A flow table processing method, device, apparatus and storage medium

Abstract

The application provides a flow table processing method and device, equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: receiving a first message sent by an internal network; if the first message is the first message of a data flow, allocating NAT address information for the first message, and establishing a forward flow table and a reverse flow table for the data flow respectively; extracting destination address information from the first message; performing hash calculation on the destination address information to obtain a first index value, the first index value being used for indicating a first hash bucket to which the forward flow table and the reverse flow table belong and a position of the forward flow table and the reverse flow table in the first hash bucket; locking the first hash bucket indicated by the first index value, and writing the forward flow table and the reverse flow table into the first hash bucket indicated by the first index value; and unlocking the first hash bucket after the flow table is written successfully.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a flow table processing method, apparatus, device and storage medium. Background Technology

[0002] Network Address Translation (NAT) is a technology that translates the private IP addresses of internal network users into public IP addresses. Nowadays, NAT often refers to the simultaneous translation of network addresses and Layer 4 port addresses. When an internal network user accesses the external network for the first time, the NAT device selects an available IP address (public attribute) and port from the NAT address resource pool, replaces the source IP address (private network / internal network) and source port of the user's packet, and establishes forward and reverse flow tables based on the original and NATed 5-tuples of the packet to guide the translation and forwarding of subsequent packets. Forward and reverse data flows with the same 5-tuple are called a session, and the corresponding forward and reverse flow tables are collectively called the session table, also known as the NAT flow table. In practical applications, the session table contains the packet's 5-tuple and is stored in DDR (Double Data Rate Synchronous Dynamic Random Access Memory) in the form of a hash table. A specific function maps the session table to different hash slots (hash buckets). Session tables stored in the same hash slot form a collision chain, implemented as a linked list.

[0003] Currently, network processing chips in NAT devices typically include multiple processing cores and multiple threads. When creating and deleting session tables, write operations to memory are involved, requiring consideration of write safety among multiple parallel threads. Locking technology is used to solve this problem. That is, when a thread writes to the session table in memory, it first acquires the lock on the corresponding memory block. Other threads cannot perform write operations on that memory block until the lock is unlocked, thus avoiding conflicts between multiple threads.

[0004] For example, a network processing chip has threads A and B. Thread A creates a pair of forward and reverse NAT flow tables, with the forward flow table located in Hash Slot 0 and the reverse flow table located in Hash Slot 1. Thread A first locks Slot 0 and Slot 1. After successfully locking, it adds the forward NAT flow table after the collision chain of Slot 0 and the reverse flow table after the collision chain of Slot 1, and then unlocks Slot 0 and Slot 1. That is, thread A needs to perform two locking operations on different Hash Slots when creating the forward and reverse NAT flow tables. If a thread requests two locks simultaneously, it can easily cause a deadlock. For example, thread A adds a forward flow table in Hash Slot 0, and thread B adds a forward flow table in Hash Slot 1. Thread A has already acquired the lock for Hash Slot 0 and is waiting for the lock for Hash Slot 1; while thread B has already acquired the lock for Hash Slot 1 and is waiting for the lock for Hash Slot 0. Threads A and B are both waiting for the lock that the other has acquired. Because the task of creating a new table entry has not been completed, they will not release the lock they have acquired in advance, thus creating a deadlock. Summary of the Invention

[0005] In view of this, this application provides a flow table processing method, apparatus, device, and storage medium to solve the deadlock problem in multi-threaded flow table processing.

[0006] Specifically, this application is implemented through the following technical solution:

[0007] According to a first aspect of this application, a flow table processing method is provided, comprising:

[0008] Receive the first message sent from the intranet;

[0009] If the first message is the first message of the data stream, then after allocating NAT address information to the first message and establishing forward flow table and reverse flow table for the data stream respectively, the destination address information is extracted from the first message;

[0010] The destination address information is hashed to obtain a first index value, which is used to indicate the first hash bucket to which the forward flow table and the reverse flow table belong and their positions in the first hash bucket.

[0011] Lock the first hash bucket indicated by the first index value, and write the forward flow table and the reverse flow table into the first hash bucket indicated by the first index value;

[0012] After the flow table is successfully written, the first hash bucket is unlocked.

[0013] According to a second aspect of this application, a flow table processing apparatus is provided, comprising:

[0014] The receiving module is used to receive the first message sent from the intranet;

[0015] The extraction module is used to extract the destination address information from the first packet if the first packet is the first packet of the data stream, after allocating NAT address information to the first packet and establishing a forward flow table and a reverse flow table for the data stream respectively.

[0016] The hash calculation module is used to perform hash calculation on the destination address information to obtain a first index value. The first index value is used to indicate the first hash bucket to which the forward flow table and the reverse flow table belong and their positions in the first hash bucket.

