Message filtering method, device, network equipment and computer-readable storage medium

Abstract

The present invention relates to a message filtering method, device, network equipment and computer-readable storage medium, belonging to the field of communications. The method comprises: obtaining a message and its message information; querying a pre-stored routing table according to the message information, determining a route corresponding to the message and a neighbor table item corresponding to the route; filtering the message according to an ACL field included in the corresponding neighbor table item. Through this method, the impact on message forwarding performance can be reduced while reducing memory consumption.

Description

Technical Field

[0001] The present application belongs to the field of communications, and specifically relates to a message filtering method, device, network equipment and computer-readable storage medium. Background Art

[0002] For application scenarios that require the use of access control lists (ACLs) to filter messages, ACL entries can be configured on the Layer 3 Ethernet port. After the Layer 3 Ethernet port obtains the message, it parses the link header of the message and uses the parsed fields to match the corresponding ACL entries, thereby filtering the message through the matched ACL entries. However, in the case of a large number of ACL entries, it is necessary to compare the fields of the parsed message with each ACL entry one by one. If the matching ACL entry is located relatively late, it will take a lot of time to find the matching ACL, which will affect the forwarding performance of the message.

[0003] In order to solve the above problems, the existing technology adopts RFC (recursive flow classification) or fully matches the first message with the ACL, records the matching result in the flow table, and then directly searches the flow table with the characteristics of the message, so as to filter the message using the result of the ACL recorded in the flow table. However, the recursive algorithm needs to consume a large amount of memory for calculation, and the introduction of the flow table also needs to occupy a large amount of memory. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a message filtering method, device, network equipment and computer-readable storage medium, which, compared with the prior art, can reduce the impact on message forwarding performance while reducing memory consumption.

[0005] The embodiment of the present application is implemented as follows:

[0006] In the first aspect, the embodiment of the present application provides a message filtering method, which is applied to a network device, wherein a neighbor table item of the network device establishes a mapping relationship with a route included in a routing table, wherein the neighbor table item includes an ACL field, wherein the ACL field is used to represent the associated information of the corresponding ACL rule, and wherein the method includes: obtaining a message and its message information; querying the routing table according to the message information, determining the route corresponding to the message and the neighbor table item corresponding to the route; filtering the message according to the ACL field included in the corresponding neighbor table item. Based on the original message forwarding process, when the corresponding route is queried for the message, the method can determine the corresponding neighbor table item according to the mapping relationship, and according to the ACL field included in the neighbor table item, the ACL field represents the associated information of the corresponding ACL rule, and filter the message according to the ACL field. Compared with the prior art, the process of re-parsing the message can be saved, and the process of matching the corresponding ACL rule according to the message information can also be saved, thereby reducing the impact on the message forwarding performance. In addition, since in the prior art, the network device itself stores neighbor table entries, and the ACL field in the embodiment of the present application is just an additional field added to the existing neighbor table entries, the memory consumption caused to the network device is small and can be ignored, thereby reducing memory consumption compared to the prior art.

[0007] In combination with the embodiment of the first aspect, in a possible implementation manner, when a new neighbor entry is created or an existing neighbor is updated, the mapping relationship is synchronously updated, and the ACL field included in the changed neighbor entry is updated.

[0008] In combination with the first aspect embodiment, in a possible implementation, when the ACL field represents the rule address of the corresponding ACL rule, filtering the message according to the ACL field included in the corresponding neighbor table entry includes: determining the corresponding ACL rule for filtering the message according to the rule address, the corresponding ACL rule includes a rule action; filtering the message according to the rule action. In other words, the ACL rule corresponding to the message can be directly determined by the address represented by the ACL field, thereby saving the time required to match ACL rules one by one.

[0009] In combination with the first aspect embodiment, in a possible implementation, when the ACL field represents the rule action of the corresponding ACL rule, filtering the message according to the ACL field included in the corresponding neighbor table entry includes: directly filtering the message according to the rule action. In other words, the message can be directly filtered according to the rule action represented by the ACL field, thereby saving the time required to match ACL rules one by one.

[0010] In combination with the embodiment of the first aspect, in a possible implementation manner, when the rule action is characterized as rejection, filtering the message according to the rule action includes: discarding the message.

