FIELD

The present invention generally relates to a stateful packet processing system.

BACKGROUND

The Software-Defined Networking (SDN) paradigm brings a separation of packet forwarding (data plane) and the control plane functions. Being widely adopted, the OpenFlow protocol provides flow-level abstractions for remote programming of switch's data plane from a centralized controller. A controller instructs an underlying switch with per-flow rules by means of specific Flow_Mod messages. Such message contains match and action parts with the first specifying the packet headers to match and with the second applying a particular processing decision to all the packets belonging to the specified flow. These forwarding rules are translated into the forwarding table statements and become installed into one or several forwarding tables of a table pipeline (as specified in “Openflow Switch Specification,” version 1.1.0 (Feb. 28, 2011) (available at archive.openflow.org/in the path: documents/openflow-spec-v1.1.0.pdf)). Such forwarding abstraction implies stateless packet processing in the table pipeline, meaning that any possible state transitions of any particular flow may be implemented only on the controller's side. This means that any forwarding logic that needs stateful packet processing requires several interactions between the switch and the controller. Examples of stateful processing applications which may involve such interactions are: traffic anomalies detection, firewall-like primitives (e.g. reflexive ACL), adaptive QoS enforcement, etc.

OpenState (as described, for instance, in Giuseppe Bianchi, Marco Bonola, Antonio Capone, and Carmelo Cascone: “OpenState: Programming Platform-independent Stateful OpenFlow Applications Inside the Switch”, in SIGCOMM Comput. Commun. Rev. 44, 2 (April 2014), 44-51) enables an extension to flow-oriented stateless processing which enhances forwarding engines with an eXtended Finite State Machine (XFSM). This extension allows to track the state of each flow in the switching pipeline and to perform transitions of this state by adding to the stateless forwarding architecture two tables: state table and XFSM (or, briefly, FSM) table.

State table, as the first of the two tables of the architecture, is a key-value first-match-lookup table. In the state table a first-match lookup is performed to match some packet header(s) of an incoming flow against the state associated with this flow. In the FSM table, a combination of packet headers and the transferred state is a key for the next lookup. If a flow's state update is needed, a feedback loop becomes involved between the two tables passing a message with a state update for a particular flow from the FSM table to the state table.

SUMMARY

An embodiment of the present invention provides a stateful network packet processing system. This system includes: a first stateful stage including a first state table and a first finite state machine (“FSM”) table; and a second stateful stage including a second state table and a second FSM table. The system is configured to perform a distribution operation that defines when a flow should be processed by either the first stateful stage or the second stateful stage or by a combination of the first stateful stage and the second stateful stage. At least one of the first FSM table or the second FSM table is extended with states and transitions that support the distribution operation. At least one of the first stateful stage or the second stateful stage is configured to execute an evaluation operation comprising executing the distribution operation. The evaluation operation provides a criterion for moving a particular flow from one of the first stateful stage or the second stateful stage to a respective other stateful stage of the first stateful stage or the second stateful stage. The first stateful stage and the second stateful stage are included in a software-defined networking (“SDN”) switch. The distribution operation is configured to operate within defined capabilities of at least one of a software pipeline or a hardware pipeline of the SDN switch.