[0017] The locking module is used to lock the first hash bucket indicated by the first index value and write the forward flow table and the reverse flow table into the first hash bucket indicated by the first index value.

[0018] The unlock module is used to unlock the first hash bucket after the flow table is successfully written.

[0019] According to a third aspect of this application, a network device is provided, including a processor and a machine-readable storage medium storing a computer program executable by the processor, the processor being prompted by the computer program to perform the method provided in the first aspect of the embodiments of this application.

[0020] According to a fourth aspect of this application, a machine-readable storage medium is provided, which stores a computer program that, when invoked and executed by a processor, causes the processor to perform the method provided in the first aspect of the embodiments of this application.

[0021] The beneficial effects of the embodiments of this application are as follows:

[0022] In the flow table processing method, apparatus, device, and storage medium provided in this application embodiment, a first packet sent from an intranet is received. If the first packet is the first packet of a data flow, after allocating NAT address information for the first packet and establishing a forward flow table and a reverse flow table for the data flow respectively, destination address information is extracted from the first packet. A hash calculation is performed on the destination address information to obtain a first index value, which indicates the first hash bucket to which the forward flow table and the reverse flow table belong and their positions within the first hash bucket. The first hash bucket indicated by the first index value is locked, and the forward flow table and the reverse flow table are written into the first hash bucket indicated by the first index value. After the flow table is successfully written, the first hash bucket is unlocked. Since this embodiment uses destination address information to calculate the first index value for storing the forward flow table and the reverse flow table, and both the forward flow table and the reverse flow table include this destination address information, the forward flow table and the reverse flow table can be written into the same first hash bucket, thus avoiding deadlock during flow table writing. Furthermore, this application greatly simplifies the flow table processing flow by only needing to lock one hash bucket when writing forward and reverse flow tables, while also ensuring the security of network devices and the processing performance of NAT services. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating a flow table processing method provided in an embodiment of this application;

[0024] Figure 2 This is a schematic diagram of the conflict chain indicated by the first index value provided in the embodiments of this application;

[0025] Figure 3 This is a schematic diagram of the structure of a flow table processing device provided in an embodiment of this application;

[0026] Figure 4 This is a schematic diagram of the hardware structure of a network device that implements a flow table processing method according to an embodiment of this application. Detailed Implementation

[0027] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0028] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used herein are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the corresponding listed items.

[0029] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0030] The inventors discovered that current methods construct a global lock for creating and deleting NAT flow tables, instead of locking only two hash slots. This transforms multi-threaded NAT flow table write operations into a serial process. When one thread creates or deletes forward or reverse NAT flow tables, other threads cannot perform write operations on all NAT flow tables, thus avoiding write conflicts between threads. However, this method's global NAT flow table lock forces the parallel processing flow into a serial one, wasting the parallel performance of the network processing chip and severely reducing the processing speed of NAT services, contradicting the efficiency of multi-threaded processing.

[0031] The flow table processing method provided in this application will be described in detail below.

[0032] See Figure 1 , Figure 1 This is a flowchart of a flow table processing method provided in this application. This method can be applied to a network device, which may be, but is not limited to, a NAT device. When implementing this method, the network device may include the following steps:

[0033] S101: Receive the first message sent from the intranet.

[0034] S102. If the first message is the first message of the data stream, then after allocating NAT address information to the first message and establishing forward flow table and reverse flow table for the data stream respectively, the destination address information is extracted from the first message.

[0035] In this step, the network device acts as an intermediary for interaction between the intranet and the extranet. To ensure the processing performance of NAT services, after the network device receives the first packet sent from the intranet, if this first packet is the first network packet in the data flow, in order to achieve fast forwarding of subsequent packets in the data flow and ensure the security of the intranet, the network device needs to allocate NAT address information for this network packet. This allows communication with the extranet while simultaneously protecting the security of the intranet. Furthermore, to facilitate the rapid processing of subsequent network packets in this data flow, a forward flow table and a reverse flow table are created for this data flow based on the allocated NAT address information.

[0036] Based on this, after creating the forward flow table and the reverse flow table, since there is still data flow transmission between the internal network and the external network, the created forward flow table and reverse flow table will be stored to facilitate and quickly realize interaction. During the storage process, in order to avoid deadlock, this embodiment proposes that the network device can extract the destination address information from the first packet.

[0037] S103. Perform hash calculation on the destination address information to obtain the first index value.

[0038] The first index value is used to indicate the first hash bucket to which the forward flow table and the reverse flow table belong and their positions in the first hash bucket.

