WO2024082081A1 - 一种报文处理方法及装置 - Google Patents

一种报文处理方法及装置 Download PDF

Info

Publication number
WO2024082081A1
WO2024082081A1 PCT/CN2022/125569 CN2022125569W WO2024082081A1 WO 2024082081 A1 WO2024082081 A1 WO 2024082081A1 CN 2022125569 W CN2022125569 W CN 2022125569W WO 2024082081 A1 WO2024082081 A1 WO 2024082081A1
Authority
WO
WIPO (PCT)
Prior art keywords
sav
message
source address
table entry
forwarding
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/125569
Other languages
English (en)
French (fr)
Inventor
吴斌
李丹
秦澜城
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tsinghua University
New H3C Technologies Co Ltd
Original Assignee
Tsinghua University
New H3C Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tsinghua University, New H3C Technologies Co Ltd filed Critical Tsinghua University
Priority to US18/715,049 priority Critical patent/US20250030633A1/en
Priority to CN202280003578.5A priority patent/CN118216125A/zh
Priority to PCT/CN2022/125569 priority patent/WO2024082081A1/zh
Priority to EP22962281.6A priority patent/EP4425860A4/en
Publication of WO2024082081A1 publication Critical patent/WO2024082081A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H04L45/748—Address table lookup; Address filtering using longest matching prefix
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/72—Routing based on the source address
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L27/00—Modulated-carrier systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/54—Organization of routing tables
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H04L45/74591—Address table lookup; Address filtering using content-addressable memories [CAM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data

