Load balancing IPsec tunnel processing with extended Berkeley packet filter (eBPF)
Certain embodiments described herein are generally directed to load balancing IPSec tunnels at an extended Berkeley Packet Filter (eBPF) module of a destination tunnel endpoint for encapsulated ESP encrypted data packets for encapsulated encrypted data packets based on a security parameter index value of the encapsulated encrypted data packets.
1. A method for processing encapsulated encrypted data packets at an extended Berkeley Packet Filter (eBPF) module on a host machine, comprising:
receiving, at the eBPF module, an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;
selecting a CPU core ID from a plurality of CPU cored IDs based at least in part on the SPI value, wherein the CPU core ID corresponds to a virtual CPU of a plurality of virtual CPUs; and
inserting the CPU core ID into the encapsulated encrypted data packet;
passing the encapsulated encrypted data packet to a receive packet steering (RPS) module for assignment of the encapsulated encrypted data packet to the virtual CPU based on the CPU core ID.
2. The method of claim 1 , further comprising:
parsing the packet to determine the SPI value and at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint;
performing a look-up of a mapping table stored in the eBPF module using the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint; and
determining if a matching entry for the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint is found in the mapping table, prior to the selecting.
3. The method of claim 2 , wherein the selecting further comprises selecting the CPU core ID using a CPU selection function upon determining that no matching entry is found.
4. The method of claim 3 , wherein the CPU selection function uses a load level of each of the plurality of virtual CPUs as input.
5. The method of claim 4 , wherein a load level of the virtual CPU is lowest among load levels of the plurality of virtual CPUs.
6. The method of claim 3 , wherein the CPU selection function performs the selecting using a round-robin mechanism.
7. The method of claim 1 , wherein the eBPF module is configured by a configuration engine.
8. The method of claim 7 , wherein the mapping table is replaced by the configuration engine in response to an event.
9. The method of claim 8 , wherein the event comprises a change in the SPI value corresponding to the security association between the source endpoint and the destination endpoint.
10. The method of claim 1 , further comprising:
storing a mapping of the SPI value to the selected CPU core ID in the mapping table, prior to the passing.
11. A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for processing encapsulated encrypted data packets at an extended Berkeley Packet Filter (eBPF) module on a host machine, the method comprising:
receiving, at the eBPF module, an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;
selecting a CPU core ID from a plurality of CPU cored IDs based at least in part on the SPI value, wherein the CPU core ID corresponds to a virtual CPU of a plurality of virtual CPUs; and
inserting the CPU core ID into the encapsulated encrypted data packet;
passing the encapsulated encrypted data packet to a receive packet steering (RPS) module for assignment of the encapsulated encrypted data packet to the virtual CPU based on the CPU core ID.
12. The non-transitory computer readable medium of claim 11 , wherein the method further comprises:
parsing the packet to determine the SPI value and at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint;
performing a look-up of a mapping table stored in the eBPF module using the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint; and
determining if a matching entry for the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint is found in the mapping table, prior to the selecting.
13. The non-transitory computer readable medium of claim 12 , wherein the selecting further comprises selecting the CPU core ID using a CPU selection function upon determining that no matching entry is found.
14. The non-transitory computer readable medium of claim 13 , wherein the CPU selection function uses a load level of each of the plurality of virtual CPUs as input.
15. The non-transitory computer readable medium of claim 14 , wherein a load level of the virtual CPU is lowest among load levels of the plurality of virtual CPUs.
16. The non-transitory computer readable medium of claim 13 , wherein the CPU selection function performs the selecting using a round-robin mechanism.
17. The non-transitory computer readable medium of claim 11 , wherein the eBPF module is configured by a configuration engine.
18. The non-transitory computer readable medium of claim 17 , wherein the mapping table is replaced by the configuration engine in response to an event.
19. The non-transitory computer readable medium of claim 18 , wherein the event comprises a change in the SPI value corresponding to the security association between the source endpoint and the destination endpoint.
20. The non-transitory computer readable medium of claim 11 , wherein the method further comprises:
storing a mapping of the SPI value to the selected CPU core ID in the mapping table, prior to the passing.
21. A computer system, wherein system software for the computer system is programmed to execute a method for processing encapsulated encrypted data packets at an extended Berkeley Packet Filter (eBPF) module on a host machine, the method comprising:
receiving, at the eBPF module, an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;
selecting a CPU core ID from a plurality of CPU cored IDs based at least in part on the SPI value, wherein the CPU core ID corresponds to a virtual CPU of a plurality of virtual CPUs; and
inserting the CPU core ID into the encapsulated encrypted data packet;
passing the encapsulated encrypted data packet to a receive packet steering (RPS) module for assignment of the encapsulated encrypted data packet to the virtual CPU based on the CPU core ID.
22. The computer system of claim 21 , wherein the method further comprises:
parsing the packet to determine the SPI value and at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint;
performing a look-up of a mapping table stored in the eBPF module using the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint; and
determining if a matching entry for the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint is found in the mapping table, prior to the selecting.
23. The computer system of claim 22 , wherein the selecting further comprises selecting the CPU core ID using a CPU selection function upon determining that no matching entry is found.
24. The computer system of claim 23 , wherein the CPU selection function uses a load level of each of the plurality of virtual CPUs as input.
25. The computer system of claim 24 , wherein a load level of the virtual CPU is lowest among load levels of the plurality of virtual CPUs.
26. The computer system of claim 23 , wherein the CPU selection function performs the selecting using a round-robin mechanism.
27. The computer system of claim 21 , wherein the eBPF module is configured by a configuration engine.
28. The computer system of claim 27 , wherein the mapping table is replaced by the configuration engine in response to an event.
29. The computer system of claim 28 , wherein the event comprises a change in the SPI value corresponding to the security association between the source endpoint and the destination endpoint.
30. The computer system of claim 21 , wherein the method further comprises:
storing a mapping of the SPI value to the selected CPU core ID in the mapping table, prior to the passing.