Message forwarding method and device, network equipment and readable storage medium

Abstract

The invention relates to a data communication technology, and provides a message forwarding method and device, network equipment and a readable storage medium, the message forwarding method and device are applied to the network equipment, the network equipment comprises a switching chip, the switching chip is provided with a routing table and an access control list ACL, and the ACL comprises a category identifier CID in the switching chip and a set processing action. The method comprises the following steps: acquiring a to-be-forwarded message; determining a target forwarding table item matched with the IP address carried by the message to be forwarded from a plurality of routing table items of a routing table, wherein the target forwarding table item is pre-bound with a CID for identifying a security group to which the IP address belongs; and determining a processing action corresponding to the CID in the target forwarding table item from the ACL, and processing the message to be forwarded according to the processing action. According to the invention, waste of the CID is avoided, and the application processing action does not need to be modified after the IP address of the user is changed.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a message forwarding method, device, network equipment and readable storage medium. Background Art

[0002] In an enterprise network, in order to meet different network access requirements of users, different network access policies can be deployed for users on access devices. In traditional campus networks, controlling user network access rights is mainly achieved through NAC (Network Access Control) technology combined with VLAN (Virtual Local Area Network) and ACL (Access Control List) technology. These technical requirements:

[0003] 1. If the administrator wants to ensure that employees have consistent network permissions within the campus, he must require employees to access the network from a designated switch, VLAN, or network segment.

[0004] 2. The ACL used to control user access rights needs to be configured in advance by the administrator, and at least the destination IP address range that is prohibited or allowed to access must be configured. Therefore, under the premise that the IP address used by the user is not fixed, the ACL cannot be used to control when the source and destination of the traffic are both the user's host.

[0005] 3. The association between ACL and user is effective only on the authentication point device. Therefore, for non-authentication point devices, such as firewall devices deployed at the edge of the enterprise campus, policies must be configured based on IP addresses.

[0006] 4. VLAN and ACL need to be configured in advance on a large number of authentication point switches, which requires huge deployment and maintenance workload.

[0007] To solve the above problems in traditional campuses, business mobility technology was introduced. Business mobility can ensure that users get the same network access policy solution regardless of their location or IP address. Business mobility is a network policy implementation model that allows network administrators to define security policies based on user and device roles rather than fixed network locations. It uses centralized control to decouple user identities from network topology and IP addresses, so that user access control permissions can be flexibly defined.

[0008] By defining security groups, the source or destination of network traffic is described and organized in the form of groups, and users are associated with security groups. If the user's access information, such as IP address, changes, only the security group information needs to be updated, and the corresponding processing action association of the security group will not change. Compared with deploying network access policies for each user, the network control solution based on security groups can greatly reduce the workload of administrators.

[0009] Free mobility allows ACL rules to be planned based on security groups, which are not adjusted by changes in user access. You only need to dynamically update the user information of the security group. However, when applying specific ACL rules, they still need to be applied based on users. When there are many users, many ACL rules need to be set, but ACL resources in the switch are limited. The core of free mobility technology is to solve the flexibility and refinement of network access control, so there will inevitably be a large number of detailed ACL rules.

[0010] If ACL rules are applied based on security groups, it can be very concise and efficient, and the processing actions do not need to change dynamically. For the data forwarding plane implemented by software, ACL rules can be applied based on the security group name or security group ID by design. However, for switches, data forwarding is implemented through switching chips, and the interactive chip cannot apply ACL rules based on security groups. The security group is a logically defined concept and cannot be mapped to the chip logic.

[0011] The existing solution still needs to issue ACL rules based on the users in the security group. The same security group needs to configure ACL rules for each user in the security group. The processing actions of ACL rules are the same. When there are many users in the same security group, there will be many repeated ACL rules that need to be set, which wastes a lot of resources. Summary of the invention

[0012] The object of the present invention is to provide a message forwarding method, apparatus, network device and readable storage medium, which can map a security group to a CID, avoid the waste of CID caused by repeated processing actions set by users of the same security group, and there is no need to modify the processing action after the user IP address changes.

[0013] The embodiments of the present invention can be implemented as follows:

[0014] In a first aspect, the present invention provides a message forwarding method, which is applied to a network device, wherein the network device includes a switching chip, wherein the switching chip is equipped with a routing table and an access control list ACL, wherein the ACL includes a category identifier CID in the switching chip and a set processing action, wherein the method includes:

[0015] Get the message to be forwarded;

[0016] Determine, from a plurality of routing table entries in the routing table, a target forwarding table entry that matches the IP address carried by the message to be forwarded, wherein the target forwarding table entry is pre-bound with a CID that identifies the security group to which the IP address belongs;

[0017] Determine a processing action corresponding to the CID in the target forwarding entry from the ACL, and process the message to be forwarded according to the processing action.

