Data processing method and device, computer equipment and readable storage medium

Abstract

Embodiments of the invention provide a data processing method and apparatus, a computer device and a readable storage medium. The method comprises the steps of obtaining a to-be-forwarded data packet in a data layer; matching forwarding field information in the data packet with the S session state tables to obtain a matching result; s is a positive integer greater than 1; the S session state tables are obtained by performing table division processing on a full connection state table in a control layer; the field information of the S session state tables comprises the field information of the full connection state table; if the matching result indicates that the matching is successful, updating the forwarding field information based on S session state tables to obtain updated forwarding field information; the updated forwarding field information is used for updating the data packet to obtain an updated data packet, and forwarding the updated data packet. By adopting the method and the device, the table item specification supported by the switch can be improved without increasing extra hardware cost.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a data processing method, apparatus, computer equipment, and readable storage medium. Background Art

[0002] The existing switch-oriented table expansion algorithm can insert an FPGA (Field-Programmable Gate Array) card into the switch through a PCIe (peripheral component interconnect express) slot, thereby storing a fully connected state table in the FPGA card to increase the table item specifications supported by the switch. However, the method of expanding table items with an external FPGA card requires the purchase of an additional FPGA card, which will increase additional hardware costs (i.e., gateway costs). Summary of the invention

[0003] The embodiments of the present application provide a data processing method, apparatus, computer device, and readable storage medium, which can improve the table item specifications supported by the switch without increasing additional hardware costs.

[0004] On the one hand, an embodiment of the present application provides a data processing method, which is executed by a switch with a gateway forwarding function, and the switch includes a data layer and a control layer, including:

[0005] Obtain data packets to be forwarded in the data layer;

[0006] Match the forwarding field information in the data packet with S session state tables to obtain a matching result; S is a positive integer greater than 1; the S session state tables are obtained by subdividing the full connection state table in the control layer; the field information of the S session state tables includes the field information of the full connection state table;

[0007] If the matching result indicates a successful match, the forwarding field information is updated based on the S session state tables to obtain updated forwarding field information; the updated forwarding field information is used to update the data packet to obtain an updated data packet, and the updated data packet is forwarded.

[0008] On one hand, an embodiment of the present application provides a data processing device, which runs on a switch with a gateway forwarding function. The switch includes a data layer and a control layer, including:

[0009] A data packet acquisition module, used to acquire data packets to be forwarded in the data layer;

[0010] The state table matching module is used to match the forwarding field information in the data packet with S session state tables to obtain a matching result; S is a positive integer greater than 1; the S session state tables are obtained by performing table-splitting processing on the full connection state table in the control layer; the field information of the S session state tables includes the field information of the full connection state table;

[0011] The data packet update module is used to update the forwarding field information based on S session state tables to obtain updated forwarding field information if the matching result indicates a successful match; the updated forwarding field information is used to update the data packet to obtain an updated data packet, and the updated data packet is forwarded.

[0012] Wherein, the S session state tables in the data layer include a first session state table and a second session state table;

[0013] The state table matching module includes:

[0014] A first matching unit, configured to obtain forwarding field information from header information of a data packet, and match the forwarding field information with a first session state table among the S session state tables to obtain a first candidate matching result;

[0015] a second matching unit, configured to obtain conversion field information from the first session state table if the first candidate matching result indicates a successful match, and match the conversion field information with a second session state table in the S session state tables to obtain a matching result;

[0016] The state table matching module also includes:

[0017] The data packet processing unit is used to send the data packet to the control layer if the first candidate matching result indicates a matching failure, and perform data packet processing on the data packet through the control layer.

[0018] The first session state table includes a pre-processing table and a session table; the forwarding field information includes pre-processing field information and session field information;

[0019] The first matching unit comprises:

[0020] A first matching subunit, used for matching the preprocessing field information in the forwarding field information with the preprocessing table to obtain a second candidate matching result;

[0021] A hash compression subunit is used to obtain candidate field information in the second candidate matching result, perform hash compression on the candidate field information, and generate hash field information corresponding to the candidate field information;

[0022] The second matching subunit is used to match the hash field information and the session field information in the forwarding field information with the session table to obtain a first candidate matching result.

[0023] The preprocessing field information includes first preprocessing field information and second preprocessing field information; the preprocessing table includes a first preprocessing table and a second preprocessing table;

[0024] a first matching subunit, specifically used to match the first preprocessing field information in the preprocessing field information with the first preprocessing table, and if the first key field corresponding to the first preprocessing field information exists in the first preprocessing table, obtain the first value field corresponding to the first key field, and determine the first value field as the first candidate field information; if the first key field corresponding to the first preprocessing field information does not exist in the first preprocessing table, determine the first candidate value field as the first candidate field information;

[0025] a first matching subunit, specifically used to match the second preprocessing field information in the preprocessing field information with the second preprocessing table, and if the second key field corresponding to the second preprocessing field information exists in the second preprocessing table, obtain the second value field corresponding to the second key field, and determine the second value field as the second candidate field information; if the second key field corresponding to the second preprocessing field information does not exist in the second preprocessing table, determine the second candidate value field as the second candidate field information;

[0026] The first matching subunit is specifically configured to determine the first candidate field information and the second candidate field information as candidate field information, and generate a second candidate matching result including the candidate field information.

[0027] The candidate field information includes first candidate field information and second candidate field information;

[0028] A hash compression subunit, specifically used to perform a hash operation on the first candidate field information to generate a first hash value corresponding to the first candidate field information;

[0029] The hash compression subunit is specifically used to perform a hash operation on the second candidate field information to generate a second hash value corresponding to the second candidate field information;

[0030] The hash compression subunit is specifically used to perform an XOR process on the first hash value and the second hash value to generate hash field information corresponding to the candidate field information.

[0031] The second matching subunit is specifically used to match the session field information in the hash field information and the forwarding field information with the session table, and if there is a third key field corresponding to the hash field information and the session field information in the session table, obtain a third value field corresponding to the third key field, and generate a first candidate matching result indicating a successful match based on the third value field;

[0032] The second matching subunit is specifically configured to generate a first candidate matching result indicating a matching failure if the third key field corresponding to the hash field information and the session field information does not exist in the session table.

[0033] The second matching unit is specifically used to obtain conversion field information from the first session state table; the conversion field information belongs to the third value field;

[0034] A second matching unit is specifically configured to match the conversion field information with a second session state table in the S session state tables, and if a fourth key field corresponding to the conversion field information exists in the second session state table, obtain a fourth value field corresponding to the fourth key field, and generate a matching result indicating a successful match based on the fourth value field;

[0035] A second matching unit, specifically configured to generate a matching result indicating a matching failure if the fourth key field corresponding to the conversion field information does not exist in the second session state table;

[0036] The second matching unit is further specifically configured to discard the data packet if the matching result indicates a matching failure.

[0037] The data packet processing unit includes:

[0038] The data packet sending subunit is used to send the data packet to the control layer and obtain the data packet in the control layer;

[0039] a field updating subunit, configured to match the forwarding field information with the fully connected state table, and if the fifth key field corresponding to the forwarding field information exists in the fully connected state table, obtain the fifth value field corresponding to the fifth key field, and update the forwarding field information based on the fifth value field to obtain the updated forwarding field information;

[0040] The state table update subunit is used to update the fully connected state table based on the forwarding field information if the fifth key field corresponding to the forwarding field information does not exist in the fully connected state table, send a state table update notification to the data layer, obtain the state table update notification in the data layer, and update S session state tables based on the state table update notification.

[0041] The data packet sending subunit is specifically used to send the data packet to the control layer and receive the data packet in the control layer;

[0042] The data packet sending subunit is specifically used to match the data packet with the conversion rule to obtain a rule matching result;

[0043] The data packet sending subunit is specifically used to obtain the data packet in the control layer if the rule matching result indicates a successful match;

[0044] The data packet sending subunit is further specifically configured to discard the data packet if the rule matching result indicates a matching failure.

[0045] Among them, the number of fully connected state tables is H, and H is a positive integer greater than 1;

[0046] A field update subunit, specifically used to obtain a fully connected state table corresponding to the data packet type of the data packet from H fully connected state tables, and match the forwarding field information with the fully connected state table corresponding to the data packet type;

[0047] The field updating subunit is specifically used to obtain the fifth value field corresponding to the fifth key field if there is a fifth key field corresponding to the forwarding field information in the full connection state table corresponding to the data packet type;

[0048] The field updating subunit is specifically used to update the forwarding field information based on the fifth value field and the data packet type to obtain updated forwarding field information.

[0049] The field update subunit is specifically used to update the source field information in the forwarding field information through the fifth value field if the data packet type is an intranet-to-public network type, to obtain the updated forwarding field information;

[0050] The field updating subunit is specifically used to update the target field information in the forwarding field information through the fifth value field if the data packet type is a public network to intranet type, so as to obtain the updated forwarding field information.

[0051] Among them, the state table update subunit is specifically used to generate public network conversion information corresponding to the forwarding field information if the data packet type is an intranet-to-public network type;

[0052] A state table update subunit, specifically used to update H fully connected state tables based on forwarding field information and public network conversion information;

[0053] The state table updating subunit is also specifically used to discard the data packet if the data packet type is a public network to intranet type.

[0054] Wherein, S session state tables are associated with the data packet type of the data packet;

[0055] A data packet updating module, specifically used to obtain auxiliary field information in the fourth value field and the third value field from S session state tables corresponding to the data packet type;

[0056] A data packet updating module, specifically used to update the source field information in the forwarding field information through the fourth value field and the auxiliary field information if the data packet type is an intranet-to-public network type, to obtain updated forwarding field information;

[0057] The data packet updating module is specifically used to update the target field information in the forwarding field information through the fourth value field and the auxiliary field information if the data packet type is a public network to intranet type, so as to obtain the updated forwarding field information.

[0058] An embodiment of the present application provides a computer device, including: a processor and a memory;

[0059] The processor is connected to the memory, wherein the memory is used to store a computer program. When the computer program is executed by the processor, the computer device executes the method provided in the embodiment of the present application.

[0060] On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. The computer program is suitable for being loaded and executed by a processor so that a computer device having the processor executes the method provided by the embodiment of the present application.

[0061] In one aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the method provided in the embodiment of the present application.

