Implementation method of three-layer switch and three-layer switch
By setting up the Layer 2 and Layer 3 flow table matching modules in the switch, combining activity management and optimized table lookup methods, the flexibility and controllability of Layer 2 and Layer 3 network packet forwarding in the SDN architecture is solved, and efficient network topology management and low-latency forwarding are achieved.
Patent Information
- Application Number
- CN202510507048.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-22
- Publication Date
- 2025-07-25
AI Technical Summary
The existing SDN architecture cannot achieve high-speed and low-latency forwarding of Layer 2 and Layer 3 network packets at the same time, and has low flexibility and controllability, which cannot meet the network processing needs of cloud computing and big data.
Set up the second-layer flow table matching module and the third-layer flow table matching module in the switch, judge the forwarding path based on the MAC address of the data stream, and maintain the mapping relationship between the port and the MAC address in combination with the activity management mechanism. The table lookup process is optimized using an independent storage method of index and data to realize high-performance second-layer and third-layer data stream forwarding.
It realizes the flexibility and controllability of network topology, improves network forwarding efficiency and data accuracy, reduces data packet forwarding delay, and meets the network processing needs of cloud computing and big data.
Smart Images
Figure CN120378388A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network technologies, and in particular, to a method for implementing a three-layer switch and a three-layer switch. Background Art
[0002] The network architecture is crucial in the process of implementing data processing and forwarding. The network architecture includes a traditional network architecture and a software defined network (SDN) architecture. In the traditional network architecture, the data plane and the control plane are vertically coupled on the same network device, and decision-making processing and routing packet encapsulation are performed according to the configured rules. However, with the rapid development of business fields such as social networks, mobile Internet, and Internet of Things, the traditional network architecture cannot meet the processing of massive data, cloud computing, and big data, and there are problems such as complex network topologies, cumbersome configurations, and inconvenient management.
[0003] The SDN architecture separates the data plane and the control plane, which is more flexible. However, the current SDN architecture cannot simultaneously achieve high-speed and low-latency forwarding of both layer-2 and layer-3 network data packets, and has low flexibility and controllability in the process of forwarding network data packets. Summary of the Invention
[0004] This application provides a method for implementing a three-layer switch and a three-layer switch, which can more flexibly and controllably implement the processing and forwarding of layer-2 and layer-3 network packets.
[0005] In a first aspect, a method for implementing a three-layer switch is provided. The execution entity of this method is a router or a device that can implement routing functions, such as a switch. The method includes: obtaining the media access control (MAC) address of the first key field in the first data stream; if the MAC address is FFFF or the receiving port MAC, sending the first data stream to the three-layer flow table matching module; if the MAC address is not the receiving port MAC, sending the first data stream to the two-layer flow table matching module; encapsulating the first data stream processed by the three-layer flow table matching module or the two-layer flow table matching module to obtain a second data stream, where the second data stream includes a destination port; and sending the second data stream to the destination port.
[0006] In this method, the switch includes a two-layer flow table matching module and a three-layer flow table matching module. According to the MAC address of the first data stream, it can be decided whether to forward the first data stream to the two-layer flow table matching module or the three-layer flow table matching module. Through this method, both the forwarding of layer-2 network data and the forwarding of layer-3 network data can be achieved, making the network topology more flexible and controllable.
[0007] Optionally, if the MAC address is not the receiving port MAC and the MAC address is located in the preset MAC address table, add the MAC address to the first entry in the layer 2 flow table matching module, where the activity of any MAC address in the first entry is greater than or equal to the first threshold; if the MAC address is not in the preset MAC address table, update the MAC address to the MAC address table.
[0008] In this solution, MAC addresses with relatively high activity are stored in one entry. By maintaining the mapping relationship between switch ports and MAC addresses, it is possible to avoid resource occupation by invalid or expired entries, thereby ensuring network forwarding efficiency and data accuracy.
[0009] Optionally, traverse the activity of all MAC addresses in the first entry; when the activity of the first MAC address in the first entry is less than or equal to the first threshold, delete the first MAC address from the first entry and add the first MAC address to the second entry, where the activity of any MAC address in the second entry is less than the first threshold.
[0010] This solution can update the first entry in a relatively timely manner, that is, dynamically maintain the mapping relationship between switch ports and MAC addresses, so as to delete invalid or expired entries in a relatively timely manner and save memory resources.
[0011] Optionally, if the MAC address is FFFF, look up the table in the layer 3 flow table matching module according to the first keyword corresponding to the first data stream; if the table lookup is successful, output the table lookup result.
