WO2019062839A1 - 转发报文的方法、装置、交换机、设备及存储介质 - Google Patents
转发报文的方法、装置、交换机、设备及存储介质 Download PDFInfo
- Publication number
- WO2019062839A1 WO2019062839A1 PCT/CN2018/108281 CN2018108281W WO2019062839A1 WO 2019062839 A1 WO2019062839 A1 WO 2019062839A1 CN 2018108281 W CN2018108281 W CN 2018108281W WO 2019062839 A1 WO2019062839 A1 WO 2019062839A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- connection
- packet
- identifier
- cache information
- information
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/74—Address processing for routing
- H04L45/745—Address table lookup; Address filtering
- H04L45/7453—Address table lookup; Address filtering using hashing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/02—Topology update or discovery
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/901—Indexing; Data structures therefor; Storage structures
- G06F16/9024—Graphs; Linked lists
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/38—Flow based routing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/74—Address processing for routing
- H04L45/742—Route cache; Operation thereof
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/56—Provisioning of proxy services
- H04L67/568—Storing data temporarily at an intermediate stage, e.g. caching
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2101/00—Indexing scheme associated with group H04L61/00
- H04L2101/60—Types of network addresses
- H04L2101/618—Details of network addresses
- H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
Definitions
- the present application relates to the field of Internet technologies, and in particular, to a method, an apparatus, a switch, a device, and a storage medium for forwarding a message.
- a virtual switch is a virtual device running on a compute node host in a public cloud environment.
- the virtual switch functions on the Layer 2 and Layer 3 network through software.
- the vSwitch is responsible for packet forwarding based on MAC (Media Access Control or Medium Access Control) and Layer 3 IP Protocol (Internet Protocol Address). It also has security groups and ACLs. List, access control list) and other functions.
- the second layer MAC address table and the queried security group rule need to be queried; If the receiving end of the packet is not in the same subnet, you need to query the Layer 3 routing table, ACL, neighbor table, and security group.
- the connection information corresponding to the packet is The transmission path between the receiving end of the packet is saved in a shortcut table.
- the existing technology for forwarding packets using the virtual switch may cause the connection information to be invalid when the connection status of the device corresponding to the connection information is changed or the control plane configuration is changed.
- the packet is forwarded according to the expired connection information. Send Error.
- the purpose of the embodiments of the present application is to provide a method, an apparatus, a switch, a device, and a storage medium for forwarding a message, so as to reduce packet forwarding errors.
- the specific technical solutions are as follows:
- the embodiment of the present application provides a method for forwarding a packet, which is applied to a switch, where the method includes: obtaining a packet to be forwarded; and querying, in the first data table, whether the connection cache information corresponding to the to-be-forwarded packet is included If the first data table includes the connection cache information corresponding to the to-be-forwarded packet, the first identifier of the connection cache information in the first data table is obtained, where the first identifier is when the connection cache information is established.
- the method for forwarding a packet in the embodiment of the present application may further include: acquiring a connection identifier sent by the device that is configured to be updated, where the device that is configured to be updated is a packet transceiver device whose connection information changes; And updating the connection information corresponding to the connection identifier sent by the device updated by the configuration in the second data table according to the connection identifier sent by the device updated by the configuration.
- the method further includes If the first identifier and the second identifier of the connection cache information are different, the connection cache information corresponding to the to-be-forwarded packet in the first data table is deleted; the destination address of the to-be-forwarded packet is obtained, and the foregoing destination address is determined according to the destination address.
- the transmission path of the packet to be forwarded; the transmission path of the packet to be forwarded is used as the current connection cache information, and the connection information corresponding to the current connection cache information is obtained in the second data table, and according to the Corresponding connection information corresponding to the current connection cache information, determining a connection identifier of the current connection cache information; using the connection identifier of the current connection cache information as the first identifier of the current connection cache information, and the current connection cache information The first identifier and the current connection cache information are recorded in the first data ; And according to the transmission path of the packet to be forwarded, and transmits the packet to be forwarded.
- the obtaining the destination address of the to-be-forwarded packet, and determining the transmission path of the to-be-forwarded packet according to the destination address includes: if the destination address is in the same network segment as the address of the switch, querying The MAC address table is configured to determine the path information of the to-be-forwarded packet, where the path information includes a forwarding address, where the forwarding address is an address of a device that receives the packet to be forwarded in a next hop; and according to the forwarding address in the path information, Determine the device that needs to be matched by the security group rule and match the security group rule. If the security group rule is successful, the device that matches the security group rule is used as the object to be forwarded to determine the packet to be forwarded. Transmission path.
- the obtaining the destination address of the to-be-forwarded packet, and determining the transmission path of the to-be-forwarded packet according to the destination address includes: if the destination address is not in the same network segment as the address of the switch, querying
- the access control list is configured to: when the foregoing access control list is allowed to forward the to-be-forwarded packet, query the routing table and the neighboring table, and determine the path information of the to-be-forwarded packet, where the path information includes a forwarding address, and the forwarding address is next
- the device that receives the packet to be forwarded is queried; the device that needs to match the security group rule is determined according to the forwarding address in the path information, and the security group rule is matched; when the matching security group rule is successful, the security group rule is matched.
- a successful device is used as the sending object of the to-be-forwarded packet to determine the transmission path of the packet to be forwarded.
- the first data table includes the connection cache information corresponding to the to-be-forwarded packet
- the first identifier of the connection cache information in the first data table is obtained, where: The table includes the connection cache information corresponding to the to-be-forwarded packet, and the key corresponding to the quintuple of the to-be-forwarded packet is queried in the first data table, as the key of the to-be-forwarded packet; and the first data table is obtained.
- a linked list header pointer corresponding to a key offset of the to-be-forwarded packet in the hash hash bucket; querying the linked list of the linked list header pointer to obtain the connection cache information and the first identifier of the connection cache information.
- the method further includes: if the first data table does not include the corresponding packet to be forwarded The cache information is obtained, and the destination address of the packet to be forwarded is obtained.
- the MAC address table is queried to determine the path information of the to-be-forwarded packet, where the path information includes Forwarding address, where the forwarding address is the address of the device that receives the packet to be forwarded in the next hop; determining, according to the forwarding address in the path information, the device that needs to match the security group rule, and matching the security group rule; If the rule is successful, the device that matches the security group rule is used as the object to be forwarded to determine the transmission path of the packet to be forwarded. The transmission path of the packet to be forwarded is used as the current connection cache information.
- Connection information corresponding to the current connection cache information in the second data table Determining the connection identifier of the current connection cache information, using the connection identifier of the current connection cache information as the first identifier of the current connection cache information, and recording the first identifier of the current connection cache information and the current connection cache information in the foregoing In the data table, the packet to be forwarded is sent according to the transmission path of the packet to be forwarded.
- the method further includes: if the first data table does not include the corresponding packet to be forwarded The cache information is obtained, and the destination address of the packet to be forwarded is obtained. If the destination address is not in the same network segment as the current virtual machine, the access control list is queried. When the ACL is allowed to forward the packet to be forwarded, the query is performed.
- the routing table and the neighbor table determine the path information of the to-be-forwarded packet, where the path information includes a forwarding address, where the forwarding address is the address of the device that receives the packet to be forwarded in the next hop;
- the device determines the device to be matched by the security group rule and matches the security group rule. If the security group rule is successful, the device that matches the security group rule is used as the object to be forwarded.
- the transmission path of the text; the transmission path of the packet to be forwarded is taken as the current
- the cache information is obtained; the connection information corresponding to the current connection cache information in the second data table is obtained, the connection identifier of the current connection cache information is determined, and the connection identifier of the current connection cache information is used as the first connection cache information.
- the identifier is configured to record the first identifier of the current connection cache information and the current connection cache information in the first data table, and send the to-be-forwarded packet according to the transmission path of the to-be-forwarded packet.
- the embodiment of the present application provides a method for forwarding a packet, which is applied to a packet sending and receiving device, and the method includes: monitoring connection information with a current network, and according to a preset when the connection information with the current network changes.
- the update rule updates the connection identifier; sends the updated connection identifier to the switch, so that the switch updates the second data table according to the connection identifier.
- the embodiment of the present application provides a device for forwarding a packet, which is applied to a switch, where the device includes: a packet acquiring module, configured to obtain a packet to be forwarded; and a query module, configured to query the first data table. Whether the connection cache information corresponding to the to-be-forwarded packet is included; the first identifier acquisition module is configured to: if the first data table includes the connection cache information corresponding to the to-be-forwarded packet, obtain the connection cache in the first data table.
- the first identifier is a connection identifier corresponding to the connection cache information when the connection cache information is established; and the second identifier determination module is configured to obtain a second data table corresponding to the connection cache information.
- the connection information is determined according to the connection information corresponding to the connection cache information, and the second identifier of the connection cache information is determined, wherein the second identifier is a connection identifier currently corresponding to the connection cache information, and when the connection information changes, the foregoing The second identifier is correspondingly changed; the first packet forwarding module is set to be the above Then the same cache information of the first and second identities, in accordance with the above-described information transfer the connection cache packets to be forwarded.
- the device for forwarding a message may further include: a connection identifier obtaining module, configured to acquire a connection identifier sent by the device that is configured to be updated, where the device that is updated by the configuration is a packet whose connection information changes.
- the transceiver device is configured to update, according to the connection identifier sent by the device updated by the foregoing configuration, the connection information corresponding to the connection identifier sent by the device updated by the configuration in the second data table.
- the apparatus for forwarding a message may further include: a connection information deletion module, configured to delete the to-be-forwarded report in the first data table if the first identifier and the second identifier of the connection cache information are different Corresponding connection cache information; the first transmission path determining module is configured to obtain the destination address of the to-be-forwarded packet, and determine the transmission path of the to-be-forwarded packet according to the destination address; the first cache information determining module is configured to The transmission path of the to-be-forwarded packet is used as the current connection cache information, and the connection information corresponding to the current connection cache information is obtained in the second data table, and the connection information corresponding to the current connection cache information is obtained.
- a connection information deletion module configured to delete the to-be-forwarded report in the first data table if the first identifier and the second identifier of the connection cache information are different Corresponding connection cache information
- the first transmission path determining module is configured to obtain the destination address of the to-be-forwarded packet, and determine the transmission path of
- the first data table update module is configured to use the connection identifier of the current connection cache information as the first identifier of the current connection cache information, and the current connection cache information
- the first identifier and the current connection cache information are recorded in the first data table;
- the packet forwarding module as a forward transmission path as described above to be packets, transmits the packets to be forwarded.
- the first transmission path determining module includes: a first path information determining submodule, configured to: if the destination address is in the same network segment as the address of the switch, query a MAC address table, and determine the to-be-determined The path information of the forwarding packet, wherein the path information includes a forwarding address, where the forwarding address is an address of a device that receives the packet to be forwarded in a next hop; the first security group matching submodule is set according to the path information.
- the forwarding address is used to determine the device that needs to be matched by the security group rule and the security group rule is matched.
- the first device is connected to the sub-module, and the device that matches the security group rule is configured as the device to be forwarded.
- the sending object determines the transmission path of the above-mentioned message to be forwarded.
- the first transmission path determining module includes: an access query sub-module, configured to query the access control list if the destination address is not in the same network segment as the address of the switch; and the second path information determining The module is configured to: when the foregoing access control list is allowed to forward the to-be-forwarded packet, query the routing table and the neighboring table, and determine the path information of the to-be-forwarded packet, where the path information includes a forwarding address, and the forwarding address is next And hopping to receive the address of the device to be forwarded; the second security group matching sub-module is configured to determine, according to the forwarding address in the path information, a device that needs to perform security group rule matching, and match the security group rule; The connection sub-module is configured to: when the matching security group rule is successful, the device that successfully matches the security group rule is used as the transmission object of the to-be-forwarded packet to determine the transmission path of the to-be-forwarded packet.
- an access query sub-module configured to query the access control list
- the first identifier obtaining module includes: a key obtaining sub-module, configured to query, in the first data table, a key corresponding to the quintuple of the to-be-forwarded packet, as the to-be-forwarded packet.
- Key a pointer acquisition sub-module, configured to obtain a link header pointer corresponding to a key offset of the to-be-forwarded packet in the hash hash bucket in the first data table; and an identifier query sub-module, configured to query the chain header pointer
- the linked list obtains the connection identifier information and the first identifier of the connection cache information.
- the apparatus for forwarding a message may further include: a first destination address obtaining module, configured to: if the first data table does not include the connection cache information corresponding to the to-be-forwarded packet, obtain the to-be-forwarded The destination address of the packet, where the destination address is the address of the target end of the packet to be forwarded; the first transmission path determining module is configured to query the MAC address table if the destination address is in the same network segment as the address of the current switch. Determining the path information of the to-be-forwarded packet, where the path information includes a forwarding address, where the forwarding address is an address of a device that receives the packet to be forwarded in a next hop; the first rule matching module is configured to be based on the path information.
- a first destination address obtaining module configured to: if the first data table does not include the connection cache information corresponding to the to-be-forwarded packet, obtain the to-be-forwarded The destination address of the packet, where the destination address is the address of the target end of the
- the forwarding address in the device determines the device that needs to match the security group rule and matches the security group rule.
- the second transmission path determination module is configured to use the device that successfully matches the security group rule as the above-mentioned to be forwarded when the matching security group rule is successful.
- the second cache information determining module is configured to use the transmission path of the to-be-forwarded packet as the current connection cache information
- the first recording module is configured to obtain connection information corresponding to the current connection cache information in the second data table, and determine The connection identifier of the current connection cache information, the connection identifier of the current connection cache information is used as the first identifier of the current connection cache information, and the first identifier of the current connection cache information and the current connection cache information are recorded in the first
- the third packet forwarding module is configured to send the to-be-forwarded packet according to the transmission path of the to-be-forwarded packet.
- the apparatus for forwarding a message may further include: a second destination address obtaining module, configured to: if the first data table does not include the connection cache information corresponding to the to-be-forwarded packet, obtain the to-be-forwarded The destination address of the packet, wherein the destination address is an address of the target end of the packet to be forwarded; and the control list query module is configured to query the access control list if the destination address is not in the same network segment as the current virtual machine address;
- the second transmission path determining module is configured to: when the foregoing access control list is allowed to forward the to-be-forwarded packet, query the routing table and the neighboring table, and determine the path information of the to-be-forwarded packet, where the path information includes a forwarding address,
- the forwarding address is the address of the device that receives the packet to be forwarded in the next hop;
- the second rule matching module is configured to determine, according to the forwarding address in the path information, a device that needs to perform security group rule matching, and matches the security group rule
- the third cache information determining module is configured to use the transmission path of the to-be-forwarded packet as The current connection cache information; the second record module is configured to obtain the connection information corresponding to the current connection cache information in the second data table, determine the connection identifier of the current connection cache information, and connect the connection identifier of the current connection cache information. As the first identifier of the current connection cache information, the first identifier of the current connection cache information and the current connection cache information are recorded in the first data table; and the fourth packet forwarding module is configured to be forwarded according to the foregoing The transmission path of the text is sent to the packet to be forwarded.
- the embodiment of the present application provides a device for forwarding a message, which is applied to a packet sending and receiving device, and the device includes: a connection information monitoring module, configured to monitor connection information with a current network, and connect with a current network. When the information changes, the connection identifier is updated according to the preset update rule; the connection identifier sending module is configured to send the updated connection identifier to the switch, so that the switch updates the second data table according to the connection identifier.
- an embodiment of the present application provides a switch, including a processor and a machine readable storage medium, where the machine readable storage medium stores machine executable instructions executable by the processor, where the processor is The executable instructions cause: to implement any of the method steps of the first aspect above.
- an embodiment of the present application provides a message transceiver device, including a processor and a machine readable storage medium, where the machine readable storage medium stores machine executable instructions executable by the processor, the processor Actuated by the machine executable instructions described above: implementing the method steps of the second aspect above.
- the embodiment of the present application provides a computer readable storage medium, where the computer readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of the foregoing first aspect are implemented.
- the embodiment of the present application provides a computer readable storage medium, where the computer readable storage medium stores a computer program, and when the computer program is executed by the processor, the method steps of the second aspect are implemented.
- an embodiment of the present application provides a computer program product comprising instructions, which when executed on a computer, cause the computer to perform any of the method steps of the first aspect above.
- an embodiment of the present application provides a computer program product comprising instructions, when executed on a computer, causing a computer to perform the method steps of the second aspect above.
- an embodiment of the present application provides a computer program that, when run on a computer, causes the computer to perform any of the method steps of the first aspect described above.
- an embodiment of the present application provides a computer program that, when run on a computer, causes the computer to perform the method steps of the second aspect above.
- the method, the device, the switch, the device, and the storage medium for forwarding a message provided by the embodiment of the present application may include: acquiring a packet to be forwarded; and querying whether the first data table includes the packet to be forwarded And the first identifier of the connection cache information in the first data table, wherein the first identifier is the connection cache, if the first data table includes the connection cache information corresponding to the to-be-forwarded packet.
- the connection identifier corresponding to the connection cache information is recorded; the connection information corresponding to the connection cache information in the second data table is obtained, and the second connection cache information is determined according to the connection information corresponding to the connection cache information.
- the identifier wherein the second identifier is a connection identifier currently associated with the connection cache information, and when the connection information changes, the second identifier is changed correspondingly; if the first identifier and the second identifier of the connection cache information are the same, And forwarding the to-be-forwarded packet according to the foregoing connection cache information.
- the first identifier and the second identifier of the connection cache information are the same, indicating that the connection cache information is not invalid, and the packet to be forwarded is forwarded according to the connection cache information at this time, which can reduce packet forwarding errors.
- implementing any of the products or methods of the present application necessarily does not necessarily require all of the above advantages.
- FIG. 1 is a schematic flowchart of a packet exchanged by a switch in the prior art
- FIG. 2 is a schematic flow chart of a method for forwarding a packet applied to a switch according to an embodiment of the present application
- FIG. 3 is a schematic flowchart of a method for forwarding a packet to a packet sending and receiving device according to an embodiment of the present disclosure
- FIG. 4 is another schematic flowchart of a method for forwarding a packet applied to a switch according to an embodiment of the present disclosure
- FIG. 5 is a schematic diagram of deleting connection cache information by using an RCU manner according to an embodiment of the present application
- FIG. 6 is a schematic diagram of an apparatus for forwarding a packet applied to a switch according to an embodiment of the present application
- FIG. 7 is a schematic diagram of an apparatus for forwarding a message applied to a packet sending and receiving device according to an embodiment of the present disclosure.
- FIG. 1 is a schematic diagram of a process of forwarding a packet by a switch in the prior art.
- the switch determines whether the destination address of the packet is in the same network segment as the address of the switch, that is, determining the packet. Whether it is a Layer 2 packet. If it is in the same network segment, it is a Layer 2 packet, and then the MAC table is queried and then matched with the security group rule and sent. If the destination address of the packet is not in the same network segment as the address of the switch, it is not a Layer 2 packet. Then, you need to query the ACL, routing table, neighbor table, etc. and match the security group rules, and then send the message.
- the path information corresponding to the packet is saved to a shortcut table after the packet is sent to the packet receiving end.
- the packet sending end communicates with the packet receiving end again, it forwards directly according to the path information in the shortcut table.
- the path information is invalid. Forwarding the packet according to the invalid path information will cause an error, and traversing all the path information in the shortcut table to clear the invalidation.
- the path information especially when the number of connection information in the shortcut table is large, the processing time is very long, which seriously affects the packet forwarding speed and the packet forwarding efficiency is low.