[0011] In combination with the embodiment of the first aspect, in a possible implementation manner, the neighbor table entry also includes an outgoing interface field and encapsulation information. When the rule action is characterized as allowed, filtering the message according to the rule action includes: encapsulating a link header for the message according to the encapsulation information; and forwarding the encapsulated message from the three-layer Ethernet port represented by the outgoing interface field.

[0012] In a second aspect, an embodiment of the present application provides a message filtering device, which is applied to a network device, wherein a neighbor table entry of the network device establishes a mapping relationship with a route included in a routing table, wherein the neighbor table entry includes an ACL field, and the ACL field is used to represent the associated information of the corresponding ACL rule, and the device includes: an acquisition module, a determination module, and a filtering module. The acquisition module is used to acquire a message and its message information; the determination module is used to query the routing table according to the message information, and determine the route corresponding to the message and the neighbor table entry corresponding to the route; the filtering module is used to filter the message according to the ACL field included in the corresponding neighbor table entry.

[0013] In combination with the embodiment of the second aspect, in a possible implementation, when the ACL field represents the rule address of the corresponding ACL rule, the filtering module is used to determine the corresponding ACL rule for filtering the message according to the rule address, and the corresponding ACL rule includes a rule action; and filter the message according to the rule action.

[0014] In combination with the embodiment of the second aspect, in a possible implementation manner, when the ACL field represents a rule action of the corresponding ACL rule, the filtering module is used to filter the message directly according to the rule action.

[0015] In combination with the embodiment of the second aspect, in a possible implementation manner, when the rule action is characterized as rejection, the filtering module is used to discard the message.

[0016] In combination with the second aspect embodiment, in a possible implementation manner, the neighbor table entry also includes an outgoing interface field and encapsulation information. When the rule action is characterized as allowed, the filtering module is used to encapsulate the link header for the message according to the encapsulation information; and forward the encapsulated message from the three-layer Ethernet port represented by the outgoing interface field.

[0017] In a third aspect, an embodiment of the present application further provides a network device comprising: a memory and a processor, wherein the memory and the processor are connected; the memory is used to store programs; the processor calls the program stored in the memory to execute the method provided in the above-mentioned first aspect embodiment and / or any possible implementation method in combination with the first aspect embodiment.

[0018] In a fourth aspect, an embodiment of the present application further provides a non-volatile computer-readable storage medium (hereinafter referred to as computer-readable storage medium), on which a computer program is stored. When the computer program is run by a computer, it executes the method provided by the above-mentioned first aspect embodiment and / or any possible implementation method in combination with the first aspect embodiment.

[0019] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by implementing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings without creative work. As shown in the drawings, the above and other purposes, features and advantages of the present application will be clearer. The same reference numerals indicate the same parts in all the drawings. The drawings are not deliberately scaled to the actual size, and the focus is on showing the main purpose of the present application.

[0021] Figure 1A A schematic diagram showing a mapping relationship between a neighbor table entry and an ACL rule provided in an embodiment of the present application is shown.

[0022] Figure 1B A schematic diagram showing a mapping relationship between a neighbor table entry and an ACL rule provided in an embodiment of the present application is shown.

[0023] Figure 2 A flow chart of a message filtering method provided in an embodiment of the present application is shown.

[0024] Figure 3 A structural block diagram of a message filtering device provided in an embodiment of the present application is shown.

[0025] Figure 4 A schematic diagram of the structure of a network device provided in an embodiment of the present application is shown.

[0026] Icons: 100 - network device; 110 - processor; 120 - memory; 400 - message filtering device; 410 - acquisition module; 420 - determination module; 430 - filtering module. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0028] It should be noted that similar numbers and letters represent similar items in the following figures, so once an item is defined in one figure, it does not need to be further defined and explained in the subsequent figures. At the same time, in the description of this application, relational terms such as "first", "second", etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, article or equipment. In the absence of more restrictions, the elements defined by the statement "comprise one..." do not exclude the existence of other identical elements in the process, method, article or equipment including the elements.

[0029] Furthermore, the term "and / or" in this application is merely a term used to describe the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone.

[0030] In addition, the defects existing in the message filtering method in the prior art (excessive memory consumption or reduced message forwarding performance) are the results obtained by the applicant after practice and careful research. Therefore, the process of discovering the above-mentioned defects and the solutions proposed in the embodiments of this application for the above-mentioned defects below should be recognized as the applicant's contribution to this application.

