WO2018082592A1 - 一种报文处理方法以及网络设备 - Google Patents

一种报文处理方法以及网络设备 Download PDF

Info

Publication number
WO2018082592A1
WO2018082592A1 PCT/CN2017/109038 CN2017109038W WO2018082592A1 WO 2018082592 A1 WO2018082592 A1 WO 2018082592A1 CN 2017109038 W CN2017109038 W CN 2017109038W WO 2018082592 A1 WO2018082592 A1 WO 2018082592A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
information
network device
identifier information
identifier
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/109038
Other languages
English (en)
French (fr)
Inventor
郑合文
韩磊
冯海东
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP17867096.4A priority Critical patent/EP3531635B1/en
Publication of WO2018082592A1 publication Critical patent/WO2018082592A1/zh
Priority to US16/399,717 priority patent/US10931580B2/en
Anticipated expiration legal-status Critical
Priority to US17/155,276 priority patent/US12101254B2/en
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/741—Routing in networks with a plurality of addressing schemes, e.g. with both IPv4 and IPv6
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/20—Traffic policing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/31—Flow control; Congestion control by tagging of packets, e.g. using discard eligibility [DE] bits
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/161—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/50—Routing or path finding of packets in data switching networks using label swapping, e.g. multi-protocol label switch [MPLS]