[0039] In this step, the network device directly uses the aforementioned destination address information to create an index for storing the forward flow table and the reverse flow table. This index is the aforementioned first index value, which indicates the hash bucket used to store the forward flow table and the reverse flow table, i.e., the aforementioned first hash bucket, and also indicates the storage location of the forward flow table and the reverse flow table in the first hash bucket. In this way, the forward flow table and the reverse flow table will be written together into the first hash bucket corresponding to the first index value created based on the destination address information, instead of creating two separate indexes based on the private network address, which would otherwise result in the forward flow table and the reverse flow table being stored in different hash buckets.

[0040] S104. Lock the first hash bucket indicated by the first index value, and write the forward flow table and the reverse flow table into the first hash bucket indicated by the first index value.

[0041] In this step, after determining the first index value, the first hash bucket used to store the forward and reverse flow tables has been determined. Based on this, when a thread in the network device writes the flow table to the hash bucket, since multiple threads may access the same hash bucket simultaneously, the thread in the network device needs to lock the first hash bucket. Once the lock is successfully acquired, other threads cannot access the first hash bucket; thus, the thread can successfully write the aforementioned forward and reverse flow tables into the first hash bucket.

[0042] S105. After the flow table is successfully written, the first hash bucket is unlocked.

[0043] In this step, after both the forward flow table and the reverse flow table have been successfully written, in order to avoid delaying other threads from accessing the first hash bucket, the thread needs to unlock the first hash bucket in a timely manner.

[0044] Thus, by using the destination address information of the first packet to calculate the location of the hash bucket used to store the forward flow table and the reverse flow table, and since the forward flow table contains this destination address information, and the source address information in the reverse flow table is the destination address information of the first packet, the forward flow table and the reverse flow table can be written into the same hash bucket. This is no longer the solution in the prior art that calculates different hash buckets based on the 5-tuple of the original packet and the 5-tuple after NAT translation. As a result, deadlock will not occur, thus solving the deadlock problem in multi-threaded flow table processing, while ensuring the processing performance of NAT services.

[0045] By implementing the flow table processing method provided in this application, after allocating destination address information for the first packet sent to the intranet and establishing forward and reverse flow tables for the first packet respectively, hash calculation is performed on the destination address information to obtain a first index value; the first hash bucket indicated by the first index value is locked, and the forward and reverse flow tables are written into the first hash bucket indicated by the first index value; after the flow table is successfully written, the first hash bucket is unlocked. Since this embodiment uses destination address information to calculate the first index value for storing the forward and reverse flow tables, and both the forward and reverse flow tables include this destination address information, the forward and reverse flow tables can be written into the same first hash bucket, thus avoiding deadlock during flow table writing. Furthermore, this application simplifies the flow table processing flow greatly by only needing to lock one hash bucket when writing the forward and reverse flow tables, while also ensuring the security of network devices and the processing performance of NAT services.

[0046] Optionally, based on the above embodiments, in this embodiment, if the first message is not the first message of the data stream, the first hash bucket for storing the forward flow table of the data stream to which the first message belongs is determined using the first index value; the first hash bucket is locked; the forward flow table is extracted from the first hash bucket; after successful extraction, the first hash bucket is unlocked; the 5-tuple information in the first message is compared with the 5-tuple information in the forward flow table; after successful comparison, the first message is forwarded according to the forward flow table.

[0047] Specifically, when the first message is not the first message of the data stream, it indicates that the forward flow table and reverse flow table of the data stream have been stored in the hash bucket based on the first message of the data stream according to the flow table processing method provided in this application. Since all messages in the data stream have the same destination address information, the index values ​​calculated based on the destination address information in each message of the data stream are the same. Therefore, the index value calculated based on the destination address information of the first message of the data stream is the first index value, and correspondingly, the hash bucket used to store the forward flow table and reverse flow table of the data stream is the first hash bucket. Therefore, in this embodiment, when querying the hash bucket based on the first index value calculated based on the destination address information of the first message, the hash bucket obtained is also the aforementioned first hash bucket.

[0048] Based on this, since the network device needs to forward the first packet by looking up the flow table after receiving it, the corresponding thread in the network device needs to lock the first hash bucket. After successful locking, it can access the first hash bucket while preventing other threads from accessing it. Thus, the corresponding thread can read the corresponding forward flow table from the first hash bucket based on the first index value. Furthermore, to ensure the correctness of forwarding, the network device compares the 5-tuple in the first packet with the 5-tuple recorded in the forward flow table to confirm that the read forward flow table is correct. If the comparison is successful, the first packet can be forwarded according to the forward flow table.

