Communication method and apparatus

Abstract

The application provides a communication method and device, the method is applied to a first service thread, and the method comprises the following steps: receiving a first Flowspec route sent by a second network device, wherein the first Flowspec route comprises an action item, and the action item comprises a first address; searching whether a first hash node matched with the first address exists according to the first address; if the first hash node exists, comparing whether a first AS value of the second network device is same as a second AS value stored in the first hash node; if the first AS value is same as the second AS value, performing an effective processing on the first Flowspec route; and if the first AS value is different from the second AS value, performing an invalid processing on the first Flowspec route.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication method and apparatus. Background Technology

[0002] Flow Specification (Flowspec) is used to filter and inspect illegitimate traffic in BGP networks to mitigate the impact of Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. Leveraging BGP route updates, Flowspec allows for centralized configuration and management of matching rules and traffic actions (e.g., Flowspec routes) tailored to the characteristics of attack traffic, and enables rapid application of these rules and actions to other BGP routers.

[0003] The aforementioned traffic actions include next-hop redirection. This allows service traffic (which may have multiple paths) to be scheduled according to a specified path. To improve security, the next-hop redirection in a Flowspec route from an EBGP neighbor must also have a BGP unicast route from the same AS to ensure that the next-hop redirection is reachable.

[0004] Currently, many vendors separate IPv4 and IPv6 routing into different threads to improve performance, achieve faster response times, and avoid mutual interference between IPv4 and IPv6 routing. In this case, if Flowspec routing supports dual-stack next-hop (e.g., a Flowspec route with an IPv4 address redirects to an IPv6 address, or a Flowspec route with an IPv6 address redirects to an IPv4 address), cross-thread validity checks are required. Currently, cross-thread access can be achieved by locking the Flowspec route, thereby completing the next-hop redirection validity check.

[0005] However, the above approach also reveals the following drawbacks: the thread where the next hop of the redirection occurs cannot perceive changes in the corresponding unicast route in another thread; it can only periodically lock and query across threads to see if there are any changes in the unicast route. If there are changes in the unicast route, the Flowspec route is locked before cross-thread access, which reduces the processing performance and response speed of each thread. Summary of the Invention

[0006] In view of this, this application provides a communication method and apparatus to solve the problem of reduced processing performance and response speed of each thread caused by locking Flowspec routes for cross-thread access.

[0007] In a first aspect, this application provides a communication method, the method being applied to a first business thread, the method comprising:

[0008] Receive a first Flowspec route sent by a second network device, the first Flowspec route including an action item, the action item including a first address;

[0009] Based on the first address, check if there exists a first hash node that matches the first address;

[0010] If the first hash node exists, compare whether the first AS value of the second network device is the same as the second AS value stored in the first hash node;

[0011] If the first AS value is the same as the second AS value, then the first Flowspec route is activated.

[0012] If the first AS value is different from the second AS value, then the first Flowspec route is invalidated.

[0013] Secondly, this application provides another communication method, which is applied to a second service thread, the second service thread being located within a first network device, the first network device further comprising the first service thread, the method comprising:

[0014] Receive a validity check message sent by the first business thread, the validity check message including a first address;

[0015] Based on the first address, check if there exists a first hash node that matches the first address;

[0016] If the first hash node exists, a first notification message is sent to the first business thread. The first notification message includes the first address and the first AS value stored in the first hash node, so that the first business thread can determine whether the first Flowspec route is effective or ineffective based on the first AS value.

[0017] Thirdly, this application provides a communication device, which is applied to a first service thread, and the device includes:

[0018] A receiving unit is configured to receive a first Flowspec route sent by a second network device, wherein the first Flowspec route includes an action item, and the action item includes a first address.

[0019] The lookup unit is used to search for whether a first hash node matching the first address exists, based on the first address.

[0020] The comparison unit is used to compare whether the first AS value of the second network device is the same as the second AS value stored in the first hash node if the first hash node exists.

[0021] The first processing unit is configured to apply the first Flowspec route to the active status if the first AS value is the same as the second AS value.

[0022] The second processing unit is used to perform failure processing on the first Flowspec route if the first AS value is different from the second AS value.

[0023] Fourthly, this application provides another communication device, which is applied to a second service thread, the second service thread being located within a first network device, the first network device further comprising the first service thread, the device comprising:

[0024] A receiving unit is configured to receive a validity check message sent by the first business thread, wherein the validity check message includes a first address;

[0025] The lookup unit is used to search for whether a first hash node matching the first address exists, based on the first address.

[0026] The sending unit is configured to send a first notification message to the first service thread if the first hash node exists. The first notification message includes the first address and the first AS value stored in the first hash node, so that the first service thread can determine whether the first Flowspec route is effective or ineffective based on the first AS value.

[0027] Fifthly, this application provides a network device including a processor and a machine-readable storage medium storing machine-executable instructions that can be executed by the processor, which in turn cause the processor to perform the method provided in the first aspect of this application.

[0028] In a sixth aspect, this application provides another network device, including a processor and a machine-readable storage medium storing machine-executable instructions that can be executed by the processor, which in turn causes the processor to perform the method provided in the second aspect of this application.

[0029] Therefore, by applying the communication method and apparatus provided in this application, the first service thread receives a first Flowspec route sent by the second network device. The first Flowspec route includes an action item, which includes a first address. Based on the first address, the first service thread searches for the existence of a first hash node that matches the first address. If a first hash node exists, the first service thread compares the first AS value of the second network device with the second AS value stored in the first hash node. If the first AS value and the second AS value are the same, the first service thread activates the first Flowspec route. If the first AS value and the second AS value are different, the first service thread deactivates the first Flowspec route.

[0030] Therefore, this application provides a cross-thread communication processing mechanism and storage structure, enabling cross-thread legality checks to be completed without locking. This solves the problem of reduced thread processing performance and response speed caused by locking Flowspec routes for cross-thread access. Attached Figure Description

[0031] Figure 1 A flowchart illustrating a communication method provided in an embodiment of this application;

[0032] Figure 2 A flowchart illustrating another communication method provided in an embodiment of this application;

[0033] Figure 3 A structural diagram of a communication device provided in an embodiment of this application;

[0034] Figure 4 A flowchart of another communication device provided in the embodiments of this application;

[0035] Figure 5 The network device hardware structure provided in the embodiments of this application. Detailed Implementation

[0036] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0037] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the corresponding listed items.

[0038] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0039] The following is a detailed description of a communication method provided by an embodiment of this application. See also... Figure 1 , Figure 1 This is a flowchart illustrating a communication method provided in an embodiment of this application. The method is applied to a first business thread. The communication method provided in this application may include the following steps.

[0040] Step 110: Receive a first Flowspec route sent by the second network device. The first Flowspec route includes an action item, and the action item includes a first address.

[0041] Specifically, the first network device and the second network device have established a BGP neighbor relationship. Through the BGP neighbor relationship, the first network device and the second network device advertise Flowspec routes to each other.

[0042] The second network device generates and sends a BGP route synchronization message to the first network device. This BGP route synchronization message includes a first Flowspec route. The first Flowspec route includes a match item and an action item. The match item may specifically include the destination address, source port, etc. The action item may specifically include dropping, rate limiting, redirecting to the next hop, etc.

[0043] In this embodiment, the example is described using the matching item as the destination address and the action item as the redirection next hop. That is, upon receiving a service packet that matches the destination address of the matching item, the service packet will be redirected to the next hop and forwarded through the outgoing interface corresponding to the redirection next hop. This action item includes a first address, which is the redirection next hop.