Definitions

  • the present invention relates to the field of network communications, and in particular, to a packet processing method and a network device.
  • the access control list (English name: Access Control Lists, abbreviation: ACL) is a list of instructions applied to the router port.
  • the policies configured in these instruction lists are used to tell the router which packets can be received and which packets need to be rejected. Whether the packet is received or rejected can be determined by a specific indication condition similar to the source address, the destination address, the port number, and the like. Its main task is to ensure that network resources are not illegally used and accessed. It is one of the most important core strategies for ensuring network security.
  • the implementation of the policy function configured by the access control list is implemented by the packet forwarding chip of the network device.
  • the network device may be a network device such as a router or a switch, and the packet forwarding chip in the network device is accessed according to the access.
  • the policy configured by the control list receives or rejects the received message.
  • the packets of different protocols such as the fourth version of the Internet Protocol (English full name: Internet Protocol Version 4, abbreviation: IPv4) message, the sixth version of the Internet Protocol (English full name: Internet Protocol Version 4, abbreviation: IPv6) message , Data link layer (L2) message, multi-protocol label switching (English name: Multi-Protocol Label Switching, abbreviation: MPLS) message and multi-link transparent interconnection (English full name: TRansparent Interconnection of Lots of Links, abbreviation: Packets such as TRILL have different formats, in which the fields constituting the above-mentioned messages are not identical, and even if the same field position, the meanings of the bits of the two messages are different, and the meaning of each field follow their respective protocol specifications.
  • the packet forwarding chip in the network device needs to identify the packet type before applying the policy of the access control list, and then enter according to the packet type.
  • Different key building blocks of the message forwarding chip (English name: Key Construction Block, abbreviation: KCB), wherein the structure diagram of KCB is shown in Figure 2. For example, if it is an IPv4 message, it enters the IPv4 key building block.
  • Each KCB has 64 Field Copy Engines (Copy Engines) and 7 Key Buffers with a length of 160 bits.
  • the packet forwarding chip in the network device uses the KCB to extract the message field, and then combines the key description information to identify the message, and stores the combined key description information into the Key Buffer, and the key description information is pre-configured.
  • the policy is matched, that is, the corresponding policy that has been configured to the message is executed if it matches.
  • the Copy Engine and the key buffer are scarce resources.
  • the matching fields of the network aggregation node or the core node are too many, the policy cannot be delivered to the hardware due to insufficient resources. That is, since the copy engine and the key buffer are scarce resources, there are too few resources for constructing the key description information for the same type of packet, that is, some policies configured by the user cannot be effectively executed at the same time. That is, the number of parallels of the packet processing policy of the network device is limited.
  • the embodiment of the invention provides a packet processing method and a network device, which can effectively solve the problem caused by the network device. Due to the scarcity of the hardware resources of the packet forwarding chip itself, the number of parallel processing messages is limited.
  • the first aspect of the present invention provides a packet processing method, in which the first network device acquires the identifier information; when the first network device receives the packet, the packet is processed.
  • the processed packet contains the identifier information, wherein the packet corresponding to the different preset policy information in the processed packet, that is, the identifier information included in the packet corresponding to the different ACL policy information is different; the first network device And sending, by the preset forwarding table, the processed packet to the second network device, so that the second network device matches the processed packet with the corresponding policy according to the identifier information.
  • the second network device and the first network device are different network devices, and the second network device is a downstream device of the first network device, and the preset forwarding table is a forwarding table pre-configured in the first network device, which should be understood.
  • the first network device forwards the packet, the first network device forwards the packet according to the route, port, and other information indicated by the preset forwarding table.
  • the packets with different preset policy information have different identification information, so that the second network device, that is, the downstream device of the first network device, is in the policy.
  • the second network device that is, the downstream device of the first network device.
  • you only need to extract the matching identification information.
  • the first network device obtains the identifier information by sending a request message to the controller, where the request message is used to request the corresponding identifier information, where the first network device receives the identifier information sent by the controller, where The identifier information is determined by the controller according to the packet description information in the preset policy information.
  • the preset policy information includes the packet description information and the action information
  • the message description information refers to the message used to classify the message.
  • the characteristic information of a certain packet flow including but not limited to the source physical address of the packet (English name: Medium Access Control, abbreviation: MAC), destination MAC address, source IP address, destination IP address, IP protocol Information such as the type, transport layer source port, and transport layer destination port is determined by the preset policy information.
  • the identifier information corresponds to the packet description information in the preset policy information, and the controller determines different identification information according to different packet description information in different preset policy information, that is, different packet description information corresponds to different identifiers. information.
  • the first network device actively requests identification information from the controller, and the identifier information is directly from the controller, and the controller uniformly allocates the packet corresponding to the packet description information in different preset policy information.
  • the implementation of the solution is enhanced.
  • the first network device acquires the identifier information, specifically, by receiving the identifier information sent by the controller, where the identifier information is used by the controller according to the preset policy information.
  • the packet description information is determined.
  • the identifier information corresponds to the packet description information in the preset policy information
  • the controller determines different identifier information according to different packet description information in different preset policy information, that is, different identifiers.
  • the message description information corresponds to different identification information.
  • the first network device does not actively request the identifier information from the controller, but the controller actively sends the identifier information to the first network device.
  • the identification information is also directly sent to the controller, and the controller uniformly allocates the messages corresponding to the packet description information in different preset policy information, thereby enhancing the implementability and diversity of the solution.
  • the first network device obtains the identifier information, which is specifically the identifier information set sent by the receiving controller, and determines the identifier information according to the identifier information set, where the identifier information is the identifier information in the identifier information set. That is, another method for allocating identification information is provided, that is, the identification information is indirectly to the controller, and the controller allocates the identification information set to the first network device, where the first network device is a management domain network.
  • the network device in the network, the identification information of the identification information sets are not overlapped with each other, and the first network device autonomously determines the identification information in the set of identification information authorized by the flow, and is the packet with different preset policy configuration information. Assign identification information.
  • the first network device determines whether the packet carries the identifier information, and if the first network device determines that the packet does not carry the identifier information, A network device processes the packet according to the identification information.
  • the first network device when the first network device performs the foregoing processing on the packet, it first determines whether the packet already contains the identifier information, and if so, the first network device can directly perform policy matching according to the identifier information. If not, the packet is processed according to the obtained identification information, so that the processed packet includes the identifier information. It can be seen that the packet with different preset policy information in the network management domain can contain different identification information.
  • the first network device processes the packet according to the identifier information, specifically by inserting the identifier information in a preset field of the packet. That is, in the embodiment of the present invention, a method for processing the packet, the packet includes the identifier information, and the implementability of the scheme is enhanced.
  • a second aspect of the embodiments of the present invention provides a network device, where the network device has a function of implementing behavior of a first network device in the foregoing method design.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the modules can be software and/or hardware.
  • the network device includes an acquisition module, a receiving module, a processing module, and a sending module.
  • the obtaining module is configured to obtain the identifier information
  • the receiving module is configured to receive the packet
  • the processing module is configured to process the packet when the receiving module receives the packet, so that the processed packet includes the acquiring module.
  • the identification information of the packet corresponding to the different preset policy information is different; the sending module is configured to send the packet processed by the processing module to the second network device, so that the second network device is configured according to the second network device.
  • the identification information matches the corresponding policy to the processed message.
  • a network device includes a receiver, a processor, and a transmitter, where the receiver is configured to receive information data or instructions involved in the foregoing method, and the processor is configured to support the foregoing.
  • the first network device performs the corresponding function in the above method.
  • the transmitter transmits information or instructions involved in the above method.
  • the first network device can also include a memory for coupling with a processor that retains program instructions and data necessary for the first network device.
  • a third aspect of the embodiments of the present invention provides a computer storage medium having stored therein program code for indicating execution of the method in the first aspect described above.
  • the packets with different preset policy information have different identification information, so that the second The network device, that is, the downstream device of the first network device, only needs to match the identification information when performing policy matching, and does not need to extract multiple fields of the packet according to the type of the packet to construct the key description information to match the policy. It can effectively solve the parallel number of packet processing strategies caused by the scarcity of the hardware resources of the packet forwarding chip in the network device. Limited problem.
  • FIG. 1 is a schematic diagram of a process for a network device to perform policy matching on a packet in the prior art
  • FIG. 2 is a schematic structural diagram of a construction module inside a packet forwarding chip in a network device
  • FIG. 3 is a schematic structural diagram of a system for processing a message according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of an embodiment of a packet processing method according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of an insertion identification information of a packet processing method according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of an application scenario of a packet processing method according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a format of an IPv4 header
  • FIG. 8 is a schematic diagram of a format after an IPv4 packet header is inserted with identification information according to an embodiment of the present invention
  • FIG. 9 is a schematic diagram of another format after an IPv4 packet header is inserted with identification information according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic diagram of a format of an IPv6 packet header
  • FIG. 11 is a schematic diagram of a format after an IPv6 packet header is inserted with identification information according to an embodiment of the present invention
  • FIG. 12 is a schematic diagram of another format after an IPv6 packet header is inserted with identification information according to an embodiment of the present disclosure
  • FIG. 13 is a schematic diagram of a format of a WXLAN packet header
  • FIG. 14 is a schematic diagram of a format of a WXLAN packet header inserted with identification information according to an embodiment of the present invention.
  • FIG. 15 is a schematic diagram of an application scenario of a packet processing method according to an embodiment of the present invention.
  • FIG. 16 is a schematic diagram of another application scenario of a packet processing method according to an embodiment of the present disclosure.
  • FIG. 17 is a schematic diagram of a policy configuration manner of a packet processing method according to an embodiment of the present invention.
  • FIG. 18 is a schematic structural diagram of an embodiment of a network device according to an embodiment of the present invention.
  • FIG. 19 is a schematic structural diagram of another embodiment of a network device according to an embodiment of the present invention.
  • the embodiment of the invention discloses a message processing method and a network device.
  • FIG. 3 is a schematic diagram of a system framework according to an embodiment of the present invention.
  • the network devices refer to physical entity devices connected to the network.
  • the server #1 communicates with the server #2, for example, when the server #1 sends a message to the server #2, it needs to be forwarded by the network device S1, the network device S2, and the network device S3, and finally arrives at the server# 2.
  • the network device S1 is a first network device.
  • the first network device acquires the identifier information.
  • the packet is processed, and the processed packet includes the identifier.
  • the information, in the processed packet, the packet corresponding to the different preset policy information, that is, the identifier information included in the packet corresponding to the different ACL policy information is different; the first network device sends the packet according to the preset forwarding table.
  • the processed packet is sent to the second network device, so that the second network device matches the processed packet with the corresponding policy according to the identifier information.
  • the first network device may refer to a network device in a certain network management domain. When the network management domain corresponding to the system frame diagram shown in FIG.
  • the first network device may refer to the network device shown in FIG. S1, the network device S2, and the network device S3, may also refer to the server #1 or the server #2, which is not limited herein, as long as the packet with different preset policy information is finally included in the packet in the network management domain.
  • the network device S2, the network device S3, and the server #2 are all downstream devices of the network device S1.
  • the network device S2, the network device S3, and the server #2 are all downstream devices of the first network device. .
  • the embodiments of the present invention will be described in detail below.
  • FIG. 4 is a schematic flowchart of a method for processing a packet according to an embodiment of the present invention, including:
  • the first network device sends a request message to the controller.
  • the request message is used to request identification information from the controller.
  • the first network device receives the identifier information sent by the controller.
  • the identifier information sent by the controller is received, where the identifier information is received by the controller according to the message description in the preset policy information.
  • the information is determined, wherein the identifier information is pre-configured information, and may be a random combination of a number, a character string, or a number and a character string, or other identifiers, which are not limited herein.
  • the preset policy information is the ACL policy information configured on the first network device. It should be understood that the ACL policy information includes the packet flow description information and the corresponding action information.
  • the packet flow description information is used to classify the report.
  • Description information of the text including but not limited to the source physical address of the packet (English name: Medium Access Control, MAC address), destination MAC address, source IP address, destination IP address, IP protocol type, transport layer Information such as the source port and the destination port of the transport layer.
  • the action information refers to the action information corresponding to the packet matching the preset policy information, such as discarding or receiving.
  • the specific preset policy information is determined by the actual policy configuration result.
  • the identifier information corresponds to the packet description information in the preset policy information, and different packet description information corresponds to different identifier information.
  • FIG. 5 is a schematic diagram of an application scenario of a packet processing method according to an embodiment of the present invention.
  • the first network device is illustrated as the switch S1 in FIG. 5 as an example:
  • the policy module may include all the preset policy information that is configured on the switch S1, that is, all the ACL policy information. It should be understood that each ACL policy information includes packet description information and corresponding action information. For example, if the ACL policy information is the source IP address is 10.10.10.1 and the destination IP address is 20.20.20.2. The source IP address and the destination IP address are the packet description information in the ACL policy information when the packet is in the permit. The permit action is the corresponding action information.
  • the policy module may be a module configured on the switch S1 or a separate hardware entity module, which is not limited herein.
  • the switch S1 communicates with the controller, and the switch S1 The controller sends a request message, where the request message is used to request the identifier information from the controller.
  • the controller communicates with the policy module, according to the message description in the preset policy information in the policy module.
  • the information identifies the corresponding identification information, and the identification information corresponds to the packet description information in the preset policy information, that is, the different packet description information corresponds to different identification information, and then the controller sends the determined identification information to the switch S1.
  • the switch S1 communicates with the controller, and the switch S1 The controller sends a request message, where the request message is used to request the identifier information from the controller.
  • the controller communicates with the policy module, according to the message description in the preset policy information in the policy module.
  • the information identifies the corresponding identification information, and the identification information corresponds to the packet description information
  • the switch S1 actively requests the identifier information from the controller, and in addition to the foregoing manner, the following manner may also be adopted:
  • the controller actively sends the identification information, and still uses FIG. 5 as an example.
  • the controller allocates identification information for the packet description information in the preset policy information, and the identification information is It is sent to the switch S1 to ensure that packets with different packet descriptions are assigned different identification information in the network of the network management domain, that is, the identifier information corresponds to the packet description information of the preset policy information. Different message description information corresponds to different identification information.
