Transmission control method and apparatus for vxlan packet, and device and storage medium

Abstract

A transmission control method and apparatus for a VXLAN packet, and a device and a storage medium, which belong to the technical field of communications. The method comprises: acquiring a Flowspec route, wherein the Flowspec route comprises a first traffic match condition configured for VXLAN traffic, and a traffic action corresponding to the first traffic match condition; performing matching on a currently received packet on the basis of the first traffic match condition, so as to obtain a target VXLAN packet; and determining a transmission mode for the target VXLAN packet on the basis of the traffic action.

Description

VXLAN message transmission control method, device, equipment and storage medium

[0001] Related applications

[0002] This application claims priority to Chinese patent application No. 202310763354.0 filed on June 26, 2023, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a VXLAN message transmission control method, apparatus, device, and storage medium. Background Art

[0004] Currently, Flowspec (Flow Specification) technology is limited to traffic matching (traffic identification) and traffic action (traffic control) for IP traffic (for example, IPv4 (Internet Protocol version 4) traffic and IPv6 (Internet Protocol version 6) traffic), and cannot identify traffic other than native IP traffic.

[0005] With the advancement of SDN (Software Defined Network) technology, the application of new technologies such as VXLAN (Virtual Extensible Local Area Network) will become more extensive. Since VXLAN is a network virtualization technology that establishes a logical tunnel, encapsulates Ethernet frames at the data link layer into UDP packets, and transmits traffic at the network layer based on the VXLAN tunnel, when transmitting traffic through the VXLAN tunnel, it is necessary to encapsulate the traffic with a VXLAN header and a UDP (User Datagram Protocol) header. However, Flowspec technology is limited to identifying and controlling Native IP traffic and has no ability to identify this type of VXLAN traffic. As a result, it is impossible to implement device-side traffic control for VXLAN packets through Flowspec NLRI (Network Layer Reachability Information) (hereinafter referred to as "Flowspec routing"), which greatly limits its application scenarios.

[0006] Therefore, the Flowspec technology in related technologies has limitations in identifying and controlling flow.

[0007] Summary of the Invention

[0008] The main purpose of this application is to provide a VXLAN message transmission control method, device, equipment and storage medium, aiming to solve the technical problem that Flowspec technology has limitations in identifying and controlling traffic.

[0009] To achieve the above objectives, the present application provides a VXLAN message transmission control method, which is applied to a routing device and includes the following steps:

[0010] Obtain a Flowspec route, where the Flowspec route includes a first traffic matching condition configured for VXLAN traffic and a traffic control action corresponding to the first traffic matching condition.

[0011] Match the currently received message based on the first traffic matching condition to obtain the target VXLAN message;

[0012] Based on the flow control action, determine the transmission control mode of the target VXLAN message.

[0013] The present application also provides a VXLAN message transmission control device, the device comprising:

[0014] a route receiving module configured to obtain a Flowspec route, the Flowspec route including a first flow matching condition configured for VXLAN traffic and a flow control action corresponding to the first flow matching condition;

[0015] a matching module configured to match the currently received message based on the first traffic matching condition to obtain a target VXLAN message;

[0016] The control module is configured to determine a transmission mode of the target VXLAN message based on the flow control action.

[0017] The present application also provides a VXLAN message transmission control device, the device comprising: a memory, a processor, and a VXLAN message transmission control program stored on the memory and executable on the processor, the VXLAN message transmission control program being configured to implement the steps of the VXLAN message transmission control method as described in any one of the above items.

[0018] The present application also provides a storage medium, on which a transmission control program for a VXLAN message is stored. When the transmission control program for the VXLAN message is executed by a processor, the steps of the VXLAN message transmission control method as described in any one of the above items are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] FIG1 is a flow chart of a first embodiment of a VXLAN message transmission control method of the present application;

[0020] FIG2 is a schematic diagram of a first scenario of a VXLAN message transmission control method according to a first embodiment of the present application;

[0021] FIG3 is a schematic diagram of a second scenario of the VXLAN message transmission control method according to the first embodiment of the present application;

[0022] FIG4 is a schematic diagram of a third scenario of the VXLAN message transmission control method according to the first embodiment of the present application;

[0023] FIG5 is a schematic diagram of a fourth scenario of the VXLAN message transmission control method according to the first embodiment of the present application;

[0024] FIG6 is a schematic diagram of a fifth scenario of the VXLAN message transmission control method according to the first embodiment of the present application;

[0025] FIG7 is a schematic diagram of a sixth scenario of the VXLAN message transmission control method according to the second embodiment of the present application;

[0026] FIG8 is a schematic diagram of the structure of a VXLAN message transmission control device in a hardware operating environment according to an embodiment of the present application;

[0027] FIG9 is a schematic diagram of a VXLAN message transmission control device according to the first embodiment of the present application.

[0028] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0029] It should be understood that the specific embodiments described herein are intended only to explain the present application and are not intended to limit the present application. Although terms such as first, second, and third may be used herein to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information.

[0030] An embodiment of the present application provides a method for controlling transmission of a VXLAN message. Referring to FIG. 1 , in this embodiment, the method for controlling transmission of a VXLAN message includes:

[0031] Step S10: Obtain a Flowspec route, where the Flowspec route includes a first traffic matching condition configured for VXLAN traffic and a traffic control action corresponding to the first traffic matching condition.