[0018] In an optional implementation manner, before the step of obtaining the message to be forwarded, the method further includes:

[0019] Acquire a pre-configured security group table, the security group table including the IP address information of the user and the CID applied from the switching chip as the group identifier of the security group to which the user belongs;

[0020] Matching the IP address information with the routing table to determine a target routing table entry;

[0021] Bind a CID that identifies the security group to which the user belongs to the target routing table entry.

[0022] In an optional implementation manner, the step of matching the IP address information with the routing table to determine the target routing table entry includes:

[0023] Matching the IP address information with each of the routing table entries one by one;

[0024] If any of the routing table entries contains the IP address information, the routing table entry containing the IP address information is used as an exact matching routing table entry and the exact matching routing table entry is used as the target routing table entry;

[0025] If the exact matching routing table entry does not exist in the multiple routing table entries, the target routing table entry is determined according to the IP address information and the multiple routing table entries.

[0026] In an optional implementation manner, the IP address information is an IP address, and the step of determining the target routing table entry according to the IP address information and the multiple routing table entries includes:

[0027] If there is an interface capable of forwarding messages from the IP address in the multiple routing table entries, then after waiting for route learning, the routing table entry corresponding to the interface capable of forwarding messages from the IP address is used as the target routing table entry;

[0028] If there is a gateway address capable of forwarding messages from the IP address in the multiple routing table entries, the routing table entry corresponding to the gateway address capable of forwarding messages from the IP address is used as a reference routing table entry;

[0029] Injecting a newly added routing table entry into the routing table according to the reference routing table entry;

[0030] The newly added routing table entry is used as the target routing table entry.

[0031] In an optional implementation manner, the IP address information is an IP network segment, and the step of determining the target routing table entry according to the IP address information and the multiple routing table entries includes:

[0032] If the length of the IP network segment is less than the length of the longest mask in the multiple routing table entries, determining the target routing table entry from the multiple routing table entries according to the IP network segment;

[0033] If the length of the IP network segment is greater than the length of the longest mask in the multiple routing table entries, the routing table entry corresponding to the longest mask is used as a reference routing table entry;

[0034] Injecting a newly added routing table entry into the routing table according to the reference routing table entry;

[0035] The newly added routing table entry is used as the target routing table entry.

[0036] In an optional implementation manner, there are multiple target routing table entries, and the step of determining the target routing table entry from the multiple routing table entries according to the IP network segment includes:

[0037] Obtaining a routing prefix for each of the routing table entries;

[0038] Determine the network segment corresponding to each routing table entry according to the routing prefix of each routing table entry;

[0039] Each routing table entry containing the network segment in the IP network segment is used as a target routing table entry.

[0040] In an optional implementation manner, the step of injecting a newly added routing table entry into the routing table according to the reference routing table entry includes:

[0041] Generate new routing table entries;

[0042] Configure the target network address and the corresponding subnet mask of the newly added routing table entry according to the IP address information, and use the egress and next hop of the reference routing table entry as the egress and next hop of the newly added routing table entry respectively;

[0043] The newly configured routing table entry is updated into the routing table.

[0044] In a second aspect, the present invention provides a message forwarding device, applied to a network device, wherein the network device includes a switching chip, the switching chip is equipped with a routing table and an access control list ACL, the ACL includes a processing action set by a category identifier CID in the switching chip, and the device includes:

[0045] An acquisition module, used to acquire messages to be forwarded;

[0046] A determination module, used to determine a target forwarding table entry that matches the IP address carried by the message to be forwarded from a plurality of routing table entries in the routing table, wherein the target forwarding table entry is pre-bound with a CID that identifies the security group to which the IP address belongs;

[0047] The processing module is used to determine the processing action corresponding to the CID in the target forwarding table entry from the ACL, and process the message to be forwarded according to the processing action.

[0048] In a third aspect, the present invention provides a network device, comprising a processor and a memory, wherein the memory is used to store a program, and the processor is used to implement the message forwarding method described in any one of the aforementioned implementation modes when executing the program.

[0049] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the message forwarding method described in any one of the aforementioned embodiments.

