Table item processing method and device, network equipment and storage medium

Abstract

The embodiment of the invention provides a table item processing method and device, network equipment and a storage medium, and relates to the technical field of data communication. According to the method, whether the VLAN is an uncontrollable VLAN or not is determined according to configuration information of a port bound with the VLAN, and the uncontrollable VLAN means that a VLAN label is stripped before a message forwarded through the VLAN is matched with an ACL table item in a switch chip in an exit direction; under the condition that the VLAN is an uncontrollable VLAN, a class identifier CID is applied for the VLAN; and generating an ACL table item corresponding to the VLAN based on the CID applying for the VLAN, and issuing the ACL table item to the ACL table in the output direction of the switch chip, so that the switch chip performs forwarding logic control on the message forwarded through the VLAN, and the flexibility and the security of network management are ensured.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a table entry processing method, device, network equipment and storage medium. Background Art

[0002] Network devices can use hardware chips to forward messages outward. The main processes executed by the hardware chip when the message reaches the exit are as follows: Figure 1 As shown, it includes: the parser completes the parsing of the second layer / third layer / fourth layer message content of the message; the interface mapper completes the VLAN (Virtual Local Area Network) mapping and selects the final forwarding VLAN; according to the message forwarding information, the message is edited, such as stripping the VLAN tag, etc.; the forwarding logic control is performed on the outgoing message; and the traffic is scheduled in the outgoing direction.

[0003] Due to the limitation of hardware chips, if the VLAN tag in the message has been stripped before entering the outbound forwarding logic control process, it is impossible to support the use of ACL (Access Control List) to perform forwarding logic control on the outbound VLAN message in specific scenarios, affecting the flexibility and security of network forwarding. Summary of the invention

[0004] In view of this, an object of the present invention is to provide a table entry processing method, apparatus, network equipment and storage medium.

[0005] In order to achieve the above purpose, the technical solution adopted by the embodiment of the present invention is as follows:

[0006] In a first aspect, an embodiment of the present invention provides a table entry processing method, the method comprising:

[0007] Determine whether the VLAN is an uncontrollable VLAN according to the configuration information of the port bound to each VLAN, wherein the uncontrollable VLAN refers to the VLAN forwarded by the message stripped of the VLAN tag before matching the ACL table entry in the outbound direction of the switching chip;

[0008] In the case that the VLAN is the uncontrollable VLAN, applying for a category identifier CID for the VLAN;

[0009] An ACL entry corresponding to the VLAN is generated based on the CID, and the ACL entry is sent to an ACL table in an outbound direction of the switching chip.

[0010] Optionally, the step of determining whether the VLAN is an uncontrollable VLAN according to the configuration information of the port bound to each VLAN includes:

[0011] If there is an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag among the ports bound to the VLAN, the VLAN is determined to be the uncontrollable VLAN.

[0012] Optionally, when the VLAN is a layer 2 VLAN, after the step of applying for a category identifier CID for the VLAN, the method further includes:

[0013] A corresponding relationship between the VLAN and the CID applied for the VLAN is established and sent to the switching chip.

[0014] Optionally, when the VLAN is a layer-3 VLAN, after the step of applying for a category identifier CID for the VLAN, the method further includes:

[0015] Search all next hops corresponding to the VLAN in the routing table, bind the CID applied for the VLAN to all the next hops, and update the table entries of all the next hops in the switching chip with the bound CID.

[0016] In a second aspect, an embodiment of the present invention provides a table entry processing device, the device comprising:

[0017] A determination module, used to determine whether the VLAN is an uncontrollable VLAN according to the configuration information of the port bound to each VLAN, wherein the uncontrollable VLAN refers to the message forwarded through the VLAN stripped of the VLAN tag before matching the ACL table entry in the outbound direction of the switching chip;

[0018] An application module, used for applying for a category identifier CID for the VLAN when the VLAN is the uncontrollable VLAN;

[0019] The processing module is used to generate an ACL table item corresponding to the VLAN based on the CID, and send the ACL table item to the ACL table in the outbound direction of the switching chip.