[0032] Step S20: Match the currently received message based on the first traffic matching condition to obtain a target VXLAN message;

[0033] Step S30: Based on the flow control action, determine the transmission mode of the target VXLAN message.

[0034] As an example, the VXLAN message transmission control method is applied to a VXLAN message transmission control device, the VXLAN message transmission control device is subordinate to the VXLAN message transmission control equipment, the VXLAN message transmission control equipment can be a routing device, and the routing device can be a router.

[0035] As an example, with the deepening of SDN technology, the application of new technologies such as VXLAN will become more extensive. Since VXLAN is a network virtualization technology that establishes a logical tunnel, encapsulates Ethernet frames at the data link layer into UDP packets, and transmits traffic at the network layer based on the VXLAN tunnel, when transmitting traffic through the VXLAN tunnel, it is necessary to encapsulate the traffic with a VXLAN header and a UDP header. However, Flowspec technology is limited to the identification and control of Native IP traffic and has no identification capability for this VXLAN traffic. As a result, it is impossible to implement device-side traffic control for VXLAN packets through Flowspec routing, which greatly limits its application scenarios.

[0036] Currently, Flowspec technology is used for policy routing on the inbound ports of routing devices. By receiving a remote Flowspec route and applying it to the corresponding device port, traffic matching and traffic action are designed for accurate traffic identification and policy enforcement, respectively, for incoming IP traffic from global or VPN (Virtual Private Network) ports. When traffic enters the inbound port of a routing device, it is matched against the traffic matching conditions of the Flowspec route. If all matching conditions are met, the traffic forwarding action is executed according to the traffic control action of the Flowspec route. If any of the matching conditions do not meet the traffic matching conditions, the match is missed, and the forwarding action is executed according to the routing device's pre-configured forwarding table.

[0037] As an example, as shown in Figure 3, the destination address (DA) of the device's inbound traffic is 12.12.12.1 / 24, the source address (SA) is 10.10.10.1 / 24, and the DSCP (Differentiated Services Code Point) value is 10. Based on the forwarding table pre-configured by the routing device, the next hop is egress port A. When the routing device receives the Flowspec route, it matches the IP traffic based on the destination address, source address, and DSCP in the Flowspec route. The corresponding flow control action includes at least one of the following:

[0038] 1) Redirection: The forwarding table is ignored and the new next hop is selected as the egress port B specified in the Flowspec route;

[0039] 2) Remark: the DSCP value in the forwarded message can be rewritten to 20;

[0040] 3) Rate limit: You can define the upper limit of traffic rate, the size of data content, etc.

[0041] This embodiment aims to add a first traffic matching condition configured for VXLAN traffic and a traffic control action corresponding to the first traffic matching condition to the Flowspec route. When a message is received, the VXLAN traffic can be matched and its transmission can be controlled, thereby implementing device-side traffic control for the VXLAN message and enriching the application scenarios of the Flowspec technology.

[0042] The specific steps are as follows:

[0043] Step S10: Obtain a Flowspec route, where the Flowspec route includes a first traffic matching condition configured for VXLAN traffic and a traffic control action corresponding to the first traffic matching condition.

[0044] As an example, the Flowspec route is sent to a local routing device through a Flowspec server.

[0045] As an example, the Flowspec route includes a first traffic matching condition configured for VXLAN traffic and a traffic control action corresponding to the first traffic matching condition.

[0046] As an example, the network layer reachability information includes an address family and a sub-address family. The address family is a configuration module of a network layer protocol, which is used to classify and configure different types of networks to facilitate management of different network types.

[0047] As shown in Figure 2, the FSv2 (Flowspec Technology Version 2) BGP NLRI encapsulation structure, in the existing Flowspec Version 2 (Flowspec routing) design, encapsulates data using TLVs. TLVs are a combination of Type-Length-Value, where Type indicates the type of information carried within the structure; Value indicates the information carried by the TLV; and Length indicates the valid byte length of the "Value" field. TLVs can be nested, with nested TLVs being called sub-TLVs. Each sub-TLV can serve as a traffic matching condition. This FSv2 can identify IPv4, IPv6, VPNv4 (Virtual Private Network Version 4), and VPNv6 (Virtual Private Network Version 6), but cannot identify VXLAN traffic.

[0048] The fields in the existing FSv2 BGP NLRI (Flowspec routing) are defined as follows, as shown in Figure 2:

[0049] 1) total-length: includes the length of all Sub-TLVs fields;

[0050] 2) order: the order of traffic matching conditions;

[0051] 3) identifier: identifier of the flow control action;

[0052] 4) type: An identifier of a Flowspec route in FSv2 TLV format.

[0053] 5) length-Subtlv: length of the Sub-TLV field;

[0054] 6) value: the value contained in the Sub-TLV.

[0055] The type field in the existing FSv2 BGP NLRI (Flowspec routing) is set as follows:

[0056] -0-reserved field;

[0057] -1-IP traffic rules: IP traffic rules (traffic matching conditions for IP traffic);

[0058] -2-L2 traffic rules: data link layer traffic rules;

[0059] -3-SFC traffic rules: service chain traffic rules;

[0060] -4-SFC VPN traffic rules: VPN service chain traffic rules;

[0061] -5-BGP / MPLS VPN IP traffic rules: BGP, MPLS (Multi-Protocol Label Switching), VPN, IP traffic rules;

[0062] -6-BGP / MPLS VPN L2 traffic rules: BGP, MPLS, VPN, and L2 traffic rules.