[0050] Compared with the prior art, the present invention establishes a mapping between a security group and a CID, and binds the CID of the security group to which it belongs in advance in the routing table item of the routing table according to the IP address information in the routing table item. Therefore, when forwarding a message, the CID bound to it can be obtained while routing according to the IP address in the message to obtain the forwarding table item, and then the processing action in the ACL is determined according to the CID. There is no need to change the original forwarding logic of the switching chip, and the purpose of processing the message according to the configuration of the security group can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0052] Figure 1 This is a block diagram of an example network device provided in this embodiment.

[0053] Figure 2This is a flowchart of an example of the message forwarding method provided in this embodiment.

[0054] Figure 3 This is an example diagram of the message processing flow provided in this embodiment.

[0055] Figure 4 This is a block diagram of an example of a message forwarding device provided in this embodiment.

[0056] Icons: 10 - network device; 11 - processor; 12 - memory; 13 - bus; 14 - switching chip; 100 - message forwarding device; 110 - acquisition module; 120 - determination module; 130 - processing module; 140 - binding module. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0058] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0060] In the description of the present invention, it should be noted that if the terms "upper", "lower", "inside", "outside", etc. appear to indicate an orientation or position relationship, they are based on the orientation or position relationship shown in the accompanying drawings, or are the orientation or position relationship in which the product of the invention is usually placed when used. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0061] In addition, the terms “first”, “second”, etc., if used, are merely used to distinguish between the descriptions and should not be understood as indicating or implying relative importance.

[0062] It should be noted that, in the absence of conflict, the features in the embodiments of the present invention may be combined with each other.

[0063] Please refer to Figure 1 , Figure 1 This is an example block diagram of a network device provided in this embodiment. The network device 10 is used to execute the message forwarding method provided in this embodiment. Figure 1 In the embodiment, the network device 10 includes a processor 11, a memory 12, a bus 13 and a switching chip 14, and the processor 11, the memory 12 and the switching chip 14 are connected through the bus 13.

[0064] The processor 11 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the message forwarding method of the above embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor 11. The above-mentioned processor 11 can be a general-purpose processor, including CPU (Central Processing Unit), NP (Network Processor), etc.; it can also be DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Logic Gate Array) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. After receiving the execution instruction, the processor 11 executes the program to implement the message forwarding method of the above embodiment.

[0065] The memory 12 is used to store a program for implementing the message forwarding method. The program can be a software function module stored in the memory 12 in the form of software or firmware or solidified in the OS (Operating System) of the network device 10.

[0066] The bus 13 includes, but is not limited to, a PCIE (Peripheral Component Interconnect Express) bus.

[0067] The switching chip 14 is mainly used to realize the efficient transmission and routing selection of data packets between different network devices. The switching chip is installed with a routing table and a preset access control list ACL, which is used to control the in and out of network traffic of the network device. The ACL can filter data packets according to predefined matching rules, thereby realizing fine management and security control of network traffic. In this embodiment, the matching rules in the ACL are set according to the CID (Category ID, category identifier, a resource in the switching chip) in the switching chip. By applying for the CID from the switching chip, a CID is used as the group identifier of a security group, and corresponds to the security group one by one. For all member IPs (including IP addresses or IP network segments) under each security group, find the exact matching route that matches the member IP, and bind the exact matching route to the CID.

[0068] The network device 10 includes, but is not limited to, routers, switches, gateways, and the like.

[0069] based on Figure 1 This embodiment also provides an application in Figure 1 For the message forwarding method, please refer to Figure 2 , Figure 2 The example flow chart of the message forwarding method provided in this embodiment includes the following steps:

[0070] Step S101, obtaining a message to be forwarded.

[0071] Step S102: determining a target forwarding table entry that matches the IP address carried by the message to be forwarded from a plurality of routing table entries in the routing table, wherein the target forwarding table entry is pre-bound with a CID that identifies the security group to which the IP address belongs.

[0072] In this embodiment, the security group describes and organizes the source or destination of the traffic in the network in the form of a group, and the IP addresses or IP network segments belonging to the same security group share the same processing action. Table 1 is an example of a security group table:

[0073] Table 1

[0074] Security Group user 1 1.1.1.1 1 1.1.2.0 / 24 1 1.1.3.1 2 2.1.1.1 2 2.1.2.0 / 24

[0075] In Table 1, three users belong to security group 1 and two users belong to security group 2. The users have IP addresses, such as 1.1.1.1, 1.1.3.1, and 2.1.1.1, and IP network segments, such as 1.1.2.0 / 24 and 2.1.2.0 / 24. 1 and 2 are group identifiers of the security group and are mapped to the CID of the switch chip, so 1 and 2 belong to the CID.