[0044] In this embodiment, the destination address and the next hop can both be IPv4 addresses or both be IPv6 addresses; or, the destination address is an IPv4 address and the next hop is an IPv6 address; or, the destination address is an IPv6 address and the next hop is an IPv4 address. This application does not restrict the address types of the destination address and the next hop.

[0045] After receiving a BGP route synchronization message through the first interface, the first network device transmits the message to the BGP module. Upon receiving the message, the BGP module retrieves the first Flowspec route and instructs the first service thread to learn it. After receiving the first Flowspec route, the first service thread retrieves the matching items and action items from it. The first service thread then obtains the first address from the action items.

[0046] Step 120: Based on the first address, check if there exists a first hash node that matches the first address;

[0047] Specifically, according to the description of step 110, after the first business thread obtains the first address, it searches locally for a first hash node that matches the first address.

[0048] If a first hash node exists, the first business thread executes step 130.

[0049] Optionally, in this embodiment of the application, after the first service thread obtains the first address, it also determines the VPN to which it belongs based on the first Flowspec route, and obtains the first VPN index of the VPN.

[0050] Based on the first address and the first VPN index, the first business thread searches for the existence of a first hash node that matches both the first address and the first VPN index locally.

[0051] If a first hash node exists, the first business thread executes step 130.

[0052] It is understood that the communication method provided in this application can support both public and private networks. When public networks are supported, the first business thread can directly perform matching through the first address; when private networks are supported, the first business thread first obtains the first VPN address and then performs matching.

[0053] Step 130: If the first hash node exists, compare whether the first AS value of the second network device is the same as the second AS value stored in the first hash node.

[0054] Specifically, according to the description of step 120, if a first hash node exists, the first service thread compares whether the first autonomous system (AS) value of the second network device is the same as the second AS value stored in the first hash node.

[0055] If the first AS value is the same as the second AS value, the first business thread executes step 140; if the first AS value is different from the second AS value, the first business thread executes step 150.

[0056] In this embodiment, the first AS value of the second network device is also the AS number of the second network device. This AS number is configured and stored locally by the first network device. The first service thread can obtain the AS number of the second network device through a configuration file. Specifically, the AS number of the second network device is stored in the aspath attribute of the first Flowspec route. When obtaining the AS number through the AS path attribute, the first service thread can use the leftmost AS number of this attribute as the AS number of the second network device.

[0057] Understandably, the ASpath attribute can store multiple AS numbers. The AS numbers are stored from right to left according to the order of the AS fields traversed during the Flowspec route forwarding process, with the leftmost AS number being the AS number of the last AS field traversed by the Flowspec route.

[0058] In this embodiment, the first business thread contains multiple first hash nodes. Each hash node stores a key and data. Specifically, the key is an address and a VPN index, or the key is an address and the data is an AS value. Additionally, each hash node includes a routing list storing received Flowspec routes. These Flowspec routes include public network Flowspec routes or private network Flowspec routes.

[0059] Step 140: If the first AS value is the same as the second AS value, then activate the first Flowspec route.

[0060] Specifically, according to the description of step 130, if the first AS value is the same as the second AS value, the first service thread determines that the first Flowspec route has passed the validity check. The first service thread will then set the first Flowspec route to take effect and distribute the first Flowspec route to the forwarding plane.

[0061] Step 150: If the first AS value is different from the second AS value, then the first Flowspec route is invalidated.

[0062] Specifically, according to the description of step 130, if the first AS value is different from the second AS value, the first service thread determines that the first Flowspec route has failed the validity check. The first service thread will then invalidate the first Flowspec route.

[0063] Therefore, by applying the communication method provided in this application, the first service thread receives a first Flowspec route sent by the second network device. The first Flowspec route includes an action item, which includes a first address. Based on the first address, the first service thread checks whether a first hash node matching the first address exists. If a first hash node exists, the first service thread compares the first AS value of the second network device with the second AS value stored in the first hash node. If the first AS value and the second AS value are the same, the first service thread activates the first Flowspec route. If the first AS value and the second AS value are different, the first service thread deactivates the first Flowspec route.

[0064] Therefore, this application provides a cross-thread communication processing mechanism and storage structure, enabling cross-thread legality checks to be completed without locking. This solves the problem of reduced thread processing performance and response speed caused by locking Flowspec routes for cross-thread access.

[0065] Optionally, in this embodiment of the application, the first hash node includes a first routing list. After the first service thread receives the first Flowspec route, it can first store the first Flowspec route in the first routing list, or it can store the first Flowspec route in the first routing list after obtaining the first address from the first Flowspec route.

[0066] Optionally, in this embodiment, the first service thread resides within a first network device, and the first network device further includes a second service thread. In the foregoing embodiments, when the first service thread searches for the existence of a first hash node that matches both the first address and the first VPN index locally, the process also includes a step where no first hash node exists.

[0067] Specifically, if the first hash node does not exist, the first business thread creates a second hash node, which stores a preset third AS value. For example, the third AS value is 0. The first business thread stores the first Flowspec route in the second route list included in the second hash node.

[0068] Understandably, since no matching hash node exists, the first business thread creates a matching hash node and then stores the Flowspec route in the route list included in the hash node.

[0069] The first business thread generates and sends a validity check message to the second business thread. This validity check message includes a first address (optionally, when private networks are supported, the validity check message also includes a first VPN index). After receiving the validity check message, the second business thread performs a validity check on the first address based on the first address (optionally, when private networks are supported, the second business thread performs a validity check based on the first address and the first VPN index).

[0070] It should be noted that the process of the second business thread performing a validity check on the first address will be described in detail in subsequent embodiments and will not be repeated here.

[0071] After the second business thread performs a validity check on the first address, it will generate and send a first notification message to the first business thread. The first notification message includes the first address and the fourth AS value (optionally, when private networks are supported, the first notification message also includes the first VPN index).

[0072] After receiving the first notification message, the first business thread retrieves the first address and the fourth AS value from it. Based on the first address, it determines the matching second hash node. (Optionally, when private networks are supported, the first business thread retrieves the first VPN index from the first notification message and determines the matching second hash node based on the first address and the first VPN index.)

[0073] The first business thread compares the third AS value with the fourth AS value. If the third AS value and the fourth AS value are the same, the first business thread determines that the first Flowspec route passes the validity check. The first business thread maintains the current state of the first Flowspec route.

[0074] Furthermore, the current state includes whether it is active or inactive; that is, the currently active first Flowspec route remains active, and the currently inactive first Flowspec route remains inactive. The first service thread forwards the active first Flowspec route to the forwarding plane; if the third AS value is different from the fourth AS value, the first service thread determines that the first Flowspec route has failed the validity check. The first service thread updates the third AS value to the fourth AS value and triggers the first address validity check again.

[0075] Furthermore, the first business thread sends a validity check message to the second business thread again and receives a first notification message from the second business thread, which includes a newly returned AS value. If the newly returned AS value is the same as the fourth AS value, the first business thread sets the first Flowspec route to active; if the newly returned AS value is different from the fourth AS value, the first business thread sets the first Flowspec route to inactive.

[0076] Optionally, in this embodiment of the application, the process of the first service thread processing the first Flowspec route after the second network device cancels the first Flowspec route is also included.

[0077] Specifically, the second network device generates and sends a BGP route revocation message to the first network device, the BGP route revocation message including the first Flowspec route.