Definitions

  • the present application relates to the field of communication technology, and in particular to a message processing method and device.
  • SAVNET Source Address Validation in Intra-domain and Inter-domain Networks
  • IPv6 Internet Protocol version 6
  • the purpose of the embodiments of the present application is to provide a message processing method and device to solve the problem of low message processing accuracy due to the length limitation of the result field of the SAV table entry of the data plane.
  • the specific technical solution is as follows:
  • an embodiment of the present application provides a message processing method, which is applied to a network device, and the method includes:
  • the message is released.
  • the network device includes at least one forwarding chip; each forwarding chip stores a SAV table entry whose key fields of the data plane include an interface index on the forwarding chip; and/or,
  • the SAV table entries of the data plane are stored in TCAM (Ternary Content Addressable Memory).
  • the result field of the SAV table entry of the data plane is empty
  • the input interface index and the legal source address prefix are filled in the order of the input interface index and the legal source address prefix; or in the key field of the SAV table item, the legal source address prefix and the input interface index are filled in the order of the legal source address prefix and the input interface index.
  • the method further comprises:
  • the method further comprises:
  • the determined deployment mode is the full deployment mode, and the key fields of all SAV table entries of the data plane do not match the inbound interface index of the received message and the source address of the message, discarding the message;
  • the step of matching the source address of the message with the key field of the forwarding table entry to obtain a target forwarding table entry whose key field matches the source address of the message is performed.
  • the step of matching the source address of the message with a key field of a forwarding table entry to obtain a target forwarding table entry whose key field matches the source address of the message includes:
  • a candidate table entry to which the longest address prefix belongs is determined as a target forwarding table entry whose key field matches the source address of the message.
  • the network device includes at least one forwarding chip; each forwarding chip stores forwarding table entries learned by the network device; and/or,
  • the forwarding table entries are stored in the TCAM.
  • the bit width of the SAV flag is 1 bit.
  • the method further comprises:
  • a key field of the SAV table entry of the control plane includes an inbound interface index, and a value field of the SAV table entry of the control plane includes at least one legal source address prefix;
  • the SAV table entry of the data plane is constructed according to the SAV table entry of the control plane.
  • an embodiment of the present application provides a message processing device, which is applied to a network device, and the device includes:
  • a first matching unit configured to match an inbound interface index of a received message and a source address of the message with a key field of a SAV table entry of a data plane, wherein the key field of the SAV table entry of the data plane includes an inbound interface index and a legal source address prefix;
  • the first release unit is configured to release the message if the key field of the target SAV table entry matches the inbound interface index of the received message and the source address of the message.
  • the network device includes at least one forwarding chip; each forwarding chip stores a SAV table entry whose key fields of the data plane include an interface index on the forwarding chip; and/or,
  • the SAV table entries of the data plane are stored in the TCAM.
  • the result field of the SAV table entry of the data plane is empty
  • the input interface index and the legal source address prefix are filled in the order of the input interface index and the legal source address prefix; or in the key field of the SAV table item, the legal source address prefix and the input interface index are filled in the order of the legal source address prefix and the input interface index.
  • the apparatus further comprises:
  • a second matching unit used for matching the source address of the message with a key field of a forwarding table item, obtaining a target forwarding table item whose key field matches the source address of the message, wherein the key field of the forwarding table item includes an address prefix, and a result field of the forwarding table item includes a SAV flag;
  • a first discarding unit configured to discard the message if the key fields of all SAV table entries of the data plane do not match the incoming interface index of the received message and the source address of the message, and the SAV flag included in the result field of the target forwarding table entry indicates that the address prefix included in the target forwarding table entry is a legal source address prefix of an incoming interface;
  • the second release unit is used to release the message if the key fields of all SAV table entries in the data plane do not match the incoming interface index of the received message and the source address of the message, and the SAV flag included in the result field of the target forwarding table entry does not indicate that the address prefix included in the target forwarding table entry is a legal source address prefix of an incoming interface.
  • the apparatus further comprises:
  • a determination unit configured to determine a deployment mode of a SAVNET of a network to which the network device belongs;
  • a second discarding unit configured to discard the message if the determined deployment mode is a full deployment mode and the key fields of all SAV table entries of the data plane do not match the inbound interface index of the received message and the source address of the message;
  • the second matching unit includes a first matching sub-unit
  • the first matching subunit is used to match the source address of the message with the key field of the forwarding table entry if the determined deployment mode is a partial deployment mode, and obtain a target forwarding table entry whose key field matches the source address of the message.
  • the second matching unit comprises a second matching sub-unit
  • the second matching subunit is used to match the source address of the message with the address prefix included in the key field of the forwarding table entry, and obtain at least one candidate table entry whose address prefix matches the source address of the message; from the at least one candidate table entry, determine the candidate table entry to which the longest address prefix belongs as the target forwarding table entry whose key field matches the source address of the message.
  • the network device includes at least one forwarding chip; each forwarding chip stores forwarding table entries learned by the network device; and/or,
  • the forwarding table entries are stored in the TCAM.
  • the bit width of the SAV flag is 1 bit.
  • the apparatus further comprises:
  • a learning unit configured to learn a SAV table entry of a control plane, wherein a key field of the SAV table entry of the control plane includes an inbound interface index, and a value field of the SAV table entry of the control plane includes at least one legal source address prefix;
  • a construction unit is used to construct the SAV table entry of the data plane according to the SAV table entry of the control plane.
  • an embodiment of the present application provides a forwarding chip that executes any of the method steps described above.
  • an embodiment of the present application provides a network device, wherein the network device includes at least one forwarding chip, and the forwarding chip is used to execute any of the method steps described above.
  • the network device also includes a processor; the processor is used to learn the SAV table entries of the control plane, the key fields of the SAV table entries of the control plane include the input interface index, and the value fields of the SAV table entries of the control plane include at least one legal source address prefix; based on the SAV table entries of the control plane, the SAV table entries of the data plane are constructed.
  • the network device after receiving a message, matches the incoming interface index of the received message and the source address of the message with the key field of the SAV table entry of the data plane, and releases the message when obtaining the target SAV table entry with a key field match. It can be seen that in the technical solution provided by the embodiment of the present application, when processing a message, the network device is not subject to the length limit of the result field of the SAV table entry, and can complete the SAV corresponding to all incoming interfaces, thereby improving the accuracy of message processing.
  • FIG1 is a schematic diagram of a network architecture for deploying SAVNET
  • FIG2 is a schematic diagram of the structure of a SAV table entry of the control plane
  • FIG3 is a schematic diagram of the structure of a SAV table entry in the data plane
  • FIG4 is a flow chart of a message processing method in the prior art
  • FIG5 is a schematic diagram of a first flow chart of a message processing method provided in an embodiment of the present application.
  • FIG6 is a schematic diagram of the structure of a SAV table entry of a data plane provided in an embodiment of the present application.
  • FIG7 is a schematic diagram of a second flow chart of a message processing method provided in an embodiment of the present application.
  • FIG8 is a schematic diagram of a structure of a forwarding table entry of a data plane provided in an embodiment of the present application.
  • FIG9 is a flow chart of a method for constructing a SAV table entry provided in an embodiment of the present application.
  • FIG10 is a schematic diagram of a structure of a SAV table entry of a control plane provided in an embodiment of the present application.
  • FIG11 is a schematic diagram of a third flow chart of a message processing method provided in an embodiment of the present application.
  • FIG12 is a schematic diagram of a first structure of a message processing device provided in an embodiment of the present application.
  • FIG13 is a schematic diagram of a second structure of a message processing device provided in an embodiment of the present application.
  • FIG. 14 is a schematic diagram of the structure of a SAV table entry construction device provided in an embodiment of the present application.
  • CM Complete Mode: All network devices in the network are deployed with SAVNET.
  • the network devices can be devices with communication functions such as routers, switches, or firewalls.
  • the network architecture shown in Figure 1 includes nodes 1-6. If nodes 1-6 are all deployed with SAVNET, the deployment mode of the network is CM.
  • IM Complete Mode: SAVNET is deployed on some network devices in the network. As shown in the network architecture of Figure 1, the network shown in Figure 1 includes nodes 1-6. If SAVNET is deployed on some nodes of nodes 1-6, such as nodes 2-6, but SAVNET is not deployed on node 1, the deployment mode of the network is IM.
  • SAVNET is a technology to prevent network attacks with forged IPv6 source addresses, using a source address verification scheme based on routing information.
  • the basic principle of SAVNET is to establish a mapping relationship between the source address and the input interface of the network device, and to filter the received messages by checking whether the input interface of the received message belongs to the legal input interface corresponding to the source address of the message.
  • the network devices that deploy SAVNET can use BGP (Border Gateway Protocol) extension, IGP (Interior Gateway Protocol) extension or other private protocols in the control plane to learn the mapping relationship between the source address and the input interface of the network device through SPA (Source Prefix Advertising) message and DPP (Destination Prefix Probing) message.
  • BGP Border Gateway Protocol
  • IGP Interior Gateway Protocol
  • SPA Source Prefix Advertising
  • DPP Destination Prefix Probing
  • nodes 1-3 are edge nodes.
  • Node 1 collects information such as direct routing, static routing, and IGP routing protocols with the interface connected to the legal terminal A on the user side as the outgoing interface, and obtains the legal user network segment under the user-side interface of node 1 as the legal source address prefix of node 1;
  • node 2 collects information such as direct routing, static routing, and IGP routing protocols with the interface connected to the legal terminal B on the user side as the outgoing interface, and obtains the legal user network segment under the user-side interface of node 2 as the legal source address prefix of node 2;
  • node 3 collects information such as direct routing, static routing, and IGP routing protocols with the interface connected to the legal terminal C on the user side as the outgoing interface, and obtains the legal user network segment under the user-side interface of node 3 as the legal source address
  • the edge node carries the legal source address prefix of the edge node in the SPA message, and notifies the SPA message to the neighboring nodes connected to the network side interface of the edge node; the neighboring node learns the legal source address prefix of the edge node, and continues to notify the SPA message to other nodes, so that other nodes learn the legal source address prefix of the edge node. Finally, all nodes in the network learn the legal source address prefixes of all edge nodes.
  • node 1 sends an SPA message to neighbor node 4, and neighbor node 4 learns the legal source address prefix of node 1 through the SPA message; then, neighbor node 4 sends an SPA message to node 6, and node 6 learns the legal source address prefix of node 1 through the SPA message.
  • node 1-6 learns the legal source address prefix of node 1-3.
  • the edge node detects the legal path of traffic through the DPP message: traverse the network side interface, select the network side interface connected to the neighbor node, obtain all FIB (Forwarding Information Base) prefixes with this interface as the outgoing interface, encapsulate them into the DPP message as the reachable destination address prefix list, and send the DPP message from this interface; after the neighbor node receives the DPP message from the edge node, it establishes the mapping relationship between the legal source prefix and the incoming interface of the edge node based on the pre-learned legal source prefix of the edge node and the incoming interface of the received DPP message; at the same time, the neighbor node splits the reachable destination address prefix list in the DPP message according to the outgoing interface of this node, forms one or more DPP messages, and continues to detect. Finally, all nodes in the network learn the mapping relationship between the legal source prefix and the incoming interface. Among them, the FIB prefix is the address prefix included in the key (key
  • each node learns a series of SAV table entries of the control plane.
  • the structure of the SAV table entries of the control plane is shown in Figure 2.
  • key represents the key field
  • value represents the value field
  • key includes a legal source address prefix, such as Prefix 1 in Figure 2
  • value includes one or more legal input interface indexes, such as IF 1-IF n in Figure 2.
  • the network device Based on the structure of the SAV table entry of the control plane, the network device generates the SAV table entry of the data plane, as shown in Figure 3, where key represents the key field and Result represents the result field.
  • Key includes a legal source address prefix, such as Prefix 1 in Figure 3
  • Result includes one or more legal input interface indexes, such as IF 1-IF n in Figure 3.
  • the network device Based on the SAV table entry of the data plane shown in Figure 3, the network device filters the message.
  • the specific message processing flow is shown in Figure 4:
  • the network device extracts the SIP (Source Internet Protocol) address of the received message, and matches the SIP with the key of the SAV table entry of the data plane; if the SIP matches the key, that is, the SIP is in the network segment represented by the key of the SAV table entry, then the input interface index of the message received by the network device is matched with the Result of the SAV table entry of the data plane; if the input interface index matches the Result, that is, the Result of the SAV table entry includes the input interface index of the message received by the network device, then it means that the input interface of the message received by the network device is a legal input interface of the legal source address prefix in the key, and the message is released; if the input interface index does not match the Result, that is, the Result of the SAV table entry does not include the input interface index of the message received by the network device, then it means that the input interface of the message received by the network device is not a legal input interface of the legal source address prefix in the key, and the message is
  • the SIP does not match the key and the network deployment mode is CM, it means that the SIP does not belong to the legal source address prefix and the message is discarded; if the SIP does not match the key and the network deployment mode is IM, the SIP may belong to the legal source address prefix, but the network device has not yet learned the legal source address prefix corresponding to the SIP. In order to avoid erroneous discarding of legal messages, the message is released.
  • the above-mentioned message processing method is implemented based on the SAV table entry of the data plane.
  • the length of the result field of the SAV table entry is limited, and the number of input interface indexes that can be stored is limited, for example, 8 input interface indexes can be stored.
  • the number of input interface indexes of a legal source address prefix is large, some input interface indexes will not be written into the result field of the SAV table entry, and the network device will not be able to accurately filter the message, and the message processing accuracy is low.
  • an embodiment of the present application provides a message processing method, which can be applied to any network device in the network, such as any node in nodes 1-6 shown in Figure 1.
  • the network device After receiving the message, the network device matches the input interface index of the received message and the source address of the message with the key field of the SAV table entry of the data plane, and releases the message when obtaining the target SAV table entry with a key field match. It can be seen that in the technical solution provided by the embodiment of the present application, when processing the message, the network device is not subject to the length limit of the result field of the SAV table entry, and can complete the SAV corresponding to all input interfaces, thereby improving the accuracy of message processing.
  • an embodiment of the present application provides a message processing method, which is applied to a network device and includes the following steps:
  • Step S51 matching the incoming interface index of the received message and the source address of the message with the key fields of the SAV table entry of the data plane, where the key fields of the SAV table entry of the data plane include the incoming interface index and the legal source address prefix;
  • Step S52 If the key field of the target SAV entry matches the incoming interface index of the received message and the source address of the message, the message is released.
  • the network device after receiving a message, matches the incoming interface index of the received message and the source address of the message with the key field of the SAV table entry of the data plane, and releases the message when obtaining the target SAV table entry with the key field matching. It can be seen that in the technical solution provided by the embodiment of the present application, when processing a message, the network device is not subject to the length restriction of the result field of the SAV table entry, and can complete the SAV corresponding to all incoming interfaces, thereby improving the accuracy of message processing.
  • the message processing method provided in the embodiment of the present application can be implemented by the CPU (Central Processing Unit) of the network device.
  • the message processing method provided in the embodiment of the present application can also be implemented by the forwarding chip of the network device.
  • the network device may include one or more forwarding chips.
  • each forwarding chip stores the SAV table entry of the data plane.
  • each forwarding chip may store all SAV entries of the data plane, so that the forwarding chip can perform more comprehensive and accurate message processing.
  • each forwarding chip stores the SAV table entry of the data plane corresponding to the interface on the forwarding chip, that is, each forwarding chip stores the SAV table entry whose key field of the data plane includes the interface index on the forwarding chip. This can greatly save the table entry resources in the forwarding chip.
  • the key fields of SAV entry 1 include ⁇ interface 1, address prefix 1 ⁇ , and the key fields of SAV entry 2 include ⁇ interface 2, address prefix 1 ⁇ .
  • Forwarding chip 1 includes interface 1
  • forwarding chip 2 includes interface 2. At this time, SAV entry 1 is stored in forwarding chip 1, and SAV entry 2 is stored in forwarding chip 2.
  • the SAV table entries stored in forwarding chip 1 and forwarding chip 2 both need to include interface 1 and interface 2.
  • the number of input interface indexes stored in a forwarding chip is reduced, saving table entry resources.
  • a TCAM (Ternary Content Addressable Memory) may also be configured in the network device, and the SAV table entries of the data plane are stored in the TCAM.
  • the network device uses the TCAM to match the key fields of the input interface index and source address with the SAV table entries of the data plane, which can greatly improve the matching efficiency and thus improve the message processing efficiency.
  • the TCAM when the message processing method is implemented by a forwarding chip of a network device, the TCAM is configured in the forwarding chip or connected to the forwarding chip. This is not limited.
  • search engines besides TCAM may be configured in the network device, as long as they can communicate with the forwarding chip and complete the matching search for the SAV table entry.
  • the SAV table entry of the data plane includes a key field and a result field.
  • the key field includes two types of information, namely, the input interface index and the legal source address prefix; the result field can be filled with default information, or no information can be filled, that is, the result field is empty, and the SAV table entry structure of the data plane can be shown in Figure 6.
  • key represents the key field
  • Result represents the result field
  • IF represents the input interface index
  • Prefix represents the legal source address prefix.
  • the SAV table entry resources can be saved to the maximum extent.
  • the above default information can be set according to actual needs.
  • the default information can be: information indicating that the message is forwarded after adding a legal identifier to the message, or information indicating that the message is forwarded after deep packet inspection is performed on the message, or information indicating that the message is forwarded after encryption processing is performed on the message, etc.
  • the network device may fill in the legal source address prefix and the inbound interface index in the order of the legal source address prefix and the inbound interface index.
  • the network device can also fill the inbound interface index and the legal source address prefix in the order of the inbound interface index and the legal source address prefix.
  • the valid information in the key field is located at the front end of the key field, which is convenient for the network device to process the key field and save storage resources.
  • the network device After receiving the message, the network device extracts the source address of the message and determines the index of the inbound interface through which the network device receives the message.
  • the network device can combine the source address of the message and the index of the inbound interface through which the message is received in the order of the inbound interface index and the legal source address prefix in the key field of the SAV table entry of the data plane, and match the combined information with the key field of the SAV table entry of the data plane.
  • the network device can use LPM (Longest Prefix Match) to complete the matching of the key fields of the combined information with the SAV table items of the data plane, and obtain the target SAV table items whose key fields match the above-mentioned combined information.
  • LPM Longest Prefix Match
  • the network device can also use other methods to complete the matching of the key fields of the combined information with the SAV table items of the data plane, which is not limited.
  • the network device matches the combined information with the key field of the SAV table item of the data plane. If the input interface index in the combined information is the same as the input interface index in the key field of the SAV table item, and the source address in the combined information has a legal source address prefix in the key field of the SAV table item, then it means that the combined information matches the key field of the SAV table item of the data plane; otherwise, the two do not match.
  • the network device executes the above step S52 to release the message, such as forwarding the message to the destination terminal according to the destination address of the message.
  • a message processing method is also provided, as shown in FIG7 , which may include the following steps:
  • Step S71 matching the incoming interface index of the received message and the source address of the message with the key fields of the SAV table entry of the data plane, where the key fields of the SAV table entry of the data plane include the incoming interface index and the legal source address prefix;
  • Step S72 if the key field of the target SAV entry matches the incoming interface index of the received message and the source address of the message, the message is released;
  • Step S73 matching the source address of the message with the key field of the forwarding table entry, obtaining a target forwarding table entry whose key field matches the source address of the message, wherein the key field of the forwarding table entry includes the address prefix, and the result field of the forwarding table entry includes the SAV flag;
  • Step S74 if the key fields of all SAV entries in the data plane do not match the incoming interface index of the received message and the source address of the message, and the SAV flag included in the result field of the target forwarding entry indicates that the address prefix included in the target forwarding entry is a legal source address prefix of an incoming interface, then the message is discarded;
  • Step S75 if the key fields of all SAV entries in the data plane do not match the incoming interface index of the received message and the source address of the message, and the SAV flag included in the result field of the target forwarding entry does not indicate that the address prefix included in the target forwarding entry is a legal source address prefix of an incoming interface, then the message is released.
  • the message processing method provided in the embodiment of the present application can be implemented by the CPU of the network device.
  • the message processing method provided in the embodiment of the present application can also be implemented by the forwarding chip of the network device.
  • the network device may include one or more forwarding chips.
  • each forwarding chip stores the forwarding table entries learned by the network device.
  • a TCAM may be configured in the network device, and the forwarding table entries of the data plane are stored in the TCAM.
  • the network device uses the TCAM to match the source address with the key fields of the forwarding table entries of the data plane, which can greatly improve the matching efficiency and thus improve the message processing efficiency.
  • the TCAM when the message processing method is implemented by a forwarding chip of a network device, the TCAM is configured in the forwarding chip or connected to the forwarding chip. This is not limited.
  • search engines besides TCAM may be configured in the network device, as long as they can communicate with the forwarding chip and complete the matching search of the forwarding table entries.
  • the embodiment of the present application does not limit the execution order of step S71 and step S73.
  • the network device can learn one or more forwarding table items.
  • the forwarding table item includes a key field and a result field, wherein the key field includes the address prefix, and the result field includes the SAV flag.
  • the structure of the forwarding table item can be seen in Figure 8, in which key represents the key field, Result represents the result field, Prefix represents the address prefix, and SAVflag represents the SAV flag.
  • the SAV flag indicates that the address prefix included in the forwarding table entry is a legal source address prefix of an incoming interface, or the SAV flag does not indicate that the address prefix included in the forwarding table entry is a legal source address prefix of an incoming interface.
  • the bit width of the SAV flag can be 1 bit.
  • the SAV flag can take a value of 0 or 1.
  • the SAV flag indicates that the address prefix included in this forwarding table item is a legal address prefix of an incoming interface, and when the SAV flag is 0, the SAV flag does not indicate that the address prefix included in this forwarding table item is a legal address prefix of an incoming interface.
  • 1 bit can be added to the result field of the forwarding table item to serve as the position of the SAV flag, or the reserved bit of the result field of the forwarding table item can be utilized to serve as the position of the SAV flag, without the need to add new table item resources, while ensuring the accuracy of message processing, saving table item resources.
  • bit width of the SAV flag may also be 2, 3 or 4 bits, etc., without limitation.
  • the result field of the forwarding table entry may include other information in addition to the SAV flag, such as an outbound interface index, a next hop index, etc., which is not limited to this.
  • the source address of the message has an address prefix in the key field of the forwarding table entry, it means that the source address of the message matches the key field of the forwarding table entry, and the matching forwarding table entry is the target forwarding table entry; otherwise, it means that the source address of the message does not match the key field of the forwarding table entry.
  • the network device detects that the SAV flag in the target forwarding table entry indicates that the address prefix included in the target forwarding table entry is a legal source address prefix of an incoming interface, for example, the SAV flag is 1, it means that the address prefix included in the target forwarding table entry is a legal source address prefix of an incoming interface, but is not a legal source address prefix of the incoming interface of the received message, execute step S74 and discard the message to improve the security of the network.
  • step S75 is executed to release the message to avoid erroneous discarding of legal messages.
  • the network device can support parallel search of SAV table entries and forwarding table entries in the data plane, such as using TCAM to support parallel search of multiple tables, and executing the above steps S71 and S73 in parallel, thereby improving matching efficiency and improving message processing efficiency.
  • the network device may determine the deployment mode of the SAVNET of the network to which the network device belongs.