[0049] Optionally, based on any of the above embodiments, in this embodiment, when performing hash calculation based on the destination address information, it can be performed as follows: index value index = hash_func(Key), where Key is the aforementioned destination address information. In practical applications, the destination address information involved in the calculation can be, but is not limited to, the IP address, destination port, and protocol number of the receiver to which the first message is actually to be received. For ease of understanding, if the first message is to be sent to destination device 1, and the IP address of destination device 1 is IP address 1, the destination port is port 1, and the protocol number used is protocol number 1, then the aforementioned destination address information is IP address 1, port 1, and protocol number 1. Based on this, hash calculation processing can be performed on the aforementioned IP address 1, port 1, and protocol number 1 to obtain the first index value index1 = hash_func(Key), where Key is the aforementioned IP address 1, port 1, and protocol number 1.

[0050] Optionally, based on any of the above embodiments, in this embodiment, the first index value is composed of a first value with a high number of bits and a second value with a low number of bits. The second value is used to indicate the collision chain in which the forward flow table and the reverse flow table are located in the first hash bucket, and the first value is the identifier of the forward flow table and the reverse flow table in the collision chain.

[0051] Specifically, flow tables in hash buckets are stored in the form of collision chains. Therefore, to quickly locate the corresponding flow table when subsequent packets arrive at the network device, an index value is proposed to identify the hash bucket where the flow table resides and the position of the flow table in the collision chain. Based on this, each index value consists of two parts: the lower bits indicate the collision chain of the forward and reverse flow tables in the hash bucket, and the higher bits represent the identifier of the forward and reverse flow tables on the aforementioned collision chain.

[0052] Preferably, the first index value is composed of 32 bits, wherein the higher bits may be, but are not limited to, the higher 8 bits, and the lower bits may be, but are not limited to, 24 bits. To better understand this embodiment, the first index value is used as an example. The first index value is composed of a first value (high 8 bits) and a second value (low 24 bits). This first index value can then locate the first hash bucket used to store the forward flow table and the reverse flow table. In this first hash bucket, the second value indicates the collision chain where the forward and reverse flow tables reside, and the first value indicates the identifiers of the forward and reverse flow tables at that position, enabling the network device to quickly distinguish different flow tables on the collision chain. (Refer to...) Figure 2 As shown.

[0053] Optionally, based on any of the above embodiments, the flow table processing method provided in this embodiment may further include the following process: receiving a second packet sent from the public network; parsing source address information from the second packet and performing hash calculation on the source address information to obtain a second index value; using the second index value to determine the second hash bucket where the first target flow table corresponding to the second packet is located; locking the second hash bucket and extracting the first target flow table from the corresponding position of the second hash bucket, the first target flow table including the forward flow table and the reverse flow table corresponding to the second packet; extracting target source address information from the first target flow table; if the source address information is consistent with the target source address information, comparing the 5-tuple of the second packet with the 5-tuple in the first target flow table; when the comparison is successful, forwarding the second packet according to the first target flow table; and unlocking the second hash bucket.

[0054] Specifically, when a packet from the external network is sent to the internal network, to ensure the security of the internal network, taking the second packet as an example, after the network device receives the second packet from the external network, in order to quickly forward the packet, it needs to extract the reverse flow table from the hash bucket for query and forwarding processing. The network device can parse the source address information from the second packet, and then use the source address information to look up the corresponding reverse flow table. That is, it performs hash calculation on the source address information to obtain the second index value. Based on this second index value, the corresponding hash bucket can be found, denoted as the second hash bucket. After finding the second hash bucket, the lower 24 bits of the second index value can be used to determine the collision chain in which the reverse flow table (second target flow table) is located in the second hash bucket. Since the higher 8 bits of the second index value indicate the identifier of the reverse flow table, the corresponding reverse flow table can be matched based on this identifier. Then the target source address information can be extracted from the reverse flow table. This target source address information is the public network address information assigned by the network device to the data flow to which the second packet belongs. It should be noted that if the second packet and the first packet belong to the same data flow, then this target source address information is the destination address information in the first packet.

[0055] After extracting the target source address information, this information can be matched with the source address information in the second packet. A successful match indicates that the second packet has matched the reverse flow table. Furthermore, to more accurately determine the correctness of the reverse flow table, the network device can compare the five-tuple in the second packet with the five-tuple recorded in the reverse flow table. If they match, the reverse flow table is considered correct. Based on this, the network device can forward the second packet according to the reverse flow table. For example, the destination address in a second packet sent over the public network can be converted to the private network destination address recorded in the reverse flow table, and then the converted second packet can be forwarded.

[0056] Therefore, since the flow table needs to be read from the hash bucket, the second hash bucket needs to be locked to prevent other threads from accessing it. After successful locking, the first target flow table can be extracted from the position indicated by the second index value in the second hash bucket. After successful extraction, the second hash bucket is unlocked to allow other threads to access it.