[0063] In this embodiment, the Flowspec route further includes a route distinguisher, and the route distinguisher is used to identify VPN traffic.

[0064] As an example, the route distinguisher in the existing FSv2 BGP NLRI is set to replace the original traffic matching condition for VPN traffic, that is, the type field related to VPN traffic is removed, and VPN traffic is identified by the route distinguisher.

[0065] In this embodiment, the design of the type field is as follows:

[0066] -0-reserved field,

[0067] -1-L2(Ether or VPN) traffic match;

[0068] -2-L3 (IP or VPN) traffic match: network layer traffic rules;

[0069] -3-MPLS traffic match;

[0070] -4-SRv6 traffic match: SRv6 (Segment Routing IPv6, segment routing based on the IPv6 forwarding plane) traffic rule;

[0071] -5-EVPN traffic match: EVPN (Ethernet Virtual Private Network) traffic rule;

[0072] -6-VXLAN traffic match.

[0073] As an example, VXLAN traffic match is the first traffic matching condition configured for VXLAN traffic.

[0074] Step S20: Match the currently received message based on the first traffic matching condition to obtain a target VXLAN message;

[0075] For example, VXLAN is a network virtualization technology that establishes a logical tunnel, encapsulates Ethernet frames at the data link layer into UDP packets, and transmits traffic at the network layer based on the VXLAN tunnel. When transmitting traffic through the VXLAN tunnel, it is necessary to encapsulate the traffic with a VXLAN header and a UDP (User Datagram Protocol) header. This is significantly different from traditional IP packets.

[0076] In this embodiment, the matching item in the first traffic matching condition includes at least one of the following:

[0077] The destination port number field in the UDP header;

[0078] The source port number field in the UDP header;

[0079] The VXLAN network identifier field in the VXLAN header.

[0080] As an example, during VXLAN message forwarding, the UDP header encapsulates the destination port number. Generally, the destination port number defaults to 4789. Therefore, the destination port number is preferably used as the matching condition for VXLAN traffic.

[0081] As an example, the UDP header also encapsulates the Source Port number corresponding to the Ethernet frame (data packet on the Ethernet link) calculated by the hash algorithm, which can be used as a matching condition for VXLAN traffic.

[0082] As an example, during VXLAN message forwarding, a VNI (VXLAN Network Identifier) ​​field with practical significance is encapsulated in the VXLAN header, which can be used as a matching condition for VXLAN traffic.

[0083] As an example, based on the first traffic matching condition, the currently received message is matched. If the currently received message can hit the field corresponding to at least one of the above matching items, it is determined that the message is the target VXLAN message.

[0084] As an example, in order to facilitate transmission control of the target VXLAN message, this embodiment designs a flow control action corresponding to the first flow matching condition for the VXLAN message.

[0085] In this embodiment, the traffic control action includes a redirection action, and the redirection action includes at least one of the following:

[0086] A VXLAN tunnel steering action, configured to direct the target VXLAN message to a specified VXLAN tunnel, the VXLAN tunnel being mapped to a target port of the target VXLAN message;

[0087] A destination node switching action, configured to modify the destination node in the target VXLAN message to a specified destination node, the destination node being mapped to a destination port of the target VXLAN message;

[0088] The VXLAN network identifier rewriting action is used to modify the VXLAN network identifier of the target VXLAN message to the VXLAN network identifier corresponding to the specified target virtual machine, and the VXLAN network identifier corresponding to the target virtual machine is mapped to the target port of the target VXLAN message.

[0089] As an example, the flow control actions in the original Flowspec technology include rate-limit (rate limit), remark (remark), and redirect (redirection).

[0090] In this embodiment, the redirection action is designed based only on the characteristics of the VXLAN message.

[0091] As an example, the VXLAN tunnel steering action is as follows: by defining a new ID-Type=6 to represent the VXLAN tunnel, and assigning the indirection-id (specified ID) to the VXLAN tunnel ID. That is, the routing device searches for the local VXLAN tunnel through the specified ID, and guides the target VXLAN message to the specified VXLAN tunnel. The VXLAN tunnel is mapped with the target port of the target VXLAN message, thereby achieving traffic diversion and forwarding. This VXLAN tunnel steering action is applicable to traffic at the data link layer or network layer, and is not applicable if the inbound traffic is tunnel encapsulated traffic, that is, it does not support MPLS, SRv6 or VXLAN encapsulated messages.

[0092] As an example, the destination node switching action is used to modify the destination node in the target VXLAN message to a specified destination node, and the destination node is mapped to the destination port of the target VXLAN message.

[0093] VTEP (VXLAN Tunnel Endpoint) is responsible for the encapsulation and decapsulation of VXLAN messages. Each VTEP has two ports: one is the local bridging port, which is responsible for receiving and sending original Ethernet frames, and the other is the IP port, which is responsible for receiving and sending VXLAN data frames. VTEP can be a physical switch or a software switch. Traffic transmission control can be achieved by changing the switching or forwarding method of the VTEP destination address, retaining the inner UDP header and VXLAN header, and performing the destination node switching action. This destination node switching action is applicable to VXLAN traffic encapsulated in the outer IP layer, and is different from the redirect Nexthop (next hop address redirection) action defined in [RFC8955]. If the VTEP intermediate network adopts forwarding methods such as MPLS and SRv6, it is necessary to expand the corresponding outer forwarding header action.

