A control method, device, medium and program product for URPF inspection

Abstract

The present application provides a control method, device, medium and program product for URPF inspection. The method includes: obtaining a flow message, determining whether the flow message is a designated flow message; if the flow message is a designated flow message, determining the flow action of the designated flow message; according to the flow action, redirecting the flow message to the first target loopback interface or the second target loopback interface pre-configured in the switch; wherein the flow action is URPF enablement or URPF disenablement; the first target loopback interface corresponds to URPF disenablement, and the second target loopback interface corresponds to URPF enablement. This solution can at least be used to solve the technical problem in the related art that it is impossible to flexibly and finely control the URPF inspection items of certain designated flow messages.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to a control method, device, medium and program product for URPF inspection. Background Art

[0002] With the widespread application of the Internet, network security has become a very important issue for everyone. URPF, as a network entry security mechanism to prevent attacks, is superior to traditional firewalls in performance. URPF stands for "Un i cast Reverse Path Forward i ng", a unicast reverse routing lookup technology used to prevent network attacks based on source address spoofing.

[0003] In the related art, URPF is generally configured on the interface of the switch to implement URPF check on the traffic of the interface. If the URPF check passes, it means that the traffic can pass through the interface normally; if the URPF check fails, the traffic is discarded and cannot pass through the interface normally.

[0004] However, the inventors have found at least the following technical problems: the technical solutions provided by the related art can only perform URPF checks on all flows of the interface, or can only not perform URPF checks on all flows of the interface, which makes it impossible to perform flexible and refined control on URPF check items for certain specified flow packets. Summary of the invention

[0005] One purpose of the present application is to provide a URPF check control method, device, medium and program product, at least to solve the technical problem in the related art that URPF check items of certain specified traffic packets cannot be flexibly and finely controlled.

[0006] To achieve the above objectives, some embodiments of the present application provide the following aspects:

[0007] In a first aspect, some embodiments of the present application provide a control method for URPF check, the method comprising: obtaining a flow packet, and determining whether the flow packet is a specified flow packet; if the flow packet is a specified flow packet, determining the flow action of the specified flow packet; according to the flow action, redirecting the flow packet to a first target loopback interface or a second target loopback interface pre-configured on a switch; wherein the flow action is URPF enabling or URPF disabling; the first target loopback interface corresponds to URPF disabling, and the second target loopback interface corresponds to URPF enabling.

[0008] In a second aspect, some embodiments of the present application further provide a computer device, comprising: one or more processors; and a memory storing computer program instructions, wherein the computer program instructions, when executed, cause the processor to perform the method described above.

[0009] In a third aspect, some embodiments of the present application further provide a computer-readable medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the method as described above.

[0010] In a fourth aspect, some embodiments of the present application further provide a computer program product, wherein the product comprises a computer program / instructions, and the computer program / instructions implement the method described above when executed by a processor.

[0011] Compared with the prior art, in the solution provided by the embodiment of the present application, by setting and obtaining a flow message, it is determined whether the flow message is a designated flow message. If the flow message is a designated flow message, the flow action of the designated flow message is determined, and then the flow message can be redirected to the first target loopback interface or the second target loopback interface preconfigured in the switch according to the flow action. Among them, the flow action can be URPF enablement or URPF disenablement; the first target loopback interface corresponds to URPF disenablement, and the second target loopback interface corresponds to URPF enablement. In this way, since it is possible to distinguish whether the flow message is a designated flow message, and when the flow message is a designated flow message, the URPF enablement or URPF disenablement of the corresponding designated flow message is realized through the first target loopback interface or the second target loopback interface preconfigured in the switch, thereby achieving the purpose of flexibly and finely controlling the URPF inspection items of certain designated flow messages. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 An exemplary flow chart of a control method for URPF checking provided in some embodiments of the present application;

[0013] Figure 2 An exemplary schematic diagram of a path of a traffic message in a switching chip in a URPF check control method provided in some embodiments of the present application;

[0014] Figure 3 This is an exemplary flowchart of step S101 in a URPF check control method provided in some embodiments of the present application. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0016] The following terms are used in this article.