[0057] It is worth noting that the aforementioned source address information may include, but is not limited to, the sender's IP address (source IP address), sender's port (source port), and protocol number corresponding to the second message. Furthermore, the method for hashing the source address information can refer to the process described above for calculating the first index value based on the destination address information; these details will not be elaborated upon here.

[0058] Based on any of the above embodiments, this embodiment also provides the following flow table deletion method, which may include the following steps: receiving a third message, the third message being used to indicate the deletion of a second target flow table corresponding to the third message, the second target flow table including a forward flow table and a reverse flow table corresponding to the third message; extracting first target address information from the third message, the first target address information being the source address information or the destination address information of the third message; performing hash calculation on the first target address information to obtain a third index value; using the third index value to determine the third hash bucket where the second target flow table corresponding to the third message is located; locking the third hash bucket and extracting the second target flow table from the corresponding position of the third hash bucket; extracting second target address information corresponding to the first target address information from the second target flow table; if the first target address information is consistent with the second target address information, comparing the 5-tuple in the third message with the 5-tuple in the second target address information; if the comparison is successful, deleting the second target flow table in the third hash bucket; and unlocking the third hash bucket after successful flow table deletion.

[0059] Specifically, to conserve network device storage resources, the flow tables in the hash bucket are monitored. For ease of description, we'll use a target data flow as an example, which can be any data flow passing through the network device. The network device can determine whether to delete the local flow table used to support interaction between the internal and external network devices by receiving messages from internal or external network devices. The aforementioned third message can be, but is not limited to, a FIN message. Based on this, when the network device receives the third message, if it confirms that the third message is a FIN message, it indicates that the internal and external network devices intend to disconnect their communication connection. It's worth noting that the aforementioned third message can be a message sent from an internal network device to a public network device, or vice versa.

[0060] Then, the network device can extract the first destination address information from the third packet, perform hash calculation on the first destination address information to obtain the third index value, and then use the third index value to determine the third hash bucket storing the aforementioned second destination flow table. Next, based on the high 8 bits and low 24 bits of the third index value, the network device extracts the aforementioned second destination flow table from the collision chain in the third hash bucket. The network device can then extract the second destination address information from the second destination flow table and verify whether the first destination address information matches the second destination address information. If they match, it indicates that the correct second destination flow table has been matched. Furthermore, to more accurately confirm the accuracy of the found flow table, the 5-tuple in the third packet is compared with the 5-tuple in the second destination flow table. Only when they match can the accuracy of the second destination flow table be confirmed. Based on this, a deletion operation can be performed on the second destination flow table. If they do not match, it indicates that the correct second destination flow table has not been matched, and no processing can be performed, or a matching failure indication message can be output.

[0061] Therefore, since the flow table needs to be deleted from the hash bucket, the third hash bucket needs to be locked to prevent other threads from accessing it. After successful locking, the first target flow table can be extracted from the position indicated by the third index value in the third hash bucket. After successful extraction, the third hash bucket is unlocked to allow other threads to access it.

[0062] It is worth noting that if the third message is a message sent from the internal network to the public network, then the first destination address information is the destination address information in the third message, i.e., the IP address, port number, and protocol number of the receiver (public network). Accordingly, the extracted second destination flow table is a forward flow table, and the second destination address information is the destination address information recorded in the forward flow table. If the third message is a message sent from the external network to the internal network, then the first destination address information is the source address information in the third message, i.e., the IP address, port number, and protocol number of the sender (public network). Accordingly, the extracted second destination flow table is a reverse flow table, and the second destination address information is the source address information recorded in the reverse flow table. Furthermore, the method for hashing the first destination address information can refer to the calculation process described above for calculating the first index value based on the destination address information in the first message, and will not be explained in detail here.

[0063] Based on any of the above embodiments, in this embodiment, the flow table can be, but is not limited to, a forward flow table or a reverse flow table established based on a TCP connection.

[0064] Therefore, by using the public network address information (destination address information in packets from the internal network to the public network or source address information in packets from the public network to the internal network) to calculate the index value for storing the forward and reverse flow tables, since the public network address information of the forward and reverse flow tables is the same, only one index value can be calculated. This ensures that both the forward and reverse flow tables can be written into the same hash bucket. In contrast, existing technologies calculate index values ​​based on the 5-tuple in the original packet and the 5-tuple after NAT, resulting in different index values ​​for the forward and reverse flow tables, leading to deadlock situations where different hash buckets are needed to store the forward and reverse flow tables respectively. Since this application uses only one hash bucket for storing the forward and reverse flow tables, the aforementioned deadlock situation does not exist. Furthermore, since both the forward flow table and the reverse flow table are written to the same hash bucket in this application, only one hash bucket needs to be locked when writing the aforementioned flow table to the hash bucket. This not only greatly simplifies the processing flow but also ensures the security of network devices when operating the flow table, while also guaranteeing the processing performance of NAT services.

