Representation of match conditions in logical pipeline data

• US 10,476,735 B2
• Filed: 11/18/2015
• Issued: 11/12/2019
• Est. Priority Date: 10/31/2015
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Pfaff, Benjamin L., Pettit, Justin
• Primary Examiner(s): Nguyen, Dustin
• Application Number:
  US14/944,505
• Publication Number:
  US 20170126551A1
• Time in Patent Office: 1,455 Days
• CPC Class Codes: G06F 16/2282 Tablespace storage structures; Management thereof
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0886 Fully automatic configuration
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/342 between virtual entities, e.g. orchestrators, SDN or NFV entities
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/56 Routing software
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Some embodiments provide a method that receives several flow descriptions. Each flow description includes a set of match conditions and corresponding set of actions. Each set of match conditions is represented as a combination of Boolean and relational operators in a flow description language. The method generates one or more flow entries for each flow description. The flow entries are generated in a format useable by a managed forwarding element (MFE). The method distributes the generated flow entries to the MFE in order for the MFE to implement network operations described by the plurality of flow descriptions.

Claims

1. A method for generating flow entries for a managed forwarding element (MFE), the method comprising:

receiving a plurality of flow descriptions for processing packets by logical forwarding elements, each flow description comprising a set of match conditions and corresponding set of actions, wherein each set of match conditions in the flow descriptions is represented as a combination of Boolean operators and relational operators in a flow description language, wherein a particular set of match conditions in a particular flow description uses one or more relational operators, including at least one of a greater-than operator and a less-than operator, to define a range of allowable values for a particular packet field;

generating, for each flow description, one or more flow entries in a format useable by the MFE, wherein a particular flow entry generated from the particular flow description based on the particular set of match conditions uses a bitmask of the particular packet field to match over at least a portion of the range of allowable values for the packet field defined by the at least one relational operator; and

distributing the generated flow entries to the MFE to use to implement network operations described by the plurality of flow descriptions.

2. The method of claim 1, wherein the method is performed by a controller agent operating on a host computer with the MFE.

3. The method of claim 1, wherein a particular set of at least two flow entries are generated for the particular flow description that comprises the particular set of match conditions, wherein the particular flow entry that uses the bitmask is a first flow entry, wherein a second flow entry generated from the particular flow description based on the particular set of match conditions comprises a match over a single value that is in the range of allowable values but outside the portion of the range of allowable values.

4. The method of claim 1, wherein the match conditions in the flow description language comprise a set of relations of fields to constant values, with multiple relations joined by Boolean operators.

5. The method of claim 4, wherein the particular set of match conditions is a first set of match conditions and the particular field is a first field, wherein a particular relation within a second set of match conditions relates a second field to a plurality of allowable values for the second field.

6. The method of claim 5, wherein the generated flow entries for the second set of match conditions each relate the second field to only one of the allowable values for the second field.

7. The method of claim 1, wherein the plurality of flow descriptions comprises a particular set of flow descriptions using a set of relational operators, said particular set of flow descriptions for (i) logical forwarding within logical forwarding elements and (ii) access control list (ACL) rules for the logical forwarding elements.

8. The method of claim 1, wherein the plurality of flow descriptions are received as database table records with match and action fields.

9. The method of claim 8, wherein the flow descriptions describe at least one logical network, the method further comprising receiving additional database table records describing (i) a physical network to which the MFE belongs and (ii) bindings between the at least one logical network and the physical network.

10. The method of claim 9 further comprising:

generating additional flow entries based on the physical network and bindings database table records; and

distributing the additional flow entries to the MFE.

19. The method of claim 1, wherein the combination of Boolean and relational operators comprises parentheses, an AND operator, an OR operator, an equality operator, and a negation operator.

20. The method of claim 1, wherein the bitmask of the particular field matches on a subset of bits of the particular field.

11. A non-transitory machine readable medium storing a program for execution by at least one processing unit, the program comprising sets of instructions for:

receiving a plurality of flow descriptions, each flow description comprising a set of match conditions and corresponding set of actions, wherein each set of match conditions is represented as a combination of Boolean operators and relational operators in a flow description language, wherein a particular set of match conditions uses one or more relational operators, including at least one of a greater-than operator and a less-than operator to define a range of allowable values for a particular field;

generating, for each flow description, one or more flow entries in a format useable by managed forwarding element (MFE), wherein a flow entry generated based on the particular set of match conditions uses a bitmask of the particular field to match over at least a portion of the range of allowable values defined by the at least one relational operator; and

distributing the generated flow entries to the MFE to use to implement network operations described by the plurality of flow descriptions.

12. The non-transitory machine readable medium of claim 11, wherein the program is a controller agent executed on a host computer that also executes the MFE.

13. The non-transitory machine readable medium of claim 11, wherein a plurality of flow entries are generated for a particular flow description that comprises the particular set of match conditions, wherein the flow entry that uses the bitmask is a first flow entry, wherein a second flow entry generated based on the particular set of match conditions comprises a match over a single value that is in the range of allowable values but outside the portion of the range of allowable values.

14. The non-transitory machine readable medium of claim 11, wherein the match conditions in the flow description language comprise a set of relations of fields to constant values, with multiple relations joined by Boolean operators.

15. The non-transitory machine readable medium of claim 14, wherein the particular set of match conditions is a first set of match conditions and the particular field is a first field, wherein a particular relation within a second set of match conditions relates a second field to a plurality of allowable values for the second field, wherein the generated flow entries for the second set of match conditions each relate the second field to only one of the allowable values for the second field.

16. The non-transitory machine readable medium of claim 11, wherein the plurality of flow descriptions comprises flow descriptions for (i) logical forwarding within logical forwarding elements and (ii) access control list (ACL) rules for the logical forwarding elements.

17. The non-transitory machine readable medium of claim 11, wherein the plurality of flow descriptions are received as database table records with match and action fields, wherein the flow descriptions describe at least one logical network, the program further comprising a set of instructions for receiving additional database table records describing (i) a physical network to which the MFE belongs and (ii) bindings between the at least one logical network and the physical network.

18. The non-transitory machine readable medium of claim 17, wherein the program further comprises sets of instructions for:

generating additional flow entries based on the physical network and bindings database table records; and

distributing the additional flow entries to the MFE.