[0017] URPF is enabled, which means URPF check is performed;

[0018] Disabling URPF means that URPF check is not required and the corresponding traffic can pass through the corresponding interface normally.

[0019] A loopback interface, usually called a loopback interface, is a logical, virtual interface.

[0020] ACL, access control list, is an access control technology based on packet filtering. It can filter data packets on the interface according to the set conditions, allowing them to pass or discard them. Access control lists are widely used in routers and three-layer switches. With the help of access control lists, users' access to the network can be effectively controlled, thereby ensuring network security to the greatest extent.

[0021] Embodiment 1

[0022] Some embodiments of the present application provide a control method for URPF checking, such as Figure 1 and Figure 2 As shown, the method may include the following steps:

[0023] Step S101, obtaining a flow message, and determining whether the flow message is a designated flow message;

[0024] Step S102: if the flow message is a designated flow message, determine the flow action of the designated flow message;

[0025] Step S103, according to the traffic action, redirecting the traffic message to the first target loopback interface or the second target loopback interface preconfigured on the switch; wherein the traffic action is URPF enabling or URPF disabling; the first target loopback interface corresponds to URPF disabling, and the second target loopback interface corresponds to URPF enabling.

[0026] The above steps are described below respectively.

[0027] Regarding step S101, specifically, in some embodiments, the designated traffic message can be customized by relevant personnel. That is to say, whether the switch interface is uniformly configured to perform URPF check or not, the relevant personnel can set the designated traffic message according to actual needs. For example, the switch interface is uniformly configured to perform URPF check on all traffic, but in actual needs, some traffic does not need to perform corresponding URPF check. In this regard, in order to allow these traffic to bypass URPF check, these traffic can be set as designated traffic messages.

[0028] In some embodiments, the relevant personnel may be a network engineer of the operator corresponding to the switch or router, or a network security maintenance personnel of the maintenance provider corresponding to the switch or router. In some special application scenarios, the relevant personnel may also be a user of the switch or router, and the user may apply for corresponding configuration permissions to enable or disable URPF for certain specified traffic packets.

[0029] Regarding step S102, specifically, in some embodiments, the traffic action may be URPF enabling or URPF disabling.

[0030] Regarding step S103, specifically, in some embodiments, relevant personnel can perform pre-configuration processing on the switch to create an internal loopback interface, and the internal loopback interface can include a first target loopback interface and a second target loopback interface, so that the designated traffic message can be redirected through the created loopback interface. It can be understood that the loopback interface occupies an IP address exclusively, which can be used to a certain extent as a physical interface on the switch. In this way, the first target loopback interface can be used to avoid URPF checking for the corresponding designated traffic message, and the second target loopback interface can be used to perform URPF checking for the corresponding designated traffic message.

[0031] Specifically, in some embodiments, the switch includes at least a first target loopback interface and a second target loopback interface. The first target loopback interface corresponds to URPF disabled, and the second target loopback interface corresponds to URPF enabled. This is done so that URPF check items of certain specified traffic packets can be more fully and flexibly controlled in a refined manner.

[0032] For example, assuming that the number of traffic messages is large, such as 10,000, and assuming that only 4 specified traffic messages need to be checked for URPF in actual applications, then relevant personnel can establish a second target access control list based on the traffic characteristics of the 4 specified traffic messages to redirect the 4 specified traffic messages to the second target loopback interface pre-configured on the switch.

[0033] For another example, assuming that the number of traffic messages is large, such as 10,000, and assuming that in actual application only 4 of the specified traffic messages need not be subjected to URPF check, at this time, relevant personnel can establish a first target access control list based on the traffic characteristics of the 4 specified traffic messages, so that the 4 specified traffic messages are redirected to the first target loopback interface pre-configured on the switch.

[0034] Specifically, in some embodiments, relevant personnel can create any number of loopback interfaces as required. For example, the number of the first target loopback interfaces can be 1, 2 or even more; the number of the second target loopback interfaces is also the same, and the embodiment of the present application does not limit the number of the loopback interfaces.