[0094] As an example, a VXLAN network identifier rewrite action is designed for the network identifier value in the VXLAN header. This VXLAN network identifier rewrite action modifies the network identifier to change the behavior of the destination VTEP, forwarding the inner layer message to a newly defined data link layer or network layer. This VXLAN network identifier rewrite action applies to VXLAN traffic.

[0095] Step S30: Based on the flow control action, determine the transmission mode of the target VXLAN message.

[0096] As an example, after the target VXLAN message is determined, the transmission of the target VXLAN message can be controlled based on the traffic control action corresponding to the first traffic matching condition.

[0097] As an example, as shown in Figure 4, the local routing information of the routing device includes: forwarding table (route-table): the next hop address (NextHop) of the traffic with the destination address (DA) of 12.12.12.1 / 24 is the directly connected address node A, and the outbound port is Int2; VXLAN tunnels (VXLAN tunnels): local IP (Local IP), remote IP (Remote IP), Tunnel ID = 10 dynamically created by the EVPN protocol, the next hop outbound port of the forwarding table iteration is Int3 to reach the directly connected address node B, and the rest of the information is omitted.

[0098] The device's inbound port receives native IP traffic: The device's inbound port Int1 receives a packet with a destination address of 12.12.12.1 / 24, a source address (SA) of 10.10.10.1 / 24, and a DSCP value of 10.

[0099] Flowspec route 1, received from the remote Flowspec server, specifies that the traffic match condition includes Sub-TLV type = 2, and the selected matching items are destination address DA = 12.12.12.1 / 24 and DSCP = 10. The traffic control action is VXLAN tunnel steering. Type-ID = 6 indicates VXLAN traffic steering, and Indirection-id = 10 selects Tunnel ID = 10.

[0100] When the routing device does not receive the Flowspec route, the routing device's public network port Int1 receives the Native IP traffic. By querying the routing device's public network forwarding table, it determines that the next hop address is Node A. Then, the Native IP traffic is transmitted to Node A from the egress port Int2.

[0101] When the routing device receives Flowspec route 1, it verifies the validity of the Flowspec route and applies it to ingress port Int1. The routing device receives native IP traffic on the ingress port and, based on the traffic matching conditions, finds DA = 12.12.12.1 / 24 and DSCP = 10. This determines that the traffic matches the target VXLAN packet and performs a VXLAN tunnel bootstrap action, redirecting the VXLAN tunnel to VXLAN Tunnel ID 10. The forwarding plane of the device queries the forwarding table for the next-hop port and selects egress port Int3 to forward the traffic to node B.

[0102] As an example, let's verify the validity of a Flowspec route: first, the traffic matching condition must include the network layer destination prefix. Second, if the traffic control action includes a redirect IP, the redirect destination address must be derived from a unicast BGP route published by the Flowspec server.

[0103] As an example, as shown in Figure 5, the local routing information of the routing device: the routing device port Int1 is connected to VTEP1, the routing device port Int2 is connected to VTEP2, and the routing device port Int3 is connected to VTEP3; the routing device forwarding table: the egress port to the destination address 1.1.1.1 / 32 is Int1, the egress port to the destination address 2.2.2.2 / 32 is Int2, and the egress port to the destination address 3.3.3.3 / 32 is Int3.

[0104] VTEP information: VTEP1, VTEP2, and VTEP3 each have two subnets, VNI a and VNI b. VTEP1's address is 1.1.1.1, and the host address of VM1 is 11.1.1.1, meaning VM1 belongs to the subnet with VNI a. VM2's host address is 11.1.1.1, meaning VM2 belongs to the subnet with VNI b. Similarly, the addresses and VM deployments of VTEP2 and VTEP3 are shown in Figure 5.

[0105] VTEP1's VXLAN tunnel information: VTEP1 has two VXLAN tunnels. Tunnel 1 has a Local IP address of 1.1.1.1 / 32 and a Remote IP address of 2.2.2.2 / 32, and supports VNIs a and b. Tunnel 2 has a Local IP address of 1.1.1.1 / 32 and a Remote IP address of 3.3.3.3 / 32, and supports VNIs a and b.

[0106] VTEP1 receives native IP traffic from VM1. VM1 sends an IPv4 packet with a destination address of 12.1.1.1 and a source address of the local host address of 11.1.1.1. This packet is forwarded to the network layer gateway device, VTEP1, through the directly connected port. VTEP1 encapsulates the native IP traffic into VXLAN traffic and sends it to the router.

[0107] The routing device receives VXLAN traffic on inbound port Int1. The traffic has an outer destination IP address of 2.2.2.2, a UDP encapsulation source port number of 6253, a UDP encapsulation destination port number of 4789, a VXLAN encapsulation VNI of a, and an inner IPv4 destination address of 12.1.1.1.

[0108] Flowspec route 2: The traffic matching condition includes Sub-TLV type = 6. The selected matching items are destination port number 4789 and VNI = a. The traffic control action is destination node switching, that is, redirecting the destination node to VTEP3 with Remote IP = 3.3.3.3.