[0078] After receiving a BGP route cancellation message through the first interface, the first network device transmits the message to the BGP module. Upon receiving the message, the BGP module retrieves the first Flowspec route and instructs the first service thread to cancel it.

[0079] After receiving the first Flowspec route, the first business thread determines that the first Flowspec route has been withdrawn and deletes the learned first Flowspec route from either the first routing list or the second routing list.

[0080] Understandably, when the first business thread deletes the first Flowspec route, it also uses the first address (optionally, when private networks are supported, the first address and the first VPN index) to find the matching first hash node or second hash node. The first business thread traverses the route list included in the corresponding hash node and deletes the first Flowspec route from it.

[0081] In this embodiment of the application, if the first Flowspec route is the last route in the first routing list or the second routing list, that is, after deleting the first Flowspec route in the first routing list or the second routing list, the first routing list is empty or the second routing list is empty, then the first business thread deletes the first hash node or the second hash node.

[0082] It is understandable that if the first Flowspec route is deleted from the first routing list or the second routing list, and the first routing list is not empty or the second routing list is not empty, then the first business thread retains the first hash node or the second hash node.

[0083] In this embodiment, when the first routing list or the second routing list is empty, the first service thread generates and sends a deletion message to the second service thread. This deletion message includes a first address (optionally, when private networks are supported, the deletion message also includes a first VPN index). Upon receiving the deletion message, the second service thread retrieves the first address. It then finds a matching hash node based on the first address and deletes the hash node. (Optionally, when private networks are supported, the second service thread retrieves the first VPN index from the deletion message, finds a matching hash node based on the first address and the first VPN index, and deletes the hash node.)

[0084] It should be noted that the process of the second business thread deleting the hash node will be described in detail in subsequent embodiments and will not be repeated here.

[0085] Optionally, in this embodiment, the process of the first service thread processing the first Flowspec route after the second network device updates the first Flowspec route is also included.

[0086] Specifically, the second network device generates and sends a BGP route update message to the first network device, the BGP route update message including the first Flowspec route.

[0087] After receiving a BGP route update message through the first interface, the first network device transmits the BGP route update message to the BGP module. Upon receiving the BGP route update message, the BGP module retrieves the first Flowspec route from it and instructs the first service thread to update the first Flowspec route.

[0088] In this embodiment of the application, the second network device updates the first address to the second address.

[0089] After receiving the first Flowspec route, the first business thread determines that the first address included in the first Flowspec route has been updated to the second address. The first business thread first deletes the learned first Flowspec route from either the first route list or the second route list, following the aforementioned process of deleting the first Flowspec route, and then sends a deletion message to the second business thread.

[0090] In this embodiment, since the previous first Flowspec route has been deleted, the first service thread will learn the updated first Flowspec route. The first service thread may repeatedly execute steps 110-150 in the aforementioned embodiment, store the updated first Flowspec route, and request the second service thread to perform a validity check, until it is determined that the updated first Flowspec route including the second address is effective or invalid.

[0091] The following describes in detail another communication method provided by an embodiment of this application. See also... Figure 2 , Figure 2 A flowchart illustrating another communication method provided in this application embodiment. This method is applied to a second business thread. The other communication method provided in this application embodiment may include the following steps.

[0092] Step 210: Receive a validity check message sent by the first business thread, wherein the validity check message includes a first address;

[0093] Specifically, as described in the foregoing embodiments, after the first business thread finds that no hash node matching the first address exists locally, the first business thread first creates a hash node and stores the first Flowspec route in the second route list included in the hash node. The third AS value included in the hash node is 0.

[0094] Then, the first business thread generates and sends a validity check message to the second business thread, which includes the first address.

[0095] After receiving the validity check message, the second business thread obtains the first address from it.

[0096] Optionally, when private networks are supported, after the first business thread finds a hash node that does not exist locally and matches both the first address and the first VPN index, the first business thread first creates a hash node and stores the first Flowspec route in the second route list included in that hash node. The third AS value included in this hash node is 0.

[0097] Then, the first business thread generates and sends a validity check message to the second business thread, which includes the first address and the first VPN index.

[0098] After receiving the validity check message, the second business thread retrieves the first address and the first VPN index from it.

[0099] Step 220: Based on the first address, check if there exists a first hash node that matches the first address;

[0100] Specifically, according to the description of step 210, after the second business thread obtains the first address, it also checks whether a first hash node matching the first address exists locally. This first hash node is the hash node in the second business thread and is different from the hash node in the first business thread.

[0101] If a first hash node exists, the second business thread executes step 230.

[0102] Optionally, when private networks are supported, according to the description in step 210, after the second business thread obtains the first address and the first VPN index, it also checks whether a first hash node exists locally that matches both the first address and the first VPN index. This first hash node is a hash node in the second business thread and is different from the hash node in the first business thread.

[0103] If a first hash node exists, the second business thread executes step 230.

[0104] In this embodiment, multiple first hash nodes also exist within the second service thread. Each hash node stores a key and data. Specifically, the key is an address and a VPN index, or the key is an address and the data is an AS value. Additionally, each hash node also includes a routing list that stores received BGP routes.

[0105] Step 230: If the first hash node exists, send a first notification message to the first business thread. The first notification message includes the first address and the first AS value stored in the first hash node, so that the first business thread can determine whether the first Flowspec route is effective or ineffective based on the first AS value.

[0106] Specifically, according to the description of step 220, if a first hash node exists, the second business thread obtains the first AS value stored in the first hash node. The second business thread generates and sends a first notification message to the first business thread, the first notification message including the first address and the first AS value.

[0107] After receiving the first notification message, the first business thread retrieves the first AS value from it. Based on the first AS value and the AS value stored in the local hash node, the first business thread determines whether the first Flowspec route is effective or ineffective. As described in the foregoing embodiments, the detailed process by which the first business thread determines whether the Flowspec route is effective or ineffective using the AS value included in the notification message and the AS value stored in the local hash node has been explained in detail and will not be repeated here.

[0108] Optionally, when private networks are supported, according to the description of step 220, if a first hash node exists, the second business thread obtains the first AS value stored in the first hash node. The second business thread generates and sends a first notification message to the first business thread, the first notification message including a first address, a first VPN index, and a first AS value.

[0109] After receiving the first notification message, the first business thread retrieves the first AS value from it. Based on the first AS value and the AS value stored in the local hash node, the first business thread determines whether the first Flowspec route is effective or ineffective. As described in the foregoing embodiments, the detailed process by which the first business thread determines whether the Flowspec route is effective or ineffective using the AS value included in the notification message and the AS value stored in the local hash node has been explained in detail and will not be repeated here.

[0110] Therefore, by applying the communication method provided in this application, the second business thread receives a validity check message sent by the first business thread, which includes a first address; based on the first address, the second business thread searches for whether there is a first hash node that matches the first address; if there is a first hash node, it sends a first notification message to the first business thread, which includes the first address and a first AS value stored in the first hash node, so that the first business thread can determine whether the first Flowspec route is effective or ineffective based on the first AS value.

[0111] Therefore, this application provides a cross-thread communication processing mechanism and storage structure, enabling cross-thread legality checks to be completed without locking. This solves the problem of reduced thread processing performance and response speed caused by locking Flowspec routes for cross-thread access.

