WO2015101119A1 - 一种流表匹配的方法、装置和OpenFlow交换*** - Google Patents

一种流表匹配的方法、装置和OpenFlow交换*** Download PDF

Info

Publication number
WO2015101119A1
WO2015101119A1 PCT/CN2014/092170 CN2014092170W WO2015101119A1 WO 2015101119 A1 WO2015101119 A1 WO 2015101119A1 CN 2014092170 W CN2014092170 W CN 2014092170W WO 2015101119 A1 WO2015101119 A1 WO 2015101119A1
Authority
WO
WIPO (PCT)
Prior art keywords
matching
instruction
field
flow
flow table
Prior art date
Application number
PCT/CN2014/092170
Other languages
English (en)
French (fr)
Inventor
冯强
沈伟锋
赵秀楚
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2015101119A1 publication Critical patent/WO2015101119A1/zh
Priority to US15/198,268 priority Critical patent/US9887912B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Definitions

  • the present invention relates to the field of data exchange, and in particular, to a method, an apparatus, and an OpenFlow switching system for matching a flow table.
  • OpenFlow technology allows programming a network as if it were a computer.
  • OpenFlow and Software Defined Network can provide the abstraction layer of the physical network directly to the control component, allowing the network to be set up and operated through software.
  • the core idea of OpenFlow technology is to completely control the data controlled by the switch/router. The packet forwarding process is transformed into an independent process performed by the OpenFlow Switch (OpenFlow Switch) and the Control Server (Controller) respectively.
  • the OpenFlow switch consists of a flow table, a secure channel and an OpenFlow protocol.
  • the flow table consists of a Match Field, Counters, and Instructions. It is used to store packet forwarding. Rules, the secure channel is the interface that connects the OpenFlow switch to the controller, and the OpenFlow protocol is used to describe the criteria used for the interaction between the controller and the switch.
  • the OpenFlow switch executes commands from the OpenFlow controller in the OpenFlow network, and forwards the received data packets according to the flow rules sent by the controller. When the OpenFlow switch cannot find a corresponding forwarding rule for a received data packet, the data packet is forwarded to the controller, and the controller determines the forwarding action of the packet and sends a new forwarding rule to the OpenFlow switch.
  • the packet matching performed by the existing OpenFlow switch can only be performed based on a limited field, that is, the matching field of the flow table cannot be dynamically updated. For example, suppose the matching field of the flow table only has three fields of the field A, the field B or the field C specified by the protocol for the matching of the data packet. When a data packet is used to represent the data field corresponding to the data packet, the characteristic field is a field. D, that is, when it is not one of the fields A, B, and C, if the OpenFlow switch matches the data packet, the matching field of the flow table needs to be extended to the field A, the field B, the field C, and the field. D. This extension often comes at a price, for example, re-changing hardware logic, for current software and / Or upgrade the hardware.
  • Embodiments of the present invention provide a method, an apparatus, and an OpenFlow switching system for matching a flow table, so as to implement matching of any field in an arbitrary data stream without changing existing hardware logic and a standard protocol.
  • a first aspect a method for matching a flow table, comprising: receiving, by a controller, a jump instruction and a matching instruction that are sent by the controller, where the matching instruction is used to indicate that the matching field is mapped to a mapped value, and the The mapping value is written to the metadata Metadata field and is passed to the second flow table, where the matching instruction includes a parameter for mapping the matching field to the mapping value, and the jump instruction is used to indicate the Second-rate table
  • the ith The stream mode message includes an i th jump instruction, an i th match instruction, and an i th metadata Metadata value for matching the i th match field, where the i th match instruction is used to indicate that the The i matching fields are mapped to an i th mapping value, where the i th matching field is the (i-1)*Nm+1 byte to the i*Nm byte in the field to be matched.
  • the i-th matching instruction includes a parameter for mapping the i-th matching field to the i-th mapping value, where the i-th jump instruction is used to indicate a next-class table of the jump,
  • the second flow table is the second flow table
  • the lower-level table of the i-th flow table is the i+1th flow table
  • the lower-level table of the n-th flow table is the final flow table;
  • an n-1 flow entry is established in the n-1 flow table, where an i th flow entry is established in the i th flow table, and a matching domain of the i th flow entry is The ith metadata Metedata value, the instruction set of the i-th flow entry is the ith jump instruction and the ith match instruction, and the matching field of the i-th flow entry
  • the first mapping value Mp1 is the first Mapping the value Mp1
  • the i-th matching instruction is configured to: according to the parameter included in the i-th matching instruction for mapping the i-th matching field to the i-th mapping value,
  • the i matching fields are mapped to the i-th mapping value Mpi, and the i-th mapping value Mpi is written into the metadata Metadata field of the i-th flow table, and the i-th jump instruction is used for the jump Passing the data packet and
  • the final flow mode message includes a behavior instruction and an nth metadata Metadata value for matching the nth matching field;
  • a device for matching a flow table includes: a first receiving module, configured to receive a jump instruction and a matching instruction that are sent by the controller for the first flow table, where the matching instruction is used to indicate that the matching is to be matched Mapping a field to a mapping value, and writing the mapping value to a metadata Metadata field, to the second flow table, where the matching instruction includes a parameter for mapping the matching field to the mapping value, The jump instruction is used to indicate a second flow table of the jump;
  • a first establishing module configured to establish a first flow entry in the first flow table, where an instruction set of the first flow entry is the jump instruction and the matching instruction, where the matching instruction is used in a switch
  • a second receiving module configured to receive a flow mode message sent by the controller for the second flow table, where the flow mode message includes a behavior instruction and a metadata Metadata value for matching the matching field;
  • a second establishing module configured to establish a second flow entry in the second flow table, where the instruction set of the second flow entry is the behavior instruction, and the matching domain of the second flow entry is a metadata Metedata value, wherein a matching field of the second flow entry is used to match the mapping value Mp, and the behavior instruction is used to process the data packet according to a matching result.
  • a third establishing module configured to establish a first flow entry in the first flow table, where the instruction set of the first flow entry is the first jump instruction and the first matching instruction, where the first a matching command, after the switch receives the data packet, mapping the first matching field according to a parameter included in the first matching instruction for mapping the first matching field to the first mapping value Is a first mapping value Mp1, and writing the first mapping value Mp1 to a metadata Metadata field of the first flow table, where the first jump instruction is used to jump to the second flow table, Transmitting, by the data packet, the first mapping value Mp1 written in the metadata Metadata field of the first flow table to the second flow table;
  • the fourth receiving module is configured to receive the n-1 flow mode messages sent by the controller for the n-1 flow tables, where the i th flow mode message is sent for the i th flow table, n ⁇ i ⁇ 2, the i-th stream mode message includes an i-th jump instruction, an i-th matching instruction, and an i-th metadata Metadata value for matching an i-th matching field, the i-th matching instruction And indicating that the i th matching field is mapped to an i th mapping value, where the i th matching field is the (i-1)*Nm+1 byte to the i th in the field that needs to be matched.
  • the i-th matching instruction includes a parameter for mapping the i-th matching field to the i-th mapping value
  • the i-th jump instruction is used to indicate a jump
  • the lower-level table is the second flow table
  • the lower-level table of the i-th flow table is the i+1th flow table
  • the lower-level table of the n-th flow table is Final flow table
  • a fourth establishing module configured to establish n-1 flow entries in the n-1 flow tables, where an i th flow list entry is created in the i th flow table, where the i th The matching field of the flow entry is the ith metadata Metedata value, and the instruction set of the i-th flow entry is the ith jump instruction and the ith matching instruction, the ith The matching field of the flow entry is used to match the i-1th mapping value Mpi-1, and the i-th jump instruction and the i-th matching instruction are executed according to the matching result, the first The mapping value Mp1 is a first mapping value Mp1, and the ith matching instruction is configured to map the ith matching field to the ith mapping value according to the ith matching instruction a parameter, mapping the i-th matching field to an i-th mapping value Mpi, and writing the i-th mapping value Mpi into a metadata Metadata field of the i-th flow table, the ith a jump instruction is used to jump to a lower-level
  • a fifth receiving module configured to receive a final flow mode message sent by the controller for the final flow table, where the final flow mode message includes a behavior instruction and an nth metadata used to match the nth matching field Metadata value;
  • a fifth establishing module configured to establish a final flow entry in the final flow table, where an instruction set of the final flow entry is the behavior instruction, and a matching domain of the final flow entry is the nth a metadata Metedata value, wherein a matching field of the final flow entry is used to match the nth mapping value Mpn, and the behavior instruction is used to process the data packet according to a matching result.
  • a fifth aspect is an OpenFlow switching system, where the switching system includes a switch and a controller, where the switch includes a first receiving module, a first establishing module, a second receiving module, and a second establishing module;
  • the controller is configured to send a jump instruction and a matching instruction to the first flow table to the switch, and send a flow mode message for the second flow table to the switch, where the matching instruction is used Instructing to map the matching field to a mapping value, and writing the mapping value to the metadata Metadata field, to the second flow table, where the matching instruction includes a parameter for mapping the matching field to the mapping value
  • the jump instruction is used to indicate a second flow table of the jump, where the flow mode message includes a behavior instruction and a metadata Metadata value for matching the matching field;
  • the first receiving module is configured to send, by the receiving controller, the jump instruction and the matching instruction that are sent by the first flow table;
  • the first establishing module is configured to establish a first flow entry in the first flow table, where an instruction set of the first flow entry is the jump instruction and the matching instruction, where the matching instruction is used by After the switch receives the data packet, mapping the matching field to the mapping value Mp according to the parameter included in the matching instruction for mapping the matching field to the mapping value, and mapping the mapping value to Mp Writing a metadata data field, the jump instruction is used to jump to the second flow table, and transmitting the data packet and the mapping value Mp written in the metadata metadata field to the first Second-rate table
  • the second receiving module is configured to receive the flow mode message that is sent by the controller for the second flow table
  • the second establishing module is configured to establish a second flow entry in the second flow table, where the instruction set of the second flow entry is the behavior instruction, and the matching domain of the second flow entry
  • the metadata Metedata value wherein the matching field of the second flow entry is used to match the mapping value Mp, and the behavior instruction is used to process the data packet according to the matching result.
  • a sixth aspect is an OpenFlow switching system, where the switching system includes a switch and a controller, where the switch includes a third receiving module, a third establishing module, a fourth receiving module, a fourth establishing module, a fifth receiving module, and a Five building modules;
  • the controller is configured to send, to the switch, a first jump instruction and a first matching instruction for the first flow table, and send, to the switch, n-1 flow mode messages for n-1 flow tables And delivering, to the switch, a final flow mode message for the final flow table, the first matching instruction is configured to indicate that the first matching field is mapped to the first mapping value, and the first mapping value is written to the element a data metadata field, which is passed to the second flow table, where the first matching instruction includes a parameter for mapping the first matching field to the first mapping value, and the first jump instruction is used to indicate a jump
  • the first matching field is the first byte to the Nth byte in the field that needs to be matched, and the i th flow mode message is sent for the i th flow table, where n ⁇ i ⁇ 2,
  • the i-th stream mode message includes an i-th jump instruction, an i-th matching instruction, and is used to match the i-th match
  • the i-th metadata of the matching field is used to indicate that the i-th matching field is mapped to the i-th mapping value
  • the i-th matching field is the a (i-1)*Nm+1 byte to an i**mth byte in the field, where the i-th matching instruction includes mapping the i-th matching field to the i-th a parameter of the mapping value, the i-th jump instruction is used to indicate a next-stage table of the jump, the second flow table is a second flow table, and the lower-level table of the i-th flow table is the i-th +1 flow table, the next best table of
  • the third receiving module is configured to receive the first jump instruction and the first matching instruction that are sent by the controller for the first flow table;
  • the third establishing module is configured to establish a first flow entry in the first flow table, where the instruction set of the first flow entry is the first jump instruction and the first matching instruction, where The first matching instruction is used after the switch receives the data packet, and the first matching is performed according to a parameter included in the first matching instruction for mapping the first matching field to the first mapping value.
  • the fourth receiving module is configured to receive the n-1 flow mode messages sent by the controller for n-1 flow tables;
  • the fourth establishing module is configured to establish n-1 flow entries in the n-1 flow tables, where an i th flow entry is established in the i th flow table, where the The matching field of the i-stream entry is the ith metadata Metedata value, and the instruction set of the i-th flow entry is the ith jump instruction and the ith matching instruction, The matching field of the i-th flow entry is used to match the i-1th mapping value Mpi-1, and the i-th jump instruction and the i-th matching instruction are executed according to the matching result,
  • the first mapping value Mp1 is a first mapping value Mp1
  • the ith matching instruction is configured to map the ith matching field to the ith according to the ith matching instruction a parameter of the mapping value, mapping the i-th matching field to an i-th mapping value Mpi, and writing the i-th mapping value Mpi into a metadata Metadata field of the i-th flow table, where The i jump instructions are used to jump to the lower-
  • the fifth receiving module is configured to receive the final flow mode message sent by the controller for the final flow table
  • the fifth establishing module is configured to establish a final flow entry in the final flow table, where an instruction set of the final flow entry is the behavior instruction, and a matching domain of the final flow entry is the The n-metadata Metedata value, wherein the matching field of the final flow entry is used to match the n-th mapping value Mpn, and the behavior instruction is used to process the data packet according to the matching result.
  • the matching instruction includes parameters for mapping the matching field to the mapping value, and the matching field may be any field other than the matching field specified by the standard protocol, by matching the matching.
  • the field is mapped to the mapped value, and the metadata Metadata value sent by the controller can be matched with the mapped value. Therefore, compared with the existing POF technology, the instruction set specified by the OpenFlow protocol is completely subverted and the workload is large.
  • the method provided by the embodiment of the present invention provides on the basis of not changing the existing hardware logic and the OpenFlow standard protocol. The way to dynamically extend the protocol support enhances the manageability of the data stream. When new applications/protocols need to be processed, there is no need to upgrade the hardware, but only through software.
  • FIG. 1 is a schematic flowchart of a method for matching a flow table according to an embodiment of the present invention
  • FIG. 2 is a controller provided by the embodiment of the present invention, which is configured to send a parameter for mapping a matching field to a mapping value to the first flow table Table N-1, and to the next best table Table N of the first flow table Table N-1.
  • FIG. 3 is a schematic diagram of mapping a matching field to a mapping value Mp according to an embodiment of the present invention
  • FIG. 4 is a schematic flowchart of a method for matching a flow table according to another embodiment of the present invention.
  • FIG. 5 is a schematic diagram of a basic logical structure of an apparatus for matching a flow table according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram of a basic logical structure of an apparatus for matching a flow table according to another embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a logical structure of an OpenFlow switching system according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of a logical structure of an OpenFlow switching system according to another embodiment of the present invention.
  • An embodiment of the present invention provides a method for matching a flow table, comprising: receiving, by a controller, a jump instruction and a matching instruction that are sent by the controller, where the matching instruction is used to indicate that the matching field is mapped to a mapping value, and the The mapping value is written to the metadata Metadata field, and is passed to the second flow table, where the matching instruction includes a parameter for mapping the matching field to the mapping value, and the jump instruction is used to indicate the jump.
  • the first flow entry is established in the first flow table, where the instruction set of the first flow entry is the jump instruction and the matching instruction, where the matching instruction is used by the switch
  • the matching field is mapped to the mapping value Mp according to the parameter included in the matching instruction for mapping the matching field to the mapping value, and the mapping value Mp is written into the metadata.
  • the jump instruction is used to jump to the second flow table, and the data packet and the mapping value Mp written in the metadata metadata field are delivered to the second flow table;
  • Receiving the controller for the first Delivered by streaming mode message flow table, the flow line mode message comprises An instruction and a metadata Metadata value for matching the matching field; establishing a second flow entry in the second flow table, where the instruction set of the second flow entry is the behavior instruction, the The matching field of the second flow entry is the metadata Metedata value, wherein the matching field of the second flow entry is used to match the mapping value Mp, and the behavior instruction is used to match the matching result.
  • the data packet is processed.
  • the embodiment of the invention further provides a corresponding flow table matching device and an OpenFlow switching system. The details are described below separately.
  • the flow table matching method of the embodiment of the present invention is applicable to an OpenFlow switch and an OpenFlow switching system, which is composed of an OpenFlow switch and an OpenFlow controller, and the execution body thereof may be an OpenFlow switch.
  • the basic process may refer to FIG. 1 and mainly includes steps S101 to Steps. S104:
  • the matching instruction sent by the controller for the first flow table is used to indicate that the matching field is mapped to the mapping value, and the mapped mapping value is written into the metadata Metadata field and passed to the second flow table, where the matching instruction is included for matching
  • the field is mapped to a parameter that maps the value, and the jump instruction is used to indicate the second flow table of the jump.
  • a flow table refers to a flow table maintained in an OpenFlow switch, and a flow table is similar to a flow table defined by an OpenFlow standard protocol, for example, all include a matching field (Match Field). ), Counters and Instructions, the flow table forms part of the switch, the switch refers to the OpenFlow switch, and the controller refers to the OpenFlow controller.
  • the matching field may be a field that can be matched by a standard protocol in the data stream to be matched, or any field in the data stream to be matched that can be matched except the standard protocol.
  • the OpenFlow standard protocol stipulates that the matching fields may only have a limited number of fields such as IP address, port number, and MAC address.
  • Metadata value corresponding to the matching field (for example, the eigenvalue that uniquely identifies the data stream) is calculated, and the metadata of the metadata is maintained by the OpenFlow controller at the local end, that is, the OpenFlow controller maintains the data with each type of data.
  • the stream uniquely corresponds to the metadata Metadata value.
  • the matching instruction includes a parameter for mapping the matching field to the mapping value, which mainly includes a mask, a matching field at a starting position of the data packet to which the matching field belongs, and a matching field in the matching field.