- the embodiment of the present application is to reduce the time-consuming time for forwarding a table lookup on the basis of establishing a connection between a sending device and a receiving device of a packet (data packet) based on the connection information of the packet forwarding message.
- the original number of table lookups is simplified to a single lookup table and then quickly forwarded to achieve a fast transmission path of the virtual switch, while avoiding the error of forwarding packets according to the failed connection information.
- an embodiment of the present application provides a method for forwarding a packet, which is applied to a switch, and the method includes:
- the packet forwarding method in the embodiment of the present application is applied to a switch, and the switch may be a physical switch or a virtual switch. That is, the virtual switch receives and obtains the to-be-forwarded packet sent by the packet-receiving device.
- the first data table is used to record the connection cache information of the two packet sending and receiving devices that have established the connection and the first identifier of the connection cache information.
- the connection cache information corresponding to the packet includes the transmission path of the packet, and may also include an identifier of each packet sending and receiving device on the transmission path, such as an ID (Identification) or an IP address.
- an ID Identity
- IP address an IP address
- the connection cache information is used as the connection cache information corresponding to the to-be-forwarded packet, and the first data table includes the connection cache information corresponding to the to-be-forwarded packet.
- the IP address of the packet sending device in the first packet to be forwarded is 13
- the IP address of the packet receiving device is 25
- the first data table is queried, and the packet sending device of the transmission path in the first connection cache information is found.
- the IP address of the packet is 13 and the IP address of the packet receiving device is 25.
- the first data table includes the connection cache information corresponding to the first packet to be forwarded, and the connection cache information corresponding to the first packet to be forwarded is A connection cache information.
- a five-tuple of connection cache information is recorded in the first data table. If the first data table has the same five-tuple group as the quintuple of the packet to be forwarded, it is determined that the first data table includes the connection cache information corresponding to the packet to be forwarded, and the first data table and the to-be-forwarded report are The connection cache information corresponding to the same quintuple of the quintuple is used as the connection cache information corresponding to the to-be-forwarded packet.
- the quintuple includes the source IP address, source port, destination IP address, destination port, and transport layer protocol.
- the connection cache information corresponding to the packet to be forwarded is determined by the quintuple, and the determination result is more accurate.
- the first data table includes the connection cache information corresponding to the to-be-forwarded packet, obtain the first identifier of the connection cache information in the first data table, where the first identifier is the connection cache information and the connection cache information. Connection identifier.
- the device in the embodiment of the present disclosure is specifically a packet sending and receiving device, and may be a physical device or a virtual device.
- the connection cache information records the identifier of each packet sending and receiving device on the transmission path, and the device corresponding to the identifier of each device in the connection cache information is used as each device corresponding to the connection cache information.
- the first identifier of the connection cache information is recorded in the first data table.
- the first identifier is a connection identifier corresponding to the connection cache information when the connection cache information is established.
- the first identifier of the connection cache information may be a first identifier of each packet transceiver device corresponding to the connection cache information.
- each device (message transceiver device) corresponding to the connection cache information is device 1, device 2, and device 3; the connection identifier of device 1 is 7, device 2 The connection identifier is 6, and the connection identifier of the device 3 is 9, the first identifier of the connection cache information may be 7, 6, 9.
- a VPC supports multiple users at the same time.
- Each user corresponds to a VXLAN (Virtual Extensible LAN) identifier, such as a VXLAN ID, to ensure isolation.
- VXLAN Virtual Extensible LAN
- the first identifier of the connection cache information may also be a first identifier of each user corresponding to the connection cache information. For example, when the connection cache information is written into the first data table, each user corresponding to the connection cache information is User 1 and User 2, the connection identifier of User 1 is 1, and the connection identifier of User 2 is 8; The first identifier of the cached information may be 1,8.
- connection information corresponding to the connection cache information in the second data table is obtained, and the second identifier of the connection cache information is determined according to the connection information corresponding to the connection cache information, where the second identifier is a connection identifier currently associated with the connection cache information. And when the connection information changes, the second identifier changes accordingly.
- the second identifier is the current connection identifier of the connection cache information, and when the connection information of the connection cache information changes, the current connection identifier of the connection cache information whose connection information changes changes according to the preset change rule.
- the connection information corresponding to the connection cache information is recorded in the second data table; the connection information corresponding to the connection cache information may be a connection identifier of each packet sending and receiving device corresponding to the connection cache information, or may be cached with the connection The connection identifier of each user corresponding to the information.
- the second identifier of the connection cache information is the current connection identifier of the connection cache information. When the connection information corresponding to the connection cache information is changed, the second identifier of the connection cache information is also changed according to the preset change rule.
- the preset change rule is any rule that can implement the second identity change.
- the device (message transceiver device) corresponding to the connection cache information is device 1, device 2, device 3, and device 4; the connection identifier of device 1 is 11, the connection identifier of device 2 is 11, and the connection identifier of device 3 is 9.
- the connection identifier of the device 4 is 13, and the current second identifier of the connection cache information is determined to be 11, 11, 9, and 13. If the connection information of the device 2 changes, the connection identifier of the device 2 is updated to 12, and the corresponding second identifier of the connection cache information is changed to 11, 12, 9, and 13.
- the user corresponding to the connection cache information is User 1 and User 2
- the connection identifier of User 1 is 6, and the connection identifier of User 2 is 13.
- the current second identifier of the connection cache information is 6,13. If the connection information of the user 1 changes, the connection identifier of the user 1 is updated to 7, and the corresponding second identifier of the connection cache information is changed to 7, 13.
- connection cache information If the first identifier and the second identifier of the connection cache information are the same, forward the to-be-forwarded packet according to the connection cache information.
- the first identifier of the connection cache information is 11, 9, 13; the second identifier of the connection cache information is 11, 9, 13.
- the first identifier and the second identifier of the connection cache information are the same, and the to-be-forwarded packet is forwarded according to the transmission path in the connection cache information.
- the first identifier and the second identifier of the connection cache information are the same, indicating that the connection cache information is not invalid, and the packet to be forwarded is forwarded according to the connection cache information at this time, so that the fast path of the packet to be forwarded is forwarded.
- the packet forwarding failure is avoided and the packet forwarding efficiency is high.
- Two additional data tables are stored in the switch: the first data table and the second data table.
- the first data table is used to record the connection cache information, and the connection cache information is established when the two message receiving and receiving devices communicate for the first time, and the connection cache information includes a message transmission path between the packet sending and receiving devices, and a connection buffer information.
- the first identifier (the first identifier of the connection cache information, which indicates the connection information of each device in the packet transmission path.
- the packet transmission path includes three devices: device 1 and device 3, and when the communication is established, the device 1 is connected.
- the connection identifier of the information is 7, the connection identifier of the connection information of the device 2 is 6, and the connection identifier of the connection information of the device 3 is 9, the first identifier of the connection cache information is 7, 6, 9)
- the second data table records the connection information of each packet sending and receiving device.
- the connection information is the real-time connection information of the packet sending and receiving device. After the connection information of the packet sending and receiving device changes, the packet sending and receiving device actively reports the changed information. Connection information).
- the device When the switch forwards the packet, the device obtains the connection cache information corresponding to the packet from the first data table (according to the receiving and sending device of the packet, and does not include the query path shown in Figure 1), and obtains the packet corresponding to the packet.
- the first identifier of the connection cache information The connection information of the connection cache information corresponding to the message (the connection information of each device on the message transmission path of the connection cache information record) is obtained in the second data table, and the second identifier of the connection cache information is determined according to the connection information.
- connection cache information is not invalid, and the packet to be forwarded is forwarded according to the connection cache information at this time, so that the fast path of the packet to be forwarded is forwarded, and packet forwarding can be avoided. failure. If the first identifier and the second identifier of the connection cache information are different, the connection cache information is invalid, and the packet sending path needs to be re-determined according to the method shown in FIG. 1 , and the connection cache information in the first data table is updated.
- the first data table and the second data table are stored in a cache.
- the first data table and the second data table are stored in a cached manner, the reading speed is fast, the packet forwarding speed is fast, and the efficiency is high.
- the method for forwarding a packet in the embodiment of the present application further includes:
- Step 1 Obtain a connection identifier sent by the device that is configured to be updated, where the device that is configured to be updated is a packet transceiver device whose connection information changes.
- the device updates the connection identifier according to the preset update rule.
- the packet sending and receiving device detects that the connection information of the packet is changed.
- the packet sending and receiving device detects the configuration change that affects the sending and receiving of the packet. For example, the address of the packet sending and receiving device changes, and the security group rule of the packet sending and receiving device occurs.
- the change, or the switch interface corresponding to the packet sending and receiving device is changed. For example, in the public cloud VPC, the control plane configuration is changed, and the service of the user responsible for the packet sending and receiving device is migrated.
- Step 2 Update the connection information corresponding to the connection identifier sent by the device configured with the update in the second data table according to the connection identifier sent by the device that is configured to be updated.
- the value of the connection identifier of the device or the value of the connection identifier of the user in the connection information corresponding to the connection identifier sent by the device configured to be updated is updated to the value of the connection identifier sent by the device configured to be updated.
- the virtual switch receives the packet with the connection identifier 3 of the device 1 sent by the device 1, and the virtual switch updates the connection identifier of the device 1 in the connection information of the second data table to 3.
- the virtual switch receives the packet with the connection identifier 3 of the user 4 sent by the device 1, and the virtual switch updates the connection identifier of the user 4 in the connection information of the second data table to 3.
- the corresponding connection information in the second data table is updated according to the connection identifier, so that the connection information recorded in the second data table is the same as the current actual connection information of each device, so as to avoid packet forwarding failure.
- the method further includes:
- the connection cache information corresponding to the to-be-forwarded packet in the first data table is deleted.
- the first identifier of the connection cache information is 9, 11; the second identifier of the connection cache information is 11,11.
- the connection cache information is deleted in the first data table.
- the first identifier of the same connection cache information is different from the second identifier, it indicates that the connection cache information has expired, and if the packet is sent according to the connection cache information, the packet transmission fails.
- the invalid connection cache information is deleted in the first data table, and the packet is not forwarded according to the connection cache information, which prevents packet forwarding failure.
- Step 2 Obtain a destination address of the packet to be forwarded, and determine a transmission path of the packet to be forwarded according to the destination address, where the destination address is the address of the target end of the packet to be forwarded.
- the virtual switch needs to query the MAC table or the routing table to determine the transmission path of the packet to be forwarded.
- Step 3 The transmission path of the packet to be forwarded is used as the current connection cache information, and the connection information corresponding to the current connection cache information is obtained in the second data table, and the current connection information is determined according to the connection information corresponding to the current connection cache information.
- the connection identifier of the connection cache information is used as the current connection cache information, and the connection information corresponding to the current connection cache information is obtained in the second data table, and the current connection information is determined according to the connection information corresponding to the current connection cache information.
- the virtual switch obtains the current transmission path and the identifier of each packet sending and receiving device on the current transmission path in the second data table, as the connection identifier of the current connection cache information.
- Step 4 The connection identifier of the current connection cache information is used as the first identifier of the current connection cache information, and the first identifier of the current connection cache information and the current connection cache information are recorded in the first data table.
- the virtual switch will use the connection identifier of the current connection cache information as the first identifier of the current connection cache information, and write the current connection cache information and the first identifier of the current connection cache information in the first data table.
- the connection information changes due to the migration of user services. For example, because the current server load is too high, the user service is migrated to other servers on the Layer 2 network.
- the current connection cache information is The connection identifier is the second identifier of the deleted connection cache information, and the second identifier of the deleted connection cache information may be recorded in the first data table as the first identifier of the current connection cache information.
- Step 5 Send the to-be-forwarded packet according to the transmission path of the packet to be forwarded.
- the virtual switch sends the to-be-forwarded packet to the device that receives the packet to be forwarded to the next hop of the transmission path.
- connection information is changed, such as adding or subtracting the packet sending and receiving device, changing the security group rule, changing the interface or address of the packet sending and receiving device, or changing the control plane configuration, for example, the packet forwarding service of user A is served by the virtual switch.
- a migration to virtual switch B will invalidate the connection cache information.
- the connection cache information is deleted, and the transmission path of the packet to be forwarded is determined by querying a MAC table or a routing table. Compared with the change of the connection information of the device, the traversal of all the connection cache information in the first data table to clear the invalid connection cache information can greatly increase the forwarding speed of the packet, especially in the first data table.
- connection cache information When the connection cache information is up to one million, the processing time of the traversal will be very long, which seriously affects the processing time of the control plane command.
- the method for determining the first identifier and the second identifier in the embodiment of the present application can greatly improve the report. The forwarding efficiency of the text.
- a packet forwarding method is provided in the case that the connection cache information is invalid, and a new connection cache information establishment method is also provided, so as to facilitate subsequent forwarding of the message according to the new connection cache information.
- the packet forwarding efficiency is high.
- the destination address of the packet to be forwarded is obtained, and the transmission path of the packet to be forwarded is determined according to the destination address, including:
- Step 1 If the destination address is in the same network segment as the current switch address, query the MAC address table to determine the path information of the packet to be forwarded.
- the path information includes the forwarding address, and the forwarding address is the next hop to receive the to-be-forwarded packet.
- the address of the device is the same network segment as the current switch address.
- the Layer 2 data link layer is based on the MAC address, and each host or virtual machine in each Layer 2 data link layer has a fixed MAC address. address.
- the MAC address table records the correspondence between different MAC addresses and interfaces. The interface corresponding to the destination address in the packets to be forwarded is determined by querying the MAC address table to determine the transmission path information of the packets to be forwarded.
- Step 2 According to the forwarding address in the path information, determine the device that needs to match the security group rule, and match the security group rule.
- the virtual switch sends the packet corresponding to the forwarding address in the path information to the device that needs to be matched by the security group rule, and sends the packet to the device that needs to match the security group rule to match the security group rule.
- Step 3 When the matching security group rule is successful, the device that matches the security group rule is used as the object to be forwarded to determine the transmission path of the packet to be forwarded.
- the security group rule is used to protect the information security of each packet sending and receiving device. Only when the security group rules match successfully, the slave can establish a communication connection between the devices. When the security group rule matching between devices fails, communication between devices is forbidden.
- Security group rules are set according to actual conditions, and can be an identity-based security policy, a rule-based security policy, or a role-based security policy. If the matching security group rule is successful, the specified information of the packet to be forwarded is in accordance with the preset rule. For example, if the source IP address of the packet to be forwarded is in the specified address range, the matching security group rule is considered successful.
- a packet forwarding method based on a MAC address is provided, and the packet forwarding in the second layer data link layer is implemented.
- the destination address of the packet to be forwarded is obtained, and the transmission path of the packet to be forwarded is determined according to the destination address, including:
- Step 1 If the destination address is not on the same network segment as the current switch address, query the access control list.
- the packet when the destination address is not in the same network segment as the current virtual machine address, the packet needs to be forwarded to the Layer 3 network layer.
- the virtual switch queries the ACL (Access Control List) to determine whether to allow the sending device of the packet to be forwarded to access the receiving device of the packet to be forwarded, that is, whether to allow the forwarding of the packet to be forwarded.
- ACL Access Control List
- the ACL can also be used to determine the priority of forwarding packets to be forwarded.
- Step 2 When the ACL is allowed to forward the to-be-forwarded packet, the routing table and the neighboring table are queried, and the path information of the packet to be forwarded is determined.
- the path information includes the forwarding address, and the forwarding address is the next hop to receive the to-be-forwarded packet.
- the address of the device is the
- the routing table records the path from the current virtual switch to other specific network terminals, such as other switches or routers except the current virtual switch.
- the neighbor table records the correspondence between the current virtual switch and each interface of the neighbor switch (switch with a communication distance of 1 hop).
- the current virtual switch first determines the switch that receives the packet to be forwarded by the next hop by querying the routing table, and then queries the neighbor table to determine the interface that communicates with the switch that receives the packet to be forwarded at the next hop, thereby determining the path of the packet to be forwarded. information.
- Step 3 According to the forwarding address in the path information, determine the device that needs to match the security group rule, and match the security group rule.
- Step 4 When the matching security group rule is successful, the device that matches the security group rule is used as the object to be forwarded to determine the transmission path of the packet to be forwarded.
- a packet forwarding method based on a routing table and a neighbor table is provided, and the packet forwarding in the network layer of the third layer is implemented.
- the first identifier of the connection cache information in the first data table is obtained, including:
- Step 1 Query the key corresponding to the quintuple of the packet to be forwarded in the first data table, as the key of the packet to be forwarded.
- the first data table is implemented by using a hash bucket (hash bucket), and the key of the corresponding hash bucket is obtained by the quintuple of the packet to be forwarded.
- the quintuple includes the source IP address, source port, destination IP address, destination port, and transport layer protocol.
- the corresponding hash bucket also stores information such as the source IP address, the source port, the destination IP address, the destination port, and the transport layer protocol, and the hash bucket also stores a key corresponding to the connection cache information.
- Step 2 Obtain a link header pointer corresponding to a key offset of the to-be-forwarded packet in the hash bucket in the first data table.
- Step 3 Query the linked list of the link header pointer to obtain the first identifier of the connection cache information and the connection cache information.
- the linked list information corresponding to the linked list and the first identifier of the connection cache information are recorded in the linked list of the linked list pointer.
- the connection cache information corresponding to the linked list refers to the same connection cache information of the quintuple in the hash bucket corresponding to the linked list.
- a method for querying the connection cache information and the first identifier of the device in the first data table is provided, and the connection cache information and the first identifier of the device are searched through the hash bucket, and the search is accurate, and the query efficiency is high.
- a read/write lock is set for each hash bucket.
- the read-write lock allows multiple processes to simultaneously read one hash bucket, but at the same time allows one process to write to the hash bucket at the same time, and the read-write lock does not allow simultaneous access to a single hash bucket. Read and write operations.
- a read-write lock is set for each hash bucket, which can be applied to the multi-core concurrent situation, and the granularity of the read-write lock is small enough.
- Each read-write lock is only responsible for one hash bucket, and different streams are not.
- a lock wait is triggered.
- connection cache information of the first identifier and the second identifier is deleted, the data is processed by using the Read-Copy Update method to ensure that the data plane is not released before the data plane processes the packet to be forwarded.
- the Read-Copy Update method is used, and the original connection cache information is not deleted before the current connection cache information is updated, thereby preventing the virtual switch from crashing due to accessing the deleted data.
- the method further includes:
- the destination address of the packet to be forwarded is obtained, where the destination address is the address of the target end of the packet to be forwarded.
- Step 2 If the destination address is in the same network segment as the current switch address, query the MAC address table to determine the path information of the packet to be forwarded.
- the path information includes the forwarding address, and the forwarding address is the next hop to receive the to-be-forwarded packet.
- the address of the device is in the same network segment as the current switch address.
- Step 3 According to the forwarding address in the path information, determine the device that needs to match the security group rule, and match the security group rule.
- Step 4 When the matching security group rule is successful, the device that matches the security group rule is used as the object to be forwarded to determine the transmission path of the packet to be forwarded.
- Step 5 The transmission path of the packet to be forwarded is used as the current connection cache information.
- Step 6 Obtain connection information corresponding to the current connection cache information in the second data table, determine a connection identifier of the current connection cache information, and use the connection identifier of the current connection cache information as the first identifier of the current connection cache information.
- the first identifier of the current connection cache information and the current connection cache information are recorded in the first data table.
- connection identifier of the current connection cache information that is, the second identifier of the current connection cache information.
- Step 7 Send the to-be-forwarded packet according to the transmission path of the packet to be forwarded.
- a packet forwarding method based on a MAC address is implemented, and packet forwarding of a slow path based on a MAC address in the second layer data link layer is implemented.
