Systems and methods for packet steering in a multi-core architecture
Described herein is a method and system for distributing whole and fragmented requests and responses across a multi-core system. Each core executes a packet engine that further processes data packets and data packet fragments allocated to that core. A flow distributor executing within the multi-core system forwards client requests to a packet engine on a core that is selected based on a value generated when a hash is applied to a tuple comprising a client IP address, a client port, a server IP address and a server port identified in the request. The packet engine maintains each element of the tuple and forwards the request to the selected core. The packet engine can also process data packet fragments by assembling the fragments prior to transmitting them to the selected core, or by transmitting the data packet fragments to the selected core.
1. A method for directing by a flow distributor network packets to a packet engine of a plurality of packet engines while maintaining a client internet protocol address and a client port, each of the plurality of packet engines executing on a core of a plurality of cores in a multi-core system intermediary to the client and a server, the method comprising:
a) receiving, from a flow distributor by a packet engine on a first core of the multi-core system intermediary to a client and a server, a client request identifying a first tuple comprising a client internet protocol address, a client port, a server internet protocol address and a server port, the first core selected by the flow distributor to receive the client request based on a hash of the first tuple;
b) receiving, by the flow distributor, a response to the client request forwarded to the server by the packet engine, the response generated by the server and comprising a second tuple identifying, via a hash of the second tuple, a second core different than the first core of the packet engine receiving the request;
c) forwarding, by the flow distributor, the received response to a second packet engine of the second core; and
d) directing, responsive to a rule of the flow distributor executing on the second core, the response received by the second core to the first core.
2. The method of claim 1 , wherein step (c) further comprises storing, by the second packet engine of the second core, one or more network packets of the response to a memory location accessible by the first core.
3. The method of claim 1 , further comprising sending, by a second core to the first core, a message to identify the response is to be processed by the packet engine of the first core.
4. The method of claim 2 , wherein the memory location is a shared buffer accessible by each core in the multi-core system.
5. The method of claim 1 , wherein step (c) further comprises determining, by the second packet engine of the second core, the response corresponds to a request not processed by the second packet engine.
6. The method of claim 5 , wherein determining the response corresponds to a request not processed by the second packet engine further comprises calculating a hash of a tuple of the response, the hash identifying the first core.
7. The method of claim 5 , wherein determining the response corresponds to a request not processed by the second packet engine further comprises looking up a port in a port allocation table to identify the first core.
8. The method of claim 1 , wherein step (a) further comprises forwarding, by the packet engine on the first core, the client request to a server.
9. The method of claim 8 , further comprising maintaining the client internet protocol address and the client port in the first tuple.
10. The method of claim 1 , wherein step (b) further comprises receiving a response comprising a second tuple comprising at least the client internet protocol address and the client port of the first tuple.
11. The method of claim 1 , wherein the hash applied to the first tuple is substantially the same as the hash applied to the second tuple.
12. The method of claim 1 , wherein the flow distributor selects the first core based in part on a hash of the first tuple.
13. The method of claim 1 , further comprising maintaining the client internet protocol address responsive to a packet engine configured to maintain client internet protocol addresses.
14. The method of claim 13 , further comprising configuring the packet engine responsive to a security policy requiring maintenance of client internet protocol addresses.
15. The method of claim 1 , further comprising maintaining the client port responsive to a packet engine configured to maintain client ports.
16. The method of claim 15 , further comprising configuring the packet engine responsive to a security policy requiring maintenance of client ports.
17. A method for directing by a flow distributor fragmented network packets to a packet engine of a plurality of packet engines, each of the plurality of packet engines executing on a respective core of a plurality of cores in a multi-core system intermediary to the client and a server, the method comprising:
a) receiving, from a flow distributor by a packet engine on a first core of the multi-core system intermediary to a client and a server, a client request identifying a first tuple comprising a client internet protocol address, a client port, a server internet protocol address and a server port, the first core selected by the flow distributor to receive the client request based on a hash of the first tuple;
b) receiving, by the flow distributor, a plurality of fragments of a response from the server to the request of client forwarded to the server by the packet engine on the first core;
c) distributing, by the flow distributor, the plurality of fragments of the response to a second core responsive to a second hash computed by the flow distributor on the source internet protocol address and destination internet protocol address identified by the plurality of fragments;
d) storing, by a second packet engine of the second core, the plurality of fragments and performing one or more fragmentation actions on the plurality of fragments; and
e) determining, by a rule of the flow distributor operating on the second core, to direct the plurality of fragments received by the second core to the first core.
18. The method of claim 17 , wherein step (d) further comprises assembling, by the second packet engine, the plurality of fragments.
19. The method of claim 18 , wherein step (e) further comprise storing, by the second packet engine, the assembled plurality of fragments in a memory location accessible by the first core.
20. The method of claim 19 , further comprising sending by the second core to the first core a message to direct the first core to process the assembled plurality of fragments.
21. The method of claim 17 , wherein step (e) further comprises determining by the second core that the first core established the connection.
22. The method of claim 17 , wherein step (d) further comprises performing an assembly action.
23. The method of claim 17 , wherein step (d) further comprises performing a bridging action.
24. The method of claim 17 , further comprising steering the plurality of fragments to the first core.
25. The method of claim 17 , wherein step (b) further comprises assembling, by the flow distributor, a portion of the plurality of fragments.
26. The method of claim 25 , wherein step (c) further comprises extracting the source internet protocol address and the destination internet protocol address of the second tuple from the portion of the assembled plurality of fragments.
27. The method of claim 25 , further comprising assembling the portion of the plurality of fragments until a header of the response is assembled.
28. The method of claim 27 , further comprising extracting the source internet protocol address and the destination internet protocol address of the second tuple from the assembled response header.