WO2017041737A1 - 报文处理 - Google Patents

报文处理 Download PDF

Info

Publication number
WO2017041737A1
WO2017041737A1 PCT/CN2016/098523 CN2016098523W WO2017041737A1 WO 2017041737 A1 WO2017041737 A1 WO 2017041737A1 CN 2016098523 W CN2016098523 W CN 2016098523W WO 2017041737 A1 WO2017041737 A1 WO 2017041737A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
hash
entry
matching
module
Prior art date
Application number
PCT/CN2016/098523
Other languages
English (en)
French (fr)
Inventor
赵云峰
李佳
Original Assignee
杭州华三通信技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州华三通信技术有限公司 filed Critical 杭州华三通信技术有限公司
Priority to EP16843675.6A priority Critical patent/EP3349403B1/en
Priority to US15/756,523 priority patent/US10659361B2/en
Priority to JP2018512600A priority patent/JP6498356B2/ja
Publication of WO2017041737A1 publication Critical patent/WO2017041737A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H04L45/7453—Address table lookup; Address filtering using hashing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/324—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the data link layer [OSI layer 2], e.g. HDLC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/325—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the network layer [OSI layer 3], e.g. X.25

Definitions

  • the network device needs to perform various types of operations on the packet according to the configuration information of the interface or the packet type to achieve forwarding or service processing. For example, Layer 2 forwarding, Layer 3 forwarding, unicast forwarding, multicast forwarding, and ACL (Access Control List) matching service processing.
  • Layer 2 forwarding Layer 3 forwarding
  • unicast forwarding Layer 3 forwarding
  • multicast forwarding Layer 3 forwarding
  • ACL Access Control List
  • FIG. 1 is a flowchart of a packet processing method according to an embodiment of the present application.
  • FIG. 2 is a flowchart of a packet processing method according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a hash table and a result table according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a message processing apparatus according to an embodiment of the present application.
  • FIG. 5 is another schematic structural diagram of a message processing apparatus according to an embodiment of the present application.
  • FIG. 6 is still another schematic structural diagram of a message processing apparatus according to an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a hardware architecture of a message processing apparatus according to an embodiment of the present application.
  • the following embodiments of the present application provide a message processing method, and a message processing apparatus to which the method can be applied.
  • the following embodiments of the present application can be applied to a network device that needs to process a packet by searching for a hash.
  • the Hash index table has two forms.
  • the hash index table is a hash table, and the hash table includes a valid identifier, an operation type, and a processing manner.
  • the structure of the hash table is as shown in Table 1.
  • Valid is a valid identifier, which is used to indicate whether the corresponding entry is valid.
  • Type is an operation type, which can be Layer 2 forwarding, Layer 3 IPv4 forwarding, Layer 3 IPv6 forwarding, multicast forwarding, and ACL matching services.
  • the processing information is the processing mode of the packets matching the hash entries.
  • the processing mode can include the following: sending the packets to the control plane to create Hash entries, sending them to the control plane for ARP learning, and discarding the packets.
  • the processing mode of the packet is stored in the Hash table of the Hash table.
  • the hash index table includes a hash table and a result table.
  • the hash table includes at least a valid identifier and a result table pointer, and the hash table may further include an operation type, as shown in Table 2 or 3.
  • Valid is a valid identifier, which is used to indicate whether the corresponding entry is valid.
  • Type is an operation type, which can be Layer 2 forwarding, Layer 3 IPv4 forwarding, Layer 3 IPv6 forwarding, multicast forwarding, and ACL matching services.
  • the processing information is a result table pointer, and the hash table item in the hash table is mapped to the result table item in the result table by using the result table pointer, and the result table pointer can be mapped to a result table item, or can be mapped to multiple result tables.
  • Item the result table is shown in Table 4.
  • the processing mode is the processing performed on the packets matching the result entry.
  • the processing mode can include the following: sending a packet to the control plane to create a hash entry, discarding the packet, and so on.
  • the result table may not be set; when the content of the processing method is large and cannot be stored in the hash table, the hash table and the result may be used.
  • the processing mode is stored in the result table, and the mapping between the hash table and the result table is established by the result table pointer.
  • a key may also be included in the hash table and/or the result table in the embodiment of the present application.
  • Key is a key value, and the Keys corresponding to different Types are different.
  • the Key when the Type is Layer 2 forwarding, the Key includes: a destination MAC (Media Access Control) address, a source MAC address, and a VPN (Virtual Private Network) ID (Identity, ID); when the Type is a Layer 3 IPv4 forwarding
  • the Key includes: the destination IP (Internet Protocol) address, the source IP address, and the VPN ID.
  • the Type is Layer 3 IPv6 forwarding
  • the Key includes: the destination IP address, the source IP address, the VPN ID, and the Layer 3 protocol number.
  • the Key When the Type is multicast forwarding, the Key includes: the destination IP address, the source IP address, the VPN ID, and the destination port number.
  • the Type When the Type is an ACL (Access Control List) matching service, the Key includes: an ACL matching. All key values required. Obviously, the above is only an example of a Key that needs to be extracted for different Types, which is not limited in this application.
  • Type and Key can be used to resolve hash conflicts. Assume that multiple hash index entries are stored in the Hash index table. The calculation result obtained by performing Hash calculation on the key value extracted from one message is a, and the calculation result obtained by performing Hash calculation on the key value extracted from another message is also a, and Hash occurs at this time. Conflict, generated based on these two messages Hash index entries are saved in the memory space where the hash entry is a. Determine which packet matches the Hash index entry by Type and Key.
  • the hash index table is a hash table and is a linked list
  • the hash result obtained by hashing the key values extracted by one packet is a, and a corresponds to multiple hash entries.
  • it is also a kind of hash conflict, and a Hash entry is matched from multiple hash index entries by Type and Key.
  • the Hash index table includes the Hash table and the result table, similar to the above process, only when the Hash table entry in the Hash table is matched, the result table pointer points to the result table query processing mode, and the description is not expanded.
  • the placement of the Type and the Key can be adjusted according to different requirements of the Hash index table configuration. For example, the Type is placed in the Hash table, the Key is placed in the result table, the Type is placed in the Hash table and the result table, and the Key is placed in the Hash table. Alternatively, the Type and Key are placed in the Hash table, and the Type is not placed in the result table. Key and so on.
  • FIG. 1 is a flowchart of a packet processing method according to an embodiment of the present application. As shown in FIG. 1, the packet processing method in the embodiment of the present application includes the following steps.
  • Step S102 After receiving the message, identify the type of operation that the message needs to be performed.
  • the related configuration information on the inbound interface of the packet can be obtained from the interface table.
  • the type of operation (Type) that the packet needs to be executed is identified.
  • the operation type may be Layer 2 forwarding, Layer 3 IPv4 forwarding, Layer 3 IPv6 forwarding, multicast forwarding, and ACL matching services.
  • the type corresponding to the value of the Type is pre-configured by the user in the Hash index table and/or the result table. For example, the value of the Type corresponding to the Layer 2 forwarding is 01, and the value of the Type corresponding to the Layer 3 IPv4 forwarding is 02. Wait.