- the method further includes:
- the destination address of the packet to be forwarded is obtained, where the destination address is the address of the target end of the packet to be forwarded.
- Step 2 If the destination address is not in the same network segment as the current virtual machine address, query the access control list.
- Step 3 When the ACL is allowed to forward the to-be-forwarded packet, the routing table and the neighboring table are queried, and the path information of the packet to be forwarded is determined.
- the path information includes the forwarding address, and the forwarding address is the next hop to receive the to-be-forwarded packet.
- the address of the device is the
- Step 4 According to the forwarding address in the path information, determine the device that needs to match the security group rule, and match the security group rule.
- Step 5 When the matching security group rule is successful, the device that matches the security group rule is used as the object to be forwarded to determine the transmission path of the packet to be forwarded.
- Step 6 The transmission path of the packet to be forwarded is used as the current connection cache information.
- Step 7 Obtain connection information corresponding to the current connection cache information in the second data table, determine a connection identifier of the current connection cache information, and use the connection identifier of the current connection cache information as the first identifier of the current connection cache information.
- the first identifier of the current connection cache information and the current connection cache information are recorded in the first data table.
- connection identifier of the current connection cache information that is, the second identifier of the current connection cache information.
- Step 8 Send the to-be-forwarded packet according to the transmission path of the packet to be forwarded.
- a packet forwarding method based on a routing table and a neighbor table is provided, and packet forwarding of a slow path based on an IP address in a layer 3 network layer is implemented.
- the implementation of the present application may send the connection cache information to the network card corresponding to each virtual machine that sends and receives packets.
- the virtual switch is changed to a forwarding rule generator.
- the virtual switch delivers the content in the first data table and the second data table to the network card of the host where the packet is sent and received by the virtual machine.
- the connection cache information is recorded, two rules can be generated to invoke the flow rule (transmission rule) delivered by the physical network card. The subsequent data packet will be directly sent. The forwarding is completed on the network card.
- the network card forwards the packet to be forwarded according to the first data table and the second data table, for example, the network card obtains the to-be-forwarded packet, and queries the first data table. If the first data table includes the connection cache information corresponding to the to-be-forwarded packet, the network card obtains the first identifier of the connection cache information in the first data table; The network card obtains the connection information related to the connection cache information in the second data table, and determines the second identifier of the connection cache information. If the first identifier and the second identifier of the connection cache information are the same, the network card forwards the foregoing according to the connection cache information. The message to be forwarded. When the NIC flow rules do not match, they are sent to the virtual switch for processing. Forwarding packets directly through the NIC to implement physical layer forwarding can further speed up packet forwarding.
- the three forwarding modes of the network card, the fast path of the virtual switch, and the slow path of the virtual switch further accelerate the packet forwarding rate, thereby solving the current virtual machine based on virtio (virtio is a semi-virtualized hypervisor located in the device)
- virtio is a semi-virtualized hypervisor located in the device
- the upper layer of the virtual network card driver forwarding performance is too low, and the SR-IOV-based network card Virtual Function (virtual function) directly passes through the virtual machine, causing the virtual switch to control the message processing.
- the implementation of the present application provides a method for forwarding a message, which is applied to a packet sending and receiving device, and the method includes:
- the change of the connection information with the current network means that the packet sending and receiving device detects the configuration change that affects the sending and receiving of the packet. For example, the address of the packet sending and receiving device is changed, the security group rule of the packet sending and receiving device is changed, or reported.
- the switch interface corresponding to the packet sending and receiving device is changed. For example, in the public cloud VPC, the configuration of the control plane is changed, and the service of the user responsible for the packet sending and receiving device is migrated.
- the preset update rule is any rule that can update the connection identifier without repeating. For example, the initial value of the connection identifier of each packet sending and receiving device or user is set to 1, and each time the packet sending and receiving device detects that its own connection information changes, the value is increased based on the current connection identifier. 1, get the updated connection ID. After the connection information of the packet sending and receiving device is changed, the connection identifier is changed. The switch can identify the current state of the packet sending and receiving device and prevent the switch from incorrectly updating the second data table.
- the packet sending and receiving device When the packet sending and receiving device detects that the connection information between itself and the current network changes, the packet receiving and receiving device updates the corresponding connection identifier according to the preset update rule. For example, the connection identifier of the packet transceiver device 1 is 3. When the packet transceiver device 1 detects that its own security group rule is changed, the packet transceiver device 1 updates the connection identifier of the packet transceiver device 1 to 4. For example, the connection identifier of the user 3 served by the packet transmitting and receiving device 1 is 2, and when the service of the user 3 is migrated to the packet transmitting and receiving device 2, the packet transmitting and receiving device 1 updates the connection identifier of the user 3 to 3.
- the packet sending and receiving device 1 sends the information that the connection identifier of the packet sending and receiving device 1 is updated to 4 to the virtual switch.
- the virtual switch updates the connection identifier of the packet sending device 1 in the connection information of the second data table. Is 4.
- the message transceiver device 1 transmits the information that the connection identifier of the user 3 is updated to 3 to the virtual switch.
- the virtual switch updates the connection identifier of the user 3 in the connection information of the second data table to 3.
- the method for forwarding the packet applied to the packet sending and receiving device in the embodiment of the present application is described below.
- connection information of the packet sending and receiving device changes
- the connection identifier is updated, and the updated connection identifier is sent to the switch, so that the switch updates the second data table according to the connection identifier, and the subsequent switch is according to the first
- the data table and the second data table are sent to be forwarded, which can prevent packet forwarding failure and high packet forwarding efficiency.
- the updated connection identifier is sent to the switch, including:
- the updated connection identifier is added to the to-be-forwarded packet.
- connection identifier is added to the to-be-forwarded packet.
- the signaling load is saved when the packet-receiving device sends the connection identifier separately after updating the connection identifier.
- the updated connection identifier is sent to the switch, including:
- the updated connection identifier is sent to the switch immediately after each update of the connection identifier.
- connection identifier In the connection information recorded in the second data table can be ensured as compared with the connection identifier being added to the to-be-forwarded packet.
- the real connection is marked with strong consistency, and the forwarding of the packets to be forwarded fails due to the delay.
- FIG. 4 is another schematic flowchart of a method for forwarding a packet applied to a switch according to an embodiment of the present disclosure, including:
- the virtual switch receives the packet.
- the virtual switch is the core component of the public cloud VPC technology. It is responsible for the isolation of virtual machines, the forwarding of Layer 2 and Layer 3 packets, and security processing.
- VPC technology has a variety of scheme isolation schemes, among which VXLAN (Virtual Extensible LAN) is the most common.
- VXLAN packets encapsulate UDP and VXLAN headers on the basis of original inner-layer packets to implement a natural third layer on the underlay network.
- Route forwarding When receiving a packet, the virtual switch acts as the endpoint of the VXLAN and unblocks the received VXLAN packet and forwards the packet to the virtual machine according to the corresponding forwarding entry.
- the virtual machine sends a packet, the virtual machine virtualizes the packet. The switch obtains the packets sent by the VM and encapsulates the VXLAN packets, and then queries the routes and sends them out. Therefore, the packets exchanged on the underlay network are encapsulated.
- VPC Virtual Private Cloud
- Each user corresponds to a VXLAN ID, such as a VXLAN ID, to ensure isolation.
- VXLAN ID such as a VXLAN ID
- an independent data structure is stored on the virtual switch, and the second layer connection cache information and the third layer connection cache information are recorded, and the second layer data link layer MAC address based FDB is performed according to the received message.
- Forwarding Data Base forwards or performs Layer 3 network layer lookup routing neighbor forwarding.
- step S402 The virtual switch queries whether the connection cache information corresponding to the packet is included. If the connection cache information corresponding to the packet is included, step S403 is performed. If the connection cache information corresponding to the packet is not included, step S405 is performed.
- the virtual switch searches for the key corresponding to the quintuple of the packet to be forwarded in the first data table as the key of the packet to be forwarded according to the quintuple of the packet, and obtains the to-be-forwarded packet of the hash bucket in the first data table.
- the corresponding pointer header pointer at the key offset query the linked list of the linked header pointer pointer, and obtain the conn_age of the connection cache information and the connection cache information (where conn_age is the first identifier).
- the connection cache information contains the transmission path of the message.
- the virtual switch can find the connection cache information corresponding to the packet in the first data table, and then determine the connection cache information corresponding to the packet; the virtual switch cannot find the connection cache information corresponding to the packet in the first data table, It is determined that the connection cache information corresponding to the message is not included.
- the conn_age of the connection cache information is the thread_age of the user corresponding to the connection cache information when the connection cache information is established (where thread_age is the second identifier).
- a user_age is maintained for each user (where user_age is the connection identifier), and the packet sending and receiving device, such as a virtual machine, adds the user_age of the user to the packet when sending the packet.
- the virtual switch reads the user_age of the user and updates the value of the thread_age of the user to the value of the user_age.
- the first data table is implemented by using a hash bucket (hash bucket).
- Each hash bucket stores a quintuple of the successfully forwarded packet and a corresponding key.
- the key offset corresponds to the linked list header pointer and the linked list pointer.
- the linked list is recorded, and the connection cache information and the first identifier of each device corresponding to the connection cache information are recorded in the linked list.
- the read-write lock allows multiple processes to simultaneously read one hash bucket, but at the same time allows one process to write to the hash bucket at the same time, and the read-write lock does not allow simultaneous access to a single hash bucket.
- Read and write operations Read-write locks can be applied to multi-core concurrency situations, and ensure that the granularity of read-write locks is small enough. Each read-write lock is only responsible for one hash bucket, and different streams do not trigger lock waits.
- S403 The virtual switch acquires thread_age and conn_age corresponding to the connection cache information, determines whether the conn_age of the connection cache information is the same as the thread_age, and if yes, executes S404, and if yes, executes S412.
- the virtual switch queries the cached second data table, and the second data table records the identity of each user and the corresponding thread_age of each user.
- the second data table can be a hash table or a column data.
- the thread_age in the second data table is maintained according to the user_age sent by the packet sending and receiving device.
- a user_age is maintained for each user.
- the value of the user_age of the user is increased, thereby notifying that the data plane configuration is changed.
- the packet sending and receiving device sends a packet, it adds the user_age of the user to the packet.
- the virtual switch in the data plane receives the packet, it reads the user_age of the user. If the value of the user_age of the user is different from the value of the thread_age of the user, the value of the thread_age of the user is updated to the value of the user_age of the user.
- the packet sending and receiving device adds user_age to the packet to be sent. Compared with sending user_age specifically, it can save signaling load.
- connection cache information If the first identifier of the connection cache information is different from the second identifier, the connection cache information is invalid, and the packet is sent according to the connection cache information, which may cause the packet to be sent. Therefore, the connection cache information needs to be deleted.
- the RCU Read-Copy Update
- the original connection cache information is not deleted until the current connection cache information is updated, preventing the virtual switch from crashing due to accessing the deleted data.
- FIG. 5 is a schematic diagram of deleting connection cache information by using an RCU manner according to an embodiment of the present application.
- connection cache information is released at this time, the virtual switch will crash the system by reading the released memory. Therefore, in the RCU mode, the cache does not release the current connection cache information until the new connection cache information is established.
- the RCU mode and the combination of the conn_age, thread_age, and user_age messages are used to ensure that the data plane and the control plane are connected to the cache information update during the packet forwarding process.
- S405 If the source address and the destination address of the packet are in the same network segment, if the source address and the destination address of the packet are in the same network segment, S406 is performed. If the source address and the destination address of the packet are not in the same network segment, S407 is performed.
- the second layer of the data link layer is based on the MAC address and the third layer of the network layer is based on the IP address.
- the source address of the packet is in the same network segment as the destination address, and the packet is forwarded on the Layer 2 data link layer.
- the source address and the destination address of the packet are not in the same network segment, and the packet is forwarded on the Layer 3 network layer.
- the MAC address table is specifically an FDB address table, and the FDB address table maintains the MAC address of each packet sending and receiving device that communicates with the virtual switch. By querying the MAC address, you can determine the receiving packet device of the next hop and the interface between the virtual switch and the receiving packet device of the next hop.
- An ACL is a list of commands that interface between a router and a switch. It is used to control incoming and outgoing packets.
- the virtual switch determines whether to allow the sending device of the packet to access the receiving device of the packet, that is, whether to allow the packet to be forwarded.
- the ACL can also be used to determine the priority of forwarding packets to be forwarded.
- the routing table records the path from the current virtual switch to other specific network terminals.
- the virtual switch determines the path of the forwarded packet by querying the routing table.
- S409 Query a neighbor table to determine a transmission path of the packet.
- the neighbor table records the correspondence between the current virtual switch and each interface of the neighbor switch (switch with a communication distance of 1 hop).
- the virtual switch queries the neighbor table to determine the interface of the device that receives the next hop packet to determine the transmission path of the packet.
- the security group rule is used to protect the information security of each packet sending and receiving device. Only when the security group rules match successfully, the slave can establish a communication connection between the devices. When the security group rule matching between devices fails, communication between devices is forbidden.
- the corresponding security group can be associated with each other.
- Each virtual machine in the same security group is trusted to each other and can communicate directly.
- the security group rules are matched when the virtual machines in the security group communicate with each other or when the virtual machine accesses the public network.
- the matching security group rule is successful, a communication connection is established to ensure that the return packet can be directly forwarded.
- ACL rules to implement stateless rule matching. When packets need to be transmitted across subnets, the ACL rules are matched. Two levels of security restrictions are protected by setting security groups and ACLs.
- connection cache information includes a transmission path and conn_age, and the connection cache information may further include information such as a 5-tuple.
- the first identifier and the second identifier of the connection cache information are the same, indicating that the connection cache information is not invalid, and the packet to be forwarded is forwarded according to the connection cache information at this time, so that the fast path of the packet to be forwarded is forwarded.
- traversing all the connection cache information in the first data table to clear the invalid connection cache information can greatly increase the forwarding speed of the packet, especially in the first data table.
- the processing time of the traversal will be very long, which seriously affects the processing time of the control plane command.
- the method for determining the first identifier and the second identifier in the embodiment of the present application can greatly improve the packet. Forwarding efficiency. Packet forwarding efficiency is high.
- the method for forwarding a packet in the embodiment of the present application includes the advantages of the self-developed virtual switch scheme and the OVS scheme, the logic architecture is simple and clear, the adjustment is easy to change, the processing delay of the first packet is reduced, and the forwarding speed of subsequent packets is accelerated. .
- the method of forwarding the packet in the embodiment of the present application may be applied to the OVS solution.
- the OVS queries whether the connection cache information of the packet exists. When the connection cache information of the packet exists, And if the first identifier corresponding to the connection cache information is the same as the second identifier, the packet is sent according to the connection cache information; otherwise, the user state is sent, the packet is sent according to the existing OVS scheme, and after the packet is sent, Generate and log connection cache information.
- a method for forwarding a message in the OVS scheme is provided, which can reduce errors in forwarding packets.
- an embodiment of the present application provides a device for forwarding a packet, which is applied to a switch, and may include:
- the packet obtaining module 601 is configured to obtain a packet to be forwarded.
- the querying module 602 is configured to query whether the first data table includes connection cache information corresponding to the to-be-forwarded packet.
- the first identifier obtaining module 603 is configured to: if the first data table includes the connection cache information corresponding to the to-be-forwarded packet, obtain the first identifier of the connection cache information in the first data table, where the first identifier is established by the connection cache information The connection identifier corresponding to the connection cache information.
- the second identifier determining module 604 is configured to obtain connection information corresponding to the connection cache information in the second data table, and determine a second identifier of the connection cache information according to the connection information corresponding to the connection cache information, where the second identifier is a connection cache The current connection identifier of the information, and when the connection information changes, the second identifier changes accordingly.
- the first packet forwarding module 605 is configured to forward the to-be-forwarded packet according to the connection cache information if the first identifier and the second identifier of the connection cache information are the same.
- the first identifier and the second identifier of the connection cache information are the same, indicating that the connection cache information is not invalid, and the packet to be forwarded is forwarded according to the connection cache information at this time, so that the fast path of the packet to be forwarded is forwarded.
- the packet forwarding failure is avoided and the packet forwarding efficiency is high.
- the apparatus for forwarding a packet in the embodiment of the present application further includes:
- the connection identifier obtaining module is configured to obtain a connection identifier sent by the device that is updated by the configuration, where the device that is updated by the configuration is a packet sending and receiving device whose connection information changes.
- the identifier update module is configured to update the connection information corresponding to the connection identifier sent by the device updated by the configuration in the second data table according to the connection identifier sent by the device updated by the configuration.
- the corresponding connection information in the second data table is updated according to the connection identifier, so that the connection information recorded in the second data table is the same as the current actual connection information of each device, so as to avoid packet forwarding failure.
- the apparatus for forwarding a packet in the embodiment of the present application further includes:
- the connection information deleting module is configured to delete the connection cache information corresponding to the to-be-forwarded packet in the first data table, if the first identifier and the second identifier of the connection cache information are different.
- the first transmission path determining module is configured to obtain the destination address of the to-be-forwarded packet, and determine the transmission path of the to-be-forwarded packet according to the destination address.
- the first cache information determining module is configured to use the transmission path of the to-be-forwarded packet as the current connection cache information, obtain the connection information corresponding to the current connection cache information in the second data table, and cache the information according to the current connection.
- Corresponding connection information determines the connection identifier of the current connection cache information.
- the first data table update module is configured to use the connection identifier of the current connection cache information as the first identifier of the current connection cache information, and record the first identifier of the current connection cache information and the current connection cache information in the foregoing In a data sheet.
- the second packet forwarding module is configured to send the to-be-forwarded packet according to the transmission path of the to-be-forwarded packet.
- a packet forwarding method is provided in the case that the connection cache information is invalid, and a new connection cache information establishment method is also provided, so as to facilitate subsequent forwarding of the message according to the new connection cache information.
- the packet forwarding efficiency is high.
- the first transmission path determining module includes:
- the first path information determining submodule is configured to: if the destination address is in the same network segment as the address of the switch, query a MAC address table, and determine path information of the to-be-forwarded packet, where the path information includes a forwarding address, where The forwarding address is the address of the device that receives the above-mentioned packet to be forwarded in the next hop.
- the first security group matching sub-module is configured to determine, according to the forwarding address in the path information, a device that needs to perform security group rule matching, and match the security group rule.
- the first device is connected to the sub-module, and is configured to: when the matching security group rule is successful, the device that successfully matches the security group rule is used as the sending object of the to-be-forwarded packet to determine the transmission path of the to-be-forwarded packet.
- a packet forwarding method based on a MAC address is provided, and the packet forwarding in the second layer data link layer is implemented.
- the first transmission path determining module includes:
- the access query sub-module is configured to query the access control list if the destination address is not in the same network segment as the address of the switch.
- the second path information determining sub-module is configured to: when the foregoing access control list is allowed to forward the to-be-forwarded packet, query the routing table and the neighboring table, and determine the path information of the to-be-forwarded packet, where the path information includes a forwarding address,
- the forwarding address is the address of the device that receives the packet to be forwarded in the next hop.
- the second security group matching sub-module is configured to determine, according to the forwarding address in the path information, a device that needs to perform security group rule matching, and match the security group rule.
- the second device is connected to the sub-module, and is configured to: when the matching security group rule is successful, the device that successfully matches the security group rule is used as the sending object of the to-be-forwarded packet to determine the transmission path of the to-be-forwarded packet.
- a packet forwarding method based on a routing table and a neighbor table is provided, and the packet forwarding in the network layer of the third layer is implemented.