  • the determined deployment mode is the full deployment mode, it means that the network device should have learned all legal source address prefixes. At this time, it is not necessary to perform the above step S73 to search for forwarding entries.
  • the key fields of all SAV entries in the data plane do not match the incoming interface index of the received message and the source address of the message, it means that the message is an illegal message and the network device discards the message.
  • the network device may execute the above step S73, search for the forwarding table entry, and then execute steps S74-S75.
  • the network device in a fully deployed mode, only needs to determine that the key fields of all SAV table entries in the data plane do not match the incoming interface index of the received message and the source address of the message, and then determine that the message is an illegal message and discard the message.
  • the network device there is no need to search for forwarding table entries, which reduces the time spent in searching for forwarding table entries and improves message processing efficiency.
  • the above-mentioned step S73 may be: the network device uses the LPM method to search for the routing table entry to obtain the target routing table entry, which may be specifically: matching the source address of the received message with the address prefix included in the key field of the routing table entry to obtain at least one candidate table entry whose address prefix matches the source address of the message; from at least one candidate table entry, determining the candidate table entry to which the longest address prefix belongs as the target routing table entry whose key field matches the source address of the message.
  • the source address of the received message is 1.1.1.1
  • the address prefix included in the key field of forwarding entry 1 is 1.1.0.0/16
  • the address prefix included in the key field of forwarding entry 2 is 1.1.1.0/24.
  • the network device matches the source address of the received message with the address prefix included in the key field of the forwarding entry, and obtains candidate entries as forwarding entry 1 and forwarding entry 2.
  • the length of 1.1.0.0/16 is less than the length of 1.1.1.0/24, so the network device determines that the candidate entry to which the longest address prefix belongs from forwarding entry 1 and forwarding entry 2 is forwarding entry 2 to which 1.1.1.0/24 belongs, that is, forwarding entry 2 is used as the target forwarding entry whose key field matches the source address of the message.
  • the network device can also use other methods to search for forwarding table items and obtain target forwarding table items. For example, the network device matches the source address of the received message with the address prefix included in the key field of the forwarding table item, and obtains at least one candidate table item whose address prefix matches the source address of the message; and uses the at least one candidate table item as the target forwarding table item.
  • the network device discards the message to avoid mis-forwarding the message. Otherwise, that is, the SAV flag included in the result field of all target forwarding table items does not indicate that the address prefix included in the target forwarding table item is a legal source address prefix of an incoming interface, the network device releases the message.
  • an embodiment of the present application provides a SAV table entry construction method, as shown in FIG9 , which may include the following steps:
  • Step S91 learning a SAV table entry of the control plane, wherein a key field of the SAV table entry of the control plane includes an inbound interface index, and a value field of the SAV table entry of the control plane includes at least one legal source address prefix.
  • the SAV table entry of the control plane includes a key field and a value field, wherein the key field includes an input interface index, and the value field includes one or more legal source address prefixes.
  • key represents the key field
  • value represents the value field
  • IF represents the input interface index
  • Prefix 1-Prefix n represents the legal source address prefix.
  • the network device can learn the mapping relationship between the source address and the input interface of the network device through the SPA message and the DPP message, and construct the SAV table entry of the control plane.
  • the specific process of constructing the SAV table entry of the control plane can be found in the above related description, which will not be repeated here.
  • Step S92 construct the SAV table entry of the data plane according to the SAV table entry of the control plane.
  • the network device After obtaining the SAV table entry of the control plane, the network device uses ⁇ incoming interface index, source address prefix ⁇ as the key to convert the SAV table entry of the control plane into the SAV table entry of the data plane.
  • the SAV table entry of the data plane obtained after the conversion can be seen in Figure 6.
  • the network device changes the structure of the control plane SAV table entry, using the input interface index as the key, so that the network device can more quickly determine the key fields of the SAV table entries of which data planes the interface index on the forwarding chip is located, and then quickly send the SAV table entries of the data plane to the corresponding forwarding chip.
  • the network device may also adopt the structure of the control plane SAV table entry in the prior art, as shown in FIG. 2 , without limitation thereto.
  • SAVflag represents a SAV flag
  • SAVflag is 1, indicating that the address prefix included in this forwarding table entry is a legal source address prefix of an incoming interface
  • SAVflag is 0, not indicating that the address prefix included in this forwarding table entry is a legal source address prefix of an incoming interface.
  • the network device extracts the SIP address of the received message and the index IF of the input interface receiving the message, and performs the following two matching operations: matching the SIP and IF with the key of the SAV table item of the data plane, and matching the SIP with the key of the forwarding table item of the data plane.
  • the above two matching operations can be performed in parallel or in series, such as first matching the SIP and IF with the key of the SAV table item of the data plane, and then matching the SIP with the key of the forwarding table item of the data plane; for another example, first matching the SIP and IF with the key of the SAV table item of the data plane, and if the SIP and IF do not match the key of the SAV table item of the data plane, and in the case of an IM scenario, then matching the SIP with the key of the forwarding table item of the data plane.
  • the specific execution order can be set according to actual needs.
  • the SIP and IF match the key of the SAV table entry, that is, the SIP is in the network segment represented by the key of the SAV table entry, and the inbound interface index included in the IF and SAV table entry key is the same, then it means that the source address of the message belongs to the legal source address prefix of the inbound interface of the network device receiving the message, and the message is released.
  • the message is an illegal message and is discarded to improve network security.
  • the current deployment mode is IM
  • the SAVflag in the result field of the target forwarding table entry that matches SIP is 1, it means that the source address of the message does not belong to the legal source address prefix of the input interface of the network device receiving the message, but belongs to the legal source address prefix of other input interfaces.
  • the message is discarded to improve network security.
  • the current deployment mode is IM
  • the SAVflag in the result field of the target forwarding table entry that matches the SIP is 0, it means that the SIP may be a legal source address prefix, but the network device has not yet learned the legal source address prefix corresponding to the SIP. In order to avoid erroneous discarding of legal messages, the message is released.
  • each forwarding chip can only store the SAV table entries corresponding to the interfaces on the forwarding chip, thereby reducing the number of incoming interface indexes stored on each forwarding chip, and correspondingly saving the number of SAV table entries of the stored incoming interface indexes, thereby saving table entry resources.
  • the embodiment of the present application further provides a message processing device, as shown in FIG12, which is applied to a network device, and the device includes:
  • a first matching unit 121 configured to match an inbound interface index of a received message and a source address of the message with a key field of a SAV table entry of a data plane, where the key field of the SAV table entry of the data plane includes an inbound interface index and a legal source address prefix;
  • the first release unit 122 is configured to release the message if the key field of the target SAV entry matches the inbound interface index of the received message and the source address of the message.
  • the network device after receiving a message, matches the incoming interface index of the received message and the source address of the message with the key field of the SAV table entry of the data plane, and releases the message when obtaining the target SAV table entry with the key field matching. It can be seen that in the technical solution provided by the embodiment of the present application, when processing a message, the network device is not subject to the length restriction of the result field of the SAV table entry, and can complete the SAV corresponding to all incoming interfaces, thereby improving the accuracy of message processing.
  • the network device may include at least one forwarding chip; each forwarding chip stores a SAV table entry whose key fields of the data plane include an interface index on the forwarding chip; and/or,
  • the SAV table entries of the data plane are stored in the TCAM.
  • the result field of the SAV table entry of the data plane is empty
  • the inbound interface index and the legal source address prefix are filled in the order of the inbound interface index and the legal source address prefix; or in the key field of the SAV table entry, the legal source address prefix and the inbound interface index are filled in the order of the legal source address prefix and the inbound interface index.
  • the message processing device may further include:
  • the second matching unit 123 is used to match the source address of the message with the key field of the forwarding table item, obtain the target forwarding table item whose key field matches the source address of the message, the key field of the forwarding table item includes the address prefix, and the result field of the forwarding table item includes the SAV flag;
  • a first discarding unit 124 is configured to discard a message if the key fields of all SAV table entries of the data plane do not match the incoming interface index of the received message and the source address of the message, and the SAV flag included in the result field of the target forwarding table entry indicates that the address prefix included in the target forwarding table entry is a legal source address prefix of an incoming interface;
  • the second release unit 125 is used to release the message if the key fields of all SAV table entries in the data plane do not match the incoming interface index of the received message and the source address of the message, and the SAV flag included in the result field of the target forwarding table entry does not indicate that the address prefix included in the target forwarding table entry is a legal source address prefix of an incoming interface.
  • the message processing device may further include:
  • a determination unit used for determining a deployment mode of source address verification SAVNET in an inter-domain and intra-domain network of a network to which the network device belongs;
  • a second discarding unit configured to discard the message if the determined deployment mode is the full deployment mode and the key fields of all SAV table entries of the data plane do not match the inbound interface index of the received message and the source address of the message;
  • the second matching unit 123 may include a first matching sub-unit
  • the first matching subunit is used to match the source address of the message with the key field of the forwarding table entry if the determined deployment mode is the partial deployment mode, and obtain a target forwarding table entry whose key field matches the source address of the message.
  • the second matching unit 123 may include a second matching sub-unit
  • the second matching subunit is used to match the source address of the message with the address prefix included in the key field of the forwarding table item, and obtain at least one candidate table item whose address prefix matches the source address of the message; from the at least one candidate table item, determine the candidate table item to which the longest address prefix belongs as the target forwarding table item whose key field matches the source address of the message.
  • the network device may include at least one forwarding chip; each forwarding chip stores forwarding table entries learned by the network device; and/or,
  • the forwarding table entries are stored in TCAM.
  • the bit width of the SAV flag is 1 bit.
  • a SAV table entry construction device which may include:
  • a learning unit 141 is used to learn a SAV table entry of a control plane, wherein a key field of the SAV table entry of the control plane includes an inbound interface index, and a value field of the SAV table entry of the control plane includes at least one legal source address prefix;
  • the constructing unit 142 is configured to construct the SAV table entry of the data plane according to the SAV table entry of the control plane.
  • the network device changes the structure of the control plane SAV table entry, using the input interface index as the key, so that the network device can more quickly determine the key fields of the SAV table entries of which data planes the interface index on the forwarding chip is located, and then quickly send the SAV table entries of the data plane to the corresponding forwarding chip.
  • an embodiment of the present application also provides a forwarding chip, which is used to execute any of the steps of the above-mentioned message processing method.
  • an embodiment of the present application further provides a network device, comprising at least one forwarding chip, which is used to execute any of the steps of the above-mentioned message processing method.
  • the network device may also include a processor; the processor is used to learn the SAV table entries of the control plane, the key fields of the SAV table entries of the control plane include the input interface index, and the value fields of the SAV table entries of the control plane include at least one legal source address prefix; based on the SAV table entries of the control plane, the SAV table entries of the data plane are constructed.
  • the construction of the SAV table entry is executed by the processor, and the forwarding chip is responsible for processing the message based on the constructed SAV table entry, which reduces the load of the forwarding chip and improves the message processing efficiency.
  • the forwarding chip can be a hardware processing chip such as NP (Network Processor), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, digital signal processors (DSP), discrete gate or transistor logic devices, discrete hardware components, etc., or a combination of multiple chips, without limitation.
  • NP Network Processor
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • DSP digital signal processors
  • discrete gate or transistor logic devices discrete hardware components, etc., or a combination of multiple chips, without limitation.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.
  • the computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated.
  • the available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.
  • SSD Solid State Disk