  • the function of the matching instruction is that after the switch receives the data packet, the matching field is mapped to the mapping value Mp according to the parameter included in the matching instruction for mapping the matching field to the mapping value, and the mapping value Mp is written into the metadata.
  • the jump instruction is used to jump to the second flow table, and the mapping value Mp written in the data packet and the metadata data field is passed to the second flow table.
  • the switch After receiving the jump instruction and the matching instruction sent by the controller for the first flow table, the switch may establish a first flow entry in the first flow table.
  • the matching instruction sent by the controller may be a struct. Assuming that the name of the structure is ofp_instruction_proto_ext, as an embodiment of the present invention, the matching instruction can be as follows:
  • the match_ext_value is a structure whose number is a constant value OFP_MAX_PROTO_EXT_LEN (for example, OFP_MAX_PROTO_EXT_LEN is equal to 7), and each structure represents a one-byte matching field, and the specific extended matching domain can be supported by the switch (Switch).
  • the length of the abstract Metadata value is defined.
  • the structure match_ext_value is defined as follows:
  • the parameters mentioned in the foregoing embodiment for mapping the matching field to the mapping value Mp include bitmask, position, offset, and serial_no, where:
  • Bitmask represents a mask used to determine which bits in the matching field are valid
  • Position indicates that the matching field is at the beginning of the data packet to which the matching field belongs, the data structure type is the enumerated type, and the structure is the starting byte number of the field in the commonly used and determined TCP/IP data packet.
  • the offset is located to the specific position of the matching field in the data packet to which it belongs.
  • the structure of the position is as follows:
  • IP_DATA_START 34;
  • Offset indicates the number of offset bytes of the matching matching field in the data packet to which the matching matching field belongs
  • Serial_no indicates the serial number of the data stream, that is, the stream identifier of the data stream to which the data packet belongs to the matching field.
  • the controller assigns different serial numbers according to the classification of the data stream to represent different data streams, so as to perform data flow. Management, the length of serial_no is uint8, which means that 256 different stream types can be represented;
  • Match_ext_num indicates the number of structs match_ext_value actually filled.
  • the switch after receiving the data packet, maps the matching field to the mapping value Mp according to the parameter for mapping the matching field to the mapping value included in the matching instruction, and includes the following steps S1021 to S1023:
  • S1021 Locating the matching field according to the starting position and the number of offset bytes to extract the matching field at the location of the received data packet.
  • a matching field is the 2nd byte at the beginning position of the packet to which it belongs, and the offset byte number offset of the packet to which it belongs is 3 bytes, the second to the packet is extracted.
  • the 4-byte content is the match field.
  • step S1022 Perform a logical AND operation on the matching field and the mask extracted in step S1021.
  • the contiguous byte group may be a byte group consisting of 8 consecutive bytes, which will match.
  • the stream identifier serial_no of the data stream to which the data packet belongs belongs to the first byte of the contiguous byte group and the operation result of the logical AND operation of step S1022 is sequentially copied to the remaining bytes of the contiguous byte group: the matching field
  • the stream identifier serial_no of the data stream to which the data packet belongs is filled to the first byte of 8 bytes, that is, byte1, and the operation result of the logical AND operation of step S1022 is sequentially copied to the remaining bytes of the 8 bytes, that is, byte2, byte3, Byte4, byte5, byte6, byte7, and byte8, the contents of the 8 bytes after being filled and copied are used as the mapping value Mp.
  • the process of steps S1021 to S1023 is as shown in FIG. 3, wherein the one-way arrow indicates the copying operation.
  • mapping value Mp obtained in step S1023 can be written in the metadata Metadata field and passed to the second flow table along with the received data packet.
  • the flow mode (Flow Mod) message sent by the controller to the second flow table indicated by the jump instruction may include a behavior instruction and is used for matching.
  • the metadata Metadata value of the matching field In the two flow tables exemplified in FIG. 2, namely Table N-1 and Table N, it is assumed that Table N-1 represents the first flow table of the foregoing embodiment, and Table N represents the second flow table of the foregoing embodiment.
  • the instruction set in Table N-1 contains the jump instruction and the matching instruction sent by the controller to Table N-1. It is assumed that the jump instruction here is represented by Goto-Table, and the matching instruction is represented by Proto-Ext.
  • the Match Fields contain the metadata Metadata sent by the controller to match the matching fields. value.
  • the switch After receiving the flow mode message sent by the controller for the second flow table, the switch obtains the second flow entry in the second flow table, and the instruction set is the flow mode message sent by the controller to the second flow table.
  • the included behavior instruction wherein the content in the matching domain of the second flow entry is a metadata Metedata value, which is used to match the mapping value Mp, and the behavior instruction is used to process the data packet according to the matching result.
  • the matching instruction sent by the controller to the first flow table includes a parameter for mapping the matching field to the mapping value, and the obtained mapping value Mp is delivered to the second flow table, and the flow mode message is included.
  • the behavioral instruction and the metadata Metadata value used to match the matching field are sent to the second flow table indicated by the jump instruction.
  • the controller sends a parameter for mapping the matching field to the mapping value to the flow table Table N-1, and issues it as an instruction and a element for matching the matching field to the flow table Table N.
  • the data Metadata value, matching the metadata Metadata value received in step S103 with the mapping value Mp delivered to the second flow table, is started when the flow table Table N is accessed, instead of accessing the flow table Table N-1 Execute.
  • step S103 If the metadata Metadata value received in step S103 is successfully matched with the mapping value Mp delivered to the second flow table, the operation of the received data packet is performed according to the behavior instruction issued to the second flow table, for example, The packet is dropped, modified, forwarded to port or forwarded to controller, and so on.
  • the matching command includes a parameter for mapping the matching field to the mapping value, and the matching field may be any other than the matching field specified by the standard protocol.
  • a field, by mapping the matching field to a mapping value can match the metadata Metadata value sent by the controller with the mapping value. Therefore, compared with the existing POF technology, the instruction set specified by the OpenFlow protocol is completely subverted and the workload is large.
  • the method provided by the embodiment of the present invention does not change the existing hardware logic and the basis of the OpenFlow standard protocol. The method of dynamically extending the protocol support is provided, and the manageability of the data stream is enhanced.
  • the method for matching the flow table provided by the embodiment of the present invention is further described below by taking the application scenario of the instant messaging software QQ as an example.
  • the packet capture tool For identifying the signature of the QQ application protocol, it can be implemented by the packet capture tool. First analyze the QQ packet of the UDP application protocol. You can open the Wireshark packet capture tool and run QQ to log in. Wireshark quickly grabs packets with protocols UDP and OICQ. First, locate the IP protocol header and know that the IP protocol header length is 20 bytes (byte), and the subsequent UDP header length is 8 bytes, including the port numbers 4000 and 8000, followed by the data field of the QQ information, starting with 1 byte. 0x02, is the protocol identifier of the OICQ packet.
  • the following two bytes, 0x262f identify the version number of QQ, indicating that the current QQ version is the official version of 2011, and the two bytes following 0x262f are command fields for QQ login.
  • the command value is 0xba. Therefore, the protocol identifier 0x02 with an offset of 28 and the command value 0xba with an offset of 31 can be used as the signature when the QQ application protocol is UDP.
  • the second is to analyze TCP packets. Whether using HTTP or SSL protocol, there are protocol identification field + version field in the QQ message: 0x02262f, the message field used for login is 0x0059 adjacent to the front, so the offsets are 40 and 0x005902 as QQ applications.
  • the protocol is a signature code for TCP.
  • Enum start_position position IP_DATA_START
  • Enum start_position position IP_DATA_START
  • the stream identifier of the QQ application and the serial number of the data stream serial_no are 0x11. According to the bitmask and offset in the above structure structure match_ext_value[0] or match_ext_value[1], the calculation methods of steps S1021 to S1023 illustrated in FIG. 1 are used.
  • the mapping value corresponding to the signature is 0x1102ba0000000000, which matches the saved in the next-class table of the current flow table. If the domain's abstract Metadata value 0x1102ba0000000000 can be matched, then the instruction in the instruction set (Actions) will discard the QQ packet.
  • the foregoing embodiment describes a method for matching a flow table corresponding to a single-stage flow table, and a flow table supports a protocol expansion of up to 8 bytes.
  • the embodiment of the present invention further provides a method for matching flow table cascading when multiple flow tables are cascaded.
  • the application scenario in which multiple flow table cascading to expand the matching range of the flow table matching domain is: a matching field of a data stream to be matched
  • the number of bytes included is too large, for example, more than 7 bytes.
  • the mapped value contains more bytes than the metadata contained in the current metadata of the OpenFlow standard protocol.
  • Another embodiment of the present invention provides another method for matching a flow table, and the execution body is still a switch in the OpenFlow switching system.
  • the main process may refer to FIG. 4, including steps S401 to S406. The details are as follows:
  • the switch receives the first jump instruction and the first matching instruction that are sent by the controller for the first flow table, and the jump instruction that is sent by the switch to the first flow table by the switch in step S101 of the example of FIG.
  • the first matching instruction is used to indicate that the first matching field is mapped to the first mapping value, and the first mapping value is written into the metadata Metadata field, and is transmitted to the second flow table
  • the first matching field is the first byte to the first field to be matched. Nm bytes.
  • the switch after receiving the first jump instruction and the first matching instruction sent by the controller for the first flow table, the switch establishes the first flow entry in the first flow table and the step S102 in the example illustrated in FIG. 1
  • the first flow entry is similar to the first flow entry in the first flow table, that is, the instruction set of the first flow entry is the first jump
  • the first matching instruction is used after the switch receives the data packet, according to the parameter included in the first matching instruction for mapping the first matching field to the first mapping value, Mapping the first matching field to the first mapping value Mp1, and writing the first mapping value Mp1 to the metadata Metadata field of the first flow table, where the first jump instruction is used to jump to the second flow table,
  • the data packet and the first mapping value Mp1 written in the metadata Metadata field of the first flow table are delivered to the second flow table.
  • the parameter that maps the first matching field to the first mapping value includes: a first mask, where the first matching field is at a first starting position of the data packet to which the first matching field belongs, and the first Matching a first offset identifier of a data packet to which the first matching field belongs and a first flow identifier of a data flow to which the first matching field belongs, and according to the first matching instruction,
  • the first matching field is mapped to the parameter of the first mapping value, and the first matching field is mapped to the first mapping value Mp1, including the following steps S4021 to S4023:
  • S4021 Locating the first matching field according to the first starting position and the first offset byte number to extract the first matching field at the location of the received data packet.
  • step S4022 Perform a logical AND operation on the first matching field extracted through step S4021 and the first mask.
  • the first mapping value Mp1 obtained in step S4023 can be written in the metadata Metadata field and passed to the second flow table along with the received data packet.
  • the receiving controller sends n-1 flow mode messages for the n-1 flow tables.
  • the controller sends n-1 flow mode messages for n-1 flow tables for n-1
  • Each of the flow table sends a flow mode message of each of the n-1 flow mode messages, that is, the i th flow mode message is sent for the i th flow table, where 2 ⁇ i ⁇ n.
  • the i-th flow mode message is sent to the i-th flow table, and the flow mode message sent in the step S103 of the example of FIG. 1 is similar to that of the second flow table, that is, the i-th flow mode message.
  • the i-th matching field is the (i-1)*Nm+1 byte to the i*Nmth byte in the field to be matched
  • the matching instructions include a parameter for mapping the i th matching field to the i th mapping value
  • the i th jump instruction is used to indicate a next best table of the jump
  • the second flow The table is the second flow table
  • the lower-level table of the i-th flow table is the i+1th flow table
  • the lower-level table of the n-th flow table is the final flow table.
  • the switch establishes n-1 flow entries in the n-1 flow tables, and establishes a flow entry in each of the n-1 flow tables, that is, in the i-th flow table.
  • the i-th flow entry is established, the matching field of the i-th flow entry is the i-th metadata Metedata value, and the instruction set of the i-th flow entry is the i-th jump instruction and The ith matching instruction.
  • the matching field of the i-th flow entry is used to match the i-1th mapping value Mpi-1, and according to the matching result.
  • the first mapping value Mp1 is a first mapping value Mp1
  • the ith matching instruction is used to perform the ith matching a parameter included in the instruction for mapping the i th matching field to the i th mapping value, mapping the i th matching field to an i th mapping value Mpi, and the i th
  • the mapping value Mpi is written into the metadata Metadata field of the i-th flow table
  • the i-th jump instruction is used to jump to the lower-level table of the i-th flow table
  • the data packet and the The i-th mapping value Mpi written in the metadata Metadata field of the i-th flow table is delivered to the lower-level table of the i-th flow table.
  • the parameter for mapping the i-th matching field to the i-th mapping value in the i-th matching instruction includes an ith mask, and the i-th matching field is matched in the i-th match
  • the i-th starting position of the data packet to which the field belongs, the i-th offset byte number of the data packet to which the i-th matching field belongs, and the data of the data packet to which the i-th matching field belongs The i-th stream identifier of the stream.
  • the i-th matching field is mapped to the i-th mapping value Mpi according to the parameter included in the i-th matching instruction for mapping the i-th matching field to the i-th mapping value. , including the following steps S4041 to S4043:
  • the i-th matching field is located according to the ith starting position and the ith offset byte number, and the i-th matching field is extracted at the position of the received data packet.
  • S4042 Perform a logical AND operation on the extracted i-th matching field and the i-th mask.
  • the first stream identifier is filled to the first byte of the i-th contiguous byte group, and the operation result of the logical AND operation in step S4042 is sequentially copied to the remaining bytes of the ith contiguous byte group.
  • the content of the ith contiguous byte group after being filled and copied is referred to as the i-th mapping value Mpi, and the ith contiguous byte group is N bytes of data.
  • the mapping value Mpi obtained in step S4023 can be written in the metadata Metadata field of the i-th flow table, and is transmitted to the next-class table of the i-th flow table, that is, the i+1th stream, along with the received data packet. table.
  • the final stream mode message contains an nth metadata Metadata value and a behavioral instruction for matching the nth matching field, the behavioral instruction indicating the action performed when accessing the final flow table.
  • the instruction set of the final flow entry is a behavior instruction
  • the matching field of the final flow entry is the nth metadata Metedata value
  • the matching field of the final flow entry is used to: the nth metadata Metedata value and step S405
  • the middle controller matches the nth mapping value Mpn included in the final flow mode message delivered by the final flow table, and the behavior instruction is used to process the data packet according to the matching result, for example, dropping the data packet (drop) , modify, forward to port Or forward to controller (forward to controller), and so on.
  • the application performs matching, including the following steps S1 to S6:
  • the Openflow controller sends a first jump instruction and a first matching instruction to the first flow table to the Openflow switch.
  • the first matching instruction sent by the Openflow controller includes a parameter for mapping the first matching field to the first mapping value Mp1, and the first jumping instruction is used to indicate the second flow table that jumps to the third-level flow table ( Recorded as Table N+1);
  • the Openflow switch establishes a first flow entry in Table N.
  • the instruction set of the first flow entry established in the Table N is a first jump instruction and a first matching instruction delivered by the Openflow controller, where the first matching instruction is used to instruct the Openflow switch, and the data packet on the WeChat passes through three
  • the first matching field that is, the first 7 bytes of the 21-byte signature is mapped to the first mapping value Mp1
  • the first jump instruction is used.
  • the first mapping value Mp1 of the data packet and the write metadata Metadata field is passed to the second flow table (referred to as Table N+1) in the third-level flow table.
  • the second stream mode message includes a second jump instruction, a second matching instruction, and a second metadata Metadata value for matching the second matching field
  • Two matching instructions are used to indicate that the second matching field, that is, the middle 7 bytes of the 21-byte signature, is mapped to the second mapping value Mp2, and the second matching instruction is included for the second
  • the matching field is mapped to the parameter of the second mapping value Mp2
  • the second jump instruction is used to indicate the next-class table of the jump
  • the third stream mode message includes the third jump instruction, the third matching instruction, and
  • the third matching instruction is used to indicate that the third matching field, that is, the last 7 bytes of the 21-byte signature is mapped to the third Mapping value Mp3
  • the third matching instruction includes a parameter for mapping the third matching field to the third mapping value Mp3, and the third jumping instruction is used
  • the Openflow switch establishes a second flow entry in the second flow table, and establishes a third flow entry in the third flow table, and the instruction set of the second flow entry is the second jump instruction and the first 2 matching instructions, the matching field of the second flow entry is the second metadata Metedata value, that is, 0x2201020304050607, and the Openflow switch matches 0x2201020304050607 with the first mapping value Mp1 according to the second matching instruction, and according to the matching result
  • the second jump instruction and the second matching instruction are executed, and the second matching instruction is used by the Openflow switch to map the second matching field to the second mapping value Mp2 according to the second matching instruction.
  • the parameter maps the second matching field to the second mapping value Mp2, and writes the second mapping value Mp2 to the metadata Metadata field of the second flow table, and the second jump instruction is used to jump to the
  • the lower-level table of the two flow tables that is, the third flow table of the three-level flow table (referred to as Table N+2)
  • the second map value written in the metadata data field of the WeChat packet and the second flow table Mp2 is passed to the second flow table of the second flow table, that is, the third flow table of the third-level flow table, and the second flow table is three
  • the second flow table of the flow table is Table N+1; the instruction set of the third flow entry is the third jump instruction and the third matching instruction, and the matching field of the third flow entry is the third element.
  • the data Metedata value is 0x2208091011121314, the matching field of the third flow entry is used to match the second mapping value Mp2, and the Openflow switch matches 0x2208091011121314 with the second mapping value Mp2 according to the third matching instruction, and performs the first according to the matching result.
  • the third jump instruction and the third match instruction are used to select the third parameter according to the third matching command for mapping the third matching field to the second mapping value Mp2.
  • the matching fields are mapped to the second mapping value Mp3, and the second mapping value Mp3 is written to the metadata Metadata field of the third flow table, and the third jump instruction is used to jump to the third flow table.