[0020] Optionally, the determining module is specifically configured to determine that the VLAN is the uncontrollable VLAN if there is an Access port or a Trunk port without a VLAN tag or a Hybrid port without a VLAN tag among the ports bound to the VLAN.

[0021] Optionally, the processing module is further configured to, when the VLAN is a layer-2 VLAN, establish a corresponding relationship between the VLAN and the CID applied for the VLAN, and send the corresponding relationship to the switching chip.

[0022] Optionally, the processing module is also used to search all next hops corresponding to the VLAN in the routing table when the VLAN is a layer-3 VLAN, bind the CID applied for the VLAN to all the next hops, and update the table entries of all the next hops in the switching chip with the bound CID.

[0023] In a third aspect, an embodiment of the present invention provides a network device, wherein the network device includes a processor and a switching chip:

[0024] The processor is used to execute the table entry processing method described in the first aspect, so as to generate a corresponding ACL table entry in an outbound direction in the switching chip;

[0025] The switching chip is used to forward the message to be forwarded with the VLAN tag stripped off out of the network device after matching the corresponding ACL entry.

[0026] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the table entry processing method as described in the first aspect is implemented.

[0027] The table item processing method provided by the embodiment of the present invention is as follows: according to the configuration information of the port bound to the VLAN, determining whether the VLAN is an uncontrollable VLAN, wherein the uncontrollable VLAN refers to the message forwarded through the VLAN stripped of the VLAN tag before matching the ACL table item in the switching chip in the outbound direction; if the VLAN is an uncontrollable VLAN, applying for a category identifier CID for the VLAN; generating an ACL table item corresponding to the VLAN based on the CID applied for the VLAN, and sending it to the ACL table in the outbound direction of the switching chip. Since the embodiment of the present invention applies for a category identifier CID for the uncontrollable VLAN, and uses the applied CID to generate an ACL table item corresponding to this type of VLAN in the ACL table and sends it to the switching chip, the switching chip can perform forwarding logic control on the message to be forwarded with the VLAN stripped, thereby ensuring the flexibility and security of network management.

[0028] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A schematic diagram of an outbound message processing process provided by an embodiment of the present invention is shown;

[0031] Figure 2 A schematic diagram showing a process of a table entry processing method provided by an embodiment of the present invention Figure 1 ;

[0032] Figure 3 A schematic diagram showing a process of a table entry processing method provided by an embodiment of the present invention Figure 2 ;

[0033] Figure 4 A schematic diagram showing a process of a table entry processing method provided by an embodiment of the present invention Figure 3 ;

[0034] Figure 5 A functional unit block diagram of a table entry processing device provided by an embodiment of the present invention is shown;

[0035] Figure 6 A schematic structural block diagram of a network device provided by an embodiment of the present invention is shown.

[0036] Icons: 100 - entry processing device; 101 - determination module; 102 - application module; 103 - processing module; 200 - network device; 210 - processor; 220 - switching chip. DETAILED DESCRIPTION

[0037] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0038] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0039] It should be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0040] In order to enable the switching chip to perform forwarding logic control on the message with the VLAN tag stripped in the outgoing processing flow and ensure the flexibility and security of network management, an embodiment of the present invention provides a table entry processing method applied to the switching chip, which will be described in detail below.

[0041] Please refer to Figure 2 The table entry processing method includes steps S101 to S103.

[0042] S101, determining whether a VLAN is an uncontrollable VLAN according to configuration information of a port bound to each VLAN.