[0012] Optionally, if the MAC address is the receiving port MAC, in the first matching module of the layer 3 flow table matching module, look up the table according to the first keyword corresponding to the first data stream; if the table lookup is successful, then in the second matching module of the layer 3 flow table matching module, look up the table according to the second keyword corresponding to the first data stream; until all matching modules in the layer 3 flow table matching module are traversed, output the table lookup result; where the matching modules in the layer 3 flow table matching module include: the first Internet Protocol (IP) module, the Segment Routing (SR) Policy module, the Address Resolution Protocol (ARP) module, the Security Identifiers (SID) module, the second IP module, the Neighbor Discovery Protocol (NDP) module, and the port matching module. The first IP module supports Internet Protocol Version 4 (IPv4), and the second IP module supports Internet Protocol Version 6 (IPv6).
[0013] Optionally, the IPv4 module is used to match the first data stream according to the IPv4 address; the SRPOLICY module (Segment Routing Policy module) is used to match the first data stream according to the bound segment ID (BSID), and the ARP module matches the first data stream according to the IPv4 address keyword; the IPv6 module is used to match the first data stream according to the IPv6 address, and the NDP module matches the first data stream according to the IPv6 address keyword; the SID module is used to determine the Segment Routing over IPv6 (Srv6) based on the IPv6 forwarding plane; the port matching module is used to match the first data stream according to the port identifier.
[0014] Optionally, when the first matching module is the IPv4 module and the second matching module is the SRPOLICY module, traversing all the matching modules in the three-layer flow table matching module includes: sequentially traversing the IPv4 module, the SRPOLICY module, and the ARP module; when the first matching module is the IPv6 module and the second matching module is the SRPOLICY module, traversing all the matching modules in the three-layer flow table matching module includes: sequentially traversing the IPv6 module, the SRPOLICY module, and the NDP module; when the first matching module is the SID module and the second matching module is the port matching module, traversing all the matching modules in the three-layer flow table matching module includes: sequentially traversing the SID module and the port matching module.
[0015] Optionally, before looking up the table according to the first keyword corresponding to the first data stream, it is determined that the MAC address in the first data stream matches the MAC address of the device itself.
[0016] In a second aspect, a three-layer switch is provided. The three-layer switch includes at least one processor and at least one memory. The at least one processor can be used to: receive a first data stream, where the first data stream includes a first key field; obtain the MAC address in the first key field; if the MAC address is FFFF or the receiving port MAC, send the first data stream to the three-layer flow table matching module; if the MAC address is not the receiving port MAC, send the first data stream to the two-layer flow table matching module; encapsulate the first data stream processed by the three-layer flow table matching module or the two-layer flow table matching module to obtain a second data stream, where the second data stream includes a destination port; send the second data stream to the destination port. The at least one memory is used to store the first data stream.
[0017] Optionally, the at least one processor is further used to: if the MAC address is located in a preset MAC address table, add the MAC address to the first entry in the two-layer flow table matching module, where the activity of any MAC address in the first entry is greater than or equal to a first threshold; if the MAC address is not in the preset MAC address table, update the MAC address to the MAC address table.
[0018] Optionally, the at least one processor is further configured to: traverse the activity levels of all MAC addresses in the first entry; when the activity level of the first MAC address in the first entry is less than or equal to the first threshold, delete the first MAC address from the first entry and add the first MAC address to the second entry, where the activity level of any MAC address in the second entry is greater than the first threshold.
[0019] In a third aspect, a three-layer switch is provided, and the three-layer switch includes a functional module for performing the method of the first aspect. For example, the three-layer switch includes a processing unit (sometimes also referred to as a processing module or a processor) and a memory. These units (modules) can perform the corresponding functions in the method example of the first aspect above. For specific details, refer to the detailed description in the method example, which will not be elaborated here.
[0020] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is run, the method in the first aspect above is implemented.
[0021] In a fifth aspect, a computer program product is provided. The computer program product includes: computer program code, and when the computer program code is run, the method in the first aspect above is executed. Description of the Drawings
[0022] Figure 1 It is a structural diagram of a three-layer switch in the SDN architecture provided by an embodiment of the present application;
[0023] Figure 2 It is a schematic flowchart of a method for implementing a three-layer switch provided by an embodiment of the application;
[0024] Figure 3 It is a detailed design diagram of a single port provided by an embodiment of the present application;
[0025] Figure 4 It is a schematic flowchart of a method for implementing a three-layer switch provided by an embodiment of the present application;
[0026] Figure 5 It is a diagram of the Ethernet frame data format provided by an embodiment of the present application;
[0027] Figure 6 It is a block diagram of the implementation of two-layer flow table matching provided by an embodiment of the present application;
[0028] Figure 7 It is a diagram of the implementation of the TCAM table lookup algorithm provided by an embodiment of the present application;
[0029] Figure 8 It is a block diagram of the implementation of three-layer flow table matching provided by an embodiment of the present application;
[0030] Figure 9 This is the state transition diagram of the data packet update module provided by the embodiments of the present application. Detailed implementation manners
[0031] Currently, with the rapid development of network technology, the traffic is gradually increasing and there are more and more network protocols, resulting in an increasingly high complexity of the topology of traditional network devices. The traditional network architecture is difficult to meet the flexible resource requirements put forward by cloud computing, big data, and related services, and at the same time, it is difficult to meet the growing network performance requirements and the requirements of cloud-network integration. In the traditional network architecture, the data plane and the control plane are highly vertically coupled, and any operation on applications or traffic is limited to operating on a single network device.