[0109] As an example, when the routing device does not receive the Flowspec route, the routing device's public port Int1 receives VXLAN traffic, and the corresponding outer IP header queries the local IPv4 forwarding table. The traffic with the destination address 2.2.2.2 is transmitted from the egress port Int2 to the next-hop node VTEP2; VTEP2 completes the decapsulation of the VXLAN message and forwards the VXLAN message to the virtual machine VM3 based on VNI = a and the inner destination IP = 12.1.1.1.

[0110] When the routing device receives Flowspec route 2, it verifies the validity of the Flowspec route and applies it to inbound port Int1. The routing device receives VXLAN traffic on the inbound port and, based on the traffic matching conditions (UDP Destination Port = 4789 and VNI = a), performs a destination node switching action, switching the VXLAN next hop address to Remote IP = 3.3.3.3. The routing device queries the IPv4 forwarding table and the corresponding egress port, and chooses to transmit the traffic from egress port Int3 to VTEP3. VTEP3 decapsulates the VXLAN packet and forwards it to VM5 based on VNI = a and inner destination IP = 12.1.1.1.

[0111] As an example, as shown in Figure 6, routing device information: Device Int1 connects to VTEP1, and Device Int2 connects to VTEP2. The device forwarding table sets the egress port to destination address 1.1.1.1 / 32 as Int1, and the egress port to destination address 2.2.2.2 / 32 as Int2. VTEP information: VTEP1 and VTEP2 each have subnets with VNI=a and VNI=b, respectively. VTEP1's address is 1.1.1.1, and the host address of VM1, which is connected to the subnet with VNI=a, is 11.1.1.1. VM2's host address is 11.1.1.1, which belongs to the subnet with VNI=b. Similarly, VTEP2's address and VM deployment are shown in Figure 6.

[0112] VXLAN tunnel information for VTEP1: A VXLAN tunnel exists on VTEP1, with the tunnel's Local IP address at 1.1.1.1 / 32 and Remote IP address at 2.2.2.2 / 32, supporting VNIs a and b. VTEP1 receives native IP traffic from VM1: VM1 sends an IPv4 packet with a destination address of 12.1.1.1 and a source address of the local host at 11.1.1.1. This packet is forwarded to the network layer gateway device VTEP1 through the directly connected port. VXLAN traffic is received on the device's inbound port: Int1 receives a VXLAN packet with an outer destination IP address of 2.2.2.2, a UDP encapsulated source port of 6253, a UDP encapsulated destination port of 4789, a VXLAN encapsulated VNI a, and an inner IPv4 destination address of 12.1.1.1.

[0113] Flowspec route 3: The traffic matching condition includes Sub-TLV type = 6. The matching items are UDP destination port number 4789 and UDP source port number 6253. The flow control action is to rewrite the VXLAN network identifier, that is, to change the VNI to b.

[0114] When the routing device does not receive the Flowspec route, the routing device queries the local IPv4 forwarding table based on the outer IP header for incoming VXLAN traffic on the public network port Int1. Traffic with the destination address 2.2.2.2 is sent out of the egress port Int2 to the next hop node VTEP2. VTEP2 decapsulates the VXLAN packet and forwards it to VM3 based on VNI = a and inner destination IP = 12.1.1.1.

[0115] When the routing device receives Flowspec route 3, it verifies the validity of the Flowspec route and applies it to inbound port Int1. The routing device receives VXLAN traffic on the inbound port and, based on the traffic matching conditions of UDP Destination Port 4789 and UDP Source Port 6253, rewrites the VXLAN network identifier (VNI) to VNI b. The routing device then queries the IPv4 forwarding table and the corresponding next-hop node for the outbound port and selects VTEP2 to forward the traffic to outbound port Int2. VTEP3 decapsulates the VXLAN packet and forwards it to VM4 based on VNI b and inner destination IP address 12.1.1.1.

[0116] In this embodiment, the routing device obtains a Flowspec route that includes a first traffic matching condition configured for VXLAN traffic and a traffic control action corresponding to the first traffic matching condition; matches the currently received message based on the first traffic matching condition to obtain a target VXLAN message; and determines the transmission method of the target VXLAN message based on the traffic control action. Because the first traffic matching condition in the Flowspec route and the traffic control action corresponding to the first traffic matching condition are both configured for VXLAN traffic, the target VXLAN message can be identified through the first traffic matching condition in the Flowspec route, and the target port of the target VXLAN message can be determined based on the traffic control action corresponding to the first traffic matching condition, and the target VXLAN message can be transmitted from the target port. This achieves the identification and processing of VXLAN messages, breaking the limitations of Flowspec technology in identifying and controlling VXLAN traffic.

[0117] Based on the above embodiments of the present application, another embodiment of the present application is provided, referring to FIG7 . In this embodiment, the Flowspec routing further includes a second flow matching condition configured for other types of flows.

[0118] In this embodiment, as shown in FIG7 , the other types of traffic include at least one of data link layer traffic, network layer traffic, MPLS traffic, SRv6 traffic, and EVPN traffic.

[0119] In this embodiment, the Flowspec route includes a type field, and the type field is used to indicate matching conditions of different types of traffic included in the Flowspec route.

