的实现方式，在第五方面第二种可能的实现方式中，网络接口卡还包括网络接口，网络接口用于连接外部网络；处理器通过主机接口向主机发送第一数据包之前，还用于通过主机接口或网络接口接收第一数据包，根据匹配信息查询记录的会话表项，并在没有查询到与第一数据包匹配的会话表项时，将第一数据包发送给主机。
根据第五方面或第五方面以上任一种可能的实现方式，在第五方面第三种可能的实现方式中，处理器还用于查询与第一数据包匹配的安全组规则，并将安全组规则写入第一会话表项的动作域。
根据第五方面第三种可能的实现方式，在第五方面的第四种可能的实现中，如果安全组规则包含正反向允许通过的防火墙规则，处理器还用于创建第二会话表项，并根据第一数据包的匹配信息生成第二会话表项的匹配域，第二会话表项为与第一数据包的反方向数据流匹配的会话表项。
根据第五方面或第五方面以上任一种可能的实现方式，在第五方面第五种可能的实现方式中，处理器还用于通过主机接口接收来自主机的修改指令，修改指令用于指示主机对至少两个流表项中的一个流表项的修改操作；处理器还用于根据修改指令修改第一会话表项。
根据第五方面或第五方面以上任一种可能的实现方式，在第五方面第六种可能的实现方式中，若第一会话表项在超过预设时间阈值的时间段内未被访问，处理器还用于删除第一会话表项。
根据第五方面第六种可能的实现方式，在第五方面的第七种可能的实现中，处理器删除第一会话表项后，还用于通过主机接口向主机发送删除指令，删除指令用于指示主机删除至少两个流表项。
第五方面或第五方面任一种可能的实现方式为第一方面或第一方面任一种可能的服务器实现方式对应的网络接口卡，第一方面或第一方面任一种可能的实现方式中的描述对应适用于第五方面或第五方面任一种可能的实现方式，在此不再赘述。
根据本申请公开的技术方案，数据包的处理过程中的一部分运行压力被转移到了网络接口卡上，而网络接口卡作为一个硬件设备，不仅处理效率高，并且其运行无需占用硬件层的其他资源。且本申请将虚拟交换机根据多个流表项对数据处理的处理信息记录在一个会话表项中，网络接口卡只需要一个会话表项就可以实现对匹配数据包的处理，简化了处理流程。
附图说明
图1为一种数据中心架构的示意图；
图2为一种服务器的组织结构示意图；
图3为依据本发明一实施例的服务器的组织结构示意图；
图4为依据本发明一实施例的服务器的硬件结构示意图；
图5为为依据本发明一实施例的数据包处理方法的流程示意图
图6为依据本发明一实施例的服务器的组织结构示意图；
图7为依据本发明一实施例的数据包处理方法的流程示意图；
图8为依据本发明一实施例的网络接口卡的逻辑结构示意图；
图9为依据本发明一实施例的网络接口卡的硬件结构示意图。
具体实施方式
下面将结合附图，对本发明实施例进行描述。
本发明实施例采用术语第一和第二等来区分各个对象，例如第一数据包和第二数据包等，但各个“第一”和“第二”之间不具有逻辑或时序上的依赖关系。
在本发明实施例中，数据包由匹配信息和载荷(英文全称：payload)构成。其中，匹配信息用于与流表或者会话表的匹配域进行匹配。
在本发明实施例中，服务器上的硬件层设置有网络接口卡，处理器，输入/输出设备以及存储设备。服务器除网络接口卡之外的部分称之为主机。
在本发明实施例中，虚拟交换机为运行在服务器的主机上的，通过软件实现的交换设备，常用于SDN中。常见的虚拟交换机包括OVS。
在本发明实施例中，流表用于在SDN中控制数据流，也可以称为SDN流表，具体可以采用符合OpenFlow协议的流表或符合其他协议的流表。流表的流表项包括匹配域和动作域，该匹配域用于与数据包进行匹配，该动作域用于指示虚拟交换机根据匹配结果对数据包进行处理。动作域可以包含对匹配数据包的处理信息，例如转发、丢弃、上送SDN控制器等，还可以包含数据包的路由信息，例如数据包的目的端口标识等。在本发明实施例中，流表的动作域可以包含OpenFlow协议支持的任意动作，本发明对此不进行限定。
在本发明实施例中，虚拟交换机可访问的流表集合包含至少两个流表，虚拟交换机使用根据流表集合中的流表对数据包进行处理。具体的，一个数据包可能与多个流表中的多个流表项关联，虚拟交换机接收到网络接口卡发送的数据包后，可以查询与该数据包关联的多个流表项，并根据该多个流表项依次对该数据包进行处理。
在本发明实施例中，会话表用于网络接口卡(英文全称：network interface card，缩写：NIC)控制数据流。会话表的会话表项包括匹配域和动作域，匹配域用于匹配数据包，动作域用于指示网络接口卡对匹配上的数据包进行处理。会话表项的动作域是根据与数据包关联的多个流表项的动作域生成的。
在本发明实施例中，流表集合一般存储于服务器的存储设备中，会话表可以存储于服务器的存储设备中，也可以存储于网络接口卡内部的存储设备中。若流表集合和会话表均存储于服务器的存储设备中，服务器在其存储设备中为流表集合和会话表分别开辟一块存储空间。本发明实施例中，以会话表存储于网络接口卡内部为例进行介绍，本领域技术人员可以直接推导出会话表存储于服务器的存储设备的情况。
在本发明实施例中，数据流(英文全称：data flow)指示携带相同的匹配信息的一系列数据包。具体的，同一数据流中的数据包的匹配信息，均可以匹配上该数据流对应的流表项的匹配域或会话表项的匹配域。
在本发明实施例中，示例性的采用了SR-IOV(英文全称：single-root I/O virtualization)的网络接口卡与VM直连的技术，在实际使用中也可以采用其他支持网络接口卡与VM直连的技术。
在本发明实施例中，与数据包关联的流表项是指虚拟交换机对该数据包处理的流程中需要使用的流表项。该流表项可以具体为OVS转发流表项。例如，虚拟交换机首先根据数据包1的匹配信息在流表1中查询与该数据包1匹配的流表项1，并根据流表项1动作域记录的信息对该数据包1进行处理操作得到数据包2，然后再根据数据包2的匹配信息在流表2中查询与该数据包2匹配的流表项2，并根据流表项2动作域记录的信息对该数据包2进行处理操作，则流表项1和流表项2都是与数据包1关联的数据包。其中，如果虚拟交换机根据流表项1动作域记录的信息对数据包1进行了修改操作，则数据包2与数据包1是不同的，如果虚拟交换机没有根据流表项1对数据包1进行修改操作，则数据包2与数据包1是相同的。
数据中心中每个服务器上的硬件资源需要支持运行多个虚拟机、虚拟交换机以及虚拟机监视器。每台服务器的硬件资源有限，如果负担了数据交换任务的虚拟交换机占用的硬件资源太多，则容易影响服务器上虚拟机的运行，降低工作效率。为了减轻服务器硬件的负担，可以将虚拟交换机的业务卸载到网络接口卡上来实现。
在OpenFlow协议中，虚拟交换机的功能非常灵活，对数据包的不同处理操作被记录在不同的流表项中，虚拟交换机维护有与数据包关联的多个流表项。由于硬件很难实现大规模的支持掩码匹配的流表，并且多个流表的查找也很影响性能。如果将虚拟交换机上的业务直接卸载到网络接口卡上，例如将虚拟交换机的流表直接复制到网络接口卡，则大量的流表会导致网络接口卡负载过大，达不到优化的目的。
本发明实施例中，根据与数据包关联的多个流表项的动作域，合并一个会话表项的动作域，并将对数据包的处理功能卸载到网络接口卡实现。网络接口卡只需要查询与数据包匹配的一个会话表项，就可以实现对数据包的处理操作，从而节约了服务器的硬件资源，且简化了对数据包的处理流程。
图1为依据本发明一实施例的SDN架构的示意图，图1中示意性的采用了集中式的SDN控制器，实际中SDN控制器也可以分布式的部署于各个服务器。
每个主机运行时，其硬件层支持软件层内的虚拟交换机以及多个虚拟机的运行。每个服务器内的主机和网络接口卡建立通信连接，主机通过网络接口卡与外部网络通信，例如，首先由网络接口卡从外部网络获取数据包，然后发送至主机上运行的VM，而该主机上运行的VM发往外部网络的数据包也会发送至网络接口卡，通过网络接口卡发送至外部网络。
下面以服务器200和服务器300为例，展示虚拟交换机的功能是否卸载到网络接口卡对数据处理流程的影响。