[0043] The switching chip uses the ACL table to perform forwarding logic control on the message, and the ACL table contains ACL entries corresponding to each VLAN. In the embodiment of the present invention, VLAN can be divided into controllable VLAN and uncontrollable VLAN. The controllable VLAN means that the message forwarded through the VLAN carries the VLAN tag when matching the ACL entry in the outbound direction of the switching chip, and the uncontrollable VLAN means that the message forwarded through the VLAN strips the VLAN tag before matching the ACL entry in the outbound direction of the switching chip.

[0044] The configuration information of each port bound to a VLAN includes port type and tag information. A VLAN is bound to at least one port. Whether the VLAN is an uncontrollable VLAN is determined according to the port type and tag information of these ports.

[0045] In a possible implementation, the implementation process of step S101 may be as follows:

[0046] First, it is determined whether there is an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag among the ports bound to the VLAN.

[0047] Access port: This type of port usually only allows packets from one VLAN to pass through, and the packets do not need to carry a VLAN tag.

[0048] Trunk port (aggregation port), if the PVID (Port VLAN ID) of this type of port is the same as the VLAN tag in the forwarded message, the VLAN tag in the message will be stripped.

[0049] Hybrid port: This type of port is configured as untag, that is, untagged, so the message does not carry a VLAN tag when passing through this type of port.

[0050] If the ports bound to the VLAN include an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag, the VLAN is determined to be an uncontrollable VLAN.

[0051] It can be understood that if there is an Access port among the ports bound to the VLAN, the VLAN tag in the message forwarded through the VLAN with the outbound direction being the Access port will be stripped before matching the ACL table entry in the switching chip, and the ACL table entry matching based on the VLAN tag cannot be performed, and thus the corresponding forwarding logic control of the message cannot be performed.

[0052] Similarly, if there is a Trunk port without a VLAN tag among the ports bound to the VLAN, the VLAN tag in the message forwarded through the VLAN with the outbound direction being the Trunk port without a VLAN tag will be stripped before matching the ACL entry in the switching chip, making it impossible to match the ACL entry based on the VLAN tag, and further making it impossible to perform corresponding forwarding logic control on the message.

[0053] If there is a Hybrid port without a VLAN tag among the ports bound to the VLAN, the VLAN tag in the message forwarded through the VLAN with the outgoing direction being the Hybrid port without a VLAN tag will be stripped before matching the ACL entry in the switching chip, making it impossible to match the ACL entry based on the VLAN tag, and further making it impossible to perform corresponding forwarding logic control on the message.

[0054] If the ports bound to the VLAN do not include any of the following three types of ports: an access port, a trunk port without a VLAN tag, or a hybrid port without a VLAN tag, the VLAN is determined to be a controllable VLAN.

[0055] It can be understood that if there is no Access port, Trunk port without VLAN tag and Hybrid port without VLAN tag in the port bound to the VLAN, then the VLAN tag in the message forwarded through the VLAN with the outgoing direction being the port bound to the VLAN will not be stripped before matching the ACL table entry in the switching chip, and the ACL table entry matching based on the VLAN tag can be performed, and the corresponding forwarding logic control of the message can be performed.

[0056] S102: If the VLAN is an uncontrollable VLAN, apply for a category identifier CID for the VLAN.

[0057] The message forwarding is achieved by applying for a CID (Category ID, a resource in the switching chip) for the uncontrollable VLAN. The CID is a resource of the switching chip and can be applied for when in use.

[0058] There are two situations in the implementation process of step S102. One situation is that the VLAN is a layer-2 forwarding VLAN, and the other situation is that the VLAN is a layer-3 forwarding VLAN.

[0059] In the case that "the VLAN is a layer 2 forwarding VLAN", the implementation process of step S102 is to apply for a CID for the VLAN in the inbound processing flow, which can be called a source CID.

[0060] In the case that "the VLAN is a layer-3 forwarding VLAN", the implementation process of step S102 applies for a CID for the VLAN in the outbound processing flow, which may be referred to as a destination CID.

[0061] In the embodiment of the present invention, when an ACL entry is bound based on a layer-3 VLAN, a destination CID is applied for a layer-3 forwarding VLAN.