  • the ACL matching service is used as an example.
  • an interface is configured with at least one ACL.
  • the at least one ACL rule is divided into at least one ACL matching service subclass according to a preset classification rule.
  • the at least one ACL matching service subclass may be a Layer 2 ACL matching service subclass, a Layer 3 IPv4 ACL matching service subclass, and a Layer 3 IPv6 ACL matching service subclass. Then, the mapping between the interface and the at least one ACL matching service subclass is configured into the interface table.
  • step S102 after receiving the message, the at least one ACL matching service subclass corresponding to the inbound interface of the packet is searched from the interface table, and the at least one ACL matching service subclass is found.
  • the ACL matching service subclass matching the packet is determined as the type of operation that the packet needs to perform. For example, if the packet is a Layer 2 packet, the ACL matching service subclass matching the packet is a Layer 2 ACL matching service subclass; if the packet is a Layer 3 packet, and the packet is IPv4, If the packet is a Layer 3 IPv4 ACL matching service subclass, the packet is determined to be a Layer 3 IPv4 ACL matching service subclass. If the packet is a Layer 3 packet and the packet is an IPv6 packet, the packet is determined.
  • the matched ACL matching service subclass is a Layer 3 IPv6 ACL matching service subclass.
  • Step S104 Extract a plurality of key values (Key) from the message according to the identified operation type.
  • the destination MAC address, the source MAC address, and the VPN ID of the packet are extracted.
  • the destination IP address, source IP address, VPN ID, and Layer 3 protocol number of the packet are extracted.
  • the operation type is an ACL matching service
  • the key values required for ACL matching are extracted.
  • step S106 a hash calculation is performed on the extracted key values.
  • the extracted key values are hashed according to a specific algorithm
  • the specific algorithm may be, for example, an exclusive OR algorithm, a CRC (Cyclic Redundancy Check) algorithm, or the like.
  • step S108 the result of the calculation in step S106 is used as a hash entry, and at least one hash index entry is found from the hash index table on the device.
  • At least one hash entry is found in step S108, and when the hash index table is a hash table, the searched hash entry includes a processing mode; when the hash index table includes a hash table and In the result table, at this time, the Hash table and/or the result table include the Type, and the searched Hash table includes the result table pointer.
  • Step S110 Match the identified operation type with the at least one Hash index entry.
  • step S112 it is determined whether a Hash index entry is hit. If yes, step S114 is performed; otherwise, step S116 is performed.
  • Step S114 processing the packet according to the hit Hash index entry.
  • the hash table when the hash index table is a hash table, the hash table includes a Type as shown in Table 1.
  • the identified operation type and the found at least one hash entry are The matching is performed; in step S114, if a hash entry is hit, the packet is processed according to the processing manner included in the hit hash entry.
  • the hash index table includes a hash table and a result table
  • the hash table does not include a Type as shown in Table 2
  • the result table includes a Type as shown in Table 4
  • an index table is included according to the result table pointer included in the hash table item, and the corresponding result table is found, and then the found result table is found according to the identified operation type. If the result item is hit, in step S114, if a result item is hit, the message is processed according to the processing mode included in the result table item of the hit.
  • the hash index table includes a hash table and a result table
  • the hash table includes a Type as shown in Table 3
  • the result table includes a Type as shown in Table 4
  • the operation type matches the found at least one Hash entry. If a Hash entry is hit, the result table pointer included in the hit Hash entry is indexed, and the corresponding result table is found, and then, according to the identification
  • the operation type matches the result table item in the found result table; in step S114, if a result item is hit, the message is processed according to the processing manner included in the hit result item.
  • Step S116 performing corresponding operations on the packet according to the identified operation type. For example, the packet is discarded, or the packet is sent to the control plane to establish a hash index entry according to the packet.
  • the default processing mode is set for each operation type.
  • the default processing mode is determined according to the identified operation type, and processed according to the default processing mode.
  • the default processing mode may include sending the packet to the control plane to create a new hash index entry, discarding the packet, and the like.
  • the process of establishing a hash index entry according to the packet in step S116 is as follows: the calculation result obtained by performing hash calculation on the key value extracted from the packet is used as a hash entry, and the hash table is in the hash table. Add a hash entry.
  • the hash index table is a hash table as shown in Table 1
  • the added hash table includes: Valid, Type, and processing information, wherein the processing information is set to be processed.
  • the hash index table includes: a hash table as shown in Table 2 and a result table as shown in Table 4
  • the added hash table includes: Valid And processing information, wherein the processing information is set as a result table pointer.
  • the Hash index table includes: a hash table as shown in Table 3 and a result table as shown in Table 4
  • the added hash table includes: Valid, Type, and processing information, wherein the processing information is set as a result table pointer.
  • the operation type Type is introduced in the Hash index table, and multiple Hash index tables corresponding to different operation types can be integrated into one Hash index table of the operation type, thereby avoiding different operation types.
  • each Hash table needs to allocate a corresponding memory space for all data streams that can be processed by the device to store corresponding Hash entries.
  • the network device needs to be configured for each Hash table. Allocate enough memory space Sum for storing Hash entries corresponding to all data streams.
  • the Hash index table provided by the embodiment of the present invention occupies only one Sum memory space, so that different operation types multiplex the same memory space Sum, thereby saving the table space resources.
  • the operation type is introduced in the Hash index table, so that only the key value Key corresponding to the operation type can be recorded in each Hash index table item, thereby further saving the table space resource.
  • FIG. 2 is a flowchart of a message processing method according to an embodiment of the present application.
  • the hash index table includes a hash table and a result table, and the hash table adopts a hash entry corresponding to a hash entry, and the hash table includes Valid, Type, Key, and result table pointers, and the result table is included in the result table. Includes Valid, Type, and processing.
  • S1 Receives a packet and obtains configuration information configured on the inbound interface of the packet. For example, Layer 2 forwarding is configured on the inbound interface. The value of the corresponding Type is 01.
  • S3 Perform a hash calculation based on the extracted key to obtain a hash entry, and obtain a hash entry corresponding to the hash entry.
  • the hash table and result table involved in this example As shown in Figure 3.
  • S5 The default processing mode is executed, that is, the packet is discarded.
  • S6 Find a result table according to the result table pointer 1 of the hash entry, and obtain a corresponding result table entry.
  • S7 Match the Type of the corresponding result entry according to the Type of the packet. If it matches, S8 is executed, and if it does not match, S5 is executed.
  • S8 Processing the packet according to the processing manner in the result entry, for example, sending the packet to the control plane for ARP learning.
  • the type stores different hash index tables, which saves the entry space of the packet processing device and improves the forwarding performance of the packet processing device.