  • the next-class table is the final flow table, and the third mapping value Mp3 written in the metadata data field of the WeChat data packet and the third flow table is passed to the lower-level table of the third flow table, that is, the final flow table.
  • the final flow mode message delivered for the final flow table includes a behavior instruction and a fourth metadata Metadata value for matching the third matching field, that is, 0x2215161718192021. According to the purpose of this application scenario, the WeChat application is prohibited, and the behavior instruction included in the final stream mode message is to drop the data packet.
  • the instruction set of the final flow entry is the behavior instruction included in the final flow mode message delivered by the Openflow controller for the final flow table.
  • the matching field of the final flow entry is the fourth metadata Metadata value, that is, 0x2215161718192021.
  • the operation of dropping the data packet is performed, that is, the data packet of the WeChat is intercepted, and the purpose of prohibiting the WeChat application is realized.
  • the apparatus for matching the flow table of the embodiment of the present invention for performing the above method of flow table matching will be described below, and the basic logical structure thereof is referred to FIG. For the convenience of description, only parts related to the embodiment of the present invention are shown.
  • the device of the flow table matching illustrated in FIG. 5 may be an exchange in an OpenFlow network.
  • the machine mainly includes a first receiving module 501, a first establishing module 502, a second receiving module 503, and a second establishing module 504, and each module is described in detail as follows:
  • the first receiving module 501 is configured to receive a jump instruction and a matching instruction that are sent by the controller for the first flow table, where the matching instruction is used to indicate that the matching field is mapped to a mapping value, and the mapping value is written into the metadata.
  • a metadata field which is passed to the second flow table, where the matching instruction includes a parameter for mapping the matching field to the mapping value, and the jump instruction is used to indicate a second flow table of the jump;
  • a first establishing module 502 configured to establish, in the first flow table, a first flow entry, where an instruction set of the first flow entry is the jump instruction and the matching instruction, where the matching instruction is used
  • the switch maps the matching field to the mapping value Mp according to the parameter included in the matching instruction for mapping the matching field to the mapping value, and writes the mapping value Mp.
  • the jump instruction is used to jump to the second flow table, and transmitting the data packet and the mapping value Mp written in the metadata metadata field to the second Flow table
  • a second receiving module 503 configured to receive a flow mode message sent by the controller for the second flow table, where the flow mode message includes a behavior instruction and a metadata Metadata value for matching the matching field;
  • the second establishing module 504 is configured to establish a second flow entry in the second flow table, where the instruction set of the second flow entry is the behavior instruction, and the matching field of the second flow entry is The metadata Metedata value, wherein the matching field of the second flow entry is used to match the mapping value Mp, and the behavior instruction is used to process the data packet according to the matching result.
  • each functional module is merely an example, and the actual application may be as needed, for example, the configuration requirements of the corresponding hardware or the convenience of the implementation of the software. It is considered that the above-mentioned function allocation is completed by different functional modules, that is, the internal structure of the device matching the flow table is divided into different functional modules to complete all or part of the functions described above.
  • the corresponding functional modules in this embodiment may be implemented by corresponding hardware, or may be executed by corresponding hardware, for example,
  • the foregoing first receiving module may be hardware having a jump instruction and a matching instruction that are sent by the foregoing receiving controller for the first flow table, such as a first receiver, or may be capable of executing a corresponding computer program to perform the foregoing functions.
  • the first establishing module may have hardware that performs the foregoing function of establishing a first flow entry in the first flow table, such as a first establisher, or may be capable of performing corresponding A general processor or other hardware device that the computer program thus performs the aforementioned functions (the various described embodiments of the present specification may apply the above described principles).
  • the parameter included in the matching instruction for mapping the matching field to the mapping value includes: a mask, the matching field is in a data packet to which the matching field belongs a starting position, a number of offset bytes of the data packet to which the matching field belongs, and a flow identifier of the data stream to which the data packet belongs to the matching field; and according to the matching instruction, Mapping the matching field to the parameter of the mapping value, and mapping the matching field to the mapping value Mp, including: locating the matching field according to the starting position and the number of offset bytes in the receiving Location of the data packet, extracting the matching field; logically ANDing the extracted matching field with the mask; filling the stream identifier to a first byte of a contiguous byte group and The operation result of the logical AND operation is sequentially copied to the remaining bytes of the consecutive byte group, and the content of the consecutive byte group after the filling and copying is used as the mapping value Mp, the continuous byte Of N bytes
  • a device for matching a flow table can be used in the case of cascading multiple flow tables.
  • the apparatus for matching the flow table illustrated in FIG. 6 may be a switch in an OpenFlow network, and mainly includes a third receiving module 601, a third establishing module 602, a fourth receiving module 603, a fourth establishing module 604, a fifth receiving module 605, and a Five build module 606, each module is described in detail as follows:
  • the third receiving module 601 is configured to receive a first jump instruction and a first matching instruction that are sent by the controller for the first flow table, where the first matching instruction is used to indicate that the first matching field is mapped to the first mapping value, And the first mapping value is written to the metadata data field, and is sent to the second flow table, where the first matching instruction includes a parameter for mapping the first matching field to the first mapping value,
  • a third establishing module 602 configured to establish a first flow entry in the first flow table, where the instruction set of the first flow entry is the first jump instruction and the first matching instruction, where the The first matching command is configured to: after the switch receives the data packet, the first matching field according to the parameter included in the first matching instruction for mapping the first matching field to the first mapping value Mapping to a first mapping value Mp1, and writing the first mapping value Mp1 to a metadata Metadata field of the first flow table, where the first jump instruction is used to jump to the second flow table, Transmitting the data packet and the first mapping value Mp1 written in a metadata metadata field of the first flow table to the second flow table;
  • the fourth receiving module 603 is configured to receive the n-1 flow mode messages sent by the controller for the n-1 flow tables, where the i th flow mode message is sent for the i th flow table, n ⁇ I ⁇ 2, the i-th stream mode message includes an i-th jump instruction, an i-th matching instruction, and an i-th metadata Metadata value for matching the i-th matching field, the i-th match
  • the instruction is used to indicate that the i-th matching field is mapped to an i-th mapping value, where the i-th matching field is the (i-1)*Nm+1 byte in the field that needs to be matched.
  • the ith matching instruction includes a parameter for mapping the ith matching field to the ith mapping value, and the ith jump instruction is used to indicate a hop
  • the next-stage table is transferred, the second flow table is the second flow table, the lower-level table of the i-th flow table is the i+1th flow table, and the lower-level table of the n-th flow table For the final flow table;
  • a fourth establishing module 604 configured to establish n-1 flow entries in the n-1 flow tables, where An i-th flow entry is created in the i-th flow table, a matching domain of the i-th flow entry is a value of the ith metadata Metedata, and an instruction set of the i-th flow entry is The i-th jump instruction and the i-th matching instruction, the matching field of the i-th flow entry is used to match the i-1th mapping value Mpi-1, and is executed according to the matching result.
  • the ith jump instruction and the ith match instruction, the first mapping value Mp1 is a first mapping value Mp1, and the ith matching instruction is used according to the ith matching instruction Included, a parameter for mapping the ith matching field to the ith mapping value, mapping the ith matching field to an ith mapping value Mpi, and the ith mapping value Mpi writes a metadata Metadata field of the i-th flow table, the i-th jump instruction is used to jump to a lower-level table of the i-th flow table, and the data packet and the first The i-th mapping value Mpi written in the metadata Metadata field of the i flow tables is delivered to the lower-level table of the i-th flow table;
  • the fifth receiving module 605 is configured to receive a final flow mode message sent by the controller for the final flow table, where the final flow mode message includes a behavior instruction and an nth element for matching the nth matching field.
  • Data Metadata value
  • a fifth establishing module 606 configured to establish a final flow entry in the final flow table, where an instruction set of the final flow entry is the behavior instruction, and a matching domain of the final flow entry is the nth a metadata Metedata value, wherein the matching field of the final flow entry is used to match the nth mapping value Mpn, and the behavior instruction is used to process the data packet according to the matching result.
  • the parameter included in the first matching instruction for mapping the first matching field to the first mapping value includes: a first mask, the first a matching field at a first start position of the data packet to which the first matching field belongs, a first offset byte number of the data packet to which the first matching field belongs, and a first matching field to which the first matching field belongs And the first matching field is configured according to the parameter used in the first matching instruction to map the first matching field to the first mapping value, Mapping to the first mapping value Mp1 includes: locating the first matching field at the location of the received data packet according to the first starting location and the first offset byte number, and extracting the first Match field And the extracted first matching field is logically ANDed with the first mask; filling the first stream identifier to a first byte of the first contiguous byte group and performing the logical AND operation The operation result is sequentially copied to the remaining bytes of the first contiguous byte group, and the content of the first contiguous byte group after the
  • the parameter of the i-th matching instruction for mapping the i-th matching field to the i-th mapping value includes: an i-th mask, the i-th matching field in the i-th matching field The i-th starting position of the belonging data packet, the i-th matching field, the number of the i-th offset bytes of the data packet to which the i-th matching field belongs, and the data flow to which the data packet of the i-th matching field belongs.
  • Mapping to the i-th mapping value Mpi includes: locating the i-th matching field according to the ith starting position and the ith offset byte number at the location of the received data packet, and extracting The i-th matching field; logically ANDing the extracted i-th matching field with the i-th mask; filling
  • the OpenFlow switching system illustrated in FIG. 7 includes a switch 702 and a controller 701, wherein the switch 702 can be the flow table matching device as exemplified in the foregoing FIG.
  • the switch 702 mainly includes a first receiving module 501, a first establishing module 502, a second receiving module 503, and a second establishing module 504, and each module is described in detail as follows:
  • the controller 701 is configured to send a jump instruction and a matching instruction for the first flow table to the switch 702, and send a flow mode message for the second flow table to the switch 702, where the matching instruction is used to indicate that the matching field is mapped.
  • the matching instruction is used to indicate that the matching field is mapped.
  • the matching instruction includes a parameter for mapping the matching field to the mapping value
  • the jump instruction is used to indicate a second flow table of the jump
  • the flow mode message includes a behavioral instruction and a metadata Metadata value for matching the matching field;
  • the first receiving module 501 is configured to receive a jump instruction and a matching instruction that are sent by the controller for the first flow table.
  • a first establishing module 502 configured to establish, in the first flow table, a first flow entry, where an instruction set of the first flow entry is the jump instruction and the matching instruction, where the matching instruction is used
  • the switch maps the matching field to the mapping value Mp according to the parameter included in the matching instruction for mapping the matching field to the mapping value, and writes the mapping value Mp.
  • the jump instruction is used to jump to the second flow table, and transmitting the data packet and the mapping value Mp written in the metadata metadata field to the second Flow table
  • the second receiving module 503 is configured to receive a flow mode message that is sent by the controller 701 to the second flow table, where the flow mode message includes a behavior instruction and a metadata Metadata value for matching the matching field;
  • the second establishing module 504 is configured to establish a second flow entry in the second flow table, where the instruction set of the second flow entry is the behavior instruction, and the matching field of the second flow entry is The metadata Metedata value, wherein the matching field of the second flow entry is used to match the mapping value Mp, and the behavior instruction is used to process the data packet according to the matching result.
  • the parameter included in the matching instruction for mapping the matching field to the mapping value includes: a mask, the matching field is in a data packet to which the matching field belongs a start position, a number of offset bytes of the data packet to which the matching field belongs, and a flow identifier of the data flow to which the data packet to which the matching field belongs; and according to the matching instruction, Mapping the matching field to the parameter of the mapping value, mapping the matching field to the mapping value Mp, comprising: locating the matching field in the received data according to the starting position and the number of offset bytes The location of the packet, extracting the matching field; the matching field to be extracted Performing a logical AND operation with the mask; filling the stream identifier to a first byte of a contiguous byte group and sequentially copying the operation result of the logical AND operation to the remaining of the contiguous byte group Byte, the content of the contiguous byte group after the padding and copying is used as the mapping value Mp,
  • FIG. 8 an OpenFlow switching system according to another embodiment of the present invention is shown.
  • the OpenFlow switching system illustrated in FIG. 8 includes a switch 802 and a controller 801, wherein the switch 802 can be the apparatus for expanding the flow table matching domain matching range as exemplified in the foregoing FIG.
  • the switch 802 mainly includes a third receiving module 601, a third establishing module 602, a fourth receiving module 603, a fourth establishing module 604, a fifth receiving module 605, and a fifth establishing module 606.
  • the modules are described in detail as follows:
  • the controller 801 is configured to send, to the switch 802, a first jump instruction and a first matching instruction for the first flow table, and send, to the switch 802, n-1 flow mode messages for n-1 flow tables, and The switch 802 sends a final flow mode message for the final flow table, where the first matching instruction is used to indicate that the first matching field is mapped to the first mapping value, and the first mapping value is written to the metadata Metadata field.
  • the first matching instruction includes a parameter for mapping the first matching field to the first mapping value
  • the first jump instruction is used to indicate a second jump a flow table
  • the first matching field is the first byte to the Nth byte in the field that needs to be matched
  • the i th stream mode message is sent for the i th flow table, n ⁇ i ⁇ 2, the ith
  • the stream mode message includes an i th jump instruction, an i th match instruction, and is used to match the i th match field
  • the i-th metadata Metadata value, the i-th matching instruction is used to indicate that the i-th matching field is mapped to an i-th mapping value, where the i-th matching field is in the field that needs to be matched
  • the third receiving module 601 is configured to receive the first jump instruction and the first matching instruction that are sent by the controller 801 for the first flow table;
  • a third establishing module 602 configured to establish a first flow entry in the first flow table, where the instruction set of the first flow entry is the first jump instruction and the first matching instruction, where the first And the matching command is configured to: after the switch receives the data packet, map the first matching field to the parameter that is used by the first matching instruction to map the first matching field to the first mapping value, a first mapping value Mp1, and writing the first mapping value Mp1 to a metadata Metadata field of the first flow table, where the first jump instruction is used to jump to the second flow table, Transmitting, by the data packet, the first mapping value Mp1 written in the metadata Metadata field of the first flow table to the second flow table;
  • the fourth receiving module 603 is configured to receive, by the controller 801, the n-1 flow mode messages that are sent by the n-1 flow tables.
  • a fourth establishing module 604 configured to establish n-1 flow entry entries in the n-1 flow tables, where an i th flow list entry is established in the i th flow table, where the i th The matching field of the flow entry is the ith metadata Metedata value, and the instruction set of the i-th flow entry is the ith jump instruction and the ith matching instruction, Matching fields of the i flow table entries are used to match the i-1th mapping value Mpi-1, and the i th jump instruction and the i th matching command are executed according to the matching result, where the a mapping value Mp1 is a first mapping value Mp1, and the ith matching instruction is configured to map the ith matching field to the ith mapping according to the ith matching instruction a parameter of a value, mapping the i-th matching field to an i-th mapping value Mpi, and writing the i-th mapping value Mpi into a metadata Metadata field of the i-th flow table, the ith Jump instructions for jumping to the it
  • the fifth receiving module 605 is configured to receive the final flow mode message that is sent by the controller 801 for the final flow table.
  • a fifth establishing module 606 configured to establish a final flow entry in the final flow table, where an instruction set of the final flow entry is the behavior instruction, and a matching domain of the final flow entry is the nth a metadata Metedata value, wherein the matching field of the final flow entry is used to match the nth mapping value Mpn, and the behavior instruction is used to process the data packet according to the matching result.
  • the parameter included in the first matching instruction for mapping the first matching field to the first mapping value includes: a first mask, the first matching field a first offset position of the data packet to which the first matching field belongs, a first offset byte number of the data packet to which the first matching field belongs, and a data packet to which the first matching field belongs And mapping, by the first matching instruction, a parameter for mapping the first matching field to the first mapping value, mapping the first matching field to a first flow identifier of the data stream,
  • the first mapping value Mp1 includes: positioning the first matching field at the location of the received data packet according to the first starting position and the first offset byte number, and extracting the first matching field And logically ANDing the extracted first matching field with the first mask; filling the first stream identifier to a first byte of a first contiguous byte group and ANDing the logic
  • the operation result of the operation is copied in order The remaining bytes of the first consecutive byte group, the content of the first consecutive byte group after the padding and copy
  • the parameter of the i-th matching instruction for mapping the i-th matching field to the i-th mapping value includes: an i-th mask, the i-th matching field in the i-th matching field The i-th starting position of the belonging data packet, the i-th matching field, the i-th bias of the data packet to which the i-th matching field belongs Transmitting the number of bytes and the i-th stream identifier of the data stream to which the data packet to which the i-th matching field belongs, the mapping according to the i-th matching instruction for mapping the i-th matching field to Mapping the i-th matching value to the i-th mapping value Mpi, including: positioning the ith starting position and the ith offset byte number according to the parameter of the ith mapping value
  • the i-th match field extracts the i-th match field at the location of the received data packet; and performs logical AND operation on the extracted i-th match field and the i-th mask; Filling the ith
  • the program may be stored in a computer readable storage medium, and the storage medium may include: Read Only Memory (ROM), Random Access Memory (RAM), disk or optical disk.
  • ROM Read Only Memory
  • RAM Random Access Memory