如图2，如果不将虚拟交换机的功能卸载到网络接口卡，服务器200内的网络接口卡从外部网络接收到数据包后，如果判断该数据包的目的地属于服务器200，则将该数据包发送至虚拟交换机，则由虚拟交换机将该数据包与流表集合中的流表进行匹配，并根据匹配上的流表项的指示，将该数据处理后发送至与该虚拟交换机相连的目的VM。
由以上数据包的处理流程可见，数据处理过程中主要的运行压力集中在虚拟交换机上，而虚拟交换机的运行依赖于服务器上的硬件层的资源，虚拟交换机占用的处理器和存储设备资源越多，服务器上能够用于VM运行的资源就越少，而如果限定虚拟交换机能够占用的硬件层的资源的上限，那么随着数据包流量的增大，虚拟交换机的性能将难以保证。
如图3，本发明实施例提供的数据处理流程中，服务器300内的网络接口卡从外部网络 接收到数据包后，如果判断该数据包的目的VM运行于服务器300上，则在会话表中查找与该数据包匹配的会话表项，并根据该数据包匹配的会话表项的指示，将该数据处理后发送至与该网络接口卡相连的目的VM。
会话表项的动作域来源于与数据包匹配的多个流表项的动作域的结合。如果网络接口卡未查询到与接收到的数据包匹配的会话表项，就会将该数据包发送至虚拟交换机，虚拟交换机查询与该数据包匹配的多个流表项，根据查询到的多个流表项处理该数据包，并向网络接口卡发送根据与该数据包匹配的流表项生成的处理信息。
如果虚拟交换机查询不到与该数据包匹配的流表项，则向SDN控制器请求获取该数据包对应的流表项，并根据从SDN控制器获取到的多个流表项处理该数据包，并向网络接口卡发送根据获取的流表项生成的处理信息。
网络接口卡根据该处理信息生成与该数据包的匹配信息匹配的一个会话表项的动作域，以供后续的使用。
由以上数据包的处理流程可见，在本申请提供的数据处理流程中，数据包的处理过程中的一部分运行压力被转移到了网络接口卡上，而网络接口卡作为一个硬件设备，不仅处理效率高，并且其运行无需占用硬件层的其他资源。且本申请将虚拟交换机根据多个流表项对数据处理的处理信息记录在一个会话表项中，简化了处理流程，网络接口卡只需要一个会话表项就可以实现对匹配数据包的处理。
需要说明的是，示意性的，图3中的服务器300上的所有VM都可以与网络接口卡相连，实际上也可以只有部分VM与网络接口卡相连，其他部分VM与虚拟交换机相连，具体VM的配置方式并不限定于必须全部都与网络接口卡相连。
图4为依据本发明一实施例的的服务器300的硬件结构示意图，服务器300上运行有虚拟机和虚拟交换机。
如图4所示，服务器300包括处理器301，处理器301与系统内存308连接。处理器301可以为中央处理器(CPU)，图像处理器(英文全称：graphics processing unit，缩写：GPU)，数字信号处理器(英文全称：digital signal processor，缩写：DSP)或其他形式的集成电路。
服务器300还包括网络接口卡303，网络接口卡303用于实现服务器300上虚拟机与外部网络的通信。
总线307用于在服务器300的各部件之间传递信息，总线307可以使用有线的连接方式或采用无线的通讯方式，本申请并不对此进行限定。总线307还可以连接有输入/输出接口304，辅助存储器(英文：secondary storage)305和通信接口306。
输入/输出接口304连接有输入/输出设备，用于接收输入的信息，输出操作结果。输入/输出设备可以为鼠标、键盘、显示器、或者光驱等。
辅助存储器305的存储介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如光盘)、或者半导体介质(例如固态硬盘(英文全称：solid state disk，缩写：SSD))等。
通信接口306使用例如但不限于收发器一类的收发装置，来实现与其他设备或通信网络之间的通信，通信接口306可以通过有线或者无线的形式与通信网络互连。该通信网络可以是因特网，内联网(英文:intranet)，局域网(英文全称：local area network，缩写：LAN)，广域网络(英文全称：wide area network，缩写：WAN)，存储区域网络(英文全称：storage  area network，缩写：SAN)等，或者以上网络的任意组合。
本发明实施例的一些特征可以由处理器301执行系统内存302中的软件代码来完成/支持。系统内存108可以包括一些软件，例如，操作系统(例如Darwin、RTXC、LINUX、UNIX、OS X、WINDOWS或嵌入式操作系统(例如Vxworks))，应用程序和数据处理模块。
工作状态下，服务器运行了至少一个VM以及虚拟交换机。用于实现本发明实施例提供的数据处理方法中主机侧的方法的程序代码保存在系统内存302中，并由处理器301执行。工作状态下，网络接口卡执行本发明实施例提供的数据处理方法中网络接口卡侧的方法。
本申请还提供了一种数据处理方法，前述SDN架构中的服务器运行时执行该方法，其流程示意图如图5所示。
图5为依据本发明一实施例的一种数据处理方法500的流程图，前述服务器300运行时执行方法500，如图5所示，方法500包括：
S502：网络接口卡接收第一数据包。
其中，第一数据包携带第一数据包的匹配信息和载荷。该第一数据包可以为服务器上运行的虚拟机向外部网络发送的数据包或由外部网络发送给该服务器上运行的虚拟机的数据包。
可选的，在步骤S502之前，方法500还包括配置虚拟机与网络接口卡互联的端口。本发明实施例中，网络接口卡通过网络接口卡端口与虚拟机互联，一个网络接口卡端口可以通过SR-I/OV技术与主机上运行的一个VM连接,网络接口卡端口可以为SR-I/OV技术定义的虚拟功能(英文全称：virtual function，缩写：VF)的端口。在本发明实施例中，网络接口卡还可以使用其他技术与虚拟机互联，本发明实施例不对网络接口卡与虚拟机互联的技术进行限定。网络接口卡还可以为支持虚拟机设备队列(英文全称：Virtual Machine Device Queues，缩写：VMDq)功能的网络接口卡。服务器配置虚拟机与网络接口卡互联的端口可以包括：
S5001：服务器的主机根据虚拟交换机端口的配置信息，在虚拟交换机上建立至少一个虚拟交换机端口，每个虚拟交换机端口对应该主机上运行的一个VM。
S5002：该主机生成网络接口卡端口的配置信息，并将该网络接口卡端口的配置信息发送至服务器的网络接口卡。
具体的，该主机获取该虚拟交换机端口的配置信息，将该虚拟交换机端口的配置信息发送至该主机上运行的网络接口卡驱动，该网络接口卡驱动根据该虚拟交换机端口的配置信息，生成网络接口卡端口的配置信息，并发送至该网络接口卡。该虚拟交换机端口的配置信息与该网络接口卡端口的配置信息的功能类似，该网络接口卡驱动将虚拟交换机端口的配置信息转换为网络接口卡端口的配置信息主要为了符合网络接口卡驱动与网络接口卡通信的规范。
S5003：该网络接口卡根据该网络接口卡端口的配置信息，在该网络接口卡上配置至少一个网络接口卡端口，每个网络接口卡端口与该主机上运行的一个VM连接。
网络接口卡端口具体可以为SR-I/OV技术定义的虚拟功能(英文全称：virtual function，缩写：VF)的端口。
具体的架构图如图6所示，虚拟交换机的每一个端口与网络接口卡的一个VF相对应，网络接口卡通过VF与虚拟机互联。
S5001-S5003为可选步骤，且S5001-S5003为该虚拟交换机和该网络接口卡的配置过程，无须每次执行S5001-S5003的后续步骤前都执行一次S5001-S5003。通过该配置过程，主机上运行的VM通过网络接口卡端口与网络接口卡连接。
由于VS端口与VM一一对应，同时VM与网络接口卡端口一一对应，因此VS端口与网络接口卡端口一一对应。在S5001-S5003的执行过程中将VS端口与网络接口卡端口的对应关系存入该虚拟交换机和/或将VS端口与网络接口卡端口的对应关系存入该网络接口卡。