[0062] In an embodiment of the present application, a switch with a gateway forwarding function can obtain a data packet to be forwarded in the data layer, match the forwarding field information in the data packet with S session state tables, and obtain a matching result. Wherein, S here can be a positive integer greater than 1; the S session state tables are obtained by performing table-splitting processing on the full connection state table in the control layer, and the field information of the S session state tables includes the field information of the full connection state table. Further, if the matching result indicates that the match is successful, the switch can update the forwarding field information based on the S session state tables to obtain the updated forwarding field information. Wherein, the updated forwarding field information is used to update the data packet, obtain the updated data packet, and forward the updated data packet. It can be seen from this that the embodiment of the present application can extract the field information in the full connection state table into S session state tables (that is, extract the field information that appears repeatedly in the session table entry into a small table, or extract the field information that occupies a large space in the session table entry into a small table), and store S session state tables in the data layer and store the full connection state table in the control layer, so that the forwarding processing of the data packet can be realized without storing the full connection state table in the data layer. In addition, since the same field information in the S session state tables can correspond to different data packets, storing session table entries through the S session state tables does not require an external FPGA card on the switch, thereby improving the table entry specifications supported by the switch without increasing additional hardware costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a structural diagram of a network architecture provided by an embodiment of the present application;

[0064] Figure 2 This is a schematic diagram of a scenario for data interaction provided by an embodiment of the present application;

[0065] Figure 3 It is a flowchart of a data processing method provided in an embodiment of the present application;

[0066] Figure 4 This is a schematic diagram of a scenario for data processing provided by an embodiment of the present application;

[0067] Figure 5 It is a flowchart of a data processing method provided in an embodiment of the present application;

[0068] Figure 6 is a structural schematic diagram of a data processing device provided in an embodiment of the present application;

[0069] Figure 7 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0071] See also Figure 1 , Figure 1 Schematic diagram of a network architecture provided by an embodiment of the present application. Figure 1 As shown, the network architecture may include a switch 2000 and a device cluster. The device cluster may include one or more devices. The number of devices in the device cluster is not limited here. Figure 1 As shown, the multiple devices may specifically include device 3000a, device 3000b, ..., device 3000n; device 3000a, device 3000b, ..., device 3000n may respectively be directly or indirectly connected to the switch 2000 via wired or wireless communication, so that each device may exchange data with the switch 2000 via the network connection.

[0072] Each device in the device cluster may include: terminal devices, servers, switches, etc. The terminal devices may include smart phones, tablet computers, laptops, desktop computers, intelligent voice interaction devices, smart home appliances (e.g., smart TVs), wearable devices, vehicle terminals, aircraft, and other smart terminals with data processing functions. Among them, the vehicle terminal may be a terminal device in smart transportation scenarios and assisted driving scenarios. Similarly, each device in the device cluster may be directly or indirectly connected to the network through wired or wireless communication, so that each device may exchange data through the network connection.

[0073] For example, device 3000a may be a server, device 3000b may be a terminal device, and device 3000n may be a switch other than switch 2000. Server 3000a may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0074] For ease of understanding, the embodiments of the present application can be Figure 1 Select one device from among the multiple devices in the device cluster as the first device, Figure 1 Select one device from the multiple devices in the device cluster shown as the second device. Figure 1The terminal device 3000b shown in the figure is used as the first device. Figure 1 The server 3000a shown is used as the second device. The switch 2000 can receive data packets sent by devices in the device cluster, and can also forward data packets according to the business arrangement logic requirements; for example, the first device can send a data packet to the switch 2000, and the switch 2000 can forward the data packet sent by the first device to the second device; the second device can send a data packet to the switch 2000, and the switch 2000 can forward the data packet sent by the second device to the first device.

[0075] It should be understood that the data processing method provided in the embodiment of the present application can be executed by a computer device, and the computer device can realize the transmission of data packets through cloud technology. Among them, the data processing method provided in the embodiment of the present application can be executed by a switch (for example, switch 2000) with a gateway forwarding function, and switch 2000 can forward data packets, that is, switch 2000 can bear the forwarding requirements of the state gateway (that is, the stateful gateway).

[0076] Gateway is also called network connector or protocol converter. Gateway realizes network interconnection above the network layer. It is a complex network interconnection device used to interconnect two networks with different high-level protocols. Gateway can be used for both wide area network interconnection and local area network interconnection. Gateway is a computer system or device that performs the important task of conversion.

[0077] Among them, cloud technology refers to a hosting technology that unifies hardware, software, network and other resources in a wide area network or local area network to realize data computing, storage, processing and sharing. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model application, which can form a resource pool, which is used on demand and flexible and convenient. The background services of the technical network system require a large amount of computing and storage resources, such as video websites, picture websites and more portal websites. With the rapid development and application of the Internet industry, each item may have its own identification mark in the future, and it needs to be transmitted to the background system for logical processing. Data of different levels will be processed separately, and all kinds of industry data need strong system backing support to be realized through cloud computing. Among them, cloud computing is a computing model that distributes computing tasks on a resource pool composed of a large number of computers, so that various application systems can obtain computing power, storage space and information services as needed. The network that provides resources is called "cloud". The resources in the "cloud" are infinitely expandable in the eyes of users, and can be obtained at any time, used on demand, expanded at any time, and paid for by use.

[0078] In other words, the switch 2000 in the embodiment of the present application may have the function of a stateful gateway, and the stateful gateway may include but is not limited to a NAT (Network Address Translation) gateway, an ACL (Access Control List) gateway, and a load balancing gateway. Among them, the stateful gateway may match the received data packet header field information (i.e., the header information of the data packet) according to the conversion rule. If the conversion rule is matched, a corresponding session (i.e., a table entry) will be generated, and the session will be serviced; compared with other data packets that do not hit the conversion rule, the data packet with the session will receive faster service processing.

[0079] Among them, the NAT gateway can provide address translation services for devices that need to leave the public network (for example, servers) or enter the intranet (for example, servers), the ACL gateway can provide filtering services for data packets with security settings (if the rules are hit, they will pass, if the rules are not hit, they will not pass), and the load balancing gateway can provide diversion services for incoming traffic in large traffic scenarios. In particular, when the switch 2000 has the function of a NAT gateway, the switch 2000 can be a switch with a gateway forwarding function. Therefore, the stateful gateway in the embodiment of the present application is mainly a NAT gateway responsible for converting the internal and external network IP addresses. Its core task is to map the intranet IP and port to the same public network IP and different ports, thereby converging the public network IP and saving the public network IP cost.

[0080] It is understandable that the switch 2000 can be a white box programmable switch (i.e. a programmable white box switch, such as Intel's Tofino switch), which needs to be able to support the deployment of containers and secondary development capabilities (e.g., programmable packet forwarding processes, i.e., modifying packet forwarding logic on demand), so as to improve the forwarding performance of the switch. In other words, the switch 2000 in the embodiment of the present application can be a white box programmable switch for implementing a stateful gateway. White box refers to the decoupling of the physical hardware and operating system in the network, allowing standardized hardware configurations to be combined and matched with different software protocols to form a more open and flexible network solution, and significantly reduce the cost of network construction.

[0081] It should be understood that the switch 2000 may include a CPU (central processing unit) chip and an ASIC (Application Specific Integrated Circuit) chip, and the memory of the CPU chip is larger than the memory of the ASIC chip; the ASIC chip may be a dedicated integrated chip for the switch 2000, and the CPU chip may be a mainstream chip in the industry (for example, Intel 8310). The switch may include a data plane and a control plane, the data plane may run on the ASIC chip, and the control plane may run on the CPU chip; the ASIC chip and the CPU chip may be interconnected via PCIe, that is, the data plane and the control plane may be interconnected via PCIe.

[0082] It should be understood that the above network framework can be applied to cloud conference scenarios, live broadcast scenarios, cloud game scenarios, etc., and specific business scenarios will not be listed one by one here. Cloud gaming, also known as gaming on demand, is an online gaming technology based on cloud computing technology. Cloud gaming technology enables thin clients with relatively limited graphics processing and data computing capabilities to run high-quality games. In the cloud gaming scenario, the game is not run on the player's game terminal, but on the cloud server, and the cloud server renders the game scene as a video and audio stream and transmits it to the player's game terminal through the network. The player's game terminal does not need to have powerful graphics computing and data processing capabilities, but only needs to have basic streaming media playback capabilities and the ability to obtain player input instructions and send them to the cloud server. Cloud conferencing is an efficient, convenient and low-cost conference format based on cloud computing technology. Users only need to use the Internet interface and perform simple and easy-to-use operations to quickly and efficiently share voice, data files and videos with teams and customers around the world, and the complex technologies such as data transmission and processing in the meeting are operated by the cloud conferencing service provider to help users.

[0083] Accordingly, the first device, the second device and the switch 2000 can transmit data packets in cloud conference scenarios, live broadcast scenarios and cloud game scenarios. For example, in a cloud conference scenario, the second device can send conference materials to the first device through the switch 2000, and at this time, the conference materials can be transmitted between the first device, the second device and the switch 2000 in the form of data packets. For another example, in a live broadcast scenario, the first device can send live video data to the second device through the switch 2000, and at this time, the live video data can be transmitted between the first device, the second device and the switch 2000 in the form of data packets. For another example, in a cloud game scenario, the second device can send a cloud trial video to the first device through the switch 2000, and at this time, the cloud trial video can be transmitted between the first device, the second device and the switch 2000 in the form of data packets.

[0084] For further understanding, please refer to Figure 2 , Figure 2 Schematic diagram of a scenario for data interaction provided by an embodiment of the present application. Figure 2 The switch 20a shown may be the above Figure 1 The switch 2000 in the corresponding embodiment is as follows: Figure 2 The terminal device 20b shown may be the above Figure 1 The first device in the corresponding embodiment, such as Figure 2 The server 20c shown may be the above Figure 1 The second device in the corresponding embodiment.

[0085] For ease of understanding, the present application embodiment takes the example of terminal device 20b sending a data packet to server 20c through switch 20a. When the present application embodiment is applied to a live broadcast scene, the data packet here can represent live video data in the live broadcast scene. The user corresponding to terminal device 20b can initiate a live broadcast through terminal device 20b, and terminal device 20b can send the live video data captured during the live broadcast to server 20c.

[0086] Among them, the switch 20a may include a data layer and a control layer, the control layer may include a full connection state table (referred to as the full connection table), and the data layer may include S session state tables, the S session state tables are obtained by sub-table processing of the full connection state table, therefore, the field information of the S session state tables may include the field information of the full connection state table; the field information of the S session state tables is more than the field information of the full connection state table.

[0087] Here, S can be a positive integer greater than 1, and the S session state tables can specifically include session state tables 21a, ..., and session state table 21b. It should be understood that the embodiment of the present application does not limit the field information of each session state table in the S session state tables, and different field information can conveniently expand the embodiment of the present application to adapt to data sets of different sizes.