  • the embodiment of the present application further provides a packet processing apparatus that can apply the foregoing method, and the apparatus can be applied to a network device that needs to process a packet by searching a hash table.
  • the message processing apparatus includes the following modules: a receiving module 201, an identification computing module 202, an entry search module 203, a matching module 204, and a message processing module 205.
  • the receiving module 201 is configured to receive a message.
  • the identification calculation module 202 is configured to identify the type of operation that the message needs to be performed after the receiving module 201 receives the message, extract key values from the message, and perform a hash calculation.
  • the entry lookup module 203 is configured to use the calculation result of the recognition calculation module 202 as a hash entry to find at least one Hash index entry from the Hash index table on the device.
  • the matching module 204 is configured to check the operation type and the entry identified by the recognition calculation module 202.
  • the at least one Hash index entry found by the module 203 is matched.
  • the message processing module 205 is configured to: if the matching module 204 hits a hash index entry, process the packet received by the receiving module 201 according to the hit hash index entry.
  • the matching module 204 is configured to: match the operation type identified by the recognition calculation module 202 with at least one hash entry found by the entry search module 203; the packet processing module 205 is specifically configured. It is used to: if the matching module 204 hits a hash entry, the packet received by the receiving module 201 is processed according to the processing manner included in the hit hash entry.
  • the matching module 204 includes: a search unit and a result table item matching unit.
  • the search unit is configured to perform indexing on the hash table item that is found by the entry search module 203, and perform indexing according to the result table pointer included in the hash entry to find a corresponding result table.
  • the result table matching unit is configured to match the result table item in the result table found by the searching unit according to the operation type recognized by the recognition calculation module 202.
  • the packet processing module 205 is specifically configured to: if the result entry matching unit hits a result entry, process the packet received by the receiving module 201 according to the processing manner included in the hit result entry.
  • the matching module 204 includes: a Hash entry matching unit, a search unit, and a result table matching unit.
  • the Hash entry matching unit is configured to match the operation type identified by the recognition calculation module 202 with at least one Hash entry found by the entry search module 203.
  • the locating unit is configured to perform indexing according to the result table pointer included in the hit Hash entry, and find the corresponding result table, if the Hash entry matching unit hits a Hash entry.
  • the result table matching unit is configured to match the result table item in the result table found by the searching unit according to the operation type recognized by the recognition calculation module 202.
  • the packet processing module 205 is specifically configured to: if the result entry matching unit hits a result entry, process the packet received by the receiving module 201 according to the processing manner included in the hit result entry.
  • the packet processing apparatus further includes: an adding module 206 and a packet discarding module 207.
  • the adding module 206 is configured to: when the matching module 204 does not hit any Hash index entry, determine the calculation result of the computing module 202 as a Hash entry when determining that the Hash index entry needs to be established according to the packet received by the receiving module 201.
  • a Hash index entry including the operation type identified by the recognition calculation module 202 is added to the Hash index table.
  • the packet discarding module 207 is configured to discard the packet when the matching module 204 does not hit any of the hash index entries, and then determines that the packet received by the receiving module 201 needs to be discarded.
  • the message processing apparatus further includes: a partitioning module 208 and an interface table configuration module 209, wherein the identification computing module 202 includes a subclass searching unit and an operation type determining unit.
  • the partitioning module 208 is configured to divide the at least one ACL rule into at least one ACL matching service subclass according to a preset classification rule when at least one ACL rule is configured on the interface.
  • the interface table configuration module 209 is configured to configure the correspondence between the interface and the at least one ACL matching service subclass obtained by the dividing module 208 into the interface table.
  • the sub-class search unit is configured to: after the receiving module 201 receives the packet, find, by the interface table, at least one ACL matching service sub-category corresponding to the inbound interface of the packet.
  • the operation type determining unit is configured to determine, from the at least one ACL matching service sub-class found by the sub-class searching unit, an ACL matching service sub-class that matches the packet received by the receiving module 201 as an operation type to be performed by the packet. .
  • the at least one ACL matching service subclass includes: a Layer 2 ACL matching service subclass, a Layer 3 IPv4 ACL matching service subclass, and a Layer 3 IPv6 ACL matching service subclass.
  • the operation type determining unit is specifically used to:
  • the ACL matching service subclass matching the packet is determined to be a Layer 2 ACL matching service subclass.
  • the ACL matching service subclass matching the packet is a Layer 3 IPv4 ACL matching service subclass.
  • the ACL matching service subclass matching the packet is a Layer 3 IPv6 ACL matching service subclass.
  • the message processing apparatus of the embodiment of the present application may be a programmable device combining software and hardware, and FIG. 7 shows the hardware architecture of the message processing apparatus.
  • the message processing apparatus includes: a nonvolatile memory, a CPU (Central Processing Unit), a forwarding chip, and a memory; wherein:
  • the memory is used to store the instruction code.
  • the operations are mainly a receiving module, a recognition computing module, an entry search module, a matching module, a packet processing module, an adding module, a packet discarding module, and a partitioning.
  • the functions performed by the module and interface table configuration module are not detailed here.
  • a CPU configured to communicate with a forwarding chip to perform packet transmission and reception; to communicate with a memory, to read and execute the instruction code stored in the memory, to complete a receiving module, a recognition computing module, and a table in the message processing device;
  • Sexual memory communication reading/writing data in non-volatile memory, including hash tables, result tables, and interface tables.
  • the forwarding chip is used to connect to other network devices through the port on the chip, and is responsible for receiving and processing the packet. Specifically, the received packet is sent to the CPU for table lookup processing.
  • a non-volatile memory for storing various data, including: a hash table, a result table, and an interface table.
  • the operation type Type is introduced in the Hash index table according to the embodiment of the present invention, and multiple Hash index tables corresponding to different operation types can be integrated into one Hash index table of the operation type to avoid different operation types respectively.
  • Hash table In order to be able to process different data flows, each Hash table needs to allocate a corresponding memory space for all data streams that can be processed by the device to store corresponding Hash entries. Thus, the network device needs to be configured for each Hash table. Allocate enough memory space Sum for storing Hash entries corresponding to all data streams. In the embodiment of the present invention, the Hash index table occupies only one Sum memory space, so that different operation types multiplex the same memory space Sum, thereby saving the table space resources.
  • the operation type is introduced in the Hash index table, so that only the key value Key corresponding to the operation type can be recorded in each Hash index table item, thereby further saving the table space resource.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