可选的，方法500还包括配置该虚拟交换机与该网络接口卡通信的至少一个队列，用于该虚拟交换机将从网络接口卡接收到的数据包返回给该网络接口卡。队列的配置有多种形式，例如，该虚拟交换机与该网络接口卡通过一个队列通信，该虚拟交换机将需要发往该网络接口卡的全部数据包发送至该队列，再例如，该虚拟交换机与该网络接口卡通过n个队列通信，n为该主机上运行的VM的数量，每一个队列与一个VM对应。本发明实施例并不限定队列的配置形式。
S504：网络接口卡根据第一数据包的匹配信息在会话表中查找是否有与该第一数据包匹配的会话表项。如果存在与第一数据包匹配的会话表项，则执行步骤S506；如果不存在与第一数据包匹配的会话表项，则执行步骤S508。
会话表项包括匹配域和动作域，匹配域用于与数据包的匹配信息进行匹配，动作域记录的信息用于指示网络接口卡对与该会话表项匹配的数据包进行处理。数据包的匹配信息可以包含数据包的源信息和/或数据包的目的信息。其中源信息和目的信息可以包含互联网协议(英文全称：Internet Protocol，缩写：IP)地址，媒体接入控制地址(英文全称：Media Access Control，缩写：MAC)，端口编号(例如，传输控制协议(英文全称：Transmission Control Protocol，缩写TCP)端口，用户数据报协议(英文全称：User Datagram Protocol，缩写：UDP)端口)，或者其他类似的用来标识数据的源和目的的信息。
通常可以使用IP五元组(源IP+源端口+协议类型+目的IP+目的端口)，或者IP三元组(源IP+目的IP+协议类型)来标识一个数据包的匹配信息，匹配信息也可以包含IP报文所属的其它特征项，例如入接口、虚拟局域网(英文全称：Virtual Local Area Network，缩写：VLAN)、租户ID、甚至MAC地址等。
在本发明的一个实施例中,当系统里面同时存在多种协议的情况下，不同类型的协议配置的地址可能相同，比如VM1属于IPV4协议，VM2属于IPV6协议，这时候他们两个可能存在IP地址相同的情况，就需要增加协议类型信息来区分IP地址是属于VM1还是VM2，即数据报文是什么协议传输过来的。例如，可以通过添加IP协议(IPV4，IPV6)或TCP协议等来标识一个会话。
在本发明施例的实现过程中，当配置网络接口卡只做交换功能，会话表构建时可以使用MAC信息。当配置网络接口卡做路由功能，那么会话表构建时可以使用MAC信息、IP信息和三层协议类型。当配置网络接口卡做更高层网络功能(防火墙、网络地址转换(英文全称：Network Address Translation，缩写：NAT)等)，则会话表构建时可以使用MAC，IP，端口和三、四层协议类型。
在本发明实施例中，会话表项的匹配域记录的信息可以为与该会话表项匹配的数据包携带的匹配信息的字段或部分字段。会话表项的匹配域记录的信息也可以为根据数据包携带的匹配信息的字段或部分字段处理之后的信息，例如，会话表项的匹配域记录的信息可以为该会话表项匹配的数据包携带的匹配信息的哈希运算结果。本发明实施例不对会话表项的匹配域与数据包携带的匹配信息之间的对应关系进行限定。
当网络接口卡收到数据包之后，会根据数据包携带的匹配信息去查询会话表，具体可以根据匹配信息中携带的字段去查询会话表项，或者根据匹配信息携带的字段处理之后的结果(例如，哈希运算)去查询会话表项。
如果该第一数据包的匹配信息无法匹配会话表的任何一个会话表项，则该第一数据包为该第一数据包所在的数据流的首个数据包，或该第一数据包不是该数据流的首个数据包，但该数据流对应的会话表项在会话表中已经被删除。
S506：网络接口卡根据与第一数据包匹配的会话表项处理第一数据包。
更具体的，网络接口卡根据与第一数据包匹配的会话表项的动作域记录的信息处理该第一数据包。
如果会话表中存在与第一数据包匹配的会话表项，则网络接口卡接收到数据包后可以直接根据会话表项的动作域对数据包进行处理，不需要将数据包上报给虚拟交换机处理，从而简化了数据处理流程，且减小了虚拟交换机对服务器硬件资源的占用。
S508：网络接口卡查询安全组规则是否允许第一数据包通过。如果安全组规则允许第一数据包通过，则执行步骤S512；如果安全组规则不允许第一数据包通过，则执行步骤S510。
在S508之前，方法500还可以包括：网络接口卡创建与第一数据包匹配的第一会话表项，并根据第一数据包的匹配信息创建与第一数据包匹配的第一会话表项的匹配域，网络接口卡可以将第一数据包的匹配信息的部分或全部字段写入第一会话表项的匹配域，网络接口卡也可以将第一数据包的匹配信息的部分或全部字段的处理结果写入第一会话表项的匹配域，本发明实施例不对第一会话表项的匹配域的形式进行限定。第一会话表项的动作域的信息可以先为空或者为上报虚拟交换机。
具体实现过程中，可以将安全组规则建立在网络接口卡芯片内部或服务器的主机上。如果安全组规则建立在主机上，则主机查找第一数据包匹配的安全组规则后，向网络接口卡发送该第一数据包匹配的安全组规则。安全组规则用于实现安全过滤规则，从而实现主机或VM间的访问隔离。
S510：网络接口卡丢弃第一数据包。
如果安全组规则不允许第一数据包通过，则网络接口卡丢弃第一数据包。方法500还可以包括：将创建的第一会话表项删除，或者将第一会话表的老化时间设置为较短时间，让其快速老化。
S512：网络接口卡将第一数据包发送给主机。
具体的，网络接口卡将第一数据包发送给主机上运行的虚拟交换机。第一数据包在会话表中没有匹配的会话表项，而且安全组规则允许第一数据包通过，网络接口卡将第 一数据包发送给主机上运行的虚拟交换机处理。
S514：主机获取与第一数据包关联的至少两个流表项。
具体的，可以由主机上运行的虚拟交换机获取与第一数据包关联的至少两个流表项。
在OpenFlow协议中，虚拟交换机的功能非常灵活，对数据包的不同处理操作被记录在不同的流表项中，一般情况下，虚拟交换机维护有与一个数据包关联的多个流表项。在本发明实施例中，与数据包关联的流表项是指虚拟交换机对该数据处理的过程中需要使用的流表项。在本发明实施例中，从源出发到目的的传输过程中，数据包可能发生变化，但为了描述方便，本发明实施例使用第一数据包或第二数据包等术语来表述一个数据包的整个生命周期。例如，虚拟交换机根据流表项1动作域对数据包1进行了修改操作，得到了数据包2，数据包2与数据包1是不同的，在本发明实施例的描述中，仍然将数据包1和数据包2都叫做第一数据包或第二数据包。
如果不存在与第一数据包匹配的流表项，则第一数据包为该第一数据包所在的数据流的首个数据包，或该第一数据包不是该数据流的首个数据包，但该数据流对应的流表项已经被删除，则该虚拟交换机获取该第一数据包后，可以将该第一数据包或者第一数据包的匹配信息发送至SDN控制器，并接收SDN控制器根据该第一数据包生成的该数据流对应的流表项。
S516：主机根据获取的第一数据包关联的至少两个流表项处理第一数据包。
更具体的，可以由主机上运行的虚拟交换机根据获取的第一数据包关联的至少两个流表项处理第一数据包。虚拟交换机根据第一数据包关联的至少两个流表项处理第一数据包后，将处理后的数据包和处理结果转发给网络接口卡，由网络接口卡转发出去。
S518：主机向网络接口卡发送处理信息。
更具体的，可以由主机上运行的虚拟交换机向网络接口卡发送处理信息。
主机获取与所述第一数据包关联的至少两个流表项之后，根据该至少两个流表项生成处理信息，该处理信息处理信息用于指示虚拟交换机根据该至少两个流表项对第一数据包的处理操作。在本发明实施例中，如果该至少两个流表项的动作域记录的信息都是对第一数据包本身进行处理操作，则该处理信息可以为该至少两个流表项的动作域记录的信息，如果该至少两个流表项中的第一流表项的动作域记录的信息不是对第一数据包本身进行处理，例如，该第一流表项的动作域记录的信息为查找下一级流表，则处理信息中可以不携带第一流表项的动作域记录的信息。在具体实现中，处理信息可以包含该至少两个流表项的动作域记录的信息，或者为该至少两个流表项的动作域记录的信息综合后的信息。
S520：网络接口卡根据主机发送的处理信息生成第一会话表项的动作域。
该第一流会话表项包含匹配域和动作域，匹配域用于匹配第一数据包的匹配信息。第一会话表项用于指示网络接口卡处理与该第一会话表项匹配的数据包，即用于指示网络接口卡处理第一数据包所在数据流的其他数据包。