  • controller refers to a control center in the network management domain, and can be a controller that manages network devices in the network management domain.
  • step 104 When the first network device receives the packet, and determines whether the packet meets the packet description information and does not carry the identifier information, if yes, step 104 is performed.
  • the first network device when the first network device receives the packet, it first determines whether the received packet has carried the identifier information, and determines whether the packet meets the packet description information, and if the packet is determined to be consistent. If the message description information does not carry the identification information, step 104 is performed.
  • the policy module when it is determined that the received packet does not meet the packet description information, the policy module does not have preset policy information for the packet. In this case, the first network device may choose to forward the packet according to the preset forwarding table. Message.
  • the first network device inserts the identifier information in a preset field of the packet.
  • the identifier information is inserted in the preset field of the packet.
  • the controller is the source IP address of 10.10.10.1 and the destination IP address is 20.20.20.2
  • the identifier of "31000" is assigned.
  • the first network device receives the source IP address of 10.10.10.1,
  • the destination IP address is a packet of 20.20.20.2, and the packet does not carry the identifier information of "31000”
  • the first network device inserts the "31000" identifier information in the preset field of the packet.
  • the preset field may be a field in the packet protocol specification, or may be a newly added field, which is not limited herein.
  • the first network device inserts the identification information between the network layer (IP header) of the packet and the transport layer (English name: Transmission Control Protocol/User Datagram Protocol, abbreviation: TCP/UDP), as shown in FIG. 6.
  • IP header IP header
  • transport layer International name: Transmission Control Protocol/User Datagram Protocol, abbreviation: TCP/UDP
  • the left side is the hierarchical structure of the uninserted identification information message received by the first network device, and the right side is the new message hierarchy after the identification information is inserted into the message received by the first network device.
  • the format of the IPv4 header is as shown in FIG. 7.
  • the Internet Protocol Specification RFC (Request For Comments) 791 defines each field in the IPv4 header.
  • the position, length and meaning, for example, the Protocol field is 8 bits, and the position where the IPv4 header is shifted backward by 71 bits is used as the starting point, that is, the consecutive 8 bits starting from the 72nd bit are
  • the protocol field of the IPv4 packet header indicates the protocol type corresponding to the payload of the IPv4 packet. That is, the mapping between the value and the meaning of the protocol field in the IPv4 packet header is specified in the specification RFC790, such as the control packet protocol. : Internet Control Message Protocol, abbreviation: ICMP) Corresponding value 1, TCP protocol corresponding value 6, UDP protocol corresponding value 17. The meanings of the various fields in the IPv4 header are not described here.
  • the identifier information may be inserted into an Option field of an IPv4 packet header, as shown in FIG. 8 .
  • the specific specification of the Option field of the IPv4 packet header can be referred to the RFC 791.
  • the insertion and bearer of the identifier information conforms to the specification of the format of the Option field of the IPv4 packet header in the RFC791, which is not limited herein, as long as the final Option field is made. It can contain identification information.
  • the bearer of the identifier information may be applied to the new IPv4 protocol type, and then the identifier information is carried in the header of the new protocol type.
  • the number of bits occupied by the identifier information in the header of the new protocol type is 32. Bit, but it can be understood that the number of bits occupied by the identifier in the header of the new protocol type can be configured according to the actual application, which is not limited herein.
  • the protocol format of an IPv6 packet header is shown in Figure 10. Similar to the IPv4 packet, in the IPv6 header, the location, length, and meaning of each field are specified by the Internet protocol. For example, the version indicates which version of the IP protocol, and the value corresponding to the IPv6 version is 0110. The meanings of the various fields in the IPv6 packet are not described here.
  • the bearer of the identifier information may be applied to the new IPv6 protocol type, and then the identifier information is carried in the header of the new protocol type, as shown in FIG.
  • the number of digits occupied by the identifier in the header of the new protocol type can be configured according to the actual application.
  • the flow label in the IPv6 header can be rewritten as our identification information, as shown in FIG. 12 .
  • the identification information can also be placed in the IP tunnel header, such as the virtual extensible LAN (English name: Virtual Extensible LAN, abbreviation: VXLAN) packet header, as shown in Figure 13,
  • Figure 13 is a VXLAN packet header format diagram It includes an identification bit (I), an unused bit (F), an unused field (Reserved), and a VXLAN Network ID (VXLAN Network ID), it being understood that the identification bit (I) is used to indicate that the VXLAN network identification is valid.
  • the identifier information may be carried in an unused field of the VXLAN packet header, as shown in FIG. 14.
  • the first bit position of the VXLAN packet header may be 1 to indicate the first 9 to 32 carries the identification information of the message, or provides such indication by a specific value of other agreed bit positions, which is not limited herein. I will not repeat them one by one.
  • identifier information may be placed in other specified positions of the message by way of protocol specification, or The way to stipulate the specification is to insert a specific field to be carried in other specific locations, which is not limited here.
  • the location of the information insertion and the length of the field are preferably fixed positions and fixed lengths relative to the packet header, or at least in a certain spatial range, that is, a certain
  • the preset network device management domain or fixed time range (time period) is fixed, which is not limited herein.
  • the first network device sends the packet after the identifier information is inserted, so that the second network device matches the corresponding message according to the identifier information.
  • the first network device may send the packet after the insertion of the identifier information according to the preset forwarding table, so that the second network device matches the corresponding message with the packet inserted after the identifier information according to the identifier information.
  • FIG. 15 is a schematic diagram of an application scenario of a packet processing method according to an embodiment of the present invention.
  • the switch S1 is used as the first network device, and it can be understood that the process shown in FIG. 15 is adopted.
  • the downstream device of the switch S1 that is, the second network device, when receiving the packet with the identification information inserted, can perform policy matching according to the identifier information. Alternatively, the downstream device may also erase the identification information inserted by the switch S1 according to the actual configuration.
  • the specific key is to obtain the method for obtaining the identification information, which may be directly or indirectly from the centralized controller to ensure different preset policies in the network within the management domain. Messages of information will not have the same identification information.
  • the first network device itself allocates the identification information, and the specific first network device receives the identification information set sent by the controller. The first network device determines the identification information according to the identification information set, where the identification information is the identification information in the identification information set.
  • the first network device has different identification information, and the corresponding information of the different preset policy information is used to notify the controller, so that the controller performs policy matching on the downstream device of the first network device.
  • each switch may be assigned a set of identification information by the controller, and the identification information sets of each switch do not overlap each other. Taking the switch S1 as an example, the switch S1 can autonomously determine the identification information in the set of identification information authorized by the packet.
  • the switch S1 When receiving the packet, the switch S1 inserts the identifier information in the preset field of the packet, as long as the identifier information corresponds to the packet description information in the preset policy information, that is, different packet description information corresponds to different identifier information. Just fine.
  • each type of message flow that is, a message having each type of message description information
  • Such packets with different preset policy information will naturally not have the same identification information; the other is the corresponding message with the same action information, and even packets with different message description information can be allocated.
  • the specific information is not limited herein.
  • the switch S1 is taken as an example.
  • the server #1 or the server #2 may be used as the first network device in the embodiment of the present invention, and preferably Ground, by selecting the edge device in the network management domain, as shown in FIG. 16, that is, server #1 as the first network device.
  • the embodiment of the present invention is not limited herein.
  • the embodiment of the present invention is not limited by the additional installation of the program or the modification of the host protocol stack code on the server #1, or the addition of a function in the virtual switch (vSwitch).
  • the first network device may forward the packet after inserting the identifier information according to the preset forwarding table.
  • the packets with different preset policy information have different identification information, so that the network device downstream of the first network device, that is, the second network device is performing policy processing.
  • it is very simple, it only needs to read the identification information from the specified position of the message to match, if the matching is performed, the corresponding strategy is executed, and if it does not match, it is ignored.
  • the configuration on the subsequent network device can normalize the strategy shown in FIG. 17, which should be understood, Ip access-list extended apply_racl", where the keyword “ip” indicates that this is for IP packets.
  • the keyword “access-list” indicates that this is an access control list policy configuration.
  • the keyword “extended” indicates that this is an extension.
  • the access control list, the word “apply_racl” is the name given by the user to this access extension list, that is, the name of the policy, and "permit flow id 31000" indicates that the "apply_racl” policy permission includes access to the message with the identification information of 31000.
  • Interface GigabitEthernet3/1 specifies that the following configuration is applied to the port named "GigabitEthernet3/1" on the network device. "ip address 192.168.1.1255.255.255.0” is used to specify the IP address of this port. Is to configure an IP address for this port.
  • the "ip access-group apply_racl out” is used to specify that the policy applied to this port is "apply_racl".
  • “apply_racl” indicates that the application policy applied here is the access policy "apply_racl” configured on this system.
  • the packets with different policy information have different identification information, so that the second network device, that is, the downstream device of the first network device, can be made to perform the policy.
  • the identification information you only need to match the identification information. You do not need to construct the key description information to match the policy through the fields of the packet. This can effectively solve the scarcity of the hardware resources of the packet forwarding chip itself. A limited number of parallel issues for message processing strategies.
  • a packet processing method in the embodiment of the present invention is described above.
  • the following describes the network device in the embodiment of the present invention:
  • FIG. 18 is a schematic structural diagram of an embodiment of a network device according to an embodiment of the present invention.
  • the network device includes an obtaining module 101, a receiving module 102, a processing module 103, and a sending module 104.
  • the obtaining module 101 is configured to obtain the identifier information; the receiving module 102 is configured to receive the packet; the processing module 103 is configured to process the packet when the receiving module 102 receives the packet, where the processed packet includes the obtaining module 101. And the identifier information that is obtained by the processing module 103 is sent to the second network device to enable the second network. The device matches the processed packet with the corresponding policy according to the identifier information.
  • the obtaining module 101 includes: a sending unit and a receiving unit.
  • the sending unit And the receiving unit is configured to receive the identifier information sent by the controller, where the identifier information is determined by the controller according to the packet description information in the preset policy information, and the identifier information is determined by the controller.
  • the information corresponds to the packet description information in the preset policy information, and different packet description information corresponds to different identification information.
  • the processing module 103 is specifically configured to: when the receiving module 102 receives the packet, if the packet meets the packet description information, the packet is processed.
  • the obtaining module 101 includes a receiving unit, where the receiving unit is configured to receive the identifier information sent by the controller, where the identifier information is determined by the controller according to the packet description information in the preset policy information, and the identifier information and the pre- The packet description information in the policy information is corresponding, and different packet description information corresponds to different identification information;
  • the processing module 103 is specifically configured to: when the receiving module 102 receives the packet, if the packet meets the packet description information, the packet is processed.
  • the receiving unit is configured to receive the identifier information set sent by the controller, and the acquiring unit is configured to obtain the identifier information from the identifier information set, where the identifier information is the identifier information in the identifier information set.
  • the processing module 103 is specifically configured to: if the processing module 103 determines that the packet conforms to the packet description information and the packet does not carry the identifier information, the processing packet is processed according to the identifier information.
  • the processing module 103 determines that the packet conforms to the packet description information and the packet does not carry the identifier information, the processing module 103 is specifically configured to insert the identifier information in the preset field of the packet.
  • the packets with different policy information have different identification information, so that the second network device, that is, the downstream device of the first network device, can be matched.
  • the identifier information is matched, the key description information is not required to be used to match the policy.
  • the network device can effectively solve the scarcity of the hardware resources of the packet forwarding chip. A problem that leads to a limited number of parallels of message processing strategies.
  • the functions of the obtaining module 101, the receiving module 102, the processing module 103, and the sending module 104, or the steps performed, or more details may refer to the first network device in the foregoing method embodiment. The corresponding process will not be described here.
  • the network device in the embodiment of the present invention is described above from the perspective of a modular functional entity.
  • the network device in the embodiment of the present invention is described below from the perspective of hardware processing.
  • a schematic structural diagram of a network device provided by an embodiment of the present application includes a processor 201, a memory 202, and a communication interface 203.
  • the processor 201, the memory 202, and the communication interface 203 are connected to each other through a bus 204.
  • the processor 201 may be a central processing unit (English name: central processing unit, abbreviation: CPU), a network processor (English full name: network processor, abbreviation: NP) or a combination of CPU and NP.
  • the processor may further include a hardware chip, which may be an application-specific integrated circuit (ASIC), a programmable logic device (abbreviated as PLD), or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the PLD can be a complex programmable logic device (English full name: complex programmable logic device, abbreviation: CPLD), field programmable logic gate array (English name: field-programmable gate array, abbreviation: FPGA), general array logic (English) Full name: generic array logic, abbreviation: GAL) or any combination thereof, which is not limited in this application.
  • CPLD complex programmable logic device
  • FPGA field-programmable gate array
  • GAL general array logic
  • the memory 202 may include a volatile memory (English full name: volatile memory), such as a random access memory (English name: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English full name: non- Volatile memory), such as flash memory (English full name: flash memory), hard disk (English full name: hard disk drive, abbreviation: HDD) or solid state drive (English full name: solid-state drive, abbreviation: SSD); memory can also include A combination of the above types of memories.
  • volatile memory English full name: volatile memory
  • RAM random access memory
  • RAM random access memory
  • non-volatile memory English full name: non- Volatile memory
  • flash memory English full name: flash memory
  • hard disk English full name: hard disk drive, abbreviation: HDD
  • SSD solid state drive
  • the bus 204 can be a peripheral component interconnect standard (English full name: peripheral component interconnect, abbreviation: PCI) bus or an extended industry standard architecture (English name: extended industry standard architecture, abbreviation: EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can also be divided into an address bus, a data bus, a control bus, and the like.
  • Figure 19 is shown with only one thick line, but does not indicate that there is only one bus or one type of bus.
  • the communication interface 203 is configured to send or receive the instruction or data used by the corresponding network device in the foregoing corresponding method embodiment.
  • the memory 202 may store the program code 205, and may also store the data 206 used by the network device in the foregoing method embodiment.
  • the data 206 may refer to the identification information, the identification information set, and the preset policy configuration information, etc., in the foregoing method embodiment, Information data related to a network device.
  • the processor 201 can call the program code 205 stored in the memory to perform the corresponding steps in the foregoing method embodiment, so that the final network device can implement the function of the first network device in the foregoing method embodiment.
  • Network device 200 can also include a power source 207. It should be noted that the network device structure shown in FIG. 17 does not constitute a limitation on the network device, and may include more or less components than those illustrated, or combine some components, or different component arrangements, where Do not repeat them one by one.
  • the steps performed by the network device in the embodiment of the present application may be based on the structure of the network device shown in FIG. 17. For details, refer to the process corresponding to the first network device in the foregoing method embodiment, and details are not described herein again.
  • the disclosed systems, modules, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the modules is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional module in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated modules when implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may contribute to the prior art or all or part of the technical solution may be embodied in the form of a software product.
  • the computer software product is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method of various embodiments of the present invention. .
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read only memory (English full name: Read-Only Memory, abbreviation: ROM), a random access memory (English name: Random Access Memory, abbreviation: RAM), a disk or A variety of media such as optical discs that can store program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种报文处理方法以及网络设备。可以有效地解决导致网络设备中，由于报文转发芯片自身硬件资源的稀缺，而导致对报文处理策略的并行数目有限的问题。本发明实施例方法部分包括：第一网络设备获取标识信息；当所述第一网络设备接收到报文时，对所述报文进行处理，处理后的所述报文包含所述标识信息，其中，对应不同预置策略信息的所述报文所包含的所述标识信息不相同；所述第一网络设备发送经过所述处理后的所述报文至第二网络设备，以使第二网络设备根据所述标识信息对经过所述处理后的所述报文匹配对应的策略。

