Communication method, device, equipment, storage medium and program product
By introducing binary information matching into the forwarding flow table, the problem of excessive initial report calculation in short-connection scenarios is solved, improving packet forwarding efficiency and performance.
Patent Information
- Application Number
- CN202511777281.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-28
- Publication Date
- 2026-02-27
AI Technical Summary
In short-connection scenarios, existing forwarding flow table schemes based on five-tuples require a large number of complex initial report calculations, which affects packet forwarding efficiency.
Introducing a second forwarding flow table (such as a binary forwarding flow table) reduces the initial report calculation, increases the flow table hit rate, and optimizes forwarding performance by increasing the matching of binary information.
By adding a binary forwarding flow table, the hit rate of packet matching flow table is improved, the initial packet calculation is reduced, and packet forwarding efficiency and performance are enhanced.
Smart Images
Figure CN121585609A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] Example embodiments of the present disclosure generally relate to the technical field of communications, and more particularly, to a method, an apparatus, an electronic device, a computer readable storage medium and a computer program product for communications. BACKGROUND
[0002] In order to improve the forwarding performance, the current network security component or network device usually uses the following process when forwarding a packet. First, the output port of the packet and whether the packet is passed are determined by performing the longest match and the mask match on the first packet of the network forwarding flow. Then, a network forwarding flow is defined based on the five-tuple of the packet, and an accurate match forwarding flow table based on the hash algorithm is established by using the five-tuple information as an index. The forwarding result of the network forwarding flow is stored in the forwarding flow table. For subsequent packets, the forwarding flow table based on the hash algorithm is searched first. If a match is found, the packet is forwarded according to the forwarding result in the forwarding flow table. If the packet does not match the forwarding flow table, a complex longest match and mask match calculation is required to obtain the forwarding result. SUMMARY
[0003] In a first aspect of the present disclosure, a method for communications is provided. The method comprises: in response to receiving a packet, determining whether a first forwarding flow table matching five-tuple information of the packet exists, the first forwarding flow table indicating a forwarding result of a historical packet having five-tuple information matching the five-tuple information of the packet; in response to determining that the first forwarding flow table does not exist, determining whether a second forwarding flow table applicable to the packet exists, the second forwarding flow table being associated with at least two items of information in the five-tuple information of the packet; and in response to determining that the second forwarding flow table exists, forwarding the packet based on a forwarding result of a historical packet having two-tuple information matching the at least two items of information in the five-tuple information of the packet in the second forwarding flow table.
[0004] In a second aspect of the present disclosure, an apparatus for communications is provided. The apparatus comprises: a first matching module configured to, in response to receiving a packet, determine whether a first forwarding flow table matching five-tuple information of the packet exists, the first forwarding flow table indicating a forwarding result of a historical packet having five-tuple information matching the five-tuple information of the packet. A second matching module configured to, in response to determining that the first forwarding flow table does not exist, determine whether a second forwarding flow table applicable to the packet exists, the second forwarding flow table being associated with at least two items of information in the five-tuple information of the packet. A forwarding module configured to, in response to determining that the second forwarding flow table exists, forward the packet based on a forwarding result of a historical packet having two-tuple information matching the at least two items of information in the five-tuple information of the packet in the second forwarding flow table.
[0005] In a third aspect of the disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit. The instructions, when executed by the at least one processing unit, cause the electronic device to perform the method of the first aspect.
[0006] In a fourth aspect of the disclosure, a computer-readable storage medium is provided. The medium has stored thereon a computer program which, when executed by a processor, implements the method of the first aspect.
[0007] In a fifth aspect of the disclosure, a computer program product is provided. The product includes a computer program, wherein the computer program, when executed by a processor, implements the method according to the first aspect of the disclosure.
[0008] It should be understood that all statements herein made regarding the features, advantages, and aspects of the embodiments of the present disclosure are intended to be illustrative and not restrictive. It can be noted that not all of the activities or elements described above can be required, which can be utilized in a manner differing from the order described, and that a variety of implementations can be derived from the disclosure which is intended to be comprehensive and protective. BRIEF DESCRIPTION OF DRAWINGS
[0009] The above-mentioned and other features and advantages of various implementations of the present disclosure can be better understood from the following detailed description taken in conjunction with the drawings, wherein the same or similar elements are referred to with the same or similar reference numerals. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the various implementations of the present disclosure. However, various implementations of the present disclosure can be practiced without these specific details. In other instances, well-known methods, procedures, components, and networks have not been described in detail so as not to unnecessarily obscure aspects of the implementations of the present disclosure. Figure 1 A schematic diagram illustrating an example environment in which embodiments of the present disclosure can be implemented is shown; Figure 2 A flowchart illustrating a method for packet forwarding is shown; Figure 3 A flowchart illustrating a method for packet forwarding according to some embodiments of the present disclosure is shown; Figure 4 A flowchart illustrating a method for communication according to some embodiments of the present disclosure is shown; Figure 5 A schematic structural block diagram of an apparatus for communication according to some embodiments of the present disclosure is shown; and Figure 6 A block diagram of a computing device in which one or more embodiments of the present disclosure can be implemented is shown. DETAILED DESCRIPTION
[0010] Embodiments of the present disclosure will be described below in greater detail with reference to the accompanying drawings. While some embodiments of the present disclosure are illustrated in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be interpreted as being limited to the embodiments set forth herein; rather, these embodiments are provided so as to more completely and thoroughly understand the present disclosure. It is understood that the drawings and embodiments of the present disclosure are for exemplary purposes only and are not intended to limit the scope of protection of the present disclosure.