[0120] As an example, the type field contains the following content that is a second traffic matching condition configured for other types of traffic:

[0121] -1-L2(Ether or VPN) traffic match;

[0122] -2-L3 (IP or VPN) traffic match;

[0123] -3-MPLS traffic match;

[0124] -4-SRv6 traffic match;

[0125] -5-EVPN traffic match.

[0126] As an example, the second traffic matching condition of other types of traffic configurations may be set based on the characteristics of the type of traffic.

[0127] In this embodiment, after the step of obtaining the Flowspec route, the method further includes:

[0128] Step S40: Based on the type field, the currently received message is matched to obtain a message corresponding to the target type traffic.

[0129] As an example, when a Flowspec route is obtained, the Flowspec route may include matching conditions for different types of traffic.

[0130] Therefore, it is necessary to match the currently received message based on the traffic matching conditions corresponding to each traffic type in the type field in the Flowspec route.

[0131] For example, if the type field in the current Flowspec route includes traffic matching conditions for MPLS traffic, EVPN traffic, and VXLAN traffic, then when matching a currently received packet based on the type field, if a traffic matching condition is met, the currently received packet is determined to be a packet corresponding to the target traffic type. (The target traffic type is the traffic that the Flowspec route is intended to match and that is matched, and the target traffic type is at least one of MPLS traffic, EVPN traffic, and VXLAN traffic.)

[0132] In this embodiment, the step of matching the currently received message based on the first traffic matching condition to obtain the target VXLAN message includes:

[0133] Step A1: Based on the priorities of the first traffic matching condition and the second traffic matching condition, and the priorities of each matching item in the first traffic matching condition, the currently received message is matched to obtain the target VXLAN message.

[0134] In this embodiment, the priority of the first traffic matching condition is lower than the priority of the second traffic matching condition, the priority of the VXLAN network identifier field in the VXLAN header is lower than the priority of the source port number field in the UDP header, and the priority of the source port number field in the UDP header is lower than the priority of the destination port number field in the UDP header.

[0135] As an example, if the first traffic matching condition only includes one of the destination port number field in the UDP header, the source port number field in the UDP header, and the VXLAN network identifier field in the VXLAN header, then in the process of matching the currently received message based on the first traffic matching condition, there is no need to judge the priority among the three.

[0136] As an example, if the first traffic matching condition includes at least two of the destination port number field in the UDP header, the source port number field in the UDP header, and the VXLAN network identifier field in the VXLAN header, then matching the currently received message based on the priority between the three can improve the efficiency of traffic matching.

[0137] As an example, since different types of traffic have different processing priorities, it is necessary to match the currently received message based on the priorities of the first traffic matching conditions and the second traffic matching conditions corresponding to the different types of traffic. The priority of the first traffic matching condition is lower than the priority of the second traffic matching condition.

[0138] In this embodiment, after the step of matching the currently received message based on the first traffic matching condition, the method further includes:

[0139] Step S60: If the currently received message is matched based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and at the same time, the currently received message is matched based on the second traffic matching condition in the Flowspec route to obtain the message corresponding to the other type of traffic, then it is determined that the target VXLAN message obtained by matching is invalid, and the message corresponding to the other type of traffic obtained by matching is valid.

[0140] As an example, since the processing priority of VXLAN traffic is low, if the Flowspec route contains the first traffic matching condition and the second traffic matching condition, then during the traffic matching process, if the currently received message is matched based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and at the same time, the currently received message is matched based on the second traffic matching condition in the Flowspec route to obtain the message corresponding to the other type of traffic, then it is determined that the matched target VXLAN message is invalid and the matched message corresponding to the other type of traffic is valid. If the currently received message is matched based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and no message corresponding to the other type of traffic is matched, then it is determined that the target VXLAN message is valid.

[0141] In this embodiment, standardized recommendations are made for the priorities and effectiveness conditions of traffic matching conditions for various types of traffic, facilitating the standardized implementation of the VXLAN message transmission control method.

[0142] Based on the above embodiments of the present application, another embodiment of the present application is provided. In this embodiment, the flow control action also includes other redirection actions.

[0143] In this embodiment, before the step of determining the transmission control mode of the target VXLAN packet based on the traffic control action, the method further includes:

[0144] Step S70: determining whether the traffic control action corresponding to the first traffic matching condition includes both the redirection action and the other redirection action;

[0145] Step S80: If it exists, it is determined that the Flowspec route is invalid, and the step of determining the transmission control method of the target VXLAN message based on the flow control action is not performed.

[0146] As an example, the traffic control action includes at least one of the above-designed VXLAN tunnel guidance action, destination node switching action, and VXLAN network identifier rewriting action.

[0147] As an example, the flow control action also includes other redirection actions specified by the original Flowspe technology.

[0148] Therefore, before determining the transmission control mode for the target VXLAN packet based on the flow control action, it is necessary to determine whether the redirection action and the other redirection action exist simultaneously in the flow control action corresponding to the first flow matching condition. If a flow control action conflict exists, the flowspec route is determined to be invalid, and the step of determining the transmission control mode for the target VXLAN packet based on the flow control action is not performed. If not, the flowspec route is determined to be valid, and the step of determining the transmission control mode for the target VXLAN packet based on the flow control action is continued.