- the first identifier obtaining module includes:
- the key acquisition sub-module is configured to query the key corresponding to the quintuple of the to-be-forwarded packet in the first data table, as the key of the to-be-forwarded packet.
- the pointer acquisition sub-module is configured to obtain a link header pointer corresponding to a key offset of the to-be-forwarded packet in the hash hash bucket in the first data table.
- the identifier query sub-module is configured to query the linked list of the link header pointer link to obtain the connection cache information and the first identifier of the connection cache information.
- a method for querying the connection cache information and the first identifier of the device in the first data table is provided, and the connection cache information and the first identifier of the device are searched through the hash bucket, and the search is accurate, and the query efficiency is high.
- the apparatus for forwarding a packet in the embodiment of the present application further includes:
- the first destination address obtaining module is configured to: if the first data table does not include the connection cache information corresponding to the to-be-forwarded packet, obtain the destination address of the to-be-forwarded packet, where the destination address is the to-be-forwarded packet The address of the target end.
- the first transmission path determining module is configured to: if the destination address is in the same network segment as the address of the current switch, query the MAC address table, and determine the path information of the to-be-forwarded packet, where the path information includes a forwarding address, and the forwarding is performed.
- the address is the address of the device that receives the above-mentioned packet to be forwarded in the next hop.
- the first rule matching module is configured to determine, according to the forwarding address in the path information, a device that needs to perform security group rule matching, and match the security group rule.
- the second transmission path determining module is configured to: when the matching security group rule is successful, the device that successfully matches the security group rule is used as the sending object of the to-be-forwarded packet to determine the transmission path of the to-be-forwarded packet.
- the second cache information determining module is configured to use the transmission path of the to-be-forwarded packet as the current connection cache information.
- the first recording module is configured to obtain connection information corresponding to the current connection cache information in the second data table, determine a connection identifier of the current connection cache information, and use the connection identifier of the current connection cache information as the current connection cache information.
- the first identifier records the first identifier of the current connection cache information and the current connection cache information in the first data table.
- the third packet forwarding module is configured to send the to-be-forwarded packet according to the transmission path of the to-be-forwarded packet.
- a packet forwarding method based on a MAC address is implemented, and packet forwarding of a slow path based on a MAC address in the second layer data link layer is implemented.
- the apparatus for forwarding a packet in the embodiment of the present application further includes:
- the second destination address obtaining module is configured to: if the first data table does not include the connection cache information corresponding to the to-be-forwarded packet, obtain the destination address of the to-be-forwarded packet, where the destination address is the to-be-forwarded packet The address of the target end.
- the control list query module is configured to query the access control list if the destination address is not in the same network segment as the current virtual machine address.
- the second transmission path determining module is configured to: when the foregoing access control list is allowed to forward the to-be-forwarded packet, query the routing table and the neighboring table, and determine the path information of the to-be-forwarded packet, where the path information includes a forwarding address,
- the forwarding address is the address of the device that receives the above-mentioned packet to be forwarded in the next hop.
- the second rule matching module is configured to determine, according to the forwarding address in the path information, a device that needs to perform security group rule matching, and match the security group rule.
- the third transmission path determining module is configured to: when the matching security group rule is successful, the device that successfully matches the security group rule is used as the sending object of the to-be-forwarded packet to determine the transmission path of the to-be-forwarded packet.
- the third cache information determining module is configured to use the transmission path of the to-be-forwarded packet as the current connection cache information.
- the second recording module is configured to obtain the connection information corresponding to the current connection cache information in the second data table, determine the connection identifier of the current connection cache information, and use the connection identifier of the current connection cache information as the current connection cache information.
- the first identifier records the first identifier of the current connection cache information and the current connection cache information in the first data table.
- the fourth packet forwarding module is configured to send the to-be-forwarded packet according to the transmission path of the to-be-forwarded packet.
- the device of the present application further provides an apparatus for forwarding a message.
- the device is applied to a packet sending and receiving device, and the device includes:
- the connection information monitoring module 701 is configured to monitor connection information with the current network, and update the connection identifier according to a preset update rule when the connection information with the current network changes.
- connection identifier sending module 702 is configured to send the updated connection identifier to the switch, so that the switch updates the second data table according to the connection identifier.
- connection information of the packet sending and receiving device changes
- the connection identifier is updated, and the updated connection identifier is sent to the switch, so that the switch updates the second data table according to the connection identifier, and the subsequent switch is according to the first
- the data table and the second data table are sent to be forwarded, which can prevent packet forwarding failure and high packet forwarding efficiency.
- the embodiment of the present application further provides a switch, including a processor and a machine readable storage medium, where the machine readable storage medium stores machine executable instructions executable by the processor, and the processor is executable by the machine Prompt to perform the following steps:
- Step 1 Obtain a packet to be forwarded.
- Step 2 Query whether the first data table includes connection cache information corresponding to the packet to be forwarded.
- Step 3 If the first data table includes the connection cache information corresponding to the packet to be forwarded, obtain the first identifier of the connection cache information in the first data table, where the first identifier is the connection cache information, the record and the connection The connection identifier corresponding to the cached information.
- Step 4 Obtain connection information corresponding to the connection cache information in the second data table, and determine a second identifier of the connection cache information according to the connection information corresponding to the connection cache information, where the second identifier is a current connection identifier of the connection cache information, And when the connection information of the connection cache information changes, the current connection identifier of the connection cache information whose connection information changes changes according to the preset change rule.
- Step 5 If the first identifier and the second identifier of the connection cache information are the same, the packet to be forwarded is forwarded according to the connection cache information.
- the first identifier and the second identifier of the connection cache information are the same, indicating that the connection cache information is not invalid, and the packet to be forwarded is forwarded according to the connection cache information at this time, so that the fast path of the packet to be forwarded is forwarded.
- the packet forwarding failure is avoided and the packet forwarding efficiency is high.
- the above processor is prompted by the above-described machine executable instructions, and can also implement any of the above steps of the method for forwarding messages applied to the switch.
- the embodiment of the present application further provides a message transceiving device, including a processor and a machine readable storage medium, where the machine readable storage medium stores machine executable instructions executable by the processor, where the processor is The executable instructions cause the following steps to be performed:
- Step 1 Monitor the connection information with the current network, and update the connection identifier according to the preset update rule when the connection information with the current network changes.
- Step 2 Send the updated connection identifier to the switch, so that the switch updates the second data table according to the connection identifier.
- connection information of the packet sending and receiving device changes
- the connection identifier is updated, and the updated connection identifier is sent to the switch, so that the switch updates the second data table according to the connection identifier, and the subsequent switch is according to the first
- the data table and the second data table are sent to be forwarded, which can prevent packet forwarding failure and high packet forwarding efficiency.
- the above processor is prompted by the above-mentioned machine executable instructions, and can also implement any of the steps of the above method applied to the packet transmitting and receiving device to forward the message.
- the readable storage medium may include a random access memory (RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.
- RAM random access memory
- NVM non-volatile memory
- the readable storage medium may also be at least one storage device located remotely from the aforementioned processor.
- the above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; or may be a digital signal processing (DSP), dedicated integration.
- CPU central processing unit
- NP network processor
- DSP digital signal processing
- ASIC Application Specific Integrated Circuit
- FPGA Field-Programmable Gate Array
- the embodiment of the present application provides a computer readable storage medium.
- the computer readable storage medium stores a computer program.
- the computer program is executed by the processor, the method for forwarding any packet applied to the switch is implemented.