[0076] In the ACL table, each ACL rule includes a security group as a matching item and a processing action set for the security group. Table 2 is an example of an ACL table:

[0077] Table 2

[0078] Security Group Processing Actions 1 Permit 2 Deny

[0079] In Table 2, for users matching security group 1 (ie, CID is 1), the processing action is to allow forwarding, and for users matching security group 2 (ie, CID is 2), the processing action is to prohibit forwarding.

[0080] In this embodiment, in order to enable the switching chip to apply ACL rules based on security groups, it is not necessary to issue ACL rules based on each user in the security group (which can be an IP address or an IP network segment), because one security group corresponds to one CID, the users of the security group are pre-bound to the CID corresponding to the security group in the switching chip through the routing table entry. In the switching chip, CID is an identifier used to flexibly specify a category. The same security group corresponds to one CID. The switching chip uses CID as a matching keyword to control the user to execute the corresponding processing action in the ACL.

[0081] In this embodiment, the IP address carried by the message to be forwarded includes a source IP address and a destination IP address. When the message to be forwarded is received, a route match is performed according to the destination IP address, and a CID identifying the security group to which the message belongs can be obtained. Since the processing action in the ACL is set based on the CID, the message to be forwarded can be processed according to the processing action corresponding to the security group through the CID.

[0082] In addition, when an RPF (Reverse Path Forwarding) check is required based on the source IP address to prevent routing loops and illegal data packet injection in the network, the source IP address is used as the destination IP address for routing matching and the CID of the security group to which it belongs can be obtained.

[0083] It should also be noted that for users who do not need processing action control, no security group will be configured for them, and the CID corresponding to the security group will not be bound to the matching routing table items. The messages of such users will follow the normal forwarding process of the existing technology.

[0084] Step S103: determine the processing action corresponding to the CID in the target forwarding table entry from the ACL, and process the message to be forwarded according to the processing action.

[0085] In this embodiment, in order to more clearly explain the process of message forwarding, please refer to Figure 3 , Figure 3This is an example diagram of the message processing flow provided in this embodiment. Figure 3 In the process, after the switching chip receives the message to be forwarded, it first performs routing selection for the destination address of the message according to the routing table, obtains the matching routing table item, and then obtains the CID bound to the routing table item. The switching chip then matches the ACL according to the CID, obtains the processing action of the message to be forwarded, and processes the message according to the processing action.

[0086] In this embodiment, in order to more clearly illustrate the difference between the use of CID by the switching chip using the method provided by this embodiment and using the prior art, please refer to Table 3, which is a comparative example diagram of the use of CID by the method provided by this embodiment and using the prior art:

[0087] Table 3

[0088] CID The method provided in this embodiment Prior art CID1 ACL rules for security group 1 1.1.1.1- ACL rules for security group 1 CID2 ACL rules for security group 2 1.1.2.0 / 24 - ACL rules for security group 1 CID3 1.1.3.1- ACL rules for security group 1 CID4 2.1.1.1- ACL rules for security group 2 CID5 2.1.2.0 / 24 - ACL rules for security group 2

[0089] In Table 3, the method provided in this embodiment only needs to allocate one CID for each security group, consuming a total of 2 CIDs, while the prior art needs to allocate one CID for each user, even though the users belong to the same security group, their processing actions are the same, consuming a total of 5 CIDs. In addition, when the user's IP address or IP network segment changes, the method provided in this embodiment does not need to re-modify the ACL rules, while the prior art needs to re-modify the ACL rules.

[0090] The above method provided in this embodiment establishes a mapping between a security group and a CID, and binds the CID corresponding to the security group to which the packet belongs in advance in the routing table entry according to the IP address in the routing table entry. Therefore, when forwarding a message, the CID bound to the message can be obtained while routing the forwarding table entry according to the IP address in the message, and then the processing action in the matching ACL is determined according to the CID. The purpose of processing the message according to the configuration of the security group can be achieved without changing the original forwarding logic of the switching chip.

