Table entry processing method and apparatus, network device, and storage medium

Abstract

Embodiments of the present application provide a kind of entry processing method, device, network equipment and storage medium, it is related to data communication technical field.The method is according to the configuration information of the port of the VLAN binding, determine whether the VLAN is uncontrollable VLAN, wherein uncontrollable VLAN refers to the message forwarded through the VLAN is stripped VLAN tag before matching ACL entry in the ACL table of the out direction of switch chip;In the case where the VLAN is uncontrollable VLAN, apply category identifier CID for the VLAN;Based on the CID of the VLAN applied to generate the ACL entry corresponding to the VLAN, and be issued to the ACL table of the ACL table of the out direction of switch chip, so that switch chip carries out forwarding logic control to the message forwarded through the VLAN, guarantee the flexibility and security of network management.

Description

Technical Field

[0001] This invention relates to the field of data communication technology, and more specifically, to a table processing method, apparatus, network device, and storage medium. Background Technology

[0002] Network devices can use hardware chips to forward packets outwards. The main process executed by the hardware chip when a packet reaches the exit point is as follows: Figure 1 As shown, the process includes: a parser parsing the Layer 2 / Layer 3 / Layer 4 packet content; an interface mapper mapping VLANs (Virtual Local Area Networks) and selecting the final forwarding VLAN; editing the packet based on the packet forwarding information, such as removing VLAN tags; performing forwarding logic control on outgoing packets; and performing traffic scheduling on the egress direction.

[0003] Due to hardware chip limitations, if the VLAN tag in a packet has been removed before it enters the outbound forwarding logic control processing flow, it is not possible to use ACL (Access Control List) to perform forwarding logic control on outbound VLAN packets in specific scenarios, affecting the flexibility and security of network forwarding. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a table entry processing method, apparatus, network device and storage medium.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of the present invention are as follows:

[0006] In a first aspect, embodiments of the present invention provide a table entry processing method, the method comprising:

[0007] Based on the configuration information of the port bound to each VLAN, determine whether the VLAN is an uncontrollable VLAN. The uncontrollable VLAN refers to a packet forwarded through the VLAN whose VLAN tag has been stripped from the ACL entry in the outgoing direction of the matching switch chip.

[0008] If the VLAN is the uncontrollable VLAN, apply for a Category Identifier (CID) for the VLAN;

[0009] Based on the CID, generate the ACL entry corresponding to the VLAN, and send the ACL entry to the ACL table of the outgoing direction of the switching chip.

[0010] Optionally, the step of determining whether a VLAN is an uncontrollable VLAN based on the configuration information of the ports bound to each VLAN includes:

[0011] If the VLAN is bound to an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag, then the VLAN is determined to be the uncontrollable VLAN.

[0012] Optionally, when the VLAN is a Layer 2 VLAN, after the step of applying for a Category Identifier (CID) for the VLAN, the method further includes:

[0013] Establish the correspondence between the VLAN and the CID applied for for it, and send it to the switching chip.

[0014] Optionally, when the VLAN is a Layer 3 VLAN, after the step of applying for a Category Identifier (CID) for the VLAN, the method further includes:

[0015] The system searches the routing table for all next hops corresponding to the VLAN, binds the CID applied for for the VLAN to all the next hops, and updates the entries of all the next hops in the switching chip with the bound CIDs.

[0016] In a second aspect, embodiments of the present invention provide a form processing apparatus, the apparatus comprising:

[0017] The determination module is used to determine whether the VLAN is an uncontrollable VLAN based on the configuration information of the port bound to each VLAN. The uncontrollable VLAN refers to a packet forwarded through the VLAN whose VLAN tag has been stripped from the ACL entry in the outgoing direction of the matching switch chip.

[0018] The application module is used to apply for a Category Identifier (CID) for the VLAN when the VLAN is the uncontrollable VLAN.

[0019] The processing module is used to generate the ACL entry corresponding to the VLAN based on the CID, and send the ACL entry to the ACL table of the outgoing direction of the switching chip.

[0020] Optionally, the determining module is specifically used to determine that the VLAN is the uncontrollable VLAN if there is an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag among the ports bound to the VLAN.

[0021] Optionally, the processing module is further configured to establish a correspondence between the VLAN and the CID applied for for it when the VLAN is a Layer 2 VLAN, and send it to the switching chip.

[0022] Optionally, the processing module is further configured to, when the VLAN is a Layer 3 VLAN, search for all next hops corresponding to the VLAN in the routing table, bind the CID applied for for the VLAN to all the next hops, and update the entries of all the next hops in the switching chip with the bound CID.

[0023] Thirdly, embodiments of the present invention provide a network device, the network device including a processor and a switching chip:

[0024] The processor is configured to execute the entry processing method described in the first aspect, so as to generate corresponding ACL entries in the outgoing direction of the switching chip;

[0025] The switching chip is used to forward packets stripped of their VLAN tags to the network device after matching the corresponding ACL entries.