[0149] In this embodiment, standardized recommendations are provided for conflict handling of redirection actions and the validity of Flowspec routing, facilitating the standardized implementation of the VXLAN message transmission control method.

[0150] Refer to Figure 8, which is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

[0151] As shown in FIG8 , the VXLAN message transmission control device may include: a processor 1001 , a memory 1005 , and a communication bus 1002 . The communication bus 1002 is used to implement connection and communication between the processor 1001 and the memory 1005 .

[0152] In one embodiment, the VXLAN message transmission control device may further include a user port, a network port, a camera, an RF (Radio Frequency) circuit, a sensor, a Wi-Fi module, etc. The user port may include a display and an input submodule such as a keyboard. The user port may also include a standard wired port or a wireless port. The network port may include a standard wired port or a wireless port (such as a Wi-Fi port).

[0153] Those skilled in the art will understand that the VXLAN message transmission control device structure shown in Figure 8 does not constitute a limitation on the VXLAN message transmission control device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0154] As shown in Figure 8, memory 1005, which serves as a storage medium, may include an operating system, a network communication module, and a VXLAN message transmission control program. The operating system is a program that manages and controls the hardware and software resources of the VXLAN message transmission control device and supports the operation of the VXLAN message transmission control program and other software and / or programs. The network communication module is used to enable communication between the various components within memory 1005, as well as communication with other hardware and software in the VXLAN message transmission control system.

[0155] In the VXLAN message transmission control device shown in Figure 8, the processor 1001 is used to execute the VXLAN message transmission control program stored in the memory 1005 to implement the steps of the VXLAN message transmission control method described in any one of the above items.

[0156] The specific implementation of the transmission control device of the VXLAN message in the present application is basically the same as the various embodiments of the transmission control method of the above-mentioned VXLAN message, and will not be repeated here.

[0157] The present application also provides a VXLAN message transmission control device, which is applied to a routing device. As shown in FIG9 , the device includes:

[0158] A route receiving module 10 is configured to obtain a Flowspec route, wherein the Flowspec route includes a first flow matching condition configured for VXLAN traffic and a flow control action corresponding to the first flow matching condition;

[0159] A matching module 20 is configured to match the currently received message based on the first traffic matching condition to obtain a target VXLAN message;

[0160] The control module 30 is used to determine the transmission mode of the target VXLAN message based on the traffic control action.

[0161] In a possible implementation manner of the present application, a VXLAN header and a UDP header are encapsulated in a VXLAN packet corresponding to the VXLAN traffic, and a matching item in the first traffic matching condition includes at least one of the following:

[0162] The destination port number field in the UDP header;

[0163] The source port number field in the UDP header;

[0164] The VXLAN network identifier field in the VXLAN header.

[0165] In a possible implementation manner of the present application, the Flowspec routing further includes a second flow matching condition configured for other types of flows, and the matching module 20 includes:

[0166] a matching submodule, configured to match the currently received message based on the priorities of the first traffic matching condition and the second traffic matching condition, and the priorities of the matching items in the first traffic matching condition, to obtain the target VXLAN message;

[0167] Among them, the priority of the first traffic matching condition is lower than the priority of the second traffic matching condition, the priority of the VXLAN network identifier field in the VXLAN header is lower than the priority of the source port number field in the UDP header, and the priority of the source port number field in the UDP header is lower than the priority of the destination port number field in the UDP header.

[0168] In a possible implementation manner of the present application, the other type of traffic includes at least one of data link layer traffic, network layer traffic, MPLS traffic, SRv6 traffic, and EVPN traffic. After the step of matching the currently received message based on the first traffic matching condition, the apparatus further includes:

[0169] The validity judgment module is used to match the currently received message based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and at the same time match the currently received message based on the second traffic matching condition in the Flowspec route to obtain the message corresponding to the other type of traffic, then determine that the matched target VXLAN message is invalid and the matched message corresponding to the other type of traffic is valid.

[0170] In a possible implementation manner of the present application, the flow control action includes a redirection action, and the redirection action includes at least one of the following:

[0171] A VXLAN tunnel steering action, configured to direct the target VXLAN message to a specified VXLAN tunnel, the VXLAN tunnel being mapped to a target port of the target VXLAN message;

[0172] A destination node switching action, configured to modify the destination node in the target VXLAN message to a specified destination node, the destination node being mapped to a destination port of the target VXLAN message;

[0173] The VXLAN network identifier rewriting action is used to modify the VXLAN network identifier of the target VXLAN message to the VXLAN network identifier corresponding to the specified target virtual machine, and the VXLAN network identifier corresponding to the target virtual machine is mapped to the target port of the target VXLAN message.

[0174] In a possible implementation manner of the present application, the flow control action further includes other redirection actions. Before the step of determining the transmission control mode of the target VXLAN message based on the flow control action, the apparatus further includes:

[0175] an action judging module, configured to judge whether the redirection action and the other redirection action exist simultaneously in the flow control action corresponding to the first flow matching condition;

[0176] A validity judgment module is used to determine that the Flowspec route is invalid if it exists, and not perform the step of determining the transmission control method of the target VXLAN message based on the flow control action.

[0177] In a possible implementation manner of the present application, the Flowspec route includes a type field, where the type field is used to indicate matching conditions for different types of traffic included in the Flowspec route. After the step of obtaining the Flowspec route, the apparatus further includes:

[0178] The field matching module is used to match the currently received message based on the type field to obtain the message corresponding to the target type traffic.