步骤S520之后，如果网络接口卡接收到第二数据包，该第二数据包与第一数据包属于同一个数据流，即第二数据包携带与第一数据包相同的匹配信息，则网络接口卡根据第二数据包携带的匹配信息查询与第二数据包匹配的第一会话表项，并根据第一会话表项处理第二数据包。更具体的，网络接口卡根据第一会话表项的动作域处理第二数据包。
可选的，方法500还包括：网络接口卡将第一数据包匹配的安全组规则写入第一会话表项的动作域。网络接口卡可以根据该第一会话表项对匹配的数据包进行多项处理，从而简化了数据包的处理流程。安全组模块如果对第一数据包的安全组规则进行了修改，还可以向网络接口卡发送修改指令，该指令用于指示安全组模块对第一数据包的安全组规则的修改，网络接口卡根据该修改指令修改第一会话表项的动作域关于安全组规则的记录。
方法500还可以包括：当安全组规则用于实现状态防火墙功能时，在该防火墙功能的处理结果是对第一数据包的源和目的正反向数据包都允许通过的情况下，网络接口卡根据第一数据包的匹配信息创建第二会话表项，并根据第一数据包的匹配信息生成第二会话表项的匹配域，第二会话表项为与第一数据包的反方向数据流匹配的会话表项，表明第一数据包的目的地址发起到源地址的报文的安全动作也是通过。
网络接口卡可以根据第一数据包的匹配信息得出第一数据包的目的到第一数据包的源的反向数据包的匹配信息，第一数据包的反向数据流的的源信息和目的信息分别为第一数据包的目的信息和源信息。第二会话表项的匹配域可以根据第一会话表项类似的方法进行配置，在此不再赘述。
第二会话表项的动作域可以设置为上传主机或者设置为空，后续会根据虚拟交换机对反向数据包的实际处理更新第二会话表的动作域，具体方案流程与下文描述中第一会话表项的动作域的配置流程类似。
第一会话表项和第二会话表项也可以合并成一条记录，动作域区分正向和反向2个域，例如可以设定VM发出方向为正向，网络侧过来的方向为反向，查反向表时交换源节点信息和目的节点信息。
可选的，方法500还包括：虚拟机虚拟交换机修改与第一数据包的匹配信息匹配的至少两个流表项中的任意一个流表项后，虚拟交换机向网络接口卡发送修改指令，该修改指令用于指示虚拟交换机对流表项的修改操作，网络接口卡根据该修改指令修改第一会话表项。
服务器可以根据链表技术把会话表项链接到虚拟交换机的流表项，当虚拟交换机的的表项删除或修改的时候，主机通知网络接口卡去同步删除或者修改会话表。
在另外一种实现方式中，每一个流表项和会话表项都有一个索引ID，主机建立流表项索引ID与会话表项索引ID的映射关系，主机监控虚拟交换机流表更新情况，当发现流表项发生了更新，就会通知网络接口卡，网络接口卡根据流表项的更新操作，对会话表项进行更新。
安全组规则的更新与流表项信息更新管理方式类似，在此不再赘述。
可选的，方法500还包括：第一会话表项在超过预设时间阈值的时间段内未被访问时，网络接口卡删除所述第一会话表项，并向所述虚拟交换机发送删除指令，虚拟交换机根据删除指令删除与第一数据包的匹配信息匹配的至少两个流表项。
因为OVS流表有老化机制，长时间不访问的流表项将会自动老化，流表项老化后，会话表项就会跟着删除，这样的话，会话表就不断的要重新创建、删除。本发明实施例中，主机可以对OVS流表的老化进行设置，可以设置很长的老化时间或者不老化。会话表项可以设置老化机制，当会话表项老化后，就可以通知OVS也将与会话表项对应的流 表项进行老化。
在本发明实施例中，为了防止TCP的SYN(英文全称：synchronous)攻击(指拼命发送建链请求的攻击)，针对TCP的建链请求，网络接口卡可以从TCP请求中识别出这是建链请求，针对这类请求先设置很短的老化时间(比如小于5秒)，表项短时间没有访问将会老化删除，让这条记录尽快删除，避免会话表被攻击。SYN攻击利用TCP协议缺陷，通过发送大量的半连接请求，耗费CPU和内存资源。一旦有新报文，会话表就会创建新的会话记录，如果不删除的话，空间会被占满，从而无法创建新的记录。
其中，SYN是TCP/IP建立连接时使用的握手信号，在客户机和服务器之间建立正常的TCP网络连接时，客户机首先发出一个SYN消息，服务器使用SYN+ACK应答表示接收到了这个消息，最后客户机再以ACK消息响应，这样在客户机和服务器之间才能建立起可靠的TCP连接，数据才可以在客户机和服务器之间传递。TCP连接完成了三次握手，连接建立状态进入稳态后，老化时间可以设置为长的老化时间(比如30分钟)。
针对UDP应用，单向报文建立会话表时设置短的老化时间，收到回应报文时改为长的老化时间。
另外，针对TCP删除链路的请求，一旦发现是删除请求，则网络接口卡可以删除会话表项，避免占用空间。
图7为依据本发明一实施例的一种数据处理方法700的流程图，前述服务器300运行时执行方法700，在方法700中网络接口卡需要根据虚拟交换机的处理信息查询第一数据包的安全组规则，如图7所示，方法700包括：
S702：网络接口卡接收第一数据包。
S704：网络接口卡根据第一数据包的匹配信息在会话表中查找是否有与该第一数据包匹配的会话表项。如果存在与第一数据包匹配的会话表项，则执行步骤S706；如果不存在与第一数据包匹配的会话表项，则执行步骤S708。
S706：网络接口卡根据与第一数据包匹配的会话表项处理第一数据包。
步骤S702-S706的具体描述参照步骤S502-S506，在此不再赘述。
S708：网络接口卡将第一数据包发送给主机。
在S708之前，方法700还可以包括：网络接口卡创建与第一数据包匹配的第一会话表项，并根据第一数据包的匹配信息创建与第一数据包匹配的第一会话表项的匹配域，网络接口卡可以将第一数据包的匹配信息的部分或全部字段写入第一会话表项的匹配域，网络接口卡也可以将第一数据包的匹配信息的部分或全部字段的处理结果写入第一会话表项的匹配域，本发明实施例不对第一会话表项的匹配域的形式进行限定。第一会话表项的动作域可以先为空或者为上报虚拟交换机。
S710：主机获取与第一数据包关联的至少两个流表项。
S712：主机根据获取的第一数据包关联的至少两个流表项处理第一数据包。
S714：主机向网络接口卡发送处理信息。
步骤S708-S714的具体描述参照步骤S512-S518，在此不再赘述。
S716：网络接口卡查询安全组规则是否允许第一数据包通过。如果安全组规则允许 第一数据包通过，则执行步骤S718；如果安全组规则不允许第一数据包通过，则执行步骤S720。
网络接口卡根据虚拟交换机发送的处理信息，查询第一数据包的安全组规则。具体实现过程中，可以将安全组规则建立在网络接口卡芯片内部或服务器的主机上。
S718：网络接口卡根据主机发送的处理信息生成第一会话表项的动作域。
步骤S718的具体描述参照步骤S520，在此不再赘述。
S720：网络接口卡丢弃第一数据包。
如果安全组规则不允许第一数据包通过，则网络接口卡丢弃第一数据包。
如果安全组规则不允许第一数据包通过，方法700还可以包括：将创建的第一会话表项删除。
方法700中，网络接口卡需要根据虚拟交换机发送的处理信息来查询第一数据包的处理信息，方法700的部分具体描述参照方法500。
参照图6的架构进行举例说明，假设数据包的匹配信息为IP五元组，VM-1的IP地址为12.5.3.1，通过VF1与网络接口卡连接，VM-1通过端口2351访问IP地址为52.5.13.5的外部服务器时。其访问流程如下：
VM的首先发起TCP的SYN报文，报文通过网络接口卡的VF1直接发到网络接口卡。
网络接口卡以IP五元组12.5.3.1：2351+TCP+52.5.13.5:80查找会话表项。对于数据流的首个数据包，网络接口卡查询不到会话表项。
网络接口卡查询安全组表，假设安全组配置规则允许12.5.3.1访问52.5.13.5。
网络接口卡将数据包发给主机，虚拟交换机查询与数据包匹配的至少两个流表项，根据至少两个流表项的处理结果是转发到外部端口NET1。
主机向网络接口卡发送处理信息，网络接口卡创建一个匹配域为12.5.3.1：2351+TCP+52.5.13.5:80的正向会话表项，正向会话表项的动作域为将数据包转发到外部网口NET1。
