A method for verifying network range configuration content

Abstract

The present application discloses a method for verifying the configuration content of a network target range, which belongs to the technical field of network target ranges. The method abstracts device feedback information and customizes various rule verification functions, thereby solidifying the verification capability and reusing it among different devices. By dynamically inserting checkpoints in configuration commands, the verification function is used to implement real-time parsing of configuration commands fed back by the device. The function dynamically determines whether to continue to execute subsequent configuration commands based on the return value, thereby avoiding the spread of incorrect configurations while taking into account configuration flexibility.

Description

Technical Field

[0001] The present application belongs to the field of network target range technology, and in particular, relates to a method for verifying the configuration content of a network target range. Background Art

[0002] The network range is a platform that uses SDN and virtualization technology to simulate the real cyberspace environment and can support various research and verification experiments. The network environment simulated in the range includes multiple key elements such as terminals, switches, routers, and security equipment. Various elements need to be configured according to the actual networking conditions of the target network to achieve high-fidelity simulation of the target network.

[0003] After the user completes the instantiation of each element node in the network target range, it is necessary to configure the port connectivity, security policy, etc. of the device. After all necessary nodes are configured and verified, the target test network is successfully generated, and various scientific experiments can be carried out. The correctness and effectiveness of the configuration are the guarantee of the realism of the target experimental network.

[0004] The existing network range technology has the following drawbacks:

[0005] 1. The correctness of the configuration content depends on manual experience to confirm. This mode is prone to errors due to negligence in manual inspection, resulting in configuration failure. In addition, this mode cannot accumulate verification knowledge and reuse it between configurations of different devices.

[0006] 2. The post-configuration verification method relies on collecting specific configuration items from the device through dedicated protocols such as SNMP. The content that needs to be collected is tightly coupled with the configuration content actually executed by the user, and cannot be flexibly customized based on user input.

[0007] 3. If an error occurs during the configuration process, the system cannot parse the error information in real time and decide whether to stop the subsequent configuration work. If the subsequent configuration depends on the correctness of the previous configuration, not stopping the subsequent configuration will easily lead to the spread of errors. Summary of the invention

[0008] The purpose of this application is to provide a network target range configuration content verification method to overcome the defects of the prior art, aiming to solve the problems of low network target range verification efficiency, easy omissions, poor reusability, as well as post-verification existence and collection dependency loops, error propagation and other problems.

[0009] The purpose of this application is achieved through the following technical solutions:

[0010] A method for verifying network range configuration content, the method comprising:

[0011] Instantiate the devices in the network range, and execute the device configuration according to the preset configuration command, wherein the preset configuration command includes channel information and commands to be executed, and the commands to be executed include checkpoints and corresponding checkpoint functions;

[0012] Establishing a configuration command execution channel to the target device using the channel information;

[0013] Decomposing the commands to be executed according to the checkpoints, reading the commands one by one, and if the current command is a checkpoint function, integrating the commands from the command to the previous checkpoint into an instruction segment, and obtaining a configuration command set consisting of the instruction segment and the checkpoint function;

[0014] Execute the commands in the configuration command set one by one, and the execution method includes:

[0015] When executing the instruction segment, the instruction segment is filled with parameters, and after the filling is completed, it is sent to the device for execution through the execution channel;

[0016] When executing a checkpoint function, obtaining the execution feedback information of the instruction segment before the checkpoint function, and filling the input parameters of the checkpoint function;

[0017] Execute the instruction after filling. If the execution is successful, continue to execute the next instruction. If the execution fails, stop executing.

[0018] Furthermore, the checkpoint functions are uniformly named in a naming format that is perceptible to the program.

[0019] Furthermore, the channel information includes a protocol used by the channel and channel configuration parameters.

[0020] Further, the filling of input parameters to the checkpoint function includes:

[0021] The first parameter filling value of the function is fixed to the first filling value;

[0022] Starting from the second input parameter of the function, traverse backwards. If the parameter is expressed in placeholder format, fill it with the corresponding input value of the user; otherwise, fill it with the value defined by the user at the checkpoint.

[0023] Furthermore, the output of the checkpoint function is a string list of length 2, the first string represents the parsing result of the function, and the second string represents additional display information.