[0065] Based on the same inventive concept, this application also provides a flow table processing apparatus corresponding to the above-described flow table processing method. Specific implementation details of this flow table processing apparatus can be found in the above description of the flow table processing method, and will not be elaborated upon here.

[0066] See Figure 3 , Figure 3 An exemplary embodiment of this application provides a flow table processing apparatus, comprising:

[0067] The first receiving module 301 is used to receive the first message sent from the intranet;

[0068] The first extraction module 302 is used to extract destination address information from the first packet if the first packet is the first packet of the data stream, after allocating NAT address information to the first packet and establishing a forward flow table and a reverse flow table for the data stream respectively.

[0069] Hash calculation module 303 is used to perform hash calculation processing on the destination address information to obtain a first index value. The first index value is used to indicate the first hash bucket to which the forward flow table and the reverse flow table belong and their positions in the first hash bucket.

[0070] The locking module 304 is used to lock the first hash bucket indicated by the first index value and write the forward flow table and the reverse flow table into the first hash bucket indicated by the first index value.

[0071] The unlocking module 305 is used to unlock the first hash bucket after the flow table is successfully written.

[0072] Optionally, based on the above embodiments, the flow table processing apparatus provided in this embodiment may further include:

[0073] The first determining module (not shown in the figure) is used to determine the first hash bucket for storing the forward flow table of the data flow to which the first message belongs, if the first message is not the first message of the data flow.

[0074] Based on this, the locking module 304 is also used to lock the first hash bucket;

[0075] The second extraction module (not shown in the figure) is used to extract the forward flow table from the first hash bucket;

[0076] The unlocking module 305 is also used to unlock the first hash bucket after successful extraction;

[0077] The first comparison module (not shown in the figure) is used to compare the five-tuple information in the first message with the five-tuple information in the forward flow table;

[0078] The first forwarding module (not shown in the figure) is used to forward the first packet according to the forwarding flow table after the first comparison module has successfully matched it.

[0079] Optionally, based on any of the above embodiments, in this embodiment, the first index value is composed of a first value with a high number of bits and a second value with a low number of bits. The second value is used to indicate the collision chain in which the forward flow table and the reverse flow table are located in the first hash bucket, and the first value is the identifier of the forward flow table and the reverse flow table in the collision chain.

[0080] Optionally, based on any of the above embodiments, the flow table processing apparatus provided in this embodiment may further include:

[0081] The first receiving module 301 is also used to receive a second message sent from the public network;

[0082] The hash calculation module 303 is further configured to parse the source address information from the second message and perform hash calculation on the source address information to obtain a second index value;

[0083] The second determining module (not shown in the figure) is used to determine the second hash bucket where the second message corresponds to the first target flow table using the second index value;

[0084] The locking module 304 is also used to lock the second hash bucket and extract the first target flow table from the corresponding position of the second hash bucket. The first target flow table includes the reverse flow table corresponding to the second packet.

[0085] The third extraction module (not shown in the figure) is used to extract the target source address information from the first target flow table;

[0086] The second comparison module (not shown in the figure) is used to compare the five-tuple of the second packet with the five-tuple in the first target flow table if the source address information is consistent with the target source address information.

[0087] The second forwarding module (not shown in the figure) is used to forward the second packet according to the first target flow table when the second comparison module successfully compares the packets.

[0088] The unlocking module 305 is also used to unlock the second hash bucket.

[0089] Optionally, based on any of the above embodiments, the flow table processing apparatus provided in this embodiment may further include:

[0090] The second receiving module (not shown in the figure) is used to receive a third message, which is used to indicate the deletion of the second target flow table corresponding to the third message. The second target flow table includes a forward flow table and a reverse flow table corresponding to the third message.

[0091] The fourth extraction module (not shown in the figure) is used to extract the first target address information from the third message, wherein the first target address information is the source address information of the third message or the destination address information of the third message;

[0092] The hash calculation module 303 is further configured to perform hash calculation on the first target address information to obtain a third index value;

[0093] The third determining module (not shown in the figure) is used to determine the third hash bucket where the second target flow table corresponding to the third message is located using the third index value;

[0094] The locking module 304 is also used to lock the third hash bucket and extract the second target flow table from the corresponding position of the third hash bucket;

[0095] The fifth extraction module (not shown in the figure) is used to extract the second target address information corresponding to the first target address information from the second target flow table;

[0096] The third comparison module (not shown in the figure) is used to compare the five-tuple in the third message with the five-tuple in the second target address information if the first target address information is consistent with the second target address information.

[0097] A deletion module (not shown in the figure) is used to delete the second target flow table in the third hash bucket when the third comparison module successfully compares the data.