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

　本发明公开了一种流表匹配的方法、装置和OpenFlow交换***，以在不改变现有硬件逻辑和标准协议的基础上实现任意数据流中任意字段的匹配。所述方法包括：接收控制器针对第一流表下发的跳转指令和匹配指令；在所述第一流表中建立第一流表项；接收所述控制器针对所述第二流表下发的流模式消息；在所述第二流表中建立第二流表项。本发明为实现真正灵活的可编程软件定义网络奠定了基础，可协助网络服务运营商降低资本性支出和运营性支出，并且使得传统的IP网络具备更灵活的面向实时业务的网络抽象和管理能力。

Description

一种流表匹配的方法、装置和OpenFlow交换*** 技术领域
本发明涉及数据交换领域，具体涉及一种流表匹配的方法、装置和OpenFlow交换***。
背景技术
开放流(OpenFlow)技术允许对一个网络进行编程，好像这个网络就是一台计算机一样。OpenFlow和软件定义网络(Software Defined Network，简称SDN)可将物理网络的抽象层直接提供给控制元件，允许通过软件设置和操作网络，OpenFlow技术的核心思想是将原本完全由交换机/路由器控制的数据包转发过程，转化为由OpenFlow交换机(OpenFlow Switch)和控制服务器(Controller)分别完成的独立过程。
OpenFlow交换机由流表(Flow Table)、安全通道和OpenFlow协议三部分组成，其中，流表由匹配域(Match Field)、计数器(Counters)和指令集(Instructions)组成，用于存储数据包的转发规则，安全通道是连接OpenFlow交换机到控制器的接口，而OpenFlow协议用来描述控制器和交换机之间交互所用信息的标准。OpenFlow交换机在OpenFlow网络中执行来自OpenFlow控制器的命令，根据控制器下发的流规则对收到的数据包进行转发。当OpenFlow交换机对于某一个收到的数据包无法找到对应的转发规则时，则将该数据包转发给控制器，由控制器决定该包的转发动作，并下发新的转发规则到OpenFlow交换机。
现有的OpenFlow交换机所进行的数据包匹配只能基于有限的字段进行，即，其流表的匹配域不能动态更新。例如，假设流表的匹配域只有协议规定的字段A、字段B或字段C三个字段用于数据包的匹配，当一个数据包中用于表征该数据包对应的数据流的特征字段是字段D，即不是字段A、字段B和字段C三个字段中的任意一个时，若OpenFlow交换机进行数据包的匹配，则需要将流表的匹配域扩展至字段A、字段B、字段C和字段D。这一扩展往往需要付出一定的代价，例如，重新更改硬件逻辑，对当前软件和/ 或硬件进行升级。
可见，现有的Switch匹配域不能动态更新，如果需要更新匹配域，则当前软硬件必须要升级才能支持，无法满足业务需求。
发明内容
本发明实施例提供一种流表匹配的方法、装置和OpenFlow交换***，以在不改变现有硬件逻辑和标准协议的基础上实现任意数据流中任意字段的匹配。
第一方面，一种流表匹配的方法，包括：接收控制器针对第一流表下发的跳转指令和匹配指令，所述匹配指令用于指示将匹配字段映射为映射值，并将所述映射值写入元数据Metadata域，传递给第二流表，所述匹配指令中包含用于将所述匹配字段映射为所述映射值的参数，所述跳转指令用于指示跳转的第二流表；
在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述跳转指令和所述匹配指令，其中，所述匹配指令用于交换机收到数据包后，根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，所述跳转指令用于跳转到所述第二流表，将所述数据包和所述元数据Metadata域中写入的所述映射值Mp传递给所述第二流表；
接收所述控制器针对所述第二流表下发的流模式消息，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值；
在所述第二流表中建立第二流表项，所述第二流表项的指令集为所述行为指令，所述第二流表项的匹配域为所述元数据Metedata值，其中，所述第二流表项的匹配域用于与所述映射值Mp进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
第二方面，一种流表匹配的方法，所述方法包括：接收控制器针对第一流表下发的第一跳转指令和第一匹配指令，所述第一匹配指令用于指示将第一匹配字段映射为第一映射值，并将所述第一映射值写入元数据Metadata域，传递给第二流表，所述第一匹配指令中包含用于将所述第一匹配字段映射为所述第一映射值的参数，所述第一跳转指令用于指示跳转的第二流表，其中， 需要匹配的字段包含Nb个字节，且Nb＝n*Nm，n为大于1的整数，Nm等于流表的元数据Metadata域可包含的最大字节数，所述第一匹配字段为所述需要匹配的字段中的第1字节至第Nm字节；
在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述第一跳转指令和所述第一匹配指令，其中，所述第一匹配指令用于交换机收到数据包后，根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，并将所述第一映射值Mp1写入所述第一流表的的元数据Metadata域，所述第一跳转指令用于跳转到所述第二流表，将所述数据包和所述第一流表的的元数据Metadata域中写入的所述第一映射值Mp1传递给所述第二流表；
接收所述控制器针对n-1个流表下发的n-1个流模式消息，其中，针对第i个流表下发第i个流模式消息，n≥i≥2，所述第i个流模式消息中包含第i个跳转指令、第i个匹配指令和用于匹配第i个匹配字段的第i个元数据Metadata值，所述第i个匹配指令用于指示将所述第i个匹配字段映射为第i个映射值，所述第i个匹配字段为所述需要匹配的字段中的第(i-1)*Nm+1字节至第i*Nm个字节，所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数，所述第i个跳转指令用于指示跳转的下一流表，所述第二流表为第2个流表，所述第i个流表的下一流表为第i+1个流表，所述第n个流表的下一流表为最终流表；
在所述n-1个流表中建立n-1个流表项，其中，在所述第i个流表中建立第i个流表项，所述第i个流表项的匹配域为所述第i个元数据Metedata值，所述第i个流表项的指令集为所述第i个跳转指令和所述第i个匹配指令，所述第i个流表项的匹配域用于与第i-1个映射值Mpi-1进行匹配，并根据匹配结果，执行所述第i个跳转指令和所述第i个匹配指令，所述第一映射值Mp1为第1个映射值Mp1，所述第i个匹配指令用于根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，并将所述第i个映射值Mpi写入所述第i个流表的元数据Metadata域，所述第i个跳转指令用于跳转到所述第i个流表的下一流表，将所述数据包和所述第i个流表的元数据Metadata域中写入的所述第i个映射值Mpi传递给所述第i个流表的下一流表；
接收所述控制器针对所述最终流表下发的最终流模式消息，所述最终流 模式消息包含行为指令和用于匹配第n个匹配字段的第n个元数据Metadata值；
在所述最终流表中建立最终流表项，所述最终流表项的指令集为所述行为指令，所述最终流表项的匹配域为所述第n个元数据Metedata值，其中，所述最终流表项的匹配域用于与所述第n个映射值Mpn进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
第三方面，一种流表匹配的装置，所述装置包括：第一接收模块，用于接收控制器针对第一流表下发的跳转指令和匹配指令，所述匹配指令用于指示将匹配字段映射为映射值，并将所述映射值写入元数据Metadata域，传递给第二流表，所述匹配指令中包含用于将所述匹配字段映射为所述映射值的参数，所述跳转指令用于指示跳转的第二流表；
第一建立模块，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述跳转指令和所述匹配指令，其中，所述匹配指令用于交换机收到数据包后，根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，所述跳转指令用于跳转到所述第二流表，将所述数据包和所述元数据Metadata域中写入的所述映射值Mp传递给所述第二流表；
第二接收模块，用于接收所述控制器针对所述第二流表下发的流模式消息，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值；
第二建立模块，用于在所述第二流表中建立第二流表项，所述第二流表项的指令集为所述行为指令，所述第二流表项的匹配域为所述元数据Metedata值，其中，所述第二流表项的匹配域用于与所述映射值Mp进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
第四方面，一种流表匹配的装置，所述装置包括：第三接收模块，用于接收控制器针对第一流表下发的第一跳转指令和第一匹配指令，所述第一匹配指令用于指示将第一匹配字段映射为第一映射值，并将所述第一映射值写入元数据Metadata域，传递给第二流表，所述第一匹配指令中包含用于将所述第一匹配字段映射为所述第一映射值的参数，所述第一跳转指令用于指示跳转的第二流表，其中，需要匹配的字段包含Nb个字节，且Nb＝n*Nm，n 为大于1的整数，Nm等于流表的元数据Metadata域可包含的最大字节数，所述第一匹配字段为所述需要匹配的字段中的第1字节至第Nm字节；
第三建立模块，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述第一跳转指令和所述第一匹配指令，其中，所述第一匹配指令用于交换机收到数据包后，根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，并将所述第一映射值Mp1写入所述第一流表的的元数据Metadata域，所述第一跳转指令用于跳转到所述第二流表，将所述数据包和所述第一流表的的元数据Metadata域中写入的所述第一映射值Mp1传递给所述第二流表；
第四接收模块，用于接收所述控制器针对n-1个流表下发的n-1个流模式消息，其中，针对第i个流表下发第i个流模式消息，n≥i≥2，所述第i个流模式消息中包含第i个跳转指令、第i个匹配指令和用于匹配第i个匹配字段的第i个元数据Metadata值，所述第i个匹配指令用于指示将所述第i个匹配字段映射为第i个映射值，所述第i个匹配字段为所述需要匹配的字段中的第(i-1)*Nm+1字节至第i*Nm个字节，所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数，所述第i个跳转指令用于指示跳转的下一流表，所述第二流表为第2个流表，所述第i个流表的下一流表为第i+1个流表，所述第n个流表的下一流表为最终流表；
第四建立模块，用于在所述n-1个流表中建立n-1个流表项，其中，在所述第i个流表中建立第i个流表项，所述第i个流表项的匹配域为所述第i个元数据Metedata值，所述第i个流表项的指令集为所述第i个跳转指令和所述第i个匹配指令，所述第i个流表项的匹配域用于与第i-1个映射值Mpi-1进行匹配，并根据匹配结果，执行所述第i个跳转指令和所述第i个匹配指令，所述第一映射值Mp1为第1个映射值Mp1，所述第i个匹配指令用于根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，并将所述第i个映射值Mpi写入所述第i个流表的元数据Metadata域，所述第i个跳转指令用于跳转到所述第i个流表的下一流表，将所述数据包和所述第i个流表的元数据Metadata域中写入的所述第i个映射值Mpi传递给所述第i个流表的下一流表；
第五接收模块，用于接收所述控制器针对所述最终流表下发的最终流模式消息，所述最终流模式消息包含行为指令和用于匹配第n个匹配字段的第n个元数据Metadata值；
第五建立模块，用于在所述最终流表中建立最终流表项，所述最终流表项的指令集为所述行为指令，所述最终流表项的匹配域为所述第n个元数据Metedata值，其中，所述最终流表项的匹配域用于与所述第n个映射值Mpn进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
第五方面，一种OpenFlow交换***，所述交换***包括交换机和控制器，所述交换机包括第一接收模块、第一建立模块、第二接收模块和第二建立模块；
所述控制器，用于向所述交换机下发针对第一流表的跳转指令和匹配指令，以及向所述交换机下发针对所述第二流表的流模式消息，所述匹配指令用于指示将匹配字段映射为映射值，并将所述映射值写入元数据Metadata域，传递给第二流表，所述匹配指令中包含用于将所述匹配字段映射为所述映射值的参数，所述跳转指令用于指示跳转的第二流表，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值；
所述第一接收模块，用于所述接收控制器针对第一流表下发的所述跳转指令和匹配指令；
所述第一建立模块，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述跳转指令和所述匹配指令，其中，所述匹配指令用于交换机收到数据包后，根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，所述跳转指令用于跳转到所述第二流表，将所述数据包和所述元数据Metadata域中写入的所述映射值Mp传递给所述第二流表；
所述第二接收模块，用于接收所述控制器针对所述第二流表下发的所述流模式消息；
所述第二建立模块，用于在所述第二流表中建立第二流表项，所述第二流表项的指令集为所述行为指令，所述第二流表项的匹配域为所述元数据Metedata值，其中，所述第二流表项的匹配域用于与所述映射值Mp进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
第六方面，一种OpenFlow交换***，所述交换***包括交换机和控制器，所述交换机包括第三接收模块、第三建立模块、第四接收模块、第四建立模块、第五接收模块和第五建立模块；
所述控制器，用于向所述交换机下发针对第一流表的第一跳转指令和第一匹配指令，向所述交换机下发针对n-1个流表的n-1个流模式消息，以及向所述交换机下发针对最终流表的最终流模式消息，所述第一匹配指令用于指示将第一匹配字段映射为第一映射值，并将所述第一映射值写入元数据Metadata域，传递给第二流表，所述第一匹配指令中包含用于将所述第一匹配字段映射为所述第一映射值的参数，所述第一跳转指令用于指示跳转的第二流表，其中，需要匹配的字段包含Nb个字节，且Nb＝n*Nm，n为大于1的整数，Nm等于流表的元数据Metadata域可包含的最大字节数，所述第一匹配字段为所述需要匹配的字段中的第1字节至第Nm字节，所述针对第i个流表下发第i个流模式消息，n≥i≥2，所述第i个流模式消息中包含第i个跳转指令、第i个匹配指令和用于匹配第i个匹配字段的第i个元数据Metadata值，所述第i个匹配指令用于指示将所述第i个匹配字段映射为第i个映射值，所述第i个匹配字段为所述需要匹配的字段中的第(i-1)*Nm+1字节至第i*Nm个字节，所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数，所述第i个跳转指令用于指示跳转的下一流表，所述第二流表为第2个流表，所述第i个流表的下一流表为第i+1个流表，所述第n个流表的下一流表为最终流表，所述最终流模式消息包含行为指令和用于匹配第n个匹配字段的第n个元数据Metadata值；
所述第三接收模块，用于接收所述控制器针对第一流表下发的所述第一跳转指令和第一匹配指令；
所述第三建立模块，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述第一跳转指令和所述第一匹配指令，其中，所述第一匹配指令用于交换机收到数据包后，根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，并将所述第一映射值Mp1写入所述第一流表的的元数据Metadata域，所述第一跳转指令用于跳转到所述第二流表，将所述数据包和所述第一流表的的元数据Metadata域中写入的所述第一映射值Mp1传递给所述第二流表；
所述第四接收模块，用于接收所述控制器针对n-1个流表下发的所述n-1个流模式消息；
所述第四建立模块，用于在所述n-1个流表中建立n-1个流表项，其中，在所述第i个流表中建立第i个流表项，所述第i个流表项的匹配域为所述第i个元数据Metedata值，所述第i个流表项的指令集为所述第i个跳转指令和所述第i个匹配指令，所述第i个流表项的匹配域用于与第i-1个映射值Mpi-1进行匹配，并根据匹配结果，执行所述第i个跳转指令和所述第i个匹配指令，所述第一映射值Mp1为第1个映射值Mp1，所述第i个匹配指令用于根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，并将所述第i个映射值Mpi写入所述第i个流表的元数据Metadata域，所述第i个跳转指令用于跳转到所述第i个流表的下一流表，将所述数据包和所述第i个流表的元数据Metadata域中写入的所述第i个映射值Mpi传递给所述第i个流表的下一流表；
所述第五接收模块，用于接收所述控制器针对所述最终流表下发的所述最终流模式消息；
所述第五建立模块，用于在所述最终流表中建立最终流表项，所述最终流表项的指令集为所述行为指令，所述最终流表项的匹配域为所述第n个元数据Metedata值，其中，所述最终流表项的匹配域用于与所述第n个映射值Mpn进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
从上述本发明实施例可知，匹配指令包含的参数是用于将匹配字段映射为映射值的参数，而匹配字段可以为除标准协议规定可匹配的字段之外的任意字段，通过将所述匹配字段映射为映射值，便可将控制器下发的元数据Metadata值与该映射值匹配。因此，与现有POF技术对OpenFlow协议规定的指令集进行了完全颠覆、实现起来工作量大相比，本发明实施例提供的方法在不改变现有的硬件逻辑和OpenFlow标准协议的基础上提供了动态拓展协议支持的方式，增强了数据流的可管理性，当在出现新的应用/协议需要处理时，无需进行硬件升级，而只是通过软件方式即可做到平滑支持。由于无需改变现有的硬件逻辑而是通过软件方式实现了流表匹配域匹配范围的扩大，因此也为实现真正灵活的可编程软件定义网络奠定了基础，可协助网络服务运营商降低资本性支出和运营性支出，并且使得传统的IP网络具备更灵 活的面向实时业务的网络抽象和管理能力。
附图说明
图1是本发明实施例提供的流表匹配的方法的基本流程示意图；
图2是本发明实施例提供的控制器是向第一流表Table N—1下发用于将匹配字段映射为映射值的参数并向第一流表Table N—1的下一流表Table N即第二流表下发行为指令和用于匹配匹配字段的元数据Metadata值示意图；
图3是本发明实施例提供的将匹配字段映射为映射值Mp的示意图；
图4是本发明另一实施例提供的流表匹配的方法的基本流程示意图；
图5是本发明实施例提供的流表匹配的装置的基本逻辑结构示意图；
图6是本发明另一实施例提供的流表匹配的装置的基本逻辑结构示意图；
图7是本发明实施例提供的OpenFlow交换***逻辑结构示意图；
图8是本发明另一实施例提供的OpenFlow交换***逻辑结构示意图。
具体实施方式
本发明实施例提供一种流表匹配的方法，包括：接收控制器针对第一流表下发的跳转指令和匹配指令，所述匹配指令用于指示将匹配字段映射为映射值，并将所述映射值写入元数据Metadata域，传递给第二流表，所述匹配指令中包含用于将所述匹配字段映射为所述映射值的参数，所述跳转指令用于指示跳转的第二流表；在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述跳转指令和所述匹配指令，其中，所述匹配指令用于交换机收到数据包后，根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，所述跳转指令用于跳转到所述第二流表，将所述数据包和所述元数据Metadata域中写入的所述映射值Mp传递给所述第二流表；接收所述控制器针对所述第二流表下发的流模式消息，所述流模式消息包含行 为指令和用于匹配所述匹配字段的元数据Metadata值；在所述第二流表中建立第二流表项，所述第二流表项的指令集为所述行为指令，所述第二流表项的匹配域为所述元数据Metedata值，其中，所述第二流表项的匹配域用于与所述映射值Mp进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。本发明实施例还提供相应的一种流表匹配的装置和OpenFlow交换***。以下分别进行详细说明。
本发明实施例的流表匹配的方法可应用于OpenFlow交换机以及由OpenFlow交换机和OpenFlow控制器构成的OpenFlow交换***，其执行主体可以是OpenFlow交换机，基本流程可参考图1，主要包括步骤S101至步骤S104：
S101，接收控制器针对第一流表下发的跳转指令和匹配指令。
控制器针对第一流表下发的匹配指令用于指示将匹配字段映射为映射值，并将映射所得映射值写入元数据Metadata域，传递给第二流表，匹配指令中包含用于将匹配字段映射为映射值的参数，而跳转指令用于指示跳转的第二流表。
在本发明实施例中，流表(Flow Table)均指的是OpenFlow交换机中维护的流表，流表(Flow Table)与OpenFlow标准协议定义的流表类似，例如，都包含匹配域(Match Field)、计数器(Counters)和指令集(Instructions)，流表构成交换机的组成部分，交换机指的是OpenFlow交换机，控制器指的是OpenFlow控制器。在本发明实施例中，匹配字段既可以是待匹配数据流中标准协议规定可匹配的字段，又可以是待匹配数据流中除标准协议规定可匹配的字段之外的任意字段。例如，OpenFlow标准协议规定可匹配的字段可能只有IP地址、端口号和MAC地址等有限的几个字段，然而，有些数据流仅仅使用上述标准协议规定可匹配的字段仍然无法进行匹配或识别，可能需要用于标识该数据流的特征值来识别。本发明实施例中，可以事先将各种数据流中 的匹配字段(例如，唯一标识该数据流的特征值)对应的元数据Metadata值计算出来，由OpenFlow控制器在本端维护这一元数据Metadata值，即，OpenFlow控制器维护有与每一种数据流唯一对应的元数据Metadata值。