[0035] See also Figure 2 , Figure 2 This is an exemplary schematic diagram of the path of a traffic message in a switching chip according to the solution provided in an embodiment of the present application. The routing module is one of the modules belonging to the switching chip, which is used to perform routing lookup and determine the egress port of the traffic message; the ACL module is used to determine whether the traffic message is a designated traffic message.

[0036] For example, assuming that the flow message is flow message 1, and the flow message 1 is a designated flow message that needs to be disabled by URPF, then if the interface C (not shown in the figure) of the switching chip is configured as: URPF enabled, then the flow message 1 should be subjected to URPF check at the interface C of the switching chip. In one example, if the URPF check fails, the flow message 1 will be discarded. However, through the solution provided by the embodiment of the present application, the ACL module can determine that the flow message 1 is a designated flow message that needs to be disabled by URPF, and therefore, the flow message 1 can be redirected to the first target loopback interface to bypass the URPF check for output.

[0037] It is understandable that in the related technologies, considering the needs of network security, it is often necessary to perform URPF checks through the interfaces of switches, but the core chip of the switch - the switching chip does not support flexible URPF checks based on specified traffic packets. As a result, it is impossible to flexibly choose between performing URPF checks and not performing URPF checks on the specified traffic packets. In other words, it is impossible to flexibly enable or disable URPF for certain specified traffic packets. This will result in that in many businesses where URPF checks need to be performed through interfaces, some traffic will be intercepted and discarded even if it is not an attack message or other messages that the operator wants to pass the URPF check, and it is impossible to achieve precise control of traffic.

[0038] It is not difficult to find that, through the scheme provided by the embodiment of the present application, by setting and obtaining the flow message, it is determined whether the flow message is a designated flow message. If the flow message is a designated flow message, the flow action of the designated flow message is determined, and then the flow message can be redirected to the first target loopback interface or the second target loopback interface preconfigured in the switch according to the flow action. Among them, the flow action can be URPF enablement or URPF disenablement; the first target loopback interface corresponds to URPF disenablement, and the second target loopback interface corresponds to URPF enablement. In this way, since it is possible to distinguish whether the flow message is a designated flow message, and when the flow message is a designated flow message, the URPF enablement or URPF disenablement of the corresponding designated flow message is realized through the first target loopback interface or the second target loopback interface preconfigured in the switch, thereby achieving the purpose of flexibly and finely controlling the URPF inspection items of certain designated flow messages.

[0039] Embodiment 2

[0040] Some embodiments of the present application are improvements made on the basis of the first embodiment. The specific improvement lies in providing a specific implementation method for obtaining the traffic message and determining whether the traffic message is a designated traffic message, which is conducive to the flexible and diverse implementation of the solution provided in the embodiments of the present application.

[0041] Specifically, in some embodiments, the obtaining of the flow message and determining whether the flow message is a designated flow message may further include the following steps: Figure 3 As shown:

[0042] Step S1011, obtaining a flow message, matching the flow message with a target access control list recording a flow feature of a specified flow message, and obtaining a matching result;

[0043] Step S1012: Determine whether the flow message is a designated flow message according to the matching result.

[0044] Specifically, in some embodiments, the target access control list may include a first target access control list corresponding to URPF disabling and a second target access control list corresponding to URPF enabling. The first target access control list corresponding to URPF disabling and the second target access control list corresponding to URPF enabling may be independently set in different target access control lists or in the same target access control list, which is not specifically limited in the embodiments of the present application. The traffic feature may be an IP address pointing to a target IP.

[0045] Specifically, in some embodiments, after the ingress port obtains the traffic packet, the traffic packet can be matched with the IP addresses recorded in the first target access control list and the second target access control list respectively. If a successful match result is obtained in the process of matching the traffic packet with the first target access control list, the traffic action of the traffic packet is determined to be: URPF disabled. Wherein, after the ingress port obtains the traffic packet each time, the traffic packet can be matched with the IP addresses recorded in the first target access control list and the second target access control list respectively.