Description

一种报文处理方法以及网络设备
本申请要求于2016年11月2日提交中国专利局、申请号为201610945556.7、申请名称为“一种报文处理方法以及网络设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络通信领域，尤其涉及到一种报文处理方法以及网络设备。
背景技术
访问控制列表(英文全称：Access Control Lists，缩写：ACL)是应用在路由器端口的指令列表，这些指令列表配置的策略用来告诉路由器哪些数据包可以接收、哪些数据包需要拒绝。至于数据包是被接收还是拒绝，可以由类似于源地址、目的地址、端口号等的特定指示条件来决定。它的主要任务是保证网络资源不被非法使用和访问。它是保证网络安全最重要的核心策略之一。其中，访问控制列表所配置的策略功能的实现本质上是依赖网络设备的报文转发芯片实现的，其中，网络设备可以是指路由器，交换机等网络设备，网络设备中的报文转发芯片依据访问控制列表所配置的策略对报文进行接收或拒绝接收处理。
其中，不同协议的报文，例如互联网协议第四版(英文全称：Internet Protocol Version 4，缩写：IPv4)报文、互联网协议第六版(英文全称：Internet Protocol Version 4，缩写：IPv6)报文，数据链路层(L2)报文，多协议标签交换(英文全称：Multi-Protocol Label Switching，缩写：MPLS)报文以及多链路透明互联(英文全称：TRansparent Interconnection of Lots of Links，缩写：TRILL)等报文，具有不同的格式，其中，构成上述报文的字段不完全相同，并且，即使是相同的字段位置，两种报文的比特位所代表的含义也不同，各个字段的含义分别遵循各自的协议规范。
因此，现有技术中，如图1所示，为了适应不同协议的报文，网络设备中的报文转发芯片应用访问控制列表的策略之前，需先识别报文类型，接着根据报文类型进入报文转发芯片不同的关键构建模块(英文全称：Key Construction Block，缩写：KCB)，其中KCB的结构示意图如图2所示，例如，若是IPv4报文，则进入IPv4关键构建模块。其中，每个KCB有64个字段拷贝引擎(Copy Engine)、7个长度为160比特的关键存储单元(Key Buffer)，具体。网络设备中的报文转发芯片再利用KCB提取报文字段，然后组合成Key描述信息用以标识报文，并将组合成的Key描述信息存储至Key Buffer中，这些Key描述信息再与预先配置的策略进行匹配，即与如果匹配上就执行已经配置到该报文的对应策略。由图2所示可以知道，Copy Engine和key buffer是稀缺资源，当网络汇聚节点或者核心节点等对应的网络设备匹配字段提取过多，容易因为资源不足导致策略无法下发到硬件。即由于copy engine和key buffer是稀缺资源，对于同一种类型的报文而言，用于构建Key描述信息的资源过少，即有可能导致同一时间里，用户配置的一些策略无法被有效地执行，即导致网络设备对报文处理策略的并行数目有限。
发明内容
本发明实施例提供了报文处理方法以及网络设备，可以有效地解决导致网络设备中， 由于报文转发芯片自身硬件资源的稀缺，而导致对报文处理策略的并行数目有限的问题。
有鉴于此，本发明实施例第一方面提供了一种报文处理方法，在该方法中，第一网络设备获取标识信息；当第一网络设备接收到报文时，对报文进行处理，处理后的报文包含标识信息，其中，处理后的报文中，对应不同预置策略信息的报文，即对应不同ACL策略信息的报文所包含的标识信息并不相同；第一网络设备根据预置转发表发送经过处理后的报文至第二网络设备，以使第二网络设备根据标识信息对经过处理后的报文匹配对应的策略。，其中，第二网络设备和第一网络设备为不同的网络设备，第二网络设备为第一网络设备的下游设备，预置转发表为预先配置在第一网络设备中的转发表，应理解，第一网络设备在转发报文的时候，是根据预置转发表所指示的路由、端口等信息对报文进行转发处理。
由以上方案可以看出，经过第一网络设备的处理后，具有不同预置策略信息的报文具有不同的标识信息，这样可以使得第二网络设备，即第一网络设备的下游设备在进行策略匹配的时候，只需提取匹配标识信息即可，不需要通过报文的多个字段来构建Key描述信息来匹配策略，可以有效地解决导致网络设备中，由于报文转发芯片自身硬件资源的稀缺，而导致对报文处理策略的并行数目有限的问题。
在一种可能的实现中，第一网络设备获取标识信息具体是通过向控制器发送请求消息，该请求消息用于请求对应的标识信息，第一网络设备接收控制器发送的标识信息，其中，该标识信息由控制器根据预置策略信息中的报文描述信息确定，应理解，预置策略信息中包括报文描述信息以及动作信息，报文描述信息即是指就是用以归类报文为某种报文流的特征信息，这些特征信息包括但不限于报文的源物理地址(英文全称：Medium Access Control，缩写：MAC)、目的MAC地址、源IP地址、目的IP地址、IP协议类型、传输层源端口、传输层目的端口等信息，具体由预置策略信息所确定。标识信息与预置策略信息中的报文描述信息相对应，该控制器根据不同的预置策略信息中不同的报文描述信息确定不同的标识信息，即不同的报文描述信息对应不同的标识信息。
由以上方案可见，由第一网络设备主动向控制器索要标识信息，该标识信息直接的来自控制器，由控制器针对不同预置策略信息中，报文描述信息所对应的报文统一分配，增强了方案的可实施性。
在一种可能的实现中，在一种可能的实现中，第一网络设备获取标识信息具体是通过接收由控制器发送的标识信息，其中，该标识信息由控制器根据预置策略信息中的报文描述信息确定，同样，标识信息与预置策略信息中的报文描述信息相对应，该控制器根据不同的预置策略信息中不同的报文描述信息确定不同的标识信息，即不同的报文描述信息对应不同的标识信息。
由以上方案可知，与上一种实现手段相比，在本实现中，不是由第一网路设备主动向控制器索要标识信息，而是由控制器主动向第一网络设备发送该标识信息，标识信息同样直接的来至控制器，由控制器针对不同预置策略信息中，报文描述信息所对应的报文统一分配，增强了方案的可实施性以及多样性。
在一种可能的实现中，第一网络设备获取标识信息具体是指接收控制器发送的标识信息集合，根据标识信息集合确定标识信息，标识信息为标识信息集合中的标识信息。即在 本发明实施例中，提供了另一种标识信息的分配方式，即该标识信息间接的来控制器，控制器通过为第一网络设备分配标识信息集合，其中，第一网络设备为管理域网络内的网络设备，这些标识信息集合相互之间的标识信息不重复交叉，第一网络设备自主为流在其所授权的标识信息集合内确定标识信息，为具有不同预置策略配置信息的报文分配标识信息。
在一种可能的实现中，第一网络设备对报文进行处理之前，第一网络设备会确定报文是否携带标识信息，若第一网络设备确定该报文并未携带有标识信息，则第一网络设备根据该标识信息对报文进行处理。
即在本发明实施例中，第一网络设备对报文进行上述处理时，会先确定报文是否已经含有上述标识信息，若有则第一网络设备可以直接根据该标识信息进行策略的匹配，若不是，则根据获取的标识信息对该报文进行处理，使得处理后的报文包含有上述标识信息。由此可见，这样可以使得最终在一个网络管理域内，具有不同预置策略信息的报文包含有不同的标识信息。
在一种可能的实现中，第一网络设备根据标识信息对报文进行处理，具体是通过在该报文的预设字段插入标识信息。即在本发明实施例中，具体给出了一种对报文处理后，报文包含有该标识信息的方法，增强了方案的可实施性。
本发明实施例第二方面提供了一种网络设备，该网络设备具有实现上述方法设计中第一网络设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。所述模块可以是软件和/或硬件。
在一种可能的实现中，该网络设备包括获取模、接收模块、处理模块以及发送模块。
其中，获取模块，用于获取标识信息；接收模块，用于接收报文；处理模块，用于当接收模块接收到报文时，对报文进行处理，使得处理后的报文包含获取模块获取的标识信息，其中，对应不同预置策略信息的报文所包含的标识信息不相同；发送模块，用于发送经过处理模块处理后的报文至第二网络设备，以使第二网络设备根据标识信息对经过处理后的报文匹配对应的策略。
在一个可能的实现中，网络设备的结构中包括接收器、处理器和发射器，所述接收器，用于接收上述方法中所涉及的信息数据或指令，所述处理器被配置为支持上述第一网络设备执行上述方法中相应的功能。所述发射器发送上述方法中所涉及的信息或者指令。所述第一网络设备还可以包括存储器，所述存储器用于与处理器耦合，其保存第一网络设备必要的程序指令和数据。
本发明实施例第三方面提供了一种计算机存储介质，该计算机存储介质中存储有程序代码，该程序代码用于指示执行上述第一方面中的方法。
相较于现有技术，从以上技术方案可以看出，本发明实施例中，经过第一网络设备的处理后，具有不同预置策略信息的报文具有不同的标识信息，这样可以使得第二网络设备，即第一网络设备的下游设备在进行策略匹配的时候，只需匹配标识信息即可，不需要根据报文的类型，提取报文的多个字段来构建Key描述信息来匹配策略，可以有效地解决导致网络设备中，由于报文转发芯片自身硬件资源的稀缺，而导致对报文处理策略的并行数目 有限的问题。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域技术人员来讲，还可以根据这些附图获得其他的附图。
图1为现有技术中网络设备对报文进行策略匹配的过程示意图；
图2为网络设备中报文转发芯片内部的构建模块结构示意图；
图3为本发明实施例一种报文处理方法一个系统框架示意图；
图4为本发明实施例一种报文处理方法一个实施例流程示意图；
图5为本发明实施例一种报文处理方法一个插入标识信息示意图；
图6为本发明实施例一种报文处理方法一个应用场景示意图；
图7为IPv4报文头的一个格式示意图；
图8为本发明实施例中IPv4报文头插入标识信息后的一个格式示意图；
图9为本发明实施例中IPv4报文头插入标识信息后的另一格式示意图；
图10为IPv6报文头的一个格式示意图；
图11为本发明实施例中IPv6报文头插入标识信息后的一个格式示意图；
图12为本发明实施例中IPv6报文头插入标识信息后的另一格式示意图；
图13为WXLAN报文头的一个格式示意图；
图14为本发明实施例中WXLAN报文头插入标识信息后的一个格式示意图；
图15为本发明实施例中一种报文处理方法一个应用场景示意图；
图16为本发明实施例中一种报文处理方法另一应用场景示意图；
图17为本发明实施例中一种报文处理方法一种策略配置方式示意图；
图18为本发明实施例一种网络设备一个实施例结构示意图；
图19为本发明实施例一种网络设备另一实施例结构示意图。
具体实施方式
本发明实施例公开了一种报文处理方法以及网络设备。可以有效地解决导致网络设备中，由于报文转发芯片自身硬件资源的稀缺，而导致对报文处理策略的并行数目有限的问题。
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员所获得的所有其他实施例，都应当属于本发明保护的范围。