如果安全组规则为正反向都允许通过，网络接口卡还可以创建一个匹配域为52.5.13.5:80+TCP+12.5.3.1：2351的反向会话表项，反向会话表项的动作域为空(为空上送主机)。正向会话表项和反向会话表项也可以是一个表项，动作域区分正向区和反向区，正向为转发到外部网口,反向为空，反向查找时交换源、目的的IP地址和端口号。
为了进一步提高安全性和防攻击性，跟踪TCP状态，会话表记录SYN状态和序号(每一个TCP请求都有序号)，老化时间为短老化时间，例如3秒。同时将会话表项链接到OVS命中的流表项和安全组命中的安全组表项中，并限制OVS流表表项老化(设置为不老化，或者老化时间很长)，具体可以通过在OVS和安全组中分别建立会话表项与流表项之间的映射关系，以及会话表项与安全组表项之间的映射关系。
主机将数据包重新发给网络接口卡，网络接口卡从网络端口NET1中将数据包发送出去。
外部服务器回应SYN+ACK报文，数据包进入网络接口卡后，网络接口卡查询会话表， 命中反向会话表项，但动作域为空，网络接口卡将数据包发送给OVS进行转发处理，OVS查询流表项，确定要将数据包转发给端口1，然后网络接口卡驱动查询端口与VF的映射关系，得知端口1对应VF1，则转发结果为转发到VF1，则主机向网络接口卡发送处理信息，处理信息指示转发结果为将数据包转发到VF1，网络接口卡根据处理信息更新反向会话表项的动作域，并通过VF1将报文发给VM-1。
VM-1收到报文之后，再回一个ACK报文，带着TCP序号，然后网络接口卡判断会话表项的SYN状态和序号，如果序号匹配，则进入建立状态，将会话表项修改为长老化时间，例如30分钟。后续的TCP数据报文查询会话表都能直接得到转发结果，不再需要上送主机进行OVS转发。如果会话表项对应的流表项或者安全组规则修改或删除，则根据关联的索引关系修改或删除会话表项。如果VM-1或外部服务器发起TCP关闭操作，完成TCP的结束状态处理后，网络接口卡删除会话表12.5.3.1：2351+TCP+52.5.13.5:80的正反向表项，并通知OVS和安全组中分别删除会话表项与流表项之间的映射关系，以及会话表项与安全组表项之间的映射关系，并重新允许该OVS流表表项老化。
实现过程中，网络接口卡接收到数据包后，如果没有查找到对应的会话表项，也可以先将数据包上报给OVS，然后根据OVS发送的处理信息查找安全表规则，例如，如果处理结果为将数据包转发VF1，网络接口卡查询VF1下配置的安全组规则，发现是禁止通过，则丢弃报文，删除所建的会话表项。如果不需要针对VM接口来进行安全组检查，则可以先查安全组表，如果不通过直接丢弃，不再上送主机进行OVS转发。
图8为依据本发明一实施例的网络接口卡800的硬件结构示意图，如8所示，网络接口卡800包括：处理器802，存储器804，网络接口806，主机接口808和总线8100。
主机接口808用于连接主机。
处理器802用于通过主机接口808向主机发送第一数据包，通过主机接口808接收来自主机的处理信息，处理信息用于指示主机根据与第一数据包匹配的至少两个流表项对第一数据包的处理操作，并根据处理信息生成第一会话表项的动作域，并根据第一数据包的匹配信息生成第一会话表项的匹配域，第一会话表项用于记录网络接口卡处理与第一会话表项匹配的数据包的规则。
本发明实施例中的处理器802可以为任意形式的处理逻辑，例如，处理器802可以为可以为中央处理器，图像处理器，数字信号处理器(英文全称：digital signal processor，缩写：DSP)或其他形式的集成电路。
处理器802的功能可以由硬件的集成电路来实现，也可以由处理器执行存储器804中存储的代码来实现，本发明对此不进行限定。
存储器804用于存储第一会话表项。
网络接口卡还包括网络接口806，网络接口806用于连接外部网络，处理器802还用于通过主机接口808或网络接口806接收第二数据包，第二数据包与第一数据包具有相同的匹配信息，802还用于根据匹配信息查询与第二数据包匹配的第一会话表项，并根据第一会话表项的动作域处理第二数据包。
处理器802通过主机接口808向主机发送第一数据包之前，还用于通过主机接口808或网络接口806接收第一数据包，根据匹配信息查询记录的会话表项，并在没有查询到与第一数据包匹配的会话表项时，将第一数据包发送给主机。
可选的，处理器802还用于查询与第一数据包匹配的安全组规则，并将安全组规则写入第一会话表项的动作域。如果安全组规则包含正反向允许通过的防火墙规则，处理器802还用于创建第二会话表项，并根据第一数据包的匹配信息生成第二会话表项的匹配域，第二会话表项为与第一数据包的反方向数据流匹配的会话表项。
可选的，处理器802还用于通过主机接口808接收来自主机的修改指令，并根据修改指令修改第一会话表项，修改指令用于指示主机对至少两个流表项中的一个流表项的修改操作。
可选的，若第一会话表项在超过预设时间阈值的时间段内未被访问，处理器802还用于删除第一会话表项。处理器802删除第一会话表项后，还用于通过主机接口808向主机发送删除指令，删除指令用于指示主机删除至少两个流表项。
本发明实施例是网络接口卡的装置实施例，本发明其他实施例部分的特征描述，适用于本发明实施例，在此不再赘述。
图9为依据本发明一实施例的网络接口卡900的逻辑结构示意图，如图9所示，网络接口卡900包括：发送单元902，接收单元904和处理单元906。
发送单元904用于向主机发送第一数据包；接收单元902用于接收来自主机的处理信息，处理信息用于指示主机根据与第一数据包匹配的至少两个流表项对第一数据包的处理操作；处理单元906用于根据处理信息生成第一会话表项的动作域，并根据第一数据包的匹配信息生成第一会话表项的匹配域，第一会话表项用于记录网络接口卡900处理与第一会话表项匹配的数据包的规则。
接收单元902还用于接收第二数据包，第二数据包与第一数据包具有相同的匹配信息；处理单元906还用于根据匹配信息查询与第二数据包匹配的第一会话表项，并根据第一会话表项的动作域处理第二数据包。
发送单元904向主机发送第一数据包之前，接收单元902还用于接收第一数据包；处理单元906还用于根据匹配信息查询记录的会话表项；发送单元904还用于在处理单元906没有查询到与第一数据包匹配的会话表项时，将第一数据包发送给主机。
可选的，处理单元906还用于查询与第一数据包匹配的安全组规则，并将安全组规则写入第一会话表项的动作域。如果安全组规则包含正反向允许通过的防火墙规则，处理单元906还用于创建第二会话表项，并根据第一数据包的匹配信息生成第二会话表项的匹配域，第二会话表项为与第一数据包的反方向数据流匹配的会话表项。
可选的，接收单元902还用于接收来自主机的修改指令，修改指令用于指示主机对至少两个流表项中的一个流表项的修改操作；处理单元906还用于根据修改指令修改第一会话表项。
可选的，若第一会话表项在超过预设时间阈值的时间段内未被访问，处理单元906还用于删除第一会话表项。处理单元906删除第一会话表项后，还用于向主机发送删除指令，删除指令用于指示主机删除至少两个流表项。
本发明实施例是网络接口卡的装置实施例，本发明其他实施例部分的特征描述，适用于本发明实施例，在此不再赘述。
本发明实施例部分的发送单元902和接收单元904的功能可以由图8实施例中的处理器802和主机接口808来实现，或者由处理器802，存储器804和主机接口808来实现。
本发明实施例部分的发送单元904的部分功能还可以由图8实施例中的处理器802 和网络接口806来实现，或者由处理器802，存储器804和网络接口806来实现。
本发明实施例部分的处理单元904的功能可以由图8实施例中的处理器802来实现，或者由处理器802执行存储器804中的代码来实现。
以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者替换其中部分技术特征；而这些修改或者替换，并不使相应技术方案脱离权利要求的保护范围。