S102，在第一流表中建立第一流表项，所述第一流表项的指令集为跳转指令和匹配指令。
如前所述，匹配指令中包含用于将匹配字段映射为映射值的参数，其主要包括掩码、匹配字段在所述匹配字段所属数据包的起始位置、匹配字段在所述匹配字段所属数据包的偏移字节数和所述匹配字段所属数据包所属数据流的流标识。匹配指令的作用在于交换机收到数据包后，根据匹配指令中包含的用于将匹配字段映射为映射值的参数，将匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，跳转指令用于跳转到第二流表，将数据包和元数据Metadata域中写入的映射值Mp传递给所述第二流表。
在收到控制器针对第一流表下发的跳转指令和匹配指令后，交换机可在第一流表中建立第一流表项。在本发明实施例中，控制器下发的匹配指令可以是一个结构体(struct)。假设该结构体的名字为ofp_instruction_proto_ext，则作为本发明一个实施例，匹配指令可以如下所示：
struct ofp_instruction_proto_ext
{
int16_t type；
int16_t len；
int8_t pad[4]；
uint8_t serial_no；
uint8_t match_ext_num；
struct match_ext match_ext_value[OFP_MAX_PROTO_EXT_LEN]；
}；
上述结构体ofp_instruction_proto_ext中，match_ext_value为数量是常量值OFP_MAX_PROTO_EXT_LEN(例如，OFP_MAX_PROTO_EXT_LEN等于7)的结构体，每一个结构体表示一个字节的匹配域，具体可支持的拓展匹配域多少由交换机(Switch)支持的抽象Metadata值的长度进行定义，具体地，结构体match_ext_value定义如下：
struct match_ext_value
{
enum start_position position；
uint16_t offset；
uint8_t bitmask；
uint8_t Reserved；
}；
在上述以结构体ofp_instruction_proto_ext表示的匹配指令中，前述实施例提及的用于将匹配字段映射为映射值Mp的参数包括bitmask、position、offset和serial_no，其中：
bitmask表示掩码，用于判决匹配字段中哪几位有效；
position表示匹配字段在该匹配字段所属数据包的起始位置，数据结构类型为枚举类型，结构体为常用的且位置确定的TCP/IP数据包中字段的起始字节数，该字段结合offset定位到匹配字段域在其所属数据包中的具***置，position的结构体示意如下：
struct start_position
{
LINK_DATA_START＝0；
MAC_DST＝0；
MAC_SRC＝6；
MAC_DATA_START＝14；
IP_SRC＝26；
IP_DST＝30；
IP_DATA_START＝34；
UDP_DATA_START＝42；
}；
offset表示匹配匹配字段在该匹配匹配字段所属数据包的偏移字节数；
serial_no表示数据流序列号，也就是匹配字段所属数据包所属数据流的流标识，用于控制器(Controller)根据数据流的分类分配不同的序列号以表示不同的数据流，以便对数据流进行管理，serial_no的长度为uint8，即可以表示256种不同的流类型；
match_ext_num表示实际填充的结构体match_ext_value的数量。
作为本发明一个实施例，交换机收到数据包后，根据匹配指令中包含的用于将匹配字段映射为映射值的参数，将匹配字段映射为映射值Mp，包括如下步骤S1021至步骤S1023：
S1021，按照起始位置和偏移字节数定位匹配字段在收到的数据包的位置，提取所述匹配字段。
例如，若某个匹配字段在其所属数据包的起始位置position是第2个字节，在其所属数据包的偏移字节数offset是3字节，则提取该数据包的第2至4字节的内容，就是匹配字段。
S1022，将步骤S1021中提取的匹配字段与掩码进行逻辑“与”运算。
S1023，将流标识填充至连续字节组的首字节以及将逻辑“与”运算的运算结果依次复制至所述连续字节组的余下字节，将所述被填充和复制完毕后的所述连续字节组的内容作为所述映射值Mp，所述连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数。
考虑到目前OpenFlow标准协议中元数据Metadata域包含的字节数为8个字节，因此，在本发明实施例中，连续字节组可以是连续8个字节组成的字节组，将匹配字段所属数据包所属数据流的流标识serial_no填充至连续字节组的首字节以及步骤S1022逻辑“与”运算的运算结果依次复制至该连续字节组的余下字节可以是：将匹配字段所属数据包所属数据流的流标识serial_no填充至8个字节的首字节即byte1以及步骤S1022逻辑“与”运算的运算结果依次复制至这8个字节的余下字节即byte2、byte3、byte4、byte5、byte6、byte7和byte8，将被填充和复制完毕后的8个字节的内容作为映射值Mp。
对于连续字节组可以是连续8个字节组成的字节组的实施例，步骤S1021至步骤S1023的过程如附图3所示，其中，单向箭头表示复制这一操作。
由步骤S1023得到的映射值Mp可以写入元数据Metadata域中，并且随收到的数据包一起传递给至第二流表。
S103，接收所述控制器针对所述第二流表下发的流模式消息，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值。
由于控制器维护有与每一种数据流唯一对应的Metadata值，因此，控制器向跳转指令所指示的第二流表下发的流模式(Flow Mod)消息可包含行为指令和用于匹配匹配字段的元数据Metadata值。在附图2示例的两个流表即Table N—1和Table N中，假设Table N—1表示前述实施例的第一流表，Table N表示前述实施例的第二流表。Table N—1中的指令集(Instructions)就包含控制器向Table N—1下发的跳转指令和匹配指令，假设此处的跳转指令使用Goto-Table表示，匹配指令使用Proto-Ext表示，则实际上Goto-Table的值可赋予第二流表的序号N，即Goto-Table＝N表示处理完Table N—1后，跳转至Table N；而Proto-Ext是基于现有的OpenFlow标准协议指令集新增的匹配指令。跳转指令Goto-Table所指示的下一流表即Table N中，其匹配域(Match Fields)包含的就是控制器下发的用于匹配所述匹配字段的元数据Metadata 值。
S104，在第二流表中建立第二流表项。
交换机在接收到控制器针对第二流表下发的流模式消息后，在第二流表中建立的第二流表项，其指令集为控制器针对第二流表下发的流模式消息所包含的行为指令，其中，第二流表项的匹配域中的内容为元数据Metedata值，其用于与映射值Mp进行匹配，行为指令用于根据匹配结果，对数据包进行处理。
如前所述，控制器向第一流表下发的匹配指令中包含用于将匹配字段映射为映射值的参数，并且所得到的映射值Mp传递至第二流表，而流模式消息包含的行为指令和用于匹配匹配字段的元数据Metadata值是下发给跳转指令所指示的第二流表。例如，如附图2所示，控制器是向流表Table N—1下发用于将匹配字段映射为映射值的参数，向流表Table N下发行为指令和用于匹配匹配字段的元数据Metadata值，将经由步骤S103所收到的元数据Metadata值与传递至第二流表的映射值Mp匹配是在访问流表Table N时才开始执行，而不是在访问流表Table N—1时执行。
若经由步骤S103所收到的元数据Metadata值与传递至第二流表的映射值Mp匹配成功，则按照向第二流表下发的行为指令执行对收到的数据包的操作，例如，将该数据包丢弃(drop)、修改(modify)、转发至端口(forward to port)或转发至控制器(forward to controller)，等等。
从上述本发明实施例提供的流表匹配的方法可知，匹配指令包含的参数是用于将匹配字段映射为映射值的参数，而匹配字段可以为除标准协议规定可匹配的字段之外的任意字段，通过将所述匹配字段映射为映射值，便可将控制器下发的元数据Metadata值与该映射值匹配。因此，与现有POF技术对OpenFlow协议规定的指令集进行了完全颠覆、实现起来工作量大相比，本发明实施例提供的方法在不改变现有的硬件逻辑和OpenFlow标准协议的基础 上提供了动态拓展协议支持的方式，增强了数据流的可管理性，当在出现新的应用/协议需要处理时，无需进行硬件升级，而只是通过软件方式即可做到平滑支持。由于无需改变现有的硬件逻辑而是通过软件方式实现了流表匹配域匹配范围的扩大，因此也为实现真正灵活的可编程软件定义网络奠定了基础，可协助网络服务运营商降低资本性支出和运营性支出，并且使得传统的IP网络具备更灵活的面向实时业务的网络抽象和管理能力。
以下以禁止即时通信软件QQ这一应用场景为例，对上述本发明实施例提供的流表匹配的方法进行进一步说明。
使用常规的ACL对QQ这一类型的流进行过滤或者通过过滤QQ登录服务器的IP地址，在功能上受到了很大限制。这是因为，QQ流被常规的ACL过滤后，QQ会采用基于TCP的80和443端口进行通信，因此无法禁止这种采用公知端口的私有协议通信，而过滤QQ登录服务器的IP地址，则由于服务器很多，并且每增加一台服务器都需要及时获取到它的IP，然后加到ACL里，所以也不是有效的办法。由此可见，要彻底禁止QQ，需要做到：1、根据QQ应用协议数据流特征来识别其所属协议类型，即找出其应用协议的特征码；2、使用更为灵活的包过滤工具匹配QQ数据包，并执行过滤操作。
对于找出QQ应用协议的特征码，可以通过抓包工具实现。首先分析UDP应用协议的QQ数据包。可打开Wireshark抓包工具，然后运行QQ进行登录，Wireshark很快就抓到协议为UDP和OICQ的数据包。首先定位到IP协议头，得知IP协议头长度为20字节(byte)，后面UDP头长度8个byte，其中包括端口号4000和8000，之后就是QQ信息的数据字段，开始1个byte为0x02，是OICQ包的协议标识(flag)，后面2个byte即0x262f标识QQ的版本号，表示当前的QQ版本是2011正式版，接在0x262f后面的2个byte是命令字段，用于QQ登录的命令取值为0xba。因此，可以将偏移量(offset)为28的协议标识0x02和偏移量(offset)为31的命令值0xba作为QQ应用协议是UDP时的特征码。
其次是分析TCP数据包。无论是使用HTTP还是SSL协议，QQ消息里都有协议标识字段+版本字段：0x02262f，用于登录的消息字段是前面相邻的0x0059，所以将偏移量(offset)为40和0x005902作为QQ应用协议是TCP时的特征码。
以QQ应用协议是UDP为例(QQ应用协议是TCP分析方法类似)，提取到上述QQ应用协议是UDP时的特征码以后，对于UDP类型的QQ数据包，流模式(Flow Mod)消息包含的以结构体match_ext_value表示的指令如下：
struct match_ext_value[0]
{
enum start_position position＝IP_DATA_START；
uint16_t offset＝28；
uint8_t bitmask＝0xff；
uint8_t Reserved；
}；
struct match_ext_value[1]
{
enum start_position position＝IP_DATA_START；
uint16_t offset＝31；
uint8_t bitmask＝0xff；
uint8_t Reserved；
}；
QQ这一应用的流标识及数据流序列号serial_no是0x11，根据上述结构体match_ext_value[0]或match_ext_value[1]中的bitmask和offset，采用附图1示例的步骤S1021至步骤S1023的计算方法，得到QQ应用协议是UDP时的特征码对应的映射值为0x1102ba0000000000，与当前流表的下一流表中保存的匹配 域的抽象Metadata值0x1102ba0000000000可以匹配，则执行指令集(Actions)中的指令即将该QQ数据包丢弃。
上述实施例说明的是单级流表对应的流表匹配的方法，一个流表最大支持8个字节的协议拓展。实际上，本发明实施例还提供多个流表级联时流表匹配的方法，多个流表级联以扩大流表匹配域匹配范围的应用场景在于：某种待匹配数据流的匹配字段所包含的字节数过多，例如，多于7个字节，将该匹配字段映射为映射值后，该映射值所包含的字节数大于目前OpenFlow标准协议中元数据Metadata值包含的字节数，因此，仅仅依靠一个流表中的元数据Metadata值无法完成匹配。为了解决这一问题，，本发明另一实施例提供另一种流表匹配的方法，其执行主体仍然是Openflow交换***中的交换机，主要流程可参阅附图4，包括步骤S401至步骤S406，详细说明如下：
S401，接收控制器针对第一流表下发的第一跳转指令和第一匹配指令。
在本实施例中，交换机接收控制器针对第一流表下发的第一跳转指令和第一匹配指令与附图1示例的步骤S101中交换机接收控制器针对第一流表下发的跳转指令和匹配指令类似，即，第一匹配指令用于指示将第一匹配字段映射为第一映射值，并将所述第一映射值写入元数据Metadata域，传递给第二流表，第一匹配指令中包含用于将第一匹配字段映射为第一映射值的参数，第一跳转指令用于指示跳转的第二流表，其中，需要匹配的字段包含Nb个字节，且Nb＝n*Nm，n为大于1的整数，Nm等于流表的元数据Metadata域可包含的最大字节数，第一匹配字段为所述需要匹配的字段中的第1字节至第Nm字节。
S402，在第一流表中建立第一流表项。
在本实施例中，交换机收到控制器针对第一流表下发的第一跳转指令和第一匹配指令后，在第一流表中建立第一流表项与附图1示例的步骤S102中在第一流表中建立第一流表项类似，即，第一流表项的指令集为第一跳转指 令和所述第一匹配指令，其中，第一匹配指令用于交换机收到数据包后，根据第一匹配指令中包含的用于将第一匹配字段映射为所述第一映射值的参数，将第一匹配字段映射为第一映射值Mp1，并将所述第一映射值Mp1写入第一流表的的元数据Metadata域，第一跳转指令用于跳转到第二流表，将所述数据包和所述第一流表的的元数据Metadata域中写入的所述第一映射值Mp1传递给所述第二流表。
其中，将第一匹配字段映射为所述第一映射值的参数包括：第一掩码、所述第一匹配字段在所述第一匹配字段所属数据包的第一起始位置、所述第一匹配字段在所述第一匹配字段所属数据包的第一偏移字节数和所述第一匹配字段所属数据包所属数据流的第一流标识，而根据第一匹配指令中包含的用于将第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，包括如下步骤S4021至步骤S4023：
S4021，按照第一起始位置和第一偏移字节数定位第一匹配字段在收到的数据包的位置，提取第一匹配字段。
S4022，将经由步骤S4021提取的所述第一匹配字段与所述第一掩码进行逻辑“与”运算。
S4023，将所述第一流标识填充至第一连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第一连续字节组的余下字节，将所述被填充和复制完毕后的所述第一连续字节组的内容作为所述第一映射值Mp1，所述第一连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数。
由步骤S4023得到的第一映射值Mp1可以写入元数据Metadata域中，并且随收到的数据包一起传递给至第二流表。
S403，接收控制器针对n-1个流表下发的n-1个流模式消息。
在本实施例中，控制器针对n-1个流表下发n-1个流模式消息是针对n-1个 流表中每一个流表下发n-1个流模式消息中的每一个流模式消息，即，针对第i个流表下发第i个流模式消息，其中，2≤i≤n。在本实施例中，针对第i个流表下发第i个流模式消息与附图1示例的步骤S103中针对第二流表下发的流模式消息类似，即，第i个流模式消息中包含第i个跳转指令、第i个匹配指令和用于匹配第i个匹配字段的第i个元数据Metadata值，所述第i个匹配指令用于指示将所述第i个匹配字段映射为第i个映射值。
与附图1示例不同的是，在本实施例中，第i个匹配字段为需要匹配的字段中的第(i-1)*Nm+1字节至第i*Nm个字节，第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数，所述第i个跳转指令用于指示跳转的下一流表，所述第二流表为第2个流表，所述第i个流表的下一流表为第i+1个流表，所述第n个流表的下一流表为最终流表。
S404，在n-1个流表中建立n-1个流表项。
在本实施例中，交换机在n-1个流表中建立n-1个流表项是在n-1个流表中每一个流表建立一个流表项，即，在第i个流表中建立第i个流表项，所述第i个流表项的匹配域为第i个元数据Metedata值，所述第i个流表项的指令集为所述第i个跳转指令和所述第i个匹配指令。
与附图1示例的单级流表匹配不同的是，在本实施例中，第i个流表项的匹配域用于与第i-1个映射值Mpi-1进行匹配，并根据匹配结果，执行所述第i个跳转指令和所述第i个匹配指令，所述第一映射值Mp1为第1个映射值Mp1，所述第i个匹配指令用于根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，并将所述第i个映射值Mpi写入所述第i个流表的元数据Metadata域，所述第i个跳转指令用于跳转到所述第i个流表的下一流表，将所述数据包和所述第i个流表的元数据Metadata域中写入的所述第i个映射值Mpi传递给所述第i个流表的下一流表。
在本实施例中，第i个匹配指令中包含用于将第i个匹配字段映射为第i个映射值的参数包括第i掩码、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i起始位置、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i偏移字节数和所述第i个匹配字段所属数据包所属数据流的第i流标识。作为本发明一个实施例，根据第i个匹配指令中包含的用于将第i个匹配字段映射为第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，包括如下步骤S4041至步骤S4043：
S4041，按照第i起始位置和第i偏移字节数定位第i个一匹配字段在收到的数据包的位置，提取第i个匹配字段。
S4042，将提取的第i个匹配字段与第i掩码进行逻辑“与”运算。
S4043，将第i流标识填充至第i连续字节组的首字节以及将步骤S4042中逻辑“与”运算的运算结果依次复制至所述第i连续字节组的余下字节，将所述被填充和复制完毕后的所述第i连续字节组的内容作为所述第i个映射值Mpi，所述第i连续字节组为N个字节的数据。
由步骤S4023得到的映射值Mpi可以写入第i个流表的元数据Metadata域中，并且随收到的数据包一起传递给至第i个流表的下一流表即第i+1个流表。
S405，接收控制器针对最终流表下发的最终流模式消息。
最终流模式消息包含用于匹配第n个匹配字段的第n个元数据Metadata值和行为指令，该行为指令表示访问至最终流表时所执行的动作。
S406，在最终流表中建立最终流表项。
最终流表项的指令集为行为指令，最终流表项的匹配域为第n个元数据Metedata值，其中，最终流表项的匹配域用于：将第n个元数据Metedata值与步骤S405中控制器针对最终流表下发的最终流模式消息中包含的第n个映射值Mpn进行匹配，行为指令用于根据匹配结果，对数据包进行处理，例如，将该数据包丢弃(drop)、修改(modify)、转发至端口(forward to port) 或转发至控制器(forward to controller)，等等。
以下以禁止微信这一应用为例，对上述本发明实施例提供的针对多级流表级联时流表匹配的方法进行进一步说明。
微信这一应用的应用协议的特征码是包含21个字节的特征码，假设该特征码如下：第一字节(byte1)＝0x01，第二字节(byte2)＝0x02，第三字节(byte3)＝0x03，第四字节(byte4)＝0x04，….，第二十一字节(byte21)＝0x21，Openflow控制器预先定义微信这一应用的类型为0x22。
由于微信的应用协议的特征码包含21个字节，经Openflow控制器计算，需要21/7＝3级流表，即至少需要三个流表级联(以下简称为三级流表)才能对该应用进行匹配，包括如下步骤S1至步骤S6：
S1，Openflow控制器向Openflow交换机下发针对第一流表的第一跳转指令和第一匹配指令。
Openflow控制器下发的第一匹配指令包含用于将第一匹配字段映射为第一映射值Mp1的参数，而第一跳转指令用于指示跳转至三级流表的第二流表(记为Table N+1)；
S2，Openflow交换机在Table N中建立第一流表项。
在Table N中建立的第一流表项的指令集为Openflow控制器下发的第一跳转指令和第一匹配指令，其中，第一匹配指令用于指示Openflow交换机，在微信的数据包经过三级流表的第一流表(记为Table N)时，将第一匹配字段即包含21个字节的特征码的前7个字节映射为第一映射值Mp1，第一跳转指令用于跳转到所述第二流表，将数据包和写入元数据Metadata域的第一映射值Mp1传递给三级流表中的第二流表(记为Table N+1)。
S3，接收Openflow控制器针对三级流表的第二流表和第三流表下发的2个流模式消息。
针对第二流表下发第2个流模式消息，针对第三流表(记为Table N+2) 下发第3个流模式消息，其中，第2个流模式消息中包含第2个跳转指令、第2个匹配指令和用于匹配第2个匹配字段的第2个元数据Metadata值，第2个匹配指令用于指示将第2个匹配字段即包含21个字节的特征码的中间7个字节映射为第2个映射值Mp2，第2个匹配指令中包含用于将第2个匹配字段映射为第2个映射值Mp2的参数，第2个跳转指令用于指示跳转的下一流表；第3个流模式消息中包含第3个跳转指令、第3个匹配指令和用于匹配第3个匹配字段的第3个元数据Metadata值，第3个匹配指令用于指示将第3个匹配字段即包含21个字节的特征码的最后7个字节映射为第3个映射值Mp3，第3个匹配指令中包含用于将第3个匹配字段映射为第3个映射值Mp3的参数，第3个跳转指令用于指示跳转的下一流表即最终流表，第2个元数据Metadata值为0x2201020304050607，第3个元数据Metadata值为0x2208091011121314。
S4，在三级流表中的余下2个流表中建立2个流表项。