[0179] In a possible implementation manner of the present application, the Flowspec route further includes a route distinguisher, and the route distinguisher is used to identify VPN traffic.

[0180] The specific implementation of the VXLAN message transmission control device of the present application is basically the same as the various embodiments of the above-mentioned VXLAN message transmission control method, and will not be repeated here.

[0181] The present application also provides a storage medium, on which a transmission control program for a VXLAN message is stored. When the transmission control program for the VXLAN message is executed by a processor, the steps of the VXLAN message transmission control method as described in any one of the above items are implemented.

[0182] The specific implementation of the storage medium of the present application is basically the same as the various embodiments of the above-mentioned VXLAN message transmission control method, and will not be repeated here.

[0183] As used herein, the terms "comprises," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or system that includes the element.

[0184] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0185] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0186] The above are merely optional embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A VXLAN message transmission control method, applied to a routing device, comprising the following steps: Obtain a Flowspec route, where the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition; Based on the first traffic matching condition, matching the currently received message to obtain a target VXLAN message; Based on the traffic control action, determine a transmission mode for the target VXLAN message.

2. The VXLAN message transmission control method according to claim 1, wherein: A VXLAN header and a UDP header are encapsulated in the VXLAN message corresponding to the VXLAN traffic, and the matching items in the first traffic matching condition include at least one of the following: The destination port number field in the UDP header; The source port number field in the UDP header; The VXLAN network identifier field in the VXLAN header.

3. The VXLAN message transmission control method according to claim 2, wherein: The Flowspec routing also includes a second flow matching condition configured for other types of flows; The step of matching the currently received message based on the first traffic matching condition to obtain the target VXLAN message includes: Based on the priorities of the first traffic matching condition and the second traffic matching condition, and the priorities of the matching items in the first traffic matching condition, the currently received message is matched to obtain the target VXLAN message; Among them, the priority of the first traffic matching condition is lower than the priority of the second traffic matching condition, the priority of the VXLAN network identifier field in the VXLAN header is lower than the priority of the source port number field in the UDP header, and the priority of the source port number field in the UDP header is lower than the priority of the destination port number field in the UDP header.

4. The VXLAN message transmission control method according to claim 3, wherein: The other types of traffic include at least one of data link layer traffic, network layer traffic, MPLS traffic, SRv6 traffic, and EVPN traffic; After the step of matching the currently received message based on the first traffic matching condition, the method further includes: If the currently received message is matched based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and at the same time, the currently received message is matched based on the second traffic matching condition in the Flowspec route to obtain the message corresponding to the other type of traffic, then it is determined that the matched target VXLAN message is invalid, and the matched message corresponding to the other type of traffic is valid.

5. The VXLAN message transmission control method according to any one of claims 1 to 4, wherein: The flow control action includes a redirection action, and the redirection action includes at least one of the following: A VXLAN tunnel guiding action, configured to guide the target VXLAN message to a specified VXLAN tunnel, the VXLAN tunnel being mapped with a target port of the target VXLAN message; A destination node switching action is configured to modify the destination node in the target VXLAN message to a specified destination node, the destination node being mapped with a destination port of the target VXLAN message; The rewriting action of the VXLAN network identifier is set to modify the VXLAN network identifier of the target VXLAN message to the VXLAN network identifier corresponding to the specified target virtual machine, and the VXLAN network identifier corresponding to the target virtual machine is mapped with the target port of the target VXLAN message.

6. The VXLAN message transmission control method according to claim 5, wherein: The flow control action further includes other redirection actions. Before the step of determining the transmission control mode of the target VXLAN message based on the flow control action, the method further includes: Determining whether the redirection action and the other redirection action exist simultaneously in the flow control action corresponding to the first flow matching condition; If so, it is determined that the Flowspec route is invalid, and the step of determining the transmission control method of the target VXLAN message based on the flow control action is not performed.

7. The VXLAN message transmission control method according to claim 3, wherein: The Flowspec route includes a type field, and the type field is set to indicate matching conditions of different types of traffic included in the Flowspec route; After the step of obtaining the Flowspec route, the method further includes: Based on the type field, the currently received message is matched to obtain a message corresponding to the target type traffic.

8. The VXLAN message transmission control method according to claim 7, wherein: The Flowspec route also includes a route distinguisher, and the route distinguisher is configured to identify VPN traffic.

9. A transmission control device for a VXLAN message, wherein: The device comprises: a route receiving module configured to obtain a Flowspec route, wherein the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition; A matching module, configured to match the currently received message based on the first traffic matching condition to obtain a target VXLAN message; The control module is configured to determine a transmission mode of the target VXLAN message based on the flow control action.

10. A VXLAN message transmission control device, wherein: The device includes: a memory, a processor, and a transmission control program for VXLAN messages stored in the memory and executable on the processor, wherein the transmission control program for VXLAN messages is configured to implement the steps of the transmission control method for VXLAN messages according to any one of claims 1 to 8.

11. A storage medium, wherein: The storage medium stores a transmission control program for a VXLAN message, and when the transmission control program for the VXLAN message is executed by the processor, the steps of the transmission control method for the VXLAN message as described in any one of claims 1 to 8 are implemented.

Images