[0062] S103: Generate an ACL entry corresponding to the VLAN based on the CID, and send the ACL entry to the ACL table in the outbound direction of the switch chip.

[0063] For the case where "the VLAN is a Layer 2 forwarding VLAN", please refer to Figure 3 After applying for the CID for the VLAN, step S104 is also required to establish a corresponding relationship between the VLAN and the CID applied for it, and send it to the switching chip. In this embodiment, not only the mapping attribute of the VLAN and the CID is sent to the switching chip, but also the CID of the VLAN is sent as the basic matching item of the ACL table item by extracting the mapping attribute of the VLAN and the CID. The message using the matching item is equivalent to matching the corresponding VLAN.

[0064] In the embodiment of the present invention, after applying for a CID for a Layer 2 forwarding VLAN, the switching chip can determine the corresponding ACL entry from the ACL table based on the Layer 2 forwarding VLAN by which the message is forwarded, and then based on the mapping attributes of the VLAN and the CID, to perform forwarding logic control on the message.

[0065] For the case where "the VLAN is a Layer 3 forwarding VLAN", please refer to Figure 4 After applying for the CID for the VLAN, step S105 needs to be performed: searching for all next hops corresponding to the VLAN in the routing table, binding the CID applied for the VLAN to all the next hops found, and updating the table entries of all next hops in the switching chip with the bound CID.

[0066] In the embodiment of the present invention, after applying for CID for the three-layer VLAN, all routing tables corresponding to the current VLAN are queried, and all corresponding next hops are found; the CID attributes in all found next hops are updated so that all routing tables forwarded in the three-layer VLAN contain CID attributes, and matching the CID in the routing table means matching the VLAN. By extracting the mapping attribute from VLAN to CID and adding a three-layer forwarding tag, the CID and the three-layer forwarding tag are sent down as the basic matching items of the ACL, and matching the value is equivalent to matching the corresponding VLAN. The switching chip can determine which three-layer forwarding VLAN the message is forwarded by based on the determined next hop, and then determine the corresponding ACL table item from the ACL table to perform forwarding logic control on the message.

[0067] In order to execute the corresponding steps in the above embodiments and various possible methods, an implementation method of the entry processing device 100 is given below. Figure 5 , Figure 5 This is a functional module diagram of a table entry processing device 100 provided in an embodiment of the present invention. It should be noted that the basic principle and technical effects of the table entry processing device 100 provided in this embodiment are the same as those of the above embodiment. For the sake of brief description, for parts not mentioned in this embodiment, reference can be made to the corresponding contents in the above embodiment. The table entry processing device 100 includes:

[0068] The determination module 101 is used to determine whether a VLAN is an uncontrollable VLAN according to the configuration information of the port bound to each VLAN, wherein the uncontrollable VLAN means that the message forwarded through the VLAN has the VLAN tag stripped before matching the ACL table entry in the outbound direction of the switching chip.

[0069] The application module 102 is used to apply for a category identifier CID for the VLAN when the VLAN is an uncontrollable VLAN.

[0070] The processing module 103 is used to generate an ACL table entry corresponding to the VLAN based on the CID, and send the ACL table entry to the ACL table in the outbound direction of the switch chip.

[0071] Optionally, the determining module 101 is specifically configured to determine that the VLAN is an uncontrollable VLAN if there is an Access port or a Trunk port without a VLAN tag or a Hybrid port without a VLAN tag among the ports bound to the VLAN.

[0072] Optionally, the processing module 103 is further configured to, when the VLAN is a layer 2 VLAN, establish a corresponding relationship between the VLAN and the CID applied for the VLAN, and send the corresponding relationship to the switching chip.

[0073] Optionally, when the VLAN is a layer-3 VLAN, the processing module 103 is further configured to search for all next hops corresponding to the VLAN in the routing table, bind the CID applied for the VLAN to all next hops, and update the table entries of all next hops in the switching chip with the bound CID.