[0026] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the table processing method as described in the first aspect.

[0027] The table entry processing method provided in this embodiment of the invention involves: determining whether the VLAN is an uncontrollable VLAN based on the configuration information of the port bound to the VLAN; wherein an uncontrollable VLAN refers to a packet forwarded through the VLAN whose VLAN tag has been stripped before the ACL entry in the outgoing matching switch chip; if the VLAN is an uncontrollable VLAN, applying for a Category Identifier (CID) for the VLAN; generating the corresponding ACL entry for the VLAN based on the applied CID, and sending it to the outgoing ACL table of the switch chip. Because this embodiment of the invention applies for a Category Identifier (CID) for the uncontrollable VLAN and uses the applied CID to generate the corresponding ACL entry in the ACL table and send it to the switch chip, the switch chip can perform forwarding logic control on packets to be forwarded after the VLAN tag has been stripped, ensuring the flexibility and security of network management.

[0028] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0029] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This diagram illustrates an outbound message processing procedure provided by an embodiment of the present invention.

[0031] Figure 2 This diagram illustrates a flowchart of a table entry processing method provided by an embodiment of the present invention. Figure 1 ;

[0032] Figure 3 This diagram illustrates a flowchart of a table entry processing method provided by an embodiment of the present invention. Figure 2 ;

[0033] Figure 4 This diagram illustrates a flowchart of a table entry processing method provided by an embodiment of the present invention. Figure 3 ;

[0034] Figure 5 This diagram shows a functional unit block diagram of a form processing device provided in an embodiment of the present invention;

[0035] Figure 6 A schematic block diagram of a network device provided in an embodiment of the present invention is shown.

[0036] Icons: 100 - Entry processing device; 101 - Determination module; 102 - Request module; 103 - Processing module; 200 - Network device; 210 - Processor; 220 - Switching chip. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0038] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0039] It should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0040] In order to enable the switching chip to perform forwarding logic control on packets with VLAN tags removed during the outbound processing flow, thereby ensuring the flexibility and security of network management, this invention provides an entry processing method for switching chips, which will be described in detail below.

[0041] Please refer to Figure 2 The table entry processing method includes steps S101 to S103.

[0042] S101 determines whether a VLAN is an uncontrollable VLAN based on the configuration information of the port bound to each VLAN.

[0043] The switching chip uses an ACL table to control packet forwarding logic. The ACL table contains ACL entries corresponding to each VLAN. In this embodiment of the invention, VLANs can be divided into controllable VLANs and uncontrollable VLANs. A controllable VLAN is one in which packets forwarded through the VLAN carry a VLAN tag when matching the outgoing ACL entry of the switching chip. An uncontrollable VLAN is one in which packets forwarded through the VLAN have their VLAN tag stripped before matching the outgoing ACL entry of the switching chip.

[0044] The configuration information for each port bound to a VLAN includes the port type and tagging information. A VLAN is bound to at least one port, and the port type and tagging information of these ports determine whether the VLAN is an uncontrollable VLAN.

[0045] In a possible implementation, step S101 can be implemented as follows:

[0046] First, determine whether there are Access ports, Trunk ports without VLAN tags, or Hybrid ports without VLAN tags among the ports bound to the VLAN.

[0047] Access ports typically allow only one VLAN's packets to pass through, and the packets do not need to carry VLAN tags.

[0048] For trunk ports (aggregated ports), if the PVID (Port VLAN ID) of this type of port is the same as the VLAN tag in the forwarded packet, the VLAN tag in the packet will be stripped.

[0049] Hybrid ports are ports configured as untagd, meaning that packets will not carry VLAN tags when passing through this type of port.

[0050] If the VLAN is bound to an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag, then the VLAN is determined to be an uncontrollable VLAN.

[0051] Understandably, if there is an Access port among the ports bound to the VLAN, the VLAN tag in the packets forwarded through the VLAN to the Access port will be stripped before matching the ACL entries in the switching chip, making it impossible to perform ACL entry matching based on VLAN tags, and thus impossible to perform the corresponding forwarding logic control on the packets.

[0052] Similarly, if there is a trunk port without a VLAN tag among the ports bound to the VLAN, the VLAN tag in the packets forwarded through the VLAN to the trunk port without a VLAN tag will be stripped before matching the ACL entries in the switching chip, making it impossible to perform ACL entry matching based on VLAN tags, and thus impossible to perform the corresponding forwarding logic control on the packets.

[0053] If there is a Hybrid port without a VLAN tag among the ports bound to the VLAN, then the VLAN tag in the packets forwarded through the VLAN to the Hybrid port without a VLAN tag will be stripped before matching the ACL entries in the switching chip, making it impossible to perform ACL entry matching based on VLAN tag, and thus unable to perform the corresponding forwarding logic control on the packets.

