System and method for packet forwarding

1. A system for packet forwarding, comprising:

an operating system kernel which is configured to implement a plurality of network protocol suites and which has a plurality of different kernel priority levels;

a plurality of packet forwarding paths, wherein the packet forwarding paths are associated with the plurality of different kernel priority levels; and

a packet classifier configured to dynamically select a forwarding path from the plurality of forwarding paths.

2. The system of claim 1 , further comprising a decision table configured to cache the results of the packet classifier.

3. The system of claim 2 , wherein the decision table comprises a series of entries in the routing table.

4. The system of claim 3 , wherein the entries are flow entries.

5. The system of claim 3 , wherein the decision table entries include a network connection context.

6. The system of claim 5 , wherein the network connection context is associated with a TCP connection.

7. The system of claim 5 , wherein the network connection context is associated with a UDP transaction.

8. The system of claim 7 , wherein the packet classifier is configured to be implemented by a user-level process.

9. The system of claim 7 , wherein the packet classifier is implemented by a loadable kernel module.

10. The system of claim 7 , wherein the packet classifier is implemented by a device driver.

11. The system of claim 9 , wherein the loadable kernel module may be implemented at a different priority level from the forwarding path.

12. The system of claim 9 , wherein the loadable kernel module is cryptographically signed to authenticate its origin.

13. The system of claim 1 , wherein the forwarding path further comprises a module that provides additional functionality beyond packet forwarding.

14. The system of claim 13 , wherein the additional functionality module comprises a network address translator.

15. The system of claim 13 , wherein the additional functionality module comprises a packet filter.

16. The system of claim 13 , wherein the additional functionality module comprises a dynamic stateful packet filter.

17. The system of claim 13 , wherein the additional functionality module comprises an IPSec tunnel implementation.

18. A system for packet forwarding, comprising:

means for receiving network packets;

means for receiving state information from a plurality of kernel tasks;

means for selecting a forwarding path from a plurality of forwarding paths based on the state information; and

means for transmitting the network packets.

19. The system of claim 18 , wherein kernel tasks are implemented as a loadable kernel module.

20. The system of claim 18 , wherein kernel tasks are implemented as a device driver.

21. A method for packet forwarding, comprising:

receiving a network packet;

receiving state information from kernel tasks;

selecting a forwarding path from forwarding paths based on the state information; and

transmitting the network packet.

22. The method of claim 21 , further comprising caching the selected forwarding path with a flow entry.

23. The method of claim 22 , further comprising synchronizing flow entries between members of a packet forwarding cluster.

24. The method of claim 21 , wherein kernel tasks are implemented as a loadable kernel module.

25. The method of claim 21 , wherein kernel tasks are implemented as a device driver.

26. A method of packet forwarding, comprising:

receiving a network packet;

receiving state information from external agents;

selecting a high priority forwarding path from forwarding paths based on the state information;

performing address translation in the high priority forwarding path; and

transmitting the network packet through the high priority forwarding path.

27. The method of claim 26 , further comprising comparing the network packet to an external state table.

28. The method of claim 26 , wherein selecting the high priority forwarding path includes applying a cryptographic signature to authenticate an origin.

29. The system of claim 1 , wherein the packet classifier is configured to dynamically select a high priority forwarding path from among the plurality of forwarding paths based on determining that a classified packet is part of an existing flow.