[0011] In the description of embodiments of the present disclosure, the term "comprising" and similar terms are to be interpreted as open-ended, i.e., "including but not limited to". The term "based on" is to be interpreted as "based, at least in part, on". The term "one embodiment" or "the embodiment" is to be interpreted as "at least one embodiment". The term "some embodiments" is to be interpreted as "at least some embodiments". Other explicit or implicit definitions can also be included below.
[0012] It should be noted that in the technical solutions of the present disclosure, the acquisition, storage and application of user personal information comply with relevant laws and regulations and do not violate public order and good customs.
[0013] It can be understood that before using the technical solutions disclosed in the embodiments of the present disclosure, the type, use range, use scenario, etc. of the personal information involved in the present disclosure should be informed to the user and the authorization of the user should be obtained through appropriate means according to relevant laws and regulations.
[0014] For example, in response to receiving the active request of the user, prompt information is sent to the user to explicitly prompt the user that the operation requested to be executed will require obtaining and using the personal information of the user, so that the user can voluntarily choose whether to provide personal information to the software or hardware such as electronic devices, application programs, servers or storage media, etc. that execute the operation of the technical solutions of the present disclosure according to the prompt information.
[0015] As an optional but non-limiting implementation manner, in response to receiving the active request of the user, the manner of sending prompt information to the user can be, for example, a pop-up window manner, and the prompt information can be presented in the form of text in the pop-up window. In addition, the pop-up window can also carry selection controls for the user to select "agree" or "disagree" to provide personal information to the electronic device.
[0016] It can be understood that the above notification and user authorization process is only illustrative and does not limit the embodiments of the present disclosure, and other manners that meet relevant laws and regulations can also be applied to the embodiments of the present disclosure.
[0017] Figure 1 A schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented is shown. As shown in FIG. 1, the environment 100 includes a user device 102, a server 104, and a network 106. Figure 1As shown, the example environment 100 can include a first device 110, a second device 120, and a third device 130. The first device 110 can be, for example, an intermediary device, the second device 120 can be, for example, a message sending device, and the third device 130 can be, for example, a message receiving device. The first device 110 can receive a message from the second device 120 and drop the message or forward the message to the third device 130 according to a forwarding rule.
[0018] The first device 110, the second device 120, and the third device 130 can include any computing system with computing capability, such as various computing devices / systems, end devices, network devices, network components, or server devices, etc. The first device 110, the second device 120, and the third device 130 can be implemented by hardware and / or software. The first device 110, the second device 120, and the third device 130 can be independent devices, or can be sub-components or apparatuses of a same device. In addition, the first device 110, the second device 120, and the third device 130 can also be virtual devices, such as virtual machines, virtual switches, etc.
[0019] An end device can be any type of mobile terminal, fixed terminal, or portable terminal including a mobile handset, a desktop computer, a laptop computer, a notebook computer, a netbook computer, a tablet computer, a media computer, a multimedia tablet, a palmtop computer, a portable gaming terminal, a VR / AR device, a Personal Communication System (PCS) device, a personal navigation device, a Personal Digital Assistant (PDA), an audio / video player, a digital camera / camcorder, a positioning device, a television receiver, a radio broadcast receiver, an electronic book device, a game device, or any combination thereof, including accessories and peripherals of these devices, or any combination thereof.
[0020] A network device / component can include, for example, a network component or device such as a network card, a router, a switch, an offload card, etc. A security component such as a firewall can be deployed in the network component. The security component can be implemented based on software and / or hardware.
[0021] A server device can be a standalone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, and basic cloud computing services such as big data and artificial intelligence platforms, etc. A server device can include, for example, a computing system / server such as a mainframe, an edge computing node, a computing device in a cloud environment, etc.
[0022] It should be appreciated that the structure and function of the various elements in the environment 100 are described for illustrative purposes only and without implying any limitation on the scope of the present disclosure.
[0023] When the network component / device forwards a packet, the mechanism is as follows: first, based on the destination Internet Protocol (IP) address of the packet, the routing lookup table of the component is searched to obtain the output port of the packet. The search algorithm is usually based on the longest matching algorithm, and the calculation amount is much larger than that of the general hash algorithm. Then, based on the five-tuple information of the packet, i.e., the source IP address (referred to as sip in this paper) and the destination IP address (referred to as dip in this paper), the protocol identifier, the source port (referred to as sport in this paper), and the destination port (referred to as dport in this paper), the Access Control list (ACL) rule of the network component / device is matched to determine whether the packet is passed. The matching algorithm is usually based on the mask matching algorithm, and the calculation amount is larger than that of the longest matching algorithm. Based on the above two matching rules, the network component / device (such as a network firewall) can safely forward the packet to the corresponding output port.
[0024] As described above, when the current network security component or network device forwards a packet, in order to improve the forwarding performance, the common process is as follows: first, for the first packet of the network forwarding flow (the first packet of the network forwarding flow), the output port of the packet and whether the packet is passed are determined by the longest matching and mask matching. Then, based on the five-tuple of the packet, a network forwarding flow is defined, and an accurate matching forwarding flow table based on the hash algorithm is established with the five-tuple information as the index, and the forwarding result of the network forwarding flow is stored in the forwarding flow table. For subsequent packets, the forwarding flow table based on the hash algorithm is first searched, and if it is hit, the forwarding result in the forwarding flow table is used for forwarding. If the packet does not match the forwarding flow table, complex longest matching and mask matching calculation is required to obtain the forwarding result.