[0088] like Figure 2 As shown, the terminal device 20b can obtain the data packet corresponding to the live video data (the data packet corresponding to the live video data can be the first packet of the data stream corresponding to the live video data), and send the data packet corresponding to the live video data through S21 (for example, the terminal device can send the data packet to the switch 20a through S21). In this way, the switch 20a can obtain the data packet to be forwarded in the data layer (the switch 20a can receive the data packet to be forwarded through the switch port), match the forwarding field information in the data packet with S session state tables (i.e., session state table 21a, ..., session state table 21b), and obtain a matching result. Further, if the matching result indicates a successful match, the switch 20a can forward the data packet based on the S session state tables. Optionally, if the matching result indicates a failed match, the switch 20a can discard the data packet.

[0089] The switch 20a can update the forwarding field information based on the S session state tables to obtain updated forwarding field information, and then update the data packet according to the updated forwarding field information to obtain an updated data packet. The updated forwarding field information is used to forward the updated data packet.

[0090] like Figure 2 As shown, the switch 20a can forward the updated data packet through S22 (for example, the switch 20a can send the updated data packet to the server 20c through S22), so that after receiving the updated data packet, the server 20c can obtain the live video data corresponding to the updated data packet. Therefore, other terminal devices except the terminal device 20b can obtain the live video data sent by the terminal device 20b from the server 20c, so that the users corresponding to the other terminal devices can watch the live broadcast initiated by the user corresponding to the terminal device 20b.

[0091] It can be seen that the embodiment of the present application can store the full connection state table in the control layer and store S session state tables obtained by sub-table processing of the full connection state table in the data layer. In this way, when the switch receives a data packet, it can directly match the data packet with the S session state tables in the data layer, thereby realizing the forwarding processing of the data packet. Compared with the table items stored in the full connection state table, the S session state tables can store more table items, thereby increasing the table item specifications supported by the switch without increasing additional hardware costs.

[0092] For further information, see Figure 3 , Figure 3 is a flow chart of a data processing method provided by an embodiment of the present application. The method can be executed by a switch with a gateway forwarding function, the switch includes a data layer and a control layer, and the switch can be the above Figure 1 The switch 2000 in the corresponding embodiment. The data processing method may include:

[0093] S101, obtaining a data packet to be forwarded in the data layer;

[0094] The data layer may include S session state tables, where S may be a positive integer greater than 1. The S session state tables are obtained by performing table-splitting processing on the full connection state table in the control layer, and the field information of the S session state tables includes the field information of the full connection state table. In other words, the S session state tables may be stored in the memory of the ASIC chip, and the full connection state table may be stored in the memory of the CPU chip, and the storage space occupied by the full connection state table is greater than the storage space occupied by the S session state tables; since the memory of the CPU chip is greater than the memory of the ASIC chip, storing tables occupying different storage spaces in the control layer and the data layer may improve the memory occupancy rate of the switch.

[0095] It is understandable that each of the S session state tables may include a key field (i.e., key) and a value field (i.e., value), and the fully connected state table may include a key field and a value field; the key field in the session state table may be used to uniquely determine the value field in the session state table, and the key field in the fully connected state table may be used to uniquely determine the value field in the fully connected state table. The key fields of the S session state tables may include the key fields of the fully connected state table, and the value fields of the S session state tables may include the value fields of the fully connected state table.

[0096] Among them, S session state tables are associated with the data packet type of the data packet. The data packet type can be an intranet-to-public network type (i.e., the data packet is forwarded from the intranet to the public network) or a public network-to-intranet type (i.e., the data packet is forwarded from the public network to the intranet), and the full connection state table can include a first full connection state table corresponding to the intranet-to-public network type and a second full connection state table corresponding to the public network-to-intranet type. Therefore, the number of session state tables in the data layer is 2S, and the 2S session state tables can include S session state tables corresponding to the intranet-to-public network type (the S session state tables corresponding to the intranet-to-public network type are obtained by performing table-splitting processing on the first full connection state table) and S session state tables corresponding to the public network-to-intranet type (the S session state tables corresponding to the public network-to-intranet type are obtained by performing table-splitting processing on the second full connection state table), and the field information of each two session state tables in the S session state tables corresponding to the intranet-to-public network type and the S session state tables corresponding to the public network-to-intranet type are the same. When the data packet type of the data packet is the intranet-to-public network type, the switch can obtain S session state tables corresponding to the intranet-to-public network type; when the data packet type of the data packet is the public network-to-intranet type, the switch can obtain S session state tables corresponding to the public network-to-intranet type.

[0097] Among them, the S session state tables in the data layer (the S session state tables here can be S session state tables corresponding to the intranet-to-public network type or S session state tables corresponding to the public network-to-intranet type) may include a first session state table and a second session state table. The embodiment of the present application does not limit the number of first session state tables and the number of second session state tables.

[0098] S102, matching the forwarding field information in the data packet with S session state tables to obtain a matching result;

[0099] Specifically, the switch can obtain forwarding field information from the header information of the data packet, match the forwarding field information with the first session state table in the S session state tables, and obtain a first candidate matching result. Further, if the first candidate matching result indicates a successful match, the switch can obtain conversion field information from the first session state table, match the conversion field information with the second session state table in the S session state tables, and obtain a matching result.

[0100] The forwarding field information can also be referred to as five-tuple information, which can include source IP address (i.e., src_ip, source address), destination IP address (i.e., dst_ip, destination address), source port (i.e., src_port), destination port (i.e., dst_port), and protocol (i.e., protocol). The IP address represents Internet Protocol Address (Internet Protocol address, Internet Protocol address).

[0101] Among them, the first session state table may include a preprocessing table and a session table, and the embodiment of the present application does not limit the number of preprocessing tables and the number of session tables; the forwarding field information may include preprocessing field information (for example, the preprocessing field information may include a destination address, a destination port, a source address and a protocol) and session field information (for example, the session field information may include a source port). It should be understood that the switch matches the forwarding field information with the first session state table in the S session state tables, and the specific process of obtaining the first candidate matching result can be described as: the switch can match the preprocessing field information in the forwarding field information with the preprocessing table to obtain the second candidate matching result. Further, the switch can obtain the candidate field information in the second candidate matching result, perform hash compression on the candidate field information, and generate hash field information corresponding to the candidate field information. Further, the switch can match the hash field information and the session field information in the forwarding field information with the session table to obtain the first candidate matching result.

[0102] Among them, the preprocessing field information may include first preprocessing field information (for example, the first preprocessing field information may include a destination address and a destination port) and second preprocessing field information (for example, the second preprocessing field information may include a source address and a protocol); the preprocessing table may include a first preprocessing table and a second preprocessing table, and the embodiment of the present application does not limit the number of the first preprocessing table and the number of the second preprocessing table. It should be understood that the specific process of the switch matching the preprocessing field information in the forwarding field information with the preprocessing table to obtain the second candidate matching result can be described as: the switch can match the first preprocessing field information in the preprocessing field information with the first preprocessing table to obtain the first candidate field information; the switch can match the second preprocessing field information in the preprocessing field information with the second preprocessing table to obtain the second candidate field information. Further, the switch can determine the first candidate field information and the second candidate field information as candidate field information, and generate a second candidate matching result including the candidate field information.

[0103] Among them, the switch may first match the first preprocessing field information with the first preprocessing table, and then match the second preprocessing field information with the second preprocessing table. The switch may also first match the second preprocessing field information with the second preprocessing table, and then match the first preprocessing field information with the first preprocessing table. The embodiment of the present application does not limit the order of matching with the first preprocessing table and the second preprocessing table. For ease of understanding, the embodiment of the present application takes the example of the switch first matching the first preprocessing field information with the first preprocessing table, and then matching the second preprocessing field information with the second preprocessing table as an example for explanation.

[0104] The switch may match the first preprocessing field information in the preprocessing field information with the first preprocessing table. If the first key field corresponding to the first preprocessing field information exists in the first preprocessing table, the switch may obtain the first value field corresponding to the first key field and determine the first value field as the first candidate field information. Optionally, if the first key field corresponding to the first preprocessing field information does not exist in the first preprocessing table, the switch may determine the first candidate value field as the first candidate field information. The embodiment of the present application does not limit the specific value of the first candidate value field. For example, the first candidate value field may be equal to -1.

[0105] The switch may match the second preprocessing field information in the preprocessing field information with the second preprocessing table. If the second key field corresponding to the second preprocessing field information exists in the second preprocessing table, the switch may obtain the second value field corresponding to the second key field and determine the second value field as the second candidate field information. Optionally, if the second key field corresponding to the second preprocessing field information does not exist in the second preprocessing table, the switch may determine the second candidate value field as the second candidate field information. The embodiment of the present application does not limit the specific value of the second candidate value field. For example, the second candidate value field may be equal to -1.

[0106] It can be understood that, whether the second candidate matching result indicates a successful match or a failed match, the switch can generate a second candidate matching result including candidate field information (i.e., the first candidate field information and the second candidate field information). If the first key field corresponding to the first preprocessing field information exists in the first preprocessing table, and the second key field corresponding to the second preprocessing field information exists in the second preprocessing table, the switch can generate a second candidate matching result indicating a successful match, otherwise, a second candidate matching result indicating a failed match is generated. Wherein, if the first key field corresponding to the first preprocessing field information exists in the first preprocessing table, and the second key field corresponding to the second preprocessing field information does not exist in the second preprocessing table, the switch can generate a second candidate matching result indicating a failed match; if the first key field corresponding to the first preprocessing field information does not exist in the first preprocessing table, and the second key field corresponding to the second preprocessing field information exists in the second preprocessing table, the switch can generate a second candidate matching result indicating a failed match; if the first key field corresponding to the first preprocessing field information does not exist in the first preprocessing table, and the second key field corresponding to the second preprocessing field information does not exist in the second preprocessing table, the switch can generate a second candidate matching result indicating a failed match.

[0107] For ease of understanding, please refer to Table 1, which is a first preprocessing table provided in an embodiment of the present application. The first preprocessing table may store a first key field (i.e., key) and a first value field (i.e., value). The first key field may include a destination address and a destination port, and the first value field may be first candidate field information. As shown in Table 1:

[0108] Table 1

[0109]

[0110] For example, when the first device sends a data packet to the second device, the destination address corresponding to the second device may be A1, and the destination port corresponding to the second device may be B1; for another example, when the second device sends a data packet to the first device, the destination address corresponding to the first device may be A2, and the destination port corresponding to the second device may be B2. The first key field in Table 1 is unique (i.e. (destination address, destination port) is unique; when the destination addresses are the same, the destination ports are different; when the destination ports are the same, the destination addresses are different), and different first key fields may correspond to different first value fields, i.e. C1, ..., C2 are all different.