在接收到报文之后，识别该报文需要执行的操作类型，从该报文中提取关键值并进行Hash计算；以计算结果作为Hash入口，从本设备上的Hash索引表中查找到至少一个Hash索引表项；将识别出的操作类型与该至少一个Hash索引表项进行匹配；若命中一个Hash索引表项，则根据命中的Hash索引表项对该报文进行处理。

Description

报文处理
发明背景
在处理报文的过程中，网络设备需要根据接口的配置信息或报文类型等信息对报文执行各种类型的操作，以达到转发或业务处理等目的。例如，二层转发、三层转发、单播转发、组播转发、ACL(访问控制列表)匹配业务处理等。而且，一般情况下，针对同一报文时，不同类型的操作是互斥的。例如，当对一报文执行二层转发时，大多数情况下就不会再对该报文执行三层转发，当对一报文执行单播转发时，大多数情况下就不会再执行组播转发。
附图简要说明
图1是本申请实施例的报文处理方法的流程图。
图2是本申请实施例的报文处理方法的流程图。
图3是本申请实施例的Hash表和结果表的示意图。
图4是本申请实施例的报文处理装置的一种结构示意图。
图5是本申请实施例的报文处理装置的另一种结构示意图。
图6是本申请实施例的报文处理装置的又一种结构示意图。
图7是本申请实施例的报文处理装置的硬件架构示意图。
实施本发明的方式
本申请以下实施例中提供了一种报文处理方法，以及一种可以应用该方法的报文处理装置。
本申请以下实施例可以应用于需要通过查找Hash方式对报文进行处理的网络设备中。
为了描述方便，本文中引入了Hash索引表，Hash索引表有两种形式。一种情况是Hash索引表为Hash表，在该Hash表中包括有效标识、操作类型和处理方式，该Hash表结构如表1所示，
Valid Type 处理信息
表1
其中，Valid为有效标识，用于指示对应表项是否有效；
Type为操作类型，可以是二层转发、三层IPv4转发、三层IPv6转发、组播转发、ACL匹配业务等；
处理信息即为对匹配Hash表项的报文的处理方式，处理方式可以包含以下内容：将报文上送控制平面建立Hash表项，上送控制平面进行ARP学习，丢弃报文等。此时，直接将需要对报文执行的处理方式存储于该Hash表的Hash表项中。
另一种情况，Hash索引表包括Hash表和结果表，Hash表中至少包含有效标识和结果表指针，该Hash表中还可以包含操作类型，如表2或3所示，
Valid 处理信息
表2
Valid Type 处理信息
表3
其中，Valid为有效标识，用于指示对应表项是否有效；
Type为操作类型，可以是二层转发、三层IPv4转发、三层IPv6转发、组播转发、ACL匹配业务等；
处理信息为结果表指针，通过该结果表指针将Hash表中的Hash表项映射到结果表中的结果表项，该结果表指针可以映射到一个结果表项，也可以映射到多个结果表项，该结果表如表4所示，
Valid Type 处理方式
表4
其中，在表4中，Valid和Type的含义与Hash表一致。
处理方式即为对匹配到结果表项的报文执行的处理方式。例如，处理方式可以包含以下内容：将报文上送控制平面建立Hash表项，丢弃报文等。
在处理方式的内容较少，Hash表中足以存储处理方式的内容时，则可以不设置结果表；在处理方式的内容较多，无法全部存储在Hash表中时，则可以采用Hash表和结果表的形式，将处理方式存储于结果表中，通过结果表指针建立Hash表和结果表之间的映射。
本申请实施例中的Hash表和/或结果表中还可以包括Key。Key为关键值，不同Type对应的Key不同。例如，当Type是二层转发时，Key包括：目的MAC(媒体访问控制)地址、源MAC地址、VPN(Virtual Private Network，虚拟专用网络)ID(Identity，标识)；当Type是三层IPv4转发时，Key包括：目的IP(Internet Protocol，因特网协议)地址、源IP地址、VPN ID；当Type是三层IPv6转发时，Key包括：目的IP地址、源IP地址、VPN ID、三层协议号；当Type是组播转发时，Key包括：目的IP地址、源IP地址、VPN ID、目的端口号；当Type是ACL(Access Control List，访问控制列表)匹配业务时，Key包括：ACL匹配所需的所有关键值。显然，上述只是对不同Type需要提取的Key的举例，本申请对此不做限定。
Type和Key可以用于解决Hash冲突。假设，在Hash索引表中存储有多个Hash索引表项。对从一报文中提取出的关键值进行Hash计算得到的计算结果为a，对从另一报文中提取出的关键值进行Hash计算得到的计算结果也为a，此时即发生了Hash冲突，根据这两个报文生成的 Hash索引表项都会保存到Hash入口为a的内存空间中。通过Type和Key确定哪一个报文能匹配到该Hash索引表项。
另外，如果Hash索引表为Hash表，且为一个链表，对于一个报文提取出的关键值进行Hash计算得到的计算结果为a，a对应多个Hash表项。此时，也是一种Hash冲突，通过Type和Key从多个Hash索引表项中匹配到一个Hash表项。
当Hash索引表包括Hash表和结果表时，与上述流程类似，仅是在匹配到Hash表中的Hash表项时，通过结果表指针指向到结果表查询处理方式，不再展开描述。
另外，由于Hash索引表的配置比较灵活，Type和Key的放置位置可以依据Hash索引表配置时的不同需求进行调整。例如Type放置于Hash表中，Key放置于结果表中；Type分别放置于Hash表和结果表中，Key放置于Hash表中；或者，Type和Key放置于Hash表，结果表中不放置Type和Key等等。
图1是本申请实施例的报文处理方法的流程图。如图1所示，本申请实施例的报文处理方法包括以下步骤。
步骤S102，在接收到报文之后，识别该报文需要执行的操作类型。
在本步骤中，通常可以从接口表中获取到该报文的入接口上的相关配置信息。根据获取到的配置信息以及解析出的报文相关内容，识别出该报文需要执行的操作类型(Type)。例如，操作类型可以是二层转发、三层IPv4转发、三层IPv6转发、组播转发和ACL匹配业务等。其中，在Hash索引表和/或结果表中，Type的值所对应的类型由用户预先配置，例如，二层转发所对应的Type的值为01，三层IPv4转发所对应的Type的值02等。
以ACL匹配业务为例进行说明，当某一接口上配置有至少一个ACL 规则时，根据预设分类规则将所述至少一个ACL规则划分成至少一个ACL匹配业务子类。例如，这至少一个ACL匹配业务子类可以是二层ACL匹配业务子类、三层IPv4 ACL匹配业务子类和三层IPv6 ACL匹配业务子类。然后，将该接口与这至少一个ACL匹配业务子类之间的对应关系配置到接口表中。这样，在步骤S102中，在接收到报文之后，从接口表中查找到与该报文的入接口对应的至少一个ACL匹配业务子类，从查找到的至少一个ACL匹配业务子类中，确定与该报文相匹配的ACL匹配业务子类作为该报文需要执行的操作类型。例如，若该报文是二层报文，则确定该报文相匹配的ACL匹配业务子类为二层ACL匹配业务子类；若该报文是三层报文，且该报文是IPv4报文，则确定该报文相匹配的ACL匹配业务子类为三层IPv4 ACL匹配业务子类；若该报文是三层报文，且该报文是IPv6报文，则确定该报文相匹配的ACL匹配业务子类为三层IPv6 ACL匹配业务子类。