[0032] Therefore, an SDN is introduced. SDN adopts the idea of separating data from control, and strips the control function from forwarding devices (such as switches). The switch is only responsible for data forwarding and does not need to process control signals. The controller realizes the control of network functions, such as being responsible for state management and logic implementation, and the allocation of network resources, thereby improving the network management and control efficiency and the flexibility of network configuration.
[0033] As Figure 1 shown, the SDN architecture includes a control plane and a data plane. One control plane can communicate with multiple data planes through a secure channel to achieve centralized control of the regional network. Figure 1 Taking the implementation of the data plane through an FPGA card as an example, the FPGA card and the Ethernet port are connected through an FPGA relay card (FMC). In the SDN architecture, the device responsible for control is called the control plane, and the device responsible for switching is called the data plane. This architecture enables the control of devices from different manufacturers without relying on corresponding supporting software, eliminates the differences from underlying network devices, and at the same time opens the control right of the devices. Users can freely implement various transmission rule policies, making the network more flexible and intelligent. However, currently, switches based on the SDN network architecture can only adapt to the forwarding of two-layer network data and cannot implement the forwarding of three-layer network data, and cannot meet the growing needs of cloud computing and big data for the network to process the forwarding of massive data.
[0034] In view of this, the solution of the embodiments of the present application is provided. In the embodiments of the present application, a two-layer flow table matching module or a three-layer flow table matching module is set in the switch. According to the MAC address of the data stream, it is determined whether to hand it over to the two-layer flow table matching module or the three-layer flow table matching module for processing, and the data stream after being processed by the two-layer flow table matching module or the three-layer flow table matching module is forwarded. Through this solution, the forwarding of two-layer and three-layer data streams can be achieved with high performance, making the network topology more flexible and controllable.
[0035] To facilitate the understanding of the solution provided by the embodiments of the present application, some concepts involved in the embodiments of the present application are first introduced.
[0036] (1) Round-robin scheduling
[0037] The rule of round-robin scheduling is to first check whether multiple output port queues are empty. If there is a non-empty queue, the corresponding queue is read out from the FIFO. Initially, port 1 has the highest priority. After the data of port 1 is read out, port 2 has the highest priority, and so on.
[0038] (2) State machine (SM)
[0039] A state machine is a design pattern used to describe the transitions and behaviors of an object between different states. A state machine can help developers manage complex state logic, making the behavior of the system in different states easier to understand and maintain. A state machine includes states, events, transitions, and behaviors. Among them, states define all possible states that the system can be in, events are the events that trigger state transitions, transitions are used to describe the transition rules between states, usually associated with specific events, and behaviors refer to the operations executed when entering, exiting, or transitioning states. State machines are divided into finite state machines (FSM) and hierarchical state machines. A finite state machine means that the number of states is limited, and a hierarchical state machine means that state nesting is allowed.
[0040] (3) Virtual routing and forwarding (VRF)
[0041] VRF is a logical division of physical devices. Each logical unit is called a VPN instance, and the instances are isolated at the routing level. Each incoming packet can know which VRF it belongs to. A VRF corresponds to a set of tables. By judging which VRF it is, the corresponding flow table is queried and then output to the corresponding port. The specific implementation method of VRF will be introduced below and will not be introduced here.
[0042] (4) Flow table configuration and flow table update
[0043] The flow table is a storage structure inside the switch, used to store the data flow matching rules and the operation actions corresponding to the matching rules. When the switch receives a packet, it first queries in the flow table whether there is a rule that matches the packet. If there is, the corresponding operation action is executed according to the matching rule.
[0044] Flow table configuration refers to the process of sending flow tables to an SDN switch by the controller. Flow table configuration includes deleting flow table entries and adding flow table entries. Deleting a flow table entry means querying the corresponding flow table entry according to the IP address and mask, deleting the flow table entry, and moving all subsequent flow table entries forward in sequence. Adding a flow table entry includes querying the corresponding flow table entry in the flow table, replacing the corresponding data in the flow table entry, and inserting it at the end of the corresponding mask flow table entry according to the mask length.
[0045] The following details the technical solutions provided by the embodiments of this application with reference to the accompanying drawings.