[0025] The current five-tuple-based forwarding flow table method for improving the packet forwarding performance reduces the complex longest matching and mask matching calculation (referred to as first packet calculation in this paper) to a certain extent, and improves the forwarding efficiency. However, in the case of a large number of short links, i.e., the number of packets in the forwarding flow corresponding to the five-tuple information is small, the amount or number of complex first packet calculations is still large. Assuming that a short hypertext transfer protocol (HTTP) request has only 8 packets, and there are only 4 packets on the forwarding flow with the same five-tuple in the same direction. If there are a large number of such short links, first packet calculation is required every 4 packets. Therefore, in the short link scenario, the five-tuple-based forwarding flow table scheme will generate a large number of first packet calculations, which greatly affects the packet forwarding efficiency.
[0026] In view of this, embodiments of the present disclosure provide an improved solution for communication. In the solution, in response to receiving a packet, it is determined whether there is a first forwarding flow table matching the five-tuple information of the packet, the first forwarding flow table indicating a forwarding result of a historical packet having five-tuple information matching the five-tuple information of the packet; in response to determining that there is no first forwarding flow table, it is determined whether there is a second forwarding flow table applicable to the packet, the second forwarding flow table being associated with at least two items of information in the five-tuple information of the packet; and in response to determining that there is a second forwarding flow table, the packet is forwarded based on a forwarding result of a historical packet having two-tuple information matching at least two items of information in the five-tuple information of the packet in the second forwarding flow table. In this way, the hit ratio of matching the forwarding flow table by the packet can be improved by adding the second forwarding flow table, and accordingly the ratio of first packet calculation can be reduced, and the forwarding performance of the packet can be improved.
[0027] Some example embodiments of the present disclosure will be described below with continuous reference to the drawings.
[0028] Figure 2 A flowchart of a current method 200 for packet forwarding is shown. The method 200 can be implemented at a first device 110 as shown. In this document, the method 200 is described in conjunction with the first device 110. Figure 1 The method 200 is described. Figure 1 The method 200 is described.
[0029] As shown, the current method 200 for user packet forwarding includes the following steps. Figure 2
[0030] At block 210, the first device 110 receives a packet to be forwarded. For example, the first device 110 can receive the packet to be forwarded from the second device 120. The packet to be forwarded can be a packet in a network forwarding flow sent by the second device 120 including data. The network forwarding flow can include at least one packet.
[0031] When the packet is received, the first device 110 can extract the key information in the packet, for example, the key information of the packet can be obtained by parsing the header of the packet. In some embodiments, the key information of the packet can be, for example, the five-tuple information of the packet. The five-tuple information of the packet can include, for example, the source IP address (hereinafter referred to as sip) and the destination IP address (hereinafter referred to as dip), the protocol identifier, the source port (hereinafter referred to as sport) and the destination port (hereinafter referred to as dport). It should be understood that the key information or the five-tuple information of the packet can also include other information, for example, the media access control (MAC) address of the packet.
[0032] At block 220, the first device 110 looks up a five-tuple forwarding flow table based on the five-tuple information of the packet.
[0033] An example structure of the quintuple forwarding flow table is shown in Table 1. The index can include a hash value of the quintuple information. The content can include the value of the quintuple information (i.e., the key value) and the forwarding result. The forwarding result can include whether the packet is passed or dropped and the output port (out-port) of the packet when passed.
[0034] Table 1
[0035] Wherein sip+dip+protocol+sport+dport: represents the quintuple information of the packet; action_pass_or_drop represents whether the forwarding action of the packet matching the forwarding flow table is to pass or drop; out_port: represents the output port of the packet when the action is to pass.
[0036] At block 230, the first device 110 determines whether there is a table entry matching the quintuple information of the packet in the quintuple flow table based on the lookup result.
[0037] Exemplarily, determining whether there is a table entry matching the quintuple information of the packet in the quintuple flow table can be achieved by the following steps. The first device 110 performs a hash calculation based on the sip, dip, protocol, sport and dport fields in the quintuple information of the input packet, and looks up the corresponding table entry of the quintuple forwarding flow table using the hash values of the five fields as the index, and then compares the key value of the table entry, i.e., compares whether the sip, dip, protocol, sport and dport of the packet are equal to the sip, dip, protocol, sport and dport in the table entry. If they are equal, it means that the packet matches the quintuple forwarding flow table, i.e., it is determined that there is a table entry matching the quintuple information of the packet in the quintuple flow table. If they are not equal, it means that the packet does not match the quintuple forwarding flow table, i.e., it is determined that there is no table entry matching the quintuple information of the packet in the quintuple flow table.
[0038] It can be understood that the packet matching the quintuple forwarding flow table can also be understood as the packet matching a forwarding rule or a sub-table in the quintuple forwarding flow table, or can be understood as the quintuple forwarding flow table or the sub-table recording the forwarding result of the historical packet matching the quintuple information of the packet.
[0039] If the first device 110 determines that there is a table entry matching the quintuple information of the packet in the quintuple flow table at block 230, the method 200 continues to block 270.
[0040] At block 270, the first device 110 outputs the packet based on the forwarding result indicated by the entry in the quintuple forwarding flow table that matches the quintuple information of the packet. If the forwarding result indicated by the entry in the quintuple forwarding flow table that matches the quintuple information of the packet is pass, the first device 110 outputs the packet based on the output port indicated by the entry in the quintuple forwarding flow table that matches the quintuple information of the packet. If the forwarding result indicated by the entry in the quintuple forwarding flow table that matches the quintuple information of the packet is drop, the first device 110 drops the packet.
[0041] If the first device 110 determines that there is no entry in the quintuple flow table that matches the quintuple information of the packet at block 230, the method 200 proceeds to block 240.
[0042] At block 240, the first device 110 can query the routing table based on the destination IP address of the packet, for example, by a longest match algorithm, to obtain the output port of the packet.