- the embodiment of the present application provides a computer readable storage medium, where the computer readable storage medium stores a computer program, and when the computer program is executed by the processor, the method for implementing the forwarding message applied to the packet sending and receiving device is implemented. .
- Embodiments of the present application provide a computer program product comprising instructions that, when run on a computer, cause the computer to perform any of the above methods of forwarding messages applied to the switch.
- the embodiment of the present application provides a computer program product comprising instructions, which when executed on a computer, causes the computer to perform any of the above methods for forwarding a message to the message receiving and receiving device.
- Embodiments of the present application provide a computer program that, when run on a computer, causes the computer to perform any of the above methods of forwarding messages applied to the switch.
- the embodiment of the present application provides a computer program that, when run on a computer, causes the computer to execute any of the above methods for forwarding a message to the message receiving and receiving device.
- the method, device, switch, device, and storage medium for forwarding packets can reduce packet forwarding errors and reduce packet loss. Moreover, it is not necessary to traverse all connection cache information to clear invalid paths, which can save Handling resources.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Databases & Information Systems (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本申请实施例提供了转发报文的方法、装置、交换机、设备及存储介质,该方法包括:获取待转发报文;查询第一数据表中是否包含待转发报文对应的连接缓存信息;若第一数据表中包含待转发报文对应的连接缓存信息,获取第一数据表中连接缓存信息的第一标识;获取第二数据表中与连接缓存信息对应的连接信息,确定连接缓存信息的第二标识,其中,第二标识为连接缓存信息当前对应的连接标识,且当连接信息发生变化时,第二标识相应改变;若连接缓存信息的第一标识和第二标识相同,按照连接缓存信息转发待转发报文。本申请实施例的转发报文的方法,能够减少报文转发错误。
Description
本申请要求于2017年09月28日提交中国专利局、申请号为201710897731.4、发明名称为“转发报文的方法、装置、交换机、设备及存储介质”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
本申请涉及互联网技术领域,特别是涉及转发报文的方法、装置、交换机、设备及存储介质。
vSwitch(Virtual Switch,虚拟交换机)为公有云环境下运行在计算节点宿主机上的虚拟设备,用于通过软件的方式实现物理交换机在二层、三层网络的功能。vSwitch主要负责二层基于MAC(Media Access Control或Medium Access Control,媒体访问控制)地址和三层基于IP地址(Internet Protocol Address,互联网协议地址)的报文转发,同时具备安全组、ACL(Access Control List,访问控制列表)等功能。
现有的技术中,在利用虚拟交换机转发报文时,当报文发送端与报文接收端在同一子网时,需要查询二层MAC地址表及查询安全组规则;当报文发送端与报文接收端不在同一子网时,需要查询三层路由表、ACL、邻居表、安全组等。为了加快报文的转发速度,在首次转发报文后,即在报文发送端与报文接收端已经建立过通信连接之后,会将该与报文对应的连接信息,例如报文发送端与报文接收端之间的传输路径,保存到一张快捷表中,当报文发送端与报文接收端再次通信时,直接查询快捷表中的连接信息,即可实现报文的快速转发。
但是现有的利用虚拟交换机转发报文的技术,在与连接信息对应的设备的连接状态发生变更或控制平面配置变更时,会导致连接信息失效,按照过期的连接信息转发报文会造成报文发送错误。
发明内容
本申请实施例的目的在于提供一种转发报文的方法、装置、交换机、设备及存储介质,以实现减少报文转发错误。具体技术方案如下:
第一方面,本申请实施例提供了一种转发报文的方法,应用于交换机, 该方法包括:获取待转发报文;查询第一数据表中是否包含上述待转发报文对应的连接缓存信息;若上述第一数据表中包含上述待转发报文对应的连接缓存信息,获取上述第一数据表中上述连接缓存信息的第一标识,其中,上述第一标识为上述连接缓存信息确立时与上述连接缓存信息对应的连接标识;获取第二数据表中与上述连接缓存信息对应的连接信息,按照上述连接缓存信息对应的连接信息,确定上述连接缓存信息的第二标识,其中,上述第二标识为上述连接缓存信息当前对应的连接标识,且当上述连接信息发生变化时,上述第二标识相应改变;若上述连接缓存信息的第一标识和第二标识相同,按照上述连接缓存信息转发上述待转发报文。
在一种实施方式中,本申请实施例的转发报文的方法还可以包括:获取由配置更新的设备发送的连接标识,其中,上述配置更新的设备为连接信息发生变化的报文收发设备;根据上述配置更新的设备发送的连接标识,更新上述第二数据表中,与上述配置更新的设备发送的连接标识对应的连接信息。
在一种实施方式中,在上述获取第二数据表中与上述连接缓存信息对应的连接信息,按照上述连接缓存信息对应的连接信息,确定上述连接缓存信息的第二标识之后,上述方法还包括:若上述连接缓存信息的第一标识和第二标识不同,删除上述第一数据表中上述待转发报文对应的连接缓存信息;获取上述待转发报文的目的地址,根据上述目的地址确定上述待转发报文的传输路径;将上述待转发报文的传输路径作为当前的连接缓存信息,在所述第二数据表中,获取所述当前的连接缓存信息对应的连接信息,并根据所述当前的连接缓存信息对应的连接信息,确定所述当前的连接缓存信息的连接标识;将所述当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,将当前的连接缓存信息的第一标识与当前的连接缓存信息记录在上述第一数据表中;按照上述待转发报文的传输路径,发送上述待转发报文。
在一种实施方式中,上述获取上述待转发报文的目的地址,根据上述目的地址确定上述待转发报文的传输路径,包括:若上述目的地址与上述交换机所在的地址处于同一网段,查询MAC地址表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址;根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待 转发报文的传输路径。
在一种实施方式中,上述获取上述待转发报文的目的地址,根据上述目的地址确定上述待转发报文的传输路径,包括:若上述目的地址与上述交换机所在的地址不在同一网段,查询访问控制列表;在上述访问控制列表允许转发上述待转发报文时,查询路由表及邻居表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址;根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径。
在一种实施方式中,上述若上述第一数据表中包含上述待转发报文对应的连接缓存信息,获取上述第一数据表中上述连接缓存信息的第一标识,包括:若上述第一数据表中包含上述待转发报文对应的连接缓存信息,在上述第一数据表中查询上述待转发报文的五元组对应的key,作为上述待转发报文的key;获取上述第一数据表中hash哈希桶的上述待转发报文的key偏移处对应的链表头指针;查询上述链表头指针链接的链表,获取上述连接缓存信息及上述连接缓存信息的第一标识。
在一种实施方式中,在上述查询第一数据表中是否包含上述待转发报文对应的连接缓存信息之后,上述方法还包括:若上述第一数据表中不包含上述待转发报文对应的连接缓存信息,获取上述待转发报文的目的地址;若上述目的地址与当前交换机所在的地址处于同一网段,查询MAC地址表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址;根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径;将上述待转发报文的传输路径作为当前的连接缓存信息;获取上述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在上述第一数据表中;按照上述待转发报文的传输路径,发送上述待转发报文。
在一种实施方式中,在上述查询第一数据表中是否包含上述待转发报文对应的连接缓存信息之后,上述方法还包括:若上述第一数据表中不包含上述待转发报文对应的连接缓存信息,获取上述待转发报文的目的地址;若上述目的地址与当前虚拟机所在的地址不在同一网段,查询访问控制列表;在上述访问控制列表允许转发上述待转发报文时,查询路由表及邻居表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址;根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径;将上述待转发报文的传输路径作为当前的连接缓存信息;获取上述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在上述第一数据表中;按照上述待转发报文的传输路径,发送上述待转发报文。
第二方面,本申请实施例提供了一种转发报文的方法,应用于报文收发设备,该方法包括:监听与当前网络的连接信息,在与当前网络的连接信息发生变化时按照预设更新规则更新连接标识;向交换机发送更新后的连接标识,以使上述交换机根据上述连接标识更新第二数据表。
第三方面,本申请实施例提供了一种转发报文的装置,应用于交换机,该装置包括:报文获取模块,设置为获取待转发报文;查询模块,设置为查询第一数据表中是否包含上述待转发报文对应的连接缓存信息;第一标识获取模块,设置为若上述第一数据表中包含上述待转发报文对应的连接缓存信息,获取上述第一数据表中上述连接缓存信息的第一标识,其中,上述第一标识为上述连接缓存信息确立时与上述连接缓存信息对应的连接标识;第二标识确定模块,设置为获取第二数据表中与上述连接缓存信息对应的连接信息,按照上述连接缓存信息对应的连接信息,确定上述连接缓存信息的第二标识,其中,上述第二标识为上述连接缓存信息当前对应的连接标识,且当上述连接信息发生变化时,上述第二标识相应改变;第一报文转发模块,设置为若上述连接缓存信息的第一标识和第二标识相同,按照上述连接缓存信息转发上述待转发报文。
在一种实施方式中,上述转发报文的装置还可以包括:连接标识获取模块,设置为获取由配置更新的设备发送的连接标识,其中,上述配置更新的设备为连接信息发生变化的报文收发设备;标识更新模块,设置为根据上述配置更新的设备发送的连接标识,更新上述第二数据表中,与上述配置更新的设备发送的连接标识对应的连接信息。
在一种实施方式中,上述转发报文的装置还可以包括:连接信息删除模块,设置为若上述连接缓存信息的第一标识和第二标识不同,删除上述第一数据表中上述待转发报文对应的连接缓存信息;第一传输路径确定模块,设置为获取上述待转发报文的目的地址,根据上述目的地址确定上述待转发报文的传输路径;第一缓存信息确定模块,设置为将上述待转发报文的传输路径作为当前的连接缓存信息,在所述第二数据表中,获取所述当前的连接缓存信息对应的连接信息,并根据所述当前的连接缓存信息对应的连接信息,确定所述当前的连接缓存信息的连接标识;第一数据表更新模块,设置为将所述当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,将当前的连接缓存信息的第一标识与当前的连接缓存信息记录在上述第一数据表中;第二报文转发模块,设置为按照上述待转发报文的传输路径,发送上述待转发报文。
在一种实施方式中,上述第一传输路径确定模块,包括:第一路径信息确定子模块,设置为若上述目的地址与上述交换机所在的地址处于同一网段,查询MAC地址表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址;第一安全组匹配子模块,设置为根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;第一设备连接子模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径。
在一种实施方式中,上述第一传输路径确定模块,包括:访问查询子模块,设置为若上述目的地址与上述交换机所在的地址不在同一网段,查询访问控制列表;第二路径信息确定子模块,设置为在上述访问控制列表允许转发上述待转发报文时,查询路由表及邻居表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址;第二安全组匹配子模块,设置为根据上述路径信息 中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;第二设备连接子模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径。
在一种实施方式中,上述第一标识获取模块,包括:key获取子模块,设置为在上述第一数据表中查询上述待转发报文的五元组对应的key,作为上述待转发报文的key;指针获取子模块,设置为获取上述第一数据表中hash哈希桶的上述待转发报文的key偏移处对应的链表头指针;标识查询子模块,设置为查询上述链表头指针链接的链表,获取上述连接缓存信息及上述连接缓存信息的第一标识。
在一种实施方式中,上述转发报文的装置还可以包括:第一目的地址获取模块,设置为若上述第一数据表中不包含上述待转发报文对应的连接缓存信息,获取上述待转发报文的目的地址,其中,上述目的地址为上述待转发报文的目标端的地址;第一传输路径确定模块,设置为若上述目的地址与当前交换机所在的地址处于同一网段,查询MAC地址表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址;第一规则匹配模块,设置为根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;第二传输路径确定模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径;第二缓存信息确定模块,设置为将上述待转发报文的传输路径作为当前的连接缓存信息;第一记录模块,设置为获取上述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在上述第一数据表中;第三报文转发模块,设置为按照上述待转发报文的传输路径,发送上述待转发报文。
在一种实施方式中,上述转发报文的装置还可以包括:第二目的地址获取模块,设置为若上述第一数据表中不包含上述待转发报文对应的连接缓存信息,获取上述待转发报文的目的地址,其中,上述目的地址为上述待转发报文的目标端的地址;控制列表查询模块,设置为若上述目的地址与当前虚 拟机所在的地址不在同一网段,查询访问控制列表;第二传输路径确定模块,设置为在上述访问控制列表允许转发上述待转发报文时,查询路由表及邻居表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址;第二规则匹配模块,设置为根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;第三传输路径确定模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径;第三缓存信息确定模块,设置为将上述待转发报文的传输路径作为当前的连接缓存信息;第二记录模块,设置为获取上述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在上述第一数据表中;第四报文转发模块,设置为按照上述待转发报文的传输路径,发送上述待转发报文。
第四方面,本申请实施例提供了一种转发报文的装置,应用于报文收发设备,该装置包括:连接信息监听模块,设置为监听与当前网络的连接信息,在与当前网络的连接信息发生变化时按照预设更新规则更新连接标识;连接标识发送模块,设置为向交换机发送更新后的连接标识,以使上述交换机根据上述连接标识更新第二数据表。
第五方面,本申请实施例提供了一种交换机,包括处理器和机器可读存储介质,上述机器可读存储介质存储有能被上述处理器执行的机器可执行指令,上述处理器被上述机器可执行指令促使:实现上述第一方面的任一方法步骤。
第六方面,本申请实施例提供了一种报文收发设备,包括处理器和机器可读存储介质,上述机器可读存储介质存储有能被上述处理器执行的机器可执行指令,上述处理器被上述机器可执行指令促使:实现上述第二方面的方法步骤。
第七方面,本申请实施例提供了一种计算机可读存储介质,上述计算机可读存储介质内存储有计算机程序,上述计算机程序被处理器执行时实现上述第一方面的任一方法步骤。
第八方面,本申请实施例提供了一种计算机可读存储介质,上述计算机 可读存储介质内存储有计算机程序,上述计算机程序被处理器执行时实现上述第二方面的方法步骤。
第九方面,本申请实施例提供了一种包含指令的计算机程序产品,当其在计算机上运行时,使得计算机执行上述第一方面任一方法步骤。
第十方面,本申请实施例提供了一种包含指令的计算机程序产品,当其在计算机上运行时,使得计算机执行上述第二方面的方法步骤。
第十一方面,本申请实施例提供了一种计算机程序,当其在计算机上运行时,使得计算机执行上述第一方面任一方法步骤。
第十二方面,本申请实施例提供了一种计算机程序,当其在计算机上运行时,使得计算机执行上述第二方面的方法步骤。
本申请实施例提供的转发报文的方法、装置、交换机、设备及存储介质,该转发报文的方法可以包括:获取待转发报文;查询第一数据表中是否包含上述待转发报文对应的连接缓存信息;若上述第一数据表中包含上述待转发报文对应的连接缓存信息,获取上述第一数据表中上述连接缓存信息的第一标识,其中,上述第一标识为上述连接缓存信息确立时,记录的与上述连接缓存信息对应的连接标识;获取第二数据表中与上述连接缓存信息对应的连接信息,按照上述连接缓存信息对应的连接信息,确定上述连接缓存信息的第二标识,其中,上述第二标识为上述连接缓存信息当前对应的连接标识,且当上述连接信息发生变化时,上述第二标识相应改变;若上述连接缓存信息的第一标识和第二标识相同,按照上述连接缓存信息转发上述待转发报文。连接缓存信息的第一标识和第二标识均相同,说明连接缓存信息未失效,按照此时的连接缓存信息转发上述待转发报文,能够减少报文转发错误。当然,实施本申请的任一产品或方法必不一定需要同时达到以上的所有优点。
为了更清楚地说明本申请实施例和现有技术的技术方案,下面对实施例和现有技术中所需要使用的附图作简单地介绍,显而易见地,下面描述中的附图仅仅是本申请的一些实施例,对于本领域普通技术人员来讲,在不付出创造性劳动的前提下,还可以根据这些附图获得其他的附图。
图1为现有技术的交换机转发报文的流程示意图;
图2为本申请实施例的应用于交换机的转发报文的方法的一种流程示意 图;
图3为本申请实施例的应用于报文收发设备的转发报文的方法的流程示意图;
图4为本申请实施例的应用于交换机的转发报文的方法的另一种流程示意图;
图5为本申请实施例的采用RCU方式删除连接缓存信息的示意图;
图6为本申请实施例的应用于交换机的转发报文的装置的示意图;
图7为本申请实施例的应用于报文收发设备的转发报文的装置的示意图。
为使本申请的目的、技术方案、及优点更加清楚明白,以下参照附图并举实施例,对本申请进一步详细说明。显然,所描述的实施例仅仅是本申请一部分实施例,而不是全部的实施例。基于本申请中的实施例,本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例,都属于本申请保护的范围。
参见图1,图1为现有技术中交换机转发报文的流程示意图,当交换机接收到报文后,首选判断该报文的目的地址与交换机的地址是否处于同一网段,即判定该报文是否为二层数据包。若处于同一网段,即为二层数据包,则查询MAC表然后匹配安全组规则并发送该报文;若该报文的目的地址与交换机的地址不在同一网段,即不是二层数据包,则需要查询ACL、路由表及邻居表等并匹配安全组规则,然后发送该报文。现有技术中,当一台设备,例如虚拟机,需要与另外一台虚拟机进行通信时,尤其是与东西向的另一台虚拟机通信时,需要查询多个转发信息表,会导致报文转发性能的明显下降。
为了加快报文转发速度,在首次转发报文后,即在报文发送端与报文接收端已经建立过通信连接之后,会将与报文对应的路径信息保存到一张快捷表中,当报文发送端与报文接收端再次通信时,直接根据快捷表中的路径信息进行转发。但是在与路径信息对应的设备的连接状态发生变更或控制平面配置变更时,会导致路径信息失效,按照失效的路径信息转发报文会造成错误,而遍历快捷表中的所有路径信息以清除失效的路径信息,尤其是在快捷表中的连接信息的数量较多时,处理时间非常长,严重影响报文的转发速度,报文转发效率低。
基于TCP(Transmission Control Protocol,传输控制协议)/UDP(User Datagram Protocol,用户数据报协议)等四层常见协议,对于安全组等有状态的防火墙,需要基于五元组信息建立相应连接表项,以保证回包在没有匹配安全组规则的情况下可以通过。本申请实施例旨在基于连接的基础上,缓存报文转发的表项信息,实现报文(数据包)的发送设备及接收设备在建立过连接的基础上,减少转发查表的耗时,将原有的数次查表处理简化为单次的查表后快速转发,实现虚拟交换机的快速传输路径,同时避免按照失效的连接信息转发报文会造成错误。
参见图2,本申请实施例提供了一种转发报文的方法,应用于交换机,该方法包括:
S201,获取待转发报文。
本申请实施例的报文转发方法应用于交换机,该交换机可以为物理交换机也可以为虚拟交换机,此处以虚拟交换机为例。即虚拟交换机接收并获取由报文收发设备发送的待转发报文。
S202,查询第一数据表中是否包含待转发报文对应的连接缓存信息。
其中,第一数据表用于记录已经建立过连接的两个报文收发设备的连接缓存信息及该连接缓存信息的第一标识。
报文对应的连接缓存信息包含该报文的传输路径,还可以包括传输路径上的各报文收发设备的标识,如ID(Identification)或IP地址等。当第一数据表中存在一连接缓存信息,使得该连接缓存信息中传输路径的报文发送设备与报文接收设备的标识,如ID或IP地址,与待转发报文中的报文发送设备与报文接收设备的标识相同时,将该连接缓存信息作为该待转发报文对应的连接缓存信息,并判定第一数据表中包含该待转发报文对应的连接缓存信息。
例如,若第一待转发报文中报文发送设备的IP地址为13,报文接收设备的IP地址为25;查询第一数据表,发现第一连接缓存信息中传输路径的报文发送设备的IP地址为13,报文接收设备的IP地址为25;则判定第一数据表中包含第一待转发报文对应的连接缓存信息,且第一待转发报文对应的连接缓存信息为第一连接缓存信息。
可选的,第一数据表中记录了连接缓存信息的五元组。若第一数据表中存在与待转发报文的五元组相同的五元组,则判定第一数据表中包含待转发 报文对应的连接缓存信息,将第一数据表中与待转发报文的五元组相同的五元组对应的连接缓存信息,作为该待转发报文对应的连接缓存信息。五元组包括源IP地址、源端口、目的IP地址、目的端口和传输层协议。通过五元组确定待转发报文对应的连接缓存信息,判定结果更加准确。
S203,若第一数据表中包含待转发报文对应的连接缓存信息,获取第一数据表中连接缓存信息的第一标识,其中,第一标识为连接缓存信息确立时与连接缓存信息对应的连接标识。
本申请实施例中的设备具体为报文收发设备,可以为物理设备也可以为虚拟设备。连接缓存信息中记录了传输路径上的各报文收发设备的标识,将与连接缓存信息中各设备的标识所对应的设备,作为与该连接缓存信息对应的各设备。第一数据表中记录了连接缓存信息的第一标识。第一标识为连接缓存信息确立时,记录的与连接缓存信息对应的连接标识。连接缓存信息的第一标识可以为与该连接缓存信息对应的各报文收发设备的第一标识。例如,在将连接缓存信息写入第一数据表时,与该连接缓存信息对应的各设备(报文收发设备)为设备1、设备2及设备3;设备1的连接标识为7,设备2的连接标识为6,设备3的连接标识为9,则该连接缓存信息的第一标识可以为7,6,9。
在公有云VPC(Virtual Private Cloud,专有网络)中,VPC支持多个用户同时使用,每个用户对应一个VXLAN(Virtual Extensible LAN,虚拟扩展局域网)标识,例如VXLAN ID,以保证相互间隔离。针对每个用户,在虚拟交换机上存储独立的数据结构,记录二层网络、三层网络的连接缓存信息。因此连接缓存信息的第一标识还可以为与该连接缓存信息对应的各用户的第一标识。例如,在将连接缓存信息写入第一数据表时,与该连接缓存信息对应的各用户为用户1与用户2,用户1的连接标识为1,用户2的连接标识为8;则该连接缓存信息的第一标识可以为1,8。