Claims (42)

  1. 一种服务器，其特征在于，所述服务器包含主机和网络接口卡，所述网络接口卡通过主机接口与所述主机相连；
    所述主机用于接收所述网络接口卡发送的第一数据包，获取与所述第一数据包关联的至少两个流表项，根据所述至少两个流表项生成处理信息，并向所述网络接口卡发送所述处理信息；
    所述网络接口卡用于根据所述处理信息生成第一会话表项的动作域；
    所述网络接口卡还用于根据所述第一数据包的匹配信息生成所述第一会话表项的匹配域；
    所述第一会话表项用于记录所述网络接口卡处理与所述第一会话表项匹配的数据包的规则。
  2. 根据权利要求1所述的服务器，其特征在于，所述网络接口卡还用于接收第二数据包，所述第二数据包与所述第一数据包具有相同的匹配信息，根据所述匹配信息查询与所述第二数据包匹配的所述第一会话表项，并根据所述第一会话表项的动作域处理所述第二数据包。
  3. 根据权利要求1或2所述的服务器，其特征在于，所述主机接收所述网络接口卡发送的所述第一数据包之前，所述网络接口卡还用于接收所述第一数据包，根据所述匹配信息查询记录的会话表项，并在没有查询到与所述第一数据包匹配的会话表项时，将所述第一数据包发送给所述主机。
  4. 根据权利要求1-3任一项所述的服务器，其特征在于，所述网络接口卡还用于查询与所述第一数据包匹配的安全组规则，并将所述安全组规则写入所述第一会话表项的动作域。
  5. 根据权利要求4所述的服务器，其特征在于，所述主机配置有安全组功能；
    所述主机还用于查询与所述第一数据包匹配的安全组规则，并向所述网络接口卡发送所述第一数据包匹配的安全组规则。
  6. 根据权利要求4或5所述的服务器，其特征在于，如果所述安全组规则包含正反向允许通过的防火墙规则，所述网络接口卡还用于创建第二会话表项，并根据所述第一数据包的匹配信息生成所述第二会话表项的匹配域，所述第二会话表项为与所述第一数据包的反方向数据流匹配的会话表项。
  7. 根据权利要求1-6任一项所述的服务器，其特征在于，所述主机还用于在修改所述至少两个流表项中的一个流表项后，向所述网络接口卡发送修改指令，所述修改指令用于指示所述主机对所述至少两个流表项中的一个流表项的修改操作；
    所述网络接口卡还用于根据所述修改指令修改所述第一会话表项。
  8. 根据权利要求1-7任一项所述的服务器，其特征在于，若所述第一会话表项在超过预设时间阈值的时间段内未被访问，所述网络接口卡还用于删除所述第一会话表项。
  9. 根据权利要求8所述的服务器，其特征在于，所述网络接口卡删除所述第一会话表项后，还用于向所述主机发送删除指令；
    所述主机还用于根据所述删除指令删除所述至少两个流表项。
  10. 一种数据处理方法，其特征在于，服务器包含运行有虚拟交换机的主机和网络接口卡，所述方法包括：
    所述主机接收所述网络接口卡发送的第一数据包，获取与所述第一数据包关联的至少两个流表项，根据所述至少两个流表项生成处理信息，并向所述网络接口卡发送所述处理信息；
    所述网络接口卡根据所述处理信息生成第一会话表项的动作域；
    所述网络接口卡根据所述第一数据包的匹配信息生成所述第一会话表项的匹配域；
    所述第一会话表项用于记录所述网络接口卡处理与所述第一会话表项匹配的数据包的规则。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    所述网络接口卡接收第二数据包，所述第二数据包与所述第一数据包具有相同的匹配信息；
    所述网络接口卡根据所述匹配信息查询与所述第二数据包匹配的所述第一会话表项，并根据所述第一会话表项的动作域处理所述第二数据包。
  12. 根据权利要求10或11所述的方法，其特征在于，所述主机接收所述网络接口卡发送的所述第一数据包之前，所述方法还包括：
    所述网络接口卡接收所述第一数据包，根据所述匹配信息查询记录的会话表项，并在没有查询到与所述第一数据包匹配的会话表项时，将所述第一数据包发送给所述主机。
  13. 根据权利要求10-12任一项所述的方法，其特征在于，所述方法还包括：
    所述网络接口卡查询与所述第一数据包匹配的安全组规则，并将所述安全组规则写入所述第一会话表项的动作域。
  14. 根据权利要求13所述的方法，其特征在于，所述主机配置有安全组功能；
    所述方法还包括：
    所述主机查询与所述第一数据包匹配的安全组规则，并向所述网络接口卡发送所述第一数据包匹配的安全组规则。
  15. 根据权利要求13或14所述的方法，其特征在于，如果所述安全组规则包含正反向允许通过的防火墙规则，所述方法还包括：
    所述网络接口卡创建第二会话表项，并根据所述第一数据包的匹配信息生成所述第二会话表项的匹配域，所述第二会话表项为与所述第一数据包的反方向数据流匹配的会话表项。
  16. 根据权利要求10-15任一项所述的方法，其特征在于，所述方法还包括：
    所述主机在修改所述至少两个流表项中的一个流表项后，向所述网络接口卡发送修改指令，所述修改指令用于指示所述主机对所述至少两个流表项中的一个流表项的修改操作；
    所述网络接口卡根据所述修改指令修改所述第一会话表项。
  17. 根据权利要求10-16任一项所述的方法，其特征在于，所述方法还包括：
    若所述第一会话表项在超过预设时间阈值的时间段内未被访问，所述网络接口卡删除所述第一会话表项。
  18. 根据权利要求17所述的方法，其特征在于，所述网络接口卡删除所述第一会话表项后，所述方法还包括：
    所述网络接口卡向所述主机发送删除指令；
    所述主机根据所述删除指令删除所述至少两个流表项。
  19. 一种数据处理方法，其特征在于，所述方法包括：
    网络接口卡向主机发送第一数据包；
    所述网络接口卡接收来自所述主机的处理信息，所述处理信息用于指示所述主机根据与所述第一数据包匹配的至少两个流表项对所述第一数据包的处理操作；
    所述网络接口卡根据所述处理信息生成第一会话表项的动作域，并根据所述第一数据包的匹配信息生成所述第一会话表项的匹配域，所述第一会话表项用于记录所述网络接口卡处理与所述第一会话表项匹配的数据包的规则。
  20. 根据权利要求19所述的方法，其特征在于，所述方法还包括：
    所述网络接口卡接收第二数据包，所述第二数据包与所述第一数据包具有相同的匹配信息；
    所述网络接口卡根据所述匹配信息查询与所述第二数据包匹配的所述第一会话表项，并根据所述第一会话表项的动作域处理所述第二数据包。
  21. 根据权利要求19或20所述的方法，其特征在于，所述网络接口卡向主机发送第一数据包之前，所述方法包括：
    所述网络接口卡接收所述第一数据包，根据所述匹配信息查询记录的会话表项，并在没有查询到与所述第一数据包匹配的会话表项时，将所述第一数据包发送给所述主机。
  22. 根据权利要求19-21任一项所述的方法，其特征在于，所述方法还包括：
    所述网络接口卡查询与所述第一数据包匹配的安全组规则，并将所述安全组规则写入所述第一会话表项的动作域。
  23. 根据权利要求22所述的方法，其特征在于，如果所述安全组规则包含正反向允许通过的防火墙规则，所述方法还包括：
    所述网络接口卡创建第二会话表项，并根据所述第一数据包的匹配信息生成所述第二会话表项的匹配域，所述第二会话表项为与所述第一数据包的反方向数据流匹配的会话表项。
  24. 根据权利要求19-23任一项所述的方法，其特征在于，所述方法还包括：
    所述网络接口卡接口卡接收来自所述主机的修改指令，所述修改指令用于指示所述主机对所述至少两个流表项中的一个流表项的修改操作；
    所述网络接口卡根据所述修改指令修改所述第一会话表项。
  25. 根据权利要求19-24任一项所述的方法，其特征在于，所述方法还包括：
    若所述第一会话表项在超过预设时间阈值的时间段内未被访问，所述网络接口卡删除所述第一会话表项。
  26. 根据权利要求25所述的方法，其特征在于，所述网络接口卡删除所述第一会话表项后，所述方法还包括：
    所述网络接口卡向所述主机发送删除指令，所述删除指令用于指示所述主机删除所述至少两个流表项。
  27. 一种网络接口卡，其特征在于，所述网络接口卡包括：
    发送单元，用于向主机发送第一数据包；
    接收单元，用于接收来自所述主机的处理信息，所述处理信息用于指示所述主机 根据与所述第一数据包匹配的至少两个流表项对所述第一数据包的处理操作；
    处理单元，用于根据所述处理信息生成第一会话表项的动作域，并根据所述第一数据包的匹配信息生成所述第一会话表项的匹配域，所述第一会话表项用于记录所述网络接口卡处理与所述第一会话表项匹配的数据包的规则。
  28. 根据权利要求27所述的网络接口卡，其特征在于，所述接收单元还用于接收第二数据包，所述第二数据包与所述第一数据包具有相同的匹配信息；
    所述处理单元还用于根据所述匹配信息查询与所述第二数据包匹配的所述第一会话表项，并根据所述第一会话表项的动作域处理所述第二数据包。
  29. 根据权利要求27或28所述的网络接口卡，其特征在于，所述发送单元向主机发送第一数据包之前，所述接收单元还用于接收所述第一数据包；所述处理单元还用于根据所述匹配信息查询记录的会话表项；所述发送单元还用于在所述处理单元没有查询到与所述第一数据包匹配的会话表项时，将所述第一数据包发送给所述主机。
  30. 根据权利要求27-29任一项所述的网络接口卡，其特征在于，所述处理单元还用于查询与所述第一数据包匹配的安全组规则，并将所述安全组规则写入所述第一会话表项的动作域。
  31. 根据权利要求30所述的网络接口卡，其特征在于，如果所述安全组规则包含正反向允许通过的防火墙规则，处理单元还用于创建第二会话表项，并根据所述第一数据包的匹配信息生成所述第二会话表项的匹配域，所述第二会话表项为与所述第一数据包的反方向数据流匹配的会话表项。
  32. 根据权利要求27-31任一项所述的网络接口卡，其特征在于，所述接收单元还用于接收来自所述主机的修改指令，所述修改指令用于指示所述主机对所述至少两个流表项中的一个流表项的修改操作；
    所述处理单元还用于根据所述修改指令修改所述第一会话表项。
  33. 根据权利要求27-32任一项所述的网络接口卡，其特征在于，若所述第一会话表项在超过预设时间阈值的时间段内未被访问，所述处理单元还用于删除所述第一会话表项。
  34. 根据权利要求33所述的网络接口卡，其特征在于，所述处理单元删除所述第一会话表项后，还用于向所述主机发送删除指令，所述删除指令用于指示所述主机删除所述至少两个流表项。
  35. 一种网络接口卡，其特征在于，包括：主机接口、处理器、存储器；
    所述主机接口用于连接所述主机；
    所述处理器用于通过所述主机接口向所述主机发送第一数据包；
    所述主机接口还用于通过所述主机接口接收来自所述主机的处理信息，所述处理信息用于指示所述主机根据与所述第一数据包匹配的至少两个流表项对所述第一数据包的处理操作；
    所述处理器还用于根据所述处理信息生成第一会话表项的动作域，并根据所述第一数据包的匹配信息生成所述第一会话表项的匹配域，所述第一会话表项用于记录所述网络接口卡处理与所述第一会话表项匹配的数据包的规则；
    所述存储器用于存储所述第一会话表项。
  36. 根据权利要求35所述的网络接口卡，其特征在于，所述网络接口卡还包括网络 接口，所述网络接口用于连接外部网络；
    所述处理器还用于通过所述主机接口或所述网络接口接收第二数据包，所述第二数据包与所述第一数据包具有相同的匹配信息；
    所述处理器还用于根据所述匹配信息查询与所述第二数据包匹配的所述第一会话表项，并根据所述第一会话表项的动作域处理所述第二数据包。
  37. 根据权利要求35或36所述的网络接口卡，其特征在于，所述网络接口卡还包括网络接口，所述网络接口用于连接外部网络；
    所述处理器通过主机接口向主机发送第一数据包之前，还用于通过所述主机接口或所述网络接口接收所述第一数据包，根据所述匹配信息查询记录的会话表项，并在没有查询到与所述第一数据包匹配的会话表项时，将所述第一数据包发送给所述主机。
  38. 根据权利要求35-37任一项所述的网络接口卡，其特征在于，所述处理器还用于查询与所述第一数据包匹配的安全组规则，并将所述安全组规则写入所述第一会话表项的动作域。
  39. 根据权利要求38所述的网络接口卡，其特征在于，如果所述安全组规则包含正反向允许通过的防火墙规则，处理器还用于创建第二会话表项，并根据所述第一数据包的匹配信息生成所述第二会话表项的匹配域，所述第二会话表项为与所述第一数据包的反方向数据流匹配的会话表项。
  40. 根据权利要求35-39任一项所述的网络接口卡，其特征在于，所述处理器还用于通过所述主机接口接收来自所述主机的修改指令，所述修改指令用于指示所述主机对所述至少两个流表项中的一个流表项的修改操作；
    所述处理器还用于根据所述修改指令修改所述第一会话表项。
  41. 根据权利要求35-40任一项所述的网络接口卡，其特征在于，若所述第一会话表项在超过预设时间阈值的时间段内未被访问，所述处理器还用于删除所述第一会话表项。
  42. 根据权利要求41所述的网络接口卡，其特征在于，所述处理器删除所述第一会话表项后，还用于通过所述主机接口向所述主机发送删除指令，所述删除指令用于指示所述主机删除所述至少两个流表项。
PCT/CN2017/091278 2017-06-30 2017-06-30 一种数据处理方法、网络接口卡及服务器 Ceased WO2019000434A1 (zh)