[0046] In the embodiments of this application, the design of the data plane of a three-layer switch based on SDN is as Figure 2 shown. The data plane may include a receiving unit, a data processing unit, a switching unit, and a control unit. The receiving unit is used to convert the serial data input through the service channel into the protocol data stream used by the user, and verify the check field in the data packet (CRC check), discard the data packets with verification errors, and pass the data packets with correct verification to the data processing unit. The data processing unit parses the data stream from the receiving unit, parses the network protocol of the data packet, and processes (such as editing) the data packet according to the query processing rules of the data packet, and then passes it to the switching unit. The switching unit is used to schedule the received data packet to the corresponding output port according to the output port number and the scheduling rule, and complete the forwarding of the data packet.
[0047] It is used to upload the query processing rules of the data plane, the data packets generated by the upper layer, and the status information of the device, etc.
[0048] The control unit is used to process the information interaction between the control plane and the data plane. The messages transmitted through the control channel follow the openflow protocol. For example, the control unit includes an upper-layer control protocol stack that follows the openflow protocol. The control unit can establish communication with the control plane, be responsible for reporting the status information of the data plane (such as the status information of the device), and uploading the data packets with failed flow table queries (such as the data packets generated by the upper layer). The control plane can also be used for issuing flow table information, issuing data packets, etc. Optionally, the control unit includes a UDP communication module for connecting / communicating with the control plane through the UDP protocol. The control unit also includes a FIFO interface for caching data packets. The uploading of data packets adopts a polling mechanism.
[0049] Taking a single port as an example, the structure of a three-layer switch based on SDN is as Figure 4 shown. A three-layer switch based on SDN includes a two-layer flow table matching module and a three-layer flow table matching module, as well as a data packet parsing module, a data packet editing module, a switching module, a control module, and a data packet caching module. Among them, the data packet enters the input interface (such as Figure 4The MAC+PHY input interface extracts the MAC address and its Ethernet frame information from the data packet and sends the extracted content to the data packet parsing module. The data packet parsing module parses the protocol type of the data packet, extracts the key fields, and determines whether to process the data packet by the layer 2 flow table matching module or the layer 3 flow table matching module based on the MAC address. The layer 2 flow table matching module or the layer 3 flow table matching module looks up the data packet's output port number according to the key fields, edits the corresponding fields of the data packet through the data packet editing module, and passes the edited data packet to the switching module, which determines the forwarding path of the data packet.
[0050] The process of the switching module is as follows: If the device operates at layer 3, check whether the MAC address of the data packet / data stream matches the MAC address of the device itself. If it matches, proceed to the next step; otherwise, discard it. If the device operates at layer 2, perform protocol parsing on the data packet / data stream. If the protocol of the data packet is supported, proceed to the next step, and send the packet header and payload of the data packet to the corresponding buffers respectively. Then, extract the corresponding key fields (IP address) according to the protocol and send them to the corresponding flow table. After all the flow tables have been looked up, collect the actions of each flow table, request the packet header buffer, edit the packet header, request the payload buffer, and determine the forwarding path of the data stream based on the action results. Forward the data stream / data packet according to the forwarding path.
[0051] Please refer to Figure 4 , which is a schematic flowchart of the implementation method of the three-layer switch provided by the embodiment of the present application. This method can be applied to the controller in the SDN system. The process of this method is described as follows:
[0052] S401: Receive the first data stream and obtain the MAC address in the first key field.
[0053] As Figure 3 shown, after the input interface in the switch receives the first data stream, it can extract some information of the first data stream, such as extracting the MAC address and Ethernet frame information of the first data stream. Specifically, the input interface can obtain the first key field of the first data stream and obtain the MAC address in the first key field to determine whether the first data stream is processed by the layer 2 flow table matching module or the layer 3 flow table matching module based on the first MAC address.
[0054] The first data stream can be the received original data packet or the data stream obtained by processing the original data packet. When extracting the MAC address in the first key field of the first data stream, the first data stream can be parsed to obtain the network protocol corresponding to the first data stream, the Ethernet frame header of the first data stream can be extracted, and the MAC address can be obtained from the first key field (destination MAC field) included in the Ethernet frame header. It should be understood that the protocol fields obtained by parsing the network protocol include Ethernet fields, VLAN fields, IPV4 fields, IPV6 fields, SRV6 fields, and UDP fields. As Figure 5 shown, the Ethernet frame header includes the destination MAC address, source MAC, custom fields, VLAN tag, and type; the Ethernet frame data includes the Ethernet frame header, Ethernet frame data, and frame check sequence (FCS).
[0055] S402: If the MAC address is FFFF or the receiving port MAC, send the first data stream to the three-layer flow table matching module; if the MAC address is not the receiving port MAC, send the first data stream to the two-layer flow table matching module.
[0056] The data packet parsing module can determine whether to send the first data stream to the two-layer flow table matching module or the three-layer flow table matching module according to the MAC address in the first key field of the first data stream. The judgment criteria are as follows: If the MAC address is FFFF or the receiving port MAC, send the first data stream to the three-layer flow table matching module; if the MAC address is not the receiving port MAC, send the first data stream to the two-layer flow table matching module.