本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必 限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
请参阅图3，图3为本发明实施例一个系统框架示意图，在图3所示的图中，包括多个网络设备以及服务器，其中，网络设备是指连接到网络中的物理实体设备。网络设备的种类繁多，具体可以是指，但不局限于计算机(无论其为个人电脑或者服务器)、集线器、交换机、网桥、路由器、网关、等。当服务器#1与服务器#2进行通信的过程中，例如当服务器#1向服务器#2发送报文的时候，需要进过网络设备S1、网络设备S2以及网络设备S3的转发，最终到达服务器#2。这里设网络设备S1为第一网络设备，在本发明实施例中，第一网络设备获取标识信息；当第一网络设备接收到报文时，对报文进行处理，处理后的报文包含标识信息，其中，处理后的报文中，对应不同预置策略信息的报文，即对应不同ACL策略信息的报文所包含的标识信息并不相同；第一网络设备根据预置转发表发送经过处理后的报文至第二网络设备，以使第二网络设备根据标识信息对经过处理后的报文匹配对应的策略。其中，第一网络设备可以是指某个网络管理域内的网络设备，具体如图3所示的系统框架图所对应的网络管理域时，第一网络设备可以是指图3所示的网络设备S1、网络设备S2、网络设备S3，也可以是指服务器#1或者服务器#2，具体此处不做限定，只要使得最后在网络管理域内的报文中，具有不同预置策略信息的报文具有不同的标识信息即可，第二网络设备第一网络设备的下游网络设备，例如图3所示系统架构图中，网络设备S2、网络设备S3以及服务器#2都为网络设备S1的下游设备。为了便于理解，下面将对本发明实施例进行详细的介绍。
请参阅图4，图4为本发明实施例一种报文处理方法一个实施例流程示意图，包括：
101、第一网络设备向控制器发送请求消息。
其中，该请求消息用于向控制器请求标识信息。
102、第一网络设备接收控制器发送的标识信息。
本发明实施例中，当第一网络设备向控制器发送请求消息后，接收控制器发送的标识信息，其中，标识信息由控制器接收到请求消息后，根据预置策略信息中的报文描述信息确定，其中，标识信息为预先配置的信息，可以为一个数字、字符串或者数字与字符串之间的随机组合，或者是其他标识，具体此处不做限定。而预置策略信息是指配置在第一网络设备上的ACL策略信息，应理解，ACL策略信息包括报文流描述信息以及对应的动作信息，其中，报文流描述信息就是用以归类报文的描述信息，这些描述信息可以包括但不限于报文的源物理地址(英文全称：Medium Access Control，缩写：MAC)、目的MAC地址、源IP地址、目的IP地址、IP协议类型、传输层源端口、传输层目的端口等信息，动作信息是指对匹配到该预置策略信息的报文所对应的动作信息，例如丢弃或者接收。具体的预置策略信息由实际策略配置结果确定。另外，标识信息与预置策略信息中的报文描述信息相对应，不同的报文描述信息对应不同的标识信息。
为了便于理解，下面通过具体的网络拓扑图进行介绍：
如图5所示，图5为本发明实施例一种报文处理方法一个应用场景示意图，以第一网络设备为图5中的交换机S1为例进行说明：
其中，其中策略模块可以是指包含有配置在交换机S1上的所有预置策略信息，即所有的ACL策略信息。应理解，每个ACL策略信息中，包含有报文描述信息以及对应的动作信息，举例来说，假设当ACL策略信息是对源IP地址为10.10.10.1，且目的IP地址是20.20.20.2的报文进行permit(允许接收)动作时，源IP地址以及目的IP地址即是ACL策略信息中的报文描述信息，permit动作即是对应的动作信息。
在实际应用中，策略模块可以为配置在交换机S1上的模块或者是独立的硬件实体模块存在，具体此处不做限定，在本发明实施例中，交换机S1与控制器进行通讯，交换机S1向控制器发送请求消息，该请求消息用于向控制器请求标识信息，当控制器接收到上述请求消息后，控制器与策略模块进行通讯，根据策略模块中的预置策略信息中的报文描述信息确定出对应的标识信息，标识信息与预置策略信息中的报文描述信息相对应，即不同的报文描述信息对应不同的标识信息，接着控制器将确定的标识信息发送给交换机S1，以保证在网络管理域范围的网络内，为不同报文描述信息所对应的报文分配有不同的标识信息。
其中，需要说明的是，上述获取标识信息的方法中，是由交换机S1主动向控制器请求标识信息的，除了上述方式外，还可以通过以下方式：
控制器主动下发标识信息，仍以图5为例，当策略模块每被配置一个预置策略信息，控制器就针对该预置策略信息中的报文描述信息分配标识信息，并将标识信息下发到交换机S1，以保证在网络管理域范围的网络内，为具有不同报文描述信息的报文分配有不同的标识信息，即标识信息与该预置策略信息的报文描述信息相对应，不同的报文描述信息对应不同的标识信息。
需要说明的是，控制器是指网络管理域内的控制中心，可以对网络管理域内的网络设备进行管理的控制器。
103、当第一网络设备接收到报文时，确定报文是否符合报文描述信息且未携带标识信息时，若是，则执行步骤104。
在本发明实施例中，当第一网络设备接收到报文时，首先确定接收到的报文是否已经携带有标识信息，确定该报文是否符合报文描述信息，若确定所述报文符合该报文描述信息且未携带标识信息，则执行步骤104。
需要说明的是，当确定接收到的报文不符合报文描述信息，说明策略模块上没有针对该报文有预置策略信息，此时，第一网络设备可以选择按照预置转发表转发该报文。
104、第一网络设备在报文的预设字段插入标识信息。
在本发明实施例中，当第一网络设备确定接收到的报文未携带有标识信息，且确定该报文是否符合报文描述信息，则在该报文的预设字段插入标识信息。
例如，假设控制器为源IP地址为10.10.10.1，且目的IP地址是20.20.20.2的报文分配了“31000”这个标识信息，当第一网络设备接收到源IP地址为10.10.10.1，且目的IP地址是20.20.20.2的报文时，且该报文未携带有“31000”的标识信息时，则第一网络设备在报文的预设字段插入该“31000”标识信息。
其中，需要说明的是，预设字段可以是指该报文协议规范内的字段，也可以是指新增加的字段，具体此处不做限定。
优选地，第一网络设备将标识信息插入到报文的网络层(IP头)和传输层(英文全称：Transmission Control Protocol/User Datagram Protocol，缩写：TCP/UDP)头之间，如图6所示，左边是第一网络设备收到的未插入标识信息报文层次结构，右边是插入了标识信息后的到第一网络设备接收的报文中之后的新报文层次结构。
为了便于理解，下面通过具体的报文例子进行说明：
请参阅图7，应理解，IPv4报文头的格式如图7所示，对于IPv4报文头，互联网协议规范RFC(Request For Comments)791，定义了IPv4报文头中每个字段(field)的位置、长度和含义，比如协议(Protocol)字段为8个比特位、位于IPv4报文头向后偏移71比特的位置作为起始点，就是说从第72比特开始连续的8个比特位为IPv4报文头的Protocol字段，含义就是表明IPv4报文的负载对应的协议类型，即在规范RFC790中规范了IPv4报文头中Protocol字段数值与含义的对应关系，比如控制报文协议(英文全称：Internet Control Message Protocol，缩写：ICMP)对应数值1、TCP协议对应数值6、UDP协议对应数值17。具体关于IPv4报文头中各个字段的含义在此不做一一赘述。
在本发明实施例中，可选地，可以将标识信息可以插入到IPv4报文头的选项(Option)字段中，具体如图8所示。需要说明的是，关于IPv4报文头Option字段的具体规范可以参考RFC791，标识信息的插入与承载遵从RFC791对IPv4报文头Option字段格式的规范，具体此处不做限定，只要使得最终Option字段包含有标识信息即可。
可选地，标识信息的承载可以通过申请新的IPv4协议类型，然后将标识信息承载在新协议类型头中，具体如图9所示，标识信息在新协议类型头所占用的位数为32位，但可以理解的是，标识信息在新协议类型头所占用的位数可以根据实际应用情况进行配置，具体此处不做限定。
以IPv6报文为例，请参阅图10，IPv6报文头的协议格式具体如图10所示。与IPv4报文相类似的，在IPv6报文头中，通过互联网协议规范了各个字段的位置、长度以及含义，比如版本(Version)指明IP协议是哪个版本，IPv6版本对应的数值为0110。具体关于IPv6报文中各个字段的含义在此也不做一一赘述。
可选地，在本发明实施例中，标识信息的承载可以通过申请新的IPv6协议类型，然后将标识信息承载在新协议类型头中，具体如图11所示，其中，需要说明的是，标识信息在新协议类型头所占用的位数可以根据实际应用情况进行配置，具体此处不做限定。
可选地，在本发明实施例中，还可以改写IPv6报文头中的流标签(flow label)作为我们的标识信息，具体如图12所示。
另外，标识信息也可以放在IP隧道头中，比如虚拟可扩展局域网(英文全称：Virtual Extensible LAN，缩写：VXLAN)报文头中，如图13所示，图13为VXLAN报文头格式示意图，其中包括标识位(I)、未使用位(F)、未使用字段(Reserved)以及VXLAN网络标识(VXLAN Network ID)，应理解，其中标识位(I)用于表示VXLAN网络标识有效。在本发明实施例中，标识信息可以承载在VXLAN报文头的未使用字段中，具体如图14所示，在这里，可以通过：VXLAN报文头的第一个比特位置为1来指示第9到第32位携带的是该报文的标识信息，或者通过其他约定的比特位置的特定值来提供这类指示，具体此处不做限定， 也不一一赘述。
需要说明的是，以上插入标识信息的过程在这里仅仅是举例进行说明，但并不对本发明实施例构成限定，标识信息可以通过协议规范的方式，约定放置到报文的其他指定位置，或者通过约定规范的方式在其他特定的位置插入特定的字段来承载，具体此处不做限定。
另外需要说明的是，为了便于第一网络设备进行处理，标识信息插入的位置和字段的长度，优选地是相对报文头的固定位置和固定长度，或者至少是在一定的空间范围，即某个预置网络设备管理域内，或者预置时间范围(时间周期)内固定的，具体此处不做限定。
105、第一网络设备发送插入标识信息后的报文，以使得第二网络设备根据标识信息对插入标识信息后的报文匹配对应的策略。
在本发明实施例中，第一网络设备可以根据预置转发表发送插入标识信息后的报文，以使得第二网络设备根据标识信息对插入所述标识信息后的报文匹配对应的策略。
如图15所示，为本发明实施例一种报文处理方法一个应用场景示意图，其中，在图15中，以交换机S1作为第一网络设备，可以理解的是，通过图15所示的流程中，交换机S1的下游设备，即第二网络设备在接收到插入有标识信息的报文时，可以根据标识信息进行策略的匹配。可选地，下游设备也可以在根据实际配置情况擦除由交换机S1插入的标识信息。
