Efficient flow management utilizing unified logging
Techniques are disclosed for a smart network interface card (smartNIC) performing a unified logging process. In one example, an accelerator transmits a packet to a programming data plane of the smart network interface card. The programming data plane determines whether the packet is to be forwarded. In accordance with a determination that the packet is not be forwarded, the programming data plane modifies the packet to include an instruction that instructs the accelerator to log the packet and to not forward the packet. The programming data plane transmits the modified packet to the accelerator. The accelerator logs data associated with the modified packet to a unified log based at least in part on the instruction.
1. A computer-implemented method, comprising:
transmitting, by an accelerator of a smart network interface card, a packet to a programming data plane of the smart network interface card;
determining, by a programming data plane, whether the packet is to be forwarded; and
in accordance with a determination that the packet is not be forwarded:
modifying, by the programming data plane, the packet to include an instruction that instructs the accelerator to log the packet and to not forward the packet;
transmitting, by the programming data plane, the modified packet to the accelerator; and
logging, by the accelerator, data associated with the modified packet to a unified log based at least in part on the instruction.
2. The computer-implemented method of claim 1 , wherein determining whether the packet is to be forwarded comprises:
identifying an authorized flow; and
determining whether the packet is associated with an authorized flow, wherein the packet is to be forwarded based at least in part on whether the packet is associated with the authorized flow.
3. The computer-implemented method of claim 1 , wherein the accelerator manages cache entries of a cache, a cache entry storing flow state of an authorized flow associated with the packet, and wherein determining whether the packet is to be forwarded comprises:
identifying a policy associated with the cache entry; and
determining whether the packet conforms to the policy, wherein the packet is to be forwarded based at least in part on whether the packet conforms to the policy.
4. The computer-implemented method of claim 1 , wherein determining whether the packet is to be forwarded comprises:
accessing a security list stored at the programming data plane, the security list comprising a rule; and
determining whether the packet conforms to the rule, wherein the packet is to be forwarded based at least in part on whether the packet conforms to the rule.
5. The computer-implemented method of claim 1 , wherein the accelerator logs metadata associated with the modified packet to the unified log, the accelerator being configured to log metadata from packets processed by at least one of: the accelerator, or the programming data plane.
6. The computer-implemented method of claim 5 , wherein the metadata indicates that the packet was not forwarded to another device, the indication based at least in part on the instruction.
7. The computer-implemented method of claim 1 , wherein the programming data plane transmits the modified packet to the accelerator via a data bus that is configured to route packets that utilize a particular header format between the accelerator and the programming data plane.
8. A smart network interface card, comprising:
one or more processors;
one or more computer-readable media that, when executed by one or more processors, cause the smart network interface card to:
transmit, by an accelerator of the smart network interface card, a packet to a programming data plane of the smart network interface card;
determine, by a programming data plane, whether the packet should be forwarded based at least in part on whether the packet is associated with an authorized flow; and
in accordance with a determination that the packet should not be forwarded:
modify, by the programming data plane, the packet to include an instruction that instructs the accelerator to log the packet and to not forward the packet;
transmit, by the programming data plane, the modified packet to the accelerator; and
log, by the accelerator, data associated with the modified packet to a unified log based at least in part on the instruction.
9. The smart network interface card of claim 8 , wherein determining whether the packet is to be forwarded comprises:
identifying an authorized flow; and
determining whether the packet is associated with an authorized flow, wherein the packet is to be forwarded based at least in part on whether the packet is associated with the authorized flow.
10. The smart network interface card of claim 8 , wherein the accelerator manages cache entries of a cache, a cache entry storing flow state of an authorized flow associated with the packet, and wherein determining whether the packet is to be forwarded comprises:
identifying a policy associated with the cache entry; and
determining whether the packet conforms to the policy, wherein the packet is to be forwarded based at least in part on whether the packet conforms to the policy.
11. The smart network interface card of claim 8 , wherein determining whether the packet is to be forwarded comprises:
accessing a security list stored at the programming data plane, the security list comprising a rule; and
determining whether the packet conforms to the rule, wherein the packet is to be forwarded based at least in part on whether the packet conforms to the rule.
12. The smart network interface card of claim 8 , wherein the accelerator logs metadata associated with the modified packet to the unified log, the accelerator being configured to log metadata from packets processed by at least one of: the accelerator, or the programming data plane.
13. The smart network interface card of claim 12 , wherein the metadata indicates that the packet was not forwarded to another device, the indication based at least in part on the instruction.
14. The smart network interface card of claim 8 , wherein the programming data plane transmits the modified packet to the accelerator via a data bus that is configured to route packets that utilize a particular header format between the accelerator and the programming data plane.
15. One or more non-transitory computer-readable storage media comprising a set of instructions that, when executed by one or more processors, cause a smart network interface card to:
transmit, by an accelerator of the smart network interface card, a packet to a programming data plane of the smart network interface card;
determine, by a programming data plane, whether the packet should be forwarded based at least in part on whether the packet is associated with an authorized flow; and
in accordance with a determination that the packet should not be forwarded:
modify, by the programming data plane, the packet to include an instruction that instructs the accelerator to log the packet and to not forward the packet;
transmit, by the programming data plane, the modified packet to the accelerator; and
log, by the accelerator, data associated with the modified packet to a unified log based at least in part on the instruction.
16. The one or more non-transitory computer-readable storage media of claim 15 , wherein the accelerator manages cache entries of a cache, a cache entry storing flow state of a particular authorized flow, and wherein the accelerator determines that the packet is not associated with the authorized flow based at least in part on determining that the packet is not associated with a cache entry of the cache.
17. The one or more non-transitory computer-readable storage media of claim 15 , wherein determining whether the packet is to be forwarded comprises:
identifying an authorized flow; and
determining whether the packet is associated with an authorized flow, wherein the packet is to be forwarded based at least in part on whether the packet is associated with the authorized flow.
18. The one or more non-transitory computer-readable storage media of claim 15 , wherein the accelerator manages cache entries of a cache, a cache entry storing flow state of an authorized flow associated with the packet, and wherein determining whether the packet is to be forwarded comprises:
identifying a policy associated with the cache entry; and
determining whether the packet conforms to the policy, wherein the packet is to be forwarded based at least in part on whether the packet conforms to the policy.
19. The one or more non-transitory computer-readable storage media of claim 15 , wherein determining whether the packet is to be forwarded comprises:
accessing a security list stored at the programming data plane, the security list comprising a rule; and
determining whether the packet conforms to the rule, wherein the packet is to be forwarded based at least in part on whether the packet conforms to the rule.
20. The one or more non-transitory computer-readable storage media of claim 19 , wherein the metadata indicates that the packet was not forwarded to another device, the indication based at least in part on the instruction.