[0057] S403: Encapsulate the first data stream processed by the three-layer flow table matching module or the two-layer flow table matching module to obtain a second data stream, and the second data stream includes the destination port.
[0058] When the data packet parsing module sends the first data stream to the two-layer flow table matching module, the two-layer flow table matching module processes the first data stream. The two-layer flow table matching module can look up the table according to the MAC address in the first data stream to obtain a query result such as the MAC address.
[0059] As Figure 6As shown, in the embodiments of the present application, an active entry (the first entry in this text) can be set to store MAC addresses with an activity level greater than or equal to a first threshold. Or rather, MAC addresses with a relatively high activity level are stored in one entry. By maintaining the mapping relationship between switch ports and MAC addresses, it is possible to avoid resource occupation by invalid or expired entries, thereby ensuring network forwarding efficiency and data accuracy. If the MAC address is not the receiving port MAC and the MAC address is located in the preset MAC address table, the MAC address is added to the first entry in the layer 2 flow table matching module. In addition, MAC address learning can also be performed to update the MAC table entries in a timely manner. For example, if the MAC address is not within the preset MAC address table, the MAC address is updated to the MAC address table.
[0060] Optionally, traverse whether each entry was active in the previous time period. If it was not active, delete the entry and write the address of the deleted entry into the available address FIFO. For example, traverse the activity levels of all MAC addresses in the first entry; when the activity level of the first MAC address in the first entry is less than or equal to the first threshold, delete the first MAC address from the first entry and add the first MAC address to the second entry, where the activity level of any MAC address in the second entry is less than the first threshold. Here, the second entry is used to store available addresses.
[0061] When the data packet parsing module sends the first data stream to the layer 3 flow table matching module, the layer 3 flow table matching module processes the first data stream. The layer 3 flow table matching module can use the TCAM look-up table method to perform look-up table processing on the first data stream.
[0062] In the embodiments of the present application, for the flow table, an index and data independent storage method can be adopted for storage. Among them, the index is stored in a register, and the data is stored in a block (block) RAM (BRAM). The index can be used to obtain an address through look-up table, and then the data corresponding to this address in the BRAM can be obtained according to the address. Compared with the on-chip plus off-chip DDR storage of large-scale flow tables in traditional layer 3 switches, it can reasonably utilize on-chip resources and reduce the look-up table latency.
[0063] For example, please refer to Figure 7 , which is the TCAM look-up table block diagram provided by the embodiments of the present application. The flow table is stored in an index and data independent storage method. In this way, when performing look-up table, the query field in the first data stream can be compared with multiple key fields in the flow table one by one. If the query field is the same as a certain key field (such as key field 1), the corresponding bit address in the address register is assigned the current address value, otherwise it is assigned 0 to obtain the final query result. After being decoded by the decoder, the corresponding data is found in the BRAM according to the address index.
[0064] The process of looking up tables in the three - layer flow table matching module is as follows: In the first matching module, look up the table according to the first key word corresponding to the first data stream; if the table look - up is successful, then in the second matching module, look up the table according to the second key word corresponding to the first data stream; until all matching modules in the three - layer flow table matching module are traversed, and then output the table look - up result. For example, please refer to Figure 8 , the three - layer flow table matching module includes: the first IP module, the segment routing policy module (SR_policy module), the ARP module, the SID module, the second IP module, the NDP module, and the port matching module, the IPV4 module, and the IPV6 module.
[0065] It should be understood that the IPV4 module is used to match the first data stream according to the IPV4 address; the SR_policy module is used to match the first data stream according to the bound segment B SID, the ARP module matches the first data stream according to the IPV4 address key word; the IPV6 module is used to match the first data stream according to the IPV6 address, the NDP module matches the first data stream according to the IPV6 address key word; the SID module is used to judge the segment routing Srv6 based on the IPv6 forwarding plane; the port matching module is used to match the first data stream according to the port identifier.
[0066] During the process of looking up tables in the three - layer flow table matching module, each module is traversed in sequence. For example, if the first matching module is the IPV4 module and the second matching module is the SR_policy module, traversing all matching modules in the three - layer flow table matching module includes: traversing the IPV4 module, the SR_policy module, and the ARP module in sequence; if the first matching module is the IPV6 module and the second matching module is the SR_policy module, traversing all matching modules in the three - layer flow table matching module includes: traversing the IPV6 module, the SR_policy module, and the NDP module in sequence; if the first matching module is the SID module and the second matching module is the port matching module, traversing all matching modules in the three - layer flow table matching module includes: traversing the SID module and the port matching module in sequence. In this way, it is equivalent to looking up tables in a pipeline manner, solving the problem of low throughput rate caused by multiple ports submitting table look - up requests simultaneously. The table look - up method of the three - layer flow table matching module in the embodiments of the present application can meet the rate requirements of multiple ports looking up tables simultaneously, enabling the packet throughput rate of a single port to reach 14.88 Mpps and achieving a forwarding rate of 10 Gbps for the system.