[0111] The switch can directly store the first key field (i.e., the target address and the target port) in the first preprocessing table; optionally, the switch can also perform hash compression on the first key field (i.e., the target address and the target port) to generate the hash-compressed first key field, and store the hash-compressed first key field in the first preprocessing table, thereby reducing the table entry specification of the first preprocessing table. For the specific process of the switch performing hash compression on the first key field, please refer to the following description of hash compression on the candidate field information.

[0112] For ease of understanding, please refer to Table 2, which is a second preprocessing table provided in an embodiment of the present application. The second preprocessing table may store a second key field (i.e., key) and a second value field (i.e., value). The second key field may include a source address and a protocol, and the second value field may be second candidate field information. As shown in Table 2:

[0113] Table 2

[0114]

[0115] For example, when the first device sends a data packet to the second device, the source address corresponding to the first device may be D1, and the protocol corresponding to the data packet may be E1; for another example, when the second device sends a data packet to the first device, the source address corresponding to the second device may be D2, and the protocol corresponding to the data packet may be E2. The second key field in Table 1 is unique (i.e. (source address, protocol) is unique; when the source address is the same, the protocol is different; when the protocol is the same, the source address is different), and different second key fields may correspond to different second value fields, i.e., F1, ..., F2 are all different.

[0116] The switch can directly store the second key field (i.e., source address and protocol) in the second preprocessing table; optionally, the switch can also perform hash compression on the second key field (i.e., source address and protocol) to generate a hash-compressed second key field, and store the hash-compressed second key field in the second preprocessing table, thereby reducing the table entry specifications of the second preprocessing table. For the specific process of the switch performing hash compression on the second key field, please refer to the following description of hash compression on candidate field information.

[0117] The candidate field information includes first candidate field information and second candidate field information. It should be understood that the specific process of the switch performing hash compression on the candidate field information and generating hash field information corresponding to the candidate field information can be described as follows: the switch can perform a hash operation on the first candidate field information to generate a first hash value corresponding to the first candidate field information; the switch can perform a hash operation on the second candidate field information to generate a second hash value corresponding to the second candidate field information. Furthermore, the switch can perform an XOR operation on the first hash value and the second hash value to generate hash field information corresponding to the candidate field information.

[0118] Optionally, the switch performs hash compression on the candidate field information, and the specific process of generating hash field information corresponding to the candidate field information can be described as follows: the switch can concatenate the first candidate field information and the second candidate field information to generate concatenated field information corresponding to the first candidate field information and the second candidate field information. Further, the switch can perform a hash operation on the concatenated field information to generate hash field information corresponding to the concatenated field information.

[0119] It should be understood that the embodiments of the present application do not limit the hash (i.e., hash) algorithm used for the hash operation in hash compression. The hash algorithm can be a typical open source algorithm. For example, the hash algorithm can be CRC (Cyclic Redundancy Check) 16, CRC32, CRC64. The length of the hash field information generated by different hash algorithms can be different or different. Among them, the length of the hash field information (i.e., hash_id) is shorter than the length of the candidate field information (i.e., the first candidate field information (i.e., oid_final) and the second candidate field information (i.e., iid_final)). For example, when the hash algorithm is CRC16, the first candidate field information can be 2 bytes (2Bytes), the second candidate field information can be 1 byte (1Bytes), and the hash field information can be 2 bytes (2Bytes). At this time, the switch can compress the 3-byte first candidate field information and the second candidate field information into 2 bytes of hash field information.

[0120] Therefore, the embodiment of the present application can further reduce the space used by the field information through the hash compression algorithm (i.e., compress the storage space occupied by each session table entry), thereby increasing the number of sessions that the switch can support (i.e., storing more table entries in a limited storage space), increasing the scale of stateful gateway services (i.e., increasing the scale (i.e., capacity) of the table entries), and improving storage efficiency, thereby enhancing product competitiveness. In addition, the query speed when searching the second preprocessing table (the second preprocessing table can also be called a hash table) through the hash field information is faster than the traditional linear search, thereby improving the query efficiency, thereby reducing the operating cost and improving the system performance.

[0121] The specific process of the switch matching the session field information in the hash field information and the forwarding field information with the session table to obtain the first candidate matching result can be described as follows: the switch can match the session field information in the hash field information and the forwarding field information with the session table, and if the session table contains a third key field corresponding to the hash field information and the session field information, obtain the third value field corresponding to the third key field, and generate the first candidate matching result indicating a successful match based on the third value field. Optionally, if the session table does not contain the third key field corresponding to the hash field information and the session field information, the switch can generate the first candidate matching result indicating a failed match.

[0122] For ease of understanding, please refer to Table 3, which is a session table provided in an embodiment of the present application. The session table may store a third key field (i.e., key) and a third value field (i.e., value). The third key field may include hash field information and a source port, and the third value field may include conversion field information and auxiliary field information (for example, the auxiliary field information may be a conversion port (i.e., NAT port, nat_port, port after nat conversion)). As shown in Table 3:

[0123] Table 3

[0124]

[0125] For example, when the first device sends a data packet to the second device, the hash field information may be G1, and the source port corresponding to the first device may be K1; for another example, when the second device sends a data packet to the first device, the hash field information may be G2, and the source port corresponding to the second device may be K2. The third key field in Table 3 is unique (i.e. (hash field information, source port) is unique; when the hash field information is the same, the source ports are different; when the source ports are the same, the hash field information is different), and different third key fields may correspond to different third value fields, i.e. (L1, M1), ..., (L2, M2) are all different.

[0126] The switch can directly store the third key field (i.e., the hash field information and the source port) in the session table; optionally, the switch can also perform hash compression on the third key field (i.e., the hash field information and the source port) to generate a hash-compressed third key field, and store the hash-compressed third key field in the session table, thereby reducing the table entry specification of the session table. The specific process of the switch performing hash compression on the third key field can be referred to the above description of hash compression on the candidate field information, which will not be repeated here.

[0127] It should be understood that the switch obtains the conversion field information (i.e., nid, nid_final) from the first session state table, matches the conversion field information with the second session state table in the S session state tables, and obtains the specific process of the matching result can be described as follows: the switch can obtain the conversion field information from the first session state table. Among them, the conversion field information belongs to the third value field, that is, the switch can obtain the conversion field information from the session table. Further, the switch can match the conversion field information with the second session state table in the S session state tables, and if there is a fourth key field corresponding to the conversion field information in the second session state table, the fourth value field corresponding to the fourth key field is obtained, and a matching result indicating a successful match is generated based on the fourth value field. Optionally, if there is no fourth key field corresponding to the conversion field information in the second session state table, the switch can generate a matching result indicating a failed match.

[0128] For ease of understanding, please refer to Table 4, which is a second session state table provided in an embodiment of the present application. The second session state table may store a fourth key field (i.e., key) and a fourth value field (i.e., value). The fourth key field may include conversion field information, and the fourth value field may include a conversion address (i.e., NAT ip, nat_ip, and the address after nat conversion). As shown in Table 4:

[0129] Table 4

[0130] key value Convert field information Convert address <![CDATA[O1]]> <![CDATA[P1]]> … … <![CDATA[O2]]> <![CDATA[P2]]>

[0131] For example, when the first device sends a data packet to the second device, the conversion field information may be O1; when the second device sends a data packet to the first device, the conversion field information may be O2. The fourth key field in Table 4 is unique, and different fourth key fields may correspond to different fourth value fields, that is, P1, ..., P2 are all different.

[0132] The switch can directly store the fourth key field (i.e., the conversion field information) in the second session state table; optionally, the switch can also perform hash compression on the fourth key field (i.e., the conversion field information) to generate a hash-compressed fourth key field, and store the hash-compressed fourth key field in the second session state table, thereby reducing the table entry specification of the second session state table. The specific process of the switch performing hash compression on the fourth key field can be found in the description of performing hash compression on the candidate field information, which will not be repeated here.

[0133] S103: If the matching result indicates that the match is successful, the forwarding field information is updated based on the S session state tables to obtain updated forwarding field information.

[0134] Specifically, when the matching result indicates that the match is successful, the switch can obtain the fourth value field (for example, the fourth value field may include a conversion address) and the auxiliary field information in the third value field (for example, the auxiliary field information may be a conversion port) from the S session state tables corresponding to the data packet type. The switch can obtain the fourth value field from the second session state table and the auxiliary field information from the session table. Further, if the data packet type is an intranet-to-public network type, the switch can update the source field information in the forwarding field information through the fourth value field and the auxiliary field information to obtain the updated forwarding field information. Optionally, if the data packet type is a public network-to-intranet type, the switch can update the target field information in the forwarding field information through the fourth value field and the auxiliary field information to obtain the updated forwarding field information. The updated forwarding field information is used to update the data packet, obtain the updated data packet, and forward the updated data packet.

[0135] Wherein, the source field information may include a source address and a source port. When the source field information in the forwarding field information is updated through the fourth value field and the auxiliary field information, the switch may update the source address through the fourth value field (i.e., update the source address through the conversion address, for example, replace the source address through the conversion address), and update the source port through the auxiliary field information (i.e., update the source port through the conversion port, for example, replace the source port through the conversion port), to obtain the updated forwarding field information. Wherein, the fourth value field and the auxiliary field information may be public network related information, and the source field information may be intranet related information. Updating the source field information in the forwarding field information through the fourth value field and the auxiliary field information means updating the intranet related information through the public network related information.

[0136] Wherein, the target field information may include a destination address and a destination port. When the target field information in the forwarding field information is updated through the fourth value field and the auxiliary field information, the switch may update the destination address through the fourth value field (i.e., update the destination address through the conversion address, for example, replace the destination address through the conversion address), and update the destination port through the auxiliary field information (i.e., update the destination port through the conversion port, for example, replace the destination port through the conversion port), to obtain the updated forwarding field information. Wherein, the fourth value field and the auxiliary field information may be intranet related information, and the target field information may be public network related information. Updating the target field information in the forwarding field information through the fourth value field and the auxiliary field information means updating the public network related information through the intranet related information.