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供了一种报文处理方法及装置，应用于网络设备，该方法包括：将接收报文的入接口索引和报文的源地址与数据平面的SAV表项的关键字段匹配，数据平面的SAV表项的关键字段包括入接口索引和合法源地址前缀；若目标SAV表项的关键字段与接收报文的入接口索引和报文的源地址匹配，则放行报文。本申请实施例提供的技术方案中，网络设备在处理报文时，可以不受节约SAV表项的结果字段的长度限制，完成所有入接口对应的SAV，提高了报文处理的精度。

Description

一种报文处理方法及装置 技术领域
本申请涉及通信技术领域，特别是涉及一种报文处理方法及装置。
背景技术
SAVNET(Source Address Validation in Intra-domain and Inter-domain Networks，域间和域内网络中源地址验证)是一种防范伪造IPv6(Internet Protocol version 6，网际协议第6版)源地址网络攻击的技术。目前，网络设备采用SAVNET技术，对报文进行处理时，受数据平面的SAV表项的结果字段的长度限制，SAV(Source Address Validation，源地址验证)表项的结果字段只能存放有限数量个入接口索引，完成有限数量个入接口对应的SAV，导致报文处理的精度较低。
发明内容
本申请实施例的目的在于提供一种报文处理方法及装置，以解决因受数据平面的SAV表项的结果字段的长度限制，导致报文处理的精度较低的问题。具体技术方案如下：
第一方面，本申请实施例提供了一种报文处理方法，应用于网络设备，所述方法包括：
将接收报文的入接口索引和所述报文的源地址与数据平面的SAV表项的关键字段匹配，所述数据平面的SAV表项的关键字段包括入接口索引和合法源地址前缀；
若目标SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址匹配，则放行所述报文。
在一些实施例中，所述网络设备包括至少一个转发芯片；每个转发芯片中存储有数据平面的关键字段包括本转发芯片上的接口索引的SAV表项；和/或，
所述数据平面的SAV表项存储在TCAM(Ternary Content Addressable Memory，三态内容寻址存储器)中。
在一些实施例中，所述数据平面的SAV表项的结果字段为空；
所述数据平面的SAV表项的关键字段中，按照入接口索引和合法源地址前缀的顺序填充入接口索引和合法源地址前缀；或所述SAV表项的关键字段中，按照合法源地址前缀和入接口索引的顺序填充合法源地址前缀和入接口索引。
在一些实施例中，所述方法还包括：
将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项，所述转发表项的关键字段包括地址前缀，所述转发表项的结果字段包括SAV标志；
若所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，且所述目标转发表项的结果字段包括的SAV标志指示所述目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则丢弃所述报文；
若所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，且所述目标转发表项的结果字段包括的SAV标志未指示所述目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则放行所述报文。
在一些实施例中，所述方法还包括：
确定所述网络设备所属网络的SAVNET的部署模式；
若所确定的部署模式为完全部署模式，且所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，则丢弃所述报文；
若所确定的部署模式为部分部署模式，则执行所述将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项的步骤。
在一些实施例中，所述将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项的步骤，包括：
将所述报文的源地址与转发表项的关键字段包括的地址前缀匹配，获得地址前缀与所述报文的源地址匹配的至少一个候选表项；
从所述至少一个候选表项中，确定最长地址前缀所属的候选表项，作为关键字段与所述报文的源地址匹配的目标转发表项。
在一些实施例中，所述网络设备包括至少一个转发芯片；每个转发芯片中存储有所述网络设备学习到的转发表项；和/或，
所述转发表项存储在TCAM中。
在一些实施例中，所述SAV标志的位宽为1比特。
在一些实施例中，所述方法还包括：
学习控制平面的SAV表项，所述控制平面的SAV表项的关键字段包括入接口索引，所述控制平面的SAV表项的值字段包括至少一个合法源地址前缀；
根据所述控制平面的SAV表项，构建所述数据平面的SAV表项。
第二方面，本申请实施例提供了一种报文处理装置，应用于网络设备，所述装置包括：
第一匹配单元，用于将接收报文的入接口索引和所述报文的源地址与数据平面的SAV表项的关键字段匹配，所述数据平面的SAV表项的关键字段包括入接口索引和合法源地址前缀；
第一放行单元，用于若目标SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址匹配，则放行所述报文。
在一些实施例中，所述网络设备包括至少一个转发芯片；每个转发芯片中存储有数据平面的关键字段包括本转发芯片上的接口索引的SAV表项；和/或，
所述数据平面的SAV表项存储在TCAM中。
在一些实施例中，所述数据平面的SAV表项的结果字段为空；
所述数据平面的SAV表项的关键字段中，按照入接口索引和合法源地址前缀的顺序填充入接口索引和合法源地址前缀；或所述SAV表项的关键字段中，按照合法源地址前缀和入接口索引的顺序填充合法源地址前缀和入接口索引。
在一些实施例中，所述装置还包括：
第二匹配单元，用于将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项，所述转发表项的关键字段包括地址前缀，所述转发表项的结果字段包括SAV标志；
第一丢弃单元，用于若所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，且所述目标转发表项的结果字段包括的SAV标志指示所述目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则丢弃所述报文；
第二放行单元，用于若所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，且所述目标转发表项的结果字段包括的SAV标志未指示所述目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则放行所述报文。
在一些实施例中，所述装置还包括：
确定单元，用于确定所述网络设备所属网络的SAVNET的部署模式；
第二丢弃单元，用于若所确定的部署模式为完全部署模式，且所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，则丢弃所述报文；
所述第二匹配单元，包括第一匹配子单元；
所述第一匹配子单元，用于若所确定的部署模式为部分部署模式，则将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项。
在一些实施例中，所述第二匹配单元，包括第二匹配子单元；
所述第二匹配子单元，用于将所述报文的源地址与转发表项的关键字段包括的地址前缀匹配，获得地址前缀与所述报文的源地址匹配的至少一个候选表项；从所述至少一个候选表项中，确定最长地址前缀所属的候选表项，作为关键字段与所述报文的源地址匹配的目标转发表项。
在一些实施例中，所述网络设备包括至少一个转发芯片；每个转发芯片中存储有所述网络设备学习到的转发表项；和/或，
所述转发表项存储在TCAM中。
在一些实施例中，所述SAV标志的位宽为1比特。
在一些实施例中，所述装置还包括：
学习单元，用于学习控制平面的SAV表项，所述控制平面的SAV表项的关键字段包括入接口索引，所述控制平面的SAV表项的值字段包括至少一个合法源地址前缀；
构建单元，用于根据所述控制平面的SAV表项，构建所述数据平面的SAV表项。
第三方面，本申请实施例提供了一种转发芯片，执行上述任一所述的方法步骤。
第四方面，本申请实施例提供了一种网络设备，所述网络设备包括至少一个转发芯片，所述转发芯片用于执行上述任一所述的方法步骤。
在一些实施例中，所述网络设备还包括处理器；所述处理器，用于学习控制平面的SAV表项，所述控制平面的SAV表项的关键字段包括入接口索引，所述控制平面的SAV表项的值字段包括至少一个合法源地址前缀；根据所述控制平面的SAV表项，构建所述数据平面的SAV表项。
本申请实施例提供的技术方案中，网络设备在接收到报文后，将接收报文的入接口索引和报文的源地址与数据平面的SAV表项的关键字段匹配，在获得关键字段匹配的目标SAV表项的情况下，放行报文。可见，本申请实施例提供的技术方案中，网络设备在处理报文时，可以不受节约SAV表项的结果字段的长度限制，能够完成所有入接口对应的SAV， 提高了报文处理的精度。
附图说明
为了更清楚地说明本发明实施例和现有技术的技术方案，下面对实施例和现有技术中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为部署SAVNET的网络架构的一种示意图；
图2为控制平面的SAV表项的结构的一种示意图；
图3为数据平面的SAV表项的结构的一种示意图；
图4为现有技术中的报文处理方法的一种流程示意图；
图5为本申请实施例提供的报文处理方法的第一种流程示意图；
图6为本申请实施例提供的数据平面的SAV表项的结构的一种示意图；
图7为本申请实施例提供的报文处理方法的第二种流程示意图；
图8为本申请实施例提供的数据平面的转发表项的结构的一种示意图；
图9为本申请实施例提供的SAV表项构建方法的一种流程示意图；
图10为本申请实施例提供的控制平面的SAV表项的结构的一种示意图；
图11为本申请实施例提供的报文处理方法的第三种流程示意图；
图12为本申请实施例提供的报文处理装置的第一种结构示意图；
图13为本申请实施例提供的报文处理装置的第二种结构示意图；
图14为本申请实施例提供的SAV表项构建装置的一种结构示意图。
具体实施方式
为使本发明的目的、技术方案、及优点更加清楚明白，以下参照附图并举实施例，对本发明进一步详细说明。显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
为便于理解，下面对本申请实施例中出现的词语进行解释说明。
CM(Complete Mode，完全部署模式)：网络中的所有网络设备均部署了SAVNET。其中，网络设备可以为路由器、交换机、或防火墙等具有通信功能的设备。如图1所示的网络架构，图1所示网络包括节点1-6，若节点1-6均部署了SAVNET，则网络的部署模式为CM。
IM(Incomplete Mode，部分部署模式)：网络中的部分网络设备部署了SAVNET。如图1所示的网络架构，图1所示网络包括节点1-6，若节点1-6中部分节点部署了SAVNET，如节点2-6部署了SAVNET，节点1未部署SAVNET，则网络的部署模式为IM。
SAVNET是一种防范伪造IPv6源地址网络攻击的技术，采用基于路由信息的源地址验证方案。SAVNET的基本原理是：建立源地址与网络设备的入接口的映射关系，通过检查接收报文的入接口是否属于报文的源地址对应的合法入接口，来对接收的报文进行仿冒过滤。
部署SAVNET的网络设备在控制平面可以采用BGP(Border Gateway Protocol，边界网关协议)扩展、IGP(Interior Gateway Protocol，内部网关协议)扩展或其他私有协议等，通过SPA(Source Prefix Advertising，源前缀通告)报文和DPP(Destination Prefix Probing，目的前缀探测)报文，学习源地址与网络设备的入接口的映射关系。具体的控制平面处理流程如下：
1)边缘节点通过路由等信息，收集本边缘节点的用户侧接口下挂的合法用户网段，作为本边缘节点的合法源地址前缀。如图1所示的网络架构，节点1-3为边缘节点，节点1收集以连接用户侧的合法终端A的接口为出接口的直连路由、静态路由、IGP路由协议等信息，得到节点1用户侧接口下挂的合法用户网段，作为节点1的合法源地址前缀；节点2收集以连接用户侧的合法终端B的接口为出接口的直连路由、静态路由、IGP路由协议等信息，得到节点2用户侧接口下挂的合法用户网段，作为节点2的合法源地址前缀；节点3收集以连接用户侧的合法终端C的接口为出接口的直连路由、静态路由、IGP路由协议等信息，得到节点3用户侧接口下挂的合法用户网段，作为节点3的合法源地址前缀。
2)边缘节点将本边缘节点的合法源地址前缀携带在SPA报文中，并将SPA报文通告给本边缘节点的网络侧接口连接的邻居节点；邻居节点学习到边缘节点的合法源地址前缀，并继续向其他节点通告SPA报文，使得其他节点学习到边缘节点的合法源地址前缀。最终网络内所有节点均学习到所有边缘节点的合法源地址前缀。