Openflow交换机在第2个流表中建立第2个流表项，在第3个流表中建立第3个流表项，第2个流表项的指令集为第2个跳转指令和第2个匹配指令，第2个流表项的匹配域为第2个元数据Metedata值即0x2201020304050607，Openflow交换机根据第2个匹配指令，将0x2201020304050607与第一映射值Mp1进行匹配配，并根据匹配结果，执行第2个跳转指令和第2个匹配指令，第2个匹配指令用于Openflow交换机根据第2个匹配指令中包含的用于将第2个匹配字段映射为第2个映射值Mp2的参数，将第2个匹配字段映射为第2个映射值Mp2，并将第2个映射值Mp2写入第2个流表的元数据Metadata域，第2个跳转指令用于跳转到第2个流表的下一流表即三级流表的第三流表(记为Table N+2)，将微信数据包和第2个流表的元数据Metadata域中写入的第二映射值Mp2传递给第2个流表的下一流表即三级流表的第三流表，第2个流表即三级流表的第二流表Table N+1；第3个流表项的指令集为第3个跳转指令和第3个匹配指令，第3个流表项的匹配域为第3个元数据Metedata值即 0x2208091011121314，第3个流表项的匹配域用于与第二映射值Mp2进行匹配，Openflow交换机根据第3个匹配指令，将0x2208091011121314与第二映射值Mp2进行匹配配，并根据匹配结果，执行第3个跳转指令和第3个匹配指令，第3个匹配指令用于根据第3个匹配指令中包含的用于将第3个匹配字段映射为第2个映射值Mp2的参数，将第3个匹配字段映射为第2个映射值Mp3，并将第2个映射值Mp3写入第3个流表的元数据Metadata域，第3个跳转指令用于跳转到第3个流表的下一流表即最终流表，将微信数据包和第3个流表的元数据Metadata域中写入的第三映射值Mp3传递给第3个流表的下一流表即最终流表。
S5，接收Openflow控制器针对最终流表下发的最终流模式消息。
针对最终流表下发的最终流模式消息中包含行为指令和用于匹配第3个匹配字段的第4个元数据Metadata值即0x2215161718192021。按照本应用场景的目的即禁止微信这一应用，最终流模式消息中包含的行为指令是丢弃(drop)数据包。
S6，在最终流表中建立最终流表项。
最终流表项的指令集为Openflow控制器针对最终流表下发的最终流模式消息所包含的行为指令，最终流表项的匹配域为第4个元数据Metadata值即0x2215161718192021。Openflow交换机在最终流表中建立最终流表项后，将最终流表项的匹配域的元数据Metadata值即0x2215161718192021与传递过来的第三映射值Mp3进行匹配。
若上述匹配成功，则按照行为指令，将执行对数据包丢弃(drop)的操作，即拦截了微信的数据包，实现了禁止微信这一应用的目的。
下面对用于执行上述流表匹配的方法的本发明实施例的流表匹配的装置进行说明，其基本逻辑结构参考图5。为了便于说明，仅仅示出了与本发明实施例相关的部分。图5示例的流表匹配的装置可以是OpenFlow网络中的交换 机，主要包括第一接收模块501、第一建立模块502、第二接收模块503和第二建立模块504，各模块详细说明如下：
第一接收模块501，用于接收控制器针对第一流表下发的跳转指令和匹配指令，所述匹配指令用于指示将匹配字段映射为映射值，并将所述映射值写入元数据Metadata域，传递给第二流表，所述匹配指令中包含用于将所述匹配字段映射为所述映射值的参数，所述跳转指令用于指示跳转的第二流表；
第一建立模块502，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述跳转指令和所述匹配指令，其中，所述匹配指令用于交换机收到数据包后，根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，所述跳转指令用于跳转到所述第二流表，将所述数据包和所述元数据Metadata域中写入的所述映射值Mp传递给所述第二流表；
第二接收模块503，用于接收所述控制器针对所述第二流表下发的流模式消息，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值；
第二建立模块504，用于在所述第二流表中建立第二流表项，所述第二流表项的指令集为所述行为指令，所述第二流表项的匹配域为所述元数据Metedata值，其中，所述第二流表项的匹配域用于与所述映射值Mp进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
需要说明的是，以上附图5示例的流表匹配的装置的实施方式中，各功能模块的划分仅是举例说明，实际应用中可以根据需要，例如相应硬件的配置要求或者软件的实现的便利考虑，而将上述功能分配由不同的功能模块完成，即将所述流表匹配的装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。而且，实际应用中，本实施例中的相应的功能模块可以是由相应的硬件实现，也可以由相应的硬件执行相应的软件完成，例如， 前述的第一接收模块，可以是具有执行前述接收控制器针对第一流表下发的跳转指令和匹配指令的硬件，例如第一接收器，也可以是能够执行相应计算机程序从而完成前述功能的一般处理器或者其他硬件设备；再如前述的第一建立模块，可以是具有执行前述在所述第一流表中建立第一流表项功能的硬件，例如第一建立器，也可以是能够执行相应计算机程序从而完成前述功能的一般处理器或者其他硬件设备(本说明书提供的各个实施例都可应用上述描述原则)。
在附图5示例的流表匹配的装置中，匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数包括：掩码、所述匹配字段在所述匹配字段所属数据包的起始位置、所述匹配字段在所述匹配字段所属数据包的偏移字节数和所述匹配字段所属数据包所属数据流的流标识；而根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，包括：按照所述起始位置和所述偏移字节数定位所述匹配字段在所述收到的数据包的位置，提取所述匹配字段；将提取的所述匹配字段与所述掩码进行逻辑“与”运算；将所述流标识填充至连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述连续字节组的余下字节，将所述被填充和复制完毕后的所述连续字节组的内容作为所述映射值Mp，所述连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数。
请参阅附图6，是本发明另一实施例提供的流表匹配的装置，可用于多个流表级联的情形。为了便于说明，仅仅示出了与本发明实施例相关的部分。图6示例的流表匹配的装置可以是OpenFlow网络中的交换机，主要包括第三接收模块601、第三建立模块602、第四接收模块603、第四建立模块604、第五接收模块605和第五建立模块606，各模块详细说明如下：
第三接收模块601，用于接收控制器针对第一流表下发的第一跳转指令和 第一匹配指令，所述第一匹配指令用于指示将第一匹配字段映射为第一映射值，并将所述第一映射值写入元数据Metadata域，传递给第二流表，所述第一匹配指令中包含用于将所述第一匹配字段映射为所述第一映射值的参数，所述第一跳转指令用于指示跳转的第二流表，其中，需要匹配的字段包含Nb个字节，且Nb＝n*Nm，n为大于1的整数，Nm等于流表的元数据Metadata域可包含的最大字节数，所述第一匹配字段为所述需要匹配的字段中的第1字节至第Nm字节；
第三建立模块602，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述第一跳转指令和所述第一匹配指令，其中，所述第一匹配指令用于交换机收到数据包后，根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，并将所述第一映射值Mp1写入所述第一流表的的元数据Metadata域，所述第一跳转指令用于跳转到所述第二流表，将所述数据包和所述第一流表的的元数据Metadata域中写入的所述第一映射值Mp1传递给所述第二流表；
第四接收模块603，用于接收所述控制器针对n-1个流表下发的n-1个流模式消息，其中，针对第i个流表下发第i个流模式消息，n≥i≥2，所述第i个流模式消息中包含第i个跳转指令、第i个匹配指令和用于匹配第i个匹配字段的第i个元数据Metadata值，所述第i个匹配指令用于指示将所述第i个匹配字段映射为第i个映射值，所述第i个匹配字段为所述需要匹配的字段中的第(i-1)*Nm+1字节至第i*Nm个字节，所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数，所述第i个跳转指令用于指示跳转的下一流表，所述第二流表为第2个流表，所述第i个流表的下一流表为第i+1个流表，所述第n个流表的下一流表为最终流表；
第四建立模块604，用于在所述n-1个流表中建立n-1个流表项，其中，在 所述第i个流表中建立第i个流表项，所述第i个流表项的匹配域为所述第i个元数据Metedata值，所述第i个流表项的指令集为所述第i个跳转指令和所述第i个匹配指令，所述第i个流表项的匹配域用于与第i-1个映射值Mpi-1进行匹配，并根据匹配结果，执行所述第i个跳转指令和所述第i个匹配指令，所述第一映射值Mp1为第1个映射值Mp1，所述第i个匹配指令用于根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，并将所述第i个映射值Mpi写入所述第i个流表的元数据Metadata域，所述第i个跳转指令用于跳转到所述第i个流表的下一流表，将所述数据包和所述第i个流表的元数据Metadata域中写入的所述第i个映射值Mpi传递给所述第i个流表的下一流表；
第五接收模块605，用于接收所述控制器针对所述最终流表下发的最终流模式消息，所述最终流模式消息包含行为指令和用于匹配第n个匹配字段的第n个元数据Metadata值；
第五建立模块606，用于在所述最终流表中建立最终流表项，所述最终流表项的指令集为所述行为指令，所述最终流表项的匹配域为所述第n个元数据Metedata值，其中，所述最终流表项的匹配域用于与所述第n个映射值Mpn进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
在附图6示例的流表匹配的装置中，第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数包括：第一掩码、所述第一匹配字段在所述第一匹配字段所属数据包的第一起始位置、所述第一匹配字段在所述第一匹配字段所属数据包的第一偏移字节数和所述第一匹配字段所属数据包所属数据流的第一流标识，则所述根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，包括：按照所述第一起始位置和所述第一偏移字节数定位所述第一匹配字段在所述收到的数据包的位置，提取所述第一匹配字段； 将提取的所述第一匹配字段与所述第一掩码进行逻辑“与”运算；将所述第一流标识填充至第一连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第一连续字节组的余下字节，将所述被填充和复制完毕后的所述第一连续字节组的内容作为所述第一映射值Mp1，所述第一连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数。
第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数包括：第i掩码、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i起始位置、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i偏移字节数和所述第i个匹配字段所属数据包所属数据流的第i流标识，则所述根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，包括：按照所述第i起始位置和所述第i偏移字节数定位所述第i个一匹配字段在所述收到的数据包的位置，提取所述第i个匹配字段；将提取的所述第i个匹配字段与所述第i掩码进行逻辑“与”运算；将所述第i流标识填充至第i连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第i连续字节组的余下字节，将所述被填充和复制完毕后的所述第i连续字节组的内容作为所述第i个映射值Mpi，所述第i连续字节组为N个字节的数据。
请参阅附图7，是本发明实施例提供的OpenFlow交换***。为了便于说明，仅仅示出了与本发明实施例相关的部分。附图7示例的OpenFlow交换***包括交换机702和控制器701，其中，交换机702可以是前述附图5示例的流表匹配的装置。交换机702主要包括第一接收模块501、第一建立模块502、第二接收模块503和第二建立模块504，各模块详细说明如下：
控制器701，用于向交换机702下发针对第一流表的跳转指令和匹配指令，以及向交换机702下发针对第二流表的流模式消息，所述匹配指令用于指示将匹配字段映射为映射值，并将所述映射值写入元数据Metadata域，传递给所 述第二流表，所述匹配指令中包含用于将所述匹配字段映射为所述映射值的参数，所述跳转指令用于指示跳转的第二流表，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值；
第一接收模块501，用于接收控制器针对第一流表下发的跳转指令和匹配指令；
第一建立模块502，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述跳转指令和所述匹配指令，其中，所述匹配指令用于交换机收到数据包后，根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，所述跳转指令用于跳转到所述第二流表，将所述数据包和所述元数据Metadata域中写入的所述映射值Mp传递给所述第二流表；
第二接收模块503，用于接收所述控制器701针对所述第二流表下发的流模式消息，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值；
第二建立模块504，用于在所述第二流表中建立第二流表项，所述第二流表项的指令集为所述行为指令，所述第二流表项的匹配域为所述元数据Metedata值，其中，所述第二流表项的匹配域用于与所述映射值Mp进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
在附图7示例的OpenFlow交换***中，匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数包括：掩码、所述匹配字段在所述匹配字段所属数据包的起始位置、所述匹配字段在所述匹配字段所属数据包的偏移字节数和所述匹配字段所属数据包所属数据流的流标识；而根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，包括：按照所述起始位置和所述偏移字节数定位所述匹配字段在所述收到的数据包的位置，提取所述匹配字段；将提取的所述匹配字段 与所述掩码进行逻辑“与”运算；将所述流标识填充至连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述连续字节组的余下字节，将所述被填充和复制完毕后的所述连续字节组的内容作为所述映射值Mp，所述连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数。
请参阅附图8，是本发明另一实施例提供的OpenFlow交换***。为了便于说明，仅仅示出了与本发明实施例相关的部分。附图8示例的OpenFlow交换***包括交换机802和控制器801，其中，交换机802可以是前述附图6示例的扩大流表匹配域匹配范围的装置。交换机802主要包括第三接收模块601、第三建立模块602、第四接收模块603、第四建立模块604、第五接收模块605和第五建立模块606，各模块详细说明如下：
控制器801，用于向交换机802下发针对第一流表的第一跳转指令和第一匹配指令，向交换机802下发针对n-1个流表的n-1个流模式消息，以及向交换机802下发针对最终流表的最终流模式消息，所述第一匹配指令用于指示将第一匹配字段映射为第一映射值，并将所述第一映射值写入元数据Metadata域，传递给第二流表，所述第一匹配指令中包含用于将所述第一匹配字段映射为所述第一映射值的参数，所述第一跳转指令用于指示跳转的第二流表，其中，需要匹配的字段包含Nb个字节，且Nb＝n*Nm，n为大于1的整数，Nm等于流表的元数据Metadata域可包含的最大字节数，所述第一匹配字段为所述需要匹配的字段中的第1字节至第Nm字节，所述针对第i个流表下发第i个流模式消息，n≥i≥2，所述第i个流模式消息中包含第i个跳转指令、第i个匹配指令和用于匹配第i个匹配字段的第i个元数据Metadata值，所述第i个匹配指令用于指示将所述第i个匹配字段映射为第i个映射值，所述第i个匹配字段为所述需要匹配的字段中的第(i-1)*Nm+1字节至第i*Nm个字节，所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数，所述第i 个跳转指令用于指示跳转的下一流表，所述第二流表为第2个流表，所述第i个流表的下一流表为第i+1个流表，所述第n个流表的下一流表为最终流表，所述最终流模式消息包含行为指令和用于匹配第n个匹配字段的第n个元数据Metadata值；
第三接收模块601，用于接收控制器801针对第一流表下发的所述第一跳转指令和第一匹配指令；
第三建立模块602，用于在第一流表中建立第一流表项，所述第一流表项的指令集为所述第一跳转指令和所述第一匹配指令，其中，所述第一匹配指令用于交换机收到数据包后，根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，并将所述第一映射值Mp1写入所述第一流表的的元数据Metadata域，所述第一跳转指令用于跳转到所述第二流表，将所述数据包和所述第一流表的的元数据Metadata域中写入的所述第一映射值Mp1传递给所述第二流表；
第四接收模块603，用于接收控制器801针对n-1个流表下发的所述n-1个流模式消息；
第四建立模块604，用于在所述n-1个流表中建立n-1个流表项，其中，在所述第i个流表中建立第i个流表项，所述第i个流表项的匹配域为所述第i个元数据Metedata值，所述第i个流表项的指令集为所述第i个跳转指令和所述第i个匹配指令，所述第i个流表项的匹配域用于与第i-1个映射值Mpi-1进行匹配，并根据匹配结果，执行所述第i个跳转指令和所述第i个匹配指令，所述第一映射值Mp1为第1个映射值Mp1，所述第i个匹配指令用于根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，并将所述第i个映射值Mpi写入所述第i个流表的元数据Metadata域，所述第i个跳转指令用于跳转到所述第i个 流表的下一流表，将所述数据包和所述第i个流表的元数据Metadata域中写入的所述第i个映射值Mpi传递给所述第i个流表的下一流表；
第五接收模块605，用于接收控制器801针对所述最终流表下发的所述最终流模式消息；
第五建立模块606，用于在所述最终流表中建立最终流表项，所述最终流表项的指令集为所述行为指令，所述最终流表项的匹配域为所述第n个元数据Metedata值，其中，所述最终流表项的匹配域用于与所述第n个映射值Mpn进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
在附图8示例的OpenFlow交换***中，第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数包括：第一掩码、所述第一匹配字段在所述第一匹配字段所属数据包的第一起始位置、所述第一匹配字段在所述第一匹配字段所属数据包的第一偏移字节数和所述第一匹配字段所属数据包所属数据流的第一流标识，则所述根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，包括：按照所述第一起始位置和所述第一偏移字节数定位所述第一匹配字段在所述收到的数据包的位置，提取所述第一匹配字段；将提取的所述第一匹配字段与所述第一掩码进行逻辑“与”运算；将所述第一流标识填充至第一连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第一连续字节组的余下字节，将所述被填充和复制完毕后的所述第一连续字节组的内容作为所述第一映射值Mp1，所述第一连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数。
第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数包括：第i掩码、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i起始位置、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i偏 移字节数和所述第i个匹配字段所属数据包所属数据流的第i流标识，则所述根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，包括：按照所述第i起始位置和所述第i偏移字节数定位所述第i个一匹配字段在所述收到的数据包的位置，提取所述第i个匹配字段；将提取的所述第i个匹配字段与所述第i掩码进行逻辑“与”运算；将所述第i流标识填充至第i连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第i连续字节组的余下字节，将所述被填充和复制完毕后的所述第i连续字节组的内容作为所述第i个映射值Mpi，所述第i连续字节组为N个字节的数据。
需要说明的是，上述装置各模块/单元之间的信息交互、执行过程等内容，由于与本发明方法实施例基于同一构思，其带来的技术效果与本发明方法实施例相同，具体内容可参见本发明方法实施例中的叙述，此处不再赘述。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：只读存储器(ROM，Read Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁盘或光盘等。
以上对本发明实施例所提供的流表匹配的方法、装置和OpenFlow交换***进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (12)