[0067] IPV4 module: When the start table lookup pull-up signal is high, it enters the processing state, judges the VRF byte, and performs table lookup according to the IPV4 destination address and mask keyword; if the table lookup result is not hit, if the flow table addition flag is set high, it searches for the blank flow table entry with the same mask in the table and adds the data to the blank flow table entry. If the flow table deletion flag is set high, it directly returns the deletion operation completion flag; otherwise, it outputs the table lookup miss flag. If the table lookup result is hit, if the flow table addition flag is set high, it replaces all items in the flow table. If the flow table deletion flag is set high, it deletes the flow table item, and the flow tables with the same mask are shifted forward in turn; otherwise, it sets the SR_policy module lookup signal high, selects the appropriate BSID according to the value of ip_opertion, waits for the lookup result returned by the SR_policy module, and then outputs the table lookup result.
[0068] SR_policy module: When starting table lookup, it enters the processing state and performs table lookup according to the VRF byte and BSID keyword. If the table lookup result is not hit and the flow table addition flag is set high, it searches for the blank flow table entry in the table and adds the data to the blank flow table entry; if the table lookup result is not hit and the flow table deletion flag is set high, it directly returns the deletion operation completion flag. Then, it separately judges the valid flags of the ipv4 module and the ipv6 module. If the valid flag is high level, it sets the lookup signals of the ARP module and the NDP module high respectively. Otherwise, when the ARP or NDP module finishes table lookup, it outputs the table lookup miss flag of this module. If the table lookup result hits the flow table entry and the flow table addition flag is set high, it replaces all items in the flow table; if the table lookup result hits the flow table entry and the flow table deletion flag is set high, it deletes the flow table item, and the flow tables are shifted forward in turn; otherwise, it separately judges the ipv4 and ipv6 valid flags. If they are high level, it sets the lookup signals of the ARP module and the NDP module high respectively. Then, it judges the layer of the hit flow table entry, and outputs the result after the ARP module and the NDP module finish lookup.
[0069] ARP module: When starting table lookup, it enters the processing state and performs table lookup according to the VRF byte and the next-hop ipv4 address keyword. If the table lookup result is not hit and the flow table addition flag is set high, it searches for the blank flow table entry in the table and adds the data to the blank flow table entry; if the table lookup result is not hit and the flow table deletion flag is set high, it directly returns the deletion operation completion flag. Otherwise, it outputs the table lookup miss flag of this module. If the table lookup result hits the flow table entry and the flow table addition flag is set high, it replaces all items in the flow table; if the table lookup result hits the flow table entry and the flow table deletion flag is set high, it deletes the flow table item, and the flow tables are shifted forward in turn; otherwise, it outputs the table lookup result.
[0070] SID_type module: If the ipv6 table lookup flag is set high, it enters the ipv6 processing state. If the Srv6 table lookup flag is set high, it enters the Srv6 processing state.
[0071] Srv6 processing state: Look up the table according to the VRF byte and the ipv6 destination address keyword. If the table look-up result is not hit and the flow table addition flag is set high, find the blank flow table entry in the table and add the data to the blank flow table entry; if the table look-up result is not hit and the flow table deletion flag is set high, directly return the deletion operation completion flag; otherwise, output the table look-up miss flag of this module. If the table look-up result hits the flow table entry and the flow table addition flag is set high, replace all items of the flow table; if the table look-up result hits the flow table entry and the flow table deletion flag is set high, delete the flow table entry and shift the flow table forward in turn; otherwise, output the SID byte obtained from the table look-up to the control module and different types of SID processing modules.
[0072] IPV6 module: The subsequent processing flow is similar to that of IPV4.
[0073] END_SID module: When the SID byte is equal to the set end_sid, enter the processing state. Look up the table according to the VRF byte and the SRV6_SID keyword. If the table look-up result is not hit and the flow table addition flag is set high, find the blank flow table entry in the table and add the data to the blank flow table entry; if the table look-up result is not hit and the flow table deletion flag is set high, directly return the deletion operation completion flag; otherwise, output the table look-up miss flag of this module. If the table look-up result hits the flow table entry and the flow table addition flag is set high, replace all items of the flow table; if the table look-up result hits the flow table entry and the flow table deletion flag is set high, delete the flow table entry and shift the flow table forward in turn; otherwise, output the table look-up result. Other SID modules: The processing flow is similar to that of the END_SID module.