[0054] If none of the following three types of ports are present in the ports bound to the VLAN: Access port, Trunk port without VLAN tag, or Hybrid port without VLAN tag, then the VLAN is determined to be a controllable VLAN.

[0055] Understandably, if there are no Access ports, Trunk ports without VLAN tags, or Hybrid ports without VLAN tags among the ports bound to the VLAN, then the VLAN tags in packets forwarded through the VLAN to the port bound to the VLAN will not be stripped before matching the ACL entries in the switching chip. This allows for ACL entry matching based on VLAN tags and corresponding forwarding logic control of the packets.

[0056] S102, if the VLAN is an uncontrollable VLAN, apply for a Category Identifier (CID) for the VLAN.

[0057] Packet forwarding is achieved by using a CID (Category ID, a resource in the switching chip) applied for for this uncontrollable VLAN. A CID is a resource of the switching chip that can be applied for when it is used.

[0058] There are two scenarios for implementing step S102: one is that the VLAN is a Layer 2 forwarding VLAN, and the other is that the VLAN is a Layer 3 forwarding VLAN.

[0059] In the case where "the VLAN is a Layer 2 forwarding VLAN", the implementation process of step S102 is to apply for a CID for the VLAN in the inbound processing flow, which can be called the source CID.

[0060] In the case where "the VLAN is a Layer 3 forwarding VLAN", the implementation process of step S102 involves applying for a CID for the VLAN in the outgoing processing flow, which can be called the destination CID.

[0061] In this embodiment of the invention, when binding an ACL entry based on a Layer 3 VLAN, the destination CID for the Layer 3 forwarding VLAN application is used.

[0062] S103 generates the ACL entry corresponding to the VLAN based on the CID and sends the ACL entry to the ACL table of the outgoing direction of the switching chip.

[0063] For the scenario where "this VLAN is a Layer 2 forwarding VLAN", please refer to... Figure 3 After applying for a CID for the VLAN, step S104 needs to be executed: establishing the mapping relationship between the VLAN and the applied CID, and then sending it to the switching chip. In this embodiment, not only is the mapping attribute between the VLAN and CID sent to the switching chip, but by extracting the mapping attribute between the VLAN and CID, the CID of the VLAN is used as the basic matching item for the ACL entry and sent. When a packet uses this matching item, it is equivalent to matching the corresponding VLAN.

[0064] In this embodiment of the invention, after applying for a CID for a Layer 2 forwarding VLAN, the switching chip can determine the corresponding ACL entry from the ACL table based on which Layer 2 forwarding VLAN the packet is forwarded by, and then based on the mapping attribute between the VLAN and the CID, to perform forwarding logic control on the packet.

[0065] For the scenario where "this VLAN is a Layer 3 forwarding VLAN", please refer to... Figure 4 After applying for a CID for the VLAN, step S105 is required: search for all next hops corresponding to the VLAN in the routing table, bind the CID applied for for the VLAN to all the found next hops, and update the entries of all next hops in the switching chip with the bound CID.

[0066] In this embodiment of the invention, after applying for a CID for a Layer 3 VLAN, all routing tables corresponding to the current VLAN are queried, and all corresponding next hops are found. The CID attribute in all found next hops is updated so that all routing tables forwarding within the Layer 3 VLAN contain the CID attribute. Matching the CID in the routing table means matching the VLAN. By extracting the VLAN-to-CID mapping attribute and adding a Layer 3 forwarding flag, the CID and the Layer 3 forwarding flag are used as the basic matching item for the ACL. Matching this value is equivalent to matching the corresponding VLAN. The switching chip can determine which Layer 3 forwarding VLAN will forward the packet based on the determined next hop, and then determine the corresponding ACL entry from the ACL table to perform forwarding logic control on the packet.

[0067] To perform the corresponding steps in the above embodiments and various possible methods, an implementation of the table entry processing device 100 is given below. Please refer to [link to relevant documentation]. Figure 5 , Figure 5 This is a functional block diagram of a form processing device 100 provided in an embodiment of the present invention. It should be noted that the basic principle and technical effects of the form processing device 100 provided in this embodiment are the same as those in the above embodiments. For the sake of brevity, any parts not mentioned in this embodiment can be referred to the corresponding content in the above embodiments. The form processing device 100 includes:

[0068] The determination module 101 is used to determine whether a VLAN is an uncontrollable VLAN based on the configuration information of the port bound to each VLAN. An uncontrollable VLAN refers to a packet forwarded through the VLAN whose VLAN tag has been stripped from the ACL entry in the outgoing direction of the matching switch chip.

[0069] Application module 102 is used to apply for a category identifier (CID) for a VLAN when the VLAN is an uncontrollable VLAN.