[0098] The unlocking module 305 is also used to unlock the third hash bucket after the flow table deletion is successful.

[0099] Optionally, based on any of the above embodiments, in this embodiment, the destination address information includes the destination IP address, destination port, and protocol number in the first message.

[0100] Based on any of the above embodiments, in this embodiment, any of the above flow table processing devices can be set in a network device, which can be, but is not limited to, a NAT device, etc.

[0101] By employing the public IP address information-based index value calculation method described in this application for storing forward and reverse flow tables, and since the public IP address information of the forward and reverse flow tables is the same, only one index value can be calculated. This ensures that both the forward and reverse flow tables can be written into the same hash bucket. In contrast, existing technologies calculate index values ​​based on the 5-tuple in the original packet and the 5-tuple after NAT, resulting in different index values ​​for the forward and reverse flow tables. This leads to deadlock situations where different hash buckets are needed to store the forward and reverse flow tables separately. Since this application uses only one hash bucket for storing the forward and reverse flow tables, the aforementioned deadlock situation is avoided. Furthermore, because both the forward and reverse flow tables are written into the same hash bucket, only one hash bucket needs to be locked when writing the flow tables into that bucket. This greatly simplifies the processing flow, ensures the security of network devices when operating flow tables, and guarantees the processing performance of NAT services.

[0102] Based on the same inventive concept, embodiments of this application provide a network device, such as... Figure 4 As shown, the device includes a processor 401 and a machine-readable storage medium 402. The machine-readable storage medium 402 stores a computer program executable by the processor 401. The processor 401 is prompted by the computer program to execute the flow table processing method provided in any embodiment of this application. Furthermore, the network device also includes a communication interface 403 and a communication bus 404, wherein the processor 401, the communication interface 403, and the machine-readable storage medium 402 communicate with each other via the communication bus 404.

[0103] The communication bus mentioned in the above network devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not indicate that there is only one bus or one type of bus.

[0104] The communication interface is used for communication between the aforementioned network devices and other devices.

[0105] The machine-readable storage medium 402 described above can be a memory, which may include random access memory (RAM), DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0106] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0107] For network devices and machine-readable storage media embodiments, since the methods involved are basically similar to those described in the foregoing method embodiments, the description is relatively simple, and relevant details can be found in the descriptions of the method embodiments.

[0108] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0109] The specific implementation process of the functions and roles of each unit / module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0110] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units / modules described as separate components may or may not be physically separate. The components shown as units / modules may or may not be physical units / modules, that is, they may be located in one place or distributed across multiple network units / modules. Some or all of the units / modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0111] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A flow table processing method, characterized in that, include: Receive the first message sent from the intranet; If the first message is the first message of the data flow, then after allocating NAT address information to the first message and establishing forward flow table and reverse flow table for the data flow respectively, the destination address information is extracted from the first message, and the destination address information is public network address information. The destination address information is hashed to obtain a first index value, which is used to indicate the first hash bucket to which the forward flow table and the reverse flow table belong and their positions in the first hash bucket. Lock the first hash bucket indicated by the first index value, and write the forward flow table and the reverse flow table into the first hash bucket indicated by the first index value; After the flow table is successfully written, the first hash bucket is unlocked.

2. The method according to claim 1, characterized in that, Also includes: If the first message is not the first message in the data stream, then the first hash bucket for storing the forward flow table of the data stream to which the first message belongs is determined using the first index value; Lock the first hash bucket; Extract the forward flow table from the first hash bucket; After successful extraction, the first hash bucket is unlocked; Compare the 5-tuple information in the first message with the 5-tuple information in the forward flow table; After a successful comparison, the first packet is forwarded according to the forward flow table.

3. The method according to claim 2, characterized in that, The first index value consists of a first value with a high number of bits and a second value with a low number of bits. The second value is used to indicate the collision chain in which the forward flow table and the reverse flow table are located in the first hash bucket, and the first value is the identifier of the forward flow table and the reverse flow table in the collision chain.

4. The method according to claim 1, characterized in that, Also includes: Receive the second message sent from the public network; The source address information is parsed from the second message, and a hash calculation is performed on the source address information to obtain the second index value; The second index value is used to determine the second hash bucket where the first target flow table corresponding to the second message is located; The second hash bucket is locked, and the first target flow table is extracted from the corresponding position of the second hash bucket. The first target flow table includes the reverse flow table corresponding to the second packet. Extract the target source address information from the first target flow table; If the source address information is consistent with the target source address information, then the five-tuple of the second message is compared with the five-tuple in the first target flow table; Upon successful comparison, the second packet is forwarded according to the first target flow table; Unlock the second hash bucket.