[0091] In this embodiment, in order to obtain the corresponding CID through routing in time when forwarding the message, it is necessary to bind the CID corresponding to the user in the security group with the corresponding routing table item in advance, so that the corresponding CID can be obtained while routing. This embodiment also provides an implementation method for binding the CID corresponding to the security group and the routing table item:

[0092] First, obtain a pre-configured security group table, which includes the user's IP address information and the CID applied for from the switch chip as the group identifier of the security group to which the user belongs;

[0093] In this embodiment, the IP address information includes an IP address and an IP network segment. The IP address can clearly correspond to a specific device. The IP address can be 32 bits or 64 bits, and the IP network segment corresponds to an address range. There can be multiple IP addresses within the address range.

[0094] Secondly, match the IP address information with the routing table to determine the target routing table entry;

[0095] In this embodiment, the target routing table item is a routing table item that needs to be bound to a CID, which can be an existing routing table item in the routing table or a routing table item that needs to be newly added to the routing table. The target routing table item can be one or more, depending on the matching situation between the IP address information and the routing table.

[0096] Third, bind the CID that identifies the security group to which the user belongs to the target routing table entry.

[0097] In this embodiment, the IP address information may accurately match the routing table, that is, there is a routing table item including the IP address information in the routing table, or it may not accurately match the routing table. This embodiment provides an implementation method for determining the target routing table item according to a specific situation:

[0098] First, match the IP address information with each routing table entry one by one;

[0099] Secondly, if any routing table entry contains IP address information, the routing table entry containing the IP address information is used as an exact matching routing table entry and the exact matching routing table entry is used as a target routing table entry;

[0100] In this embodiment, if the IP address information is 1.1.1.1, the routing table entries in the routing table are as shown in Table 4:

[0101] Table 4

[0102] Target Network Subnet Mask Next hop interface Metrics 1.1.1.1 255.255.255.0 0.0.0.0 Eth0 1 10.0.0.0 255.0.0.0 2.2.2.2 Eth1 2

[0103] Then there is a routing table entry including IP address information in Table 4, that is, the first routing table entry in Table 1 is the target routing table entry.

[0104] Third, if there is no exact matching routing table entry among the multiple routing table entries, the target routing table entry is determined according to the IP address information and the multiple routing table entries.

[0105] In this embodiment, when there is no exact matching routing table entry, when the IP address information is an IP address and an IP network segment, the method of determining the target routing table entry is also different.

[0106] Method 1: IP address information is IP address

[0107] When the IP address information is an IP address, the matching conditions between the IP address and the routing table entry are different, and the method of determining the target routing table entry is also different. The matching conditions include at least two conditions:

[0108] Method 1, situation 1:

[0109] If there are interfaces that can forward packets from the IP address in multiple routing table entries, the routing table entry corresponding to the interface that can forward packets from the IP address will be used as the target routing table entry after waiting for route learning;

[0110] In this embodiment, if there is an interface that can forward messages from the IP address among multiple routing table entries, it means that the IP address matches the interface routing table entry. The interface routing table entry refers to the routing entries of the interfaces of the target network directly connected to the router. Such interface routing table entries are usually learned directly through the direct interface. At this time, after waiting for the route learning, the routing table entry corresponding to the interface that can forward messages from the IP address is used as the target routing table entry.

[0111] Method 1, situation 2:

[0112] If there is a gateway address that can forward messages from the IP address in multiple routing table entries, the routing table entry corresponding to the gateway address that can forward messages from the IP address is used as the reference routing table entry;

[0113] Inject new routing table entries into the routing table based on the reference routing table entries;

[0114] Use the newly added routing table entry as the target routing table entry.

[0115] In this embodiment, when the IP address does not belong to the local network, and the forwarded message needs to be sent to another network through the gateway, if no processing action is performed, the forwarded message will match the routing table item corresponding to the gateway address that can forward messages from the IP address, that is, the reference routing table item, and forward it according to the reference routing table item. However, in order to be able to process the message to be forwarded carrying the IP address according to the processing action of the security group to which it belongs, it is necessary to specially inject a new routing table item into the routing table.

[0116] In this embodiment, when injecting a newly added routing table entry, in order not to affect the normal forwarding of the message to be forwarded when the forwarding condition is met, it is necessary to correctly configure the newly added routing table entry according to the reference routing table entry. This embodiment provides an implementation method for injecting the newly added routing table entry into the routing table according to the reference routing table entry:

[0117] First, generate a new routing table entry;

[0118] Secondly, configure the target network address and corresponding subnet mask of the newly added routing table entry according to the IP address information, and use the egress and next hop of the reference routing table entry as the egress and next hop of the newly added routing table entry respectively;

[0119] In this embodiment, when the IP address information is a 32-bit IP address, the newly injected routing table entry is also 32 bits, and when the IP address information is a 64-bit IP address, the newly injected routing table entry is also 64 bits.