这里需要说明的是，在上述描述中，具体关键是需要配置标识信息的获得方法，可以通过可以是直接或间接来自集中的控制器，以保证在管理域范围的网络内，具有不同预置策略信息的报文不会具有相同的标识信息。除了上文提到的两种标识信息的获得方法外，还有其他分配标识信息的方法，例如，由第一网络设备自身分配标识信息，具体第一网络设备通过接收控制器发送的标识信息集合；第一网络设备根据标识信息集合确定标识信息，标识信息为标识信息集合中的标识信息。接着第一网络设备具有不同预置策略信息的报文分配不同的标识信息，标识信息与不同预置策略信息的对应关系告知控制器，以便控制器在第一网络设备的下游设备进行策略的匹配。即在本发明实施例中，除了上述提到的两种获取标识信息的方式，还可以通过控制器给每个交换机分配一段标识信息集合，每个交换机的标识信息集合相互之间不重复交叉，以交换机S1为例，交换机S1可以自主为报文在其所授权的标识信息集合内为确定标识信息。当接收到报文时，交换机S1在报文的预设字段插入标识信息，只要使得标识信息与预置策略信息中的报文描述信息相对应，即不同的报文描述信息对应不同的标识信息即可。
综上所述，在本发明实施例中，有多种分配标识信息的方法，针对每种报文流，即具有每种报文描述信息的报文分配一个网络管理域内全局唯一的标识信息，这样具有不同预置策略信息的报文自然不会具有相同的标识信息；另一种是具有相同动作信息的所对应的报文，中，即使是不同报文描述信息的报文，也可以分配相同的标识信息，只要不同动作信息所对应的报文具有不同的标识信息即可，具体此处不做限定。
需要说明的是，在上述所举的例子，都是以交换机S1为例，但在实际应用中，也可以以服务器#1或服务器#2上作为本发明实施例中的第一网络设备，优选地，通过选网络管理域内的边缘设备，如图16所示，即服务器#1作为第一网络设备。具体可以通过比如通过 在服务器#1上额外安装程序或修改主机协议栈代码、或在虚拟交换机(vSwitch)增加功能等来本发明实施例，具体此处不做限定。
本发明实施例中，当第一网络设备在接收的报文的预设字段插入标识信息后，可以根据预置转发表转发插入所述标识信息后的报文。应理解，经过本发实施插标识信息的步骤后，具有不同预置策略信息的报文具有不同的标识信息，这样在第一网络设备后下游的网络设备，即第二网络设备在进行策略处理时，就非常简单了，只需要从报文的指定位置读出标识信息进行匹配就好，如果匹配就执行对应策略，如果不匹配则忽略。
例如，采用了本发明实施例后，假设对应的标识信息是一个数值为31000的标识，那么在后续网络设备上的配置就可以归一化如图17所示的策略，应理解，其中，“ip access-list extended apply_racl”，其中关键词“ip”说明这个是针对IP报文的，关键词“access-list”说明这个是一个访问控制列表策略配置，关键词“extended”说明这个是一个扩展访问控制列表，词语“apply_racl”是用户给这个访问扩展列表，即策略命名的名字，“permit flow id 31000”表示这个“apply_racl”策略许可包含有标识信息为31000的报文进行访问。“interface GigabitEthernet3/1”，是指定下面的配置是应用在网络设备上名称为“GigabitEthernet3/1”的端口上的，“ip address 192.168.1.1255.255.255.0”是用来指定这个端口的IP地址的，就是为这个端口配置一个IP地址。
而“ip access-group apply_racl out”是用来指定应用到这个端口的策略是“apply_racl”。“apply_racl”说明这里应用的策略就是这个系统上配置的访问策略“apply_racl”，可以看到匹配的时候仅需要匹配报文的标识信息31000这一个字段，而不需要提取报文的多个字段组合成key描述信息来匹配，从而彻底解决现有的网络设备中的转发芯片因设计问题导致报文处理策略并行数目有限的问题。
即由以上方案可以看出，经过第一网络设备的处理后，具有不同策略信息的报文具有不同的标识信息，这样当可以使得第二网络设备，即第一网络设备的下游设备在进行策略匹配的时候，只需匹配标识信息即可，不需要通过报文的字段来构建Key描述信息来匹配策略，可以有效地解决导致网络设备中，由于报文转发芯片自身硬件资源的稀缺，而导致对报文处理策略的并行数目有限的问题。
以上对本发明实施例中的一种报文处理方法进行了描述，下面对本发明实施例中的网络设备进行描述：
请参阅图18，图18为本发明实施例一种网络设备一个实施例结构示意图，该网络设备包括获取模块101、接收模块102、处理模块103以及发送模块104。
其中，获取模块101用于获取标识信息；接收模块102用于接收报文；处理模块103用于当接收模块102接收到报文时，对报文进行处理，处理后的报文包含获取模块101获取的标识信息，其中，对应不同预置策略信息的报文所包含的标识信息不相同；发送模块104用于发送经过处理模块103处理后的报文至第二网络设备，以使第二网络设备根据标识信息对经过处理后的报文匹配对应的策略。
在一种可能的实现中，获取模块101包括：发送单元以及接收单元。其中，发送单元 用于向控制器发送请求消息；接收单元用于接收控制器发送的标识信息，标识信息由控制器接收到发送单元发送的请求消息后，根据预置策略信息中的报文描述信息确定，标识信息与预置策略信息中的报文描述信息相对应，不同的报文描述信息对应不同的标识信息；
处理模块103具体用于当接收模块102接收到报文时，若报文符合报文描述信息时，则对报文进行处理。
在一种可能的实现中，获取模块101包括接收单元，该接收单元用于接收控制器发送的标识信息，标识信息为控制器根据预置策略信息中的报文描述信息确定，标识信息与预置策略信息中的报文描述信息相对应，不同的报文描述信息对应不同的标识信息；
处理模块103具体用于当接收模块102接收到报文时，若报文符合报文描述信息时，则对报文进行处理。
在一种可能的实现中，接收单元用于接收控制器发送的标识信息集合；获取单元用于从标识信息集合中获取标识信息，标识信息为标识信息集合中的标识信息。
在一种可能的实现中，处理模块103具体用于：若处理模块103确定报文符合报文描述信息且报文未携带标识信息，则根据标识信息对报文进行处理。
在一种可能的实现中，若处理模块103确定报文符合报文描述信息且报文未携带标识信息时，处理模块103具体用于在报文的预设字段插入标识信息。
由以上方案可以看出，经过第一网络设备的处理后，具有不同策略信息的报文具有不同的标识信息，这样当可以使得第二网络设备，即第一网络设备的下游设备在进行策略匹配的时候，只需匹配标识信息即可，不需要通过报文的多个字段来构建Key描述信息来匹配策略，可以有效地解决导致网络设备中，由于报文转发芯片自身硬件资源的稀缺，而导致对报文处理策略的并行数目有限的问题。
这里需要说明的是，结合上述实施例，获取模块101、接收模块102、处理模块103以及发送模块104的功能或者所执行的步骤、或者更多的细节可以参照前述方法实施例中第一网络设备对应的过程，具体此处不再赘述。
上面从模块化功能实体的角度对本发明实施例中的网络设备进行描述，下面从硬件处理的角度对本发明实施例中的网络设备进行描述，
请参阅图19，本申请实施例提供的一种网络设备的结构示意图，该网络设备200包括处理器201、存储器202和通信接口203。其中，处理器201、存储器202和通信接口203之间通过总线204相互连接。
其中，处理器201可以是中央处理器(英文全称：central processing unit，缩写：CPU)，网络处理器(英文全称：network processor，缩写：NP)或者CPU和NP的组合。处理器还可以进一步包括硬件芯片，具体可以是专用集成电路(英文全称：application-specific integrated circuit，缩写：ASIC)，可编程逻辑器(英文全称：programmable logic device，缩写：PLD)或其组合。另外PLD可以是复杂可编程逻辑器件(英文全称：complex programmable logic device，缩写：CPLD)，现场可编程逻辑门阵列(英文全称：field-programmable gate array，缩写：FPGA)，通用阵列逻辑(英文 全称：generic array logic,缩写：GAL)或其任意组合，在本申请中不做任何限定。
存储器202可以包括易失性存储器(英文全称：volatile memory)，例如随机存取存储器(英文全称：random-access memory，缩写：RAM)；存储器也可以包括非易失性存储器(英文全称：non-volatile memory)，例如快闪存储器(英文全称：flash memory)，硬盘(英文全称：hard disk drive，缩写：HDD)或固态硬盘(英文全称：solid-state drive，缩写：SSD)；存储器还可以包括上述种类的存储器的组合。
总线204可以是外设部件互连标准(英文全称：peripheral component interconnect，缩写：PCI)总线或扩展工业标准结构(英文全称：extended industry standard architecture，缩写：EISA)总线等。所述总线还可以分为地址总线、数据总线、控制总线等。为便于表示，图19仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
其中，通信接口203用于发送或者接收上述对应方法实施例中对应网络设备所用到的指令或者数据。
存储器202可以存储程序代码205，还可以存储上述方法实施例中网络设备所用到的数据206，例如数据206可以是指标识信息、标识信息集合以及预置策略配置信息等上述方法实施例中，第一网络设备所涉及到的信息数据。处理器201可以调用该存储器中存储的程序代码205，执行上述方法实施例中对应的步骤，使得最终网络设备可以实现上述方法实施例中第一网络设备的功能。
网络设备200还可以包括电源207。需要说明的是，图17中示出的网络设备结构并不构成对网络设备构成限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置，在此不一一赘述。
本申请实施例中由网络设备所执行的步骤可以基于该图17所示的网络设备的结构示意图，具体可以参考前述方法实施例第一网络设备对应的过程，在此也不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，模块和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的模块果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出 来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(英文全称：Read-Only Memory，缩写：ROM)、随机存取存储器(英文全称：Random Access Memory，缩写：RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (12)