步骤S104，根据识别出的操作类型，从该报文中提取出多个关键值(Key)。
在本发明实施例中，当操作类型是二层转发时，提取报文的目的MAC地址、源MAC地址和VPN ID；
当操作类型是三层IPv4转发时，提取报文的目的IP地址、源IP地址和VPN ID；
当操作类型是三层IPv6转发时，提取报文的目的IP地址、源IP地址、VPN ID和三层协议号；
当操作类型是组播转发时，提取报文的目的IP地址、源IP地址、VPN ID和目的端口号；
当操作类型是ACL匹配业务时，提取ACL匹配所需的关键值。
上述只是对不同操作类型需要提取的关键值的举例，本申请对此不 做限定。
步骤S106，对提取出的关键值进行Hash计算。
在本发明实施例中，按照特定算法，对提取出的关键值进行Hash计算，特定算法例如可以是异或算法、CRC(Cyclic Redundancy Check，循环冗余校验)算法等。
步骤S108，以步骤S106中的计算结果作为Hash入口，从本设备上的Hash索引表中查找到至少一个Hash索引表项。
由于可能存在Hash冲突，因此同一Hash入口中的Hash索引表项可能有一个或多个。
在本发明实施例中，步骤S108中查找到的是至少一个Hash表项，并且，当Hash索引表为Hash表时，查找到的Hash表项中包括处理方式；当Hash索引表包括Hash表和结果表时，此时，Hash表和/或结果表中包括Type，查找到的Hash表项中包括结果表指针。
步骤S110，将识别出的操作类型与该至少一个Hash索引表项进行匹配。
在这个过程中，也可以通过操作类型和关键值分别进行匹配。
步骤S112，判断是否命中一个Hash索引表项，若是，则执行步骤S114，否则，执行步骤S116。
步骤S114，根据命中的Hash索引表项对该报文进行处理。
在本发明实施例中，当Hash索引表为Hash表时，此时，Hash表如表1所示包括Type，在步骤S110中，会将识别出的操作类型与查找到的至少一个Hash表项进行匹配；在步骤S114中，若命中一个Hash表项，则根据命中的Hash表项中包括的处理方式，对该报文进行处理。
在本发明实施例中，当Hash索引表包括Hash表和结果表，并且，Hash表如表2所示不包括Type，结果表如表4所示包括Type时，在步 骤S110中，会针对查找到的每一个Hash表项，根据该Hash表项中包括的结果表指针进行索引，查找到对应的结果表，然后，根据识别出的操作类型在查找到的结果表中匹配结果表项；在步骤S114中，若命中一个结果表项，则根据命中的结果表项中包括的处理方式，对该报文进行处理。
在本发明实施例中，当Hash索引表包括Hash表和结果表，并且，Hash表如表3所示包括Type，结果表如表4所示包括Type时，在步骤S110中，会将识别出的操作类型与查找到的至少一个Hash表项进行匹配，若命中一个Hash表项，则根据命中的Hash表项中包括的结果表指针进行索引，查找到对应的结果表，然后，根据识别出的操作类型在查找到的结果表中匹配结果表项；在步骤S114中，若命中一个结果表项，则根据命中的结果表项中包括的处理方式，对该报文进行处理。
步骤S116，根据识别出的操作类型，对该报文进行对应操作。例如，丢弃该报文，或将该报文上送控制平面以便根据该报文建立Hash索引表项。
在进行报文处理时，会为每种操作类型设置默认处理方式；当未能匹配到对应的Hash索引表项时，则根据识别出的操作类型确定默认处理方式，并根据默认处理方式进行处理。该默认处理方式可以包括将报文上送控制平面以建立新的Hash索引表项，以及丢弃该报文等。
在本发明实施例中，在步骤S116中根据该报文建立Hash索引表项的过程如下：以对从该报文中提取出的关键值进行Hash计算得到的计算结果作为Hash入口，在Hash表中添加一Hash表项。当Hash索引表为如表1所示的Hash表时，添加的Hash表项中包括：Valid、Type和处理信息，其中，处理信息置为处理方式。当Hash索引表包括：如表2所示的Hash表和如表4所示的结果表时，添加的Hash表项中包括：Valid 和处理信息，其中，处理信息置为结果表指针。当Hash索引表包括：如表3所示的Hash表和如表4所示的结果表时，添加的Hash表项中包括：Valid、Type和处理信息，其中，处理信息置为结果表指针。
本申请上述实施例的方法中，在Hash索引表中引入了操作类型Type，可以将不同操作类型对应的多个Hash索引表整合成区分操作类型的一张Hash索引表，避免了不同操作类型分别对应一张Hash表。为了能够处理不同数据流，每一张Hash表中均需要为本设备能够处理的所有数据流分配对应的内存空间用于存储对应的Hash表项，这样，网络设备需要为每一张Hash表均分配足够用于存储所有数据流对应的Hash表项的内存空间Sum。本发明实施例提供的该Hash索引表只占用一个Sum的内存空间，从而使得不同操作类型复用同一内存空间Sum，节省了表项空间资源。另外，在Hash索引表中引入了操作类型，这样，每一个Hash索引表项中只需记录与操作类型对应的关键值Key即可，进一步节省了表项空间资源。
下面以一个具体的例子对本申请所涉及的报文处理方法进行描述。图2示出了本申请实施例的报文处理方法的流程图。在本实施例中，在Hash索引表包括Hash表和结果表，Hash表采用一个Hash入口对应一个Hash表项的方式，并且，Hash表中包括Valid、Type、Key和结果表指针，结果表中包括Valid、Type和处理方式。
S1，接收报文，获取该报文的入接口上配置的配置信息。例如，入接口上配置了二层转发。获取到对应的Type的值为01。
S2，根据识别出的Type，从报文提取出作为Key的源MAC地址、目的MAC地址和VPN ID。
S3，根据提取出的Key，进行Hash计算得到Hash入口，获取到Hash入口所对应的Hash表项。其中，本例子中涉及的Hash表和结果表 如图3所示。
S4，根据报文的Type匹配获取到的Hash表项的Type，如果匹配则执行S6，如果不匹配则执行S5。
S5，执行默认处理方式，即丢弃该报文。
S6，根据Hash表项的结果表指针1，查找结果表，获取对应的结果表表项。
S7，根据报文的Type，匹配对应的结果表项的Type。如果匹配则执行S8，如果不匹配则执行S5。
S8，根据该结果表项中的处理方式，对报文进行处理，例如，可以将该报文上送到控制平面，进行ARP学习。