[0043] At block 250, the first device 110 can determine whether the packet passes based on the quintuple information of the packet, for example, by matching the ACL rule by a mask match algorithm.
[0044] At block 260, the first device 110 establishes the quintuple forwarding flow table for the packet based on the output port determined at block 240 and the forwarding result determined at block 250 and the quintuple information.
[0045] Establishing the quintuple forwarding flow table for the packet is to define a network forwarding flow based on the quintuple information of the packet. Specifically, the quintuple information of the packet is the index, and an exact match flow table based on a hash algorithm is established, and the forwarding result of the forwarding flow is stored in the quintuple forwarding flow table.
[0046] Figure 3 A flow chart of a method 300 for packet forwarding according to some embodiments of the present disclosure is shown. The method 300 can be implemented at the first device 110. Figure 1 The first device 110 is shown. The method 300 is described herein in conjunction with the first device 110. Figure 1 The method 300 is described.
[0047] As shown, the method 300 for packet forwarding implemented according to the present disclosure includes the following steps. Figure 3
[0048] At block 310, the first device 110 receives a packet to be forwarded. For example, the first device 110 can receive the packet to be forwarded from the second device 120. The packet to be forwarded can be a packet in a network forwarding flow including data sent by the second device 120. The network forwarding flow can include at least one packet.
[0049] When receiving the packet, the first device 110 can extract the key information in the packet, for example, by parsing the header of the packet to obtain the key information of the packet. In some embodiments, the key information of the packet can be, for example, the five-tuple information of the packet. The five-tuple information of the packet can include, for example, the source IP address (referred to as sip herein) and the destination IP address (referred to as dip herein), the protocol identifier, the source port (referred to as sport herein), and the destination port (referred to as dport herein). It should be understood that the key information or the five-tuple information of the packet can also include other information, for example, the media access control (MAC) address of the packet.
[0050] At block 320, the first device 110 looks up the five-tuple forwarding flow table based on the five-tuple information of the packet.
[0051] An example structure of the five-tuple forwarding flow table is shown in Table 1. The index can include the hash value of the five-tuple information. The entry content includes the first part of the entry content and the second part of the entry content. The first part of the entry content can include the value of the five-tuple information (i.e., the key value). The second part of the entry content can include the forwarding result. The forwarding result can include whether the packet is passed or dropped and the output port (out-port) of the packet when passed.
[0052] Table 1
[0053] wherein sip+dip+protocol+sport+dport: represents the five-tuple information of the packet; action_pass_or_drop represents whether the forwarding action of the packet matching the forwarding flow table is pass or drop; out_port: represents the output port of the packet when the action is pass.
[0054] At block 330, the first device 110 determines whether there is an entry in the five-tuple flow table that matches the five-tuple information of the packet based on the lookup result.
[0055] Exemplarily, determining whether there is a table entry in the quintuple flow table matching the quintuple information of the packet can be implemented by the following steps. The first device 110 performs hash calculation based on the sip, dip, protocol, sport and dport fields in the quintuple information of the input packet, takes the hash values of the five fields as indexes to look up the corresponding table entry of the quintuple forwarding flow table, and then compares the key value of the table entry, i.e., compares whether the sip, dip, protocol, sport and dport of the packet and the sip, dip, protocol, sport and dport in the table entry are equal. If they are equal, it indicates that the packet matches the quintuple forwarding flow table, i.e., it is determined that there is a table entry in the quintuple flow table matching the quintuple information of the packet. If they are not equal, it indicates that the packet does not match the quintuple forwarding flow table, i.e., it is determined that there is no table entry in the quintuple flow table matching the quintuple information of the packet.
[0056] It can be understood that the packet matching the quintuple forwarding flow table can also be understood as the packet matching a forwarding rule or a sub-table in the quintuple forwarding flow table, or can be understood as that the quintuple forwarding flow table or the sub-table records the forwarding result of the historical packet matching the quintuple information of the packet.
[0057] If the first device 110 determines at block 230 that there is a table entry in the quintuple flow table matching the quintuple information of the packet, the method 300 continues to block 390.
[0058] At block 390, the first device 110 outputs the packet based on the forwarding result indicated by the table entry in the quintuple forwarding flow table matching the quintuple information of the packet. If the forwarding result indicated by the table entry in the quintuple forwarding flow table matching the quintuple information of the packet is pass, the first device 110 outputs the packet based on the output port indicated by the table entry in the quintuple forwarding flow table matching the quintuple information of the packet. If the forwarding result indicated by the table entry in the quintuple forwarding flow table matching the quintuple information of the packet is discard, the first device 110 discards the packet.
[0059] If the first device 110 determines at block 330 that there is no table entry in the quintuple flow table matching the quintuple information of the packet, the method 300 continues to block 340.
[0060] At block 340, the first device 110 looks up the binary tuple forwarding flow table based on at least two items in the quintuple information of the packet.
[0061] An example structure of the two-tuple forwarding flow table is shown in Table 2. The index can include a hash value of at least two items of the five-tuple information. The table entry content includes a first part table entry content and a second part table entry content. The first part table entry content can include values (i.e., key values) of at least two items of the five-tuple information. The second part table entry content can include a forwarding result and a preset range value of area information other than the at least two items of the five-tuple information. The forwarding result can include whether the packet is passed or dropped and an output port (out-port) of the packet when passed.