[0137] For easier understanding, see Figure 4 , Figure 4 Schematic diagram of a data processing scenario provided by an embodiment of the present application. Figure 4As shown, the switch may include a data layer and a control layer, and data can be exchanged between the data layer and the control layer. The data layer may include S session state tables, and the S session state tables may specifically include a session state table 40a (i.e., outtable, pre-session table 1), a session state table 40b (i.e., nat&in table, pre-session table 2), a session state table 40c (i.e., session table), and a session state table 40d (i.e., map table, post-session table). For example, the session state table 40a may be the first pre-processing table in Table 1 above, the session state table 40b may be the second pre-processing table in Table 2 above, the session state table 40c may be the session table in Table 3 above, and the session state table 40d may be the second session state table in Table 4 above. Among them, the session state table 40a and the session state table 40b may be collectively referred to as pre-processing tables, and the session state table 40a, the session state table 40b, and the session state table 40c may be collectively referred to as first session state tables.

[0138] Among them, the session state table 40a may include field information 41a, field information 41b and field information 42a, field information 41a may be a destination address, field information 41b may be a destination port, and field information 42a may be a first value field; the session state table 40b may include field information 41c, field information 41d and field information 42b, field information 41c may be a source address, field information 41d may be a protocol, and field information 42b may be a second value field; the session state table 40c may include field information 42c, field information 41e, field information 43a and field information 43b, field information 42c may be hash field information, field information 41e may be a source port, field information 43a may be conversion field information, and field information 43b may be auxiliary field information; the session state table 40d may include field information 43a and field information 43c, field information 43a may be conversion field information, and field information 43c may be a conversion address. Among them, field information 41a and field information 41b can be collectively referred to as first pre-processing field information, field information 41c and field information 41d can be collectively referred to as second pre-processing field information, and field information 41e can be collectively referred to as session field information.

[0139] like Figure 4As shown, the switch can receive the data packet to be forwarded in the data layer, and obtain the forwarding field information from the header information of the data packet, wherein the forwarding field information may include a protocol, an input address (inside ip, src ip, i.e., source address), an input port (inside port, src port, i.e., source port), an output address (outside ip (oip), dst_ip, i.e., destination address) and an output port (outside port (oport), dst_port, i.e., destination port). Further, the switch can input the forwarding field information into the session state table 40a, match the first pre-processing field information (i.e., field information 41a and field information 41b) in the forwarding field information with the session state table 40a, and obtain the first candidate field information (i.e., oid). Further, the switch can input the forwarding field information into the session state table 40b, match the second pre-processing field information (i.e., field information 41c and field information 41d) in the forwarding field information with the session state table 40b, and obtain the second candidate field information (i.e., iid).

[0140] Furthermore, the switch may determine the first candidate field information and the second candidate field information as candidate field information, perform hash compression on the candidate field information, and generate hash field information (ie, field information 42c) corresponding to the candidate field information. Figure 4 As shown, the switch can input the forwarding field information and the hash field information into the session state table 40c, match the hash field information and the session field information (i.e., field information 41e) in the forwarding field information with the session state table 40c, and obtain a first candidate matching result indicating a successful match or a first candidate matching result indicating a failed match.

[0141] like Figure 4 As shown, if the first candidate matching result indicates a successful match, the switch can obtain the conversion field information (i.e., field information 43a) and the auxiliary field information (i.e., field information 43b) from the session state table 40c, input the conversion field information, the auxiliary field information, and the forwarding field information into the session state table 40d, match the conversion field information with the session state table 40d, and obtain a matching result indicating a successful match or a matching result indicating a failed match.

[0142] Among them, if the matching result indicates that the match is successful, the switch can obtain the field information 43c corresponding to the conversion field information from the session state table 40d, and update the forwarding field information through the field information 43b (i.e., the conversion port) and the field information 43c (i.e., the conversion address). It can be understood that the switch can update the input address and input port through the field information 43b and the field information 43c when the data packet type is the intranet out of the public network type; the switch can update the output address and output port through the field information 43b and the field information 43c when the data packet type is the public network into the intranet type. Optionally, if the matching result indicates that the match fails, the switch can discard the data packet.

[0143] Optional, such as Figure 4 As shown in FIG. 1 , if the first candidate matching result indicates a match failure, the switch can send the data packet from the data layer to the control layer, and process the data packet through the control layer. In other words, if the first candidate matching result indicates a match failure, the switch can send the data packet to the CPU for slow path processing. The specific process of the switch processing the data packet through the control layer can be seen in the following Figure 5 The description of S1023 in the corresponding embodiment.

[0144] In an embodiment of the present application, a switch with a gateway forwarding function can obtain a data packet to be forwarded in the data layer, match the forwarding field information in the data packet with S session state tables, and obtain a matching result. Wherein, S here can be a positive integer greater than 1; the S session state tables are obtained by performing table-splitting processing on the full connection state table in the control layer, and the field information of the S session state tables includes the field information of the full connection state table. Further, if the matching result indicates that the match is successful, the switch can update the forwarding field information based on the S session state tables to obtain the updated forwarding field information. Wherein, the updated forwarding field information is used to update the data packet, obtain the updated data packet, and forward the updated data packet. It can be seen from this that the embodiment of the present application can extract the field information in the full connection state table into S session state tables (that is, extract the field information that appears repeatedly in the session table entry into a small table, or extract the field information that occupies a large space in the session table entry into a small table), and store S session state tables in the data layer and store the full connection state table in the control layer, so that the forwarding processing of the data packet can be realized without storing the full connection state table in the data layer. In addition, since the same field information in the S session state tables can correspond to different data packets, storing session table entries through the S session state tables does not require an external FPGA card on the switch, thereby improving the table entry specifications supported by the switch without increasing additional hardware costs.

[0145] For further information, see Figure 5 , Figure 5 is a flow chart of a data processing method provided in an embodiment of the present application. The data processing method may include S1021-S1023, and S1021-S1023 are Figure 2 A specific embodiment of S102 in the corresponding embodiment.

[0146] S1021, obtaining forwarding field information from header information of the data packet, matching the forwarding field information with a first session state table among the S session state tables, and obtaining a first candidate matching result;

[0147] The switch matches the forwarding field information with the first session state table in the S session state tables to obtain the first candidate matching result. For details, see the above Figure 3 The description of S102 in the corresponding embodiment will not be repeated here.

[0148] The first candidate matching result may indicate a successful match or a failed match. If the first candidate matching result indicates a successful match, the switch may execute the following S1022; if the first candidate matching result indicates a failed match, the switch may execute the following S1023.

[0149] S1022, if the first candidate matching result indicates a successful match, obtaining conversion field information from the first session state table, and matching the conversion field information with the second session state table in the S session state tables to obtain a matching result;

[0150] The switch matches the conversion field information with the second session state table in the S session state tables to obtain the specific process of the matching result, which can be seen in the above Figure 3 The description of S102 in the corresponding embodiment will not be repeated here.

[0151] S1023: If the first candidate matching result indicates a matching failure, the data packet is sent to the control layer, and the control layer processes the data packet.

[0152] Specifically, the switch can send a data packet to the control layer and obtain the data packet in the control layer. The switch can detect the data packet sent from the pipeline (i.e., the data layer) through the CPU and extract the forwarding field information from the data packet. Furthermore, the switch can match the forwarding field information with the fully connected state table (i.e., query whether the five-tuple information has a corresponding session table entry in the fully connected state table). If there is a fifth key field corresponding to the forwarding field information in the fully connected state table (i.e., there is a session table entry corresponding to the five-tuple information in the fully connected state table), the fifth value field corresponding to the fifth key field is obtained, and the forwarding field information is updated based on the fifth value field to obtain the updated forwarding field information. The updated forwarding field information is used to update the data packet, obtain the updated data packet, and forward the updated data packet. Optionally, if the fifth key field corresponding to the forwarding field information does not exist in the fully connected state table (that is, there is no session table entry corresponding to the five-tuple information in the fully connected state table), the fully connected state table is updated based on the forwarding field information, a state table update notification is sent to the data layer, the state table update notification is obtained in the data layer, and S session state tables are updated based on the state table update notification.

[0153] The specific process of the switch obtaining the data packet in the control layer can be described as follows: the switch can send the data packet to the control layer and receive the data packet in the control layer. Further, the switch can match the data packet with the conversion rule to obtain the rule matching result. The embodiment of the present application does not limit the number of conversion rules. Further, if the rule matching result indicates a successful match, the switch can obtain the data packet in the control layer. Optionally, if the rule matching result indicates a failed match, the switch can discard the data packet.

[0154] Among them, the number of fully connected state tables is H, where H can be a positive integer greater than 1. It should be understood that the switch updates the forwarding field information based on the fifth value field, and the specific process of obtaining the updated forwarding field information can be described as: the switch can obtain the fully connected state table corresponding to the data packet type of the data packet from the H fully connected state tables, and match the forwarding field information with the fully connected state table corresponding to the data packet type. Further, if there is a fifth key field corresponding to the forwarding field information in the fully connected state table corresponding to the data packet type, the switch can obtain the fifth value field corresponding to the fifth key field. Further, the switch can update the forwarding field information based on the fifth value field and the data packet type to obtain the updated forwarding field information.

[0155] The switch updates the forwarding field information based on the fifth value field and the data packet type, and the specific process of obtaining the updated forwarding field information can be described as follows: if the data packet type is an intranet-to-public network type, the switch can update the source field information in the forwarding field information through the fifth value field to obtain the updated forwarding field information. Optionally, if the data packet type is a public network-to-intranet type, the switch can update the target field information in the forwarding field information through the fifth value field to obtain the updated forwarding field information. The fifth value field may include a conversion address and a conversion port. The specific process of the switch updating the source field information or the target field information through the conversion address and the conversion port can be found in the above Figure 3 The description of updating the forwarding field information by using the fourth value field and the auxiliary field information in the corresponding embodiment will not be repeated here.

[0156] Among them, the full connection state table may include a first full connection state table corresponding to the type of the intranet out of the public network and a second full connection state table corresponding to the type of the public network into the intranet. In other words, if the data packet type of the data packet is the type of the intranet out of the public network, the switch can match the forwarding field information with the first full connection state table. Further, if there is a fifth key field corresponding to the forwarding field information in the first full connection state table, the switch can obtain the fifth value field corresponding to the fifth key field, and update the source field information in the forwarding field information through the fifth value field to obtain the updated forwarding field information.