  1. 一种报文处理方法，其特征在于，包括：
    第一网络设备获取标识信息；
    当所述第一网络设备接收到报文时，对所述报文进行处理，处理后的所述报文包含所述标识信息，其中，对应不同预置策略信息的所述报文所包含的所述标识信息不相同；
    所述第一网络设备发送经过所述处理后的所述报文至第二网络设备，以使第二网络设备根据所述标识信息对经过所述处理后的所述报文匹配对应的策略。
  2. 根据权利要求1所述的方法，其特征在于，所述第一网络设备获取所述标识信息，包括：
    所述第一网络设备向控制器发送请求消息；
    所述第一网络设备接收所述控制器发送的所述标识信息，所述标识信息由所述控制器接收到所述请求消息后，根据所述预置策略信息中的报文描述信息确定，所述标识信息与所述预置策略信息中的报文描述信息相对应，不同的报文描述信息对应不同的标识信息；
    当所述第一网络设备接收到报文时，对所述报文进行处理，包括：
    若所述报文符合所述报文描述信息时，则对所述报文进行所述处理。
  3. 根据权利要求1所述的方法，其特征在于，所述第一网络设备获取所述标识信息，包括：
    所述第一网络设备接收所述控制器发送的所述标识信息，所述标识信息为所述控制器根据所述预置策略信息中的报文描述信息确定，所述标识信息与所述预置策略信息中的报文描述信息相对应，不同的报文描述信息对应不同的标识信息；
    当所述第一网络接收到报文时，对所述报文进行处理，包括：
    若所述报文符合所述报文描述信息时，则对所述报文进行处理。
  4. 根据权利要求1所述的方法，其特征在于，所述第一网络设备获取所述标识信息，包括：
    所述第一网络设备接收所述控制器发送的标识信息集合；
    所述第一网络设备从所述标识信息集合中获取所述标识信息，所述标识信息为所述标识信息集合中的标识信息。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，若所述报文符合所述报文描述信息时，所述对所述报文进行处理，包括：
    若所述报文符合所述报文描述信息且所述报文未携带所述标识信息时，则根据所述标识信息对所述报文进行所述处理。
  6. 根据权利要求5中所述的方法，其特征在于，所述根据所述标识信息对所述报文进行处理，包括：
    所述第一网络设备在所述报文的预设字段插入所述标识信息。
  7. 一种网络设备，其特征在于，包括：
    获取模块，用于获取标识信息；
    接收模块，用于接收报文；
    处理模块，用于当所述接收模块接收到所述报文时，对所述报文进行处理，处理后的所述报文包含所述获取模块获取的所述标识信息，其中，对应不同预置策略信息的所述报文所包含的所述标识信息不相同；
    发送模块，用于发送经过所述处理模块处理后的所述报文至第二网络设备，以使第二网络设备根据所述标识信息对经过所述处理后的所述报文匹配对应的策略。
  8. 根据权利要求7所述的网络设备，其特征在于，所述获取模块包括：
    发送单元，用于向控制器发送请求消息；
    接收单元，用于接收所述控制器发送的所述标识信息，所述标识信息由所述控制器接收到所述发送单元发送的所述请求消息后，根据所述预置策略信息中的报文描述信息确定，所述标识信息与所述预置策略信息中的报文描述信息相对应，不同的报文描述信息对应不同的标识信息；
    所述处理模块具体用于，当所述接收模块接收到所述报文时，若所述报文符合所述报文描述信息时，则对所述报文进行处理。
  9. 根据权利要求7所述的网络设备，其特征在于，所述获取模块包括：
    所述接收单元，用于接收所述控制器发送的所述标识信息，所述标识信息为所述控制器根据所述预置策略信息中的报文描述信息确定，所述标识信息与所述预置策略信息中的报文描述信息相对应，不同的报文描述信息对应不同的标识信息；
    所述处理模块用于，当所述接收模块接收到所述报文时，若所述报文符合所述报文描述信息时，则对所述报文进行处理。
  10. 根据权利要求7所述的网络设备，其特征在于，所述获取模块包括:
    所述接收单元，用于接收所述控制器发送的标识信息集合；
    获取单元，用于从所述标识信息集合中获取所述标识信息，所述标识信息为所述标识信息集合中的标识信息。
  11. 根据权利要求7至10中任一项所述的网络设备，其特征在于，所述处理模块具体用于：
    若所述处理模块确定所述报文符合所述报文描述信息且所述报文未携带所述标识信息，则根据所述标识信息对所述报文进行所述处理。
  12. 根据权利要求11中所述的网络设备，其特征在于，若所述处理模块确定所述报文符合所述报文描述信息且所述报文未携带所述标识信息时，所述处理模块具体用于：
    在所述报文的预设字段插入所述标识信息。
PCT/CN2017/109038 2016-11-02 2017-11-02 一种报文处理方法以及网络设备 Ceased WO2018082592A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17867096.4A EP3531635B1 (en) 2016-11-02 2017-11-02 Message processing method and network device
US16/399,717 US10931580B2 (en) 2016-11-02 2019-04-30 Packet processing method and network device
US17/155,276 US12101254B2 (en) 2016-11-02 2021-01-22 Packet processing method and network device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610945556.7 2016-11-02
CN201610945556.7A CN108011824B (zh) 2016-11-02 2016-11-02 一种报文处理方法以及网络设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/399,717 Continuation US10931580B2 (en) 2016-11-02 2019-04-30 Packet processing method and network device