[0062] Table 2
[0063] Wherein dip+protocol: represents the two-tuple information of the packet; action_pass_or_drop represents whether the forwarding action of the packet matching the forwarding flow table is to pass or drop; out_port: represents the packet output port when the packet action is to pass. Min_sip: represents the minimum value of the sip that can be matched; max_sip: represents the maximum value of the sip that can be matched; Min_sport: represents the minimum value of the sport that can be matched; Max_sport: represents the maximum value of the sport that can be matched; Min_dport: represents the minimum value of the dport that can be matched; Max_dport: represents the maximum value of the dport that can be matched.
[0064] It should be noted that in the embodiments of the present disclosure, the two-tuple flow table is taken as an example for description, but in other embodiments, a forwarding flow table including more information based on similar principles, such as a three-tuple flow table, can also be used. Or in other embodiments, the index in the two-tuple flow table can not be dip+protocol but a combination of any two items of the five-tuple information.
[0065] At block 350, the first device 110 determines whether there is a table entry matching at least two items of the five-tuple information of the packet in the two-tuple flow table based on the lookup result.
[0066] Exemplarily, determining whether there is a table entry in the two-tuple flow table matching at least two items of the five-tuple information of the packet can be implemented by the following steps. The first device 110 performs hash calculation based on the dip and protocol fields in the five-tuple information of the input packet, and looks up the corresponding table entry of the two-tuple forwarding flow table by using the hash values of the two fields as indexes, and then compares the key values of the table entries, i.e., compares whether the dip and protocol of the packet are equal to the dip and protocol in the table entry. If they are equal, it indicates that the packet matches the two-tuple forwarding flow table, i.e., it is determined that there is a table entry in the two-tuple flow table matching at least two items of the five-tuple information of the packet. If they are not equal, it indicates that the packet does not match the two-tuple forwarding flow table, i.e., it is determined that there is no table entry in the two-tuple flow table matching at least two items of the five-tuple information of the packet.
[0067] It can be understood that the matching of the packet to the two-tuple forwarding flow table can also be understood as the matching of the packet to a forwarding rule or a sub-table in the two-tuple forwarding flow table, or can be understood as that the two-tuple forwarding flow table or the sub-table records the forwarding result of the historical packet matching the two-tuple information of the packet.
[0068] If the first device 110 determines that there is a table entry in the two-tuple flow table matching at least two items of the five-tuple information of the packet at block 350, the method 300 continues to block 390. Conversely, if the first device 110 determines that there is no table entry in the two-tuple flow table matching at least two items of the five-tuple information of the packet at block 350, the method 300 continues to block 360.
[0069] At block 360, the first device 110 can query the routing table based on the destination IP address of the packet, for example, by using a longest match algorithm, to obtain the output port of the packet.
[0070] At block 370, the first device 110 can determine whether the packet is passed based on the five-tuple information of the packet, for example, by matching the ACL rule by using a mask matching algorithm.
[0071] At block 380, the first device 110 establishes the two-tuple forwarding flow table for the packet and the five-tuple forwarding flow table for the packet based on the output port determined at block 240, the forwarding result determined at block 250, and the five-tuple information.
[0072] Establishing the five-tuple forwarding flow table for the packet means defining a network forwarding flow based on the five-tuple information of the packet. Specifically, an exact match flow table based on a hash algorithm is established by using the five-tuple information of the packet as an index, and the forwarding result of the forwarding flow is stored in the five-tuple forwarding flow table.
[0073] The binary tuple forwarding flow table for the packet is established, that is, the five tuple information of the packet defines a network forwarding flow. Specifically, at least two items in the five tuple information of the packet are used as indexes to establish a hash algorithm-based exact match flow table, and the forwarding result of the forwarding flow is stored in the binary tuple forwarding flow table. And the mask matching table is used to add the range value of the remaining information in the five tuple information in the binary tuple forwarding flow table.
[0074] According to the packet forwarding method of the embodiments of the present disclosure, in order to reduce the number of first packet calculations, a binary tuple forwarding flow table is added, so that the forwarding result can be obtained by, for example, table lookup through the destination IP address and the packet correlation identifier. At the same time, in the content of the table entry of the added binary tuple forwarding flow table, in addition to the original forwarding pass or fail action information and output port information, the minimum and maximum values of the source IP address, the source port and the destination port are also added. Such IP address and packet correlation identifier matching, and the source IP address, the source port and the destination port in the range indicated by the binary tuple flow table can all obtain the forwarding result based on the binary tuple forwarding flow table. Therefore, the binary tuple forwarding flow table realized based on the above scheme improves the proportion of the packet following the fast table lookup process, can match more packets, realizes more flow table-based forwarding, reduces the first packet calculation, and improves the packet forwarding efficiency and performance.
[0075] In addition, since six fields: min_sip, max_sip, min_sport, max_sport, min_dport, max_dport are added in the binary tuple forwarding flow table, through the range matching function of the corresponding fields, it is realized that the binary tuple forwarding flow table can match more packets while ensuring that the original firewall ACL rules remain unchanged, and only the packets that meet the ACL rules can be forwarded based on the flow table.
[0076] Figure 4 Flowchart of the method 400 for communication according to some embodiments of the present disclosure. The method 400 for communication according to the embodiments of the present disclosure can be executed at the first device 110 in Figure 1 As shown in Figure 4 , the method 400 includes: At block 410, the first device 110 determines, in response to receiving the packet, whether there is a first forwarding flow table matching the five tuple information of the packet, the first forwarding flow table indicating a forwarding result of a historical packet having five tuple information matching the five tuple information of the packet.
[0077] At block 420, the first device 110 determines, in response to determining that there is no first forwarding flow table, whether there is a second forwarding flow table applicable to the packet, the second forwarding flow table being associated with at least two items of information in the five tuple information of the packet.
