Load balancing ipsec tunnel processing with extended berkeley packet filer (ebpf)
AssigneeNicira, Inc.
InventorsYong WANG, Brenden BLANCO, Ly LOI
Life of this patent
Estimating the term…
Abstract
Certain embodiments described herein are generally directed to load balancing IPSec tunnels at an extended Berkeley Packet Filter (eBPF) module of a destination tunnel endpoint for encapsulated ESP encrypted data packets for encapsulated encrypted data packets based on a security parameter index value of the encapsulated encrypted data packets.
Claims30
A method for processing encapsulated encrypted data packets at an extended Berkeley Packet Filter (eBPF) module on a host machine, comprising:
- receiving, at the eBPF module, an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;
- selecting a CPU core ID from a plurality of CPU cored IDs based at least in part on the SPI value, wherein the CPU core ID corresponds to a virtual CPU of a plurality of virtual CPUs;
- and
- inserting the CPU core ID into the encapsulated encrypted data packet;
- passing the encapsulated encrypted data packet to a receive packet steering (RPS) module for assignment of the encapsulated encrypted data packet to the virtual CPU based on the CPU core ID.
A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for processing encapsulated encrypted data packets at an extended Berkeley Packet Filter (eBPF) module on a host machine, the method comprising:
- receiving, at the eBPF module, an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;
- selecting a CPU core ID from a plurality of CPU cored IDs based at least in part on the SPI value, wherein the CPU core ID corresponds to a virtual CPU of a plurality of virtual CPUs;
- and
- inserting the CPU core ID into the encapsulated encrypted data packet;
- passing the encapsulated encrypted data packet to a receive packet steering (RPS) module for assignment of the encapsulated encrypted data packet to the virtual CPU based on the CPU core ID.
A computer system, wherein system software for the computer system is programmed to execute a method for processing encapsulated encrypted data packets at an extended Berkeley Packet Filter (eBPF) module on a host machine, the method comprising:
- receiving, at the eBPF module, an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;
- selecting a CPU core ID from a plurality of CPU cored IDs based at least in part on the SPI value, wherein the CPU core ID corresponds to a virtual CPU of a plurality of virtual CPUs;
- and
- inserting the CPU core ID into the encapsulated encrypted data packet;
- passing the encapsulated encrypted data packet to a receive packet steering (RPS) module for assignment of the encapsulated encrypted data packet to the virtual CPU based on the CPU core ID.
Dependencies are inferred from the claim text.