Publications (1)

Publication Number Publication Date
WO2018082592A1 true WO2018082592A1 (zh) 2018-05-11

Family

ID=62047292

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/109038 Ceased WO2018082592A1 (zh) 2016-11-02 2017-11-02 一种报文处理方法以及网络设备

Country Status (4)

Country Link
US (2) US10931580B2 (zh)
EP (1) EP3531635B1 (zh)
CN (2) CN113938426A (zh)
WO (1) WO2018082592A1 (zh)

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110557846B (zh) * 2018-05-31 2021-06-29 华为技术有限公司 一种数据传输方法、终端设备及网络设备
EP3815313A4 (en) * 2018-07-13 2021-08-18 Huawei Technologies Co., Ltd. MPLS EXPANSION HEADS FOR INTERNAL NETWORK SERVICES
US11546300B2 (en) * 2019-05-07 2023-01-03 Comcast Cable Communications, Llc Firewall system with application identifier based rules
CN112039777B (zh) 2019-06-04 2023-09-15 华为技术有限公司 一种集合通信的方法、装置及系统
CN110535782B (zh) 2019-06-15 2023-06-20 华为技术有限公司 一种实现QoS保障的报文处理方法、设备和系统
EP4024783A4 (en) * 2019-09-11 2022-09-07 Huawei Technologies Co., Ltd. CONTROL METHOD AND DEVICE FOR DATA TRANSMISSION
CN116456397A (zh) * 2019-11-14 2023-07-18 华为技术有限公司 一种资源分配方法、装置、系统及存储介质
CN111049840B (zh) * 2019-12-17 2022-04-26 锐捷网络股份有限公司 一种报文检测方法及装置
CN111181825B (zh) * 2019-12-31 2021-12-21 智车优行科技（北京）有限公司 信息处理方法和装置、电子设备和存储介质
CN113709015A (zh) * 2020-05-20 2021-11-26 中兴通讯股份有限公司 数据传输方法、电子设备及存储介质
CN113364684B (zh) * 2021-05-07 2023-01-17 联想(北京)有限公司 一种信息处理方法、边缘计算平台及存储介质
CN115834091A (zh) * 2021-09-16 2023-03-21 华为云计算技术有限公司 网络流量控制方法以及相关系统
CN116113006A (zh) * 2021-11-10 2023-05-12 华为技术有限公司 一种处理报文的系统、方法和网络装置
CN115426301B (zh) * 2022-08-24 2023-11-10 北京华耀科技有限公司 基于自生报文的设备检测方法、装置、设备和存储介质
CN117675258A (zh) * 2022-09-06 2024-03-08 华为技术有限公司 网络隔离方法、系统及相关设备
CN117834478A (zh) * 2023-12-14 2024-04-05 天翼云科技有限公司 一种公有云检测集群支持高可用的方法和系统
CN118802304B (zh) * 2024-04-26 2026-01-30 中国移动通信有限公司研究院 路由安全的配置方法、装置、设备、存储介质及程序产品

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102035724A (zh) * 2009-09-30 2011-04-27 华为技术有限公司 一种实现报文转发的方法、装置和系统
CN103534991A (zh) * 2013-07-23 2014-01-22 华为技术有限公司 一种报文转发方法及设备
CN104025505A (zh) * 2011-12-31 2014-09-03 英特尔公司 用于管理用户认证的方法、装置和系统
CN106034089A (zh) * 2015-03-20 2016-10-19 中兴通讯股份有限公司 基于调度流标识的报文调度方法和装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102263774B (zh) * 2010-05-24 2014-04-16 杭州华三通信技术有限公司 一种处理源角色信息的方法和装置
US9716592B1 (en) * 2011-06-10 2017-07-25 Google Inc. Traffic distribution over multiple paths in a network while maintaining flow affinity
US9094459B2 (en) * 2012-07-16 2015-07-28 International Business Machines Corporation Flow based overlay network
CN104702505B (zh) 2013-12-04 2018-03-27 华为技术有限公司 一种报文传输方法和节点

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102035724A (zh) * 2009-09-30 2011-04-27 华为技术有限公司 一种实现报文转发的方法、装置和系统
CN104025505A (zh) * 2011-12-31 2014-09-03 英特尔公司 用于管理用户认证的方法、装置和系统
CN103534991A (zh) * 2013-07-23 2014-01-22 华为技术有限公司 一种报文转发方法及设备
CN106034089A (zh) * 2015-03-20 2016-10-19 中兴通讯股份有限公司 基于调度流标识的报文调度方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3531635A4

Also Published As

Publication number Publication date
US12101254B2 (en) 2024-09-24
EP3531635B1 (en) 2023-04-26
CN108011824A (zh) 2018-05-08
US10931580B2 (en) 2021-02-23
EP3531635A4 (en) 2019-11-06
CN108011824B (zh) 2021-07-09
EP3531635A1 (en) 2019-08-28
US20190260677A1 (en) 2019-08-22
CN113938426A (zh) 2022-01-14
US20210144092A1 (en) 2021-05-13

Similar Documents

Publication Publication Date Title
US12101254B2 (en) Packet processing method and network device
CN100472487C (zh) 用于域间通信的虚拟广播网络
CN102907049B (zh) 基于虚拟站接口发现和配置协议响应来指定优先级
CN104639512B (zh) 网络安全方法和设备
JP7322088B2 (ja) パケット検出方法および第１のネットワーク機器
CN106452857A (zh) 生成配置信息的方法和网络控制单元
CN104579898A (zh) 一种租户隔离方法及系统
CN106533947B (zh) 报文处理方法及装置
US11855888B2 (en) Packet verification method, device, and system
CN107426343A (zh) 用于跨网络内的多个接口代理子网内流量的方法、系统和装置
WO2022237291A1 (zh) 报文传输方法、装置、相关设备及存储介质
CN104580505A (zh) 一种租户隔离方法及系统
WO2020052499A1 (zh) 防仿冒攻击检查的方法、设备和系统
CN106533973A (zh) 分发业务消息的方法、设备和系统
CN111614505A (zh) 报文处理的方法和网关设备
WO2025180331A1 (zh) 信息处理方法、装置、设备、存储介质及计算机程序产品
CN103561122A (zh) IPv6地址配置方法、IPv6客户端及服务器
CN107809386A (zh) Ip地址转换方法、路由设备和通信系统
CN106209554B (zh) 跨虚拟可扩展局域网的报文转发方法和设备
CN104836738A (zh) 路由硬件表项资源管理方法、装置及网络设备
CN105337860B (zh) 一种数据包传输路径的确定方法、装置及系统
CN105933235A (zh) 数据通信方法及装置
WO2024051321A1 (zh) 网络隔离方法、系统及相关设备
CN114024725B (zh) 一种容器间通信方法、系统、电子设备及存储介质
CN112929193B (zh) 用于配置介质访问控制地址老化时间的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17867096

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017867096

Country of ref document: EP

Effective date: 20190521