[0078] At block 430, the first device 110 forwards the packet based on a forwarding result of a historical packet with the two-tuple information in the second forwarding flow table that matches at least two pieces of information in the five-tuple information of the packet in response to determining that the second forwarding flow table exists.
[0079] In some embodiments of the present disclosure, the five-tuple information includes a source Internet Protocol (IP) address, a source port, a destination IP address, a destination port, and a protocol identifier.
[0080] In some embodiments of the present disclosure, the at least two pieces of information in the five-tuple information of the packet include the destination IP address of the packet and the protocol identifier of the packet, and determining whether the second forwarding flow table exists for the packet includes: obtaining a set of candidate forwarding flow tables; in response to determining that a table entry index of a first candidate forwarding flow table in the set of candidate forwarding flow tables matches the destination IP address and the protocol identifier, determining whether a first part of table entry content of the first candidate forwarding flow table matches the destination IP address and the protocol identifier of the packet; in response to determining that the first part of table entry content of the first candidate forwarding flow table matches the destination IP address and the protocol identifier, determining whether a second part of table entry content of the first candidate forwarding flow table matches a source IP address, a source port, and a destination port of the packet; and in response to determining that the second part of table entry content of the first candidate forwarding flow table matches the source IP address, the source port, and the destination port of the packet, determining the first candidate forwarding flow table as the second forwarding flow table.
[0081] In some embodiments of the present disclosure, determining whether the second part of table entry content of the first candidate forwarding flow table matches the source IP address, the source port, and the destination port of the packet includes: determining whether the source IP address, the source port, and the destination port of the packet are respectively within an address range of a source IP address, a first port range of a source port, and a second port range of a destination port indicated by the second part of table entry content of the first candidate forwarding flow table; and in response to determining that the source IP address, the source port, and the destination port of the packet are respectively within the address range of the source IP address, the first port range, and the second port range indicated by the second part of table entry content of the first candidate forwarding flow table, determining that the second part of table entry content of the first candidate forwarding flow table matches the source IP address, the source port, and the destination port of the packet.
[0082] In some embodiments of the present disclosure, the second part of table entry content indicates a maximum value and a minimum value of the source IP address, a maximum value and a minimum value of the source port, a maximum value and a minimum value of the destination port, and a forwarding result and an output port of a matching packet.
[0083] In some embodiments of the present disclosure, in response to determining that the second forwarding flow table does not exist, performing a longest match query based on the destination IP address of the packet and performing a mask match query based on the five-tuple information.
[0084] In some embodiments of the present disclosure, the method 400 further includes: based on the results of the longest match query and the mask match query, establishing a third forwarding flow table for the packet, the third forwarding flow table indicating a forwarding result of the packet having five-tuple information matching the five-tuple information of the packet.
[0085] In some embodiments of the present disclosure, the method 400 further includes: based on the results of the longest match query and the mask match query, establishing a fourth forwarding flow table for the packet, the fourth forwarding flow table indicating a forwarding result of the packet having at least two items of information in the five-tuple information of the packet matching, and the remaining information other than the at least two items of information being within a predetermined range.
[0086] The method for communication of the embodiments of the present disclosure has the following beneficial effects: First, the present disclosure improves the hit ratio of the packet matching flow table by adding a second forwarding flow table (such as a two-tuple forwarding flow table), and accordingly reduces the ratio of the first packet calculation, thereby improving the forwarding performance of the packet.
[0087] Second, since one entry of the second forwarding flow table can represent multiple entries of the first forwarding flow table for packet forwarding, using the second forwarding flow table (such as a two-tuple forwarding flow table) can greatly reduce the storage space of the flow table, thereby reducing the forwarding cost.
[0088] Figure 5 A schematic structural block diagram of an apparatus 500 for communication according to some embodiments of the present disclosure is shown.
[0089] As shown in Figure 5 The apparatus 500 includes a first matching module 510 configured to, in response to receiving a packet, determine whether a first forwarding flow table matching five-tuple information of the packet exists, the first forwarding flow table indicating a forwarding result of a historical packet having five-tuple information matching the five-tuple information of the packet. A second matching module 520 is configured to, in response to determining that the first forwarding flow table does not exist, determine whether a second forwarding flow table applicable to the packet exists, the second forwarding flow table being associated with at least two items of information in the five-tuple information of the packet. A forwarding module 530 is configured to, in response to determining that the second forwarding flow table exists, forward the packet based on a forwarding result of a historical packet having two-tuple information matching the at least two items of information in the five-tuple information of the packet in the second forwarding flow table.
[0090] In some embodiments of the present disclosure, the five-tuple information includes a source Internet Protocol (IP) address, a source port, a destination IP address, a destination port, and a protocol identifier.
[0091] In some embodiments of the present disclosure, at least two of the five-tuple information of the packet include a destination Internet Protocol (IP) address of the packet and a protocol identifier of the packet, and the second matching module 520 is further configured to: obtain a set of candidate forwarding flow tables; in response to determining that a table entry index of a first candidate forwarding flow table in the set of candidate forwarding flow tables matches the destination IP address and the protocol identifier, determine whether a first part of table entry content of the first candidate forwarding flow table matches the destination IP address and the protocol identifier of the packet; in response to determining that the first part of table entry content of the first candidate forwarding flow table matches the destination IP address and the protocol identifier, determine whether a second part of table entry content of the first candidate forwarding flow table matches a source IP address, a source port and a destination port of the packet; and in response to determining that the second part of table entry content of the first candidate forwarding flow table matches the source IP address, the source port and the destination port of the packet, determine the first candidate forwarding flow table as the second forwarding flow table.