S204,获取第二数据表中与连接缓存信息对应的连接信息,按照连接缓存信息对应的连接信息,确定连接缓存信息的第二标识,其中,第二标识为连接缓存信息当前对应的连接标识,且当连接信息发生变化时,第二标识相应改变。
第二标识为连接缓存信息当前的连接标识,且当连接缓存信息的连接信息发生变化时,连接信息发生变化的连接缓存信息当前的连接标识,按照预 设变更规则相应改变。第二数据表中记录了与连接缓存信息对应的连接信息;与连接缓存信息对应的连接信息,可以为与该连接缓存信息对应的各报文收发设备的连接标识,也可以为与该连接缓存信息对应的各用户的连接标识。连接缓存信息的第二标识为该连接缓存信息当前的连接标识。与连接缓存信息对应的连接信息发生改变时,该连接缓存信息的第二标识也会按照预设变更规则相应改变。预设变更规则为任意能够实现第二标识变更的规则。
例如,与连接缓存信息对应的设备(报文收发设备)为设备1、设备2、设备3及设备4;设备1的连接标识为11,设备2的连接标识为11,设备3的连接标识为9,设备4的连接标识为13,则确定该连接缓存信息当前的第二标识为11,11,9,13。若设备2的连接信息发生改变,设备2的连接标识更新为12,相应的该连接缓存信息的第二标识变更为11,12,9,13。
例如,与连接缓存信息对应的用户为用户1与用户2,用户1的连接标识为6,用户2的连接标识为13;则确定该连接缓存信息当前的第二标识为6,13。若用户1的连接信息发生改变,用户1的连接标识更新为7,相应的该连接缓存信息第二标识变更为7,13。
S205,若连接缓存信息的第一标识和第二标识相同,按照连接缓存信息转发待转发报文。
例如,连接缓存信息的第一标识为11,9,13;该连接缓存信息的第二标识为11,9,13。则连接缓存信息的第一标识和第二标识相同,按照连接缓存信息中的传输路径转发待转发报文。
在本申请实施例中,连接缓存信息的第一标识和第二标识相同,说明连接缓存信息未失效,按照此时的连接缓存信息转发待转发报文,实现待转发报文的快路径的转发,能够避免报文转发失败,报文转发效率高。
交换机中额外存储了2张数据表:第一数据表和第二数据表。
第一数据表中用于记录连接缓存信息,连接缓存信息是在两个报文收发设备首次通信时建立的,连接缓存信息中包含报文收发设备间的报文传输路径,及连接缓存信息的第一标识(连接缓存信息的第一标识,表征报文传输路径中各设备的连接信息,例如报文传输路径上包括设备1设备2及设备3共三个设备,通信建立时,设备1连接信息的连接标识为7,设备2连接信息的连接标识为6,设备3连接信息的连接标识为9,则连接缓存信息的第一标识为7,6,9)
第二数据表中记录了各报文收发设备的连接信息,该连接信息为报文收发设备实时的连接信息(在报文收发设备的连接信息发生变化后,报文收发设备主动上报变化后的连接信息)。
在交换机转发报文时,从第一数据表中获取报文对应的连接缓存信息(按照报文的收、发设备确定,不包含时走如图1所示的查询路径),获取报文对应的连接缓存信息的第一标识。在第二数据表中获取报文对应的连接缓存信息的连接信息(连接缓存信息记录的报文传输路径上各设备的连接信息),按照连接信息,确定连接缓存信息的第二标识。
若连接缓存信息的第一标识和第二标识相同,说明连接缓存信息未失效,按照此时的连接缓存信息转发待转发报文,实现待转发报文的快路径的转发,能够避免报文转发失败。若连接缓存信息的第一标识和第二标识不同,说明连接缓存信息失效,需要按照图1所示的方法重新确定报文发送路径,并更新第一数据表中的连接缓存信息。
可选的,在本申请实施例的转发报文的方法中,第一数据表与第二数据表存储在缓存中。将第一数据表与第二数据表以缓存的形式进行存储,读取速度快,报文转发速度快,效率高。
可选的,本申请实施例的转发报文的方法还包括:
步骤一,获取由配置更新的设备发送的连接标识,其中,配置更新的设备为连接信息发生变化的报文收发设备。
在报文收发设备检测到自身的连接信息发生变化时,该设备会按照预设更新规则更新连接标识。报文收发设备检测到自身的连接信息发生变化,是指报文收发设备检测到影响报文收发的配置的变更,例如,报文收发设备的地址发生变更,报文收发设备的安全组规则发生变更,或报文收发设备对应的交换机接口发生变更,又例如,在公有云VPC中,控制平面配置发生变更,报文收发设备负责的用户的业务发生迁移等。
步骤二,根据配置更新的设备发送的连接标识,更新第二数据表中,与配置更新的设备发送的连接标识对应的连接信息。
在第二数据表中,将与配置更新的设备发送的连接标识对应的连接信息中的,设备的连接标识的值或用户的连接标识的值,更新为配置更新的设备发送的连接标识的值。例如,虚拟交换机接收到有设备1发送的设备1的连接标识为3的报文,虚拟交换机将第二数据表的连接信息中的设备1的连接标识 更新为3。又例如,虚拟交换机接收到有设备1发送的用户4的连接标识为3的报文,虚拟交换机将第二数据表的连接信息中的用户4的连接标识更新为3。
在本申请实施例中,根据连接标识更新第二数据表中相应的连接信息,能够保证第二数据表中记录的各连接信息,与各设备当前实际的连接信息相同,从而避免报文转发失败。
可选的,在获取第二数据表中与连接缓存信息对应的连接信息,按照连接缓存信息对应的连接信息,确定连接缓存信息的第二标识之后,该方法还包括:
步骤一,若连接缓存信息的第一标识和第二标识不同,删除第一数据表中待转发报文对应的连接缓存信息。
例如,连接缓存信息的第一标识为9,11;该连接缓存信息的第二标识为11,11。则在第一数据表中删除该连接缓存信息。当同一连接缓存信息的第一标识与第二标识不同时,说明该连接缓存信息已经失效,继续按照该连接缓存信息发送报文的话,会造成报文发送失败。在第一数据表中删除失效的连接缓存信息,后续不再根据该连接缓存信息转发报文,能够防止报文转发失败。
步骤二,获取待转发报文的目的地址,根据目的地址确定待转发报文的传输路径,其中,目的地址为待转发报文的目标端的地址。
在连接缓存信息失效时,虚拟交换机需要查询MAC表或路由表等,以确定待转发报文的传输路径。
步骤三,将待转发报文的传输路径作为当前的连接缓存信息,在第二数据表中,获取当前的连接缓存信息对应的连接信息,并根据当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识。
虚拟交换机在第二数据表中获取当前的传输路径及当前的传输路径上的各报文收发设备的标识,作为当前的连接缓存信息的连接标识。
步骤四,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,将当前的连接缓存信息的第一标识与当前的连接缓存信息记录在第一数据表中。
虚拟交换机将将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,并在第一数据表中写入当前的连接缓存信息与当前的连接缓 存信息的第一标识。一般情况下,连接信息发生变更是由于用户业务的迁移,例如,由于当前服务器负载过高,将用户业务迁移到二层网络的其他服务器中,在此种情况下,将当前的连接缓存信息的连接标识即为被删除的连接缓存信息的第二标识,可以将被删除的连接缓存信息的第二标识,作为当前的连接缓存信息的第一标识,记录在第一数据表中。
步骤五,按照待转发报文的传输路径,发送待转发报文。
虚拟交换机通过传输路径标识的接口,向传输路径标识的下一跳接收待转发报文的设备发送该待转发报文。
在连接信息发生变更,如增设或减少报文收发设备,变更安全组规则,变更报文收发设备的接口或地址等,或控制平面配置变更时,如将用户A的报文转发服务由虚拟交换机A迁移到虚拟交换机B上,会造成连接缓存信息失效。在连接缓存信息的第一标识与第二标识不同时,删除该连接缓存信息,并通过查询MAC表或路由表等,确定待转发报文的传输路径。相比于每次检测到设备的连接信息变更,遍历第一数据表中的所有连接缓存信息,以清除失效的连接缓存信息,可以大大增加报文的转发速度,尤其是在第一数据表中的连接缓存信息达百万级时,遍历的处理时间将非常长,严重影响控制平面命令下发的处理时间,采用本申请实施例的判定第一标识与第二标识的方法,可以大大提升报文的转发效率。
在本申请实施例中,给出了在连接缓存信息失效的情况下,报文的转发方法,同时还给出了新的连接缓存信息的建立方法,以方便后续根据新的连接缓存信息转发报文,以提高报文的转发速度,报文转发效率高。
可选的,获取待转发报文的目的地址,根据目的地址确定待转发报文的传输路径,包括:
步骤一,若目的地址与当前交换机所在的地址处于同一网段,查询MAC地址表,确定待转发报文的路径信息,其中,路径信息包括转发地址,转发地址为下一跳接收待转发报文的设备的地址。
在OSI模型(Open System Interconnection,开放式通信***互联参考模型)中,第二层数据链路层基于MAC地址,每个第二层数据链路层中每个主机或虚拟机会有一个固定的MAC地址。MAC地址表中记录了不同MAC地址与接口的对应情况,通过查询MAC地址表,确定与待转发报文中目的地址相对应的接口,以确定待转发报文的传输路径信息。
步骤二,根据路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则。
虚拟交换机将路径信息中的转发地址对应的设备,作为需要进行安全组规则匹配的设备,通过与该转发地址对应的接口,向需要进行安全组规则匹配的设备发送报文,以匹配安全组规则。
步骤三,在匹配安全组规则成功时,将安全组规则匹配成功的设备作为待转发报文的发送对象,以确定待转发报文的传输路径。
安全组规则用于保护各报文收发设备的信息安全,只有在安全组规则匹配成功时,从能够建立设备间的通信连接。在设备间安全组规则匹配失败时,设备间禁止建立通信。安全组规则根据实际情况进行设定,可以为基于身份的安全策略、基于规则的安全策略或基于角色的安全策略等。匹配安全组规则成功,是指待转发报文的指定信息符合预设的规则,例如待转发报文的源IP地址处于指定的地址段,则认为匹配安全组规则成功。
在本申请实施例中,给出了基于MAC地址的报文转发方法,实现第二层数据链路层中报文的转发。
可选的,获取待转发报文的目的地址,根据目的地址确定待转发报文的传输路径,包括:
步骤一,若目的地址与当前交换机所在的地址不在同一网段,查询访问控制列表。
在OSI模型中,当目的地址与当前虚拟机所在的地址不在同一网段时,需要对报文进行第三层网络层的转发。虚拟交换机查询ACL(Access Control List,访问控制列表),确定是否允许该待转发报文的发送设备,访问该待转发报文的接收设备,即是否允许待转发报文的转发。当然通过查询ACL还可以确定待转发报文转发的优先级等。
步骤二,在访问控制列表允许转发待转发报文时,查询路由表及邻居表,确定待转发报文的路径信息,其中,路径信息包括转发地址,转发地址为下一跳接收待转发报文的设备的地址。
路由表中记录了从当前虚拟交换机,到达其他特定网络终端,如除当前虚拟交换机外的其他交换机或路由器等,的路径。邻居表中记录了当前虚拟交换机与邻居交换机(通信距离为1跳的交换机)的各个接口的对应情况。当前虚拟交换机首先通过查询路由表确定下一跳接收待转发报文的交换机, 然后查询邻居表,确定与下一跳接收待转发报文的交换机通信的接口,从而确定了待转发报文的路径信息。
步骤三,根据路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则。
步骤四,在匹配安全组规则成功时,将安全组规则匹配成功的设备作为待转发报文的发送对象,以确定待转发报文的传输路径。
在本申请实施例中,给出了基于路由表及邻居表的报文转发方法,实现第三层网络层中报文的转发。
可选的,获取第一数据表中连接缓存信息的第一标识,包括:
步骤一,在第一数据表中查询待转发报文的五元组对应的key,作为待转发报文的key。
在本申请实施例中,第一数据表采用hash桶(哈希桶)的方式实现,通过待转发报文的五元组,得到相应的hash桶的key。五元组包括源IP地址、源端口、目的IP地址、目的端口和传输层协议。相应的hash桶中也存储了源IP地址、源端口、目的IP地址、目的端口和传输层协议等信息,并且hash桶中还存储了与连接缓存信息相对应的key。
步骤二,获取第一数据表中hash桶的待转发报文的key偏移处对应的链表头指针。
步骤三,查询链表头指针链接的链表,获取连接缓存信息及连接缓存信息的第一标识。
链表头指针链接的链表中记录了该链表对应的连接缓存信息,及该连接缓存信息的第一标识。链表对应的连接缓存信息是指五元组与该链表对应的hash桶中的五元组相同的连接缓存信息。
在本申请实施例中,给出了第一数据表中查询连接缓存信息及设备的第一标识的方法,通过hash桶查找连接缓存信息及设备的第一标识,寻找准确,查询效率高。
可选的,在本申请实施例一种可能的实施方式中,针对每个hash桶设置一个读写锁。
针对每个hash桶维护一个读写锁,读写锁允许多个进程同时读取一个hash桶,但是最多同时允许一个进程对hash桶进行写入操作,且读写锁不允许对一个hash桶同时进行读取和写入操作。
在本申请实施例中,针对每个hash桶设置一个读写锁,能够适用于多核并发情况,并且保证读写锁的粒度足够小,每个读写锁仅负责一个hash桶,不同的流不会触发锁等待。
可选的,在删除第一标识与第二标识不同的连接缓存信息时,使用Read-Copy Update方式处理,以保证数据平面在处理完本次待转发报文前数据结构不会释放。
在本申请实施例中,使用Read-Copy Update方式处理,在当前的连接缓存信息更新完成前,原连接缓存信息不会被删除,防止虚拟交换机因访问已经删除的数据而导致***崩溃。
可选的,在查询第一数据表中是否包含待转发报文对应的连接缓存信息之后,该方法还包括:
步骤一,若第一数据表中不包含待转发报文对应的连接缓存信息,获取待转发报文的目的地址,其中,目的地址为待转发报文的目标端的地址。
步骤二,若目的地址与当前交换机所在的地址处于同一网段,查询MAC地址表,确定待转发报文的路径信息,其中,路径信息包括转发地址,转发地址为下一跳接收待转发报文的设备的地址。
步骤三,根据路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则。
步骤四,在匹配安全组规则成功时,将安全组规则匹配成功的设备作为待转发报文的发送对象,以确定待转发报文的传输路径。
步骤五,将待转发报文的传输路径作为当前的连接缓存信息。
步骤六,获取第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在第一数据表中。
其中,当前的连接缓存信息的连接标识,即当前的连接缓存信息的第二标识。
步骤七,按照待转发报文的传输路径,发送待转发报文。
在本申请实施例中,给出了基于MAC地址的报文转发方法,实现第二层数据链路层中基于MAC地址的慢路径的报文转发。
可选的,在查询第一数据表中是否包含待转发报文对应的连接缓存信息 之后,该方法还包括:
步骤一,若第一数据表中不包含待转发报文对应的连接缓存信息,获取待转发报文的目的地址,其中,目的地址为待转发报文的目标端的地址。
步骤二,若目的地址与当前虚拟机所在的地址不在同一网段,查询访问控制列表。
步骤三,在访问控制列表允许转发待转发报文时,查询路由表及邻居表,确定待转发报文的路径信息,其中,路径信息包括转发地址,转发地址为下一跳接收待转发报文的设备的地址。
步骤四,根据路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则。
步骤五,在匹配安全组规则成功时,将安全组规则匹配成功的设备作为待转发报文的发送对象,以确定待转发报文的传输路径。
步骤六,将待转发报文的传输路径作为当前的连接缓存信息。
步骤七,获取第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在第一数据表中。
其中,当前的连接缓存信息的连接标识,即当前的连接缓存信息的第二标识。
步骤八,按照待转发报文的传输路径,发送待转发报文。
在本申请实施例中,给出了基于路由表及邻居表的报文转发方法,实现第三层网络层中基于IP地址的慢路径的报文转发。
可选的,针对SR-IOV(Single-root I/O Virtualization,单根I/O虚拟化)等技术方案,本申请实施可以将连接缓存信息下发至各收发报文的虚拟机对应的网卡,以实现网卡层面的快速转发,此时虚拟交换机变更为转发规则生成器。虚拟交换机将第一数据表及第二数据表中的内容下发至报文收发虚拟机所在的宿主机的网卡。对于支持SR-IOV配置流(报文流)转发的网卡,在记录连接缓存信息时,可以生成双向的两条规则调用物理网卡提供的流规则(传输规则)下发接口,后续数据包将直接在网卡完成转发。当待转发报文到达宿主机的网卡时,网卡根据第一数据表及第二数据表,利用上述转发报文的方法转发待转发报文,例如网卡获取待转发报文,查询第一数据表中是 否包含上述待转发报文对应的连接缓存信息;若上述第一数据表中包含上述待转发报文对应的连接缓存信息,网卡获取上述第一数据表中上述连接缓存信息的第一标识;网卡获取第二数据表中与上述连接缓存信息相关的连接信息,确定上述连接缓存信息的第二标识;若上述连接缓存信息的第一标识和第二标识相同,网卡按照上述连接缓存信息转发上述待转发报文。当网卡流规则不匹配时,再上发至虚拟交换机进行处理。通过网卡直接转发报文,实现物理层面转发,能够进一步加快报文的转发速度。
本申请实施例中,以网卡、虚拟交换机的快路径、虚拟交换机的慢路径的三种转发方式,进一步加快报文转发速率,从而解决当前虚拟机基于virtio(virtio是半虚拟化Hypervisor中位于设备之上的抽象层)的虚拟网卡驱动转发性能过低,以及基于SR-IOV的网卡Virtual Function(虚函数)直通虚拟机内部导致虚拟交换机无法控制报文处理的问题。
参见图3,本申请实施提供了一种转发报文的方法,应用于报文收发设备,该方法包括:
S301,监听与当前网络的连接信息,在与当前网络的连接信息发生变化时按照预设更新规则更新连接标识。
与当前网络的连接信息发生变化,是指报文收发设备检测到影响报文收发的配置的变更,例如,报文收发设备的地址发生变更,报文收发设备的安全组规则发生变更,或报文收发设备对应的交换机接口发生变更,又例如,在公有云VPC中,控制平面配置发生变更,报文收发设备负责的用户的业务发生迁移等。
预设更新规则为任意能够不重复的更新连接标识的规则。例如,将各报文收发设备或用户的连接标识的初始值设定为1,每次报文收发设备检测到自身的连接信息发生变化时,便在当前的连接标识的基础上,将数值增加1,得到更新后的连接标识。每次报文收发设备的连接信息变更后,其连接标识均会发生改变,便于交换机识别报文收发设备的当前状态,防止交换机错误更新第二数据表。
在报文收发设备检测到自身与当前网络的连接信息发生变化时,该报文收发设备会按照预设更新规则更新相应的连接标识。例如,报文收发设备1的连接标识为3,当报文收发设备1检测到自身的安全组规则发生变更时,报文收发设备1将报文收发设备1的连接标识更新为4。又例如,报文收发设备 1服务的用户3的连接标识为2,当用户3的服务迁移到报文收发设备2时,报文收发设备1将用户3的连接标识更新为3。
S302,向交换机发送更新后的连接标识,以使交换机根据连接标识更新第二数据表。
例如,报文收发设备1向虚拟交换机发送报文收发设备1的连接标识更新为4的信息,虚拟交换机接收该信息后,将第二数据表的连接信息中报文发设备1的连接标识更新为4。又例如,报文收发设备1向虚拟交换机发送用户3的连接标识更新为3的信息,虚拟交换机接收该信息后,将第二数据表的连接信息中用户3的连接标识更新为3。
可选的,下面对本申请实施例的应用于报文收发设备的转发报文的方法进行举例说明。对于报文收发设备A,服务于用户B,其连接标识为user_age=7;当用户B中断服务后,报文收发设备A服务于用户C,则报文收发设备A更新连接标识为user_age=8,报文收发设备A在向虚拟交换机发送报文时,将user_age=8添加到该报文中,以使虚拟交换机在接收到该报文后,更新第二数据表中报文收发设备A的连接标识。
在本申请实施例中,当报文收发设备的连接信息发生改变时,更新连接标识,并向交换机发送更新后的连接标识,以使交换机根据连接标识更新第二数据表,后续交换机根据第一数据表及第二数据表发送待转发报文,能够避免报文转发失败,报文转发效率高。
可选的,向交换机发送更新后的连接标识,包括:
每次向交换机发送待转发报文时,将更新后的连接标识加入到待转发报文中。
每次发送待转发报文时,将当前的连接标识加入到待转发报文中,相比于报文收发设备每次更新连接标识后单独发送连接标识,可以节约信令负载;
可选的,向交换机发送更新后的连接标识,包括:
每次更新连接标识后,即时向交换机发送更新后的连接标识。
报文收发设备每次改变连接标识后,即时向虚拟交换机发送当前的连接标识,相比于将连接标识加入到待转发报文中,可以保证第二数据表记录的连接信息中的连接标识与真实的连接标识强一致性,避免因延时造成待转发报文的转发失败。
参见图4,图4为本申请实施例的应用于交换机的转发报文的方法的另一 种流程示意图,包括:
S401,虚拟交换机接收报文。
虚拟交换机为公有云VPC技术中的核心组件,负责虚拟机的隔离,网络中第二、三层报文的转发,及安全处理等功能。目前VPC技术有多种方案隔离方案,其中以VXLAN(Virtual Extensible LAN)最为普遍,VXLAN报文在原有内层报文的基础上封装UDP和VXLAN头,以在underlay网络上实现自然的第三层路由转发。在接收报文时,虚拟交换机作为VXLAN的终结点,会解封收到的VXLAN报文,并根据相应转发表项,将报文转发给虚拟机;当虚拟机向外发送报文时,虚拟交换机获取虚拟机发送的报文,并封装VXLAN报文,然后查询路由并对外发出,因此在underlay网络上交互的报文都是封装的。
公有云VPC(Virtual Private Cloud,专有网络)支持多个用户同时使用,每个用户对应一个VXLAN标识,例如VXLAN ID,以保证相互间隔离。针对每个用户,在虚拟交换机上存储独立的数据结构,记录第二层连接缓存信息及第三层连接缓存信息,根据收到的报文进行第二层数据链路层基于MAC地址的FDB(Forwarding Data Base)转发或进行第三层网络层查找路由邻居转发。
S402,虚拟交换机查询是否包含与该报文对应的连接缓存信息,若包含该报文对应的连接缓存信息,则执行步骤S403;若不包含该报文对应的连接缓存信息,则执行步骤S405。
虚拟交换机根据报文的五元组,在第一数据表中查询待转发报文的五元组对应的key,作为待转发报文的key;获取第一数据表中hash桶的待转发报文的key偏移处对应的链表头指针;查询链表头指针链接的链表,获取连接缓存信息及连接缓存信息的conn_age(此处conn_age即为第一标识)。连接缓存信息中包含报文的传输路径。虚拟交换机能够在第一数据表中找到报文对应的连接缓存信息,则判定包含该报文对应的连接缓存信息;虚拟交换机不能够在第一数据表中找到报文对应的连接缓存信息,则判定不包含该报文对应的连接缓存信息。
连接缓存信息的conn_age为该连接缓存信息建立时,该连接缓存信息对应的用户的thread_age(此处thread_age即为第二标识)。在公有云VPC环境下,针对每个用户维护一个user_age(此处user_age即为连接标识),报文收 发设备,例如虚拟机,在发送报文时,将用户的user_age加入到报文中。虚拟交换机接收报文时,读取用户的user_age,将该用户的thread_age的值更新为该用户user_age的值。
第一数据表采用hash桶(哈希桶)的方式实现,各hash桶中存储了已成功转发过的报文的五元组及相应的key,key偏移处对应链表头指针,链表头指针连接链表,链表中记录了连接缓存信息及与连接缓存信息对应的各设备的第一标识。针对每个hash桶维护一个读写锁,读写锁允许多个进程同时读取一个hash桶,但是最多同时允许一个进程对hash桶进行写入操作,且读写锁不允许对一个hash桶同时进行读取和写入操作。读写锁能够适用于多核并发情况,并且保证读写锁的粒度足够小,每个读写锁仅负责一个hash桶,不同的流不会触发锁等待。
S403,虚拟交换机获取与连接缓存信息对应的thread_age与conn_age,判定该连接缓存信息的conn_age与thread_age是否相同,若不同则执行S404,若相同则执行S412。
虚拟交换机查询缓存的第二数据表,第二数据表中记录了各用户的标识以及每个用户各自对应的thread_age。第二数据表可以为hash表,也可以为列数据等。
第二数据表中的thread_age是根据报文收发设备发送的user_age维护的。在公有云VPC环境下,针对每个用户维护一个user_age,当有影响用户的连接缓存信息的配置更新时,增加该用户的user_age的值,由此通知数据平面配置有变动。报文收发设备在发送报文时,将用户的user_age加入到报文中。数据平面中的虚拟交换机接收报文时,读取用户的user_age,若用户的user_age的值与该用户的thread_age的值不同,则将该用户的thread_age的值更新为该用户的user_age的值。报文收发设备将user_age加入到需要发送的报文中,相比与专门发送user_age,可以节约信令负载。
S404,删除该连接缓存信息。
若连接缓存信息的第一标识与第二标识不同,说明该连接缓存信息已经失效,继续按照该连接缓存信息发送报文,会造成报文发送失败,因此需要删除该连接缓存信息。
可选的,在删除第一标识与第二标识不同的连接缓存信息时,使用RCU(Read-Copy Update)方式处理,以保证数据平面在处理完本次待转发报文前 数据结构不会释放。使用RCU方式,在当前的连接缓存信息更新完成前,原连接缓存信息不会被删除,防止虚拟交换机因访问已经删除的数据而导致***崩溃。
例如,参见图5,图5为本申请实施例的采用RCU方式删除连接缓存信息的示意图。在转发报文时,当连接建立后(报文转发完成后),保存连接缓存信息及当前用户的conn_age=1。然后,虚拟交换机收到第一报文,读取第一报文中当前用户的user_age=1,记录当前用户的thread_age=1;因为发生配置变更,更新用户的user_age=2,此时虚拟交换机收到第二报文,第二报文中当前用户的user_age=2。对于第一报文,比较thread_age与conn_age是否相同,conn_age=thread_age,可以进行快转,即虚拟交换机根据缓存中的连接缓存信息进行转发。读取第二报文中当前用户的user_age=2,相应的更新当前用户的thread_age=2,比较thread_age与conn_age是否相同,对于第二报文conn_age不等于thread_age。因此需要删除缓存中的连接缓存信息,需要进行慢转,即虚拟交换机重新查找MAC表或路由表等转发表进行转发。但是对于第一报文,此时虚拟交换机正在读取缓存中的连接缓存信息,若此时释放该连接缓存信息,虚拟交换机会因为读取已释放的内存而导致***崩溃。因此采用RCU方式,在新的连接缓存信息建立前,缓存不会释放当前的连接缓存信息。对于第一报文按照当前的连接缓存信息进行报文的快路径转发,对于第二报文查找MAC地址表或路由表等进行报文的慢路径转发,建立新的连接缓存信息,记录当前用户的conn_age=2。