[0031] In order to solve the above problems, the embodiments of the present application provide a message filtering method, apparatus, network device and computer-readable storage medium, which can reduce the impact on message forwarding performance while reducing memory consumption.

[0032] The technology can be implemented by using corresponding software, hardware or a combination of software and hardware. The following is a detailed introduction to the embodiments of the present application.

[0033] The following is an introduction to the message filtering method provided by this application.

[0034] An embodiment of the present application provides a message filtering method applied to a network device.

[0035] A plurality of ACL rules and neighbor entries corresponding to the outgoing direction of each layer 3 Ethernet interface are pre-stored in the network device.

[0036] The ACL rule is pre-configured by the user and stored in the electronic device. The ACL rule includes a rule condition field and a rule action field. The ACL rule is used to execute the rule action included in the message that meets the rule condition field included in the ACL rule, thereby realizing the function of filtering the message.

[0037] For a Layer 3 Ethernet interface, the neighbor information of the neighbor table entry corresponding to it includes the conventional information included in the neighbor table entry in the prior art, such as its own MAC address (source MAC address), the MAC address of one of the neighbor devices corresponding to itself (destination MAC address), the Ethernet protocol and tag TAG required for interaction between itself and the neighbor device. In addition, in the embodiment of the present application, the neighbor information of the neighbor table entry also includes an ACL field.

[0038] The MAC address of the neighbor device corresponding to itself can be obtained through the ARP protocol (Address Resolution Protocol) or other neighbor discovery protocols.

[0039] The Ethernet protocol, TAG, and ACL fields are all generated by the user through pre-configuration.

[0040] Optionally, the TAG may include a priority and a VLAN number (Virtual Local Area Network), etc., which are used to represent the priority and VLAN number that the message for interacting with the neighboring device needs to carry.

[0041] As for the ACL field, which is used to represent the association information of the corresponding ACL rule, in the embodiment of the present application, a one-to-one mapping relationship is established between the neighbor table entry and the ACL rule in advance. That is to say, the ACL field included in the neighbor table entry is the association information of the ACL rule that has established a mapping relationship with the neighbor table entry in advance, and the ACL field points to the ACL rule corresponding to the neighbor table entry including the ACL field.

[0042] In an optional implementation, the association information of the corresponding ACL rule represented by the ACL field may be the rule address of the corresponding ACL rule (a large number of ACL rules are stored in the network device, and the rule address is used to represent the position of the corresponding ACL rule in all ACL rules, so that the network device can directly locate the corresponding ACL rule). Figure 1A As shown, Figure 1A A schematic diagram showing a mapping relationship between a neighbor entry and an ACL rule in this implementation manner.

[0043] exist Figure 1A In the example, the ACL field of the neighbor entry points to the rule address of the ACL rule corresponding to the neighbor entry including the ACL field (e.g. Figure 1A Pointing to rule 2). Subsequently, the network device can directly query the ACL rule corresponding to rule 2 according to the rule address. Then, the message is filtered according to the rule action included in the queried ACL rule.

[0044] In an optional implementation manner, the association information of the corresponding ACL rule represented by the ACL field may be a rule action included in the corresponding ACL rule or a value pointing to the rule action included in the corresponding ACL rule.

[0045] like Figure 1B As shown, Figure 1B A schematic diagram showing a mapping relationship between a neighbor entry and an ACL rule in this implementation manner.

[0046] exist Figure 1B In the example, the ACL field of the neighbor entry points to the value of the rule action of the ACL rule corresponding to the neighbor entry including the ACL field. Subsequently, the network device can filter the message according to the pointed rule action.

[0047] It is worth pointing out that, in the prior art, the network device itself stores neighbor table entries, and the ACL field in the embodiment of the present application is just an additional field added to the existing neighbor table entries, so the memory consumption caused to the network device is small and can be ignored.

[0048] In an optional implementation, the rule field included in the ACL rule that establishes a mapping relationship with the neighbor table entry may be associated with the general information included in the corresponding neighbor table entry. For example, the rule field matches the MAC address of the neighbor device, the MAC address of the neighbor device, the Ethernet protocol, and the TAG included in the neighbor table entry (e.g. Figure 1AFor example, the rule field matches one or more of the information in the neighbor table entry, including the MAC address of the neighbor device, the Ethernet protocol, and the TAG. The matching rule can be determined by the configuration personnel through the configuration information. For example, in some embodiments, the two are consistent, which is a match. In some embodiments, the two meet the preset mapping relationship, which is a match.