[0070] The processing module 103 is used to generate ACL entries corresponding to VLANs based on CIDs and send the ACL entries to the ACL table of the outgoing direction of the switching chip.

[0071] Optionally, the determination module 101 is specifically used to determine that if there is an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag among the ports bound to the VLAN, then the VLAN is determined to be an uncontrollable VLAN.

[0072] Optionally, the processing module 103 is also used to establish a correspondence between the VLAN and the CID applied for for it when the VLAN is a Layer 2 VLAN, and to send it to the switching chip.

[0073] Optionally, the processing module 103 is also used to, when the VLAN is a Layer 3 VLAN, look up all the next hops corresponding to the VLAN in the routing table, bind the CID applied for for the VLAN to all the next hops, and update the entries of all the next hops in the switching chip with the bound CIDs.

[0074] Furthermore, this embodiment of the invention also provides a network device 200, please refer to... Figure 6 The network device 200 may include a processor 210 and a switching chip 220.

[0075] The processor 210 can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of a program that controls the table entry processing method provided in the above method embodiments, so as to generate corresponding ACL entries in the outgoing direction of the switching chip 220.

[0076] The switching chip 220 is used to forward packets with VLAN tags removed to the network device 200 after matching the corresponding ACL entries.

[0077] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0078] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0079] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0080] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for processing table entries, characterized in that, The method includes: Based on the configuration information of the port bound to each VLAN, determine whether the VLAN is an uncontrollable VLAN. The uncontrollable VLAN refers to a packet forwarded through the VLAN whose VLAN tag has been stripped from the ACL entry in the outgoing direction of the matching switch chip. If the VLAN is the uncontrollable VLAN, apply for a Category Identifier (CID) for the VLAN; Based on the CID, an ACL entry corresponding to the VLAN is generated, and the ACL entry is sent to the ACL table of the outgoing direction of the switching chip, so that the switching chip performs ACL matching on the packet to be forwarded without VLAN tag based on the CID in the outgoing direction, and controls the packet forwarding logic of the VLAN. The step of determining whether a VLAN is an uncontrollable VLAN based on the configuration information of the ports bound to each VLAN includes: If the VLAN is bound to an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag, then the VLAN is determined to be the uncontrollable VLAN.

2. The table entry processing method as described in claim 1, characterized in that, When the VLAN is a Layer 2 VLAN, after the step of applying for a Category Identifier (CID) for the VLAN, the method further includes: Establish the correspondence between the VLAN and the CID applied for for it, and send it to the switching chip.

3. The table entry processing method as described in claim 1, characterized in that, When the VLAN is a Layer 3 VLAN, after the step of applying for a Class Identifier (CID) for the VLAN, the method further includes: The system searches the routing table for all next hops corresponding to the VLAN, binds the CID applied for for the VLAN to all the next hops, and updates the entries of all the next hops in the switching chip with the bound CIDs.

4. A form processing apparatus, characterized in that, The device includes: The determination module is used to determine whether the VLAN is an uncontrollable VLAN based on the configuration information of the port bound to each VLAN. The uncontrollable VLAN refers to a packet forwarded through the VLAN whose VLAN tag has been stripped from the ACL entry in the outgoing direction of the matching switch chip. The application module is used to apply for a Category Identifier (CID) for the VLAN when the VLAN is the uncontrollable VLAN. The processing module is used to generate an ACL entry corresponding to the VLAN based on the CID, and send the ACL entry to the ACL table in the outgoing direction of the switching chip, so that the switching chip performs ACL matching on the packet to be forwarded with the VLAN tag removed based on the CID in the outgoing direction, and controls the packet forwarding logic of the VLAN. The determining module is specifically used to determine that the VLAN is the uncontrollable VLAN if there is an Access port, a Trunk port without a VLAN tag, or a Hybrid port without a VLAN tag among the ports bound to the VLAN.

5. The apparatus as described in claim 4, characterized in that, The processing module is further configured to establish a correspondence between the VLAN and the CID applied for for it when the VLAN is a Layer 2 VLAN, and then send it to the switching chip.

6. The apparatus as claimed in claim 4, characterized in that, The processing module is further configured to, when the VLAN is a Layer 3 VLAN, search for all next hops corresponding to the VLAN in the routing table, bind the CID applied for for the VLAN to all the next hops, and update the entries of all the next hops in the switching chip with the bound CID.

7. A network device, characterized in that, The network device includes a processor and a switching chip: The processor is configured to execute the entry processing method according to any one of claims 1-3, so as to generate corresponding ACL entries in the outgoing direction of the switching chip; The switching chip is used to forward packets stripped of their VLAN tags to the network device after matching the corresponding ACL entries.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the table entry processing method as described in any one of claims 1-3.

Images