5. The method according to claim 1, characterized in that, Also includes: Receive a third message, the third message being used to instruct the deletion of the second target flow table corresponding to the third message, the second target flow table including the forward flow table and the reverse flow table corresponding to the third message; Extract the first target address information from the third message, wherein the first target address information is the source address information of the third message or the destination address information of the third message; The first target address information is hashed to obtain the third index value; The third index value is used to determine the third hash bucket where the second target flow table corresponding to the third message is located; The third hash bucket is locked, and the second target flow table is extracted from the corresponding position of the third hash bucket; Extract the second target address information corresponding to the first target address information from the second target flow table; If the first target address information is consistent with the second target address information, then the 5-tuple in the third message is compared with the 5-tuple in the second target address information; If the comparison is successful, the second target flow table in the third hash bucket is deleted; After successful deletion of the flow table, the third hash bucket is unlocked.

6. The method according to claim 1, characterized in that, The destination address information includes the destination IP address, destination port, and protocol number in the first message.

7. A flow meter processing device, characterized in that, include: The first receiving module is used to receive the first message sent from the intranet. The first extraction module is used to extract destination address information from the first packet if the first packet is the first packet of the data flow, after allocating NAT address information to the first packet and establishing forward flow table and reverse flow table for the data flow respectively. The destination address information is public network address information. The hash calculation module is used to perform hash calculation on the destination address information to obtain a first index value. The first index value is used to indicate the first hash bucket to which the forward flow table and the reverse flow table belong and their positions in the first hash bucket. The locking module is used to lock the first hash bucket indicated by the first index value and write the forward flow table and the reverse flow table into the first hash bucket indicated by the first index value. The unlock module is used to unlock the first hash bucket after the flow table is successfully written.

8. The apparatus according to claim 7, characterized in that, Also includes: The first determining module is configured to determine, using the first index value, a first hash bucket for storing the forward flow table of the data flow to which the first message belongs if the first message is not the first message of the data flow. The locking module is also used to lock the first hash bucket; The second extraction module is used to extract the forward flow table from the first hash bucket; The unlocking module is also used to unlock the first hash bucket after successful extraction; The first comparison module is used to compare the five-tuple information in the first message with the five-tuple information in the forward flow table; The first forwarding module is used to forward the first packet according to the forwarding flow table after the first comparison module has successfully matched it.

9. The apparatus according to claim 8, characterized in that, The first index value consists of a first value with a high number of bits and a second value with a low number of bits. The second value is used to indicate the collision chain in which the forward flow table and the reverse flow table are located in the first hash bucket, and the first value is the identifier of the forward flow table and the reverse flow table in the collision chain.

10. The apparatus according to claim 7, characterized in that, Also includes: The first receiving module is also used to receive a second message sent from the public network; The hash calculation module is further configured to parse the source address information from the second message and perform hash calculation on the source address information to obtain the second index value; The second determining module is used to determine the second hash bucket where the second message corresponds to the first target flow table using the second index value; The locking module is further configured to lock the second hash bucket and extract the first target flow table from the corresponding position of the second hash bucket, wherein the first target flow table includes the reverse flow table corresponding to the second packet; The third extraction module is used to extract target source address information from the first target flow table; The second comparison module is used to compare the five-tuple of the second packet with the five-tuple in the first target flow table if the source address information is consistent with the target source address information. The second forwarding module is used to forward the second packet according to the first target flow table when the second comparison module successfully compares the packets. The unlocking module is also used to unlock the second hash bucket.

11. The apparatus according to claim 7, characterized in that, Also includes: The second receiving module is used to receive a third message, the third message being used to instruct the deletion of the second target flow table corresponding to the third message, the second target flow table including the forward flow table and the reverse flow table corresponding to the third message; The fourth extraction module is used to extract first target address information from the third message, wherein the first target address information is the source address information of the third message or the destination address information of the third message; The hash calculation module is also used to perform hash calculation on the first target address information to obtain a third index value; The third determining module is used to determine the third hash bucket where the second target flow table corresponding to the third message is located using the third index value; The locking module is also used to lock the third hash bucket and extract the second target flow table from the corresponding position of the third hash bucket; The fifth extraction module is used to extract the second target address information corresponding to the first target address information from the second target flow table; The third comparison module is used to compare the 5-tuple in the third message with the 5-tuple in the second target address information if the first target address information is consistent with the second target address information. The deletion module is used to delete the second target flow table in the third hash bucket when the comparison by the third comparison module is successful; The unlocking module is also used to unlock the third hash bucket after the flow table deletion is successful.

12. A network device, characterized in that, The method includes a processor and a machine-readable storage medium storing a computer program executable by the processor, which is prompted by the computer program to perform the method according to any one of claims 1-6.

13. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores a computer program that, when invoked and executed by a processor, causes the processor to perform the method according to any one of claims 1-6.

Images