Efficient packet classification for dynamic containers
A novel algorithm for packet classification that is based on a novel search structure for packet classification rules is provided. Addresses from all the containers are merged and maintained in a single Trie. Each entry in the Trie has additional information that can be traced back to the container from where the address originated. This information is used to keep the Trie in sync with the containers when the container definition dynamically changes.
1. A method for classifying an incoming packet based on a set of rules comprising:
using an address-based search structure to identify a first set of potential matching rules for the incoming packet based on source and destination addresses of the incoming packet;
using a port-based search structure to identify a second set of potential matching rules for the incoming packet based on source and destination ports of the incoming packet;
using a protocol-based search structure to identify a third set of potential matching rules for the incoming packet based on a protocol of the incoming packet;
identifying a matching rule for the incoming packet from the first, second, and third sets of potential matching rules.
2. The method of claim 1 , wherein the port-based search structure comprises a discrete port value search structure for identifying one or more rules that each specifies a single explicit value for at least one of its source or destination port field.
3. The method of claim 2 , wherein the discrete port value search structure is a binary search tree, wherein each node in the binary search tree corresponds to a different discrete port value.
4. The method of claim 2 , wherein the port-based search structure further comprises a port expression search structure for identifying one or more rules that each specifies a range or collection of ports values by using expressions or relational operators.
5. The method of claim 4 , wherein the port expression search structure is a link list, wherein each node in the list corresponds to a different range or collection of port values.
6. The method of claim 1 , wherein the matching rule is the highest priority rule that matches the incoming packet in five fields of a connection five-tuple.
7. A non-transitory machine readable medium storing a program for classifying an incoming packet based on a set of rules, the program for execution by at least one hardware processing unit, the program comprising sets of instructions for:
using an address-based search structure to identify a first set of potential matching rules for the incoming packet based on source and destination addresses of the incoming packet;
using a port-based search structure to identify a second set of potential matching rules for the incoming packet based on source and destination ports of the incoming packet;
using a protocol-based search structure to identify a third set of potential matching rules for the incoming packet based on a protocol of the incoming packet;
identifying a matching rule for the incoming packet from the first, second, and third sets of potential matching rules.
8. The non-transitory machine readable medium of claim 7 , wherein the port-based search structure comprises a discrete port value search structure for identifying one or more rules that each specifies a single explicit value for at least one of its source or destination port field.
9. The non-transitory machine readable medium of claim 8 , wherein the discrete port value search structure is a binary search tree, wherein each node in the binary search tree corresponds to a different discrete port value.
10. The non-transitory machine readable medium of claim 8 , wherein the port-based search structure further comprises a port expression search structure for identifying one or more rules that each specifies a range or collection of ports values by using expressions or relational operators.
11. The non-transitory machine readable medium of claim 10 , wherein the port expression search structure is a link list, wherein each node in the list corresponds to a different range or collection of port values.
12. The non-transitory machine readable medium of claim 7 , wherein the matching rule is the highest priority rule that matches the incoming packet in five fields of a connection five-tuple.