通过RCU方式,及结合conn_age、thread_age和user_age转发报文的方案保证报文转发过程中,数据平面和控制平面连接缓存信息更新的同步。
S405,查询报文的源地址与目的地址是否在同一网段,若报文的源地址与目的地址在同一网段执行S406,若报文的源地址与目的地址不在同一网段执行S407。
在OSI模型中,第二层数据链路层基于MAC地址,第三次网络层基于IP地址。报文的源地址与目的地址在同一网段,报文进行第二层数据链路层的转发;报文的源地址与目的地址不在同一网段,报文进行第三层网络层的转发。
S406,查询MAC地址表,确定报文的传输路径,然后执行S410。
MAC地址表具体为FDB地址表,FDB地址表维护与虚拟交换机通信的 各报文收发设备的MAC地址。通过查询MAC地址,可以确定下一跳的接收报文设备,及虚拟交换机与下一跳的接收报文设备间通信的接口。
S407,查询ACL。
ACL是路由器与交换机接口的指令列表,用来控制接口进出的报文。虚拟交换机通过查询ACL确定是否允许该报文的发送设备,访问该报文的接收设备,即是否允许报文的转发。当然通过查询ACL还可以确定待转发报文转发的优先级等。
S408,查询路由表。
路由表中记录了从当前虚拟交换机,到达其他特定网络终端的路径。虚拟交换机通过查询路由表,确定转发报文的路径。
S409,查询邻居表,确定报文的传输路径。
邻居表中记录了当前虚拟交换机与邻居交换机(通信距离为1跳的交换机)的各个接口的对应情况。虚拟交换机查询邻居表,确定下一跳接收报文的设备的接口,以而确定报文的传输路径。
S410,匹配安全组规则。
安全组规则用于保护各报文收发设备的信息安全,只有在安全组规则匹配成功时,从能够建立设备间的通信连接。在设备间安全组规则匹配失败时,设备间禁止建立通信。
对于每个虚拟机,可以关联相应的安全组,同一安全组内各虚拟机之间相互可信,可以直接通信。不通过安全组中的虚拟机相互通信,或虚拟机访问公网时,会匹配安全组规则。当匹配安全组规则成功时,建立通信连接以保证回包可以直接转发。对于每个第二层子网,还可以关联ACL规则,实现无状态的规则匹配,当报文需要跨子网传输时,匹配ACL规则。通过设置安全组及ACL实现两个层次的安全限制保护。
S411,记录连接缓存信息。
在确定报文的传输路径且安全规则匹配成功后,虚拟交换机缓存与该报文对应的连接缓存信息。连接缓存信息包括传输路径,及conn_age,连接缓存信息中还可以包括五元组等信息。
S412,根据报文的传输路径,发送该报文。
在本申请实施例中,连接缓存信息的第一标识和第二标识相同,说明连接缓存信息未失效,按照此时的连接缓存信息转发待转发报文,实现待转发 报文的快路径的转发,能够避免报文转发失败。相比于每次检测到连接信息变更,遍历第一数据表中的所有连接缓存信息,以清除失效的连接缓存信息,可以大大增加报文的转发速度,尤其是在第一数据表中的连接缓存信息达百万级时,遍历的处理时间将非常长,严重影响控制平面命令下发的处理时间,采用本申请实施例的判定第一标识与第二标识的方法,可以大大提升报文的转发效率。报文转发效率高。
目前针对于虚拟交换机而言,主要存在自研虚拟交换机和OVS(Open Vswitch,开源虚拟交换机)两种方案。针对自研虚拟交换机方案,转发一条虚拟机交互的报文至少要经过两个以上的查表操作,浪费时间。相对于数据平面,控制平面的变更较少。对于同一条流,在同样的配置下每次查表得到的结果都是相同的。在多数场景下,都需要匹配安全组并建立连接,本申请将连接创建提前到收包时的首次处理,在转发报文时先查找是否存在对应的连接,若存在则按照连接缓存信息转发报文,避免再次查询路由表等,提升报文的转发效率。对于OVS方案,报文首包在内核状态未匹配时,会上送用户态,导致首包存在内核态与用户态的切换,并且OVS方案整体过于臃肿,不利于公有云环境快速变化的需求迭代。本申请实施例中的转发报文的方法,包括自研虚拟交换机方案和OVS方案的优点,逻辑架构简单清晰,易于调整变更,减少了首包的处理延时,加快了后续报文的转发速度。
当然本申请实施例中的转发报文的方法可以应用到OVS方案中,OVS在接收到报文后,查询是否存在该报文相应的连接缓存信息,当存在该报文相应的连接缓存信息,且该连接缓存信息相应的第一标识与第二标识相同时,按照该连接缓存信息发送报文;否则上送用户态,按照现有的OVS方案发送报文,并在报文发送完成后,生成并记录连接缓存信息。本申请实施例中给出了OVS方案中转发报文的方法,能够减少转发报文的错误。
参见图6,本申请实施例提供了一种转发报文的装置,应用于交换机,可以包括:
报文获取模块601,设置为获取待转发报文。
查询模块602,设置为查询第一数据表中是否包含待转发报文对应的连接缓存信息。
第一标识获取模块603,设置为若第一数据表中包含待转发报文对应的连接缓存信息,获取第一数据表中连接缓存信息的第一标识,其中,第一标识 为连接缓存信息确立时与连接缓存信息对应的连接标识。
第二标识确定模块604,设置为获取第二数据表中与连接缓存信息对应的连接信息,按照连接缓存信息对应的连接信息,确定连接缓存信息的第二标识,其中,第二标识为连接缓存信息当前对应的连接标识,且当连接信息发生变化时,第二标识相应改变。
第一报文转发模块605,设置为若连接缓存信息的第一标识和第二标识相同,按照连接缓存信息转发待转发报文。
在本申请实施例中,连接缓存信息的第一标识和第二标识相同,说明连接缓存信息未失效,按照此时的连接缓存信息转发待转发报文,实现待转发报文的快路径的转发,能够避免报文转发失败,报文转发效率高。
可选的,本申请实施例的转发报文的装置还包括:
连接标识获取模块,设置为获取由配置更新的设备发送的连接标识,其中,上述配置更新的设备为连接信息发生变化的报文收发设备。
标识更新模块,设置为根据上述配置更新的设备发送的连接标识,更新上述第二数据表中,与上述配置更新的设备发送的连接标识对应的连接信息。
在本申请实施例中,根据连接标识更新第二数据表中相应的连接信息,能够保证第二数据表中记录的各连接信息,与各设备当前实际的连接信息相同,从而避免报文转发失败。
可选的,本申请实施例的转发报文的装置还包括:
连接信息删除模块,设置为若上述连接缓存信息的第一标识和第二标识不同,删除上述第一数据表中上述待转发报文对应的连接缓存信息。
第一传输路径确定模块,设置为获取上述待转发报文的目的地址,根据上述目的地址确定上述待转发报文的传输路径。
第一缓存信息确定模块,设置为将上述待转发报文的传输路径作为当前的连接缓存信息,在第二数据表中,获取当前的连接缓存信息对应的连接信息,并根据当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识。
第一数据表更新模块,设置为将将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,将当前的连接缓存信息的第一标识与当前的连接缓存信息记录在上述第一数据表中。
第二报文转发模块,设置为按照上述待转发报文的传输路径,发送上述 待转发报文。
在本申请实施例中,给出了在连接缓存信息失效的情况下,报文的转发方法,同时还给出了新的连接缓存信息的建立方法,以方便后续根据新的连接缓存信息转发报文,以提高报文的转发速度,报文转发效率高。
可选的,第一传输路径确定模块,包括:
第一路径信息确定子模块,设置为若上述目的地址与上述交换机所在的地址处于同一网段,查询MAC地址表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址。
第一安全组匹配子模块,设置为根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则。
第一设备连接子模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径。
在本申请实施例中,给出了基于MAC地址的报文转发方法,实现第二层数据链路层中报文的转发。
可选的,第一传输路径确定模块,包括:
访问查询子模块,设置为若上述目的地址与上述交换机所在的地址不在同一网段,查询访问控制列表。
第二路径信息确定子模块,设置为在上述访问控制列表允许转发上述待转发报文时,查询路由表及邻居表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址。
第二安全组匹配子模块,设置为根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则。
第二设备连接子模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径。
在本申请实施例中,给出了基于路由表及邻居表的报文转发方法,实现第三层网络层中报文的转发。
可选的,第一标识获取模块,包括:
key获取子模块,设置为在上述第一数据表中查询上述待转发报文的五元组对应的key,作为上述待转发报文的key。
指针获取子模块,设置为获取上述第一数据表中hash哈希桶的上述待转发报文的key偏移处对应的链表头指针。
标识查询子模块,设置为查询上述链表头指针链接的链表,获取上述连接缓存信息及上述连接缓存信息的第一标识。
在本申请实施例中,给出了第一数据表中查询连接缓存信息及设备的第一标识的方法,通过hash桶查找连接缓存信息及设备的第一标识,寻找准确,查询效率高。
可选的,本申请实施例的转发报文的装置还包括:
第一目的地址获取模块,设置为若上述第一数据表中不包含上述待转发报文对应的连接缓存信息,获取上述待转发报文的目的地址,其中,上述目的地址为上述待转发报文的目标端的地址。
第一传输路径确定模块,设置为若上述目的地址与当前交换机所在的地址处于同一网段,查询MAC地址表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址。
第一规则匹配模块,设置为根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则。
第二传输路径确定模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径。
第二缓存信息确定模块,设置为将上述待转发报文的传输路径作为当前的连接缓存信息。
第一记录模块,设置为获取上述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在上述第一数据表中。
第三报文转发模块,设置为按照上述待转发报文的传输路径,发送上述待转发报文。
在本申请实施例中,给出了基于MAC地址的报文转发方法,实现第二层 数据链路层中基于MAC地址的慢路径的报文转发。
可选的,本申请实施例的转发报文的装置还包括:
第二目的地址获取模块,设置为若上述第一数据表中不包含上述待转发报文对应的连接缓存信息,获取上述待转发报文的目的地址,其中,上述目的地址为上述待转发报文的目标端的地址。
控制列表查询模块,设置为若上述目的地址与当前虚拟机所在的地址不在同一网段,查询访问控制列表。
第二传输路径确定模块,设置为在上述访问控制列表允许转发上述待转发报文时,查询路由表及邻居表,确定上述待转发报文的路径信息,其中,上述路径信息包括转发地址,上述转发地址为下一跳接收上述待转发报文的设备的地址。
第二规则匹配模块,设置为根据上述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则。
第三传输路径确定模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为上述待转发报文的发送对象,以确定上述待转发报文的传输路径。
第三缓存信息确定模块,设置为将上述待转发报文的传输路径作为当前的连接缓存信息。
第二记录模块,设置为获取上述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在上述第一数据表中。
第四报文转发模块,设置为按照上述待转发报文的传输路径,发送上述待转发报文。
本申请实施例还提供了一种转发报文的装置,参见图7,应用于报文收发设备,该装置包括:
连接信息监听模块701,设置为监听与当前网络的连接信息,在与当前网络的连接信息发生变化时按照预设更新规则更新连接标识。
连接标识发送模块702,设置为向交换机发送更新后的连接标识,以使交换机根据连接标识更新第二数据表。
在本申请实施例中,当报文收发设备的连接信息发生改变时,更新连接 标识,并向交换机发送更新后的连接标识,以使交换机根据连接标识更新第二数据表,后续交换机根据第一数据表及第二数据表发送待转发报文,能够避免报文转发失败,报文转发效率高。
本申请实施例还提供了一种交换机,包括处理器和机器可读存储介质,上述机器可读存储介质存储有能被上述处理器执行的机器可执行指令,上述处理器被上述机器可执行指令促使执行以下步骤:
步骤一,获取待转发报文。
步骤二,查询第一数据表中是否包含待转发报文对应的连接缓存信息。
步骤三,若第一数据表中包含待转发报文对应的连接缓存信息,获取第一数据表中连接缓存信息的第一标识,其中,第一标识为连接缓存信息确立时,记录的与连接缓存信息对应的连接标识。
步骤四,获取第二数据表中与连接缓存信息对应的连接信息,按照连接缓存信息对应的连接信息,确定连接缓存信息的第二标识,其中,第二标识为连接缓存信息当前的连接标识,且当连接缓存信息的连接信息发生变化时,连接信息发生变化的连接缓存信息当前的连接标识,按照预设变更规则相应改变。
步骤五,若连接缓存信息的第一标识和第二标识相同,按照连接缓存信息转发待转发报文。
在本申请实施例中,连接缓存信息的第一标识和第二标识相同,说明连接缓存信息未失效,按照此时的连接缓存信息转发待转发报文,实现待转发报文的快路径的转发,能够避免报文转发失败,报文转发效率高。
当然,上述处理器被上述机器可执行指令促使,还能够实现上述应用于交换机的转发报文的方法的任意步骤。
本申请实施例还提供了一种报文收发设备,包括处理器和机器可读存储介质,上述机器可读存储介质存储有能被上述处理器执行的机器可执行指令,上述处理器被上述机器可执行指令促使执行以下步骤:
步骤一,监听与当前网络的连接信息,在与当前网络的连接信息发生变化时按照预设更新规则更新连接标识。
步骤二,向交换机发送更新后的连接标识,以使上述交换机根据上述连接标识更新第二数据表。
在本申请实施例中,当报文收发设备的连接信息发生改变时,更新连接 标识,并向交换机发送更新后的连接标识,以使交换机根据连接标识更新第二数据表,后续交换机根据第一数据表及第二数据表发送待转发报文,能够避免报文转发失败,报文转发效率高。
当然,上述处理器被上述机器可执行指令促使,还能够实现上述应用于报文收发设备的转发报文的方法的任意步骤。
可读存储介质可以包括随机存取存储器(Random Access Memory,RAM),也可以包括非易失性存储器(Non-Volatile Memory,NVM),例如至少一个磁盘存储器。可选的,可读存储介质还可以是至少一个位于远离前述处理器的存储装置。
上述的处理器可以是通用处理器,包括中央处理器(Central Processing Unit,CPU)、网络处理器(Network Processor,NP)等;还可以是数字信号处理器(Digital Signal Processing,DSP)、专用集成电路(Application Specific Integrated Circuit,ASIC)、现场可编程门阵列(Field-Programmable Gate Array,FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
本申请实施例提供了一种计算机可读存储介质,上述计算机可读存储介质内存储有计算机程序,上述计算机程序被处理器执行时实现上述应用于交换机的任一转发报文的方法。
本申请实施例提供了一种计算机可读存储介质,上述计算机可读存储介质内存储有计算机程序,上述计算机程序被处理器执行时实现上述应用于报文收发设备的任一转发报文的方法。
本申请实施例提供了一种包含指令的计算机程序产品,当其在计算机上运行时,使得计算机执行上述应用于交换机的任一转发报文的方法。
本申请实施例提供了一种包含指令的计算机程序产品,当其在计算机上运行时,使得计算机执行上述应用于报文收发设备的任一转发报文的方法。
本申请实施例提供了一种计算机程序,当其在计算机上运行时,使得计算机执行上述应用于交换机的任一转发报文的方法。
本申请实施例提供了一种计算机程序,当其在计算机上运行时,使得计算机执行上述应用于报文收发设备的任一转发报文的方法。
对于转发报文的装置/交换机/报文收发设备/可读存储介质/计算机程序产品/计算机程序的实施例而言,由于其基本相似于方法实施例,所以描述的比 较简单,相关之处参见方法实施例的部分说明即可。
需要说明的是,在本文中,诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来,而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且,术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含,从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素,而且还包括没有明确列出的其他要素,或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下,由语句“包括一个……”限定的要素,并不排除在包括要素的过程、方法、物品或者设备中还存在另外的相同要素。
本说明书中的各个实施例均采用对应的方式描述,各个实施例之间相同相似的部分互相参见即可,每个实施例重点说明的都是与其他实施例的不同之处。尤其,对于***实施例而言,由于其基本相似于方法实施例,所以描述的比较简单,相关之处参见方法实施例的部分说明即可。
以上所述仅为本申请的较佳实施例而已,并不用以限制本申请,凡在本申请的精神和原则之内,所做的任何修改、等同替换、改进等,均应包含在本申请保护的范围之内。
本申请提供的转发报文的方法、装置、交换机、设备及存储介质,能够减少报文转发错误,减少报文丢失的情况,而且,不用通过遍历所有连接缓存信息来清除失效的路径,能够节约处理资源。
Claims (22)
- 一种转发报文的方法,应用于交换机,所述方法包括:获取待转发报文;查询第一数据表中是否包含所述待转发报文对应的连接缓存信息;若所述第一数据表中包含所述待转发报文对应的连接缓存信息,获取所述第一数据表中所述连接缓存信息的第一标识,其中,所述第一标识为所述连接缓存信息确立时与所述连接缓存信息对应的连接标识;获取第二数据表中与所述连接缓存信息对应的连接信息,按照所述连接缓存信息对应的连接信息,确定所述连接缓存信息的第二标识,其中,所述第二标识为所述连接缓存信息当前对应的连接标识,且当所述连接信息发生变化时,所述第二标识相应改变;若所述连接缓存信息的第一标识和第二标识相同,按照所述连接缓存信息转发所述待转发报文。
- 根据权利要求1所述的方法,其中,所述方法还包括:获取由配置更新的设备发送的连接标识,其中,所述配置更新的设备为连接信息发生变化的报文收发设备;根据所述配置更新的设备发送的连接标识,更新所述第二数据表中,与所述配置更新的设备发送的连接标识对应的连接信息。
- 根据权利要求2所述的方法,其中,在所述获取第二数据表中与所述连接缓存信息对应的连接信息,按照所述连接缓存信息对应的连接信息,确定所述连接缓存信息的第二标识之后,所述方法还包括:若所述连接缓存信息的第一标识和第二标识不同,删除所述第一数据表中所述待转发报文对应的连接缓存信息;获取所述待转发报文的目的地址,根据所述目的地址确定所述待转发报文的传输路径;将所述待转发报文的传输路径作为当前的连接缓存信息;在所述第二数据表中,获取所述当前的连接缓存信息对应的连接信息,并根据所述当前的连接缓存信息对应的连接信息,确定所述当前的连接缓存信息的连接标识;将所述当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,将当前的连接缓存信息的第一标识与当前的连接缓存信息记录在所述 第一数据表中;按照所述待转发报文的传输路径,发送所述待转发报文。
- 根据权利要求3所述的方法,其中,所述获取所述待转发报文的目的地址,根据所述目的地址确定所述待转发报文的传输路径,包括:若所述目的地址与所述交换机所在的地址处于同一网段,查询MAC地址表,确定所述待转发报文的路径信息,其中,所述路径信息包括转发地址,所述转发地址为下一跳接收所述待转发报文的设备的地址;根据所述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;在匹配安全组规则成功时,将安全组规则匹配成功的设备作为所述待转发报文的发送对象,以确定所述待转发报文的传输路径。
- 根据权利要求3所述的方法,其中,所述获取所述待转发报文的目的地址,根据所述目的地址确定所述待转发报文的传输路径,包括:若所述目的地址与所述交换机所在的地址不在同一网段,查询访问控制列表;在所述访问控制列表允许转发所述待转发报文时,查询路由表及邻居表,确定所述待转发报文的路径信息,其中,所述路径信息包括转发地址,所述转发地址为下一跳接收所述待转发报文的设备的地址;根据所述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;在匹配安全组规则成功时,将安全组规则匹配成功的设备作为所述待转发报文的发送对象,以确定所述待转发报文的传输路径。
- 根据权利要求1-5任一项所述的方法,其中,所述若所述第一数据表中包含所述待转发报文对应的连接缓存信息,获取所述第一数据表中所述连接缓存信息的第一标识,包括:若所述第一数据表中包含所述待转发报文对应的连接缓存信息,在所述第一数据表中查询所述待转发报文的五元组对应的key,作为所述待转发报文的key;获取所述第一数据表中hash哈希桶的所述待转发报文的key偏移处对应的链表头指针;查询所述链表头指针链接的链表,获取所述连接缓存信息及所述连接缓 存信息的第一标识。
- 根据权利要求1-5任一项所述的方法,其中,在所述查询第一数据表中是否包含所述待转发报文对应的连接缓存信息之后,所述方法还包括:若所述第一数据表中不包含所述待转发报文对应的连接缓存信息,获取所述待转发报文的目的地址;若所述目的地址与当前交换机所在的地址处于同一网段,查询MAC地址表,确定所述待转发报文的路径信息,其中,所述路径信息包括转发地址,所述转发地址为下一跳接收所述待转发报文的设备的地址;根据所述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;在匹配安全组规则成功时,将安全组规则匹配成功的设备作为所述待转发报文的发送对象,以确定所述待转发报文的传输路径;将所述待转发报文的传输路径作为当前的连接缓存信息;获取所述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在所述第一数据表中;按照所述待转发报文的传输路径,发送所述待转发报文。
- 根据权利要求1-5任一项所述的方法,其中,在所述查询第一数据表中是否包含所述待转发报文对应的连接缓存信息之后,所述方法还包括:若所述第一数据表中不包含所述待转发报文对应的连接缓存信息,获取所述待转发报文的目的地址;若所述目的地址与当前虚拟机所在的地址不在同一网段,查询访问控制列表;在所述访问控制列表允许转发所述待转发报文时,查询路由表及邻居表,确定所述待转发报文的路径信息,其中,所述路径信息包括转发地址,所述转发地址为下一跳接收所述待转发报文的设备的地址;根据所述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;在匹配安全组规则成功时,将安全组规则匹配成功的设备作为所述待转发报文的发送对象,以确定所述待转发报文的传输路径;将所述待转发报文的传输路径作为当前的连接缓存信息;获取所述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在所述第一数据表中;按照所述待转发报文的传输路径,发送所述待转发报文。
- 一种转发报文的方法,应用于报文收发设备,所述方法包括:监听与当前网络的连接信息,在与当前网络的连接信息发生变化时按照预设更新规则更新连接标识;向交换机发送更新后的连接标识,以使所述交换机根据所述连接标识更新第二数据表。
- 一种转发报文的装置,应用于交换机,所述装置包括:报文获取模块,设置为获取待转发报文;查询模块,设置为查询第一数据表中是否包含所述待转发报文对应的连接缓存信息;第一标识获取模块,设置为若所述第一数据表中包含所述待转发报文对应的连接缓存信息,获取所述第一数据表中所述连接缓存信息的第一标识,其中,所述第一标识为所述连接缓存信息确立时与所述连接缓存信息对应的连接标识;第二标识确定模块,设置为获取第二数据表中与所述连接缓存信息对应的连接信息,按照所述连接缓存信息对应的连接信息,确定所述连接缓存信息的第二标识,其中,所述第二标识为所述连接缓存信息当前对应的连接标识,且当所述连接信息发生变化时,所述第二标识相应改变;第一报文转发模块,设置为若所述连接缓存信息的第一标识和第二标识相同,按照所述连接缓存信息转发所述待转发报文。
- 根据权利要求10所述的装置,其中,所述装置还包括:连接标识获取模块,设置为获取由配置更新的设备发送的连接标识,其中,所述配置更新的设备为连接信息发生变化的报文收发设备;标识更新模块,设置为根据所述配置更新的设备发送的连接标识,更新所述第二数据表中,与所述配置更新的设备发送的连接标识对应的连接信息。
- 根据权利要求11所述的装置,其中,所述装置还包括:连接信息删除模块,设置为若所述连接缓存信息的第一标识和第二标识不同,删除所述第一数据表中所述待转发报文对应的连接缓存信息;第一传输路径确定模块,设置为获取所述待转发报文的目的地址,根据所述目的地址确定所述待转发报文的传输路径;第一缓存信息确定模块,设置为将所述待转发报文的传输路径作为当前的连接缓存信息,在所述第二数据表中,获取所述当前的连接缓存信息对应的连接信息,并根据所述当前的连接缓存信息对应的连接信息,确定所述当前的连接缓存信息的连接标识;第一数据表更新模块,设置为将所述当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,将当前的连接缓存信息的第一标识与当前的连接缓存信息记录在所述第一数据表中;第二报文转发模块,设置为按照所述待转发报文的传输路径,发送所述待转发报文。