[0046] Further, in some embodiments, assuming that the above-mentioned traffic message has been matched successfully, the matching operation can be stopped; otherwise, assuming that the traffic message has not been matched successfully based on the first target access control list, and a matching result of unsuccessful matching is obtained, the traffic message and the IP address recorded in the second target access control list are matched again until the matching is completed. If a matching result of successful matching is obtained in the process of matching the traffic message and the second target access control list, the traffic action of the traffic message is determined to be: URPF enabled. In some embodiments, the priority of matching the first target access control list and the second target access control list can be set.

[0047] Further, in some embodiments, assuming that the above-mentioned traffic message fails to match successfully in the first target access control list corresponding to URPF disabled and the second target access control list corresponding to URPF enabled, it can be determined that the traffic message does not belong to the specified traffic message, then according to the existing methods in the relevant technology, the traffic message is allowed to perform subsequent operations normally through the interface of the switch.

[0048] Specifically, in some embodiments, the number of designated flow packets recorded in the target access control list is not limited, and relevant personnel can enter the designated flow packets according to actual needs. Of course, the number of designated flow packets depends largely on the ACL specifications supported by the switch.

[0049] Optionally, in some embodiments, matching the traffic message with a target access control list recording traffic characteristics of a specified traffic message to obtain a matching result may further include the following steps:

[0050] Step S10111: if the update information is obtained, the target access control list recording the traffic characteristics of the specified traffic message is updated according to the update information;

[0051] Step S10112, matching the traffic message with the updated target access control list to obtain a matching result.

[0052] Optionally, in some embodiments, the method for generating the target access control list may include the following steps:

[0053] Step S201, receiving a flow feature set by a user for determining whether it is the designated flow message, and a flow action set for the flow feature;

[0054] Step S202: Generate a first target access control list corresponding to URPF disabling and a second target access control list corresponding to URPF enabling according to the traffic characteristics and the traffic action.

[0055] Specifically, in some embodiments, after receiving the traffic feature set by relevant personnel for determining whether it is the designated traffic message, and the traffic action set for the traffic feature, the target access control list (ac l table) can be created according to the traffic feature and the traffic action. The traffic feature can be an IP address pointing to a target IP, and the traffic action can include URPF disabling and URPF enabling; the target access control list is a newly created access control list independent of the existing access control list in the related technology.

[0056] It is not difficult to find that the solution provided in the embodiment of the present application provides a specific implementation method for obtaining the traffic message and determining whether the traffic message is a specified traffic message, which is conducive to the flexible and diverse implementation of the solution provided in the embodiment of the present application.

[0057] Embodiment 3

[0058] Some embodiments of the present application are improvements made on the basis of embodiment one. The specific improvement lies in that a specific implementation method is provided for redirecting the traffic message to the first target loopback interface or the second target loopback interface preconfigured on the switch according to the traffic action, which is conducive to the flexible and diverse implementation of the solution provided in the embodiments of the present application.

[0059] Specifically, in some embodiments, redirecting the traffic message to a first target loopback interface or a second target loopback interface preconfigured on a switch according to the traffic action may further include the following steps:

[0060] If the traffic action is URPF disabling, redirecting the traffic message to the pre-configured first target loopback interface;

[0061] If the traffic action is URPF enabled, the traffic message is redirected to the pre-configured second target loopback interface.

[0062] Optionally, in some embodiments, the method for creating the first target loopback interface may include: creating a first loopback interface based on a switching chip of a target switch; creating a layer 3 interface based on the first loopback interface, and configuring a URPF disabled attribute based on the layer 3 interface to obtain the first target loopback interface.

[0063] For example, relevant personnel can create a first loopback interface A based on the switching chip of the target switch, and then create a three-layer interface based on the first loopback interface A, and configure the URPF disabling attribute based on the three-layer interface. In this way, a first target loopback interface A is obtained, and the attribute of the first target loopback interface A is URPF disabling.

[0064] Optionally, in some embodiments, the method for creating the second target loopback interface may include: creating a second loopback interface based on a switching chip of the target switch; creating a layer 3 interface based on the second loopback interface, and configuring URPF-enabled attributes based on the layer 3 interface to obtain the second target loopback interface.