[0157] Among them, the full connection state table may include a first full connection state table corresponding to the type of the intranet out of the public network and a second full connection state table corresponding to the type of the public network into the intranet. In other words, if the data packet type of the data packet is the type of the public network into the intranet, the switch can match the forwarding field information with the second full connection state table. Further, if there is a fifth key field corresponding to the forwarding field information in the second full connection state table, the switch can obtain the fifth value field corresponding to the fifth key field, update the target field information in the forwarding field information through the fifth value field, and obtain the updated forwarding field information. Among them, the fifth key field in the first full connection state table and the second full connection state table is different, and the fifth value field in the first full connection state table and the second full connection state table is different.

[0158] For ease of understanding, please refer to Table 5, which is a full connection state table provided in an embodiment of the present application. The full connection state table may store a fifth key field (i.e., key) and a fifth value field (i.e., value). The fifth key field may include a destination address, a destination port, a source address, a protocol, and a source port, and the fifth value field may include a conversion address and a conversion port. As shown in Table 5:

[0159] Table 5

[0160]

[0161] Among them, the conversion address corresponding to the forwarding field information (destination address A1, destination port B1, source address D1, protocol E1, source port K1) can be P1, and the conversion port corresponding to the forwarding field information (destination address A1, destination port B1, source address D1, protocol E1, source port K1) can be M1; the conversion address corresponding to the forwarding field information (destination address A2, destination port B2, source address D2, protocol E2, source port K2) can be P2, and the conversion port corresponding to the forwarding field information (destination address A2, destination port B2, source address D2, protocol E2, source port K2) can be M2.

[0162] The switch can directly store the fifth key field (i.e., destination address, destination port, source address, protocol, and source port) in the fully connected state table; optionally, the switch can also perform hash compression on the fifth key field (i.e., destination address, destination port, source address, protocol, and source port) to generate a hash-compressed fifth key field, and store the hash-compressed fifth key field in the fully connected state table, thereby reducing the table entry specifications of the fully connected state table. The specific process of the switch performing hash compression on the fifth key field can be found in the above description of hash compression on the candidate field information, which will not be repeated here.

[0163] As shown in Table 5, when the full connection state table is the first full connection state table (that is, when the data packet type is the intranet-to-public network type), the destination address can be the destination public network IP, the destination port can be the destination public network port, the source address can be the intranet IP, and the source port can be the intranet port; the conversion address can be the NAT public network IP, and the conversion port can be the NAT public network port.

[0164] As shown in Table 5, when the full connection state table is the second full connection state table (that is, when the data packet type is the public network to intranet type), the destination address can be the NAT public network IP, the destination port can be the NAT public network port, the source address can be the destination public network IP, and the source port can be the destination public network port; the conversion address can be the intranet IP, and the conversion port can be the intranet port.

[0165] For ease of understanding, please refer to the above Table 1, Table 2, Table 3, Table 4 and Table 5 again. Table 1, Table 2, Table 3 and Table 4 may be S session state tables, and Table 5 may be a full connection state table. The field information of the S session state tables may include target address, destination port, first value field, source address, protocol, second value field, hash field information, source port, conversion field information, auxiliary field information and conversion address, and the field information of the full connection state table may include destination address, destination port, source address, protocol, source port, conversion address and conversion port (i.e. auxiliary field information). Therefore, the field information of the S session state tables includes the field information of the full connection state table.

[0166] Among them, the specific process of the switch updating the full connection state table based on the forwarding field information can be described as follows: if the data packet type is an intranet-to-public network type, the switch can generate public network conversion information corresponding to the forwarding field information, and update H fully connected state tables based on the forwarding field information and the public network conversion information (i.e., create corresponding session information for the five-tuple information, and insert the session information into the fully connected table entry). In other words, if the data packet type is an intranet-to-public network type, the switch can generate public network conversion information corresponding to the forwarding field information, and update the first fully connected state table and the second fully connected state table based on the forwarding field information and the public network conversion information. Optionally, if the data packet type is a public network-to-intranet type, the switch can discard the data packet, thereby ensuring that the public network cannot access the intranet when the intranet does not access the public network, which can improve the security of the intranet.

[0167] The public network conversion information corresponding to the forwarding field information is generated by the switch for the source field information in the forwarding field information, and different source field information may correspond to different public network conversion information (i.e., different (source address, source port) may correspond to different (conversion address, conversion port)). The same conversion address may be mapped to different public network conversion information, and at this time, different public network conversion information may be distinguished by the conversion port.

[0168] For example, the forwarding field information may be (destination address A3, destination port B3, source address D3, protocol E3, source port K3), and the public network conversion information may be (conversion address P3, conversion port M3). At this time, the switch may associate (destination address A3, destination port B3, source address D3, protocol E3, source port K3) and (conversion address P3, conversion port M3) and write them into the first fully connected state table. At the same time, the destination address A3 is determined as the source address, the destination port B3 is determined as the source port, the conversion address P3 is determined as the destination address, the conversion port M3 is determined as the destination port, the source address D3 is determined as the conversion address, and the source port K3 is determined as the conversion port, and then (destination address P3, destination port M3, source address A3, protocol E3, source port B3) and (conversion address D3, conversion port K3) are associated and written into the second fully connected state table.

[0169] Further, when the data packet type of the data packet is an intranet-to-public network type, if the forwarding field information of the data packet is (destination address A3, destination port B3, source address D3, protocol E3, source port K3), the switch can obtain the (conversion address P3, conversion port M3) corresponding to the (destination address A3, destination port B3, source address D3, protocol E3, source port K3) from the first fully connected state table, and update the source field information in the forwarding field information through the (conversion address P3, conversion port M3) (i.e., replace the source address D3 with the conversion address P3, and replace the source port K3 with the conversion port M3). Similarly, when the data packet type of the data packet is the type of entering the public network into the intranet, if the forwarding field information of the data packet is (destination address P3, destination port M3, source address A3, protocol E3, source port B3), the switch can obtain the (conversion address D3, conversion port K3) corresponding to (destination address P3, destination port M3, source address A3, protocol E3, source port B3) from the second fully connected state table, and update the target field information in the forwarding field information through (conversion address D3, conversion port K3) (that is, replace the destination address P3 with the conversion address D3, and replace the destination port M3 with the conversion port K3).

[0170] Therefore, the field information in the first fully connected state table and the field information in the second fully connected state table are the same. Correspondingly, the field information in the S session state tables corresponding to the intranet-to-public network type and the field information in the S session state tables corresponding to the public network-to-intranet type are the same.

[0171] It should be understood that the S session state tables are obtained by performing table splitting processing on the full connection state table. The table splitting processing means selecting field information from the key field of the full connection state table as the key field of the S session state tables, and selecting field information from the value field of the full connection state table as the value field of the S session state tables. The embodiment of the present application does not limit the key field and value field of each session state table in the S session state tables. For example, the S session state tables may include a preprocessing table, a session table, and a second session state table; the S session state tables may include a first preprocessing table, a second preprocessing table, a session table, and a second session state table; the S session state tables may include a first session state table and a second session state table. In the process of performing table splitting processing on the full connection state table to generate the S session state tables, it is necessary to generate a new key field and a new value field (for example, conversion field information) to associate the S session state tables through the new key field and the new value field.

[0172] Among them, the specific process of the switch updating S session state tables based on the state table update notification can be described as follows: if the data packet type is the type of intranet to public network, the switch can send a state table update notification to the data layer through the control layer, and obtain the state table update notification in the data layer. Further, the switch can update 2S session state tables (the 2S session state tables include S session state tables corresponding to the type of intranet to public network and S session state tables corresponding to the type of public network to intranet) based on the forwarding field information and the public network conversion information (i.e., send pre-session table1 information, pre-session table2 information, session table information, and post-session table information to the fast path table entry). Optionally, if the data packet type is the type of public network to intranet, the switch does not need to send a state table update notification to the data layer through the control layer.

[0173] For example, the forwarding field information may be (destination address A3, destination port B3, source address D3, protocol E3, source port K3), and the public network conversion information may be (conversion address P3, conversion port M3). At this time, for Table 1 corresponding to the intranet-to-public network type, the switch may write (destination address A3, destination port B3) as a key into Table 1, and generate a value corresponding to (destination address A3, destination port B3) (for example, value may be (first value field C3)); for Table 2 corresponding to the intranet-to-public network type, the switch may write (source address D3, protocol E3) as a key into Table 2, and generate a value corresponding to (source address D3, protocol E3) (for example, value may be (second value field F3)); for the intranet-to-public network type Corresponding to Table 3, the switch can generate hash field information corresponding to the first value field C3 and the second value field F3 (for example, the hash field information can be G3), generate conversion field information corresponding to the conversion address P3 (for example, the conversion field information can be L3), and write (hash field information G3, source port K3) as the key and (conversion field information L3, conversion port M3) as the value into Table 3; for Table 4 corresponding to the intranet to public network type, the switch can write (conversion field information L3) as the key and (conversion address P3) as the value into Table 4.

[0174] At the same time, for Table 1 corresponding to the type of public network entering the intranet, the switch can write (destination address P3, destination port M3) as a key into Table 1, and generate a value corresponding to (destination address P3, destination port M3) (for example, value can be (first value field C3)); for Table 2 corresponding to the type of public network entering the intranet, the switch can write (source address A3, protocol E3) as a key into Table 2, and generate a value corresponding to (source address A3, protocol E3) (for example, value can be (second value field F3)); for the type of public network entering the intranet, the switch can write (source address A3, protocol E3) as a key into Table 2, and generate a value corresponding to (source address A3, protocol E3) (for example, value can be (second value field F3)); For Table 3 corresponding to the type, the switch can generate hash field information corresponding to the first value field C3 and the second value field F3 (for example, the hash field information can be G3), generate conversion field information corresponding to the conversion address D3 (for example, the conversion field information can be L3), and write (hash field information G3, source port B3) as the key and (conversion field information L3, conversion port K3) as the value into Table 3; for Table 4 corresponding to the public network to intranet type, the switch can write (conversion field information L3) as the key and (conversion address D3) as the value into Table 4.

[0175] For easier understanding, please refer to Figure 4 ,like Figure 4As shown, the switch can send the data packet to the control layer through the data layer, receive the data packet in the control layer, and then match the data packet with the conversion rule to obtain the rule matching result. Further, if the rule matching result indicates a successful match, the switch can update the session state table 40a, the session state table 40b, the session state table 40c and the session state table 40d. At the same time, if the rule matching result indicates a successful match, the switch can update the full connection state table, thereby terminating the CPU operation logic. Optionally, if the rule matching result indicates a failed match, the switch can discard the data packet, thereby terminating the CPU operation logic.