[0112] Optionally, in this embodiment, when the second business thread checks whether a first hash node matching the first address exists locally, it also includes a process where the first hash node does not exist. (Optionally, when private networks are supported, when the second business thread checks whether a first hash node matching both the first address and the first VPN index exists locally, it also includes a process where the first hash node does not exist.)

[0113] Specifically, the first network device already stores a BGP routing table. When public networks are supported, the BGP routing table stores public network BGP unicast routes. (Optionally, when private networks are supported, the first VPN index indicates that a BGP routing table is already stored under the first VPN, and the BGP routing table stores private network BGP unicast routes under the first VPN.) If the first hash node does not exist, the second service process creates a second hash node, which includes a routing list.

[0114] Based on the first address, the second service thread searches the BGP routing table for a matching BGP route. If a matching BGP route exists, the second service thread sorts the at least one matching BGP route according to its mask value and stores the sorted route in a routing list. For example, the second service thread sorts the mask values ​​from largest to smallest and then stores the sorted route in the routing list.

[0115] The second service process retrieves the first BGP route from the routing list. It then attempts to obtain the second AS value included in that BGP route. If the second AS value is obtained, it stores it in the second hash node. That is, the AS value stored in the second hash node is the AS number included in the first BGP route.

[0116] In this embodiment, the second AS value is the leftmost AS value in the ASpath attribute included in the BGP route.

[0117] Understandably, the ASpath attribute can store multiple AS numbers. The AS numbers are stored from right to left according to the order of the AS fields traversed during the Flowspec route forwarding process, with the leftmost AS number being the AS number of the last AS field traversed by the Flowspec route.

[0118] The second service thread generates and sends a second notification message to the first service thread. This second notification message includes a first address and a second AS value (optionally, when private networks are supported, the second notification message also includes a first VPN index). Upon receiving the second notification message, the first service thread retrieves the first address and the second AS value from it (optionally, when private networks are supported, the first service thread retrieves the first VPN index from the second notification message). Based on the second AS value and the AS value stored in the local hash node, the first service thread determines whether the first Flowspec route is active or inactive. The detailed process of the first service thread determining whether the Flowspec route is active or inactive using the AS value included in the notification message and the AS value stored in the local hash node, as described in the foregoing embodiments, has been explained in detail and will not be repeated here.

[0119] Optionally, in this embodiment of the application, when the second service thread searches for whether there is a BGP route matching the first address, it also includes the process of not having a BGP route.

[0120] Specifically, if no matching BGP route exists, the second service thread stores the preset third AS value in the second hash node. For example, the third AS value is 0.

[0121] The second service thread generates and sends a third notification message to the first service thread. This third notification message includes a first address and a third AS value (optionally, when private networks are supported, the third notification message also includes a first VPN index). Upon receiving the third notification message, the first service thread retrieves the first address and the third AS value from it (optionally, when private networks are supported, the first service thread retrieves the first VPN index from the third notification message). Based on the third AS value and the AS value stored in the local hash node, the first service thread determines whether the first Flowspec route is active or inactive. The detailed process of the first service thread determining whether the Flowspec route is active or inactive using the AS value included in the notification message and the AS value stored in the local hash node, as described in the foregoing embodiments, has been explained in detail and will not be repeated here.

[0122] Optionally, in this embodiment of the application, the process of the second service process attempting to obtain the second AS value of the second network device also includes a process in which the second AS value is not obtained.

[0123] Specifically, if the second AS value is not obtained, the second business process stores the preset third AS value in the second hash node. For example, the third AS value is 0.

[0124] The second service thread generates and sends a fourth notification message to the first service thread. This fourth notification message includes a first address and a third AS value (optionally, when private networks are supported, the fourth notification message also includes a first VPN index). Upon receiving the fourth notification message, the first service thread retrieves the first address and the third AS value from it (optionally, when private networks are supported, the first service thread retrieves the first VPN index from the fourth notification message). Based on the third AS value and the AS value stored in the local hash node, the first service thread determines whether the first Flowspec route is active or inactive. The detailed process of the first service thread determining whether the Flowspec route is active or inactive using the AS value included in the notification message and the AS value stored in the local hash node, as described in the foregoing embodiments, has been explained in detail and will not be repeated here.

[0125] Optionally, in this embodiment of the application, the process of adjusting the BGP routes stored in the routing list by the second service thread when a newly learned BGP route is stored in the BGP routing table or when a stored BGP route changes.

[0126] Specifically, the first network device has a BGP routing table stored within it. When public networks are supported, the BGP routing table stores public network BGP unicast routes. (Optionally, when private networks are supported, the first VPN index indicates that a BGP routing table has been stored under the first VPN, and the BGP routing table stores private network BGP unicast routes under the first VPN.)

[0127] The BGP routing table stores at least one BGP route. The following explanation uses the first BGP route as an example. The first BGP route can be any route and includes the second address.

[0128] It should be noted that the second address mentioned above can also be the first address in the aforementioned embodiments, that is, the address for redirecting the next hop.

[0129] If the first BGP route is a newly learned route or an attribute update of the first BGP route (e.g., MED(cost) value, community attribute, extended community attribute, AS value), then the second service thread determines a third hash node that matches the second address locally, based on the second address. This third hash node includes the fourth AS value. (Optionally, when private networks are supported, the second service thread determines a third hash node that matches both the second address and the first VPN index locally, based on the second address and the first VPN index.)

[0130] In one implementation, if the newly learned first BGP route or the first BGP route after attribute update is the preferred route to the second address and the newly learned first BGP route or the first BGP route before attribute update is not stored in the route list included in the third hash node, then the second service thread stores the newly learned first BGP route or the first BGP route after attribute update in the route list according to the mask value.

[0131] If the newly learned first BGP route or the first BGP route with updated attributes is at the head of the routing list, the second service thread compares the fifth AS value included in the newly learned first BGP route or the first BGP route with the fourth AS value. If the fifth AS value is different from the fourth AS value, the second service thread updates the fourth AS value to the fifth AS value; if the fifth AS value is the same as the fourth AS value, the fourth AS value is retained.

[0132] The second service thread generates and sends a fifth notification message to the first service thread. This fifth notification message includes a second address and a fifth AS value (optionally, when private networks are supported, the fifth notification message also includes a first VPN index). Based on the fifth AS value and the AS value stored in the local hash node, the first service thread determines whether the first Flowspec route is effective or ineffective. The detailed process of the first service thread determining whether the Flowspec route is effective or ineffective based on the AS value included in the notification message and the AS value stored in the local hash node, as described in the foregoing embodiments, has been explained in detail and will not be repeated here.

[0133] Understandably, if the newly learned first BGP route or the first BGP route after attribute updates is not at the head of the routing list, the second business thread will not execute the process of comparing the fifth AS value with the fourth AS value.

[0134] In another implementation, if the newly learned first BGP route or the first BGP route after attribute update is the preferred route to the second address and the newly learned first BGP route or the first BGP route before attribute update is at the head of the routing list, then the second service thread compares the fifth AS value with the fourth AS value. If the fifth AS value is different from the fourth AS value, the second service thread updates the fourth AS value to the fifth AS value. If the fifth AS value is the same as the fourth AS value, then the fourth AS value is retained.

[0135] The second service thread generates and sends a sixth notification message to the first service thread. This sixth notification message includes a second address and a fifth AS value (optionally, when private networks are supported, the sixth notification message also includes a first VPN index). Based on the fifth AS value and the AS value stored in the local hash node, the first service thread determines whether the first Flowspec route is active or inactive. The detailed process of the first service thread determining whether the Flowspec route is active or inactive using the AS value included in the notification message and the AS value stored in the local hash node, as described in the foregoing embodiments, has been explained in detail and will not be repeated here.