[0120] Finally, the configured route entry is updated to the routing table.

[0121] Method 2: IP address information is IP network segment

[0122] When the IP address information is an IP network segment, the size relationship between the length of the IP network segment and the length of the longest mask in the routing table entry is different, which means that the network range represented by the IP network segment is different from the minimum network range represented in the routing table entry. For example, the IP network segment is 24 bits, and the length of the longest mask in the routing table entry is 16 bits. For different size relationships, different methods provided in this embodiment are used to determine the target routing table entry:

[0123] Method 2, case 1:

[0124] If the length of the IP network segment is less than the length of the longest mask in multiple routing table entries, the target routing table entry is determined from the multiple routing table entries according to the IP network segment;

[0125] In this embodiment, the length of the IP network segment is less than the length of the longest mask in the multiple routing table entries. For example, the IP network segment is 24 bits, and there are only routing table entries in the routing table that are longer than the 24-bit mask length, which means that the network range represented by the IP network segment is greater than the network range represented by the routing table entry corresponding to the length of the longest mask in the routing table entry. At this time, it is necessary to determine the target routing table entry by using the reverse matching routing method, so that all routing table entries in the network range represented by the IP network segment in the multiple routing table entries are used as the target routing table entries. One implementation method is:

[0126] First, obtain the routing prefix of each routing table entry;

[0127] Secondly, determine the network segment corresponding to each routing table entry based on the routing prefix of each routing table entry;

[0128] Finally, each routing table entry whose network segment is contained in the IP network segment is used as a target routing table entry.

[0129] In this embodiment, for example, the target network in the routing table entry is: 2.1.2.0 / 24, which means that the network address is "2.1.2.0", the prefix length is 24, that is, the first 24 bits are the network part, and the remaining 8 bits are the host part. For example, the IP network segment is 2.2.0.0 / 16, and there are 2.2.1.0 / 24, 2.2.2.0 / 24, and 2.2.3.0 / 24 in the routing table entry, then these three routing table entries need to be used as a target routing table entry, and the CID corresponding to the IP network segment needs to be bound.

[0130] Method 2, situation 2:

[0131] If the length of the IP network segment is greater than the length of the longest mask among multiple routing table entries, the routing table entry corresponding to the longest mask is used as the reference routing table entry;

[0132] Inject new routing table entries into the routing table based on the reference routing table entries;

[0133] Use the newly added routing table entry as the target routing table entry.

[0134] In this embodiment, the length of the IP network segment is greater than the length of the longest mask in multiple routing table entries. For example, the route matched by the longest mask is 1.1.0.0 / 16, and the IP network segment is 1.1.1.0 / 24, that is, the IP network segment is 24 bits, and the route matched by the longest mask in the routing table entry is 1.1.0.0 / 16, that is, the length of the longest mask is 16 bits, which means that the network range represented by the IP network segment is smaller than the network range represented by the routing table entry corresponding to the length of the longest mask in the routing table entry. At this time, the routing table entry corresponding to the longest mask is used as the reference routing table entry, and the newly added routing table entry is injected into the routing table. If the IP network segment is 24 bits, the newly injected routing table entry is also 24 bits. The remaining processing methods have been described in Case 2 of Method 1 and will not be repeated here.

[0135] In order to execute the corresponding steps in the above embodiment and each possible implementation method, a method for implementing the message forwarding device 100 is given below. Figure 4 , Figure 4 The block diagram of the message forwarding device provided in this embodiment. It should be noted that the basic principle and technical effect of the message forwarding device 100 provided by the present invention are the same as those of the corresponding above-mentioned embodiments, which are not mentioned in this embodiment for the sake of brief description.

[0136] The message forwarding device 100 is applied to a network device, the network device includes a switching chip, the switching chip is installed with a routing table and an access control list ACL, the ACL includes a processing action set according to a category identifier CID in the switching chip, and the message forwarding device 100 includes an acquisition module 110, a determination module 120, a processing module 130 and a binding module 140.

[0137] An acquisition module 110 is used to acquire a message to be forwarded;

[0138] A determination module 120, configured to determine a target forwarding table entry that matches the IP address carried by the message to be forwarded from a plurality of routing table entries in the routing table, wherein the target forwarding table entry is pre-bound with a CID that identifies the security group to which the IP address belongs;

[0139] The processing module 130 is used to determine the processing action corresponding to the CID in the target forwarding table entry from the ACL, and process the message to be forwarded according to the processing action.

[0140] In an optional implementation, the binding module 140 is used to:

[0141] Obtain a pre-configured security group table, which includes the user's IP address information and the CID requested from the switch chip as the group identifier of the security group to which the user belongs;

[0142] Match the IP address information with the routing table to determine the target routing table entry;

[0143] Bind the CID that identifies the security group to which the user belongs to the target routing table entry.

[0144] In an optional implementation manner, the binding module 140 is specifically used to match the IP address information with the routing table to determine the target routing table entry:

[0145] Match the IP address information with each routing table entry one by one;

[0146] If any routing table entry contains IP address information, the routing table entry containing IP address information is used as an exact match routing table entry and the exact match routing table entry is used as the target routing table entry;

[0147] If there is no exact matching routing table entry among the multiple routing table entries, the target routing table entry is determined according to the IP address information and the multiple routing table entries.

[0148] In an optional implementation, the IP address information is an IP address, and the binding module 140 is further used to:

[0149] If there are interfaces that can forward packets from the IP address in multiple routing table entries, the routing table entry corresponding to the interface that can forward packets from the IP address will be used as the target routing table entry after waiting for route learning;

[0150] If there is a gateway address that can forward messages from the IP address in multiple routing table entries, the routing table entry corresponding to the gateway address that can forward messages from the IP address is used as the reference routing table entry;

[0151] Inject new routing table entries into the routing table based on the reference routing table entries;

[0152] Use the newly added routing table entry as the target routing table entry.

[0153] In an optional implementation, the IP address information is an IP network segment, and the binding module 140 is further used to:

[0154] If the length of the IP network segment is less than the length of the longest mask in multiple routing table entries, the target routing table entry is determined from the multiple routing table entries according to the IP network segment;

[0155] If the length of the IP network segment is greater than the length of the longest mask among multiple routing table entries, the routing table entry corresponding to the longest mask is used as the reference routing table entry;

[0156] Inject new routing table entries into the routing table based on the reference routing table entries;

[0157] Use the newly added routing table entry as the target routing table entry.

[0158] In an optional implementation, there are multiple target routing table entries, and the binding module 140 is further used to determine the target routing table entry from the multiple routing table entries according to the IP network segment:

[0159] Get the routing prefix of each routing table entry;

[0160] Determine the network segment corresponding to each routing table entry according to the routing prefix of each routing table entry;

[0161] Each routing table entry containing the network segment in the IP network segment is used as a target routing table entry.

[0162] In an optional implementation, the step of the binding module 140 injecting a newly added routing table entry into the routing table according to the reference routing table entry includes:

[0163] Generate new routing table entries;

[0164] Configure the target network address and corresponding subnet mask of the newly added routing table entry according to the IP address information, and use the egress and next hop of the reference routing table entry as the egress and next hop of the newly added routing table entry respectively;

[0165] Update the newly configured routing table entries to the routing table.

[0166] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the message forwarding method described in any one of the aforementioned implementations is implemented.

[0167] In summary, an embodiment of the present invention provides a message forwarding method, an apparatus, a network device and a readable storage medium, the method comprising: providing a message forwarding method, an apparatus, a network device and a readable storage medium, applied to a network device, the network device comprising a switching chip, the switching chip being installed with a routing table and an access control list ACL, the ACL comprising a processing action set according to a category identifier CID in the switching chip, the method comprising: obtaining a message to be forwarded; determining a target forwarding table entry that matches the IP address carried by the message to be forwarded from multiple routing table entries in the routing table, the target forwarding table entry being pre-bound with a CID that identifies the security group to which the IP address belongs; determining a processing action corresponding to the CID in the target forwarding table entry from the ACL, and processing the message to be forwarded according to the processing action. Compared with the prior art, this embodiment has at least the following advantages: (1) By establishing a mapping between a security group and a CID, the CID corresponding to the security group to which the security group belongs is bound in advance in the routing table entry of the routing table according to the IP address in the routing table entry. Therefore, when forwarding a message, the CID bound to the security group can be obtained while routing the message according to the IP address in the message. Then, the processing action in the corresponding ACL is determined according to the CID. Without changing the original forwarding logic of the switching chip, the purpose of processing the message according to the configuration of the security group can be achieved. (2) When the IP address information cannot accurately match the routing table entry, the CID corresponding to the security group to which the IP address information belongs is associated with the most reasonable routing table entry through route injection and reverse mask matching.

[0168] The above are only various embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A message forwarding method, characterized in that: Applied to a network device, the network device includes a switching chip, the switching chip is installed with a routing table and an access control list ACL, the ACL includes a category identifier CID in the switching chip and a set processing action, the method includes: Get the message to be forwarded; Determine, from a plurality of routing table entries in the routing table, a target forwarding table entry that matches the IP address carried by the message to be forwarded, wherein the target forwarding table entry is pre-bound with a CID that identifies the security group to which the IP address belongs; Determine a processing action corresponding to the CID in the target forwarding entry from the ACL, and process the message to be forwarded according to the processing action.

2. The method according to claim 1, characterized in that Before the step of obtaining the message to be forwarded, the method further includes: Acquire a pre-configured security group table, the security group table including the IP address information of the user and the CID applied from the switching chip as the group identifier of the security group to which the user belongs; Matching the IP address information with the routing table to determine a target routing table entry; Bind a CID that identifies the security group to which the user belongs to the target routing table entry.

3. The method according to claim 2, characterized in that The step of matching the IP address information with the routing table to determine the target routing table entry includes: Matching the IP address information with each of the routing table entries one by one; If any of the routing table entries contains the IP address information, the routing table entry containing the IP address information is used as an exact matching routing table entry and the exact matching routing table entry is used as the target routing table entry; If the exact matching routing table entry does not exist in the multiple routing table entries, the target routing table entry is determined according to the IP address information and the multiple routing table entries.

4. The method according to claim 3, characterized in that The IP address information is an IP address, and the step of determining the target routing table entry according to the IP address information and the multiple routing table entries includes: If there is an interface capable of forwarding messages from the IP address in the multiple routing table entries, then after waiting for route learning, the routing table entry corresponding to the interface capable of forwarding messages from the IP address is used as the target routing table entry; If there is a gateway address capable of forwarding messages from the IP address in the multiple routing table entries, the routing table entry corresponding to the gateway address capable of forwarding messages from the IP address is used as a reference routing table entry; Injecting a newly added routing table entry into the routing table according to the reference routing table entry; The newly added routing table entry is used as the target routing table entry.

5. The method according to claim 3, characterized in that: The IP address information is an IP network segment, and the step of determining the target routing table entry according to the IP address information and the multiple routing table entries includes: If the length of the IP network segment is less than the length of the longest mask in the multiple routing table entries, determining the target routing table entry from the multiple routing table entries according to the IP network segment; If the length of the IP network segment is greater than the length of the longest mask in the multiple routing table entries, the routing table entry corresponding to the longest mask is used as a reference routing table entry; Injecting a newly added routing table entry into the routing table according to the reference routing table entry; The newly added routing table entry is used as the target routing table entry.

6. The method according to claim 5, characterized in that There are multiple target routing table entries, and the step of determining the target routing table entry from the multiple routing table entries according to the IP network segment includes: Obtaining a routing prefix for each of the routing table entries; Determine the network segment corresponding to each routing table entry according to the routing prefix of each routing table entry; Each routing table entry containing the network segment in the IP network segment is used as a target routing table entry.

7. The method according to claim 4 or 5, characterized in that: The step of injecting a newly added routing table entry into the routing table according to the reference routing table entry comprises: Generate new routing table entries; Configure the target network address and the corresponding subnet mask of the newly added routing table entry according to the IP address information, and use the egress and next hop of the reference routing table entry as the egress and next hop of the newly added routing table entry respectively; The newly configured routing table entry is updated into the routing table.

8. A message forwarding device, characterized in that: Applied to a network device, the network device includes a switching chip, the switching chip is installed with a routing table and an access control list ACL, the ACL includes a category identifier CID in the switching chip and a set processing action, the device includes: An acquisition module, used to acquire messages to be forwarded; A determination module, used to determine a target forwarding table entry that matches the IP address carried by the message to be forwarded from a plurality of routing table entries in the routing table, wherein the target forwarding table entry is pre-bound with a CID that identifies the security group to which the IP address belongs; The processing module is used to determine the processing action corresponding to the CID in the target forwarding table entry from the ACL, and process the message to be forwarded according to the processing action.

9. A network device, characterized in that: It comprises a processor and a memory, wherein the memory is used to store a program, and the processor is used to implement the message forwarding method according to any one of claims 1 to 7 when executing the program.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the message forwarding method according to any one of claims 1 to 7 is implemented.

Images