  1. 一种流表匹配的方法，其特征在于，所述方法包括：
    接收控制器针对第一流表下发的跳转指令和匹配指令，所述匹配指令用于指示将匹配字段映射为映射值，并将所述映射值写入元数据Metadata域，传递给第二流表，所述匹配指令中包含用于将所述匹配字段映射为所述映射值的参数，所述跳转指令用于指示跳转的第二流表；
    在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述跳转指令和所述匹配指令，其中，所述匹配指令用于交换机收到数据包后，根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，所述跳转指令用于跳转到所述第二流表，将所述数据包和所述元数据Metadata域中写入的所述映射值Mp传递给所述第二流表；
    接收所述控制器针对所述第二流表下发的流模式消息，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值；
    在所述第二流表中建立第二流表项，所述第二流表项的指令集为所述行为指令，所述第二流表项的匹配域为所述元数据Metedata值，其中，所述第二流表项的匹配域用于与所述映射值Mp进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
  2. 根据权利要求1所述的方法，其特征在于，所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数包括：掩码、所述匹配字段在所述匹配字段所属数据包的起始位置、所述匹配字段在所述匹配字段所属数据包的偏移字节数和所述匹配字段所属数据包所属数据流的流标识；
    所述根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，包括：
    按照所述起始位置和所述偏移字节数定位所述匹配字段在所述收到的数据包的位置，提取所述匹配字段；
    将提取的所述匹配字段与所述掩码进行逻辑“与”运算；
    将所述流标识填充至连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述连续字节组的余下字节，将所述被填充和复制完毕 后的所述连续字节组的内容作为所述映射值Mp，所述连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数。
  3. 一种流表匹配的方法，其特征在于，所述方法包括：
    接收控制器针对第一流表下发的第一跳转指令和第一匹配指令，所述第一匹配指令用于指示将第一匹配字段映射为第一映射值，并将所述第一映射值写入元数据Metadata域，传递给第二流表，所述第一匹配指令中包含用于将所述第一匹配字段映射为所述第一映射值的参数，所述第一跳转指令用于指示跳转的第二流表，其中，需要匹配的字段包含Nb个字节，且Nb＝n*Nm，n为大于1的整数，Nm等于流表的元数据Metadata域可包含的最大字节数，所述第一匹配字段为所述需要匹配的字段中的第1字节至第Nm字节；
    在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述第一跳转指令和所述第一匹配指令，其中，所述第一匹配指令用于交换机收到数据包后，根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，并将所述第一映射值Mp1写入所述第一流表的的元数据Metadata域，所述第一跳转指令用于跳转到所述第二流表，将所述数据包和所述第一流表的的元数据Metadata域中写入的所述第一映射值Mp1传递给所述第二流表；
    接收所述控制器针对n-1个流表下发的n-1个流模式消息，其中，针对第i个流表下发第i个流模式消息，n≥i≥2，所述第i个流模式消息中包含第i个跳转指令、第i个匹配指令和用于匹配第i个匹配字段的第i个元数据Metadata值，所述第i个匹配指令用于指示将所述第i个匹配字段映射为第i个映射值，所述第i个匹配字段为所述需要匹配的字段中的第(i-1)*Nm+1字节至第i*Nm个字节，所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数，所述第i个跳转指令用于指示跳转的下一流表，所述第二流表为第2个流表，所述第i个流表的下一流表为第i+1个流表，所述第n个流表的下一流表为最终流表；
    在所述n-1个流表中建立n-1个流表项，其中，在所述第i个流表中建立第i个流表项，所述第i个流表项的匹配域为所述第i个元数据Metedata值，所述第i个流表项的指令集为所述第i个跳转指令和所述第i个匹配指令，所述第i个流表项的匹配域用于与第i-1个映射值Mpi-1进行匹配，并 根据匹配结果，执行所述第i个跳转指令和所述第i个匹配指令，所述第一映射值Mp1为第1个映射值Mp1，所述第i个匹配指令用于根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，并将所述第i个映射值Mpi写入所述第i个流表的元数据Metadata域，所述第i个跳转指令用于跳转到所述第i个流表的下一流表，将所述数据包和所述第i个流表的元数据Metadata域中写入的所述第i个映射值Mpi传递给所述第i个流表的下一流表；
    接收所述控制器针对所述最终流表下发的最终流模式消息，所述最终流模式消息包含行为指令和用于匹配第n个匹配字段的第n个元数据Metadata值；
    在所述最终流表中建立最终流表项，所述最终流表项的指令集为所述行为指令，所述最终流表项的匹配域为所述第n个元数据Metedata值，其中，所述最终流表项的匹配域用于与所述第n个映射值Mpn进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
  4. 根据权利要求3所述的方法，其特征在于，所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数包括：第一掩码、所述第一匹配字段在所述第一匹配字段所属数据包的第一起始位置、所述第一匹配字段在所述第一匹配字段所属数据包的第一偏移字节数和所述第一匹配字段所属数据包所属数据流的第一流标识，则所述根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，包括：
    按照所述第一起始位置和所述第一偏移字节数定位所述第一匹配字段在所述收到的数据包的位置，提取所述第一匹配字段；
    将提取的所述第一匹配字段与所述第一掩码进行逻辑“与”运算；
    将所述第一流标识填充至第一连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第一连续字节组的余下字节，将所述被填充和复制完毕后的所述第一连续字节组的内容作为所述第一映射值Mp1，所述第一连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数；
    所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i 个映射值的参数包括：第i掩码、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i起始位置、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i偏移字节数和所述第i个匹配字段所属数据包所属数据流的第i流标识，则所述根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，包括：
    按照所述第i起始位置和所述第i偏移字节数定位所述第i个一匹配字段在所述收到的数据包的位置，提取所述第i个匹配字段；
    将提取的所述第i个匹配字段与所述第i掩码进行逻辑“与”运算；
    将所述第i流标识填充至第i连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第i连续字节组的余下字节，将所述被填充和复制完毕后的所述第i连续字节组的内容作为所述第i个映射值Mpi，所述第i连续字节组为N个字节的数据。
  5. 一种流表匹配的装置，其特征在于，所述装置包括：
    第一接收模块，用于接收控制器针对第一流表下发的跳转指令和匹配指令，所述匹配指令用于指示将匹配字段映射为映射值，并将所述映射值写入元数据Metadata域，传递给第二流表，所述匹配指令中包含用于将所述匹配字段映射为所述映射值的参数，所述跳转指令用于指示跳转的第二流表；
    第一建立模块，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述跳转指令和所述匹配指令，其中，所述匹配指令用于交换机收到数据包后，根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，所述跳转指令用于跳转到所述第二流表，将所述数据包和所述元数据Metadata域中写入的所述映射值Mp传递给所述第二流表；
    第二接收模块，用于接收所述控制器针对所述第二流表下发的流模式消息，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值；
    第二建立模块，用于在所述第二流表中建立第二流表项，所述第二流表项的指令集为所述行为指令，所述第二流表项的匹配域为所述元数据Metedata值，其中，所述第二流表项的匹配域用于与所述映射值Mp进行匹 配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
  6. 根据权利要求5所述的装置，其特征在于，所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数包括：掩码、所述匹配字段在所述匹配字段所属数据包的起始位置、所述匹配字段在所述匹配字段所属数据包的偏移字节数和所述匹配字段所属数据包所属数据流的流标识；
    所述根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，包括：按照所述起始位置和所述偏移字节数定位所述匹配字段在所述收到的数据包的位置，提取所述匹配字段；将提取的所述匹配字段与所述掩码进行逻辑“与”运算；将所述流标识填充至连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述连续字节组的余下字节，将所述被填充和复制完毕后的所述连续字节组的内容作为所述映射值Mp，所述连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数。
  7. 一种流表匹配的装置，其特征在于，所述装置包括：
    第三接收模块，用于接收控制器针对第一流表下发的第一跳转指令和第一匹配指令，所述第一匹配指令用于指示将第一匹配字段映射为第一映射值，并将所述第一映射值写入元数据Metadata域，传递给第二流表，所述第一匹配指令中包含用于将所述第一匹配字段映射为所述第一映射值的参数，所述第一跳转指令用于指示跳转的第二流表，其中，需要匹配的字段包含Nb个字节，且Nb＝n*Nm，n为大于1的整数，Nm等于流表的元数据Metadata域可包含的最大字节数，所述第一匹配字段为所述需要匹配的字段中的第1字节至第Nm字节；
    第三建立模块，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述第一跳转指令和所述第一匹配指令，其中，所述第一匹配指令用于交换机收到数据包后，根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，并将所述第一映射值Mp1写入所述第一流表的的元数据Metadata域，所述第一跳转指令用于跳转到所述第二流表，将所述数据包和所述第一流表的的元数据Metadata域中写入的所述第一映射值Mp1传递给所述第二流表；
    第四接收模块，用于接收所述控制器针对n-1个流表下发的n-1个流模 式消息，其中，针对第i个流表下发第i个流模式消息，n≥i≥2，所述第i个流模式消息中包含第i个跳转指令、第i个匹配指令和用于匹配第i个匹配字段的第i个元数据Metadata值，所述第i个匹配指令用于指示将所述第i个匹配字段映射为第i个映射值，所述第i个匹配字段为所述需要匹配的字段中的第(i-1)*Nm+1字节至第i*Nm个字节，所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数，所述第i个跳转指令用于指示跳转的下一流表，所述第二流表为第2个流表，所述第i个流表的下一流表为第i+1个流表，所述第n个流表的下一流表为最终流表；
    第四建立模块，用于在所述n-1个流表中建立n-1个流表项，其中，在所述第i个流表中建立第i个流表项，所述第i个流表项的匹配域为所述第i个元数据Metedata值，所述第i个流表项的指令集为所述第i个跳转指令和所述第i个匹配指令，所述第i个流表项的匹配域用于与第i-1个映射值Mpi-1进行匹配，并根据匹配结果，执行所述第i个跳转指令和所述第i个匹配指令，所述第一映射值Mp1为第1个映射值Mp1，所述第i个匹配指令用于根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，并将所述第i个映射值Mpi写入所述第i个流表的元数据Metadata域，所述第i个跳转指令用于跳转到所述第i个流表的下一流表，将所述数据包和所述第i个流表的元数据Metadata域中写入的所述第i个映射值Mpi传递给所述第i个流表的下一流表；
    第五接收模块，用于接收所述控制器针对所述最终流表下发的最终流模式消息，所述最终流模式消息包含行为指令和用于匹配第n个匹配字段的第n个元数据Metadata值；
    第五建立模块，用于在所述最终流表中建立最终流表项，所述最终流表项的指令集为所述行为指令，所述最终流表项的匹配域为所述第n个元数据Metedata值，其中，所述最终流表项的匹配域用于与所述第n个映射值Mpn进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
  8. 根据权利要求7所述的装置，其特征在于，所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数包括：第一掩码、所述第一匹配字段在所述第一匹配字段所属数据包的第一起始位置、所述第一匹配字段在所述第一匹配字段所属数据包的第一偏移字节数和所述 第一匹配字段所属数据包所属数据流的第一流标识，则所述根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，包括：
    按照所述第一起始位置和所述第一偏移字节数定位所述第一匹配字段在所述收到的数据包的位置，提取所述第一匹配字段；
    将提取的所述第一匹配字段与所述第一掩码进行逻辑“与”运算；
    将所述第一流标识填充至第一连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第一连续字节组的余下字节，将所述被填充和复制完毕后的所述第一连续字节组的内容作为所述第一映射值Mp1，所述第一连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数；
    所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数包括：第i掩码、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i起始位置、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i偏移字节数和所述第i个匹配字段所属数据包所属数据流的第i流标识，则所述根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，包括：
    按照所述第i起始位置和所述第i偏移字节数定位所述第i个一匹配字段在所述收到的数据包的位置，提取所述第i个匹配字段；
    将提取的所述第i个匹配字段与所述第i掩码进行逻辑“与”运算；
    将所述第i流标识填充至第i连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第i连续字节组的余下字节，将所述被填充和复制完毕后的所述第i连续字节组的内容作为所述第i个映射值Mpi，所述第i连续字节组为N个字节的数据。
  9. 一种OpenFlow交换***，其特征在于，所述***包括交换机和控制器，所述交换机包括第一接收模块、第一建立模块、第二接收模块和第二建立模块；
    所述控制器，用于向所述交换机下发针对第一流表的跳转指令和匹配指令，以及向所述交换机下发针对第二流表的流模式消息，所述匹配指令用于指示将匹配字段映射为映射值，并将所述映射值写入元数据Metadata域， 传递给所述第二流表，所述匹配指令中包含用于将所述匹配字段映射为所述映射值的参数，所述跳转指令用于指示跳转的第二流表，所述流模式消息包含行为指令和用于匹配所述匹配字段的元数据Metadata值；
    所述第一接收模块，用于所述接收控制器针对第一流表下发的所述跳转指令和匹配指令；
    所述第一建立模块，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述跳转指令和所述匹配指令，其中，所述匹配指令用于交换机收到数据包后，根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，并将所述映射值Mp写入元数据Metadata域，所述跳转指令用于跳转到所述第二流表，将所述数据包和所述元数据Metadata域中写入的所述映射值Mp传递给所述第二流表；
    所述第二接收模块，用于接收所述控制器针对所述第二流表下发的所述流模式消息；
    所述第二建立模块，用于在所述第二流表中建立第二流表项，所述第二流表项的指令集为所述行为指令，所述第二流表项的匹配域为所述元数据Metedata值，其中，所述第二流表项的匹配域用于与所述映射值Mp进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
  10. 根据权利要求9所述的交换***，其特征在于，所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数包括：掩码、所述匹配字段在所述匹配字段所属数据包的起始位置、所述匹配字段在所述匹配字段所属数据包的偏移字节数和所述匹配字段所属数据包所属数据流的流标识；
    所述根据所述匹配指令中包含的用于将所述匹配字段映射为所述映射值的参数，将所述匹配字段映射为映射值Mp，包括：按照所述起始位置和所述偏移字节数定位所述匹配字段在所述收到的数据包的位置，提取所述匹配字段；将提取的所述匹配字段与所述掩码进行逻辑“与”运算；将所述流标识填充至连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述连续字节组的余下字节，将所述被填充和复制完毕后的所述连续字节组的内容作为所述映射值Mp，所述连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数。
  11. 一种OpenFlow交换***，其特征在于，所述***包括交换机和控 制器，所述交换机包括第三接收模块、第三建立模块、第四接收模块、第四建立模块、第五接收模块和第五建立模块；
    所述控制器，用于向所述交换机下发针对第一流表的第一跳转指令和第一匹配指令，向所述交换机下发针对n-1个流表的n-1个流模式消息，以及向所述交换机下发针对最终流表的最终流模式消息，所述第一匹配指令用于指示将第一匹配字段映射为第一映射值，并将所述第一映射值写入元数据Metadata域，传递给第二流表，所述第一匹配指令中包含用于将所述第一匹配字段映射为所述第一映射值的参数，所述第一跳转指令用于指示跳转的第二流表，其中，需要匹配的字段包含Nb个字节，且Nb＝n*Nm，n为大于1的整数，Nm等于流表的元数据Metadata域可包含的最大字节数，所述第一匹配字段为所述需要匹配的字段中的第1字节至第Nm字节，所述针对第i个流表下发第i个流模式消息，n≥i≥2，所述第i个流模式消息中包含第i个跳转指令、第i个匹配指令和用于匹配第i个匹配字段的第i个元数据Metadata值，所述第i个匹配指令用于指示将所述第i个匹配字段映射为第i个映射值，所述第i个匹配字段为所述需要匹配的字段中的第(i-1)*Nm+1字节至第i*Nm个字节，所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数，所述第i个跳转指令用于指示跳转的下一流表，所述第二流表为第2个流表，所述第i个流表的下一流表为第i+1个流表，所述第n个流表的下一流表为最终流表，所述最终流模式消息包含行为指令和用于匹配第n个匹配字段的第n个元数据Metadata值；
    所述第三接收模块，用于接收所述控制器针对第一流表下发的所述第一跳转指令和第一匹配指令；
    所述第三建立模块，用于在所述第一流表中建立第一流表项，所述第一流表项的指令集为所述第一跳转指令和所述第一匹配指令，其中，所述第一匹配指令用于交换机收到数据包后，根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，并将所述第一映射值Mp1写入所述第一流表的的元数据Metadata域，所述第一跳转指令用于跳转到所述第二流表，将所述数据包和所述第一流表的的元数据Metadata域中写入的所述第一映射值Mp1传递给所述第二流表；
    所述第四接收模块，用于接收所述控制器针对n-1个流表下发的所述n-1 个流模式消息；
    所述第四建立模块，用于在所述n-1个流表中建立n-1个流表项，其中，在所述第i个流表中建立第i个流表项，所述第i个流表项的匹配域为所述第i个元数据Metedata值，所述第i个流表项的指令集为所述第i个跳转指令和所述第i个匹配指令，所述第i个流表项的匹配域用于与第i-1个映射值Mpi-1进行匹配，并根据匹配结果，执行所述第i个跳转指令和所述第i个匹配指令，所述第一映射值Mp1为第1个映射值Mp1，所述第i个匹配指令用于根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，并将所述第i个映射值Mpi写入所述第i个流表的元数据Metadata域，所述第i个跳转指令用于跳转到所述第i个流表的下一流表，将所述数据包和所述第i个流表的元数据Metadata域中写入的所述第i个映射值Mpi传递给所述第i个流表的下一流表；
    所述第五接收模块，用于接收所述控制器针对所述最终流表下发的所述最终流模式消息；
    所述第五建立模块，用于在所述最终流表中建立最终流表项，所述最终流表项的指令集为所述行为指令，所述最终流表项的匹配域为所述第n个元数据Metedata值，其中，所述最终流表项的匹配域用于与所述第n个映射值Mpn进行匹配，所述行为指令用于根据匹配结果，对所述数据包进行处理。
  12. 根据权利要求11所述的交换***，其特征在于，所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数包括：第一掩码、所述第一匹配字段在所述第一匹配字段所属数据包的第一起始位置、所述第一匹配字段在所述第一匹配字段所属数据包的第一偏移字节数和所述第一匹配字段所属数据包所属数据流的第一流标识，则所述根据所述第一匹配指令中包含的用于将所述第一匹配字段映射为所述第一映射值的参数，将所述第一匹配字段映射为第一映射值Mp1，包括：
    按照所述第一起始位置和所述第一偏移字节数定位所述第一匹配字段在所述收到的数据包的位置，提取所述第一匹配字段；
    将提取的所述第一匹配字段与所述第一掩码进行逻辑“与”运算；
    将所述第一流标识填充至第一连续字节组的首字节以及将所述逻辑 “与”运算的运算结果依次复制至所述第一连续字节组的余下字节，将所述被填充和复制完毕后的所述第一连续字节组的内容作为所述第一映射值Mp1，所述第一连续字节组为N个字节的数据，N为流表的元数据Metadata域可包含的最大字节数；
    所述第i个匹配指令中包含用于将所述第i个匹配字段映射为所述第i个映射值的参数包括：第i掩码、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i起始位置、所述第i个匹配字段在所述第i个匹配字段所属数据包的第i偏移字节数和所述第i个匹配字段所属数据包所属数据流的第i流标识，则所述根据所述第i个匹配指令中包含的用于将所述第i个匹配字段映射为所述第i个映射值的参数，将所述第i个匹配字段映射为第i个映射值Mpi，包括：
    按照所述第i起始位置和所述第i偏移字节数定位所述第i个一匹配字段在所述收到的数据包的位置，提取所述第i个匹配字段；
    将提取的所述第i个匹配字段与所述第i掩码进行逻辑“与”运算；
    将所述第i流标识填充至第i连续字节组的首字节以及将所述逻辑“与”运算的运算结果依次复制至所述第i连续字节组的余下字节，将所述被填充和复制完毕后的所述第i连续字节组的内容作为所述第i个映射值Mpi，所述第i连续字节组为N个字节的数据。
PCT/CN2014/092170 2013-12-30 2014-11-25 一种流表匹配的方法、装置和OpenFlow交换*** WO2015101119A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/198,268 US9887912B2 (en) 2013-12-30 2016-06-30 Flow table matching method and apparatus, and openflow switching system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310749898.8 2013-12-30
CN201310749898.8A CN104753885B (zh) 2013-12-30 2013-12-30 一种流表匹配的方法、装置和OpenFlow交换***