Priority Applications (7)

Application Number Priority Date Filing Date Title
EP21193675.2A EP3995955B1 (en) 2017-06-30 2017-06-30 Data processing method, network interface card, and server
CA3066826A CA3066826C (en) 2017-06-30 2017-06-30 Network data processing method, network interface card, and server
EP17915228.5A EP3627781B1 (en) 2017-06-30 2017-06-30 Data processing method and network interface card
JP2019572365A JP7034187B2 (ja) 2017-06-30 2017-06-30 データ処理方法、ネットワークインタフェースカード、及びサーバ
CN201780076601.2A CN110050447B (zh) 2017-06-30 2017-06-30 一种数据处理方法、网络接口卡及服务器
PCT/CN2017/091278 WO2019000434A1 (zh) 2017-06-30 2017-06-30 一种数据处理方法、网络接口卡及服务器
US16/728,180 US11223579B2 (en) 2017-06-30 2019-12-27 Data processing method, network interface card, and server

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/091278 WO2019000434A1 (zh) 2017-06-30 2017-06-30 一种数据处理方法、网络接口卡及服务器

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/728,180 Continuation US11223579B2 (en) 2017-06-30 2019-12-27 Data processing method, network interface card, and server

Publications (1)

Publication Number Publication Date
WO2019000434A1 true WO2019000434A1 (zh) 2019-01-03

Family

ID=64740875

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/091278 Ceased WO2019000434A1 (zh) 2017-06-30 2017-06-30 一种数据处理方法、网络接口卡及服务器

Country Status (6)

Country Link
US (1) US11223579B2 (zh)
EP (2) EP3627781B1 (zh)
JP (1) JP7034187B2 (zh)
CN (1) CN110050447B (zh)
CA (1) CA3066826C (zh)
WO (1) WO2019000434A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113839933A (zh) * 2021-09-13 2021-12-24 紫光云(南京)数字技术有限公司 一种利用安全组解决多网卡流量的方法
CN116132386A (zh) * 2023-04-19 2023-05-16 安超云软件有限公司 混合工作负载引流方法及计算机集群
WO2026000890A1 (zh) * 2024-06-25 2026-01-02 中国银联股份有限公司 会话访问控制方法、装置、设备、介质及程序产品

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10887221B2 (en) * 2018-08-28 2021-01-05 Mediatek Inc. Methods of synchronization mode of flow table and apparatus using the same
CN113285892B (zh) * 2020-02-20 2024-12-24 华为云计算技术有限公司 报文处理系统、方法、机器可读存储介质以及程序产品
CN111541784B (zh) * 2020-07-08 2021-07-20 支付宝(杭州)信息技术有限公司 一种基于区块链一体机的交易处理方法及装置
CN111539829B (zh) 2020-07-08 2020-12-29 支付宝(杭州)信息技术有限公司 一种基于区块链一体机的待过滤交易识别方法及装置
CN111541789A (zh) 2020-07-08 2020-08-14 支付宝(杭州)信息技术有限公司 一种基于区块链一体机的数据同步方法及装置
CN111541783B (zh) 2020-07-08 2020-10-20 支付宝(杭州)信息技术有限公司 一种基于区块链一体机的交易转发方法及装置
CN111541726B (zh) 2020-07-08 2021-05-18 支付宝(杭州)信息技术有限公司 一种基于区块链一体机的重放交易识别方法及装置
CN113905416B (zh) * 2021-09-16 2024-04-16 锐捷网络股份有限公司 VoLTE报文的处理方法及装置
US11899585B2 (en) 2021-12-24 2024-02-13 Western Digital Technologies, Inc. In-kernel caching for distributed cache
US11934663B2 (en) 2022-01-10 2024-03-19 Western Digital Technologies, Inc. Computational acceleration for distributed cache
US11797379B2 (en) 2022-02-04 2023-10-24 Western Digital Technologies, Inc. Error detection and data recovery for distributed cache
US12182022B2 (en) 2022-05-10 2024-12-31 Western Digital Tehcnologies, Inc. In-kernel cache request queuing for distributed cache
US12452189B2 (en) 2022-06-01 2025-10-21 Western Digital Technologies, Inc. Context-aware NVMe processing in virtualized environments
US12386648B2 (en) 2022-06-09 2025-08-12 Western Digital Technologies, Inc. Resource allocation in virtualized environments
US12379951B2 (en) 2022-06-27 2025-08-05 Western Digital Technologies, Inc. Memory coherence in virtualized environments
CN115292694B (zh) * 2022-08-01 2025-09-16 中国电信股份有限公司 计算机网络安全服务器虚拟化处理方法及相关设备
US20240078185A1 (en) * 2022-09-07 2024-03-07 Mellanox Technologies, Ltd. Using parallel processor(s) to process packets in real-time
US20240179158A1 (en) * 2022-11-30 2024-05-30 Juniper Networks, Inc. Self learning firewall policy enforcer
CN119071091B (zh) * 2024-11-06 2025-01-28 北京凝思软件股份有限公司 数据处理方法、装置、设备、存储介质和程序产品

