【作者】 孙宇；

【导师】 罗军舟；

【作者基本信息】 东南大学 ， 计算机软件与理论， 2006， 硕士

【摘要】 随着近年来全球网络带宽的飞速增长,对网络设备尤其是边界接入设备的性能要求越来越高,与此同时,日新月异的网络应用又对网络设备功能上的灵活性、可维护性提出了更高的要求。防火墙技术发展至今,同样面临这两方面的问题。传统设计模式中,基于x86的软件防火墙可以解决功能与协议快速支持的问题,基于ASIC的硬件防火墙则能够解决性能及可扩展性上的问题,然而两者无法兼顾现今性能与功能两方面的要求。网络处理器的出现为防火墙设计提供了新的思路,基于网络处理器的防火墙系统同时具备采用ASIC纯硬解决方案的高性能和通用CPU软件解决方案的高灵活性。论文对Intel网络处理器硬件和软件体系结构进行了研究,给出了一个基于IXP2400网络处理器的防火墙系统整体设计方案,该设计充分利用了网络处理器硬件的微引擎多线程并行处理能力,并且构造出层次型、模块化的软件实施框架。此外,论文完成了对微引擎数据层面的路由转发、包过滤和网络地址转换三个核心功能微块的设计和实现,相关章节先从包分类的角度进行理论分析,再结合IXP2400网络处理器的特性设计辅助数据结构及查找算法,最后通过在各自的极端条件下进行测试验证了各模块的设计方案,并证明了系统能够达到线速的包处理性能。更多还原

【Abstract】 Along with the rapid growth of global network bandwidth in recent years, the speed requirement of network devices especially edge/access devices gets higher. At the same time, quickly developing network applications call for devices with more flexibility and lower cost of change. Nowadays firewall technology also faces the dilemma concering speed and flexibility. Designed on traditional platforms, software firewall on x86 architecture solved new application and protocol supporting problem, while hardware firewall based on ASIC met the need for speed and scalability. However, neither of them could achieve advantages in both speed and flexibility. The emergence of network processor brings a brand new solution. Firewall system based on network processor combines the speed of ASIC with the flexibility provided by the common CPU.The paper’s research work includes the study of hardware and software architecture of Intel IXP2400 network processor. By utilizing hardware parallelism of multi-thread microengines, as well as constructing layered and modularized software framework, an architecture design of the firewall system based on IXP2400 is introduced. Furthermore, three core function——Forwarder, Filter and NAT microblock in the microengine data-plane are designed and implemented. After theoretical analysis using packet classification perspective and considering advantages brought by the hardware platform, assistant data structure for each microblock and its lookup flowchart are introduced. The design is validated by tests under critical circumstance respectively to each module. It also proves that the system could generally run well in the line rate.更多还原