[0074] After the second-layer flow table matching module or the third-layer flow table matching module processes the first data stream, the output port (i.e., the destination port) of the first data stream can be obtained, and the first data stream is encapsulated according to the destination port to obtain the second data stream, and the second data stream includes the destination port. For example, after the second-layer flow table matching module or the third-layer flow table matching module processes the first data stream, it can send keyword segment information (such as the destination port) to the packet editing module. The packet editing module obtains the packet from the FIFO buffer, judges the position of the keyword segment according to the count value, completes the encapsulation of the packet at the corresponding position to obtain the second data stream. The second data stream is written into the FIFO buffer according to the destination port.
[0075] Among them, obtaining the second data stream mainly uses the state machine method to realize the data stream editing and encapsulation.
[0076] For example, please refer to Figure 9, which is the state transition diagram of the data packet update module provided by the embodiments of this application. The actions performed in each state are as follows: The idle state indicates waiting for an action instruction; the adding VLAN tag state indicates adding a VLAN tag to the read data packet; the holding state indicates writing the read data packet directly into the FIFO without any processing; the deleting VLAN tag state indicates deleting the VLAN tag from the read data packet; the SRV6_1 field update state indicates decrementing the hop limit of the read data packet by 1, decrementing the SL by 1, and updating the destination IP, destination MAC, and source MAC; the SRV6_2 field update state indicates updating the destination MAC and source MAC of the read data packet and deleting the IPv6 header; the SRV6_3 field update state indicates decrementing the hop limit of the read data packet by 1, updating the destination MAC and source MAC, deleting the SRV6 header, and changing the next header number in the IPv6 header; the SRV6_4 field update state: indicates deleting the IPv6 header from the read data packet; the IPv4 field update state indicates decrementing the TTL of the read data packet by 1 and updating the source MAC and destination MAC; the IPv6 field update state indicates decrementing the hop limit of the read data packet by 1 and updating the source MAC and destination MAC; the data packet upload state indicates re-encapsulating the read data packet according to the port protocol and then writing it into the FIFO; the IPv4_PACKAGE_BE state indicates adding the source MAC and destination MAC addresses to the read IPv4 packet and adding an IPv6 header; the IPv4_PACKAGE_TE state indicates adding the source MAC and destination MAC addresses to the read IPv4 packet, adding an IPv6 header, and adding an SRV6 extension header; the IPv6_PACKAGE_BE state indicates adding the source MAC and destination MAC addresses to the read IPv6 packet and adding an IPv6 header; the IPv6_PACKAGE_TE state indicates adding the source MAC and destination MAC addresses to the read IPv6 packet, adding an IPv6 header, and adding an SRV6 extension header.
[0077] S404. Send the second data stream to the destination port.
[0078] The second data stream includes destination port information. The second data stream written into the FIFO buffer is read out in a polling manner and delivered to the destination port. The polling method has been introduced above and will not be introduced here again.
[0079] Compared with traditional switches (the data packet forwarding delay is greater than 1 microsecond), the data packet forwarding delay of the three-layer switch implemented by the method provided by the embodiments of this application can be reduced to less than 1 microsecond.
[0080] The embodiments of this application also provide a computer-readable storage medium, including instructions, which when running on a computer, cause the computer to execute the methods in the above method examples. For specific details, please refer to the detailed description in the method examples and will not be elaborated here.
[0081] To implement each function in the method provided in the embodiments of the present application above, the switch may include a hardware structure and / or software modules, and implement the above functions in the form of a hardware structure, a software module, or a combination of a hardware structure and a software module. Whether a certain function among the above functions is executed in the form of a hardware structure, a software module, or a combination of a hardware structure and a software module depends on the specific application and design constraints of the technical solution.
[0082] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above function modules is used as an example for illustration. In actual applications, the above functions can be allocated to different function modules according to needs, that is, the internal structure of the device is divided into different function modules to complete all or part of the functions described above. The specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.
[0083] In addition, each functional unit in the embodiments of the present invention can be integrated into a processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
[0084] If the above integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: various media that can store program codes, such as a Universal Serial Bus flash disk (USB), a mobile hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disc.
[0085] In the embodiments of the present application, the various illustrative logical units and circuits can be implemented or operated with the described functions by a general-purpose processor, a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination of the above designs. The general-purpose processor can be a microprocessor, and optionally, the general-purpose processor can also be any conventional processor, controller, microcontroller or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration.
[0086] The steps of the methods or algorithms described in the embodiments of the present application can be directly embedded in hardware, software units executed by a processor, or a combination of both. The software units can be stored in a RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and the storage medium can be disposed in an ASIC.
[0087] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in Figure 1 one process or multiple processes and / or boxes Figure 1 the steps of the functions specified in one box or multiple boxes.
[0088] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.