这样一来，就完成了一次报文处理，基于报文的操作类型，识别必要的关键值，并在Hash索引表中进行匹配，无需在Hash索引表中存储大量的关键值或者设置针对不同操作类型存储不同的Hash索引表，从而节省了报文处理装置的表项空间，提升了报文处理装置的转发性能。
针对上述实施例的方法，本申请实施例中还提供了一种可以应用上述方法的报文处理装置，该装置可以应用于需要通过查找Hash表对报文进行处理的网络设备中。
如图4所示，该报文处理装置中包括以下模块：接收模块201、识别计算模块202、表项查找模块203、匹配模块204和报文处理模块205。
接收模块201用于接收报文。
识别计算模块202用于在接收模块201接收到报文之后，识别该报文需要执行的操作类型，从该报文中提取关键值并进行Hash计算。
表项查找模块203用于以识别计算模块202的计算结果作为Hash入口，从本设备上的Hash索引表中查找到至少一个Hash索引表项。
匹配模块204用于将识别计算模块202识别出的操作类型与表项查 找模块203查找到的至少一个Hash索引表项进行匹配。
报文处理模块205，用于若匹配模块204命中一个Hash索引表项，则根据命中的Hash索引表项对接收模块201接收到的报文进行处理。
其中，当Hash索引表为Hash表时，匹配模块204用于：将识别计算模块202识别出的操作类型与表项查找模块203查找到的至少一个Hash表项进行匹配；报文处理模块205具体用于：若匹配模块204命中一个Hash表项，则根据命中的Hash表项中包括的处理方式，对接收模块201接收到的报文进行处理。
当Hash索引表包括：Hash表和结果表，并且，Hash表中不包括Type，结果表中包括Type时，匹配模块204中包括：查找单元和结果表项匹配单元。
查找单元，用于针对表项查找模块203查找到的每一个Hash表项，根据该Hash表项中包括的结果表指针进行索引，查找到对应的结果表。
结果表项匹配单元，用于根据识别计算模块202识别出的操作类型在查找单元查找到的结果表中匹配结果表项。
报文处理模块205具体用于若结果表项匹配单元命中一个结果表项，则根据命中的结果表项中包括的处理方式，对接收模块201接收到的报文进行处理。
当Hash索引表包括：Hash表和结果表，并且，Hash表和结果表中均包括Type时，匹配模块204中包括：Hash表项匹配单元、查找单元和结果表项匹配单元。
Hash表项匹配单元用于将识别计算模块202识别出的操作类型与表项查找模块203查找到的至少一个Hash表项进行匹配。
查找单元用于若Hash表项匹配单元命中一个Hash表项，则根据命中的Hash表项中包括的结果表指针进行索引，查找到对应的结果表。
结果表项匹配单元用于根据识别计算模块202识别出的操作类型在查找单元查找到的结果表中匹配结果表项。
报文处理模块205具体用于若结果表项匹配单元命中一个结果表项，则根据命中的结果表项中包括的处理方式，对接收模块201接收到的报文进行处理。
在本发明实施例中，如图5所示，该报文处理装置中还包括：添加模块206和报文丢弃模块207。
添加模块206用于若匹配模块204没有命中任一Hash索引表项，则在确定需要根据接收模块201接收到的报文建立Hash索引表项时，以识别计算模块202的计算结果作为Hash入口，在Hash索引表中添加一包括识别计算模块202识别出的操作类型的Hash索引表项。
报文丢弃模块207用于若匹配模块204没有命中任一Hash索引表项，则在确定需要丢弃接收模块201接收到的报文时，将该报文丢弃。
在本发明实施例中，如图6所示，该报文处理装置中还包括：划分模块208和接口表配置模块209，其中，识别计算模块202中包括子类查找单元和操作类型确定单元。
划分模块208用于当接口上配置有至少一个ACL规则时，根据预设分类规则将这至少一个ACL规则划分成至少一个ACL匹配业务子类。
接口表配置模块209用于将该接口与划分模块208划分得到的至少一个ACL匹配业务子类之间的对应关系配置到接口表中。
子类查找单元用于在接收模块201接收到报文之后，从接口表中查找到与该报文的入接口对应的至少一个ACL匹配业务子类。
操作类型确定单元用于从子类查找单元查找到的至少一个ACL匹配业务子类中，确定与接收模块201接收到的报文相匹配的ACL匹配业务子类作为该报文需要执行的操作类型。
其中，上述至少一个ACL匹配业务子类包括：二层ACL匹配业务子类、三层IPv4 ACL匹配业务子类和三层IPv6 ACL匹配业务子类。操作类型确定单元具体用于：
若接收模块201接收到的报文是二层报文，则确定该报文相匹配的ACL匹配业务子类为二层ACL匹配业务子类；
若接收模块201接收到的报文是三层报文，且该报文是IPv4报文，则确定该报文相匹配的ACL匹配业务子类为三层IPv4 ACL匹配业务子类；
若接收模块201接收到的报文是三层报文，且该报文是IPv6报文，则确定该报文相匹配的ACL匹配业务子类为三层IPv6 ACL匹配业务子类。
本申请实施例的报文处理装置可以是软硬件结合的可编程设备，图7给出了该报文处理装置的硬件架构组成。如图7所示，该报文处理装置中包括：非易失性存储器，CPU(中央处理器)，转发芯片和内存；其中：
内存，用于存储指令代码，当所述指令代码被执行时完成的操作主要为接收模块、识别计算模块、表项查找模块、匹配模块、报文处理模块、添加模块、报文丢弃模块、划分模块和接口表配置模块完成的功能，这里不再详述。
CPU，用于与转发芯片通信，进行报文的收发；用于与内存通信，读取和执行内存中存储的所述指令代码，完成上述报文处理装置中的接收模块、识别计算模块、表项查找模块、匹配模块、报文处理模块、添加模块、报文丢弃模块、划分模块和接口表配置模块完成的功能，以及对从转发芯片上送的报文的处理；用于与非易失性存储器通信，读/写非易失性存储器中的数据，包括Hash表、结果表和接口表。
转发芯片，用于通过该芯片上的端口连接到其它网络设备，负责报文的收发处理，具体的，将接收到的报文上送给CPU进行查表处理。
非易失性存储器，用于存储各种数据，包括：Hash表、结果表和接口表。
综上，根据本发明实施例在Hash索引表中引入了操作类型Type，可以将不同操作类型对应的多个Hash索引表整合成区分操作类型的一张Hash索引表，避免不同操作类型分别对应一张Hash表。为了能够处理不同数据流，每一张Hash表中均需要为本设备能够处理的所有数据流分配对应的内存空间用于存储对应的Hash表项，这样，网络设备需要为每一张Hash表均分配足够用于存储所有数据流对应的Hash表项的内存空间Sum。在本发明实施例中，该Hash索引表只占用一个Sum的内存空间，从而使得不同操作类型复用同一内存空间Sum，节省了表项空间资源。另外，在Hash索引表中引入了操作类型，这样，每一个Hash索引表项中只需记录与操作类型对应的关键值Key即可，进一步节省了表项空间资源。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (14)