以图1中的节点1为例，节点1向邻居节点4发送SPA报文，邻居节点4通过SPA报文，学习到节点1的合法源地址前缀；之后，邻居节点4向节点6发送SPA报文，节点6通过SPA报文，学习到节点1的合法源地址前缀。
通过上述方式，节点1-6学习到节点1-3的合法源地址前缀。
3)边缘节点通过DPP报文进行流量合法路径探测：遍历网络侧接口，选择连接邻居节点的网络侧接口，获取所有以该接口为出接口的FIB(Forwarding Information Base，转发表)前缀，作为可达目的地址前缀列表封装到DPP报文内，并将DPP报文从该接口发出；邻居节点收到来自边缘节点的DPP报文后，基于预先学习到的边缘节点的合法源前缀，以及接收DPP报文的入接口，建立该边缘节点的合法源前缀和入接口的映射关系；同时，邻居节点按照本节点的出接口拆分DPP报文里的可达目的地址前缀列表，形成一或多个DPP报文，并继续进行探测。最终网络内所有节点均学到合法源前缀和入接口的映射关系。其中，FIB前缀为FIB表项的key(关键字段)包括的地址前缀。
通过上述1)-3)的协议交互，各个节点学到一系列控制平面的SAV表项，控制平面的SAV表项的结构如图2所示，图2中，key表示关键字段，value表示值字段，key包括合法源地址前缀，如图2中的Prefix 1，value包括一个或多个合法入接口索引，如图2中的IF 1-IF n。
基于控制平面的SAV表项的结构，网络设备生成数据平面的SAV表项，如图3所示，key表示关键字段，Result表示结果字段，key包括合法源地址前缀，如图3中的Prefix 1，Result包括一个或多个合法入接口索引，如图3中的IF 1-IF n。
基于图3所示的数据平面的SAV表项，网络设备对报文进行过滤处理，具体的报文处 理流程如图4所示：
网络设备提取所接收的报文的SIP(Source Internet Protocol，源网际协议)地址，将SIP与数据平面的SAV表项的key匹配；若SIP与key匹配，即SIP在SAV表项的key表示的网段内，则将网络设备接收报文的入接口索引与该数据平面的SAV表项的Result匹配；若入接口索引与Result匹配，即SAV表项的Result内包括网络设备接收报文的入接口索引，则说明网络设备接收报文的入接口是key内合法源地址前缀的合法入接口，放行该报文；若入接口索引与Result不匹配，即SAV表项的Result内不包括网络设备接收报文的入接口索引，则说明网络设备接收报文的入接口不是key内合法源地址前缀的合法入接口，丢弃该报文。
若SIP与key不匹配，且网络的部署模式为CM，则说明SIP不属于合法源地址前缀，丢弃该报文；若SIP与key不匹配，且网络的部署模式为IM，则该SIP可能属于合法源地址前缀，只是因网络设备还未学习到该SIP对应的合法源地址前缀，为避免错误丢弃合法报文，放行该报文。
上述报文处理方法的实现是基于数据平面的SAV表项实现的。而SAV表项的结果字段的长度是有限的，可存放的入接口索引数量有一定限制，例如可存放8个入接口索引。这种情况下，一旦一个合法源地址前缀的入接口索引数量较多，将导致部分入接口索引无法写入SAV表项的结果字段，网络设备无法精确的进行报文过滤，报文处理精度较低。
为解决上述问题，本申请实施例提供了一种报文处理方法，该方法可以应用于网络中的任一网络设备，如图1所示的节点1-6中的任一节点。网络设备在接收到报文后，将接收报文的入接口索引和报文的源地址与数据平面的SAV表项的关键字段匹配，在获得关键字段匹配的目标SAV表项的情况下，放行报文。可见，本申请实施例提供的技术方案中，网络设备在处理报文时，可以不受节约SAV表项的结果字段的长度限制，能够完成所有入接口对应的SAV，提高了报文处理的精度。
下面通过具体实施例，对本申请实施例提供的报文处理方法进行详细说明。
如图5所示，本申请实施例提供了一种报文处理方法，应用于网络设备，包括如下步骤：
步骤S51，将接收报文的入接口索引和报文的源地址与数据平面的SAV表项的关键字段匹配，数据平面的SAV表项的关键字段包括入接口索引和合法源地址前缀；
步骤S52，若目标SAV表项的关键字段与接收报文的入接口索引和报文的源地址匹配，则放行报文。
本申请实施例提供的技术方案中，网络设备在接收到报文后，将接收报文的入接口索引和报文的源地址与数据平面的SAV表项的关键字段匹配，在获得关键字段匹配的目标SAV表项的情况下，放行报文。可见，本申请实施例提供的技术方案中，网络设备在处理报文时，可以不受节约SAV表项的结果字段的长度限制，能够完成所有入接口对应的SAV，提高了报文处理的精度。
本申请实施例提供的报文处理方法可以由网络设备的CPU(Central Processing Unit，中央处理器)实现，而为了提高报文处理效率，本申请实施例提供的报文处理方法还可以 由网络设备的转发芯片实现。
网络设备可以包括一个或多个转发芯片。当由网络设备的转发芯片实现报文处理方法时，每个转发芯片存储数据平面的SAV表项。
一个示例中，每个转发芯片中可以存储数据平面的所有SAV表项，以便于转发芯片执行更为全面精确的报文处理。
另一个示例中，每个转发芯片存储本转发芯片上的接口对应的数据平面的SAV表项，也就是，每个转发芯片中存储有数据平面的关键字段包括本转发芯片上的接口索引的SAV表项。这样可以大大节约转发芯片中的表项资源。
例如，SAV表项1的关键字段包括{接口1，地址前缀1}，SAV表项2的关键字段包括{接口2，地址前缀1}。转发芯片1包括接口1，转发芯片2包括接口2。此时，转发芯片1内存储SAV表项1，转发芯片2内存储SAV表项2。
相对于现有技术，如图3所示的数据平面的SAV表项的结构，转发芯片1和转发芯片2中存储的SAV表项均需要包括接口1和接口2，本申请实施例中，减少一个转发芯片内存储的入接口索引的数量，节约了表项资源。
在一些实施例中，网络设备中还可以配置TCAM(Ternary Content Addressable Memory，三态内容寻址存储器)，数据平面的SAV表项存储在TCAM中。网络设备利用TCAM，完成入接口索引和源地址与数据平面的SAV表项的关键字段匹配，可以大大提高匹配效率，进而提高报文处理效率。
本申请实施例中，由网络设备的转发芯片实现报文处理方法时，TCAM配置在转发芯片内，或与转发芯片连接。对此不进行限定。
本申请实施例中，网络设备中还可以配置除TCAM外的其他类型的查找引擎，只要能够与转发芯片通信，完成对SAV表项的匹配查找即可。
上述步骤S51中，数据平面的SAV表项包括关键字段和结果字段。本申请实施例中，数据平面的SAV表项中，关键字段包括两种信息，分别为入接口索引和合法源地址前缀；结果字段中可以填充默认信息，也可以不填充任何信息，即结果字段为空，此时数据平面的SAV表项结构可以参见图6所示。图6中，key表示关键字段，Result表示结果字段，IF表示入接口索引，Prefix表示合法源地址前缀。
本申请实施例中，当SAV表项的结果字段为空时，可以最大限度的节约SAV表项资源。上述默认信息可以根据实际需求进行设定，例如，默认信息可以为：指示对报文添加合法标识符后转发报文的信息，或，指示对报文进行深度包检测后转发报文的信息，或，指示对报文进行加密处理后转发报文的信息等。
对于数据平面的SAV表项的关键字段中，网络设备可以按照合法源地址前缀和入接口索引的顺序填充合法源地址前缀和入接口索引。
对于数据平面的SAV表项的关键字段中，网络设备还可以按照入接口索引和合法源地址前缀的顺序填充入接口索引和合法源地址前缀。此时关键字段内的有效信息均位于关键字段的前端，便于网络设备对关键字段进行处理，节约存储资源。
网络设备在接收到报文后，提取报文的源地址，并确定网络设备接收该报文的入接口 索引。网络设备可以按照数据平面的SAV表项的关键字段中入接口索引和合法源地址前缀的顺序，组合报文的源地址和接收该报文的入接口索引，将组合得到的信息与数据平面的SAV表项的关键字段进行匹配。
本申请实施例中，网络设备可以LPM(Longest Prefix Match，最长前缀匹配)方式，完成组合得到的信息与数据平面的SAV表项的关键字段匹配，获得关键字段与上述组合得到的信息匹配的目标SAV表项。网络设备还可以采用其他方式，完成组合得到的信息与数据平面的SAV表项的关键字段匹配，对此不进行限定。
本申请实施例中，网络设备将组合得到的信息与数据平面的SAV表项的关键字段进行匹配，若组合得到的信息中的入接口索引与SAV表项的关键字段中的入接口索引相同，组合得到的信息中的源地址具有SAV表项的关键字段中的合法源地址前缀，则说明组合得到的信息与数据平面的SAV表项的关键字段匹配；否则，二者不匹配。
当组合得到的信息与数据平面的SAV表项的关键字段匹配时，说明接收的报文的源地址属于接收报文的入接口的合法源地址前缀，网络设备执行上述步骤S52，放行报文，如根据报文的目的地址，向目的终端转发报文。
在一些实施例中，还提供了一种报文处理方法，如图7所示，可以包括如下步骤：
步骤S71，将接收报文的入接口索引和报文的源地址与数据平面的SAV表项的关键字段匹配，数据平面的SAV表项的关键字段包括入接口索引和合法源地址前缀；
步骤S72，若目标SAV表项的关键字段与接收报文的入接口索引和报文的源地址匹配，则放行报文；
步骤S73，将报文的源地址与转发表项的关键字段匹配，获得关键字段与报文的源地址匹配的目标转发表项，转发表项的关键字段包括地址前缀，转发表项的结果字段包括SAV标志；
步骤S74，若数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配，且目标转发表项的结果字段包括的SAV标志指示目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则丢弃报文；
步骤S75，若数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配，且目标转发表项的结果字段包括的SAV标志未指示目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则放行报文。
本申请实施例提供的技术方案中，在数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配的情况下，结合转发表项，可以准确的确定报文的源地址是否属于其他入接口的合法源地址前缀，提高了报文处理的准确性。
本申请实施例提供的报文处理方法可以由网络设备的CPU实现，而为了提高报文处理效率，本申请实施例提供的报文处理方法还可以由网络设备的转发芯片实现。
网络设备可以包括一个或多个转发芯片。当由网络设备的转发芯片实现报文处理方法时，每个转发芯片中存储有网络设备学习到的转发表项。
在一些实施例中，网络设备中还可以配置TCAM，数据平面的转发表项存储在TCAM中。网络设备利用TCAM，完成源地址与数据平面的转发表项的关键字段匹配，可以大大 提高匹配效率，进而提高报文处理效率。
本申请实施例中，由网络设备的转发芯片实现报文处理方法时，TCAM配置在转发芯片内，或与转发芯片连接。对此不进行限定。
本申请实施例中，网络设备中还可以配置除TCAM外的其他类型的查找引擎，只要能够与转发芯片通信，完成对转发表项的匹配查找即可。
上述步骤S71-S72与上述步骤S51-S52相同，此处不再赘述。
本申请实施例不限定步骤S71与步骤S73的执行顺序。
上述步骤S73中，网络设备可以学习到一个或多个转发表项。在数据平面，转发表项包括关键字段和结果字段，其中，关键字段包括地址前缀，结果字段包括SAV标志。此时，转发表项的结构可参见图8所示，图8中，key表示关键字段，Result表示结果字段，Prefix表示地址前缀，SAVflag表示SAV标志。
SAV标志指示本转发表项包括的地址前缀为一个入接口的合法源地址前缀，或者SAV标志不指示本转发表项包括的地址前缀为一个入接口的合法源地址前缀。
在一些实施例中，SAV标志的位宽可以为1比特(bit)。例如，SAV标志可以取值为0或1。当SAV标志为1时，SAV标志指示本转发表项包括的地址前缀为一个入接口的合法地址前缀，当SAV标志为0时，SAV标志不指示本转发表项包括的地址前缀为一个入接口的合法地址前缀。本申请实施例中，可以在转发表项的结果字段增加1bit，来作为SAV标志的位置，也可以利用转发表项的结果字段的保留位，来作为SAV标志的位置，无需新增表项资源，在保证报文处理的精度的情况下，节约了表项资源。
本申请实施例中，SAV标志的位宽也可以为2、3或4bit等，对此不进行限定。
本申请实施例中，转发表项的结果字段除包括SAV标志外，还可以包括其他信息，如出接口索引、下一跳索引等，对此不进行限定。
本申请实施例中，若报文的源地址具有转发表项的关键字段中的地址前缀，则说明报文的源地址与转发表项的关键字段匹配，匹配的转发表项即为目标转发表项；否则，说明报文的源地址与转发表项的关键字段不匹配。
当数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配时，若网络设备检测到目标转发表项中的SAV标志指示目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，例如SAV标志为1，则说明目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，但不是接收报文的入接口的合法源地址前缀，执行步骤S74，丢弃报文，以提高网络的安全性。