[0024] Furthermore, the input of the checkpoint function is a list of strings of variable length, the first string represents the feedback output of the device, and the subsequent strings include input content in a preset format.

[0025] Furthermore, the checkpoint function satisfies the syntax of the dynamic language.

[0026] Furthermore, the name of the checkpoint function is globally unique.

[0027] Furthermore, the preset format includes variables represented by fixed value strings and placeholder formats.

[0028] The beneficial effects of this application are:

[0029] (1) This application proposes a method for dynamically verifying configuration content based on device feedback. By dynamically inserting checkpoints in the configuration command, a verification function is used to implement real-time parsing of the configuration command fed back by the device. The function dynamically determines whether to continue to execute subsequent configuration commands based on the return value, thereby avoiding the spread of incorrect configuration while taking into account the flexibility of configuration.

[0030] (2) This application abstracts the device feedback information and customizes various rule verification functions, thereby solidifying the verification capability and reusing it among different devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a flowchart of a method for verifying content of a network range configuration according to an embodiment of the present application. DETAILED DESCRIPTION

[0032] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0033] Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of this application.

[0034] The existing network range technology has the following drawbacks:

[0035] 1. The correctness of the configuration content depends on manual experience to confirm. This mode is prone to errors due to negligence in manual inspection, resulting in configuration failure. In addition, this mode cannot accumulate verification knowledge and reuse it between configurations of different devices.

[0036] 2. The post-configuration verification method relies on collecting specific configuration items from the device through dedicated protocols such as SNMP. The content that needs to be collected is tightly coupled with the configuration content actually executed by the user, and cannot be flexibly customized based on user input.

[0037] 3. If an error occurs during the configuration process, the system cannot parse the error information in real time and decide whether to stop the subsequent configuration work. If the subsequent configuration depends on the correctness of the previous configuration, not stopping the subsequent configuration will easily lead to the spread of errors.

[0038] In order to solve the above technical problems, the following embodiments of a method for verifying content of a network target range configuration are proposed in the present application.

[0039] Reference Figure 1 ,like Figure 1 The figure is a flowchart of a method for verifying the configuration content of a network range in this embodiment, and the method specifically includes the following steps:

[0040] 1. For the configuration that needs to be verified in the command, add or reuse the existing verification function.

[0041] 2. Sort out the configuration commands required by the device and the execution channels of the configuration commands. For commands that require real-time verification, add a checkpoint function to the command. The checkpoint function needs to use a unified naming method that is perceptible to the program.

[0042] As an implementation method, the checkpoint function in this embodiment is named in the format of checkpoint_function(), where "checkpoint_" is a fixed naming format, and function corresponds to a specific check function name.

[0043] For the configuration channel required by the device, record the protocol used by the channel and its specific parameters (such as using ssh, telnet and other protocols. The ssh protocol requires a user name, password, and port parameters).

[0044] 3. After all devices in the shooting range scene are instantiated, traverse each device that needs to be configured and execute the device configuration one by one. For each device, the core parameters required for configuration execution are as follows: channel information A for configuration execution and command B to be executed.

[0045] 4. Use channel information A to establish a configuration command execution channel to the target device.

[0046] 5. Decompose the command B to be executed according to the checkpoints, read the command Ci one by one, and if the current command Ci starts with the checkpoint naming convention (such as checkpoint_), integrate the commands before Ci and until the last checkpoint into the instruction segment Si. The final configuration command is a set of specific instruction segments and check functions. The format example is as follows: S={S1,S2,function1,S3,function2,…}.

[0047] 6. Execute the commands in set S one by one. The execution method is as follows:

[0048] Fill the instruction segment Si with parameters, and after filling, send it to the device for execution using the channel established in step 4.

[0049] 7. If Si+1 is an instruction segment, repeat step 6, otherwise jump to step 8.

[0050] 8. If Si+1 is a verification function, the program blocks and reads the execution feedback information Fsi of the device about the instruction segment Si. After obtaining the feedback information Fsi of the device, the verification function input parameter is filled in. The filling method is as follows:

[0051] The first parameter of the function is filled with the value Fsi;

[0052] Starting from the second parameter of the function, traverse backwards. If the parameter is expressed in placeholder format (similar to ${VALUE}), fill it with the corresponding input value of the user; otherwise, fill it with the value defined by the user at the checkpoint.