  1. 一种报文处理方法，其特征在于，包括：
    在接收到报文之后，识别该报文需要执行的操作类型，从该报文中提取关键值并进行哈希Hash计算；
    以所述Hash计算的计算结果作为Hash入口，从本设备上的Hash索引表中查找到至少一个Hash索引表项；
    将识别出的操作类型与所述至少一个Hash索引表项进行匹配；和
    若命中一个Hash索引表项，则根据命中的Hash索引表项对该报文进行处理。
  2. 根据权利要求1所述的方法，其特征在于，Hash索引表为Hash表；
    将识别出的操作类型与所述至少一个Hash索引表项进行匹配，包括：
    将识别出的操作类型与至少一个Hash表项进行匹配；
    若命中一个Hash索引表项，则根据命中的Hash索引表项对该报文进行处理，包括：
    若命中一个Hash表项，则根据命中的Hash表项中包括的处理方式，对该报文进行处理。
  3. 根据权利要求1所述的方法，其特征在于，Hash索引表包括：Hash表和结果表；
    将识别出的操作类型与所述至少一个Hash索引表项进行匹配，包括：
    针对每一个Hash表项，根据该Hash表项中包括的结果表指针进行索引，查找到对应的结果表；
    根据识别出的操作类型在查找到的结果表中匹配结果表项；
    若命中一个Hash索引表项，则根据命中的Hash索引表项对该报文进行处理，包括：
    若命中一个结果表项，则根据命中的结果表项中包括的处理方式，对该报文进行处理。
  4. 根据权利要求1所述的方法，其特征在于，Hash索引表包括：Hash表和结果表；
    将识别出的操作类型与所述至少一个Hash索引表项进行匹配，包括：
    将识别出的操作类型与至少一个Hash表项进行匹配；
    若命中一个Hash表项，则根据命中的Hash表项中包括的结果表指针进行索引，查找到对应的结果表；
    根据识别出的操作类型在查找到的结果表中匹配结果表项；
    若命中一个Hash索引表项，则根据命中的Hash索引表项对该报文进行处理，包括：
    若命中一个结果表项，则根据命中的结果表项中包括的处理方式，对该报文进行处理。
  5. 根据权利要求1所述的方法，其特征在于，在将识别出的操作类型与所述至少一个Hash索引表项进行匹配之后，还包括：
    若没有命中任一Hash索引表项，则在确定需要根据该报文建立Hash索引表项时，以所述计算结果作为Hash入口，在Hash索引表中添加一包括所述识别出的操作类型的Hash索引表项；在确定需要丢弃该报文时，将该报文丢弃。
  6. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    当接口上配置有至少一个访问控制列表ACL规则时，根据预设分类 规则将所述至少一个ACL规则划分成至少一个ACL匹配业务子类；
    将该接口与所述至少一个ACL匹配业务子类之间的对应关系配置到接口表中；
    在接收到报文之后，识别该报文需要执行的操作类型，包括：
    在接收到报文之后，从所述接口表中查找到与接收到的报文的入接口对应的至少一个ACL匹配业务子类；
    从查找到的至少一个ACL匹配业务子类中，确定与所述接收到的报文相匹配的ACL匹配业务子类作为该报文需要执行的操作类型。
  7. 根据权利要求6所述的方法，其特征在于，所述至少一个ACL匹配业务子类包括：二层ACL匹配业务子类、三层因特网协议第四版IPv4 ACL匹配业务子类和三层因特网协议第六版IPv6 ACL匹配业务子类；
    确定与所述接收到的报文相匹配的ACL匹配业务子类的方法包括：
    若该报文是二层报文，则确定该报文相匹配的ACL匹配业务子类为二层ACL匹配业务子类；
    若该报文是三层报文，且该报文是IPv4报文，则确定该报文相匹配的ACL匹配业务子类为三层IPv4 ACL匹配业务子类；
    若该报文是三层报文，且该报文是IPv6报文，则确定该报文相匹配的ACL匹配业务子类为三层IPv6 ACL匹配业务子类。
  8. 一种报文处理装置，其特征在于，包括：
    接收模块，用于接收报文；
    识别计算模块，用于在所述接收模块接收到报文之后，识别该报文需要执行的操作类型，从该报文中提取关键值并进行哈希Hash计算；
    表项查找模块，用于以所述识别计算模块的计算结果作为Hash入口，从本设备上的Hash索引表中查找到至少一个Hash索引表项；
    匹配模块，用于将所述识别计算模块识别出的操作类型与所述表项查找模块查找到的至少一个Hash索引表项进行匹配；和
    报文处理模块，用于若所述匹配模块命中一个Hash索引表项，则根据命中的Hash索引表项对所述接收模块接收到的报文进行处理。
  9. 根据权利要求8所述的装置，其特征在于，Hash索引表为Hash表；
    所述匹配模块具体用于：将所述识别计算模块识别出的操作类型与所述表项查找模块查找到的至少一个Hash表项进行匹配；
    所述报文处理模块具体用于：若所述匹配模块命中一个Hash表项，则根据命中的Hash表项中包括的处理方式，对所述接收模块接收到的报文进行处理。
  10. 根据权利要求8所述的装置，其特征在于，Hash索引表包括：Hash表和结果表；
    所述匹配模块包括：查找单元，用于针对所述表项查找模块查找到的每一个Hash表项，根据该Hash表项中包括的结果表指针进行索引，查找到对应的结果表；结果表项匹配单元，用于根据所述识别计算模块识别出的操作类型在所述查找单元查找到的结果表中匹配结果表项；
    所述报文处理模块具体用于：若所述结果表项匹配单元命中一个结果表项，则根据命中的结果表项中包括的处理方式，对所述接收模块接收到的报文进行处理。
  11. 根据权利要求8所述的装置，其特征在于，Hash索引表包括：Hash表和结果表；
    所述匹配模块包括：Hash表项匹配单元，用于将所述识别计算模块识别出的操作类型与所述表项查找模块查找到的至少一个Hash表项进行匹配；查找单元，用于若所述Hash表项匹配单元命中一个Hash表项， 则根据命中的Hash表项中包括的结果表指针进行索引，查找到对应的结果表；结果表项匹配单元，用于根据所述识别计算模块识别出的操作类型在所述查找单元查找到的结果表中匹配结果表项；
    所述报文处理模块具体用于：若所述结果表项匹配单元命中一个结果表项，则根据命中的结果表项中包括的处理方式，对所述接收模块接收到的报文进行处理。
  12. 根据权利要求8所述的装置，其特征在于，还包括：
    添加模块，用于若所述匹配模块没有命中任一Hash索引表项，则在确定需要根据所述接收模块接收到的报文建立Hash索引表项时，以所述识别计算模块的计算结果作为Hash入口，在Hash索引表中添加一包括所述识别计算模块识别出的操作类型的Hash索引表项；
    报文丢弃模块，用于若所述匹配模块没有命中任一Hash索引表项，则在确定需要丢弃所述接收模块接收到的报文时，将该报文丢弃。
  13. 根据权利要求8所述的装置，其特征在于，还包括：划分模块和接口表配置模块，其中，所述识别计算模块包括子类查找单元和操作类型确定单元；
    所述划分模块，用于当接口上配置有至少一个访问控制列表ACL规则时，根据预设分类规则将所述至少一个ACL规则划分成至少一个ACL匹配业务子类；
    所述接口表配置模块，用于将该接口与所述划分模块划分得到的至少一个ACL匹配业务子类之间的对应关系配置到接口表中；
    所述子类查找单元，用于在所述接收模块接收到报文之后，从所述接口表中查找到与该报文的入接口对应的至少一个ACL匹配业务子类；
    所述操作类型确定单元，用于从所述子类查找单元查找到的至少一个ACL匹配业务子类中，确定与所述接收模块接收到的报文相匹配的 ACL匹配业务子类作为该报文需要执行的操作类型。
  14. 根据权利要求13所述的装置，其特征在于，所述至少一个ACL匹配业务子类包括：二层ACL匹配业务子类、三层因特网协议第四版IPv4 ACL匹配业务子类和三层因特网协议第六版IPv6 ACL匹配业务子类；；所述操作类型确定单元具体用于：
    若所述接收模块接收到的报文是二层报文，则确定该报文相匹配的ACL匹配业务子类为二层ACL匹配业务子类；
    若所述接收模块接收到的报文是三层报文，且该报文是IPv4报文，则确定该报文相匹配的ACL匹配业务子类为三层IPv4 ACL匹配业务子类；
    若所述接收模块接收到的报文是三层报文，且该报文是IPv6报文，则确定该报文相匹配的ACL匹配业务子类为三层IPv6 ACL匹配业务子类。
PCT/CN2016/098523 2015-09-11 2016-09-09 报文处理 WO2017041737A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP16843675.6A EP3349403B1 (en) 2015-09-11 2016-09-09 Packet processing
US15/756,523 US10659361B2 (en) 2015-09-11 2016-09-09 Packet processing
JP2018512600A JP6498356B2 (ja) 2015-09-11 2016-09-09 パケット処理