[0136] It should be noted that both the first BGP route before and after the attribute update indicate a BGP route leading to the second address.

[0137] Understandably, if the newly learned first BGP route or the first BGP route after attribute updates is not at the head of the routing list, the second business thread will not execute the process of comparing the fifth AS value with the fourth AS value.

[0138] In another implementation, if the newly learned first BGP route or the first BGP route after attribute update is a non-preferred route to the second address and the newly learned first BGP route or the first BGP route before attribute update is not stored in the routing list, then the second service thread does not process the routing list.

[0139] In another implementation, if the newly learned first BGP route or the first BGP route after attribute update is a non-preferred route to the second address and the newly learned first BGP route or the first BGP route before attribute update is not at the first position in the routing list, then the second service thread deletes the newly learned first BGP route or the first BGP route before attribute update from the routing list and does not perform any other processing on the routing list.

[0140] In another implementation, if the newly learned first BGP route or the first BGP route after attribute update is a non-preferred route to the second address and the newly learned first BGP route or the first BGP route before attribute update is at the head of the routing list, then the second service thread deletes the newly learned first BGP route or the first BGP route before attribute update from the routing list.

[0141] The second service thread compares the sixth AS value of the third network device that sent the second BGP route with the fourth AS value. If the sixth AS value is different from the fourth AS value, the second service thread updates the fourth AS value to the sixth AS value. If the sixth AS value is the same as the fourth AS value, the fourth AS value is retained.

[0142] The second service thread generates and sends a seventh notification message to the first service thread. This seventh notification message includes a second address and a sixth AS value (optionally, when private networks are supported, the seventh notification message also includes a first VPN index). Based on the sixth AS value and the AS value stored in the local hash node, the first service thread determines whether the first Flowspec route is active or inactive. The detailed process of the first service thread determining whether the Flowspec route is active or inactive using the AS value included in the notification message and the AS value stored in the local hash node, as described in the foregoing embodiments, has been explained in detail and will not be repeated here.

[0143] It should be noted that the second BGP route is the BGP route that is currently at the top of the routing list after the newly learned first BGP route or the first BGP route before the attribute update is deleted.

[0144] It is understandable that if the newly learned first BGP route or the first BGP route before the attribute update is not at the first position in the routing list, the second business thread will not execute the process of deleting the newly learned first BGP route or the first BGP route before the attribute update from the routing list.

[0145] Optionally, in this embodiment of the application, the process of receiving a deletion message sent by the first business thread is also included.

[0146] Specifically, as can be seen from the foregoing embodiments, after deleting the local hash node, the first business thread generates and sends a deletion message to the second business thread, and the deletion message includes the first address.

[0147] After receiving the deletion message, the second business thread retrieves the first address from it. Based on the first address, it locates the first hash node locally. The second business thread then deletes the first hash node.

[0148] Optionally, when private networks are supported, after deleting the local hash node, the first business thread generates and sends a deletion message to the second business thread. The deletion message includes the first address and the first VPN index.

[0149] After receiving the deletion message, the second business thread retrieves the first address and the first VPN index. Based on the first address and the first VPN index, it locates the first hash node locally. The second business thread then deletes the first hash node.

[0150] Based on the same inventive concept, embodiments of this application also provide a communication device corresponding to the communication method. See also Figure 3 , Figure 3 A communication device provided in this application embodiment, the device being applied to a first service thread, the device comprising:

[0151] The receiving unit 310 is configured to receive a first Flowspec route sent by a second network device, wherein the first Flowspec route includes an action item, and the action item includes a first address.

[0152] The lookup unit 320 is used to look up whether there is a first hash node that matches the first address based on the first address;

[0153] The comparison unit 330 is used to compare whether the first AS value of the second network device is the same as the second AS value stored in the first hash node if the first hash node exists.

[0154] The first processing unit 340 is configured to apply the first Flowspec route to the active position if the first AS value is the same as the second AS value.

[0155] The second processing unit 350 is used to perform failure processing on the first Flowspec route if the first AS value is different from the second AS value.

[0156] Optionally, the device further includes:

[0157] The acquisition unit (not shown in the figure) is used to acquire the first VPN index of the VPN to which the first Flowspec route belongs;

[0158] The search unit 320 is specifically used to search for whether a first hash node exists that matches both the first address and the first VPN index.

[0159] Optionally, the first hash node includes a first routing list, and the device further includes:

[0160] A storage unit (not shown in the figure) is used to store the first Flowspec route in the first route list.

[0161] Optionally, the first service thread resides within a first network device, and the first network device further includes a second service thread. The apparatus also includes:

[0162] A creation unit (not shown in the figure) is used to create a second hash node if the first hash node does not exist, and the second hash node stores a preset third AS value.

[0163] The storage unit (not shown in the figure) is also used to store the first Flowspec route in the second route list included in the second hash node;

[0164] The device further includes: a sending unit (not shown in the figure), configured to send a validity check message to the second service thread, the validity check message including the first address, so that the second service thread performs a validity check on the first address;

[0165] The receiving unit 310 is further configured to receive a first notification message sent by the second service thread, the first notification message including the first address and the fourth AS value;

[0166] The comparison unit 330 is further configured to compare whether the third AS value and the fourth AS value are the same;

[0167] The first processing unit 340 is further configured to maintain the current state of the first Flowspec route if the third AS value is the same as the fourth AS value.

[0168] The second processing unit 350 is further configured to: if the third AS value is different from the fourth AS value, update the third AS value to the fourth AS value and trigger the first address validity check again; if the AS value fed back by the second service thread is the same as the fourth AS value, enable the first Flowspec route; if the AS value fed back by the second service thread is different from the fourth AS value, disable the first Flowspec route.

[0169] Optionally, the legitimacy check message further includes the first VPN index; the first notification message further includes the first VPN index.

[0170] Optionally, the device further includes:

[0171] The deletion unit (not shown in the figure) is used to delete the first Flowspec route from the first routing list or the second routing list if it is determined that the first Flowspec route has been withdrawn.

[0172] The deletion unit (not shown in the figure) is further configured to delete the first hash node or the second hash node if the first Flowspec routing list is empty or the second routing list is empty.

[0173] The sending unit (not shown in the figure) is further configured to send a deletion message to the second service thread, the deletion message including the first address, so that the second service thread can find a matching hash node based on the first address and delete the hash node.

[0174] Optionally, the deletion unit (not shown in the figure) is further configured to delete the first Flowspec route from the first routing list or the second routing list if the first address is updated to the second address;

[0175] The deletion unit (not shown in the figure) is further configured to delete the first hash node or the second hash node if the first Flowspec routing list is empty or the second routing list is empty.

[0176] The sending unit (not shown in the figure) is further configured to send a deletion message to the second service thread, the deletion message including the first address, so that the second service thread can find a matching hash node based on the first address and delete the hash node;

[0177] The lookup unit 320 is further configured to repeatedly execute the process of searching for the existence of a hash node matching the address, until the first processing unit 340 and the second processing unit 350 determine that the updated first Flowspec route, including the second address, is effective or ineffective; or,

[0178] The lookup unit 320 is further configured to repeatedly perform the process of searching for a hash node that matches both the address and the VPN index, until the first processing unit 340 and the second processing unit 350 determine that the updated first Flowspec route, including the second address, is effective or invalid.