[0092] In some embodiments of the present disclosure, the second matching module 520 is further configured to: determine whether the source IP address, the source port and the destination port of the packet are respectively within a source IP address range, a first port range of the source port and a second port range of the destination port indicated by the second part of table entry content of the first candidate forwarding flow table; and in response to determining that the source IP address, the source port and the destination port of the packet are respectively within the source IP address range, the first port range and the second port range indicated by the second part of table entry content of the first candidate forwarding flow table, determine that the second part of table entry content of the first candidate forwarding flow table matches the source IP address, the source port and the destination port of the packet.
[0093] In some embodiments of the present disclosure, the second part of table entry content indicates a maximum value and a minimum value of the source IP address, a maximum value and a minimum value of the source port, a maximum value and a minimum value of the destination port, and a forwarding result and an output port of the matching packet.
[0094] In some embodiments of the present disclosure, the apparatus 500 further includes a first packet calculation module configured to, in response to determining that the second forwarding flow table does not exist, perform a longest match query based on a destination IP address of the packet and a mask match query based on the five-tuple information.
[0095] In some embodiments of the present disclosure, the apparatus 500 further includes a flow table establishment module configured to, based on a result of the longest match query and the mask match query, establish a third forwarding flow table for the packet, the third forwarding flow table indicating a forwarding result of a packet having a five-tuple information matching the five-tuple information of the packet.
[0096] In some embodiments of the present disclosure, the flow table establishing module is further configured to establish, based on the results of the longest match query and the mask match query, a fourth forwarding flow table for the packet, the fourth forwarding flow table indicating a forwarding result of the packet matching at least two items of the five-tuple information of the packet and the remaining information other than the at least two items of the five-tuple information being within a predetermined range.
[0097] The units and / or modules included in the apparatus 500 can be implemented utilizing various means including software, hardware, and / or firmware. In some embodiments, one or more units and / or modules can be implemented using software and / or firmware, e.g., machine executable instructions stored on a storage medium. In addition to or alternatively, some or all of the units and / or modules in the apparatus 500 can be implemented at least partially by one or more hardware logic components. As an example and not by way of limitation, example types of hardware logic components that can be used include Field-Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application-Specific Standard Products (ASSPs), System-on-a-Chip (SOCs), Complex Programmable Logic Devices (CPLDs), etc.
[0098] It should be understood that one or more steps in the above methods can be performed by an appropriate electronic device or combination of electronic devices. Such an electronic device or combination of electronic devices may, for example, include Figure 1 the first device 110 of
[0099] Figure 6 A block diagram of an electronic device 600 in which one or more embodiments of the disclosure can be implemented is shown. It should be understood that Figure 6 the electronic device 600 shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments described herein. Figure 6 The electronic device 600 shown can be used to implement the first device 110 of Figure 1 or the apparatus 500 of Figure 5 .
[0100] As shown in Figure 6 , the electronic device 600 is in the form of a general electronic device. Components of the electronic device 600 can include, but are not limited to, one or more processors or processing units 610, a memory 620, a storage device 630, one or more communication units 640, one or more input devices 650, and one or more output devices 660. The processing unit 610 can be a real or virtual processor and is capable of executing various processing in accordance with programs stored in the memory 620. In a multi-processor system, multiple processing units execute computer-executable instructions in parallel to improve the parallel processing capability of the electronic device 600.
[0101] The electronic device 600 typically includes a plurality of computer storage media. Such media can be any available media that is located either internally or externally to the electronic device 600, including, but not limited to, memory, removable storage, and non-removable storage. The memory 620 can be volatile (such as, for example, registers, cache, RAM), non-volatile (such as, for example, ROM, EEPROM, flash memory), or some combination of the two. The storage 630 can be removable or non-removable media, and can include machine- readable media, such as flash drives, disk drives, or any other media that can be used to store information and / or data and that can be accessed by the electronic device 600.
[0102] The electronic device 600 can further include additional removable / non-removable, volatile / non-volatile storage media. Although not shown, a disk drive can be provided for reading from or writing to a removable, non- volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive can be provided for reading from or writing to a removable, non-volatile optical disk (e.g., a CD-ROM, a DVD, etc.). In such instances, each drive can be connected to the bus (not shown) by one or more data media interfaces. The memory 620 can include a computer program product 625 having one or more program modules configured to carry out the various methods or actions of the various embodiments of the present disclosure. Figure 6
[0103] The communication unit 640 enables communications with other electronic devices over a communication medium. Additionally, the functionality of the components of the electronic device 600 can be implemented in a single computing cluster or a plurality of computer machines that are capable of communicating over a communication connection. As such, the electronic device 600 can operate in a networked environment using logical connections to one or more other servers, network personal computers (PCs), or another network nodes.
[0104] The input device 650 can be one or more input devices, such as a mouse, a keyboard, a trackball, etc. The output device 660 can be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 600 can also communicate with one or more external devices (not shown) such as a storage device, a display device, etc. through the communication unit 640, as needed, one or more devices that enable a user to interact with the electronic device 700, or any devices (e.g., a network card, a modem, etc.) that enable the electronic device 600 to communicate with one or more other electronic devices. Such communication can be carried out via an input / output (I / O) interface (not shown).
[0105] According to an example implementation of the present disclosure, a computer readable storage medium is provided having computer executable instructions stored thereon, where the computer executable instructions are executed by a processor to implement the method described above. According to an example implementation of the present disclosure, a computer program product is also provided that is tangibly stored on a non-transitory computer readable medium and includes computer executable instructions, where the computer executable instructions are executed by a processor to implement the method described above.
[0106] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.
[0107] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.
[0108] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.