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510575456.5A CN106533947B (zh) 2015-09-11 2015-09-11 报文处理方法及装置
CN201510575456.5 2015-09-11

Publications (1)

Publication Number Publication Date
WO2017041737A1 true WO2017041737A1 (zh) 2017-03-16

Family

ID=58239133

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/098523 WO2017041737A1 (zh) 2015-09-11 2016-09-09 报文处理

Country Status (5)

Country Link
US (1) US10659361B2 (zh)
EP (1) EP3349403B1 (zh)
JP (1) JP6498356B2 (zh)
CN (1) CN106533947B (zh)
WO (1) WO2017041737A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111935021A (zh) * 2020-09-27 2020-11-13 翱捷智能科技(上海)有限公司 一种快速匹配网络数据包的方法及***

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10454965B1 (en) * 2017-04-17 2019-10-22 Symantec Corporation Detecting network packet injection
CN107911315B (zh) * 2017-11-17 2020-09-11 成都西加云杉科技有限公司 报文分类方法及网络设备
CN109062801B (zh) * 2018-08-01 2021-09-14 四川长虹电器股份有限公司 软件接口自动转换***
CN113114574B (zh) * 2021-03-30 2023-04-25 杭州迪普科技股份有限公司 一种报文转发方法及装置
US11962494B2 (en) 2021-07-20 2024-04-16 Pensando Systems Inc. Methods and systems for data consistent search and storage using trees
WO2024111088A1 (ja) * 2022-11-24 2024-05-30 日本電信電話株式会社 分析装置、分析方法及び分析プログラム

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101247337A (zh) * 2008-02-18 2008-08-20 华为技术有限公司 一种报文转发的方法和设备
CN102025643A (zh) * 2010-12-30 2011-04-20 华为技术有限公司 一种流表查找方法和装置
CN102882810A (zh) * 2012-10-26 2013-01-16 杭州迪普科技有限公司 一种报文快速转发方法及装置
US20140282830A1 (en) * 2013-03-15 2014-09-18 International Business Machines Corporation Firewall Packet Filtering

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7324514B1 (en) * 2000-01-14 2008-01-29 Cisco Technology, Inc. Implementing access control lists using a balanced hash table of access control list binary comparison trees
US7474653B2 (en) * 2003-12-05 2009-01-06 Hewlett-Packard Development Company, L.P. Decision cache using multi-key lookup
CN100596062C (zh) * 2007-08-16 2010-03-24 杭州华三通信技术有限公司 分布式报文传输安全保护装置和方法
JP5012674B2 (ja) 2008-06-03 2012-08-29 日本電気株式会社 Ｉｐパケット制御装置におけるソフトウェア検索方法
US8515965B2 (en) * 2010-05-18 2013-08-20 Lsi Corporation Concurrent linked-list traversal for real-time hash processing in multi-core, multi-thread network processors
EP2693717B1 (en) * 2012-07-29 2015-05-06 Verint Systems Limited System and method of high volume rule engine related applications
CN103905311B (zh) 2012-12-28 2017-02-22 华为技术有限公司 流表匹配方法和装置以及交换机
US9659046B2 (en) * 2013-07-31 2017-05-23 Oracle Inernational Corporation Probing a hash table using vectorized instructions
CN103595637B (zh) * 2013-10-27 2017-03-29 西安电子科技大学 基于树与哈希表的内容中心网络结点处理数据方法
CN106326234A (zh) * 2015-06-18 2017-01-11 深圳市中兴微电子技术有限公司 流分类方法及装置
JP6582723B2 (ja) * 2015-08-19 2019-10-02 富士通株式会社 ネットワークシステム、スイッチ装置、及びネットワークシステム制御方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101247337A (zh) * 2008-02-18 2008-08-20 华为技术有限公司 一种报文转发的方法和设备
CN102025643A (zh) * 2010-12-30 2011-04-20 华为技术有限公司 一种流表查找方法和装置
CN102882810A (zh) * 2012-10-26 2013-01-16 杭州迪普科技有限公司 一种报文快速转发方法及装置
US20140282830A1 (en) * 2013-03-15 2014-09-18 International Business Machines Corporation Firewall Packet Filtering

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3349403A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111935021A (zh) * 2020-09-27 2020-11-13 翱捷智能科技(上海)有限公司 一种快速匹配网络数据包的方法及***

Also Published As

Publication number Publication date
CN106533947A (zh) 2017-03-22
CN106533947B (zh) 2019-10-08
EP3349403A4 (en) 2018-11-07
US10659361B2 (en) 2020-05-19
EP3349403B1 (en) 2020-10-21
US20180270152A1 (en) 2018-09-20
EP3349403A1 (en) 2018-07-18
JP6498356B2 (ja) 2019-04-10
JP2018528699A (ja) 2018-09-27

Similar Documents

Publication Publication Date Title
WO2017041737A1 (zh) 报文处理
US20190058661A1 (en) Storing keys with variable sizes in a multi-bank database
US10608866B2 (en) Forwarding Ethernet packets
US10333845B2 (en) Forwarding data packets
CN109714274B (zh) 一种获取对应关系的方法和路由设备
JP2009532919A5 (zh)
US10313154B2 (en) Packet forwarding
WO2017133647A1 (zh) 一种报文处理方法、流分类器和业务功能实例
WO2020114239A1 (zh) 组播报文的处理方法及装置、存储介质、处理器
CN107547407B (zh) 报文传输方法、装置和实现装置
US11621853B1 (en) Protocol-independent multi-table packet routing using shared memory resource
WO2021135491A1 (zh) 流表的匹配方法及装置
US8250189B1 (en) Employing IP version fields to determine data-link layer addresses
CN105282133B (zh) 从分组内容形成哈希输入的方法及其装置
WO2015131720A1 (zh) 报文处理方法及装置
US10798014B1 (en) Egress maximum transmission unit (MTU) enforcement
CN107666428B (zh) 静默设备探测方法以及装置
CN111131049B (zh) 路由表项的处理方法及装置
US10313274B2 (en) Packet forwarding
TW201607274A (zh) 擷取封包數據方法及裝置
WO2015184979A1 (zh) 处理报文、发送信息、接收信息的方法及装置
CN107547687B (zh) 一种报文传输方法和装置
WO2014067384A1 (zh) 一种转发表的生成方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16843675

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15756523

Country of ref document: US

ENP Entry into the national phase

Ref document number: 2018512600

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2016843675

Country of ref document: EP