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/198,268 Continuation US9887912B2 (en) 2013-12-30 2016-06-30 Flow table matching method and apparatus, and openflow switching system

Publications (1)

Publication Number Publication Date
WO2015101119A1 true WO2015101119A1 (zh) 2015-07-09

Family

ID=53493157

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/092170 WO2015101119A1 (zh) 2013-12-30 2014-11-25 一种流表匹配的方法、装置和OpenFlow交换***

Country Status (3)

Country Link
US (1) US9887912B2 (zh)
CN (1) CN104753885B (zh)
WO (1) WO2015101119A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105897587A (zh) * 2016-03-31 2016-08-24 湖南大学 一种数据包分类方法
EP3349402A4 (en) * 2015-09-30 2018-09-26 Huawei Technologies Co., Ltd. Message processing method and device

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016131422A1 (en) * 2015-02-17 2016-08-25 Hangzhou H3C Technologies Co., Ltd. Flow entry generating and packet processing based on flow entry
US10003498B2 (en) 2015-06-29 2018-06-19 Ca, Inc. Efficient management of network configuration-dependent network functionality
US10084657B2 (en) * 2015-06-29 2018-09-25 Ca, Inc. Normalized software-defined networking interface
CN106535274B (zh) * 2015-09-14 2019-12-06 ***通信集团公司 一种实现动态网络连接的方法及***
CN106878098A (zh) * 2015-12-10 2017-06-20 深圳市中兴微电子技术有限公司 数据报文的识别处理方法及装置
CN105763465B (zh) * 2016-01-29 2019-01-22 新华三技术有限公司 一种分布式组合流量控制方法及装置
CN106059921B (zh) * 2016-05-06 2019-02-12 中国科学技术大学 一种基于sdn技术和ccn框架的网络层的内容路由***及其工作方式
US10110469B2 (en) * 2016-07-21 2018-10-23 Cisco Technology, Inc. Detecting and preventing network loops
WO2019000434A1 (zh) * 2017-06-30 2019-01-03 华为技术有限公司 一种数据处理方法、网络接口卡及服务器
CN107645450B (zh) * 2017-10-11 2019-10-25 中国科学技术大学 基于协议无感知转发技术的流表虚拟化装置及方法
US10797946B2 (en) * 2018-03-29 2020-10-06 Adtran, Inc. Provisioning a network device
CN111050339B (zh) * 2019-12-19 2021-01-01 中国科学院信息工程研究所 一种基于协议无感知转发的高速数据更新***及方法
CN113254376B (zh) * 2021-06-09 2021-12-17 广州朗国电子科技股份有限公司 一种一体机兼容集控指令的处理方法、***、设备、存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103051539A (zh) * 2012-12-14 2013-04-17 中兴通讯股份有限公司 一种基于dht的控制网络实现方法、***和网络控制器
CN103281246A (zh) * 2013-05-20 2013-09-04 华为技术有限公司 报文处理方法及网络设备
CN103346922A (zh) * 2013-07-26 2013-10-09 电子科技大学 基于sdn的确定网络状态的控制器及其确定方法
CN103905303A (zh) * 2012-12-28 2014-07-02 ***通信集团公司 一种虚拟机vm跨网迁移后的数据处理方法、装置及***

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8930690B2 (en) * 2012-03-21 2015-01-06 Microsoft Corporation Offloading packet processing for networking device virtualization
CN103200101B (zh) * 2013-04-15 2015-12-23 昆山天元昌电子有限公司 基于交换芯片的openflow多表查询的方法及装置
CN103368851B (zh) * 2013-07-22 2016-03-23 武汉烽火网络有限责任公司 基于资源复用的Openflow流表存储优化方法
US20160197831A1 (en) * 2013-08-16 2016-07-07 Interdigital Patent Holdings, Inc. Method and apparatus for name resolution in software defined networking
US9602398B2 (en) * 2013-09-15 2017-03-21 Nicira, Inc. Dynamically generating flows with wildcard fields
US9686185B2 (en) * 2013-09-15 2017-06-20 Nicira, Inc. Generating flows using common match techniques
CN104468357B (zh) * 2013-09-16 2019-07-12 中兴通讯股份有限公司 流表的多级化方法、多级流表处理方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103051539A (zh) * 2012-12-14 2013-04-17 中兴通讯股份有限公司 一种基于dht的控制网络实现方法、***和网络控制器
CN103905303A (zh) * 2012-12-28 2014-07-02 ***通信集团公司 一种虚拟机vm跨网迁移后的数据处理方法、装置及***
CN103281246A (zh) * 2013-05-20 2013-09-04 华为技术有限公司 报文处理方法及网络设备
CN103346922A (zh) * 2013-07-26 2013-10-09 电子科技大学 基于sdn的确定网络状态的控制器及其确定方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3349402A4 (en) * 2015-09-30 2018-09-26 Huawei Technologies Co., Ltd. Message processing method and device
US10630584B2 (en) 2015-09-30 2020-04-21 Huawei Technologies Co., Ltd. Packet processing method and apparatus
US11184281B2 (en) 2015-09-30 2021-11-23 Huawei Technologies Co., Ltd. Packet processing method and apparatus
CN105897587A (zh) * 2016-03-31 2016-08-24 湖南大学 一种数据包分类方法
CN105897587B (zh) * 2016-03-31 2018-11-09 湖南大学 一种数据包分类方法

Also Published As

Publication number Publication date
CN104753885B (zh) 2018-06-26
US20160308759A1 (en) 2016-10-20
US9887912B2 (en) 2018-02-06
CN104753885A (zh) 2015-07-01

Similar Documents

Publication Publication Date Title
WO2015101119A1 (zh) 一种流表匹配的方法、装置和OpenFlow交换***
US9553845B1 (en) Methods for validating and testing firewalls and devices thereof
US20160301603A1 (en) Integrated routing method based on software-defined network and system thereof
US20170048312A1 (en) Sdn-based mirroring of traffic flows for in-band network analytics
US9590922B2 (en) Programmable and high performance switch for data center networks
US10257091B2 (en) Pipeline table identification
US10164908B2 (en) Filtration of network traffic using virtually-extended ternary content-addressable memory (TCAM)
EP3844911B1 (en) Systems and methods for generating network flow information
US20170171080A1 (en) System and Method to Analyze Congestion in Low Latency Network
US10187286B2 (en) Method and system for tracking network device information in a network switch
WO2014112616A1 (ja) 制御装置、通信装置、通信システム、スイッチの制御方法及びプログラム
JP2016522627A (ja) パケット処理方法および装置
CN109547288B (zh) 一种协议无关转发网络可编程流测量方法
CN105939284B (zh) 报文控制策略的匹配方法及装置
JP6007972B2 (ja) 通信ノード、パケット処理方法及びプログラム
US20220070091A1 (en) Open fronthaul network system
JP5900352B2 (ja) パケット処理装置、パケット処理方法およびプログラム
RU2602333C2 (ru) Сетевая система, способ обработки пакетов и носитель записи
EP3510535A1 (en) Techniques for policy-controlled analytic data collection in large-scale systems
EP3461083B1 (en) Data processing method and device
CN106230902B (zh) 一种模块化家庭云***及其控制方法
JP2007228217A (ja) トラフィック判定装置、トラフィック判定方法、及びそのプログラム
EP3057265B1 (en) An interface between a network entity and a virtual network function within a software-defined Network
Ahmad et al. Protection of centralized SDN control plane from high-rate Packet-In messages
KR101707073B1 (ko) Sdn 기반의 에러 탐색 네트워크 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14876025

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14876025

Country of ref document: EP

Kind code of ref document: A1