[0176] It can be seen that the embodiment of the present application can match the forwarding field information of the data packet with the first session state table in the S session state tables to obtain the first candidate matching result. Further, if the first candidate matching result indicates a successful match, the switch can match the conversion field information in the first session state table with the second session state table in the S session state tables to obtain a matching result; optionally, if the first candidate matching result indicates a failed match, the switch can send the data packet to the control layer, and perform data packet processing on the data packet through the control layer. Therefore, the embodiment of the present application can quickly forward the data packet through the S session state tables, or when the S session state tables cannot forward the data packet, the data packet is processed through the fully connected state table, thereby increasing the table item specifications supported by the switch without increasing additional hardware costs.

[0177] For further information, see Figure 6 , Figure 6 1 is a schematic diagram of a data processing device provided in an embodiment of the present application. The data processing device 1 can be run on a switch with a gateway forwarding function. The switch includes a data layer and a control layer. The data processing device 1 may include: a data packet acquisition module 11, a state table matching module 12, and a data packet update module 13;

[0178] The data packet acquisition module 11 is used to acquire the data packet to be forwarded in the data layer;

[0179] The state table matching module 12 is used to match the forwarding field information in the data packet with S session state tables to obtain a matching result; S is a positive integer greater than 1; the S session state tables are obtained by performing table splitting processing on the full connection state table in the control layer; the field information of the S session state tables includes the field information of the full connection state table;

[0180] Wherein, the S session state tables in the data layer include a first session state table and a second session state table;

[0181] The state table matching module 12 includes: a first matching unit 121, a second matching unit 122, and a data packet processing unit 123;

[0182] A first matching unit 121 is used to obtain forwarding field information from header information of a data packet, and match the forwarding field information with a first session state table in the S session state tables to obtain a first candidate matching result;

[0183] The first session state table includes a pre-processing table and a session table; the forwarding field information includes pre-processing field information and session field information;

[0184] The first matching unit 121 includes: a first matching subunit 1211, a hash compression subunit 1212, and a second matching subunit 1213;

[0185] The first matching subunit 1211 is used to match the preprocessing field information in the forwarding field information with the preprocessing table to obtain a second candidate matching result;

[0186] The preprocessing field information includes first preprocessing field information and second preprocessing field information; the preprocessing table includes a first preprocessing table and a second preprocessing table;

[0187] The first matching subunit 1211 is specifically used to match the first preprocessing field information in the preprocessing field information with the first preprocessing table, and if the first key field corresponding to the first preprocessing field information exists in the first preprocessing table, obtain the first value field corresponding to the first key field, and determine the first value field as the first candidate field information; if the first key field corresponding to the first preprocessing field information does not exist in the first preprocessing table, determine the first candidate value field as the first candidate field information;

[0188] The first matching subunit 1211 is specifically used to match the second preprocessing field information in the preprocessing field information with the second preprocessing table, and if the second key field corresponding to the second preprocessing field information exists in the second preprocessing table, obtain the second value field corresponding to the second key field, and determine the second value field as the second candidate field information; if the second key field corresponding to the second preprocessing field information does not exist in the second preprocessing table, determine the second candidate value field as the second candidate field information;

[0189] The first matching subunit 1211 is specifically configured to determine the first candidate field information and the second candidate field information as candidate field information, and generate a second candidate matching result including the candidate field information.

[0190] The hash compression subunit 1212 is used to obtain the candidate field information in the second candidate matching result, perform hash compression on the candidate field information, and generate hash field information corresponding to the candidate field information;

[0191] The candidate field information includes first candidate field information and second candidate field information;

[0192] The hash compression subunit 1212 is specifically configured to perform a hash operation on the first candidate field information to generate a first hash value corresponding to the first candidate field information;

[0193] The hash compression subunit 1212 is specifically configured to perform a hash operation on the second candidate field information to generate a second hash value corresponding to the second candidate field information;

[0194] The hash compression subunit 1212 is specifically configured to perform an XOR process on the first hash value and the second hash value to generate hash field information corresponding to the candidate field information.

[0195] The second matching subunit 1213 is used to match the hash field information and the session field information in the forwarding field information with the session table to obtain a first candidate matching result.

[0196] The second matching subunit 1213 is specifically used to match the session field information in the hash field information and the forwarding field information with the session table, and if the session table contains a third key field corresponding to the hash field information and the session field information, obtain a third value field corresponding to the third key field, and generate a first candidate matching result indicating a successful match based on the third value field;

[0197] The second matching subunit 1213 is specifically configured to generate a first candidate matching result indicating a matching failure if the third key field corresponding to the hash field information and the session field information does not exist in the session table.

[0198] The specific implementation of the first matching subunit 1211, the hash compression subunit 1212, and the second matching subunit 1213 can be found in the above Figure 3 The description of S102 in the corresponding embodiment will not be repeated here.

[0199] The second matching unit 122 is configured to obtain conversion field information from the first session state table if the first candidate matching result indicates a successful match, and match the conversion field information with a second session state table in the S session state tables to obtain a matching result;

[0200] The second matching unit 122 is specifically used to obtain conversion field information from the first session state table; the conversion field information belongs to the third value field;

[0201] The second matching unit 122 is specifically configured to match the conversion field information with a second session state table in the S session state tables, and if a fourth key field corresponding to the conversion field information exists in the second session state table, obtain a fourth value field corresponding to the fourth key field, and generate a matching result indicating a successful match based on the fourth value field;

[0202] The second matching unit 122 is specifically configured to generate a matching result indicating a matching failure if the fourth key field corresponding to the conversion field information does not exist in the second session state table;

[0203] The second matching unit 122 is further specifically configured to discard the data packet if the matching result indicates a matching failure.

[0204] The data packet processing unit 123 is configured to send the data packet to the control layer if the first candidate matching result indicates a matching failure, and perform data packet processing on the data packet through the control layer.

[0205] The data packet processing unit 123 includes: a data packet sending subunit 1231, a field updating subunit 1232, and a state table updating subunit 1233;

[0206] The data packet sending subunit 1231 is used to send the data packet to the control layer and obtain the data packet in the control layer;

[0207] The data packet sending subunit 1231 is specifically used to send the data packet to the control layer and receive the data packet in the control layer;

[0208] The data packet sending subunit 1231 is specifically used to match the data packet with the conversion rule to obtain a rule matching result;

[0209] The data packet sending subunit 1231 is specifically used to obtain the data packet in the control layer if the rule matching result indicates a successful match;

[0210] The data packet sending subunit 1231 is further specifically configured to discard the data packet if the rule matching result indicates a matching failure.

[0211] The field updating subunit 1232 is used to match the forwarding field information with the full connection state table, and if the fifth key field corresponding to the forwarding field information exists in the full connection state table, obtain the fifth value field corresponding to the fifth key field, and update the forwarding field information based on the fifth value field to obtain the updated forwarding field information;

[0212] Among them, the number of fully connected state tables is H, and H is a positive integer greater than 1;

[0213] The field updating subunit 1232 is specifically used to obtain the full connection state table corresponding to the data packet type of the data packet from the H full connection state tables, and match the forwarding field information with the full connection state table corresponding to the data packet type;

[0214] The field updating subunit 1232 is specifically configured to obtain a fifth value field corresponding to the fifth key field if there is a fifth key field corresponding to the forwarding field information in the full connection state table corresponding to the data packet type;

[0215] The field updating subunit 1232 is specifically configured to update the forwarding field information based on the fifth value field and the data packet type to obtain updated forwarding field information.

[0216] The field updating subunit 1232 is specifically used to update the source field information in the forwarding field information through the fifth value field if the data packet type is an intranet-to-public network type, to obtain updated forwarding field information;

[0217] The field updating subunit 1232 is specifically used to update the target field information in the forwarding field information through the fifth value field if the data packet type is a public network to intranet type, so as to obtain updated forwarding field information.

[0218] The state table update subunit 1233 is used to update the fully connected state table based on the forwarding field information if the fifth key field corresponding to the forwarding field information does not exist in the fully connected state table, send a state table update notification to the data layer, obtain the state table update notification in the data layer, and update S session state tables based on the state table update notification.

[0219] Among them, the state table update subunit 1233 is specifically used to generate public network conversion information corresponding to the forwarding field information if the data packet type is an intranet-to-public network type;

[0220] The state table updating subunit 1233 is specifically used to update H fully connected state tables based on the forwarding field information and the public network conversion information;

[0221] The state table updating subunit 1233 is further specifically used to discard the data packet if the data packet type is a public network to intranet type.

[0222] The specific implementation of the data packet sending subunit 1231, the field updating subunit 1232, and the state table updating subunit 1233 can be found in the above Figure 5 The description of S1023 in the corresponding embodiment will not be repeated here.

[0223] The specific implementation of the first matching unit 121, the second matching unit 122, and the data packet processing unit 123 can be found in the above Figure 3In the corresponding embodiment, S102 and Figure 5 The description of S1021-S1023 in the corresponding embodiment will not be repeated here.

[0224] The data packet updating module 13 is used to update the forwarding field information based on the S session state tables to obtain updated forwarding field information if the matching result indicates a successful match; the updated forwarding field information is used to update the data packet to obtain an updated data packet, and forward the updated data packet.

[0225] Wherein, S session state tables are associated with the data packet type of the data packet;

[0226] The data packet updating module 13 is specifically used to obtain the auxiliary field information in the fourth value field and the third value field from the S session state tables corresponding to the data packet type;

[0227] The data packet updating module 13 is specifically used to update the source field information in the forwarding field information by using the fourth value field and the auxiliary field information to obtain the updated forwarding field information if the data packet type is an intranet-to-public network type;

[0228] The data packet updating module 13 is specifically used to update the target field information in the forwarding field information through the fourth value field and the auxiliary field information to obtain the updated forwarding field information if the data packet type is a public network to intranet type.

[0229] The specific implementation of the data packet acquisition module 11, the state table matching module 12, and the data packet updating module 13 can be found in the above Figure 3 In the corresponding embodiment, S101-S103 and Figure 5 The description of S1021-S1023 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated here either.

[0230] For further information, see Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided in an embodiment of the present application, the computer device may be a switch with a gateway forwarding function (for example, the above Figure 1 The switch 2000 in the corresponding embodiment includes a data layer and a control layer. Figure 7As shown, the computer device 1000 may include: a processor 1001, a network interface 1004 and a memory 1005. In addition, the above-mentioned computer device 1000 may also include: a user interface 1003, and at least one communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components; the user interface 1003 may include a standard wired interface and a wireless interface. Optionally, the network interface 1004 may include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or it may be a non-volatile memory (non-volatile memory), such as at least one disk storage. Optionally, the memory 1005 may also be at least one storage device located away from the aforementioned processor 1001. As Figure 7 As shown, the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a device control application program.