[0065] For example, relevant personnel can create a second loopback interface B based on the switching chip of the target switch, and then create a three-layer interface based on the second loopback interface B, and configure the URPF-enabled attributes based on the three-layer interface. In this way, a second target loopback interface B is obtained, and the attribute of the second target loopback interface B is URPF disabled.

[0066] Specifically, in the embodiment of the present application, a layer 3 interface is created based on the first loopback interface A or the second loopback interface B to perform route lookup and re-forwarding. The layer 3 interface can be created in a manner already known in the relevant art, and the embodiment of the present application does not specifically limit this.

[0067] It should be noted that, in practical applications, the first target loopback interface may be created first, and then the second target loopback interface may be created; or the second target loopback interface may be created first, and then the first target loopback interface may be created. The embodiment of the present application does not impose any limitation on the order of creating the first target loopback interface and the second target loopback interface.

[0068] In addition, it should be noted that the third embodiment of the present application may also be an improvement made on the basis of the second embodiment.

[0069] It is not difficult to find that the solution provided in the embodiment of the present application provides a specific implementation method for redirecting the traffic message to the first target loopback interface or the second target loopback interface pre-configured on the switch according to the traffic action, which is conducive to the flexible and varied implementation of the solution provided in the embodiment of the present application.

[0070] Embodiment 4

[0071] Some embodiments of the present application are improvements made on the basis of embodiment 3. The specific improvement is that although the technical solution provided in embodiment 3 can be applied to about 99% of the switch chips on the market, not all switch chips support the creation of internal loopback interfaces. In this regard, an improved solution is proposed in the embodiment of the present application. The improved solution provided in embodiment 4 of the present application can be applied to all switches, so that all switches can flexibly enable or disable URPF.

[0072] Specifically, in some embodiments, in the process of creating the first loopback interface based on the switching chip of the target switch, or in the process of creating the second loopback interface based on the switching chip of the target switch, the method may further include the following steps:

[0073] Step 301, determining whether the switching chip supports the creation of a first loopback interface or a second loopback interface;

[0074] Step 302, if it is determined that the switch chip does not support the creation of the first loopback interface or the second loopback interface, determining the free ports of the switch;

[0075] Step 303: configure port self-loop according to the free ports of the switch to obtain a target port, so as to create a first loopback interface or a second loopback interface according to the target port.

[0076] Specifically, in some embodiments, if the switch chip does not support the creation of a loopback interface, including not supporting the creation of a first loopback interface or not supporting the creation of a second loopback interface, the free ports of the switch can be determined, and the port self-loop is configured and enabled according to the free ports of the switch to obtain the target port. In some embodiments, two target interfaces can be created, the first target interface can be used as the first loopback interface, and the second target interface can be used as the second loopback interface. In some embodiments, the free ports of the switch can be displayed on an electronic display interface for selection by relevant personnel.

[0077] It should be noted that the embodiments of the present application may also be improvements made on the basis of Embodiment 1 or Embodiment 2.

[0078] It is not difficult to find that the improved solution provided in the fourth embodiment of the present application can be applied to all switches, so that all switches can flexibly enable or disable URPF.

[0079] Embodiment 5

[0080] An embodiment of the present application provides a computer device, which includes a memory for storing computer-readable instructions and a processor for executing the computer-readable instructions, wherein when the computer-readable instructions are executed by the processor, the processor is triggered to execute the described method.

[0081] The methods and / or embodiments in the embodiments of the present application may be implemented as computer software programs. For example, the embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. When the computer program is executed by the processing unit, the above functions defined in the method of the present application are executed.

[0082] It should be noted that the computer-readable medium described in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0083] In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0084] The computer program code for performing the operation of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).

[0085] The flow chart or block diagram in the accompanying drawings shows the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated system for hardware that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0086] As another aspect, the embodiments of the present application further provide a computer-readable medium, which may be included in the device described in the above embodiments; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more computer-readable instructions, which may be executed by a processor to implement the steps of the methods and / or technical solutions of the above multiple embodiments of the present application.

[0087] In a typical configuration of the present application, the terminal and the equipment of the service network each include one or more processors (CPU), input / output interface, network interface and memory.