[0179] Therefore, by applying the communication device provided in this application, the first service thread receives a first Flowspec route sent by the second network device. The first Flowspec route includes an action item, which includes a first address. Based on the first address, the first service thread checks whether a first hash node matching the first address exists. If a first hash node exists, the first service thread compares the first AS value of the second network device with the second AS value stored in the first hash node. If the first AS value and the second AS value are the same, the first service thread activates the first Flowspec route. If the first AS value and the second AS value are different, the first service thread deactivates the first Flowspec route.

[0180] Therefore, this application provides a cross-thread communication processing mechanism and storage structure, enabling cross-thread legality checks to be completed without locking. This solves the problem of reduced thread processing performance and response speed caused by locking Flowspec routes for cross-thread access.

[0181] Based on the same inventive concept, embodiments of this application also provide a communication device corresponding to the communication method. See also Figure 4 , Figure 4 Another communication device provided in this application embodiment is applied to a second service thread, the second service thread being located within a first network device, the first network device further comprising the first service thread, the device comprising:

[0182] The receiving unit 410 is configured to receive a legality check message sent by the first service thread, wherein the legality check message includes a first address;

[0183] The first lookup unit 420 is used to look up whether there is a first hash node that matches the first address based on the first address;

[0184] The sending unit 430 is configured to send a first notification message to the first service thread if the first hash node exists. The first notification message includes the first address and the first AS value stored in the first hash node, so that the first service thread can determine whether the first Flowspec route is effective or ineffective based on the first AS value.

[0185] Optionally, the legitimacy check message further includes a first VPN index; the first notification message further includes the first VPN index.

[0186] The first lookup unit 420 is specifically used to search for whether there is a first hash node that matches both the first address and the first VPN index, based on the first address and the first VPN index.

[0187] Optionally, the device further includes:

[0188] A creation unit (not shown in the figure) is used to create a second hash node if the first hash node does not exist. The second hash node includes a routing list.

[0189] The second lookup unit (not shown in the figure) is used to search the BGP routing table for a BGP route that matches the first address based on the first address.

[0190] The sorting unit (not shown in the figure) is used to sort at least one BGP route that matches the first address according to the size of the mask value if a matching BGP route exists, and store the sorted at least one BGP route in the route list.

[0191] A storage unit (not shown in the figure) is used to store the second AS value in the second hash node if the second AS value included in the BGP route at the head of the routing list is obtained.

[0192] The sending unit 430 is further configured to send a second notification message to the first service thread, the second notification message including the first address and the second AS value, so that the first service thread determines whether the first Flowspec route is effective or ineffective based on the second AS value.

[0193] The second AS value is the leftmost AS value in the aspath attribute included in the BGP route.

[0194] Optionally, the storage unit (not shown in the figure) is further used to store a preset third AS value in the second hash node if no matching BGP route exists.

[0195] The sending unit 430 is further configured to send a third notification message to the first service thread, the third notification message including the first address and the third AS value, so that the first service thread determines whether the first Flowspec route is effective or ineffective based on the third AS value.

[0196] Optionally, the storage unit (not shown in the figure) is further configured to store a preset third AS value in the second hash node if the second AS value is not obtained.

[0197] The sending unit 430 is further configured to send a fourth notification message to the first service thread, the fourth notification message including the first address and the third AS value, so that the first service thread determines whether the first Flowspec route is effective or ineffective based on the third AS value.

[0198] Optionally, the first VPN index indicates that a BGP routing table has been stored under the first VPN; the second notification message also includes the first VPN index; the third notification message also includes the first VPN index; and the fourth notification message also includes the first VPN index.

[0199] Optionally, the receiving unit 410 is further configured to receive a deletion message sent by the first service thread, the deletion message including the first address;

[0200] The device further includes a deletion unit (not shown in the figure) for deleting the first hash node based on the first address.

[0201] Optionally, the deletion message may also include the first VPN index;

[0202] The deletion unit (not shown in the figure) is specifically used to delete the first hash node based on the first address and the first VPN index.

[0203] Optionally, the first network device has a BGP routing table stored within it, the BGP routing table including a first BGP route, and the first BGP route including a second address; the device further includes:

[0204] The determining unit (not shown in the figure) is used to determine a third hash node that matches the second address locally based on the second address if the first BGP route is a newly learned route or the attribute of the first BGP route is updated. The third hash node includes a fourth AS value.

[0205] The sorting unit (not shown in the figure) is further configured to, if the newly learned first BGP route or the first BGP route after attribute update is the preferred route to the second address and the newly learned first BGP route or the first BGP route before attribute update is not stored in the route list included in the third hash node, then sort by mask value and store the newly learned first BGP route or the first BGP route after attribute update in the route list.

[0206] A comparison unit (not shown in the figure) is used to compare whether the fifth AS value included in the newly learned first BGP route or the first BGP route after attribute update is the same as the fourth AS value if the first BGP route after learning or the first BGP route after attribute update is at the head of the route chain.

[0207] An update unit (not shown in the figure) is used to update the fourth AS value to the fifth AS value if the fifth AS value is different from the fourth AS value.

[0208] The sending unit 430 is further configured to send a fifth notification message to the first service thread, the fifth notification message including the second address and the fifth AS value, so that the first service thread can determine whether the second Flowspec route is effective or ineffective based on the fifth AS value.

[0209] Optionally, the comparison unit (not shown in the figure) is further configured to compare whether the fifth AS value is the same as the fourth AS value if the newly learned first BGP route or the first BGP route after the attribute update is the preferred route to the second address and the newly learned first BGP route or the first BGP route before the attribute update is at the head of the route chain.

[0210] The update unit (not shown in the figure) is further configured to update the fourth AS value to the fifth AS value if the fifth AS value is different from the fourth AS value.

[0211] The sending unit 430 is further configured to send a sixth notification message to the first service thread, the sixth notification message including the second address and the fifth AS value, so that the first service thread can determine whether the second Flowspec route is effective or ineffective based on the fifth AS value.

[0212] Both the first BGP route before the attribute update and the first BGP route after the attribute update indicate a BGP route leading to the second address.

[0213] Optionally, the device further includes:

[0214] The processing unit (not shown in the figure) is configured to not process the routing list if the newly learned first BGP route or the first BGP route after the attribute update is a non-preferred route to the second address and the newly learned first BGP route or the first BGP route before the attribute update is not stored in the routing list.

[0215] Optionally, the deletion unit (not shown in the figure) is further configured to delete the newly learned first BGP route or the first BGP route before the attribute update from the routing list if the newly learned first BGP route or the first BGP route before the attribute update is a non-preferred route to the second address and the newly learned first BGP route or the first BGP route before the attribute update is not at the first position in the routing list.

[0216] Optionally, the deletion unit is further configured to delete the newly learned first BGP route or the first BGP route before the attribute update from the routing list if the first BGP route after the attribute update is a non-preferred route to the second address and the newly learned first BGP route or the first BGP route before the attribute update is at the head of the routing list.

[0217] The comparison unit (not shown in the figure) is also used to compare whether the sixth AS value of the third network device that sends the second BGP route is the same as the fourth AS value.

[0218] The update unit (not shown in the figure) is also used to update the fourth AS value to the sixth AS value if the sixth AS value is different from the fourth AS value.