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103401797A (zh) * 2013-07-24 2013-11-20 杭州华三通信技术有限公司 一种报文处理方法和设备
CN104426816A (zh) * 2013-08-19 2015-03-18 华为技术有限公司 一种虚拟机通信方法及装置
CN104883302A (zh) * 2015-03-18 2015-09-02 华为技术有限公司 一种数据包转发的方法、装置及系统
CN105245456A (zh) * 2015-10-20 2016-01-13 浪潮(北京)电子信息产业有限公司 一种云服务器内卸载sdn虚拟网络功能的方法和系统
CN105939291A (zh) * 2015-09-25 2016-09-14 杭州迪普科技有限公司 报文处理方法和网络设备
CN106302225A (zh) * 2016-10-18 2017-01-04 上海优刻得信息科技有限公司 一种服务器负载均衡的方法与装置
CN106533942A (zh) * 2016-11-30 2017-03-22 北京邮电大学 一种基于sdn的数据处理方法及装置
CN106815067A (zh) * 2015-11-30 2017-06-09 中国移动通信集团公司 带i/o虚拟化的虚拟机在线迁移方法、装置

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2011068091A1 (ja) 2009-12-04 2011-06-09 日本電気株式会社 サーバ及びフロー制御プログラム
US8930690B2 (en) * 2012-03-21 2015-01-06 Microsoft Corporation Offloading packet processing for networking device virtualization
CN103718520B (zh) * 2012-08-02 2017-07-21 华为技术有限公司 处理数据报文的方法、装置及系统
CN104253770B (zh) * 2013-06-27 2017-07-14 新华三技术有限公司 实现分布式虚拟交换机系统的方法及设备
CN104468357B (zh) * 2013-09-16 2019-07-12 中兴通讯股份有限公司 流表的多级化方法、多级流表处理方法及装置
CN103916314A (zh) * 2013-12-26 2014-07-09 杭州华为数字技术有限公司 报文转发控制方法和相关装置及物理主机
CN104753885B (zh) * 2013-12-30 2018-06-26 杭州华为数字技术有限公司 一种流表匹配的方法、装置和OpenFlow交换系统
US9692698B2 (en) * 2014-06-30 2017-06-27 Nicira, Inc. Methods and systems to offload overlay network packet encapsulation to hardware
US9917769B2 (en) * 2014-11-17 2018-03-13 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for virtualizing flow tables in a software-defined networking (SDN) system
CN104394080A (zh) * 2014-11-28 2015-03-04 杭州华三通信技术有限公司 实现安全组功能的方法及装置
US10812632B2 (en) * 2015-02-09 2020-10-20 Avago Technologies International Sales Pte. Limited Network interface controller with integrated network flow processing
US20180048593A1 (en) * 2015-02-17 2018-02-15 Hewlett Packard Enterprise Development Lp Flow entry generating and packet processing based on flow entry
US10333897B2 (en) * 2015-10-23 2019-06-25 Attala Systems Corporation Distributed firewalls and virtual network services using network packets with security tags
EP3694159A1 (en) * 2016-08-03 2020-08-12 Huawei Technologies Co., Ltd. Network interface card, computing device, and data packet processing method
EP3340064B1 (en) 2016-08-03 2020-12-02 Huawei Technologies Co., Ltd. Network interface card, computer device and data packet processing method

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103401797A (zh) * 2013-07-24 2013-11-20 杭州华三通信技术有限公司 一种报文处理方法和设备
CN104426816A (zh) * 2013-08-19 2015-03-18 华为技术有限公司 一种虚拟机通信方法及装置
CN104883302A (zh) * 2015-03-18 2015-09-02 华为技术有限公司 一种数据包转发的方法、装置及系统
CN105939291A (zh) * 2015-09-25 2016-09-14 杭州迪普科技有限公司 报文处理方法和网络设备
CN105245456A (zh) * 2015-10-20 2016-01-13 浪潮(北京)电子信息产业有限公司 一种云服务器内卸载sdn虚拟网络功能的方法和系统
CN106815067A (zh) * 2015-11-30 2017-06-09 中国移动通信集团公司 带i/o虚拟化的虚拟机在线迁移方法、装置
CN106302225A (zh) * 2016-10-18 2017-01-04 上海优刻得信息科技有限公司 一种服务器负载均衡的方法与装置
CN106533942A (zh) * 2016-11-30 2017-03-22 北京邮电大学 一种基于sdn的数据处理方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3627781A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113839933A (zh) * 2021-09-13 2021-12-24 紫光云(南京)数字技术有限公司 一种利用安全组解决多网卡流量的方法
CN113839933B (zh) * 2021-09-13 2023-09-26 紫光云(南京)数字技术有限公司 一种利用安全组解决多网卡流量的方法
CN116132386A (zh) * 2023-04-19 2023-05-16 安超云软件有限公司 混合工作负载引流方法及计算机集群
WO2026000890A1 (zh) * 2024-06-25 2026-01-02 中国银联股份有限公司 会话访问控制方法、装置、设备、介质及程序产品

Also Published As

Publication number Publication date
JP2020526122A (ja) 2020-08-27
EP3627781A4 (en) 2020-04-22
US20200136998A1 (en) 2020-04-30
CN110050447B (zh) 2021-02-12
CA3066826C (en) 2023-06-27
CA3066826A1 (en) 2019-01-03
EP3995955B1 (en) 2024-10-16
JP7034187B2 (ja) 2022-03-11
EP3627781A1 (en) 2020-03-25
EP3995955A1 (en) 2022-05-11
CN110050447A (zh) 2019-07-23
EP3627781B1 (en) 2021-09-01
US11223579B2 (en) 2022-01-11

Similar Documents

Publication Publication Date Title
US11223579B2 (en) Data processing method, network interface card, and server
CN114531405B (zh) 一种流表处理方法及相关设备
CN103299278B (zh) 通过广域网的虚拟机和应用移动
JP5648926B2 (ja) ネットワークシステム、コントローラ、ネットワーク制御方法
JP6151394B2 (ja) 仮想クラウドインフラストラクチャへの仮想セキュリティ装置アーキテクチャの提供
US10320895B2 (en) Live migration of load balanced virtual machines via traffic bypass
JP5946532B2 (ja) データセンタ環境で物理ネットワークに仮想ネットワークをオーバーレイするための方法、オーバーレイ仮想ネットワークで通信するための方法、ネットワーク仮想化環境のためのシステム、データセンタおよびコンピュータ・プログラム
EP3878158A1 (en) Mirroring network traffic of virtual networks at a service provider network
CN110838975A (zh) 虚拟网络中租户工作负载的安全转发
US11595303B2 (en) Packet handling in software-defined net working (SDN) environments
US20130298126A1 (en) Computer-readable recording medium and data relay device
WO2014079005A1 (zh) Mac地址强制转发装置及方法
CN109937400A (zh) 用于虚拟机的实时迁移的流状态传送
CN111736958A (zh) 虚拟机迁移方法、系统、计算机设备及存储介质
EP3493058A1 (en) Method and device for migrating a stateful function
JP6718739B2 (ja) 通信装置および通信方法
US20260005927A1 (en) Link-level network virtualization architecture for large-scale network function virtualization applications

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17915228

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3066826

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2019572365

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017915228

Country of ref document: EP

Effective date: 20191219