[0231] In such Figure 7 In the computer device 1000 shown, the network interface 1004 can provide a network communication function; the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the device control application stored in the memory 1005 to achieve:

[0232] Obtain data packets to be forwarded in the data layer;

[0233] Match the forwarding field information in the data packet with S session state tables to obtain a matching result; S is a positive integer greater than 1; the S session state tables are obtained by subdividing the full connection state table in the control layer; the field information of the S session state tables includes the field information of the full connection state table;

[0234] If the matching result indicates a successful match, the forwarding field information is updated based on the S session state tables to obtain updated forwarding field information; the updated forwarding field information is used to update the data packet to obtain an updated data packet, and the updated data packet is forwarded.

[0235] It should be understood that the computer device 1000 described in the embodiment of the present application can execute the above Figure 3 and Figure 5 The description of the data processing method in the corresponding embodiment can also be performed as described above. Figure 6 The description of the data processing device 1 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated here either.

[0236] In addition, it should be pointed out here that: the embodiment of the present application also provides a computer-readable storage medium, and the computer-readable storage medium stores a computer program executed by the data processing device 1 mentioned above. When the processor executes the computer program, it can execute the above-mentioned Figure 3 and Figure 5 The description of the data processing method in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer-readable storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0237] In addition, it should be noted that: the embodiment of the present application also provides a computer program product, which may include a computer program, and the computer program may be stored in a computer-readable storage medium. The processor of the computer device reads the computer program from the computer-readable storage medium, and the processor may execute the computer program, so that the computer device performs the above Figure 3 and Figure 5 The description of the data processing method in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer program product embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0238] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0239] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data processing method, characterized in that: The method is performed by a switch with a gateway forwarding function, the switch comprising a data layer and a control layer, including: Acquire a data packet to be forwarded in the data layer; Match the forwarding field information in the data packet with S session state tables to obtain a matching result; S is a positive integer greater than 1; the S session state tables are obtained by performing table splitting processing on the full connection state table in the control layer; the field information of the S session state tables includes the field information of the full connection state table; If the matching result indicates a successful match, the forwarding field information is updated based on the S session state tables to obtain updated forwarding field information; the updated forwarding field information is used to update the data packet to obtain an updated data packet, and the updated data packet is forwarded.

2. The method according to claim 1, characterized in that The S session state tables in the data layer include a first session state table and a second session state table; The step of matching the forwarding field information in the data packet with the S session state tables to obtain a matching result includes: Acquire forwarding field information from header information of the data packet, and match the forwarding field information with the first session state table in the S session state tables to obtain a first candidate matching result; If the first candidate matching result indicates a successful match, obtaining conversion field information from the first session state table, and matching the conversion field information with the second session state table in the S session state tables to obtain a matching result; The method further comprises: If the first candidate matching result indicates a matching failure, the data packet is sent to the control layer, and the control layer performs data packet processing on the data packet.

3. The method according to claim 2, characterized in that The first session state table includes a pre-processing table and a session table; the forwarding field information includes pre-processing field information and session field information; The step of matching the forwarding field information with the first session state table in the S session state tables to obtain a first candidate matching result includes: Matching the preprocessing field information in the forwarding field information with the preprocessing table to obtain a second candidate matching result; Obtaining candidate field information in the second candidate matching result, performing hash compression on the candidate field information, and generating hash field information corresponding to the candidate field information; The hash field information and the session field information in the forwarding field information are matched with the session table to obtain a first candidate matching result.

4. The method according to claim 3, characterized in that The preprocessing field information includes first preprocessing field information and second preprocessing field information; the preprocessing table includes a first preprocessing table and a second preprocessing table; The matching the preprocessing field information in the forwarding field information with the preprocessing table to obtain a second candidate matching result includes: Matching the first preprocessing field information in the preprocessing field information with the first preprocessing table, if the first key field corresponding to the first preprocessing field information exists in the first preprocessing table, obtaining the first value field corresponding to the first key field, and determining the first value field as the first candidate field information; if the first key field corresponding to the first preprocessing field information does not exist in the first preprocessing table, determining the first candidate value field as the first candidate field information; Matching the second preprocessing field information in the preprocessing field information with the second preprocessing table, if the second key field corresponding to the second preprocessing field information exists in the second preprocessing table, obtaining the second value field corresponding to the second key field, determining the second value field as the second candidate field information, and if the second key field corresponding to the second preprocessing field information does not exist in the second preprocessing table, determining the second candidate value field as the second candidate field information; The first candidate field information and the second candidate field information are determined as candidate field information, and a second candidate matching result including the candidate field information is generated.

5. The method according to claim 3, characterized in that: The candidate field information includes first candidate field information and second candidate field information; The performing hash compression on the candidate field information to generate hash field information corresponding to the candidate field information includes: Performing a hash operation on the first candidate field information to generate a first hash value corresponding to the first candidate field information; Performing a hash operation on the second candidate field information to generate a second hash value corresponding to the second candidate field information; An XOR process is performed on the first Hash value and the second Hash value to generate Hash field information corresponding to the candidate field information.

6. The method according to claim 3, characterized in that The step of matching the hash field information and the session field information with the session table in the forwarding field information to obtain a first candidate matching result includes: Matching the session field information in the hash field information and the forwarding field information with the session table, and if a third key field corresponding to the hash field information and the session field information exists in the session table, obtaining a third value field corresponding to the third key field, and generating a first candidate matching result indicating a successful match based on the third value field; If the third key field corresponding to the hash field information and the session field information does not exist in the session table, a first candidate matching result indicating a matching failure is generated.

7. The method according to claim 6, characterized in that The acquiring conversion field information from the first session state table, matching the conversion field information with the second session state table in the S session state tables, and obtaining a matching result includes: Acquire conversion field information from the first session state table; the conversion field information belongs to the third value field; Matching the conversion field information with the second session state table in the S session state tables, and if a fourth key field corresponding to the conversion field information exists in the second session state table, obtaining a fourth value field corresponding to the fourth key field, and generating a matching result indicating a successful match based on the fourth value field; If the fourth key field corresponding to the conversion field information does not exist in the second session state table, generating a matching result indicating a matching failure; The method further comprises: If the matching result indicates a matching failure, the data packet is discarded.

8. The method according to claim 2, characterized in that: The sending of the data packet to the control layer and performing data packet processing on the data packet by the control layer includes: Sending the data packet to the control layer, and acquiring the data packet in the control layer; Matching the forwarding field information with the fully connected state table, if a fifth key field corresponding to the forwarding field information exists in the fully connected state table, obtaining a fifth value field corresponding to the fifth key field, and updating the forwarding field information based on the fifth value field to obtain updated forwarding field information; If the fifth key field corresponding to the forwarding field information does not exist in the fully connected state table, the fully connected state table is updated based on the forwarding field information, a state table update notification is sent to the data layer, the state table update notification is obtained in the data layer, and the S session state tables are updated based on the state table update notification.

9. The method according to claim 8, characterized in that The sending the data packet to the control layer and obtaining the data packet in the control layer includes: Sending the data packet to the control layer, and receiving the data packet in the control layer; Match the data packet with the conversion rule to obtain a rule matching result; If the rule matching result indicates a successful match, obtaining the data packet in the control layer; The method further comprises: If the rule matching result indicates a match failure, the data packet is discarded.

10. The method according to claim 8, characterized in that The number of the fully connected state tables is H, where H is a positive integer greater than 1; The step of matching the forwarding field information with the fully connected state table, and if a fifth key field corresponding to the forwarding field information exists in the fully connected state table, obtaining a fifth value field corresponding to the fifth key field, and updating the forwarding field information based on the fifth value field to obtain updated forwarding field information includes: Obtaining a fully connected state table corresponding to the data packet type of the data packet from the H fully connected state tables, and matching the forwarding field information with the fully connected state table corresponding to the data packet type; If the fifth key field corresponding to the forwarding field information exists in the full connection state table corresponding to the data packet type, obtaining the fifth value field corresponding to the fifth key field; The forwarding field information is updated based on the fifth value field and the data packet type to obtain updated forwarding field information.

11. The method according to claim 10, characterized in that The updating of the forwarding field information based on the fifth value field and the data packet type to obtain updated forwarding field information includes: If the data packet type is an intranet-to-public network type, the source field information in the forwarding field information is updated through the fifth value field to obtain updated forwarding field information; If the data packet type is a public network to intranet type, the target field information in the forwarding field information is updated through the fifth value field to obtain updated forwarding field information.

12. The method according to claim 10, characterized in that The updating of the fully connected state table based on the forwarding field information includes: If the data packet type is an intranet-to-public network type, generating public network conversion information corresponding to the forwarding field information; Updating the H fully connected state tables based on the forwarding field information and the public network conversion information; The method further comprises: If the data packet type is a public network to intranet type, the data packet is discarded.

13. The method according to claim 7, characterized in that S of the session state tables are associated with the data packet type of the data packet; The updating of the forwarding field information based on the S session state tables to obtain updated forwarding field information includes: Acquire auxiliary field information in the fourth value field and the third value field from the S session state tables corresponding to the data packet type; If the data packet type is an intranet-to-public network type, the source field information in the forwarding field information is updated by using the fourth value field and the auxiliary field information to obtain updated forwarding field information; If the data packet type is a public network to intranet type, the target field information in the forwarding field information is updated by using the fourth value field and the auxiliary field information to obtain updated forwarding field information.

14. A data processing device, characterized in that: The device runs on a switch with a gateway forwarding function, and the switch includes a data layer and a control layer, including: A data packet acquisition module, used for acquiring data packets to be forwarded in the data layer; A state table matching module, used for matching the forwarding field information in the data packet with S session state tables to obtain a matching result; S is a positive integer greater than 1; the S session state tables are obtained by performing table splitting processing on the full connection state table in the control layer; the field information of the S session state tables includes the field information of the full connection state table; A data packet updating module is used to update the forwarding field information based on the S session state tables to obtain updated forwarding field information if the matching result indicates a successful match; the updated forwarding field information is used to update the data packet to obtain an updated data packet, and forward the updated data packet.

15. A computer device, characterized in that: include: Processor and memory; The processor is connected to the memory, wherein the memory is used to store a computer program, and the processor is used to call the computer program so that the computer device executes the method according to any one of claims 1 to 13.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which is suitable for being loaded and executed by a processor, so that a computer device having the processor executes the method according to any one of claims 1 to 13.

Images