[0219] The sending unit 430 is further configured to send a seventh notification message to the first service thread, the seventh notification message including the second address and the sixth AS value, so that the first service thread can determine whether the second Flowspec route is effective or ineffective based on the sixth AS value.

[0220] The second BGP route is the BGP route that is currently at the top of the routing list after the first BGP route is deleted.

[0221] Optionally, the first VPN index indicates that the BGP routing table has been stored under the first VPN, the BGP routing table includes the first BGP route, and the first BGP route includes the second address;

[0222] The fifth notification message also includes the first VPN index; the sixth notification message also includes the first VPN index; the seventh notification message also includes the first VPN index.

[0223] Therefore, by applying the communication method provided in this application, the second business thread receives a validity check message sent by the first business thread, which includes a first address; based on the first address, the second business thread searches for whether there is a first hash node that matches the first address; if there is a first hash node, it sends a first notification message to the first business thread, which includes the first address and a first AS value stored in the first hash node, so that the first business thread can determine whether the first Flowspec route is effective or ineffective based on the first AS value.

[0224] Therefore, this application provides a cross-thread communication processing mechanism and storage structure, enabling cross-thread legality checks to be completed without locking. This solves the problem of reduced thread processing performance and response speed caused by locking Flowspec routes for cross-thread access.

[0225] Based on the same inventive concept, embodiments of this application also provide a network device, such as... Figure 5 As shown, the system includes a processor 510, a transceiver 520, and a machine-readable storage medium 530. The machine-readable storage medium 530 stores machine-executable instructions that can be executed by the processor 510. The processor 510 is prompted by the machine-executable instructions to execute the communication method provided in the embodiments of this application. (The foregoing...) Figure 3 , Figure 4 The communication device shown can be used as follows: Figure 5 The hardware structure of the network device shown is implemented.

[0226] The aforementioned computer-readable storage medium 530 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the computer-readable storage medium 530 may also be at least one storage device located remotely from the aforementioned processor 510.

[0227] The processor 510 mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0228] In this embodiment, the processor 510 reads the machine-executable instructions stored in the machine-readable storage medium 530, and is prompted by the machine-executable instructions to enable the processor 510 itself and the transceiver 520 to execute the communication method described in the foregoing embodiment.

[0229] In addition, this application provides a machine-readable storage medium 530 that stores machine-executable instructions. When called and executed by the processor 510, the machine-executable instructions cause the processor 510 itself and the transceiver 520 to execute the communication method described in the aforementioned application.

[0230] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0231] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0232] For the embodiments of communication devices and machine-readable storage media, since the methods involved are basically similar to those of the aforementioned method embodiments, the description is relatively simple, and relevant details can be found in the descriptions of the method embodiments.

[0233] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A communication method, characterized in that, The method is applied to the first business thread, and the method includes: Receive a first Flowspec route sent by a second network device, the first Flowspec route including an action item, the action item including a first address; Based on the first address, check if there exists a first hash node that matches the first address; If the first hash node exists, compare whether the first AS value of the second network device is the same as the second AS value stored in the first hash node; If the first AS value is the same as the second AS value, then the first Flowspec route is activated. If the first AS value is different from the second AS value, then the first Flowspec route is invalidated. The first hash node includes a first routing list, and the method further includes: Store the first Flowspec route in the first route linked list; The first service thread resides within a first network device, and the first network device further includes a second service thread. The method further includes: If the first hash node does not exist, a second hash node is created, and the second hash node stores a preset third AS value; The first Flowspec route is stored in the second route list included in the second hash node; A validity check message is sent to the second business thread, the validity check message including the first address, so that the second business thread performs a validity check on the first address; Receive a first notification message sent by the second business thread, the first notification message including the first address and the fourth AS value; Compare whether the third AS value is the same as the fourth AS value; If the third AS value is the same as the fourth AS value, then the current state of the first Flowspec route is maintained; If the third AS value is different from the fourth AS value, the third AS value is updated to the fourth AS value, and the first address validity check is triggered again; if the AS value returned by the second service thread is the same as the fourth AS value, the first Flowspec route is activated; if the AS value returned by the second service thread is different from the fourth AS value, the first Flowspec route is deactivated.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the first VPN index of the VPN to which the first Flowspec route belongs; The process of checking whether a first hash node matches the first address specifically includes: Find if a first hash node exists that matches both the first address and the first VPN index.

3. The method according to claim 1, characterized in that, The legitimacy check message also includes a first VPN index; the first notification message also includes the first VPN index.

4. The method according to claim 1, characterized in that, The method further includes: If it is determined that the first Flowspec route has been withdrawn, then delete the first Flowspec route from either the first route list or the second route list; If the first routing list is empty or the second routing list is empty, then delete the first hash node or the second hash node; A deletion message is sent to the second business thread, the deletion message including the first address, so that the second business thread can find a matching hash node based on the first address and delete the hash node.

5. The method according to claim 1, characterized in that, The method further includes: If the first address is updated to the second address, then delete the first Flowspec route from either the first routing list or the second routing list; If the first routing list is empty or the second routing list is empty, then delete the first hash node or the second hash node; Send a deletion message to the second business thread, the deletion message including the first address, so that the second business thread can find a matching hash node based on the first address and delete the hash node; Repeat the process of searching for a hash node that matches the address until it is determined that the updated first Flowspec route including the second address is effective or ineffective; or, repeat the process of searching for a hash node that matches both the address and the VPN index until it is determined that the updated first Flowspec route including the second address is effective or ineffective.

6. The method according to any one of claims 4 or 5, characterized in that, The deletion message also includes a first VPN index, which is used to enable the second business thread to find a matching hash node based on the first address and the first VPN index, and then delete the hash node.

7. A communication method, characterized in that, The method is applied to a second service thread, which resides within a first network device. The first network device further includes the first service thread. The method comprises: Receive a validity check message sent by the first business thread, the validity check message including a first address; Based on the first address, check if there exists a first hash node that matches the first address; If the first hash node exists, a first notification message is sent to the first business thread. The first notification message includes the first address and the first AS value stored in the first hash node, so that the first business thread can determine whether the first Flowspec route is effective or ineffective based on the first AS value. The legality check message also includes a first VPN index; the first notification message also includes the first VPN index; The step of searching for whether a first hash node matching the first address exists based on the first address specifically includes: Based on the first address and the first VPN index, search for whether there exists a first hash node that matches both the first address and the first VPN index; The method further includes: If the first hash node does not exist, a second hash node is created, which includes a routing list; Based on the first address, check the BGP routing table to see if there is a BGP route that matches the first address; If a matching BGP route exists, at least one BGP route that matches the first address is sorted according to the size of the mask value, and the sorted at least one BGP route is stored in the route list. If the second AS value of the BGP route at the head of the routing list is obtained, then the second AS value is stored in the second hash node; Send a second notification message to the first business thread. The second notification message includes the first address and the second AS value, so that the first business thread can determine whether the first Flowspec route is effective or ineffective based on the second AS value. The second AS value is the leftmost AS value in the aspath attribute included in the BGP route.

8. The method according to claim 7, characterized in that, The method further includes: If no matching BGP route exists, the preset third AS value is stored in the second hash node; A third notification message is sent to the first service thread. The third notification message includes the first address and the third AS value, so that the first service thread can determine whether the first Flowspec route is effective or ineffective based on the third AS value.

9. The method according to claim 8, characterized in that, The method further includes: If the second AS value is not obtained, the preset third AS value is stored in the second hash node; A fourth notification message is sent to the first service thread. The fourth notification message includes the first address and the third AS value, so that the first service thread can determine whether the first Flowspec route is effective or ineffective based on the third AS value.