Claims
1. A method for implementing a three-layer switch, characterized in that The switch includes a layer-2 flow table matching module and a layer-3 flow table matching module, and the method includes: Receiving a first data stream, where the first data stream includes a first key field; Obtaining the Media Access Control (MAC) address in the first key field. If the MAC address is FFFF or the receiving port MAC, sending the first data stream to the layer-3 flow table matching module; if the MAC address is not the receiving port MAC, sending the first data stream to the layer-2 flow table matching module; Encapsulating the first data stream processed by the layer-3 flow table matching module or the layer-2 flow table matching module to obtain a second data stream, where the second data stream includes a destination port; Sending the second data stream to the destination port.
2. The method according to claim 1, wherein If the MAC address is not the receiving port MAC, the method further includes: If the MAC address is in the preset MAC address table, adding the MAC address to the first entry in the layer-2 flow table matching module, where the activity of any MAC address in the first entry is greater than or equal to a first threshold; If the MAC address is not in the preset MAC address table, updating the MAC address to the MAC address table.
3. The method according to claim 2, wherein The method further includes: Traversing the activity of all MAC addresses in the first entry; When the activity of the first MAC address in the first entry is less than or equal to the first threshold, deleting the first MAC address from the first entry and adding the first MAC address to a second entry, where the activity of any MAC address in the second entry is less than the first threshold.
4. The method according to any one of claims 1-3, characterized in that, If the MAC address is FFFF or the receiving port MAC, the method further includes: In the first matching module in the layer-3 flow table matching module, looking up a table according to the first key corresponding to the first data stream; If the table lookup is successful, in the second matching module in the layer-3 flow table matching module, looking up a table according to the second key corresponding to the first data stream; Until all matching modules in the layer-3 flow table matching module are traversed, outputting the table lookup result; Wherein, the matching modules in the layer-3 flow table matching module include: a first Internet Protocol (IP) module, a Segment Routing Policy (SRPOLICY) module, an Address Resolution Protocol (ARP) module, a Security Identifier (SID) module, a second IP module, a Neighbor Discovery Protocol (NDP) module, and a port matching module, the first IP module supports Internet Protocol version 4, and the second IP module supports Internet Protocol version 6; The IPv4 module is used to match the first data stream according to the IPv4 address; the SRPOLICY module is used to match the first data stream according to the Binding Segment ID (BSID), and the ARP module matches the first data stream according to the IPv4 address keyword; the IPv6 module is used to match the first data stream according to the IPv6 address, and the NDP module matches the first data stream according to the IPv6 address keyword; the SID module is used to judge the Segment Routing over IPv6 (Srv6) based on the IPv6 forwarding plane; the port matching module is used to match the first data stream according to the port identifier.
5. The method according to claim 4, wherein when the first matching module is the IPv4 module and the second matching module is the SRPOLICY module, traversing all the matching modules in the three-layer flow table matching module includes: sequentially traversing the IPv4 module, the SRPOLICY module, and the ARP module. when the first matching module is the IPv6 module and the second matching module is the SRPOLICY module, traversing all the matching modules in the three-layer flow table matching module includes: sequentially traversing the IPv6 module, the SRPOLICY module, and the NDP module; when the first matching module is the SID module and the second matching module is the port matching module, traversing all the matching modules in the three-layer flow table matching module includes: sequentially traversing the SID module and the port matching module.
6. The method according to claim 5, wherein Before looking up the table according to the first keyword corresponding to the first data stream, the method further includes: determining that the MAC address in the first data stream matches the MAC address of the device itself.
7. A three-layer switch, characterized in that, The three-layer switch includes at least one processor and a memory; The at least one processor is configured to: receive a first data stream, where the first data stream includes a first key field; obtain the Media Access Control (MAC) address in the first key field; if the MAC address is FFFF or the receiving port MAC, send the first data stream to the three-layer flow table matching module; if the MAC address is not the receiving port MAC, send the first data stream to the two-layer flow table matching module; encapsulate the first data stream processed by the three-layer flow table matching module or the two-layer flow table matching module to obtain a second data stream, where the second data stream includes a destination port; and send the second data stream to the destination port; The memory is used for the first data stream.
8. The controller according to claim 7, characterized in that, The at least one processor is further configured to: if the MAC address is located in a preset MAC address table, add the MAC address to the first entry in the two-layer flow table matching module, where the activity of any MAC address in the first entry is greater than or equal to a first threshold; if the MAC address is not in the preset MAC address table, update the MAC address to the MAC entry.
9. The controller according to claim 8, characterized in that, The at least one processor is further configured to: traverse the activity of all MAC addresses in the first entry; When the activity of the first MAC address in the first entry is less than or equal to the first threshold, the first MAC address is deleted from the first entry and added to the second entry, where the activity of any MAC address in the second entry is less than the first threshold.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program, which, when running on a computer, causes the method according to any one of claims 1-6 to be executed.