Protocol-independent multi-table packet routing using shared memory resource

1. A system comprising:

one or more memories storing a first flow table, a second flow table, and a shared hash table accessible by both the first flow table and the second flow table, wherein the first flow table and the second flow table are capable of routing packets having any combination of protocol headers, including protocol headers for protocols that were not yet developed at a time the shared hash table was developed;

one or more processors in communication with the one or more memories, the one or more processors configured to:

generate, in response to receiving a first packet at the first flow table, a first secure signature of a lookup key of the first flow table;

generate, in response to receiving the first packet at the second flow table, a second secure signature of a lookup key for the second flow table;

store, in the shared hash table, the first secure signature and a first value corresponding to the first secure signature; and

store, in the shared hash table, the second secure signature and a second value corresponding to the second secure signature.

2. The system of claim 1 , wherein the one or more processors, in generating the first secure signature, are further configured to:

detect one or more protocol headers of the first packet;

select one or more sets of bytes of the first packet based on the detected one or more protocol headers;

construct a header N-tuple vector using the selected sets of bytes;

form a hash vector by appending a unique flow table identifier programmed for the first table to the header N-tuple vector; and

hash the hash vector with a secret hash key.

3. The system of claim 2 , wherein the one or more memories further store at least one N-tuple definition in association with the first flow table, the N-tuple definition corresponding to the detected one or more protocol headers.

4. The system of claim 3 , wherein the N-tuple definition is a mask of a first number of bytes of the packet header.

5. The system of claim 2 , wherein forming the hash vector further comprises pre-appending metadata to the N-tuple vector.

6. The system of claim 2 , wherein the one or more processors are further configured to pad the hash vector to a predetermined length.

7. The system of claim 2 , wherein hashing the hash vector comprises using a keyed secure crypto hash.

8. The system of claim 1 , wherein the first and second values designate routing destinations for packets which produce corresponding lookup keys.

9. A method, comprising:

generating, in response to receiving a first packet at a first flow table, a first secure signature of a lookup key of the first flow table;

generating, in response to receiving the first packet at a second flow table, a second secure signature of a lookup key for the second flow table;

storing, in a shared hash table, the first secure signature and a first value corresponding to the first secure signature; and

storing, in the shared hash table, the second secure signature and a second value corresponding to the second secure signature,

wherein the first flow table and the second flow table are capable of routing packets having any combination of protocol headers, including protocol headers for protocols that were not yet developed at a time the shared hash table was developed.

10. The method of claim 9 , wherein generating the first secure signature comprises:

detecting one or more protocol headers of the first packet;

selecting one or more sets of bytes of the first packet based on the detected one or more protocol headers;

constructing a header N-tuple vector using the selected sets of bytes;

forming a hash vector by appending a unique flow table identifier programmed for the first table to the header N-tuple vector; and

hashing the hash vector with a secret hash key.

11. The method of claim 10 , wherein selecting one or more sets of bytes of the first packet comprises programming an N-tuple definition in the first flow table for the one or more protocol headers detected in a given packet.

12. The method of claim 11 , wherein the N-tuple definition is a mask of a first number of bytes of the packet header.

13. The method of claim 10 , wherein forming the hash vector further comprises pre-appending metadata to the N-tuple vector.

14. The method of claim 10 , further comprising zero padding the hash vector.

15. The method of claim 10 , wherein hashing the hash vector comprises using a keyed secure crypto hash.

16. The method of claim 9 , wherein the first and second values designate routing destinations for packets which produce corresponding lookup keys.

17. A chip, comprising:

one or more ingress ports for receiving data packets; and

a memory storing a hash table, the hash table being accessible by a plurality of different flow tables;

wherein the chip is adapted to:

receive an incoming data packet having any combination of headers, including headers developed after the chip was developed;

generate a first lookup key signature based on a first header and a first of the plurality of different flow tables;

access the hash table, using the generated first lookup key signature, to determine destination information for the packet; and

transmit the packet based on the destination information, wherein transmitting the packet comprises sending the packet to a second of the plurality of different flow tables.

18. The chip of claim 17 , wherein the chip is further configured to:

generate a second lookup key signature based on a second header and the second of the plurality of different flow tables;

access the hash table using the generated second lookup key signature to determine next destination information for the packet; and

transmit the packet based on the next destination information.