当数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配时，若网络设备检测到目标转发表项中的SAV标志未指示目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，例如SAV标志为0，则该SIP可能属于合法源地址前缀，只是因网络设备还未学习到该SIP对应的合法源地址前缀，执行步骤S75，放行该报文，以避免错误丢弃合法报文。
本申请实施例中，网络设备可以支持数据平面的SAV表项和转发表项的并行查找，如利用TCAM支持多表并行查找的功能，并行执行上述步骤S71和步骤S73，提高匹配的效 率，提高报文处理效率。
若网络设备不支持数据平面的SAV表项和转发表项的并行查找，则为提高报文处理效率，网络设备可以确定网络设备所属网络的SAVNET的部署模式。
若所确定的部署模式为完全部署模式，则说明网络设备应该学习到了所有合法源地址前缀。此时，不需要执行上述步骤S73，查找转发表项，当数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配时，说明该报文为非法报文，网络设备丢弃该报文。
若所确定的部署模式为部分部署模式，则网络设备可以执行上述步骤S73，查找转发表项，进而执行步骤S74-S75。
本申请实施例中，在完全部署模式下，网络设备只要确定数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配，即可确定报文为非法报文，进而丢弃该报文，这里，可以不必查找转发表项，减少了查找转发表项的耗时，提高了报文处理效率。
在一些实施例中，上述步骤S73可以为：网络设备采用LPM方式查找转发表项，获得目标转发表项，具体可以为：将所接收报文的源地址与转发表项的关键字段包括的地址前缀匹配，获得地址前缀与报文的源地址匹配的至少一个候选表项；从至少一个候选表项中，确定最长地址前缀所属的候选表项，作为关键字段与报文的源地址匹配的目标转发表项。
例如，所接收报文的源地址为1.1.1.1，转发表项1的关键字段包括的地址前缀为1.1.0.0/16，转发表项2的关键字段包括的地址前缀为1.1.1.0/24。网络设备将所接收报文的源地址与转发表项的关键字段包括的地址前缀匹配，获得候选表项为转发表项1和转发表项2。1.1.0.0/16的长度小于1.1.1.0/24的长度，因此，网络设备从转发表项1和转发表项2中，确定最长地址前缀所属的候选表项为1.1.1.0/24所属的转发表项2，即转发表项2作为关键字段与报文的源地址匹配的目标转发表项。
本申请实施例中，网络设备也可以采用其他方式查找转发表项，获得目标转发表项。例如，网络设备将所接收报文的源地址与转发表项的关键字段包括的地址前缀匹配，获得地址前缀与报文的源地址匹配的至少一个候选表项；将这至少一个候选表项均作为目标转发表项。此时，只要有一个目标转发表项的结果字段包括的SAV标志指示目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则网络设备丢弃报文，避免误转发报文。否则，即所有目标转发表项的结果字段包括的SAV标志均未指示目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则网络设备放行报文。
在一些实施例中，为便于向各个转发芯片中下发包括本转发芯片上的接口索引的SAV表项，本申请实施例提供了一种SAV表项构建方法，如图9所示，可以包括如下步骤：
步骤S91，学习控制平面的SAV表项，控制平面的SAV表项的关键字段包括入接口索引，控制平面的SAV表项的值字段包括至少一个合法源地址前缀。
本申请实施例中，控制平面的SAV表项包括关键字段和值字段，其中，关键字段包括入接口索引，值字段包括一个或多个合法源地址前缀，具体的控制平面的SAV表项的结构 可参见图10所示，图10中，key表示关键字段，value表示值字段，IF表示入接口索引，Prefix 1-Prefix n表示合法源地址前缀。
网络设备可以通过SPA报文和DPP报文，学习源地址与网络设备的入接口的映射关系，构建控制平面的SAV表项，具体构建控制平面的SAV表项的过程可参见上述相关描述，此处不再赘述。
步骤S92，根据控制平面的SAV表项，构建数据平面的SAV表项。
网络设备在获取到控制平面的SAV表项后，以{入接口索引，源地址前缀}为key，将控制平面的SAV表项转换为数据平面的SAV表项，转换后得到的数据平面的SAV表项可参见图6所示。
本申请实施例提供的技术方案中，网络设备改变了控制平面SAV表项的结构，以入接口索引为key，使得网络设备更为快速的确定转发芯片上的接口索引在哪些数据平面的SAV表项的关键字段中，进而快速的将数据平面的SAV表项下发至相应的转发芯片。
本申请实施例中，网络设备也可以采用现有技术中的控制平面SAV表项的结构，如图2所示，对此不进行限定。
下面结合图11所示的报文处理流程，对本申请实施例提供的报文处理方法进行详细说明。其中，SAVflag表示SAV标志，SAVflag为1，指示本转发表项包括的地址前缀为一个入接口的合法源地址前缀；SAVflag为0，不指示本转发表项包括的地址前缀为一个入接口的合法源地址前缀。
网络设备提取所接收的报文的SIP地址和接收该报文的入接口索引IF，执行如下两种匹配操作：将SIP和IF与数据平面的SAV表项的key匹配，将SIP与数据平面的转发表项的key匹配。上述两种匹配操作可以并行执行，也可以串行执行，如先执行将SIP和IF与数据平面的SAV表项的key匹配，再执行将SIP与数据平面的转发表项的key匹配；再如，先执行将SIP和IF与数据平面的SAV表项的key匹配，在SIP和IF与数据平面的SAV表项的key不匹配，且IM场景的情况下，再执行将SIP与数据平面的转发表项的key匹配。具体的执行顺序可以根据实际需求进行设定。
若SIP和IF与SAV表项的key匹配，即SIP在SAV表项的key表示的网段内，且IF与SAV表项的key包括的入接口索引相同，则说明该报文的源地址属于网络设备接收该报文的入接口的合法源地址前缀，放行该报文。
若SIP和IF与SAV表项的key不匹配，且当前部署模式为CM，则说明该报文为非法报文，丢弃该报文，以提高网络安全性。
若SIP和IF与SAV表项的key不匹配，当前部署模式为IM，与SIP匹配的目标转发表项的结果字段中，SAVflag为1，则说明该报文的源地址不属于网络设备接收该报文的入接口的合法源地址前缀，而是属于其他入接口的合法源地址前缀，丢弃该报文，以提高网络安全性。
若SIP和IF与SAV表项的key不匹配，当前部署模式为IM，与SIP匹配的目标转发表项的结果字段中，SAVflag为0，则说明该SIP可能是合法源地址前缀，只是因网络设备还未学习到该SIP对应的合法源地址前缀，为避免错误丢弃合法报文，放行该报文。
通过本申请实施例提供的技术方案，合法入接口的数量不再受结果字段的长度限制，提高了报文处理的精度。另外，每个转发芯片中可以仅存储本转发芯片上的接口对应的SAV表项，减少了每个转发芯片上存储的入接口索引的数量，相应的节约了存储的入接口索引的SAV表项的数量，节约了表项资源。
此外，本申请实施例提供的技术方案中，结合转发表项，完成对SAV处理时，只需要在转发表项中增加1bit的SAVflag的存储空间，甚至可以利用转发表项的保留位来实现SAVflag，这在完成SAV处理的同时，进一步节约了表项资源。
与上述报文处理方法对应，本申请实施例还提供了一种报文处理装置，如图12所示，应用于网络设备，该装置包括：
第一匹配单元121，用于将接收报文的入接口索引和报文的源地址与数据平面的SAV表项的关键字段匹配，数据平面的SAV表项的关键字段包括入接口索引和合法源地址前缀；
第一放行单元122，用于若目标SAV表项的关键字段与接收报文的入接口索引和报文的源地址匹配，则放行报文。
本申请实施例提供的技术方案中，网络设备在接收到报文后，将接收报文的入接口索引和报文的源地址与数据平面的SAV表项的关键字段匹配，在获得关键字段匹配的目标SAV表项的情况下，放行报文。可见，本申请实施例提供的技术方案中，网络设备在处理报文时，可以不受节约SAV表项的结果字段的长度限制，能够完成所有入接口对应的SAV，提高了报文处理的精度。
在一些实施例中，网络设备可以包括至少一个转发芯片；每个转发芯片中存储有数据平面的关键字段包括本转发芯片上的接口索引的SAV表项；和/或，
数据平面的SAV表项存储在TCAM中。
在一些实施例中，数据平面的SAV表项的结果字段为空；
数据平面的SAV表项的关键字段中，按照入接口索引和合法源地址前缀的顺序填充入接口索引和合法源地址前缀；或SAV表项的关键字段中，按照合法源地址前缀和入接口索引的顺序填充合法源地址前缀和入接口索引。
在一些实施例中，如图13所示，上述报文处理装置还可以包括：
第二匹配单元123，用于将报文的源地址与转发表项的关键字段匹配，获得关键字段与报文的源地址匹配的目标转发表项，转发表项的关键字段包括地址前缀，转发表项的结果字段包括SAV标志；
第一丢弃单元124，用于若数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配，且目标转发表项的结果字段包括的SAV标志指示目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则丢弃报文；
第二放行单元125，用于若数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配，且目标转发表项的结果字段包括的SAV标志未指示目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则放行报文。
在一些实施例中，上述报文处理装置还可以包括：
确定单元，用于确定网络设备所属网络的域间和域内网络中源地址验证SAVNET的部 署模式；
第二丢弃单元，用于若所确定的部署模式为完全部署模式，且数据平面的所有SAV表项的关键字段与接收报文的入接口索引和报文的源地址均不匹配，则丢弃报文；
第二匹配单元123，可以包括第一匹配子单元；
第一匹配子单元，用于若所确定的部署模式为部分部署模式，则将报文的源地址与转发表项的关键字段匹配，获得关键字段与报文的源地址匹配的目标转发表项。
在一些实施例中，第二匹配单元123，可以包括第二匹配子单元；
第二匹配子单元，用于将报文的源地址与转发表项的关键字段包括的地址前缀匹配，获得地址前缀与报文的源地址匹配的至少一个候选表项；从至少一个候选表项中，确定最长地址前缀所属的候选表项，作为关键字段与报文的源地址匹配的目标转发表项。
在一些实施例中，网络设备可以包括至少一个转发芯片；每个转发芯片中存储有网络设备学习到的转发表项；和/或，
转发表项存储在TCAM中。
在一些实施例中，SAV标志的位宽为1比特。
在一些实施例中，如图14所示，还提供了一种SAV表项构建装置，可以包括：
学习单元141，用于学习控制平面的SAV表项，控制平面的SAV表项的关键字段包括入接口索引，控制平面的SAV表项的值字段包括至少一个合法源地址前缀；
构建单元142，用于根据控制平面的SAV表项，构建数据平面的SAV表项。
本申请实施例提供的技术方案中，网络设备改变了控制平面SAV表项的结构，以入接口索引为key，使得网络设备更为快速的确定转发芯片上的接口索引在哪些数据平面的SAV表项的关键字段中，进而快速的将数据平面的SAV表项下发至相应的转发芯片。
与上述报文处理方法对应，本申请实施例还提供了一种转发芯片，该转发芯片用于执行上述任一所述的报文处理方法步骤。
与上述报文处理方法对应，本申请实施例还提供了一种网络设备，包括至少一个转发芯片，该转发芯片用于执行上述任一所述的报文处理方法步骤。
在一些实施例中，网络设备还可以包括处理器；处理器，用于学习控制平面的SAV表项，控制平面的SAV表项的关键字段包括入接口索引，控制平面的SAV表项的值字段包括至少一个合法源地址前缀；根据控制平面的SAV表项，构建数据平面的SAV表项。
本申请实施例中，SAV表项的构建由处理器执行，转发芯片负责基于构建的SAV表项，对报文进行处理，减轻了转发芯片的负载，提高了报文处理效率。
转发芯片可以为NP(Network Processor，网络处理器)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、数字信号处理器(Digital Signal Processor，DSP)、分立门或者晶体管逻辑器件、分立硬件组件等硬件处理芯片，也可以采用多个芯片结合，对此不进行限定。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产 品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
本说明书中的各个实施例均采用相关的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置、转发芯片和网络设备实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明保护的范围之内。