[0049] Of course, a network device with a Layer 3 Ethernet interface may have multiple neighbor devices. Accordingly, for the network device with multiple neighbor devices, there are also multiple corresponding neighbor entries. When the neighbor information of the network device changes or a new neighbor device is added, the corresponding neighbor entry also changes. At this time, the ACL field in the neighbor entry needs to be updated accordingly.

[0050] In addition, it is worth pointing out that in the embodiment of the present application, a routing table is also pre-configured and stored in the electronic device, and the configuration personnel pre-establish a mapping relationship between the routes in the routing table and the neighbor table items. The rules for establishing the mapping relationship can be controlled by the configuration personnel. When a new neighbor table item is created or a neighbor table item is updated, the mapping relationship between the routes in the routing table and the neighbor table items needs to be updated synchronously.

[0051] After receiving the message, the network device parses the message, and after querying the routing table based on the parsed message information to determine the route for forwarding the message, the network device determines the neighbor table entry corresponding to the route through the determined route and the pre-established mapping relationship. After determining the corresponding neighbor table entry, the network device filters the message based on the neighbor table entry.

[0052] The following will be combined Figure 2 The message filtering method shown in the figure illustrates the process of filtering the message mentioned above.

[0053] Step S110: Acquire a message and its message information.

[0054] After the network device obtains the message, it can parse the message to obtain the message information corresponding to the message.

[0055] The message information includes, but is not limited to, the source IP address, destination IP address, source MAC address, destination MAC address, etc. of the message.

[0056] Step S120: query the routing table according to the message information to determine the route corresponding to the message and the neighbor table entry corresponding to the route.

[0057] After obtaining the message information, the network device queries the routing table according to the destination IP address included in the message information, thereby querying the corresponding route and determining the outgoing interface and next hop address of the message.

[0058] In addition, since a mapping relationship is established in advance between the routes in the routing table and the neighbor table entries, after the route corresponding to the message is determined, the neighbor table entry corresponding to the message can also be determined.

[0059] Step S130: Filter the message according to the ACL field included in the corresponding neighbor entry.

[0060] The neighbor table entry includes an ACL field. After the network device determines the corresponding neighbor table entry, it can obtain the ACL field included in the corresponding neighbor table entry.

[0061] As mentioned above, the ACL field is used to represent the associated information of the corresponding ACL rule.

[0062] In an optional implementation, the association information of the corresponding ACL rule represented by the ACL field may be the rule address of the corresponding ACL rule (a large number of ACL rules are stored in the network device, and the rule address is used to represent the position of the corresponding ACL rule in all ACL rules so that the network device can directly locate the corresponding ACL rule).

[0063] In this implementation, when the network device filters the message based on the ACL field included in the corresponding neighbor table entry, it can first determine the corresponding ACL rule for filtering the message according to the rule address, and then filter the message based on the corresponding ACL rule.

[0064] The ACL rule includes a rule action field.

[0065] When filtering messages according to the corresponding ACL rule, the network device may filter the messages according to the rule action represented by the rule action field included in the corresponding ACL rule.

[0066] Generally speaking, rule actions include two types: permit and deny.

[0067] When the rule action included in the corresponding ACL rule is allowed, the filtering strategy of the network device is to release, that is, forward the message. At this time, the network device uses the neighbor information included in the determined neighbor table entry as encapsulation information, performs IP header encapsulation and link header encapsulation for the message, and after the encapsulation is completed, forwards the encapsulated message. Among them, the forwarding outbound interface and next hop address are determined when checking the routing table.

[0068] When the rule action included in the corresponding ACL rule is reject, the filtering strategy of the network device is discard, that is, discard the message and prevent the message from being forwarded. Correspondingly, at this time, the network device does not need to perform link header encapsulation on the message and directly discards the message.

[0069] In another optional implementation, the association information of the corresponding ACL rule represented by the ACL field may be the rule action included in the corresponding ACL rule or a value pointing to the rule action included in the corresponding ACL rule.

[0070] In this implementation, when the network device filters the message based on the ACL field included in the corresponding neighbor table entry, the message can be directly filtered according to the rule action represented by the ACL field without determining the corresponding ACL rule, thereby further saving the time required for filtering.