[0088] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0089] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0090] In addition, an embodiment of the present application further provides a computer program, which is stored in a computer device, so that the computer device executes the method for controlling code execution.

[0091] It should be noted that the present application can be implemented in software and / or a combination of software and hardware, for example, can be implemented using an application specific integrated circuit (ASIC), a general purpose computer or any other similar hardware device. In certain embodiments, the software program of the present application can be executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including related data structures) can be stored in a computer-readable recording medium, for example, a RAM memory, a magnetic or optical drive or a floppy disk and similar devices. In addition, some steps or functions of the present application can be implemented using hardware, for example, as a circuit that cooperates with a processor to perform each step or function.

[0092] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the spirit or basic features of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the present application is limited by the attached claims rather than the above description, so it is intended to include all changes that fall within the meaning and scope of the equivalent elements of the claims in the present application. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

Claims

1. A control method for URPF inspection, characterized in that: The method comprises: Obtain a flow message, and determine whether the flow message is a designated flow message; If the traffic message is a designated traffic message, determining a traffic action of the designated traffic message; According to the traffic action, redirect the traffic message to a first target loopback interface or a second target loopback interface preconfigured on the switch; wherein the traffic action is URPF enabling or URPF disabling; the first target loopback interface corresponds to URPF disabling, and the second target loopback interface corresponds to URPF enabling; Among them, the method for creating the first target loopback interface includes: creating a first loopback interface based on the switching chip of the target switch; creating a three-layer interface according to the first loopback interface, and configuring the URPF disabled attribute based on the three-layer interface to obtain the first target loopback interface; the method for creating the second target loopback interface includes: creating a second loopback interface based on the switching chip of the target switch; creating a three-layer interface according to the second loopback interface, and configuring the URPF enabled attribute based on the three-layer interface to obtain the second target loopback interface.

2. The method according to claim 1, characterized in that: The acquiring of the flow message and determining whether the flow message is a designated flow message comprises: Obtaining a flow message, matching the flow message with a target access control list recording a flow feature of a specified flow message, and obtaining a matching result; According to the matching result, it is determined whether the flow packet is a designated flow packet.

3. The method according to claim 2, characterized in that The acquiring of the traffic message, matching the traffic message with a target access control list recording the traffic characteristics of the specified traffic message, and obtaining a matching result includes: If the update information is obtained before the flow message is obtained, the target access control list recording the flow characteristics of the specified flow message is updated according to the update information; The flow message is matched with the updated target access control list to obtain a matching result.

4. The method according to claim 2, characterized in that: The method for generating the target access control list includes: Receive a traffic feature set by a user for determining whether it is the designated traffic message, and a traffic action set for the designated traffic message; A first target access control list corresponding to URPF disabling and a second target access control list corresponding to URPF enabling are generated according to the traffic characteristics and the traffic action.

5. The method according to any one of claims 1 to 4, characterized in that: The step of redirecting the traffic message to a first target loopback interface or a second target loopback interface preconfigured on a switch according to the traffic action comprises: If the traffic action is URPF disabling, redirecting the traffic message to the pre-configured first target loopback interface; If the traffic action is URPF enabled, the traffic message is redirected to the pre-configured second target loopback interface.

6. The method according to claim 1, characterized in that In the process of creating the first loopback interface based on the switching chip of the target switch, or in the process of creating the second loopback interface based on the switching chip of the target switch, the method includes: Determine whether the switching chip supports creating a first loopback interface or a second loopback interface; If it is determined that the switch chip does not support the creation of the first loopback interface or the second loopback interface, determining a free port of the switch; A port self-loop is configured according to the spare ports of the switch to obtain a target port, so as to create a first loopback interface or a second loopback interface according to the target port.

7. A computer device, characterized in that: The device comprises: one or more processors; and A memory storing computer program instructions, which when executed cause the processor to perform the method as claimed in any one of claims 1 to 6.

8. A computer readable medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the method according to any one of claims 1 to 6.

9. A computer program product, the product comprising a computer program / instructions, characterized in that: When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images