[0074] Furthermore, the embodiment of the present invention also provides a network device 200, please refer to Figure 6 , the network device 200 may include a processor 210 and a switching chip 220 .

[0075] Among them, the processor 210 can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the table entry processing method provided by the above method embodiment, so as to generate corresponding ACL table entries in the outbound direction of the switching chip 220.

[0076] The switching chip 220 is used to forward the message to be forwarded with the VLAN tag stripped off out of the network device 200 after matching the corresponding ACL entry.

[0077] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0078] In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0079] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0080] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A table entry processing method, characterized in that: The method comprises: Determine whether the VLAN is an uncontrollable VLAN according to the configuration information of the port bound to each VLAN, wherein the uncontrollable VLAN refers to the VLAN forwarded by the message stripped of the VLAN tag before matching the ACL table entry in the outbound direction of the switching chip; In the case that the VLAN is the uncontrollable VLAN, applying for a category identifier CID for the VLAN; An ACL entry corresponding to the VLAN is generated based on the CID, and the ACL entry is sent to an ACL table in an outbound direction of the switching chip.

2. The table entry processing method according to claim 1, characterized in that: The step of determining whether the VLAN is an uncontrollable VLAN according to the configuration information of the port bound to each VLAN includes: If there is an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag among the ports bound to the VLAN, the VLAN is determined to be the uncontrollable VLAN.

3. The table entry processing method according to claim 1 or 2, characterized in that: When the VLAN is a layer 2 VLAN, after the step of applying for a category identifier CID for the VLAN, the method further includes: A corresponding relationship between the VLAN and the CID applied for the VLAN is established and sent to the switching chip.

4. The table entry processing method according to claim 1 or 2, characterized in that: When the VLAN is a layer-3 VLAN, after the step of applying for a category identifier CID for the VLAN, the method further includes: Search all next hops corresponding to the VLAN in the routing table, bind the CID applied for the VLAN to all the next hops, and update the table entries of all the next hops in the switching chip with the bound CID.

5. A table entry processing device, characterized in that: The device comprises: A determination module, used to determine whether the VLAN is an uncontrollable VLAN according to the configuration information of the port bound to each VLAN, wherein the uncontrollable VLAN refers to the message forwarded through the VLAN stripped of the VLAN tag before matching the ACL table entry in the outbound direction of the switching chip; An application module, used for applying for a category identifier CID for the VLAN when the VLAN is the uncontrollable VLAN; The processing module is used to generate an ACL table item corresponding to the VLAN based on the CID, and send the ACL table item to the ACL table in the outbound direction of the switching chip.

6. The device according to claim 5, characterized in that The determining module is specifically configured to determine that the VLAN is the uncontrollable VLAN if there is an Access port or a Trunk port without a VLAN tag or a Hybrid port without a VLAN tag among the ports bound to the VLAN.

7. The device according to claim 5 or 6, characterized in that The processing module is further used for establishing a corresponding relationship between the VLAN and the CID applied for the VLAN when the VLAN is a layer 2 VLAN, and sending the corresponding relationship to the switching chip.

8. The device according to claim 5 or 6, characterized in that The processing module is also used to search all next hops corresponding to the VLAN in the routing table when the VLAN is a layer-3 VLAN, bind the CID applied for the VLAN to all the next hops, and update the table entries of all the next hops in the switching chip with the bound CID.

9. A network device, characterized in that: The network device includes a processor and a switching chip: The processor is used to execute the table entry processing method according to any one of claims 1 to 4, so as to generate a corresponding ACL table entry in an outbound direction in a switching chip; The switching chip is used to forward the message to be forwarded with the VLAN tag stripped off out of the network device after matching the corresponding ACL entry.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the table entry processing method according to any one of claims 1 to 4 is implemented.

Images