[0071] Of course, when the content represented by the ACL field is a rule action, when the rule action is to allow, the filtering policy of the network device is to release, that is, to forward the message. At this time, the network device uses the neighbor information included in the determined neighbor table entry as encapsulation information, performs IP header encapsulation and link header encapsulation for the message, and after the encapsulation is completed, forwards the encapsulated message. Among them, the forwarded outgoing interface and the next hop address are determined when checking the routing table. When the rule action is to reject, the filtering policy of the network device is to discard, that is, to discard the message and prevent the message from being forwarded further. Correspondingly, at this time, the network device does not need to perform link header encapsulation on the message and directly discards the message.

[0072] It is worth pointing out that in the prior art, before determining the ACL rule corresponding to the message, the message needs to be parsed for the first time, so as to obtain the message information to query the routing table and determine the corresponding route. This process involves encapsulating the message in the IP header. When it is necessary to determine the ACL rule corresponding to the message, the message needs to be parsed again, and then the corresponding ACL rule is matched according to the parsed message information, and then the message is filtered by the ACL rule.

[0073] In the embodiment of the present application, on the basis of the original message forwarding process, when the corresponding route is queried for the message, the corresponding neighbor table item can be determined according to the mapping relationship, and the associated information of the corresponding ACL rule can be determined according to the ACL field included in the neighbor table item, and the message can be filtered according to the ACL field. Compared with the prior art, the process of re-parsing the message can be saved, and the process of matching the corresponding ACL rule according to the message information can also be saved, thereby reducing the impact on the message forwarding performance. In addition, since in the prior art, the network device itself stores the neighbor table item, and the ACL field in the embodiment of the present application is just an additional field added to the existing neighbor table item, the memory consumption caused to the network device is less and can be ignored, thereby reducing the memory consumption compared with the prior art.

[0074] like Figure 3 As shown, the embodiment of the present application further provides a message filtering device 400 , which may include: an acquisition module 410 , a determination module 420 , and a filtering module 430 .

[0075] An acquisition module 410, used to acquire a message and its message information;

[0076] A determination module 420, configured to query the routing table according to the message information, and determine a route corresponding to the message and a neighbor table entry corresponding to the route;

[0077] The filtering module 430 is configured to filter the message according to the ACL field included in the corresponding neighbor entry.

[0078] In a possible implementation, when the ACL field represents the rule address of the corresponding ACL rule, the filtering module 430 is used to determine the corresponding ACL rule for filtering the message according to the rule address, and the corresponding ACL rule includes a rule action; and filter the message according to the rule action.

[0079] In a possible implementation manner, when the ACL field represents the rule action of the corresponding ACL rule, the filtering module 430 is configured to filter the message directly according to the rule action.

[0080] In a possible implementation manner, when the rule action is characterized as rejection, the filtering module 430 is configured to discard the message.

[0081] In a possible implementation, the neighbor table entry also includes an outgoing interface field and encapsulation information. When the rule action is characterized as allowed, the filtering module 430 is used to encapsulate a link header for the message according to the encapsulation information; and forward the encapsulated message from the three-layer Ethernet port represented by the outgoing interface field.

[0082] The message filtering device 400 provided in the embodiment of the present application has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0083] In addition, see Figure 4 The embodiment of the present invention also provides a network device for implementing the message filtering method and apparatus of the embodiment of the present application.

[0084] The network device 100 may be a network data communication device such as a router or a switch, and may forward messages from a layer 3 Ethernet port.

[0085] The network device 100 may include: a processor 110 and a memory 120 .

[0086] It should be noted that Figure 4 The components and structures of the network device 100 shown are only exemplary and non-restrictive. The network device 100 may also have other components and structures as required. For example, in some cases, the network device 100 may also include multiple interfaces.

[0087] The processor 110, the memory 120, and other components that may appear in the network device 100 are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, the processor 110, the memory 120, and other components that may appear may be electrically connected to each other via one or more communication buses or signal lines.

[0088] The memory 120 is used to store programs, for example, a program corresponding to the message filtering method mentioned above or a message filtering device mentioned above. Optionally, when the message filtering device is stored in the memory 120, the message filtering device includes at least one software function module that can be stored in the memory 120 in the form of software or firmware.

[0089] Optionally, the software function modules included in the message filtering device may also be embedded in the operating system (OS) of the network device 100 .