- 根据权利要求12所述的装置,其中,所述第一传输路径确定模块,包括:第一路径信息确定子模块,设置为若所述目的地址与所述交换机所在的地址处于同一网段,查询MAC地址表,确定所述待转发报文的路径信息,其中,所述路径信息包括转发地址,所述转发地址为下一跳接收所述待转发报文的设备的地址;第一安全组匹配子模块,设置为根据所述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;第一设备连接子模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为所述待转发报文的发送对象,以确定所述待转发报文的传输路径。
- 根据权利要求12所述的装置,其中,所述第一传输路径确定模块,包括:访问查询子模块,设置为若所述目的地址与所述交换机所在的地址不在同一网段,查询访问控制列表;第二路径信息确定子模块,设置为在所述访问控制列表允许转发所述待转发报文时,查询路由表及邻居表,确定所述待转发报文的路径信息,其中,所述路径信息包括转发地址,所述转发地址为下一跳接收所述待转发报文的 设备的地址;第二安全组匹配子模块,设置为根据所述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;第二设备连接子模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为所述待转发报文的发送对象,以确定所述待转发报文的传输路径。
- 根据权利要求10-14任一项所述的装置,其中,所述第一标识获取模块,包括:key获取子模块,设置为在所述第一数据表中查询所述待转发报文的五元组对应的key,作为所述待转发报文的key;指针获取子模块,设置为获取所述第一数据表中hash哈希桶的所述待转发报文的key偏移处对应的链表头指针;标识查询子模块,设置为查询所述链表头指针链接的链表,获取所述连接缓存信息及所述连接缓存信息的第一标识。
- 根据权利要求10-14任一项所述的装置,其中,所述装置还包括:第一目的地址获取模块,设置为若所述第一数据表中不包含所述待转发报文对应的连接缓存信息,获取所述待转发报文的目的地址,其中,所述目的地址为所述待转发报文的目标端的地址;第一传输路径确定模块,设置为若所述目的地址与当前交换机所在的地址处于同一网段,查询MAC地址表,确定所述待转发报文的路径信息,其中,所述路径信息包括转发地址,所述转发地址为下一跳接收所述待转发报文的设备的地址;第一规则匹配模块,设置为根据所述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;第二传输路径确定模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为所述待转发报文的发送对象,以确定所述待转发报文的传输路径;第二缓存信息确定模块,设置为将所述待转发报文的传输路径作为当前的连接缓存信息;第一记录模块,设置为获取所述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信 息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在所述第一数据表中;第三报文转发模块,设置为按照所述待转发报文的传输路径,发送所述待转发报文。
- 根据权利要求10-14任一项所述的装置,其中,所述装置还包括:第二目的地址获取模块,设置为若所述第一数据表中不包含所述待转发报文对应的连接缓存信息,获取所述待转发报文的目的地址,其中,所述目的地址为所述待转发报文的目标端的地址;控制列表查询模块,设置为若所述目的地址与当前虚拟机所在的地址不在同一网段,查询访问控制列表;第二传输路径确定模块,设置为在所述访问控制列表允许转发所述待转发报文时,查询路由表及邻居表,确定所述待转发报文的路径信息,其中,所述路径信息包括转发地址,所述转发地址为下一跳接收所述待转发报文的设备的地址;第二规则匹配模块,设置为根据所述路径信息中的转发地址,确定需要进行安全组规则匹配的设备,并匹配安全组规则;第三传输路径确定模块,设置为在匹配安全组规则成功时,将安全组规则匹配成功的设备作为所述待转发报文的发送对象,以确定所述待转发报文的传输路径;第三缓存信息确定模块,设置为将所述待转发报文的传输路径作为当前的连接缓存信息;第二记录模块,设置为获取所述第二数据表中与当前的连接缓存信息对应的连接信息,确定当前的连接缓存信息的连接标识,将当前的连接缓存信息的连接标识作为当前的连接缓存信息的第一标识,把当前的连接缓存信息的第一标识与当前的连接缓存信息记录在所述第一数据表中;第四报文转发模块,设置为按照所述待转发报文的传输路径,发送所述待转发报文。
- 一种转发报文的装置,应用于报文收发设备,所述装置包括:连接信息监听模块,设置为监听与当前网络的连接信息,在与当前网络的连接信息发生变化时按照预设更新规则更新连接标识;连接标识发送模块,设置为向交换机发送更新后的连接标识,以使所述 交换机根据所述连接标识更新第二数据表。
- 一种交换机,包括处理器和机器可读存储介质,所述机器可读存储介质存储有能被所述处理器执行的机器可执行指令,所述处理器被所述机器可执行指令促使:实现权利要求1-8任一所述的方法步骤。
- 一种报文收发设备,包括处理器和机器可读存储介质,所述机器可读存储介质存储有能被所述处理器执行的机器可执行指令,所述处理器被所述机器可执行指令促使:实现权利要求9所述的方法步骤。
- 一种计算机可读存储介质,所述计算机可读存储介质内存储有计算机程序,所述计算机程序被处理器执行时实现权利要求1-8任一所述的方法步骤。
- 一种计算机可读存储介质,所述计算机可读存储介质内存储有计算机程序,所述计算机程序被处理器执行时实现权利要求9所述的方法步骤。
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US16/651,682 US11050667B2 (en) | 2017-09-28 | 2018-09-28 | Packet forwarding method, device, switch, apparatus, and storage medium |
RU2020114474A RU2732184C1 (ru) | 2017-09-28 | 2018-09-28 | Способ, устройство, коммутатор, аппарат для передачи пакетов и носитель информации |
SG11202002977VA SG11202002977VA (en) | 2017-09-28 | 2018-09-28 | Packet forwarding method, device, switch, apparatus, and storage medium |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201710897731.4 | 2017-09-28 | ||
CN201710897731.4A CN109587065B (zh) | 2017-09-28 | 2017-09-28 | 转发报文的方法、装置、交换机、设备及存储介质 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2019062839A1 true WO2019062839A1 (zh) | 2019-04-04 |
Family
ID=65900845
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2018/108281 WO2019062839A1 (zh) | 2017-09-28 | 2018-09-28 | 转发报文的方法、装置、交换机、设备及存储介质 |
Country Status (5)
Country | Link |
---|---|
US (1) | US11050667B2 (zh) |
CN (1) | CN109587065B (zh) |
RU (1) | RU2732184C1 (zh) |
SG (1) | SG11202002977VA (zh) |
WO (1) | WO2019062839A1 (zh) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111338986A (zh) * | 2020-03-13 | 2020-06-26 | 北京艾克斯特科技有限公司 | 一种三维模型数据结构、创建及数据获取方法 |
CN112311595A (zh) * | 2020-10-15 | 2021-02-02 | 烽火通信科技股份有限公司 | 一种高效访问控制链表及其实现方法 |
Families Citing this family (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10467435B1 (en) | 2018-10-24 | 2019-11-05 | Palantir Technologies Inc. | Approaches for managing restrictions for middleware applications |
CN111131197B (zh) * | 2019-12-11 | 2021-12-24 | 杭州迪普信息技术有限公司 | 一种过滤策略管理***及其方法 |
JP2021182689A (ja) * | 2020-05-19 | 2021-11-25 | 富士通株式会社 | スイッチ特定方法、及びスイッチ特定プログラム |
US11522917B2 (en) * | 2020-06-10 | 2022-12-06 | Arista Networks, Inc. | Scalable network processing segmentation |
CN111901317B (zh) * | 2020-07-15 | 2022-05-17 | 中盈优创资讯科技有限公司 | 一种访问控制策略处理方法、***和设备 |
CN112615867B (zh) * | 2020-12-22 | 2022-07-12 | 北京天融信网络安全技术有限公司 | 数据包检测方法和装置 |
CN112737914B (zh) * | 2020-12-28 | 2022-08-05 | 北京天融信网络安全技术有限公司 | 报文处理方法、装置、网络设备及可读存储介质 |
CN112770344B (zh) * | 2021-01-26 | 2022-06-14 | 深圳震有科技股份有限公司 | 一种5g数据转发平面的转发效率控制方法、***及终端 |
CN115175194A (zh) * | 2021-03-19 | 2022-10-11 | 华为技术有限公司 | 安全通信的方法和装置 |
CN115129685A (zh) * | 2021-03-24 | 2022-09-30 | 阿里巴巴新加坡控股有限公司 | 数据处理方法和装置、电子设备及计算机可读存储介质 |
CN113596038B (zh) * | 2021-08-02 | 2023-04-07 | 武汉绿色网络信息服务有限责任公司 | 数据包解析的方法和服务器 |
CN113965343B (zh) * | 2021-09-06 | 2024-06-18 | 锐捷网络股份有限公司 | 一种基于局域网的终端设备隔离方法及装置 |
CN114697215A (zh) * | 2022-03-31 | 2022-07-01 | 西安超越申泰信息科技有限公司 | 一种虚拟化网络性能提升的方法、***、设备及介质 |
CN115022251B (zh) * | 2022-06-02 | 2023-09-05 | 中国电子科技集团公司第二十八研究所 | 一种信息***间双向报文收发控制方法 |
CN116996438B (zh) * | 2023-09-22 | 2023-12-22 | 新华三技术有限公司 | 流表管理方法及装置 |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN103139752A (zh) * | 2011-12-01 | 2013-06-05 | 中兴通讯股份有限公司 | 传输通道表修改方法及装置 |
CN104363174A (zh) * | 2014-11-12 | 2015-02-18 | 迈普通信技术股份有限公司 | 一种连接跟踪管理装置和方法 |
US20160142306A1 (en) * | 2014-11-18 | 2016-05-19 | Fujitsu Limited | Route information provision program, route information provision method and information processing system |
Family Cites Families (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1012730A1 (en) * | 1996-01-31 | 2000-06-28 | Ipsilon Networks, Inc. | Improved method and apparatus for dynamically shifting between routing and switching packets in a transmission network |
US20040044799A1 (en) * | 2002-09-03 | 2004-03-04 | Nokia Corporation | Method, device and system for synchronizing of data providing for the handling of an interrupted synchronization process |
US7403992B2 (en) * | 2003-07-10 | 2008-07-22 | Nokia Corporation | Adaptive connection cache for communication networks |
CN1630259B (zh) * | 2003-12-15 | 2011-03-30 | 松下电器产业株式会社 | 内部代理装置、通信***以及通信方法 |
JP5182821B2 (ja) * | 2009-05-29 | 2013-04-17 | インターナショナル・ビジネス・マシーンズ・コーポレーション | プログラム中のメモリ消費の発生原因を突き止める方法、並びにそのコンピュータ・システム及びコンピュータ・プログラム |
CN102025608B (zh) * | 2009-09-17 | 2013-03-20 | 中兴通讯股份有限公司 | 通信方法、通信过程中的数据报文转发方法及通信节点 |
CN103428090B (zh) * | 2012-05-15 | 2017-10-31 | 深圳中兴力维技术有限公司 | 一种用于异构网络的动态路由方法、路由服务器及*** |
US9453734B2 (en) * | 2012-06-05 | 2016-09-27 | Apple Inc. | Smart loading of map tiles |
CN102882793B (zh) * | 2012-09-20 | 2018-10-12 | 新华三技术有限公司 | 拓扑改变消息的传输处理方法及网络设备 |
US20140233384A1 (en) | 2013-02-15 | 2014-08-21 | General Dynamics Broadband Inc. | Method and Apparatus for Receiving Information From a Communications Network |
US9525564B2 (en) * | 2013-02-26 | 2016-12-20 | Zentera Systems, Inc. | Secure virtual network platform for enterprise hybrid cloud computing environments |
JP6269163B2 (ja) * | 2014-02-27 | 2018-01-31 | 富士通株式会社 | 中継装置、ストレージ装置、および中継プログラム |
EP3342117A1 (en) * | 2015-08-28 | 2018-07-04 | Telefonaktiebolaget LM Ericsson (publ) | Systems and methods for routing traffic originating from a communication device |
CN105553841B (zh) * | 2015-12-11 | 2019-08-02 | 武汉兴图新科电子股份有限公司 | 一种能有效防止信令风暴的高效分布式智能路由方法 |
CN107528784B (zh) * | 2016-06-21 | 2021-02-26 | 新华三技术有限公司 | 报文转发方法和装置 |
CN106131919B (zh) * | 2016-07-15 | 2019-06-11 | 中国电子科技集团公司第五十四研究所 | 一种无中心自组织网络拓扑的同步方法 |
CN106603401B (zh) * | 2017-02-16 | 2019-09-13 | 迈普通信技术股份有限公司 | 快速重路由方法和装置 |
US10516728B2 (en) * | 2017-03-10 | 2019-12-24 | Microsoft Technology Licensing, Llc | Virtual filtering platform in distributed computing systems |
CN106993036B (zh) * | 2017-03-30 | 2020-02-21 | 联想(北京)有限公司 | 运行环境信息处理方法及交换机 |
US10771390B2 (en) * | 2017-06-18 | 2020-09-08 | Cisco Technology, Inc. | Techniques for optimizing egress tunnel router failure scenarios in intelligent wide area networks |
-
2017
- 2017-09-28 CN CN201710897731.4A patent/CN109587065B/zh active Active
-
2018
- 2018-09-28 US US16/651,682 patent/US11050667B2/en active Active
- 2018-09-28 SG SG11202002977VA patent/SG11202002977VA/en unknown
- 2018-09-28 WO PCT/CN2018/108281 patent/WO2019062839A1/zh active Application Filing
- 2018-09-28 RU RU2020114474A patent/RU2732184C1/ru active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN103139752A (zh) * | 2011-12-01 | 2013-06-05 | 中兴通讯股份有限公司 | 传输通道表修改方法及装置 |
CN104363174A (zh) * | 2014-11-12 | 2015-02-18 | 迈普通信技术股份有限公司 | 一种连接跟踪管理装置和方法 |
US20160142306A1 (en) * | 2014-11-18 | 2016-05-19 | Fujitsu Limited | Route information provision program, route information provision method and information processing system |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111338986A (zh) * | 2020-03-13 | 2020-06-26 | 北京艾克斯特科技有限公司 | 一种三维模型数据结构、创建及数据获取方法 |
CN111338986B (zh) * | 2020-03-13 | 2023-08-04 | 北京艾克斯特科技有限公司 | 一种获取三维模型数据结构中数据的方法 |
CN112311595A (zh) * | 2020-10-15 | 2021-02-02 | 烽火通信科技股份有限公司 | 一种高效访问控制链表及其实现方法 |
CN112311595B (zh) * | 2020-10-15 | 2022-09-09 | 烽火通信科技股份有限公司 | 一种高效访问控制链表及其实现方法 |
Also Published As
Publication number | Publication date |
---|---|
US11050667B2 (en) | 2021-06-29 |
SG11202002977VA (en) | 2020-04-29 |
US20200267082A1 (en) | 2020-08-20 |
CN109587065B (zh) | 2021-02-23 |
RU2732184C1 (ru) | 2020-09-14 |
CN109587065A (zh) | 2019-04-05 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2019062839A1 (zh) | 转发报文的方法、装置、交换机、设备及存储介质 | |
US9110703B2 (en) | Virtual machine packet processing | |
US9674139B2 (en) | Detection of a misconfigured duplicate IP address in a distributed data center network fabric | |
US20210344714A1 (en) | Cyber threat deception method and system, and forwarding device | |
US11336696B2 (en) | Control access to domains, servers, and content | |
US11223579B2 (en) | Data processing method, network interface card, and server | |
EP2940970B1 (en) | Nat implementation system, method, and openflow switch | |
CN107547349B (zh) | 一种虚拟机迁移的方法及装置 | |
US20150358232A1 (en) | Packet Forwarding Method and VXLAN Gateway | |
US10572291B2 (en) | Virtual network management | |
WO2019047855A1 (zh) | 一种bras转控分离的备份方法和装置 | |
US9825861B2 (en) | Packet forwarding method, apparatus, and system | |
US11671363B2 (en) | Method and apparatus for cross-service-zone communication, and data center network | |
EP2811691B1 (en) | Method and device for synchronizing network data flow detection status | |
US10652142B2 (en) | SDN-based ARP implementation method and apparatus | |
CN107623757B (zh) | 表项更新方法和装置 | |
US20150207665A1 (en) | Network control software notification with denial of service protection | |
US20180351879A1 (en) | Multicast data packet forwarding | |
US20180351878A1 (en) | Multicast data packet forwarding | |
EP4113937A1 (en) | Mac address sending method and apparatus, system, and related devices | |
US10877951B2 (en) | Network control software notification and invalidation of static entries | |
WO2019196914A1 (zh) | 一种发现转发路径的方法及其相关设备 | |
US8893271B1 (en) | End node discovery and tracking in layer-2 of an internet protocol version 6 network | |
EP3288224B1 (en) | Data packet forwarding method and network device | |
WO2016188222A1 (zh) | 一种业务报文转发方法、装置及通信*** |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 18861374 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 18861374 Country of ref document: EP Kind code of ref document: A1 |