[0053] 9. Execute the verification function after filling and obtain its return value X. If X represents success, repeat step 6 until all instruction segments and verification functions in S are executed; if X represents failure, stop the configuration of the set S and return the error information corresponding to X.

[0054] The rules for the validation function are as follows:

[0055] 1. The output of the function is a list of strings of length 2. The first string represents the parsing result of the function, where "0" represents correct and "1" represents error; the second string represents additional display information, such as the specific content of the error in the event of an error.

[0056] 2. The function input is a variable-length string list. The first string represents the feedback output of the device. The subsequent strings are user-defined inputs. The formats allowed for user-defined inputs are as follows:

[0057] 2.1. Fixed value string. When checking for errors, the error is usually checked by looking for keywords such as "invalid" or "error" in the device feedback.

[0058] 2.2. Variables represented by the ${VALUE} placeholder format, where the actual value of VALUE represents the configuration variable entered previously.

[0059] 3. The function conforms to the syntax of dynamic languages, including groovy, js, etc.

[0060] 4. The verification function name is globally unique.

[0061] 5. The function needs to handle exceptions by itself. When the framework catches an exception, it will be treated as a configuration failure.

[0062] This embodiment abstracts the configuration framework and the feedback information of the device, and solidifies the verification rules by means of a custom verification function, so that the verification rules can be reused between configuration commands of different devices. The solidified verification function only requires the user to enter a specific verification parameter value, which reduces the probability of introducing errors compared to manual verification.

[0063] This embodiment implements real-time parsing of configuration commands based on device feedback by dynamically inserting checkpoints in configuration commands, eliminating the need to collect specific configuration items and verify configuration content after configuration is completed.

[0064] After a configuration error is found, this embodiment dynamically determines whether to continue to execute subsequent configuration commands according to the return value parsed by the verification function, thereby avoiding the spread of incorrect configuration while taking into account configuration flexibility.

[0065] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for verifying the configuration content of a network range, characterized in that: The method comprises: Instantiate the devices in the network range, and execute the device configuration according to the preset configuration command, wherein the preset configuration command includes channel information and commands to be executed, and the commands to be executed include checkpoints and corresponding checkpoint functions; Establishing a configuration command execution channel to the target device using the channel information; Decomposing the commands to be executed according to the checkpoints, reading the commands one by one, and if the current command is a checkpoint function, integrating the commands from the command to the previous checkpoint into an instruction segment, and obtaining a configuration command set consisting of the instruction segment and the checkpoint function; Execute the commands in the configuration command set one by one, and the execution method includes: When executing the instruction segment, the instruction segment is filled with parameters, and after the filling is completed, it is sent to the device for execution through the execution channel; When executing a checkpoint function, obtaining the execution feedback information of the instruction segment before the checkpoint function, and filling the input parameters of the checkpoint function; Execute the instruction after filling. If the execution is successful, continue to execute the next instruction. If the execution fails, stop executing.

2. The network range configuration content verification method according to claim 1, characterized in that: The checkpoint functions are uniformly named in a naming format that is perceptible to the program.

3. The network range configuration content verification method according to claim 1, characterized in that: The channel information includes the protocol used by the channel and channel configuration parameters.

4. The network range configuration content verification method according to claim 1, characterized in that: The filling of input parameters to the checkpoint function comprises: The first parameter filling value of the function is fixed to the first filling value; Starting from the second input parameter of the function, traverse backwards. If the parameter is expressed in placeholder format, fill it with the corresponding input value of the user; otherwise, fill it with the value defined by the user at the checkpoint.

5. The network range configuration content verification method according to claim 1, characterized in that: The output of the checkpoint function is a string list of length 2, the first string represents the parsing result of the function, and the second string represents additional display information.

6. The network range configuration content verification method according to claim 5, characterized in that: The input of the checkpoint function is a list of strings of variable length, the first string represents the feedback output of the device, and the subsequent strings include input content in a preset format.

7. The network range configuration content verification method according to claim 1, characterized in that: The checkpoint function satisfies the syntax of the dynamic language.

8. The network range configuration content verification method according to claim 1, characterized in that: The name of the checkpoint function is globally unique.

9. The network range configuration content verification method according to claim 6, characterized in that: The preset format includes variables represented by fixed value strings and placeholder formats.

Images