[0090] The processor 110 is used to execute the executable modules stored in the memory 120, such as the software function modules or computer programs included in the message filtering device. After receiving the execution instruction, the processor 110 can execute the computer program, for example, to execute: obtaining the message and its message information; querying the routing table according to the message information, determining the route corresponding to the message and the neighbor table entry corresponding to the route; filtering the message according to the ACL field included in the corresponding neighbor table entry.

[0091] Of course, the method disclosed in any embodiment of the present application can be applied to the processor 110 or implemented by the processor 110.

[0092] In summary, the message filtering method, device, network device and computer-readable storage medium proposed in the embodiments of the present invention include: obtaining a message and its message information; querying the routing table according to the message information to determine the route corresponding to the message and the neighbor table item corresponding to the route; filtering the message according to the ACL field included in the corresponding neighbor table item. In the above process, based on the original message forwarding process, when the corresponding route is queried for the message, the corresponding neighbor table item can be determined according to the mapping relationship, and the association information of the corresponding ACL rule can be determined according to the ACL field included in the neighbor table item, and the message can be filtered according to the ACL field. Compared with the prior art, the process of re-parsing the message can be saved, and the process of matching the corresponding ACL rule according to the message information can also be saved, thereby reducing the impact on the message forwarding performance. In addition, since in the prior art, the network device itself stores neighbor table entries, and the ACL field in the embodiment of the present application is just an additional field added to the existing neighbor table entries, the memory consumption caused to the network device is small and can be ignored, thereby reducing memory consumption compared to the prior art.

[0093] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0094] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0095] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0096] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a laptop, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0097] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A message filtering method, characterized in that: Applied to a network device, a neighbor table entry of the network device establishes a mapping relationship with a route included in a routing table, the neighbor table entry includes an ACL field, and the ACL field is used to represent association information of a corresponding ACL rule. The method includes: Obtaining messages and their message information; Query the routing table according to the message information to determine the route corresponding to the message and the neighbor table entry corresponding to the route; Filtering the message according to the ACL field included in the corresponding neighbor table entry; When the ACL field represents the rule address of the corresponding ACL rule, filtering the message according to the ACL field included in the corresponding neighbor table entry includes: determining, according to the rule address, a corresponding ACL rule for filtering the message, wherein the corresponding ACL rule includes a rule action; filtering the message according to the rule action; When the ACL field represents the rule action of the corresponding ACL rule or points to the value of the rule action included in the corresponding ACL rule, filtering the message according to the ACL field included in the corresponding neighbor table entry includes: directly filtering the message according to the rule action.

2. The method according to claim 1, characterized in that When the rule action is characterized as rejection, filtering the message according to the rule action includes: The message is discarded.

3. The method according to claim 1, characterized in that The neighbor table entry further includes an outbound interface field and encapsulation information. When the rule action is characterized as allowed, filtering the message according to the rule action includes: Encapsulating a link header for the message according to the encapsulation information; The encapsulated message is forwarded from the layer 3 Ethernet port represented by the outgoing interface field.

4. The method according to claim 1, characterized in that: When a new neighbor entry is created or an existing neighbor is updated, the mapping relationship is updated synchronously, and the ACL field included in the changed neighbor entry is updated.

5. A message filtering device, characterized in that: Applied to a network device, a neighbor table entry of the network device establishes a mapping relationship with a route included in a routing table, the neighbor table entry includes an ACL field, and the ACL field is used to represent association information of a corresponding ACL rule. The device includes: An acquisition module, used to acquire messages and message information; A determination module, configured to query the routing table according to the message information, and determine a route corresponding to the message and a neighbor table entry corresponding to the route; A filtering module, used to filter the message according to the ACL field included in the corresponding neighbor table entry; When the ACL field represents the rule address of the corresponding ACL rule, the filtering module is used to determine the corresponding ACL rule for filtering the message according to the rule address, and the corresponding ACL rule includes a rule action; and filter the message according to the rule action; When the ACL field represents the rule action of the corresponding ACL rule or points to the value of the rule action included in the corresponding ACL rule, the filtering module is used to filter the message directly according to the rule action.

6. A network device, characterized in that: include: A memory and a processor, wherein the memory and the processor are connected; The memory is used to store programs; The processor calls the program stored in the memory to execute the method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a computer, the method according to any one of claims 1 to 4 is executed.

Images