10. The method according to claim 9, characterized in that, The first VPN index indicates that a BGP routing table has been stored under the first VPN; the second notification message also includes the first VPN index; the third notification message also includes the first VPN index; the fourth notification message also includes the first VPN index.

11. The method according to claim 9, characterized in that, The method further includes: Receive a deletion message sent by the first business thread, the deletion message including the first address; Delete the first hash node based on the first address.

12. The method according to claim 11, characterized in that, The deletion message also includes the first VPN index; Deleting the first hash node based on the first address specifically includes: Delete the first hash node based on the first address and the first VPN index.

13. The method according to claim 9, characterized in that, The first network device has a BGP routing table stored within it, the BGP routing table including a first BGP route, and the first BGP route including a second address; the method further includes: If the first BGP route is a newly learned route or the attributes of the first BGP route are updated, then a third hash node matching the second address is determined locally based on the second address, and the third hash node includes a fourth AS value; If the newly learned first BGP route or the first BGP route after attribute update is the preferred route to the second address and the newly learned first BGP route or the first BGP route before attribute update is not stored in the route list included in the third hash node, then the newly learned first BGP route or the first BGP route after attribute update is stored in the route list according to the mask value. If the newly learned first BGP route or the first BGP route after attribute update is at the head of the route chain, then compare whether the fifth AS value included in the newly learned first BGP route or the first BGP route after attribute update is the same as the fourth AS value. If the fifth AS value is different from the fourth AS value, then the fourth AS value is updated to the fifth AS value; A fifth notification message is sent to the first service thread. The fifth notification message includes the second address and the fifth AS value, so that the first service thread can determine whether the second Flowspec route is effective or ineffective based on the fifth AS value.

14. The method according to claim 13, characterized in that, The method further includes: If the newly learned first BGP route or the first BGP route after the attribute update is the preferred route to the second address and the newly learned first BGP route or the first BGP route before the attribute update is at the head of the route chain, then compare whether the fifth AS value is the same as the fourth AS value. If the fifth AS value is different from the fourth AS value, then the fourth AS value is updated to the fifth AS value; A sixth notification message is sent to the first service thread. The sixth notification message includes the second address and the fifth AS value, so that the first service thread can determine whether the second Flowspec route is effective or ineffective based on the fifth AS value. Both the first BGP route before the attribute update and the first BGP route after the attribute update indicate a BGP route leading to the second address.

15. The method according to claim 13, characterized in that, The method further includes: If the newly learned first BGP route or the first BGP route after the attribute update is a non-preferred route to the second address and the newly learned first BGP route or the first BGP route before the attribute update is not stored in the routing list, then the routing list will not be processed.

16. The method according to claim 13, characterized in that, The method further includes: If the newly learned first BGP route or the first BGP route after the attribute update is a non-preferred route to the second address and the newly learned first BGP route or the first BGP route before the attribute update is not at the first position in the routing list, then the newly learned first BGP route or the first BGP route before the attribute update is deleted from the routing list.

17. The method according to claim 14, characterized in that, The method further includes: If the newly learned first BGP route or the first BGP route after the attribute update is a non-preferred route to the second address and the newly learned first BGP route or the first BGP route before the attribute update is at the head of the routing list, then the newly learned first BGP route or the first BGP route before the attribute update is deleted from the routing list. Compare the sixth AS value of the third network device that sent the second BGP route with the fourth AS value to see if they are the same; If the sixth AS value is different from the fourth AS value, then the fourth AS value is updated to the sixth AS value; A seventh notification message is sent to the first service thread. The seventh notification message includes the second address and the sixth AS value, so that the first service thread can determine whether the second Flowspec route is effective or ineffective based on the sixth AS value. The second BGP route is the BGP route that is currently at the top of the routing list after the first BGP route is deleted.

18. The method according to claim 17, characterized in that, The first VPN index indicates that the BGP routing table has been stored under the first VPN, the BGP routing table includes the first BGP route, and the first BGP route includes the second address; The fifth notification message also includes the first VPN index; the sixth notification message also includes the first VPN index; the seventh notification message also includes the first VPN index.

19. A communication device, characterized in that, The device is applied to the first business thread, and the device includes: A receiving unit is configured to receive a first Flowspec route sent by a second network device, wherein the first Flowspec route includes an action item, and the action item includes a first address. The lookup unit is used to search for whether a first hash node matching the first address exists, based on the first address. The comparison unit is used to compare whether the first AS value of the second network device is the same as the second AS value stored in the first hash node if the first hash node exists. The first processing unit is configured to apply the first Flowspec route to the active status if the first AS value is the same as the second AS value. The second processing unit is used to perform failure processing on the first Flowspec route if the first AS value is different from the second AS value. The first hash node includes a first routing list, and the device further includes: Storage unit, used to store the first Flowspec route in the first route linked list; The first service thread resides within the first network device, and the first network device further includes a second service thread. The device also includes: A creation unit is used to create a second hash node if the first hash node does not exist, and the second hash node stores a preset third AS value; The storage unit is further configured to store the first Flowspec route in the second route list included in the second hash node; The apparatus further includes: a sending unit, configured to send a validity check message to the second service thread, the validity check message including the first address, so that the second service thread performs a validity check on the first address; The receiving unit is also configured to receive a first notification message sent by the second service thread, the first notification message including the first address and the fourth AS value; The comparison unit is further configured to compare whether the third AS value and the fourth AS value are the same; The first processing unit is further configured to maintain the current state of the first Flowspec route if the third AS value is the same as the fourth AS value. The second processing unit is further configured to: if the third AS value is different from the fourth AS value, update the third AS value to the fourth AS value and trigger the first address validity check again; if the AS value returned by the second service thread is the same as the fourth AS value, enable the first Flowspec route; if the AS value returned by the second service thread is different from the fourth AS value, disable the first Flowspec route.

20. A communication device, characterized in that, The device is applied to a second service thread, the second service thread being located within a first network device, the first network device further comprising the first service thread, and the device comprising: A receiving unit is configured to receive a validity check message sent by the first business thread, wherein the validity check message includes a first address; The first search unit is used to search for whether there is a first hash node that matches the first address, based on the first address; The sending unit is configured to send a first notification message to the first service thread if the first hash node exists. The first notification message includes the first address and the first AS value stored in the first hash node, so that the first service thread can determine whether the first Flowspec route is effective or ineffective based on the first AS value. The legality check message also includes a first VPN index; the first notification message also includes the first VPN index; The first lookup unit is configured to search for whether there exists a first hash node that matches both the first address and the first VPN index, based on the first address and the first VPN index. The device further includes: A creation unit is used to create a second hash node if the first hash node does not exist, the second hash node including a routing list; The second lookup unit is used to look up whether there is a BGP route matching the first address in the BGP routing table based on the first address. The sorting unit is used to sort at least one BGP route that matches the first address according to the size of the mask value if a matching BGP route exists, and to store the sorted at least one BGP route in the route list. A storage unit is used to store the second AS value in the second hash node if the second AS value included in the BGP route at the head of the routing list is obtained. The sending unit is further configured to send a second notification message to the first service thread, the second notification message including the first address and the second AS value, so that the first service thread determines whether the first Flowspec route is effective or ineffective based on the second AS value. The second AS value is the leftmost AS value in the aspath attribute included in the BGP route.

Images