Message processing device and method

Abstract

The invention provides a message processing device and method. The device comprises a VLAN (Virtual Local Area Network) label identification module, a VLAN label filtering module and a VLAN label insertion module, the VLAN label identification module is used for identifying an original message and outputting identification information; the identification information comprises VLAN tag carrying information in the original message, VLAN tag insertion position information in the original message and original inner and outer layer attributes of the carried VLAN tag; the VLAN label filtering module is used for filtering an original message according to pre-configured VLAN filtering configuration information and identification information; the filtering treatment comprises discarding, release after modification or direct release; and the VLAN label insertion module inserts a new VLAN label in an original message according to pre-configured VLAN insertion configuration information and the identification information. According to the invention, the efficiency of inserting the message into the VLAN is improved through hardware unloading.

Description

Technical Field

[0001] The present application belongs to the technical field of network chips, and in particular, relates to a message processing device and method. Background Art

[0002] VLAN (Virtual Local Area Network) refers to a virtual local area network, which is a technology that divides a physical local area network into multiple independent broadcast domains in a logical way. It allows network administrators to divide a physical local area network into multiple logical local area networks, and each VLAN is an independent broadcast domain. Through VLAN technology, a large network can be divided into multiple small local area networks, effectively controlling broadcast traffic, improving network security and performance, and at the same time improving network performance and flexibility. Summary of the invention

[0003] The purpose of the present application is to provide a message processing device and method, aiming to solve the technical problems such as low efficiency of software driver insertion of VLAN tags, easy errors and VLAN attacks when hardware inserts VLAN tags.

[0004] According to a first aspect of the present application, a message processing device is provided, comprising: a VLAN tag identification module, a VLAN tag filtering module and a VLAN tag insertion module; wherein:

[0005] The VLAN tag identification module is used to identify the original message and output identification information; the identification information includes the VLAN tag carrying information in the original message, the VLAN tag insertion position information in the original message, and the original inner and outer layer attributes of the carried VLAN tag;

[0006] The VLAN tag filtering module is used to filter the original message according to the pre-configured VLAN filtering configuration information and identification information; the filtering process includes discarding, releasing after modification or directly releasing;

[0007] The VLAN tag insertion module inserts a new VLAN tag into the original message according to the pre-configured VLAN insertion configuration information and the identification information.

[0008] In an alternative embodiment,

[0009] If a layer 2 message is embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the layer 2 message; if a layer 2 message is not embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the original message;

[0010] If the VLAN tag is not identified, the VLAN tag identification module determines that the VLAN tag carrying information is not carried, and the VLAN tag insertion position information is unlimited;

[0011] If a VLAN tag is identified and the carried VLAN tag is of a first set type, the VLAN tag identification module determines that the VLAN tag insertion position information is unlimited;

[0012] If a VLAN tag is identified, and the carried VLAN tag is of the second set type, the VLAN tag identification module determines whether the inner layer of the VLAN tag of the second set type also carries an inner VLAN tag; if it carries an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are double layers; if it does not carry an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are outer layers;

[0013] If a VLAN tag is identified, and the carried VLAN tag is not of the first set type and the second set type, the VLAN tag identification module determines that the VLAN tag carries no information.

[0014] In an optional implementation, the VLAN filtering configuration information includes a filtering mode corresponding to a VLAN filtering level; the VLAN tag filtering module identifies the VLAN filtering level to which the original message belongs, and determines the filtering mode corresponding to the original message based on the VLAN filtering configuration information and the VLAN filtering level to which the original message belongs;

[0015] If the filtering mode corresponding to the original message is the accept mode, the filtering processing performed by the VLAN tag filtering module on the original message is to directly release the message;

[0016] If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries the information of carrying, the filtering processing performed by the VLAN tag filtering module on the original message is to replace the setting field in the VLAN tag carried by the original message with the configuration content corresponding to the replacement mode before releasing it;

[0017] If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries no information, the VLAN tag filtering module performs filtering processing on the original message as direct release;

[0018] If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carrying information is carried, the filtering processing performed by the VLAN tag filtering module on the original message is directly released;

[0019] If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carries no information, the filtering process performed by the VLAN tag filtering module on the original message is discarding;

[0020] If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carrying information is carrying, the filtering processing performed by the VLAN tag filtering module on the original message is discarding;

[0021] If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carries no information, the filtering process performed by the VLAN tag filtering module on the original message is to directly release the message.

[0022] In an optional implementation, if the VLAN tag insertion position information in the identification information is at a layer 2 message, the VLAN tag insertion module offsets the set insertion position corresponding to the new VLAN tag by a set length corresponding to the layer 2 message;

[0023] If the VLAN tag insertion position information in the identification information is unlimited or the VLAN tag carrying information is not carried, the VLAN tag insertion module inserts the new VLAN tag at the set insertion position in the order of outer layer first and inner layer later;

[0024] If the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information.

[0025] In an optional implementation manner, the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, then if the original inner and outer layer attributes are inner layers, and the new inner and outer layer attributes are not supporting only a single-layer VLAN, then the VLAN tag insertion module inserts the new VLAN tag in the outer layer of the original message;

[0026] If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting VLANs above layer 2, the VLAN tag insertion module inserts the new VLAN tag into the inner layer or outer layer of the original message;

[0027] If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the inner layer of the original message;

[0028] If the original inner and outer layer attributes are double layers, and the new inner and outer layer attributes are neither supporting only single-layer VLAN nor supporting only double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the outer layer of the original message.

[0029] In an optional implementation, the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, then if the original inner and outer layer attributes are inner layer or outer layer, and the new inner and outer layer attributes are only supporting single-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message, and if the original inner and outer layer attributes are double layers, and the new inner and outer layer attributes are only supporting single-layer VLAN or only supporting double-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message.

[0030] According to a second aspect of the present application, a message processing method is provided, including:

[0031] The VLAN tag identification module identifies the original message and outputs identification information; the identification information includes the VLAN tag carrying information in the original message, the VLAN tag insertion position information in the original message, and the original inner and outer layer attributes of the carried VLAN tag;

[0032] The VLAN tag filtering module filters the original message according to the pre-configured VLAN filtering configuration information and the identification information; the filtering process includes discarding, releasing after modification, or directly releasing;

[0033] The VLAN tag inserting module inserts a new VLAN tag into the original message according to the pre-configured VLAN insertion configuration information and the identification information.

[0034] In an optional implementation manner, the VLAN tag identification module identifies the original message and outputs identification information, including:

[0035] If a layer 2 message is embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the layer 2 message; if a layer 2 message is not embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the original message;

[0036] If the VLAN tag is not identified, the VLAN tag identification module determines that the VLAN tag carrying information is not carried, and the VLAN tag insertion position information is unlimited;

[0037] If a VLAN tag is identified and the carried VLAN tag is of a first set type, the VLAN tag identification module determines that the VLAN tag insertion position information is unlimited;

[0038] If a VLAN tag is identified, and the carried VLAN tag is of the second set type, the VLAN tag identification module determines whether the inner layer of the VLAN tag of the second set type also carries an inner VLAN tag; if it carries an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are double layers; if it does not carry an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are outer layers;

[0039] If a VLAN tag is identified, and the carried VLAN tag is not of the first set type and the second set type, the VLAN tag identification module determines that the VLAN tag carries no information.

[0040] In an optional implementation, the VLAN filtering configuration information includes a filtering mode corresponding to a VLAN filtering level; the VLAN tag filtering module performs filtering processing on the original message according to the pre-configured VLAN filtering configuration information and the identification information, including:

[0041] The VLAN tag filtering module identifies the VLAN filtering level to which the original message belongs, and determines a filtering mode corresponding to the original message based on the VLAN filtering configuration information and the VLAN filtering level to which the original message belongs;

[0042] If the filtering mode corresponding to the original message is the accept mode, the VLAN tag filtering module directly releases the original message through filtering;

[0043] If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries information, the VLAN tag filtering module performs filtering processing on the original message by first replacing the setting field in the VLAN tag carried by the original message with the configuration content corresponding to the replacement mode and then releasing the message;

[0044] If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries no information, the VLAN tag filtering module directly releases the original message through filtering;

[0045] If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carrying information is carried, the VLAN tag filtering module performs filtering processing on the original message to directly release the message;

[0046] If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carries no information, the VLAN tag filtering module performs a filtering process of discarding the original message;

[0047] If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carrying information is carrying, the VLAN tag filtering module performs a discard filtering process on the original message;

[0048] If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carries no information, the VLAN tag filtering module performs filtering processing to directly release the original message.

[0049] In an optional implementation manner, the VLAN tag insertion module inserts a new VLAN tag into the original message according to pre-configured VLAN insertion configuration information and the identification information, including:

[0050] If the VLAN tag insertion position information in the identification information is at the layer 2 message, the VLAN tag insertion module offsets the set insertion position corresponding to the new VLAN tag by the set length corresponding to the layer 2 message;

[0051] If the VLAN tag insertion position information in the identification information is unlimited or the VLAN tag carrying information is not carried, the VLAN tag insertion module inserts the new VLAN tag at the set insertion position in the order of outer layer first and inner layer later;

[0052] If the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information.

[0053] In an optional implementation manner, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information, including:

[0054] If the original inner and outer layer attributes are inner layers, and the new inner and outer layer attributes are not to support only a single-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the outer layer of the original message;

[0055] If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting VLANs above layer 2, the VLAN tag insertion module inserts the new VLAN tag into the inner layer or outer layer of the original message;

[0056] If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the inner layer of the original message;

[0057] If the original inner and outer layer attributes are double layers, and the new inner and outer layer attributes are neither supporting only single-layer VLAN nor supporting only double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the outer layer of the original message.

[0058] In an optional implementation manner, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information, further comprising:

[0059] If the original inner and outer layer attributes are inner or outer, and the new inner and outer layer attributes are to support only single-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message; and if the original inner and outer layer attributes are double-layer, and the new inner and outer layer attributes are to support only single-layer VLAN or only double-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message.

[0060] Compared with the related art, the technical solution of this application has the following advantages:

[0061] 1. Compared with the method of inserting VLAN tags by software, this application can effectively improve the efficiency of inserting VLAN tags into messages through hardware unloading. When there are multiple queues in the system, the efficiency of hardware inserting VLAN tags is improved more, and the resources for software to calculate and manage VLAN tags can be released. In the related art, the hardware directly inserts the VLAN tag after the MAC source address of the L2 message header. This method does not consider the outer and inner attributes of the VLAN tag, which will cause the order of the tags in the L2 message header to be wrong. This application can ensure the correctness of VLAN insertion by accurately identifying the tag type of the VLAN tag and the insertion position of the VLAN tag.

[0062] 2. Through the automatic identification of VLAN tag types by hardware, the hardware can filter out untrusted VLAN tags or directly discard messages. This approach can solve the problems of virtual machine VLAN attacks and VLAN priority traffic preemption, and improve the security and robustness of the entire system.

[0063] 3. The hardware filtering VLAN level is highly flexible, and filtering configurations of different granularities can be selected through software configuration; the hardware VLAN filtering mode can be flexibly configured, and different VLAN filtering methods can be selected according to different business types, increasing the software's control over hardware and reducing the software's resource consumption for VLAN tag management.

[0064] 4. The hardware insertion method of VLAN tags is flexible, supporting the insertion of different types of VLAN tags, supporting double-layer / multi-layer VLAN tag insertion, and supporting the insertion management of VLAN tags at different levels.

[0065] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained through the structures and processes indicated in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. It is obvious that the drawings described below are certain embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0067] Figure 1 It is a schematic diagram of the Ethernet frame format carrying VLAN tags according to the related art.

[0068] Figure 2 It is a structural diagram of a message processing device according to an exemplary embodiment of the present application.

[0069] Figure 3 It is a schematic diagram of software configuration information according to an exemplary embodiment of the present application.

[0070] Figure 4 It is a schematic diagram of the identification process of the VLAN tag identification module according to an exemplary embodiment of the present application.

[0071] Figure 5 It is a filtering flow diagram of a VLAN tag filtering module according to an exemplary embodiment of the present application.

[0072] Figure 6 It is a schematic diagram of the insertion process of the VLAN tag insertion module according to an exemplary embodiment of the present application.

[0073] Figure 7 It is a flowchart of a message processing method according to an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0074] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0075] The working principle of VLAN is to achieve logical segmentation at the data link layer, and to distinguish data packets of different VLANs by adding VLAN tags (as defined by the IEEE 802.1Q standard) to Ethernet frames. The VLAN frame format is as follows: Figure 1 As shown in the figure, the first fields are the MAC destination address and the MAC source address, followed by the VLAN tag. Figure 1 Shown is a VLAN tag of type 802.1QTag.

[0076] With the development of VLAN technology, in order to divide more local area networks, Ethernet in the related technology supports double-layer VLAN or even multi-layer VLAN network frame formats. At the same time, with the development of network hardware, network cards can now support multiple queues (such as 2K, 4K, 8K and 16K) to send messages and insert VLAN tags at the same time. There are two ways to implement VLAN technology in the related technology: 1. The upper-layer software directly inserts VLAN tags into the message; 2. The software driver controls the hardware to insert VLAN tags into the message (this method can be called hardware unloading). After investigation, the inventor of the present application learned that generally old graphics cards only support software insertion of VLAN tags, and only new or medium and high-performance network cards support hardware insertion of VLAN tags.

[0077] In addition, because existing network cards can support multiple queues (such as 2K, 4K, 8K and 16K) to send messages, different queues are generally open to upper-layer software or virtual machines to send messages. Since upper-layer software or virtual machines may send unreliable data, there are problems such as VLAN attacks when the system is running. Therefore, the host needs to identify and filter messages carrying problematic VLAN tags. This process is generally implemented by software. However, most network card hardware does not support the VLAN identification and filtering function.

[0078] In summary, the related technologies have the following problems:

[0079] 1. The efficiency of software inserting VLAN tags is low. As the types of VLAN tags to be inserted increase, the number of queues supported by network cards increases, and the software needs to consume a lot of resources to insert and manage VLAN tags in original messages.

[0080] 2. The accuracy of hardware insertion of VLAN tags is low. In the related technology, most network cards that support hardware VLAN tag insertion do not have the ability to accurately identify VLAN tags and correctly insert VLAN tags. Generally, network cards directly insert VLAN tags after the MAC source address (Source Address) in the link layer (L2) message header. This method does not consider the outer and inner attributes of the VLAN tag, which will cause the VLAN tags to be placed in the message header in the wrong order; the hardware does not identify the type of VLAN tag carried by the original message, and directly inserts the VLAN tag through software control, which will cause a message to carry multiple VLAN tags of the same type.

[0081] 3. The network card does not have VLAN filtering function. Existing network cards can support multiple queues to send messages, which brings more difficulties to software and hardware VLAN attack prevention.

[0082] Based on the above analysis, this application proposes a VLAN tag insertion and filtering solution based on hardware unloading. After the software configures the hardware working mode, the hardware automatically inserts VLAN tags and filters VLAN tags that do not meet expectations through technical means such as hardware identification of the type of VLAN tags carried by the message and judgment of the VLAN tag insertion position. This solves the technical problems of low efficiency of software driver insertion of VLAN tags, easy errors and VLAN attacks when hardware inserts VLAN tags. This application can enhance the efficiency of VLAN tag insertion in the network card and improve the security of the network card.

[0083] See also Figure 2 As shown, the present application exemplarily proposes a message processing device, including: a VLAN tag identification module, a VLAN tag filtering module and a VLAN tag insertion module; wherein,

[0084] The VLAN tag identification module is used to identify the original message and output identification information; the identification information includes the VLAN tag carrying information in the original message, the VLAN tag insertion position information in the original message, and the original inner and outer layer attributes of the carried VLAN tag;

[0085] The VLAN tag filtering module is used to filter the original message according to the pre-configured VLAN filtering configuration information and identification information; the filtering process includes discarding, releasing after modification or directly releasing;

[0086] The VLAN tag insertion module inserts a new VLAN tag into the original message according to the pre-configured VLAN insertion configuration information and the identification information.

[0087] Exemplarily, in the present application, the storage content of the corresponding VLAN tag insertion register can be pre-configured by software. There are multiple types of VLAN tags, and each type of VLAN tag can correspond to an insertion register. The storage content of the insertion register includes the content of the VLAN tag of this type, such as the VLAN tag type, identifier, inner and outer layer attributes, etc. In this way, the granularity of VLAN tag insertion can be flexibly selected, including TC (traffic category), Queue (queue) and VSI (virtual switching interface). The granularity can be understood as the level to which the original message belongs.

[0088] Exemplarily, the present application uses hardware to identify VLAN tags in the original message, such as whether the original message contains VLAN tags, the types of VLAN tags, the number of VLAN tags, the inner and outer layer attributes of the VLAN tags, etc. The original message may have VLAN tags pre-inserted by software, so this step requires the hardware to first identify the VLAN tags that the original message may carry and output identification information. Exemplarily, the identification process can be implemented by a VLAN tag identification module in a message processing device, and the identified information can be used as identification information for the VLAN tag filtering module and the VLAN tag insertion module of the message processing device.

[0089] Exemplarily, the present application configures VLAN filtering configuration information through software so that the hardware can choose to discard, release or modify the original message according to the VLAN filtering configuration information configured by the software and the identification information output by the VLAN tag identification module. This process implements the VLAN anti-attack function and can improve the security of the system. Exemplarily, the filtering process can be implemented by the VLAN tag filtering module in the message processing device.

[0090] Exemplarily, the present application determines the number and position of new VLAN tags to be inserted based on the original inner and outer layer attributes of the VLAN tags carried in the original message identified by the hardware, whether the software configuration supports double-layer / multi-layer VLAN, the new inner and outer layer attributes of the new VLAN tags, etc. This process achieves the accuracy of VLAN tag insertion. Exemplarily, the filtering process can be implemented by a VLAN tag insertion module in the message processing device.

[0091] Below through Figure 3 Information that exemplarily describes the software configuration.

[0092] Exemplarily, the software configuration information may include VLAN insertion configuration information, and the VLAN insertion configuration information may include the following parts:

[0093] VLAN insertion level: determines the level at which the hardware processes the original message. If the TC level insertion is configured, the hardware uses the same set of insertion configurations for the original messages belonging to the same TC (traffic category). The VLAN insertion level can include but is not limited to TC (traffic category), TX Queue (transmit queue) and VSI (virtual switching interface).

[0094] VLAN insertion type: determines the type of VLAN tag to be inserted by the software-controlled hardware. It can include but is not limited to 0x88A8 (STAG), 0x8100 (802.1Q TAG), 0x9100 (802.1QinQ outer tag) and other custom tags.

[0095] VLAN insertion layer number: determines the maximum number of VLAN layers that the hardware can insert. The VLAN insertion layer number can include single-layer, double-layer, and multi-layer (that is, more than two layers) VLAN tags.

[0096] VLAN Insertion Position: This section can configure the optional set insertion position. First, the hardware automatically identifies that the software does not interfere with the actual insertion position of the VLAN. The hardware automatically identifies the original inner and outer layer attributes of the VLAN tag carried by the original message and selects the set insertion position of the new VLAN tag in the original message from the VLAN insertion position configured by the software; for example, if the hardware determines to insert the new VLAN tag into the innermost layer, the hardware will insert the new VLAN tag at the set insertion position corresponding to the innermost layer. At this time, the set insertion position can be the position farthest from the MAC source address; for example, if the hardware determines to insert the new VLAN tag into the outermost layer, the hardware will insert the new VLAN tag at the set insertion position corresponding to the outermost layer. At this time, the set insertion position can be the position closest to the MAC source address.

[0097] Exemplarily, the software configuration information may also include VLAN filtering configuration information, and the VLAN filtering configuration information may include the following parts:

[0098] VLAN filtering level: determines the level at which the hardware filters the original message. If VSI-level filtering is configured, it means that the VLAN filtering mode is applied to the same VSI level. The VLAN filtering level can include but is not limited to TC (traffic category), TX Queue (transmit queue) and VSI (virtual switching interface).

[0099] VLAN filtering mode: It is a configurable filtering method. VLAN filtering modes include the following:

[0100] Accept mode: If the corresponding VLAN filter level is configured in accept mode, the hardware accepts the contents of all original messages belonging to the filter level. That is, regardless of whether the original message carries a VLAN tag, the hardware will not modify the original message, will not mark it as a discarded message, but will directly release it.

[0101] Replacement mode: If the replacement mode is configured for the corresponding VLAN filter level, the hardware replaces the VLAN tag content carried by the original message belonging to the filter level. The replacement content includes the PFI, CFI and VLAN ID fields in the VLAN tag. The contents of these fields are configured by software. If the original message does not carry a VLAN tag, the hardware does not modify the original message. In replacement mode, the original message will not be marked as discarded, that is, the original message will not be discarded.

[0102] Expected mode: If the expected mode is configured for the corresponding VLAN filtering level, the VLAN tag type corresponding to the expected mode also needs to be set. If this type of VLAN tag is detected in the original message belonging to the filtering level, the expectation is considered to be successful, and the hardware sends the original message normally. If the original message is not detected to carry this type of VLAN tag, the expectation is considered to have failed, and the hardware will discard the original message.

[0103] Discard mode: If the corresponding VLAN filter level is configured with the discard mode, you also need to set the VLAN tag type corresponding to the discard mode. If this type of VLAN tag is detected in the original message belonging to this filter level, the hardware will discard the original message. If the original message is not detected to carry this type of VLAN tag, the hardware will send the original message normally.

[0104] In some optional implementations, if a layer 2 message is embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the layer 2 message; if the layer 2 message is not embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the original message;

[0105] If the VLAN tag is not identified, the VLAN tag identification module determines that the VLAN tag carrying information is not carried, and the VLAN tag insertion position information is unlimited;

[0106] If a VLAN tag is identified and the carried VLAN tag is of a first set type, the VLAN tag identification module determines that the VLAN tag insertion position information is unlimited;

[0107] If a VLAN tag is identified, and the carried VLAN tag is of the second set type, the VLAN tag identification module determines whether the inner layer of the VLAN tag of the second set type also carries an inner VLAN tag; if it carries an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are double layers; if it does not carry an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are outer layers;

[0108] If a VLAN tag is identified, and the carried VLAN tag is not of the first set type and the second set type, the VLAN tag identification module determines that the VLAN tag carries no information.

[0109] Combine the following Figure 4 The hardware identification process is illustrated.

[0110] See also Figure 4 As shown, illustratively, the VLAN tag identification module identifies the original message according to the following process and outputs identification information, which may include but is not limited to the VLAN tag carrying information in the original message, the VLAN tag insertion position information in the original message, and the original inner and outer layer attributes of the carried VLAN tag:

[0111] Step 1: Detect the ETYPE field after the MAC source address (DA / SA) of the original message, which is used to identify the Ethernet frame protocol type, and detect whether the content of the ETYPE field is a combination of BVLAN (0x88a8) and ITAG (0x88E7), that is, detect whether the ETYPE field is a MAC-in-MAC tag. If it is a MAC-in-MAC tag, it means that the original message is embedded with a second-layer message. If it is not a MAC-in-MAC tag, determine whether the ETYPE field after the source address of the original message has a VLAN tag, and then execute step 2. If it is a MAC-in-MAC tag, execute step 6.

[0112] Step 2: If there is no VLAN tag, the detection ends and the VLAN tag carrying information of the original message is recorded as not carried and the VLAN tag insertion position information is unlimited. If there is a VLAN tag, execute step 3;

[0113] Step 3: Check whether the VLAN tag is equal to the first set type tag, such as the NSHoe tag (the label of the destination Mac address in the MAC message) or the MPLS label (Multi-Protocol Label Switching). If it is equal to the NSHoe label or the MPLS label, record the VLAN tag insertion position information as unrestricted. If it is not equal to the NSHoe label or the MPLS label, continue to step 4;

[0114] Step 4: Check whether the VLAN tag is equal to the tag of the second set type, such as whether it is a tag of type 0x8100, 0x9100 or 0x88a8. If it is not equal to the second set type, then the detection is terminated, and the VLAN tag insertion position information is recorded as unlimited and / or the VLAN tag carrying information is not carried. If it is equal to the second set type, it means that there may still be an inner VLAN tag, and step 5 is executed at this time.

[0115] Step 5: Check whether there is an inner VLAN tag, for example, check whether the ETYPE after the second set type tag in the layer 2 message is equal to the 0x8100 tag. If not, the detection ends and the original inner and outer layer attributes are recorded as outer, that is, the original message only carries the outer VLAN tag. If it exists, the detection ends and the original inner and outer layer attributes are recorded as double, that is, the original message carries double VLAN tags.

[0116] Step 6: Detect the ETYPE behind the MAC source address (DA / SA) of the layer 2 message to determine whether there is a VLAN tag, and execute step 2. In this step, the set insertion position of the new VLAN tag can also be refreshed, that is, the set insertion position configured by the software is offset by the set length of the layer 2 message. Of course, it is also possible to only identify the original message as nested in the layer 2 message, and temporarily not refresh the set insertion position of the new VLAN tag, but let the VLAN tag insertion module refresh the set insertion position.

[0117] In some optional implementations, the VLAN filtering configuration information includes a filtering mode corresponding to a VLAN filtering level; the VLAN tag filtering module identifies the VLAN filtering level to which the original message belongs, and determines the filtering mode corresponding to the original message based on the VLAN filtering configuration information and the VLAN filtering level to which the original message belongs;

[0118] If the filtering mode corresponding to the original message is the accept mode, the filtering processing performed by the VLAN tag filtering module on the original message is to directly release the message;

[0119] If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries the information of carrying, the filtering processing performed by the VLAN tag filtering module on the original message is to replace the setting field in the VLAN tag carried by the original message with the configuration content corresponding to the replacement mode before releasing it;

[0120] If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries no information, the VLAN tag filtering module performs filtering processing on the original message as direct release;

[0121] If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carrying information is carried, the filtering processing performed by the VLAN tag filtering module on the original message is directly released;

[0122] If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carries no information, the filtering process performed by the VLAN tag filtering module on the original message is discarding;

[0123] If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carrying information is carrying, the filtering processing performed by the VLAN tag filtering module on the original message is discarding;

[0124] If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carries no information, the filtering process performed by the VLAN tag filtering module on the original message is to directly release the message.

[0125] Combine the following Figure 5 The filtering process of the original message is illustrated by way of example.

[0126] See also Figure 5 As shown, illustratively, the VLAN tag filtering module filters the original message according to the following process:

[0127] Step 1: The hardware determines the message processing level according to the filtering level in the VLAN filtering configuration information configured by the software and the VLAN filtering mode configured corresponding to the filtering level. The filtering levels include traffic category (TC), virtual switch interface (VSI) and transmit queue (TX Queue).

[0128] Step 2: When the filtering level is the level to which the original message belongs, determine whether the corresponding filtering mode is the accept mode. If it is equal to the accept mode, the hardware does not make any modification to the original message and the hardware ends the VLAN filtering process. If it is not equal to the accept mode, execute step 3.

[0129] Step 3: When the filter level is the level to which the original message belongs, determine whether the corresponding filter mode is the replacement mode. If it is equal to the replacement mode, the hardware replaces the VLAN tag carried by the original message, and the replacement content includes the PRI, CFI and VLAN ID fields in the carried VLAN tag. If the original message does not carry a VLAN tag, the hardware does not make any modifications to the original message and ends the hardware filtering process. If it is not equal to the replacement mode, execute step 4.

[0130] Step 4: When the filter level is the level to which the original message belongs, determine whether the corresponding filter mode is the expected mode. If it is equal to the expected mode, and the hardware does not detect that the original message carries the VLAN tag type corresponding to the expected mode, it is considered that the expectation has failed, and the original message is discarded. If the original message is detected to carry the VLAN tag type corresponding to the expected mode, it is considered that the expectation has succeeded, and the hardware sends the message normally. If it is not equal to the expected mode, execute step 5.

[0131] Step 5: When the filter level is the level to which the original message belongs, determine whether the corresponding filter mode is the discard mode. If it is equal to the discard mode, and the hardware detects that the original message carries the VLAN tag type corresponding to the discard mode, the message will be discarded. If the hardware does not detect the VLAN tag type, the message is sent normally and the hardware filtering process ends. If it is not equal to the expected mode, the hardware filtering process ends.

[0132] It should be noted that in the above process, in some cases, the VLAN tag carrying information can be set to not carrying, but the VLAN tag insertion position information is empty; in this case, the VLAN tag insertion module can determine that the VLAN tag insertion position information is actually unlimited based on the VLAN tag carrying information being not carrying.

[0133] In some optional implementations, if the VLAN tag insertion position information in the identification information is at a layer 2 message, the VLAN tag insertion module offsets the set insertion position corresponding to the new VLAN tag by a set length corresponding to the layer 2 message;

[0134] If the VLAN tag insertion position information in the identification information is unlimited or the VLAN tag carrying information is not carried, the VLAN tag insertion module inserts the new VLAN tag at the set insertion position in the order of outer layer first and inner layer later;

[0135] If the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information.

[0136] Exemplarily, if the original message does not carry a VLAN tag, the VLAN tag identification module will set the VLAN tag insertion position information to unlimited, and / or set the VLAN tag carrying information to not carry, and the VLAN tag insertion module can insert the new VLAN tag into the corresponding information of the original message according to the relevant information configured by the software. According to the relevant protocol, for a single-layer VLAN tag, the VLAN tag usually follows the DA (destination address) / SA (source address) of the original message, and for a double-layer or multi-layer (more than two layers) VLAN, the outermost VLAN tag is inserted after the DA (destination address) / SA (source address), and the inner VLAN tag can continue to be inserted after the outermost VLAN tag, that is, the position after the DA (destination address) / SA (source address) is the set insertion position, and starting from the DA (destination address) / SA (source address), the new VLAN tags are inserted in the order of outer layer first and inner layer later, wherein the number of new VLAN tags and the inner and outer layer order in the case of multiple new VLAN tags are pre-configured in the new inner and outer layer attributes by software.

[0137] It should be noted that, when there is no Layer 2 message, the set insertion position is the position after the DA (destination address) / SA (source address) of the original message, and when there is a Layer 2 message, if the VLAN tag identification module sets the VLAN tag insertion position information to the Layer 2 message, the set insertion position is after the DA (destination address) / SA (source address) of the Layer 2 message. Therefore, when the default set insertion position is the position after the DA (destination address) / SA (source address) of the original message, it is necessary to offset the set insertion position by the set length corresponding to the Layer 2 message, and the set length can be understood as the length from the position after the DA (destination address) / SA (source address) of the original message to the DA (destination address) / SA (source address) of the Layer 2 message.

[0138] Exemplarily, if the VLAN tag identification module identifies that the original message carries a VLAN tag, and the VLAN tag insertion position information is not unlimited and the VLAN tag carrying information is not not carrying, the VLAN tag insertion module needs to further insert the new VLAN tag into the appropriate position based on the identification information and the VLAN insertion configuration information, or not insert the new VLAN tag if there is no appropriate position.

[0139] In some optional implementations, the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, then if the original inner and outer layer attributes are inner layers, and the new inner and outer layer attributes are not supporting only a single-layer VLAN, then the VLAN tag insertion module inserts the new VLAN tag in the outer layer of the original message;

[0140] If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting VLANs above layer 2, the VLAN tag insertion module inserts the new VLAN tag into the inner layer or outer layer of the original message;

[0141] If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the inner layer of the original message;

[0142] If the original inner and outer layer attributes are double layers, and the new inner and outer layer attributes are neither supporting only single-layer VLAN nor supporting only double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the outer layer of the original message.

[0143] In some other optional implementations, the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, then if the original inner and outer layer attributes are inner layer or outer layer, and the new inner and outer layer attributes are only supporting single-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message, and if the original inner and outer layer attributes are double layers, and the new inner and outer layer attributes are only supporting single-layer VLAN or only supporting double-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message.

[0144] Combine the following Figure 6 The detailed processes of multiple optional implementations involved in the above VLAN tag insertion process are exemplarily described.

[0145] See also Figure 6 As shown, illustratively, the VLAN tag insertion module inserts a new VLAN tag as follows:

[0146] Step 1: The hardware determines the message processing level according to the insertion level configured by the software, which are the traffic category (TC), virtual switch interface (VSI) and transmit queue (TX Queue); determines the VLAN tag to be inserted into the original message according to the insertion type configured by the software; and determines the number of VLAN layers to be inserted according to the number of insertion layers configured by the software;

[0147] Step 2: Confirm the message VLAN insertion position according to the hardware VLAN identification process;

[0148] Step 3: If the original message insertion position is not restricted, the hardware inserts the VLAN in order according to the inner and outer layer attributes of the VLAN tag;

[0149] Step 4: If the original message carries an inner VLAN tag (such as a VLAN tag of type 0x8100), in this case, if the software is configured to support only a single-layer VLAN, the hardware will not insert a new VLAN tag; if the software is configured not to support only a single-layer VLAN, the hardware will insert a new VLAN tag in the outer layer.

[0150] Step 5: If the original message carries an outer VLAN tag, in this case, if the software is configured to support only single-layer VLAN tags, the hardware will not insert new VLAN tags; if the software is configured to support double-layer VLAN tags, new VLAN tags can be inserted into the inner layer; if the software is configured to support multiple layers of VLAN tags, new VLAN tags can be inserted into both the inner and outer layers.

[0151] Step 6: If the original message carries double VLAN tags, if the software is configured to support only single or double VLAN tags, the hardware will not insert new VLAN tags; if the software is configured to support multiple VLANs, the hardware can insert VLAN tags in the outer layer.

[0152] The above is the message processing device proposed in this application, which has the following advantages:

[0153] 1. Compared with the method of inserting VLAN tags by software, this application can effectively improve the efficiency of inserting messages into VLAN through hardware unloading. When there are multiple queues in the system, the efficiency of hardware inserting VLAN tags is improved more, and the resources for software to calculate and manage VLAN tags can be released. In the related art, the hardware directly inserts the VLAN tag after the MAC source address of the L2 message header. This method does not consider the outer and inner attributes of the VLAN tag, which will cause the order of the tags in the L2 message header to be wrong. This application can ensure the correctness of VLAN insertion by accurately identifying the tag type of the VLAN tag and the insertion position of the VLAN tag.

[0154] 2. Through the automatic identification of VLAN tag types by hardware, the hardware can filter out untrusted VLAN tags or directly discard messages. This approach can solve the problems of virtual machine VLAN attacks and VLAN priority traffic preemption, and improve the security and robustness of the entire system.

[0155] 3. The hardware filtering VLAN level is highly flexible, and filtering configurations of different granularities can be selected through software configuration; the hardware VLAN filtering mode can be flexibly configured, and different VLAN filtering methods can be selected according to different business types, increasing the software's control over hardware and reducing the software's resource consumption for VLAN tag management.

[0156] 4. The hardware insertion method of VLAN tags is flexible, supporting the insertion of different types of VLAN tags, supporting double-layer / multi-layer VLAN tag insertion, and supporting the insertion management of VLAN tags at different levels.

[0157] Accordingly, see Figure 7 As shown, the present application also exemplarily provides a message processing method, including:

[0158] In step S701, the VLAN tag identification module identifies the original message and outputs identification information; the identification information includes the VLAN tag carrying information in the original message, the VLAN tag insertion position information in the original message, and the original inner and outer layer attributes of the carried VLAN tag;

[0159] In step S702, the VLAN tag filtering module performs filtering processing on the original message according to the pre-configured VLAN filtering configuration information and the identification information; the filtering processing includes discarding, releasing after modification, or directly releasing;

[0160] In step S703, the VLAN tag insertion module inserts a new VLAN tag into the original message according to the pre-configured VLAN insertion configuration information and the identification information.

[0161] In some optional implementations, the VLAN tag identification module identifies the original message and outputs identification information, including:

[0162] If a layer 2 message is embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the layer 2 message; if a layer 2 message is not embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the original message;

[0163] If the VLAN tag is not identified, the VLAN tag identification module determines that the VLAN tag carrying information is not carried, and the VLAN tag insertion position information is unlimited;

[0164] If a VLAN tag is identified and the carried VLAN tag is of a first set type, the VLAN tag identification module determines that the VLAN tag insertion position information is unlimited;

[0165] If a VLAN tag is identified, and the carried VLAN tag is of the second set type, the VLAN tag identification module determines whether the inner layer of the VLAN tag of the second set type also carries an inner VLAN tag; if it carries an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are double layers; if it does not carry an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are outer layers;

[0166] If a VLAN tag is identified, and the carried VLAN tag is not of the first set type and the second set type, the VLAN tag identification module determines that the VLAN tag carries no information.

[0167] In some optional implementations, the VLAN filtering configuration information includes a filtering mode corresponding to a VLAN filtering level; the VLAN tag filtering module performs filtering processing on the original message according to the pre-configured VLAN filtering configuration information and the identification information, including:

[0168] The VLAN tag filtering module identifies the VLAN filtering level to which the original message belongs, and determines a filtering mode corresponding to the original message based on the VLAN filtering configuration information and the VLAN filtering level to which the original message belongs;

[0169] If the filtering mode corresponding to the original message is the accept mode, the VLAN tag filtering module directly releases the original message through filtering;

[0170] If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries information, the VLAN tag filtering module performs filtering processing on the original message by first replacing the setting field in the VLAN tag carried by the original message with the configuration content corresponding to the replacement mode and then releasing the message;

[0171] If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries no information, the VLAN tag filtering module directly releases the original message through filtering;

[0172] If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carrying information is carried, the VLAN tag filtering module performs filtering processing on the original message to directly release the message;

[0173] If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carries no information, the VLAN tag filtering module performs a filtering process of discarding the original message;

[0174] If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carrying information is carrying, the VLAN tag filtering module performs a discard filtering process on the original message;

[0175] If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carries no information, the VLAN tag filtering module performs filtering processing to directly release the original message.

[0176] In some optional implementations, the VLAN tag insertion module inserts a new VLAN tag into the original message according to pre-configured VLAN insertion configuration information and the identification information, including:

[0177] If the VLAN tag insertion position information in the identification information is at the layer 2 message, the VLAN tag insertion module offsets the set insertion position corresponding to the new VLAN tag by the set length corresponding to the layer 2 message;

[0178] If the VLAN tag insertion position information in the identification information is unlimited or the VLAN tag carrying information is not carried, the VLAN tag insertion module inserts the new VLAN tag at the set insertion position in the order of outer layer first and inner layer later;

[0179] If the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information.

[0180] In some optional implementations, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information, including:

[0181] If the original inner and outer layer attributes are inner layers, and the new inner and outer layer attributes are not to support only a single-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the outer layer of the original message;

[0182] If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting VLANs above layer 2, the VLAN tag insertion module inserts the new VLAN tag into the inner layer or outer layer of the original message;

[0183] If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the inner layer of the original message;

[0184] If the original inner and outer layer attributes are double layers, and the new inner and outer layer attributes are neither supporting only single-layer VLAN nor supporting only double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the outer layer of the original message.

[0185] In some optional implementations, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information, further comprising:

[0186] If the original inner and outer layer attributes are inner or outer, and the new inner and outer layer attributes are to support only single-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message; and if the original inner and outer layer attributes are double-layer, and the new inner and outer layer attributes are to support only single-layer VLAN or only double-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message.

[0187] The above method can be implemented by the message processing device provided in the above embodiment. The specific implementation method can refer to the description of the message processing device in the above embodiment, which will not be repeated here.

[0188] It is understood that the circuit structures, names and parameters described in the above embodiments are only examples. Those skilled in the art can also easily combine and adjust the structural features of the above embodiments according to the use requirements, and should not limit the concept of the present application to the specific details of the above examples.

[0189] Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that he or she may still modify the technical solutions described in the aforementioned embodiments, or make equivalent substitutions for some of the technical features therein; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A message processing device, characterized in that: include: VLAN tag identification module, VLAN tag filtering module and VLAN tag insertion module; wherein, The VLAN tag identification module is used to identify the original message and output identification information; The identification information includes the VLAN tag carrying information in the original message, the VLAN tag insertion position information in the original message, and the original inner and outer layer attributes of the carried VLAN tag; The VLAN tag filtering module is used to filter the original message according to the pre-configured VLAN filtering configuration information and identification information; the filtering process includes discarding, releasing after modification or directly releasing; The VLAN tag insertion module inserts a new VLAN tag into the original message according to the pre-configured VLAN insertion configuration information and the identification information.

2. The message processing device according to claim 1, characterized in that: If a layer 2 message is embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the layer 2 message; if a layer 2 message is not embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the original message; If the VLAN tag is not identified, the VLAN tag identification module determines that the VLAN tag carrying information is not carried, and the VLAN tag insertion position information is unlimited; If a VLAN tag is identified and the carried VLAN tag is of a first set type, the VLAN tag identification module determines that the VLAN tag insertion position information is unlimited; If a VLAN tag is identified, and the carried VLAN tag is of the second set type, the VLAN tag identification module determines whether the inner layer of the VLAN tag of the second set type also carries an inner VLAN tag; if it carries an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are double layers; if it does not carry an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are outer layers; If a VLAN tag is identified, and the carried VLAN tag is not of the first set type and the second set type, the VLAN tag identification module determines that the VLAN tag carries no information.

3. The message processing device according to claim 1, characterized in that: The VLAN filtering configuration information includes a filtering mode corresponding to the VLAN filtering level; the VLAN tag filtering module identifies the VLAN filtering level to which the original message belongs, and determines the filtering mode corresponding to the original message based on the VLAN filtering configuration information and the VLAN filtering level to which the original message belongs; If the filtering mode corresponding to the original message is the accept mode, the filtering processing performed by the VLAN tag filtering module on the original message is to directly release the message; If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries the information of carrying, the filtering processing performed by the VLAN tag filtering module on the original message is to replace the setting field in the VLAN tag carried by the original message with the configuration content corresponding to the replacement mode before releasing it; If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries no information, the VLAN tag filtering module performs filtering processing on the original message as direct release; If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carrying information is carried, the filtering processing performed by the VLAN tag filtering module on the original message is directly released; If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carries no information, the filtering process performed by the VLAN tag filtering module on the original message is discarding; If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carrying information is carrying, the filtering processing performed by the VLAN tag filtering module on the original message is discarding; If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carries no information, the filtering process performed by the VLAN tag filtering module on the original message is to directly release the message.

4. The message processing device according to any one of claims 1 to 3, characterized in that: If the original message is embedded in a layer 2 message, the VLAN tag insertion module offsets the set insertion position corresponding to the new VLAN tag by the set length corresponding to the layer 2 message; If the VLAN tag insertion position information in the identification information is unlimited or the VLAN tag carrying information is not carried, the VLAN tag insertion module inserts the new VLAN tag at the set insertion position in the order of outer layer first and inner layer later; If the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information.

5. The message processing device according to claim 4, characterized in that: If the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, then if the original inner and outer layer attributes are inner layers, and the new inner and outer layer attributes are not supporting only a single-layer VLAN, then the VLAN tag insertion module inserts the new VLAN tag in the outer layer of the original message; If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting VLANs above layer 2, the VLAN tag insertion module inserts the new VLAN tag into the inner layer or outer layer of the original message; If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the inner layer of the original message; If the original inner and outer layer attributes are double layers, and the new inner and outer layer attributes are neither supporting only single-layer VLAN nor supporting only double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the outer layer of the original message.

6. The message processing device according to claim 4, characterized in that: If the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, then if the original inner and outer layer attributes are inner layer or outer layer, and the new inner and outer layer attributes are only supporting single-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message; and if the original inner and outer layer attributes are double layers, and the new inner and outer layer attributes are only supporting single-layer VLAN or only supporting double-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message.

7. A message processing method, characterized in that: include: The VLAN tag identification module identifies the original message and outputs the identification information; The identification information includes the VLAN tag carrying information in the original message, the VLAN tag insertion position information in the original message, and the original inner and outer layer attributes of the carried VLAN tag; The VLAN tag filtering module filters the original message according to the pre-configured VLAN filtering configuration information and the identification information; the filtering process includes discarding, releasing after modification, or directly releasing; The VLAN tag inserting module inserts a new VLAN tag into the original message according to the pre-configured VLAN insertion configuration information and the identification information.

8. The message processing method according to claim 7, characterized in that: The VLAN tag identification module identifies the original message and outputs identification information, including: If a layer 2 message is embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the layer 2 message; if a layer 2 message is not embedded in the original message, the VLAN tag identification module identifies the VLAN tag after the source address of the original message; If the VLAN tag is not identified, the VLAN tag identification module determines that the VLAN tag carrying information is not carried, and the VLAN tag insertion position information is unlimited; If a VLAN tag is identified and the carried VLAN tag is of a first set type, the VLAN tag identification module determines that the VLAN tag insertion position information is unlimited; If a VLAN tag is identified, and the carried VLAN tag is of the second set type, the VLAN tag identification module determines whether the inner layer of the VLAN tag of the second set type also carries an inner VLAN tag; if it carries an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are double layers; if it does not carry an inner VLAN tag, the VLAN tag identification module determines that the original inner and outer layer attributes are outer layers; If a VLAN tag is identified, and the carried VLAN tag is not of the first set type and the second set type, the VLAN tag identification module determines that the VLAN tag carries no information.

9. The message processing method according to claim 7, characterized in that: The VLAN filtering configuration information includes a filtering mode corresponding to the VLAN filtering level; the VLAN tag filtering module filters the original message according to the pre-configured VLAN filtering configuration information and the identification information. It includes: The VLAN tag filtering module identifies the VLAN filtering level to which the original message belongs, and determines a filtering mode corresponding to the original message based on the VLAN filtering configuration information and the VLAN filtering level to which the original message belongs; If the filtering mode corresponding to the original message is the accept mode, the VLAN tag filtering module directly releases the original message through filtering; If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries information, the VLAN tag filtering module performs filtering processing on the original message by first replacing the setting field in the VLAN tag carried by the original message with the configuration content corresponding to the replacement mode and then releasing the message; If the filtering mode corresponding to the original message is the replacement mode, and the VLAN tag carries no information, the VLAN tag filtering module directly releases the original message through filtering; If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carrying information is carried, the VLAN tag filtering module performs filtering processing on the original message to directly release the message; If the filtering mode corresponding to the original message is the expected mode, and the VLAN tag carries no information, the VLAN tag filtering module performs a filtering process of discarding the original message; If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carrying information is carrying, the VLAN tag filtering module performs a discard filtering process on the original message; If the filtering mode corresponding to the original message is the discard mode, and the VLAN tag carries no information, the VLAN tag filtering module performs filtering processing to directly release the original message.

10. The message processing method according to any one of claims 7 to 9, characterized in that: The VLAN tag insertion module inserts a new VLAN tag into the original message according to the pre-configured VLAN insertion configuration information and the identification information, including: If the VLAN tag insertion position information in the identification information is at the layer 2 message, the VLAN tag insertion module offsets the set insertion position corresponding to the new VLAN tag by the set length corresponding to the layer 2 message; If the VLAN tag insertion position information in the identification information is unlimited or the VLAN tag carrying information is not carried, the VLAN tag insertion module inserts the new VLAN tag at the set insertion position in the order of outer layer first and inner layer later; If the VLAN tag insertion position information in the identification information is not unlimited and the VLAN tag carrying information is not not carrying, the VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information.

11. The message processing method according to claim 10, characterized in that: The VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information, including: If the original inner and outer layer attributes are inner layers, and the new inner and outer layer attributes are not to support only a single-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the outer layer of the original message; If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting VLANs above layer 2, the VLAN tag insertion module inserts the new VLAN tag into the inner layer or outer layer of the original message; If the original inner and outer layer attributes are outer layers, and the new inner and outer layer attributes are supporting double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the inner layer of the original message; If the original inner and outer layer attributes are double layers, and the new inner and outer layer attributes are neither supporting only single-layer VLAN nor supporting only double-layer VLAN, the VLAN tag insertion module inserts the new VLAN tag into the outer layer of the original message.

12. The message processing method according to claim 10, characterized in that: The VLAN tag insertion module inserts the new VLAN tag into the original message according to the original inner and outer layer attributes in the identification information and the new inner and outer layer attributes in the VLAN insertion configuration information, and further includes: If the original inner and outer layer attributes are inner or outer, and the new inner and outer layer attributes are to support only single-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message; and if the original inner and outer layer attributes are double-layer, and the new inner and outer layer attributes are to support only single-layer VLAN or only double-layer VLAN, the VLAN tag insertion module does not insert the new VLAN tag into the original message.

Images