[0109] The computer program product of the present disclosure can have a signal including said computer program. This signal can be electronic, electromagnetic, optical, or any other suitable type of signal. Such a signal can be provided through a communication connection, such as electrical wiring, optical fiber, wireless interface, etc. Examples of computer program products include computer program implemented on a personal computer, server, or other networked device. A non-transitory computer readable medium, such as a floppy disk, CD-ROM, DVD-ROM, Blu-ray Disc, hard disk drive, or any other suitable non-transitory computer readable medium can store the computer program product.
[0110] Having described several implementations of the present disclosure, it is to be appreciated various alterations, modifications, and improvements will readily occur to those skilled in the art. Such alterations, modifications, and improvements are intended to be part of this disclosure. Accordingly, the foregoing description is by way of example only and is not intended to be limiting. The implementation described herein is implementations of the present disclosure. Other implementations of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the present disclosure. Therefore, this disclosure is intended to cover all such modifications and variations as fall within the scope of the implementations. It is intended that the specification and depicted embodiments are to be considered exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.
Claims
1. A method for communication, comprising: In response to receiving a message, it is determined whether there is a first forwarding flow table that matches the five-tuple information of the message, the first forwarding flow table indicating the forwarding results of historical messages that have five-tuple information that matches the five-tuple information of the message; In response to determining that the first forwarding flow table does not exist, determine whether a second forwarding flow table exists for the packet, the second forwarding flow table being associated with at least two of the five-tuple information of the packet; as well as In response to determining the existence of the second forwarding flow table, the packet is forwarded based on the forwarding results of historical packets whose binary information matches at least two of the five-tuple information of the packet in the second forwarding flow table.
2. The method according to claim 1, wherein the five-tuple information includes the source Internet Protocol IP address, the source port, the destination Internet Protocol IP address, the destination port, and the protocol identifier.
3. The method according to claim 1, wherein at least two pieces of information in the five-tuple information of the message include the destination Internet Protocol (IP) address of the message and the protocol identifier of the message, and determining whether there exists a second forwarding flow table applicable to the message includes: Obtain a set of candidate forwarding flow tables; In response to determining that the entry index of the first candidate forwarding flow table in the set of candidate forwarding flow tables matches the destination IP address and the protocol identifier, determine whether the contents of the first part of the entries in the first candidate forwarding flow table match the destination IP address and the protocol identifier of the packet; In response to determining that the contents of the first part of the first candidate forwarding flow table match the destination IP address and the protocol identifier, determine whether the contents of the second part of the first candidate forwarding flow table match the source IP address, source port and destination port of the packet; as well as In response to determining that the second part of the entries in the first candidate forwarding flow table matches the source IP address, source port, and destination port of the packet, the first candidate forwarding flow table is determined as the second forwarding flow table.
4. The method according to claim 3, wherein determining whether the contents of the second part of the entries in the first candidate forwarding flow table match the source IP address, source port, and destination port of the packet includes: Determine whether the source IP address, source port, and destination port of the packet are respectively within the address range of the source IP address, the first port range of the source port, and the second port range of the destination port indicated by the second part of the entry in the first candidate forwarding flow table; as well as In response to determining that the source IP address, source port, and destination port of the packet are respectively within the range of the source IP address, the range of the first port, and the range of the second port indicated by the second part of the entry content of the first candidate forwarding flow table, it is determined that the second part of the entry content of the first candidate forwarding flow table matches the source IP address, source port, and destination port of the packet.
5. The method according to claim 3 or 4, wherein the second part of the table entry content indicates the maximum and minimum values of the source IP address, the maximum and minimum values of the source port, the maximum and minimum values of the destination port, and the forwarding result and output port of the matching packet.
6. The method according to any one of claims 1 to 4, wherein in response to determining that the second forwarding flow table does not exist, a longest match query is performed based on the destination IP address of the packet and a mask match query is performed based on the 5-tuple information.
7. The method according to claim 6, further comprising: Based on the results of the longest match query and the mask match query, a third forwarding flow table is established for the packet. The third forwarding flow table indicates the forwarding result of a packet with five-tuple information that matches the five-tuple information of the packet.
8. The method according to claim 6, further comprising: Based on the results of the longest match query and the mask match query, a fourth forwarding flow table is established for the packet. The fourth forwarding flow table indicates the forwarding result of a packet that matches at least two of the five-tuple information of the packet, and the remaining information other than the at least two of the five-tuple information is within a predetermined range.
9. A device for communication, comprising: The first matching module is configured to, in response to receiving a packet, determine whether there exists a first forwarding flow table that matches the five-tuple information of the packet, wherein the first forwarding flow table indicates the forwarding results of historical packets that have five-tuple information that matches the five-tuple information of the packet; The second matching module is configured to determine, in response to determining that the first forwarding flow table does not exist, whether a second forwarding flow table applicable to the packet exists, wherein the second forwarding flow table is associated with at least two items of the five-tuple information of the packet; as well as The forwarding module is configured to forward the packet in response to determining that the second forwarding flow table exists, based on the forwarding results of historical packets in the second forwarding flow table that match at least two pieces of information in the five-tuple information of the packet.
10. An electronic device, comprising: At least one processing unit; as well as At least one memory, coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, which, when executed by the at least one processing unit, cause the electronic device to perform the method according to any one of claims 1 to 8.
11. A computer-readable storage medium having a computer program stored thereon, the computer program being executable by a processor to implement the method according to any one of claims 1 to 8.
12. A computer program product tangibly stored in a computer storage medium and comprising computer-executable instructions that, when executed by a device, cause the device to perform the method according to any one of claims 1 to 8.