Caching of service decisions
View Patent ↗Some embodiments provide a method for processing a packet received by a managed forwarding element. The method performs a series of packet classification operations based on header values of the received packet. The packet classifications operations determine a next destination of the received packet. When the series of packet classification operations specifies to send the packet to a network service that performs payload transformations on the packet, the method (1) assigns a service operation identifier to the packet that identifies the service operations for the network service to perform on the packet, (2) sends the packet to the network service with the service operation identifier, and (3) stores a cache entry for processing subsequent packets without the series of packet classification operations. The cache entry includes the assigned service operation identifier. The network service uses the assigned service operation identifier to process packets without performing its own classification operations.
1. A method for processing a packet received by a managed forwarding element, the method comprising:
performing an ordered series of lookups into a plurality of flow tables based on a set of header values of the received packet, the ordered series of lookups for determining a next destination of the received packet and specifying a plurality of actions to perform on the received packet; and
when the ordered series of lookups specifies sending the packet to a network service that performs payload transformations on the packet:
assigning a service operation identifier to the packet that identifies the service operations for the network service to perform on the packet;
sending the packet to the network service with the service operation identifier; and
for subsequent packets that should be processed like the received packet, storing a cache entry that specifies the plurality of actions to be performed on the subsequent packets without requiring the ordered series of lookups into the flow tables, the cache entry comprising the assigned service operation identifier,
wherein the network service uses the assigned service operation identifier to process packets without performing its own classification operations.
2. The method of claim 1 , wherein the ordered series of lookups comprise at least one of layer 2 (“L2”) and layer 3 (“L3”) forwarding operations, and the network service performs at least one of layer 4 (“L4”), layer 5 (“L5”), layer 6 (“L6”), and layer 7 (“L7”) operations.
3. The method of claim 1 , wherein the network service is performed by the managed forwarding element.
4. The method of claim 1 , wherein the managed forwarding element operates within virtualization software of a host machine, wherein the ordered series of lookups are performed in a user space of the virtualization software and the cache entry is stored in a kernel of the virtualization software.
5. The method of claim 4 , wherein the subsequent packets are packets in a same data flow as the received packet and are processed only in the kernel.
6. The method of claim 1 further comprising:
receiving a second packet that belongs to a same data flow as the received packet;
processing the second packet using the plurality of actions specified in the cache entry; and
sending the packet to the network service with the service operation identifier.
7. The method of claim 1 further comprising creating an object to represent the packet for the managed forwarding element, wherein the service operation identifier is stored as an attribute of the packet object.
8. The method of claim 7 , wherein sending the packet to the network service comprises calling a network service module with the packet object as a parameter.
9. The method of claim 1 further comprising assigning a connection identifier to the packet that identifies the packet as part of a particular transport layer connection, wherein the packet is sent to the network service with the connection identifier.
10. The method of claim 9 , wherein the stored cache entry further comprises the connection identifier, the stored cache entry for sending the subsequent packets of the particular transport layer connection to the network service with the connection identifier.
11. The method of claim 10 , wherein the network service performs stateful operations and uses the assigned connection identifier to apply state stored for the particular transport layer connection to the subsequent packets.
12. A non-transitory machine readable medium storing a managed forwarding element which when executed by at least one processing unit processes packets for a network, the managed forwarding element comprising sets of instructions for:
performing an ordered series of lookups into a plurality of flow tables based on a set of header values of the received packet, the ordered series of lookups for determining a next destination of the received packet and specifying a plurality of actions to perform on the received packet; and
when the ordered series of lookups specifies sending the packet to a network service that performs payload transformations on the packet:
assigning a service operation identifier to the packet that identifies the service operations for the network service to perform on the packet;
sending the packet to the network service with the service operation identifier; and
for subsequent packets that should be processed like the received packet, storing a cache entry that specifies the plurality of actions to be performed on the subsequent packets without requiring the ordered series of lookups into the flow tables, the cache entry comprising the assigned service operation identifier, wherein the network service uses the assigned service operation identifier to process packets without performing its own classification operations.
13. The non-transitory machine readable medium of claim 12 , wherein the ordered series of lookups comprise at least one of layer 2 (“L2”) and layer 3 (“L3”) forwarding operations, and the network service performs at least one of layer 4 (“L4”), layer 5 (“L5”), layer 6 (“L6”), and layer 7 (“L7”) operations.
14. The non-transitory machine readable medium of claim 12 , wherein the network service operates on a same host machine as the managed forwarding element.
15. The non-transitory machine readable medium of claim 12 , wherein the managed forwarding element further comprises sets of instructions for:
receiving a second packet that belongs to a same data flow as the received packet;
processing the second packet using the plurality of actions specified in the cache entry; and
sending the packet to the network service with the service operation identifier.
16. The non-transitory machine readable medium of claim 12 , wherein the managed forwarding element further comprises sets of instructions for creating an object to represent the packet for the managed forwarding element, wherein the service operation identifier is stored as an attribute of the packet object.
17. The non-transitory machine readable medium of claim 16 , wherein the set of instructions for sending the packet to the network service comprises a set of instructions for calling a network service module with the packet object as a parameter.
18. The non-transitory machine readable medium of claim 12 , wherein the managed forwarding element further comprises a set of instructions for assigning a connection identifier to the packet that identifies the packet as part of a particular transport layer connection, wherein the packet is sent to the network service with the connection identifier.
19. The non-transitory machine readable medium of claim 18 , wherein the stored cache entry further comprises the connection identifier, the stored cache entry for sending the subsequent packets of the particular transport layer connection to the network service with the connection identifier.
20. The non-transitory machine readable medium of claim 19 , wherein the network service performs stateful operations and uses the assigned connection identifier to apply state stored for the particular transport layer connection to the subsequent packets.