Claims (21)

  1. 一种报文处理方法，其特征在于，应用于网络设备，所述方法包括：
    将接收报文的入接口索引和所述报文的源地址与数据平面的源地址验证SAV表项的关键字段匹配，所述数据平面的SAV表项的关键字段包括入接口索引和合法源地址前缀；
    若目标SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址匹配，则放行所述报文。
  2. 根据权利要求1所述的方法，其特征在于，所述网络设备包括至少一个转发芯片；每个转发芯片中存储有数据平面的关键字段包括本转发芯片上的接口索引的SAV表项；和/或，
    所述数据平面的SAV表项存储在三态内容寻址存储器TCAM中。
  3. 根据权利要求1或2所述的方法，其特征在于，所述数据平面的SAV表项的结果字段为空；
    所述数据平面的SAV表项的关键字段中，按照入接口索引和合法源地址前缀的顺序填充入接口索引和合法源地址前缀；或所述SAV表项的关键字段中，按照合法源地址前缀和入接口索引的顺序填充合法源地址前缀和入接口索引。
  4. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项，所述转发表项的关键字段包括地址前缀，所述转发表项的结果字段包括SAV标志；
    若所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，且所述目标转发表项的结果字段包括的SAV标志指示所述目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则丢弃所述报文；
    若所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，且所述目标转发表项的结果字段包括的SAV标志未指示所述目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则放行所述报文。
  5. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    确定所述网络设备所属网络的域间和域内网络中源地址验证SAVNET的部署模式；
    若所确定的部署模式为完全部署模式，且所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，则丢弃所述报文；
    若所确定的部署模式为部分部署模式，则执行所述将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项的步骤。
  6. 根据权利要求4所述的方法，其特征在于，所述将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项的步骤，包括：
    将所述报文的源地址与转发表项的关键字段包括的地址前缀匹配，获得地址前缀与所述报文的源地址匹配的至少一个候选表项；
    从所述至少一个候选表项中，确定最长地址前缀所属的候选表项，作为关键字段与所述报文的源地址匹配的目标转发表项。
  7. 根据权利要求4-6任一项所述的方法，其特征在于，所述网络设备包括至少一个转发芯片；每个转发芯片中存储有所述网络设备学习到的转发表项；和/或，
    所述转发表项存储在三态内容寻址存储器TCAM中。
  8. 根据权利要求4-6任一项所述的方法，其特征在于，所述SAV标志的位宽为1比特。
  9. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    学习控制平面的SAV表项，所述控制平面的SAV表项的关键字段包括入接口索引，所述控制平面的SAV表项的值字段包括至少一个合法源地址前缀；
    根据所述控制平面的SAV表项，构建所述数据平面的SAV表项。
  10. 一种报文处理装置，其特征在于，应用于网络设备，所述装置包括：
    第一匹配单元，用于将接收报文的入接口索引和所述报文的源地址与数据平面的源地址验证SAV表项的关键字段匹配，所述数据平面的SAV表项的关键字段包括入接口索引和合法源地址前缀；
    第一放行单元，用于若目标SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址匹配，则放行所述报文。
  11. 根据权利要求10所述的装置，其特征在于，所述网络设备包括至少一个转发芯片；每个转发芯片中存储有数据平面的关键字段包括本转发芯片上的接口索引的SAV表项；和/或，
    所述数据平面的SAV表项存储在三态内容寻址存储器TCAM中。
  12. 根据权利要求10或11所述的装置，其特征在于，所述数据平面的SAV表项的结果字段为空；
    所述数据平面的SAV表项的关键字段中，按照入接口索引和合法源地址前缀的顺序填充入接口索引和合法源地址前缀；或所述SAV表项的关键字段中，按照合法源地址前缀和入接口索引的顺序填充合法源地址前缀和入接口索引。
  13. 根据权利要求10所述的装置，其特征在于，所述装置还包括：
    第二匹配单元，用于将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项，所述转发表项的关键字段包括地址前缀，所述转发表项的结果字段包括SAV标志；
    第一丢弃单元，用于若所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，且所述目标转发表项的结果字段包括的SAV标志指示所述目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则丢弃所述报文；
    第二放行单元，用于若所述数据平面的所有SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，且所述目标转发表项的结果字段包括的SAV标志未指示所述目标转发表项包括的地址前缀为一个入接口的合法源地址前缀，则放行所述报文。
  14. 根据权利要求13所述的装置，其特征在于，所述装置还包括：
    确定单元，用于确定所述网络设备所属网络的域间和域内网络中源地址验证SAVNET的部署模式；
    第二丢弃单元，用于若所确定的部署模式为完全部署模式，且所述数据平面的所有 SAV表项的关键字段与接收报文的入接口索引和所述报文的源地址均不匹配，则丢弃所述报文；
    所述第二匹配单元，包括第一匹配子单元；
    所述第一匹配子单元，用于若所确定的部署模式为部分部署模式，则将所述报文的源地址与转发表项的关键字段匹配，获得关键字段与所述报文的源地址匹配的目标转发表项。
  15. 根据权利要求13所述的装置，其特征在于，所述第二匹配单元，包括第二匹配子单元；
    所述第二匹配子单元，用于将所述报文的源地址与转发表项的关键字段包括的地址前缀匹配，获得地址前缀与所述报文的源地址匹配的至少一个候选表项；从所述至少一个候选表项中，确定最长地址前缀所属的候选表项，作为关键字段与所述报文的源地址匹配的目标转发表项。
  16. 根据权利要求13-15任一项所述的装置，其特征在于，所述网络设备包括至少一个转发芯片；每个转发芯片中存储有所述网络设备学习到的转发表项；和/或，
    所述转发表项存储在三态内容寻址存储器TCAM中。
  17. 根据权利要求13-15任一项所述的装置，其特征在于，所述SAV标志的位宽为1比特。
  18. 根据权利要求10所述的装置，其特征在于，所述装置还包括：
    学习单元，用于学习控制平面的SAV表项，所述控制平面的SAV表项的关键字段包括入接口索引，所述控制平面的SAV表项的值字段包括至少一个合法源地址前缀；
    构建单元，用于根据所述控制平面的SAV表项，构建所述数据平面的SAV表项。
  19. 一种转发芯片，其特征在于，执行权利要求1-8任一项所述的方法步骤。
  20. 一种网络设备，其特征在于，所述网络设备包括至少一个转发芯片，所述转发芯片用于执行权利要求1-8任一项所述的方法步骤。
  21. 根据权利要求20所述的网络设备，其特征在于，所述网络设备还包括处理器；所述处理器，用于学习控制平面的SAV表项，所述控制平面的SAV表项的关键字段包括入接口索引，所述控制平面的SAV表项的值字段包括至少一个合法源地址前缀；根据所述控制平面的SAV表项，构建所述数据平面的SAV表项。
PCT/CN2022/125569 2022-10-17 2022-10-17 一种报文处理方法及装置 Ceased WO2024082081A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
US18/715,049 US20250030633A1 (en) 2022-10-17 2022-10-17 Packet processing method and apparatus
CN202280003578.5A CN118216125A (zh) 2022-10-17 2022-10-17 一种报文处理方法及装置
PCT/CN2022/125569 WO2024082081A1 (zh) 2022-10-17 2022-10-17 一种报文处理方法及装置
EP22962281.6A EP4425860A4 (en) 2022-10-17 2022-10-17 PACKET PROCESSING METHOD AND APPARATUS

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/125569 WO2024082081A1 (zh) 2022-10-17 2022-10-17 一种报文处理方法及装置

Publications (1)

Publication Number Publication Date
WO2024082081A1 true WO2024082081A1 (zh) 2024-04-25

Family

ID=90736548

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/125569 Ceased WO2024082081A1 (zh) 2022-10-17 2022-10-17 一种报文处理方法及装置

Country Status (4)

Country Link
US (1) US20250030633A1 (zh)
EP (1) EP4425860A4 (zh)
CN (1) CN118216125A (zh)
WO (1) WO2024082081A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2026040756A1 (zh) * 2024-08-23 2026-02-26 中国移动通信有限公司研究院 信息验证方法、装置、网络设备、存储介质及计算机程序产品

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118611955B (zh) * 2024-06-24 2024-11-15 泉城省实验室 一种基于可编程数据平面的源地址流量识别和管控方法、装置、设备及介质
CN119697081B (zh) * 2024-12-24 2025-09-23 泉城省实验室 一种基于事件驱动的OSPFv3协议真实源前缀学习方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040215609A1 (en) * 2003-04-25 2004-10-28 Yoshihisa Takatsu Communication control apparatus and method for searching an internet protocol address
US20140006706A1 (en) * 2012-06-27 2014-01-02 Futurewei Technologies, Inc. Ternary Content-Addressable Memory Assisted Packet Classification
CN106911724A (zh) * 2017-04-27 2017-06-30 杭州迪普科技股份有限公司 一种报文处理方法及装置
CN109257279A (zh) * 2018-10-26 2019-01-22 新华三技术有限公司 一种报文转发方法及装置
CN111416887A (zh) * 2020-03-31 2020-07-14 清华大学 地址检测的方法、装置、交换机及存储介质
CN112910792A (zh) * 2018-08-30 2021-06-04 华为技术有限公司 报文处理的方法、装置及相关设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9491085B2 (en) * 2010-05-24 2016-11-08 At&T Intellectual Property I, L.P. Methods and apparatus to route control packets based on address partitioning
US10318587B1 (en) * 2015-09-20 2019-06-11 Barefoot Networks, Inc. Algorithmic TCAM based ternary lookup
US11522917B2 (en) * 2020-06-10 2022-12-06 Arista Networks, Inc. Scalable network processing segmentation
CN114866470A (zh) * 2021-02-03 2022-08-05 华为技术有限公司 发送报文的方法、装置、系统及存储介质
US12506689B2 (en) * 2023-01-30 2025-12-23 Arista Networks, Inc. Storing and selection of entries in routing tables based on prefix length
US20260032103A1 (en) * 2023-07-28 2026-01-29 Cisco Technology, Inc. Network security functions for dynamic construction and programmatic placement

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040215609A1 (en) * 2003-04-25 2004-10-28 Yoshihisa Takatsu Communication control apparatus and method for searching an internet protocol address
US20140006706A1 (en) * 2012-06-27 2014-01-02 Futurewei Technologies, Inc. Ternary Content-Addressable Memory Assisted Packet Classification
CN106911724A (zh) * 2017-04-27 2017-06-30 杭州迪普科技股份有限公司 一种报文处理方法及装置
CN112910792A (zh) * 2018-08-30 2021-06-04 华为技术有限公司 报文处理的方法、装置及相关设备
CN109257279A (zh) * 2018-10-26 2019-01-22 新华三技术有限公司 一种报文转发方法及装置
CN111416887A (zh) * 2020-03-31 2020-07-14 清华大学 地址检测的方法、装置、交换机及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4425860A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2026040756A1 (zh) * 2024-08-23 2026-02-26 中国移动通信有限公司研究院 信息验证方法、装置、网络设备、存储介质及计算机程序产品

Also Published As

Publication number Publication date
EP4425860A4 (en) 2025-02-12
US20250030633A1 (en) 2025-01-23
EP4425860A1 (en) 2024-09-04
CN118216125A (zh) 2024-06-18

Similar Documents

Publication Publication Date Title
WO2024082081A1 (zh) 一种报文处理方法及装置
US8274979B2 (en) Method and system for secure communication between a public network and a local network
CN105830406B (zh) 用于支持软件定义网络中的灵活查找关键字的方法、设备和系统
US11652735B2 (en) Multicast data packet processing method, and apparatus
US11212216B2 (en) Border gateway protocol (BGP) security measures along autonomous system (AS) paths
US12177250B2 (en) Anti-spoofing attack check method, device, and system
CN106664244B (zh) 用于源路由网络的反向路径验证
US20240323115A1 (en) Loop Avoidance Communications Method, Device, and System
CN111614505B (zh) 报文处理的方法和网关设备
CN103220255A (zh) 一种实现单播反向路径转发urpf检查的方法及装置
RU2642812C2 (ru) Способ и устройство переадресации сообщений
WO2017198131A1 (zh) 用于重定向数据流的方法和系统、网络设备和控制设备
CN111064668B (zh) 路由表项的生成方法、装置及相关设备
WO2026045866A1 (zh) 路由配置方法、装置、设备、介质及程序产品
WO2025103384A1 (zh) 源地址验证方法、装置及网络设备
CN116684367A (zh) 一种报文转发方法及装置
CN115442288B (zh) 一种SRv6网络数据包检查方法和装置
Marder et al. Vrfinder: Finding outbound addresses in traceroute
CN105207904B (zh) 报文的处理方法、装置和路由器
CN114124816B (zh) 单播报文处理方法、装置、计算机设备和可读介质
WO2005036834A1 (ja) 統計情報採取方法及び装置
WO2024198812A1 (zh) 源地址验证名单获取方法、装置、电子设备以及存储介质
TWI281804B (en) Packet forwarding method and system
CN112737957B (zh) 流表的老化方法及装置
WO2024087688A1 (zh) 报文转发方法、装置、设备、存储介质及计算机程序

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2022962281

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 18715049

Country of ref document: US

ENP Entry into the national phase

Ref document number: 2022962281

Country of ref document: EP

Effective date: 20240529

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22962281

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE