Network rule confirmation method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a network rule confirmation method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring full data from a Neutron database; extracting a service table and a data table from the total data; determining a target node from the service table, and establishing a mapping relationship based on the target node and the configuration information in the data table; extracting a configuration information set corresponding to a target node from the mapping relation, and sending the configuration information set to the target node to indicate the target node to collect an actual rule set on the target node; generating an expected rule set based on the configuration information set; and comparing the actual rule set with the expected rule set to obtain at least one of a hit rule, a residual rule or a missing rule. By adopting the method, the network rules can be acquired regularly and compared, so that problems existing in the network can be found efficiently and timely and processed.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a network rule reconciliation method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] Openstack is an open source virtualization and cloud computing application platform that includes multiple basic component modules such as computing, storage, and networking. The network module Neutron provides the Openstack platform with the functions of creating, managing, isolating, and connecting virtual networks. Neutron generally uses various network rules to implement the above network functions. When a physical cluster meets the conditions of a small physical machine cluster size, a small number of virtual machine services, and infrequent physical machine deployment changes, the network rules in the cluster will be relatively stable, and the cluster service availability will be high. Even if there is a problem of missing rules, manual intervention and repair is also a feasible solution.

[0003] However, with the increase in the scale of physical machine clusters, the increase in the number of virtual machine services, the iteration of network functions and the continuous deployment and upgrade in the production environment, the restart of physical machines in the production environment, the failure of Openstack to respond due to excessive service load, and the loss of messages in the message queue, the cluster may have different types of network rules missing or residual, and at the same time, it will cause the network service of one or more virtual machines to be interrupted or incomplete. The Neutron module is designed to issue rule creation commands only in the two stages of resource creation and full refresh. There is no mechanism for reconfirming the rules. The business can only wait until functional problems occur before manual inspection and intervention. This solution is relatively passive and will consume a lot of manpower and time. Summary of the invention

[0004] Based on this, it is necessary to provide a network rule confirmation method, device, computer equipment, computer-readable storage medium and computer program product that can automatically reconfirm the rules in order to solve the above technical problems.

[0005] In a first aspect, the present application provides a network rule confirmation method, which is applied to a data distribution node, comprising:

[0006] Get all data from the Neutron database;

[0007] Extracting a service table and a data table from the full amount of data;

[0008] Determine a target node from the service table, and establish a mapping relationship based on the target node and the configuration information in the data table;

[0009] Extract the configuration information set corresponding to the target node from the mapping relationship, and send the configuration information set to the target node to instruct the target node to collect the actual rule set on the target node; generate an expected rule set based on the configuration information set; compare the actual rule set and the expected rule set to obtain at least one of a hit rule, a residual rule or a missing rule.

[0010] In one embodiment, obtaining the full amount of data from the Neutron database includes:

[0011] Get all data from the Neutron database at preset intervals;

[0012] Determining a target node from the service table includes:

[0013] All nodes in the service table are taken as target nodes.

[0014] In one embodiment, determining the target node from the service table includes:

[0015] A single-node rule confirmation request triggered by a user is received, wherein the single-node rule confirmation request carries a node identifier; and a target node is determined from the service table based on the node identifier.

[0016] In one embodiment, the establishing a mapping relationship based on the target node and the configuration information in the data table includes:

[0017] The target node is used as a key, and the configuration information corresponding to the target node in the data table is used as a value to generate a hash mapping relationship.

[0018] In a second aspect, the present application also provides a network rule confirmation method, which is applied to a data receiving node, comprising:

[0019] Receive a configuration information set corresponding to the data receiving node sent by the data distribution node, where the configuration information set is extracted by the data distribution node from a mapping relationship, where the mapping relationship is established after the data distribution node determines the target node from the service table and based on the configuration information in the target node and the data table, where the service table and the data table are extracted by the data distribution node from the full data, where the full data is obtained by the data distribution node from a Neutron database;

[0020] Collecting the actual rule set on the data receiving node;

[0021] generating an expected rule set based on the configuration information set;

[0022] The actual rule set and the expected rule set are compared to obtain at least one of a hit rule, a residual rule or a missing rule.

[0023] In one embodiment, generating the comparison result includes:

[0024] The rules that intersect in the actual rule set and the expected rule set are composed into a rule hit set; the rules that exist in the actual rule set but do not exist in the expected rule set are composed into a rule residual set; the rules that exist in the expected rule set but do not exist in the actual rule set are composed into a rule missing set.

[0025] In a third aspect, the present application further provides a network rule confirmation device, which is applied to a data distribution node, comprising:

[0026] The acquisition module is used to obtain full data from the Neutron database;

[0027] An extraction module extracts a service table and a data table from the full amount of data;

[0028] A mapping module, which determines a target node from the service table and establishes a mapping relationship based on the target node and the configuration information in the data table;

[0029] A sending module extracts a configuration information set corresponding to a target node from the mapping relationship, and sends the configuration information set to the target node to instruct the target node to collect an actual rule set on the target node; generates an expected rule set based on the configuration information set; and compares the actual rule set with the expected rule set to obtain at least one of a hit rule, a residual rule, or a missing rule.

[0030] In a fourth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps described in the first aspect or the second aspect when executing the computer program.

[0031] In a fifth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps described in the first aspect or the second aspect when executed by a processor.

[0032] In a sixth aspect, the present application further provides a computer program product, comprising a computer program, which implements the steps described in the first aspect or the second aspect when executed by a processor.

[0033] The above-mentioned network rule confirmation method, device, computer equipment, computer-readable storage medium and computer program product first obtain the full data from the Neutron database; then extract the service table and data table from the full data; then determine the target node from the service table, and establish a mapping relationship based on the configuration information in the target node and the data table; finally, extract the configuration information set corresponding to the target node from the mapping relationship, and send the configuration information set to the target node to instruct the target node to collect the actual rule set on the target node; generate an expected rule set based on the configuration information set; compare the actual rule set and the expected rule set to obtain at least one of the hit rules, residual rules or missing rules. By regularly collecting network rules and comparing them, problems in the network can be discovered efficiently and timely for processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0035] FIG1 is a schematic diagram of a flow chart of a data distribution node in a network rule confirmation method in one embodiment;

[0036] FIG2 is a schematic diagram of serializing and deserializing data in one embodiment;

[0037] FIG3 is a schematic diagram of obtaining full data in one embodiment;

[0038] Figure 4 A schematic diagram of mapping in one embodiment;

[0039] Figure 5 A schematic diagram of a flow chart of a data receiving node in a network rule confirmation method in an embodiment;

[0040] Figure 6 is a schematic diagram of comparing an actual rule set with an expected rule set in one embodiment;

[0041] Figure 7 A schematic diagram of a network rule confirmation system in one embodiment;

[0042] Figure 8 is a structural block diagram of a network rule confirmation device in an embodiment;

[0043] FIG. 9 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] In one embodiment, as shown in FIG1 , a network rule confirmation method is provided, which is applied to a data distribution node. In this embodiment, the method includes the following steps:

[0046] Step 102, obtaining full data from the Neutron database;

[0047] Among them, the Neutron database is the part of the Neutron network service component in the OpenStack cloud computing platform used to store network status information.

[0048] Among them, full data refers to all network status information. Optionally, the network status information can be: Network: virtual network information, including network type, segment ID, etc. Subnet: subnet information, including IP address range, gateway, DNS server, etc. Port: virtual machine network interface information, including MAC address, IP address, network, etc. Router: virtual router information, including routing table, namespace, iptables rules, etc.

[0049] Exemplarily, all network status information is obtained from the Neutron database.

[0050] Step 104, extracting a service table and a data table from the full amount of data;

[0051] Optionally, the service table can be an agents table, where in the Neutron database, the agents table is a table used to store information related to Neutron agents. These agents are key components in the Neutron architecture and are responsible for performing specific network operations on the host.

[0052] Optionally, the data table may be a ports table, a VPC (Virtual Private Cloud) table, etc. In the Neutron database, the ports table is a key data table used to store information related to virtual machine network interfaces (ports). The VPC table is a table for managing private clouds.

[0053] Exemplarily, the agents table and the ports table are extracted from all network status information.

[0054] Step 106, determining a target node from the service table, and establishing a mapping relationship based on the target node and the configuration information in the data table;

[0055] Among them, the target node is the node that needs network status information.

[0056] Optionally, the configuration information in the data table may be a port number in the ports table.

[0057] Exemplarily, a node requiring network status information is determined from the agents table as a target node, and a name corresponding to the target node in the agents table and a port number corresponding to the target node in the ports table are mapped to establish a mapping relationship.

[0058] Step 108: extract the configuration information set corresponding to the target node from the mapping relationship, and send the configuration information set to the target node to instruct the target node to collect the actual rule set on the target node; generate an expected rule set based on the configuration information set; compare the actual rule set and the expected rule set to obtain at least one of a hit rule, a residual rule or a missing rule.

[0059] Optionally, the configuration information set may be information in tables such as ports table and VPC table corresponding to each node.

[0060] Optionally, as shown in Figure 2, data can be distributed between nodes in a point-to-point manner using RPC (Remote Procedure Call). Each data receiving node starts an RPC server, and the data distribution node will start an RPC client for each data receiving node, and send the data related to the destination node through the corresponding client. In actual operation, in order to facilitate data transmission, the data needs to be serialized and deserialized before distribution and after reception. The serialization format can be json, protobuf, etc. For the golang programming language, the specific data type can also be converted to an interface type at the data distribution end, and then further converted to a byte type, and then reversely converted at the data receiving end and asserted to a specific data type through a type.

[0061] Exemplarily, information in tables such as ports tables and VPC tables corresponding to the target node is extracted from the mapping relationship, and the information in the ports tables and VPC tables is serialized, and the RPC client is used to send the serialized information to the RPC server of the target node to instruct the target node to collect the actual rule set on the target node; an expected rule set is generated based on the configuration information set; the actual rule set and the expected rule set are compared to obtain at least one of a hit rule, a residual rule or a missing rule.

[0062] The above-mentioned network rule confirmation method, device, computer equipment, computer-readable storage medium and computer program product first obtain the full data from the Neutron database; then extract the service table and data table from the full data; then determine the target node from the service table, and establish a mapping relationship based on the configuration information in the target node and the data table; finally, extract the configuration information set corresponding to the target node from the mapping relationship, and send the configuration information set to the target node to instruct the target node to collect the actual rule set on the target node; generate an expected rule set based on the configuration information set; compare the actual rule set and the expected rule set to obtain at least one of the hit rules, residual rules or missing rules. By regularly collecting network rules and comparing them, problems in the network can be discovered efficiently and timely for processing.

[0063] In an exemplary embodiment, as shown in FIG3 , the obtaining of full data from the Neutron database includes: obtaining full data from the Neutron database at preset time intervals;

[0064] Determining the target node from the service table includes: taking all nodes in the service table as target nodes.

[0065] Among them, a node is actually a host.

[0066] Optionally, the preset duration may be 1 hour.

[0067] Optionally, you can set a timer to automatically trigger the acquisition of data from the Neutron database, or you can manually access the data of a specific host or all hosts through the restfulapi interface.

[0068] Exemplarily, a timing trigger is set to obtain data of all nodes in the database from the Neutron database every hour as current real-time data.

[0069] In this embodiment, by acquiring data from the Neutron database at predetermined intervals for subsequent comparison, it is possible to regularly check whether the network rules are missing or residual.

[0070] In an exemplary embodiment, as shown in FIG3 , determining the target node from the service table includes:

[0071] A single-node rule confirmation request triggered by a user is received, wherein the single-node rule confirmation request carries a node identifier; and a target node is determined from the service table based on the node identifier.

[0072] Optionally, the node rule confirmation request triggered by the user may not be for a single node, but may be for multiple nodes or all nodes.

[0073] Exemplarily, a single-node rule confirmation request triggered by a user is received through a restful API interface, wherein the single-node rule confirmation request carries a node identifier; and a target node is determined from the service table based on the node identifier.

[0074] In this embodiment, the need for scenarios such as human intervention and emergency inspection can be supported by obtaining data in a manner that is considered.

[0075] In an exemplary embodiment, establishing a mapping relationship based on the target node and the configuration information in the data table includes:

[0076] The target node is used as a key, and the configuration information corresponding to the target node in the data table is used as a value to generate a hash mapping relationship.

[0077] Optional, such as Figure 4 As shown in the figure, taking the ports table in Neutron as an example, the ports table records the network port information on each node. Through this information, the mapping relationship between the port and the host name is established. More complex, such as the vpc table in Neutron, it is necessary to first establish the corresponding relationship mapping between the port and the vpc, and then combine the mapping between the port and the host name to calculate the mapping relationship between the host name and the vpc. It should be noted here that this corresponding relationship is one-to-many or even many-to-many, but through the classification and integration of the above method, the mapping relationship between a single host and all types of data can be obtained in the end.

[0078] Exemplarily, a hash mapping relationship is generated using the host name of the target node as the key and the port number corresponding to the target node in the ports table as the value.

[0079] In this embodiment, by matching the node name with the port, the data required by each node is sent to the corresponding node, rather than sending the data to all target nodes without processing, which can reduce the amount of data transmission in subsequent steps.

[0080] In one embodiment, Figure 5 As shown, a network rule confirmation method is provided, which is applied to a data receiving node. In this embodiment, the method includes the following steps:

[0081] Step 202: Receive a configuration information set corresponding to the data receiving node sent by the data distribution node, where the configuration information set is extracted by the data distribution node from a mapping relationship, where the mapping relationship is established after the data distribution node determines the target node from the service table based on the configuration information in the target node and the data table, where the service table and the data table are extracted by the data distribution node from the full data, and the full data is obtained by the data distribution node from the Neutron database.

[0082] Optionally, the corresponding configuration information set can be received through the RPC server.

[0083] Exemplarily, serialized information of a configuration information set corresponding to a data receiving node sent by a data distribution node is received through an RPC server and deserialized; the configuration information set is extracted by the data distribution node from a mapping relationship, and the mapping relationship is established after the data distribution node determines the target node from a service table based on the target node and the configuration information in the data table, and the service table and the data table are extracted by the data distribution node from the full data, and the full data is obtained by the data distribution node from a Neutron database.

[0084] Step 204, collecting the actual rule set on the data receiving node;

[0085] The actual rule set is a set of actual network rules.

[0086] Exemplarily, all network rules on the data receiving node are collected to form an actual rule set.

[0087] For example, taking the Open vSwitch flow table rule as an example, first execute the command "ovs-ofctl dump-flows br-int table=0 --no-stat --names" to obtain the ovs flow table, obtain the rule of table=0 of the br-int bridge, and put the obtained rule into the actual rule set.

[0088] Step 206, generating an expected rule set based on the configuration information set;

[0089] The expected rule set is a set of all network rules extracted from the configuration information set.

[0090] Optionally, generating the expected rules on the host requires querying the distributed data through different filtering conditions. Since the same query condition may be used multiple times, in order to reduce the traversal operation of the data, this step requires first traversing the received data once, and pre-establishing a mapping relationship to the data pointer based on the filtering conditions that will be used later. In this way, in subsequent queries, the required data can be quickly queried without traversing the entire data table, which reduces the query time for generating the expected rule operation and is also beneficial to ensuring the real-time nature of the data.

[0091] Exemplarily, the configuration information set is traversed and indexed, and all network rules in the configuration information set are collected through the index to form an expected rule set.

[0092] For example, for each port whose device type is a virtual machine, a flow table will be generated in table=0 of the br-int bridge. For example, for the port whose first ten digits of the port number corresponding to the virtual machine are xxxxxxxx-xx, it is expected that a flow table rule with priority=10,arp,in_port="qvoxxxxxxxx-xx" actions=resubmit(,24) will be generated, and the generated rule will be put into the expected rule set.

[0093] Step 208: compare the actual rule set with the expected rule set to obtain at least one of a hit rule, a residual rule or a missing rule.

[0094] The comparison between the actual rule set and the expected rule set is to compare the intersecting parts and the different parts of the two sets.

[0095] Exemplarily, the actual rule set and the expected rule set are compared to obtain one or more of a hit rule set, a residual rule set or a missing rule set.

[0096] In an exemplary embodiment, Figure 6 As shown, generating the comparison result includes:

[0097] The rules that intersect in the actual rule set and the expected rule set are composed into a rule hit set; the rules that exist in the actual rule set but do not exist in the expected rule set are composed into a rule residual set; the rules that exist in the expected rule set but do not exist in the actual rule set are composed into a rule missing set.

[0098] Exemplarily, the rules that intersect in the actual rule set and the expected rule set are grouped into a rule hit set; the rules that exist in the actual rule set but not in the expected rule set are grouped into a rule residual set; and the rules that exist in the expected rule set but not in the actual rule set are grouped into a rule missing set.

[0099] Furthermore, according to the comparison results, result reporting, result recording and rule repair operations are performed. Result reporting: Provide an interface for obtaining monitoring data to the outside world, access the monitoring data interface regularly through prometheus monitoring to pull brief comparison results, and then trigger alarms to remind relevant personnel. For example, the reported data includes the total number of residual rule entries and the total number of missing rule entries. An alarm is triggered when the total number of residual or missing rule entries reaches the threshold. Result recording: Detailed comparison results will be persisted in the form of local storage in files. After observing the alarm information, relevant personnel can pay attention to the comparison results of interest through local files. Compared with the reporting of comparison results, the recording of comparison results can add specific missing or residual rules. These records can help technical personnel analyze whether there are systemic vulnerabilities. Rule repair: Based on the difference between actual rules and expected rules, you can choose the program to automatically complete the missing rules and delete the remaining rules, or you can choose to manually confirm and repair the rules with higher importance levels.

[0100] In an exemplary embodiment, Figure 7 As shown, a network rule confirmation method is applied to a system composed of a data distribution node and a data receiving node. The number of data distribution nodes can be one, and the number of data receiving nodes can be multiple. The Neutron database can be deployed on the data distribution node, and the data distribution node is also deployed with a distributor and an RPC client. An RPC client, a receiver, and a comparator are deployed on each data receiving node. For the convenience of explanation, the RPC client deployed on the data distribution node is called a distribution-side RPC client, and the RPC client deployed on the data receiving node is called a receiving-side RPC client. The above-mentioned network rule confirmation method includes the following steps:

[0101] The distributor obtains the full amount of data from the Neutron database; extracts the service table and the data table from the full amount of data; determines the target node from the service table, and establishes a mapping relationship based on the configuration information in the target node and the data table; extracts the configuration information set corresponding to the target node from the mapping relationship, and sends the configuration information set to the target node in multiple data distribution nodes through the distribution side RPC client. The receiving side RPC client deployed in the target node receives the configuration information set and transmits it to the comparator through the receiver. The comparator collects the actual rule set on the target node; generates the expected rule set based on the configuration information set; compares the actual rule set and the expected rule set to obtain a comparison result, which includes at least one of a hit rule, a residual rule or a missing rule; the comparison result can be processed as follows: record, upper part and rule repair. Among them, the detailed implementation process of the data distribution node and the target node when executing the steps on this side refers to the aforementioned embodiment, which will not be repeated here.

[0102] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0103] In an exemplary embodiment, Figure 8 As shown, a network rule confirmation device is provided, which is applied to a data distribution node, including: an acquisition module, an extraction module, a mapping module and a sending module, wherein:

[0104] The acquisition module is used to obtain full data from the Neutron database;

[0105] An extraction module extracts a service table and a data table from the full amount of data;

[0106] A mapping module, which determines a target node from the service table and establishes a mapping relationship based on the target node and the configuration information in the data table;

[0107] A sending module extracts a configuration information set corresponding to a target node from the mapping relationship, and sends the configuration information set to the target node to instruct the target node to collect an actual rule set on the target node; generates an expected rule set based on the configuration information set; and compares the actual rule set with the expected rule set to obtain at least one of a hit rule, a residual rule, or a missing rule.

[0108] In an exemplary embodiment, the acquisition module is further used to: acquire full data from the Neutron database at preset time intervals;

[0109] Determining the target node from the service table includes: taking all nodes in the service table as target nodes.

[0110] In an exemplary embodiment, the acquisition module is further used to:

[0111] A single-node rule confirmation request triggered by a user is received, wherein the single-node rule confirmation request carries a node identifier; and a target node is determined from the service table based on the node identifier.

[0112] In an exemplary embodiment, the mapping module is further configured to:

[0113] The target node is used as a key, and the configuration information corresponding to the target node in the data table is used as a value to generate a hash mapping relationship.

[0114] Each module in the above network rule confirmation device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0115] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG9. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store full data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network rule confirmation method is implemented.

[0116] Those skilled in the art will understand that the structure shown in FIG. 9 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0117] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0118] Get all data from the Neutron database;

[0119] Extracting a service table and a data table from the full amount of data;

[0120] Determine a target node from the service table, and establish a mapping relationship based on the target node and the configuration information in the data table;

[0121] Extract the configuration information set corresponding to the target node from the mapping relationship, and send the configuration information set to the target node to instruct the target node to collect the actual rule set on the target node; generate an expected rule set based on the configuration information set; compare the actual rule set and the expected rule set to obtain at least one of a hit rule, a residual rule or a missing rule.

[0122] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0123] Get all data from the Neutron database at preset intervals;

[0124] Determining a target node from the service table includes:

[0125] All nodes in the service table are taken as target nodes.

[0126] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0127] A single-node rule confirmation request triggered by a user is received, wherein the single-node rule confirmation request carries a node identifier; and a target node is determined from the service table based on the node identifier.

[0128] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0129] The target node is used as a key, and the configuration information corresponding to the target node in the data table is used as a value to generate a hash mapping relationship.

[0130] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0131] Get all data from the Neutron database;

[0132] Extracting a service table and a data table from the full amount of data;

[0133] Determine a target node from the service table, and establish a mapping relationship based on the target node and the configuration information in the data table;

[0134] Extract the configuration information set corresponding to the target node from the mapping relationship, and send the configuration information set to the target node to instruct the target node to collect the actual rule set on the target node; generate an expected rule set based on the configuration information set; compare the actual rule set and the expected rule set to obtain at least one of a hit rule, a residual rule or a missing rule.

[0135] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0136] Get all data from the Neutron database at preset intervals;

[0137] Determining a target node from the service table includes:

[0138] All nodes in the service table are taken as target nodes.

[0139] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0140] A single-node rule confirmation request triggered by a user is received, wherein the single-node rule confirmation request carries a node identifier; and a target node is determined from the service table based on the node identifier.

[0141] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0142] The target node is used as a key, and the configuration information corresponding to the target node in the data table is used as a value to generate a hash mapping relationship.

[0143] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0144] Get all data from the Neutron database;

[0145] Extracting a service table and a data table from the full amount of data;

[0146] Determine a target node from the service table, and establish a mapping relationship based on the target node and the configuration information in the data table;

[0147] Extract the configuration information set corresponding to the target node from the mapping relationship, and send the configuration information set to the target node to instruct the target node to collect the actual rule set on the target node; generate an expected rule set based on the configuration information set; compare the actual rule set and the expected rule set to obtain at least one of a hit rule, a residual rule or a missing rule.

[0148] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0149] Get all data from the Neutron database at preset intervals;

[0150] Determining a target node from the service table includes:

[0151] All nodes in the service table are taken as target nodes.

[0152] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0153] A single-node rule confirmation request triggered by a user is received, wherein the single-node rule confirmation request carries a node identifier; and a target node is determined from the service table based on the node identifier.

[0154] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0155] The target node is used as a key, and the configuration information corresponding to the target node in the data table is used as a value to generate a hash mapping relationship.

[0156] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0157] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0158] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network rule confirmation method, characterized in that: Applied to a data distribution node, the method comprises: Get all data from the Neutron database; Extracting a service table and a data table from the full amount of data; Determine a target node from the service table, and establish a mapping relationship based on the target node and the configuration information in the data table; Extract the configuration information set corresponding to the target node from the mapping relationship, and send the configuration information set to the target node to instruct the target node to collect the actual rule set on the target node; generate an expected rule set based on the configuration information set; compare the actual rule set and the expected rule set to obtain at least one of a hit rule, a residual rule or a missing rule.

2. The method according to claim 1, characterized in that The acquisition of full data from the Neutron database includes: Get all data from the Neutron database at preset intervals; Determining a target node from the service table includes: All nodes in the service table are taken as target nodes.

3. The method according to claim 1, characterized in that The determining the target node from the service table comprises: A single-node rule confirmation request triggered by a user is received, wherein the single-node rule confirmation request carries a node identifier; and a target node is determined from the service table based on the node identifier.

4. The method according to claim 1, characterized in that: The establishing a mapping relationship based on the target node and the configuration information in the data table includes: The target node is used as a key, and the configuration information corresponding to the target node in the data table is used as a value to generate a hash mapping relationship.

5. A network rule confirmation method, characterized in that: Applied to a data receiving node, the method comprises: Receive a configuration information set corresponding to the data receiving node sent by the data distribution node, where the configuration information set is extracted by the data distribution node from a mapping relationship, where the mapping relationship is established after the data distribution node determines the target node from the service table and based on the configuration information in the target node and the data table, where the service table and the data table are extracted by the data distribution node from the full data, where the full data is obtained by the data distribution node from a Neutron database; Collecting the actual rule set on the data receiving node; generating an expected rule set based on the configuration information set; The actual rule set and the expected rule set are compared to obtain at least one of a hit rule, a residual rule or a missing rule.

6. The method according to claim 1, characterized in that The generating of the comparison result comprises: The rules that intersect in the actual rule set and the expected rule set are composed into a rule hit set; the rules that exist in the actual rule set but do not exist in the expected rule set are composed into a rule residual set; the rules that exist in the expected rule set but do not exist in the actual rule set are composed into a rule missing set.

7. A network rule confirmation device, characterized in that: Applied to a data distribution node, the device comprises: The acquisition module is used to obtain full data from the Neutron database; An extraction module extracts a service table and a data table from the full amount of data; A mapping module, which determines a target node from the service table and establishes a mapping relationship based on the target node and the configuration information in the data table; A sending module extracts a configuration information set corresponding to a target node from the mapping relationship, and sends the configuration information set to the target node to instruct the target node to collect an actual rule set on the target node; generates an expected rule set based on the configuration information set; compares the actual rule set with the expected rule set to obtain at least one of a hit rule, a residual rule or a missing rule.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images