CN112217918B

CN112217918B - IPv6 address conflict detection method and device in SDN network

Info

Publication number: CN112217918B
Application number: CN202011146015.0A
Authority: CN
Inventors: 韩冰
Original assignee: New H3C Security Technologies Co Ltd
Current assignee: New H3C Security Technologies Co Ltd
Priority date: 2020-10-23
Filing date: 2020-10-23
Publication date: 2022-05-24
Anticipated expiration: 2040-10-23
Also published as: CN112217918A

Abstract

The embodiment of the invention provides an IPv6 address conflict detection method and device in an SDN network, wherein a multicast detection message sent by a first network device is received, and the multicast detection message comprises an MAC address of the first network device and an IPv6 address to be detected; judging whether the IPv6 address list has an IPv6 address to be detected or not; if the judgment result is yes, converting the multicast detection message into a unicast detection message with the destination MAC address being the MAC address of the second network equipment, and sending the unicast detection message to the second network equipment; and receiving a multicast response message sent by the second network equipment, converting the multicast response message into a unicast response message with a destination MAC address as the MAC address of the first network equipment based on the corresponding relation between the MAC address of the first network equipment and the IPv6 address to be detected, and sending the unicast response message to the first network equipment. The method realizes that the IPv6 address conflict can be detected when the flooding function is closed.

Description

IPv6 address conflict detection method and device in SDN network

Technical Field

The invention relates to the technical field of network communication, in particular to an IPv6 address conflict detection method and device in an SDN network.

Background

In a Software Defined Network (SDN), in order to avoid flooding traffic from occupying Network and computing resources, a flooding function of an OpenVSwitch (OVS) is usually turned off, that is, forwarding of multicast and broadcast packets is prohibited. For some services which must use multicast or broadcast messages, the OVS may convert the multicast or broadcast messages into unicast messages, that is, replace the multicast IPv6 address with the target IPv6 address carried in the message, and forward the unicast message to the target IPv6 address.

However, the existing solutions are undetectable if there is an IPv6 address conflict in the network. The reason is that: the reply message for detecting the address conflict is multicast, and the target IPv6 address and the source IPv6 address in the reply message are the same, if the multicast reply message is converted into a unicast message, the target IPv6 address in the reply message is changed into the source IPv6 address, namely the reply message returns to the network device sending the reply message. As can be seen, the multicast response packet cannot be normally converted into the unicast packet, so that the address conflict cannot be detected.

It can be seen that when the flooding function is turned off, the address collision of IPv6 cannot be detected. In view of the above problems, there are two existing solutions. The first solution is to start the flooding function, so that the multicast packet can be directly forwarded, but starting the flooding function occupies more bandwidth and computing resources, is more vulnerable and has poorer security; the second solution is to replace the SDN controller with the reply, that is, all reply messages are uploaded to the SDN controller and replaced by the SDN controller for forwarding, but this may result in a large pressure on the controller and a high requirement on the performance of the controller.

Disclosure of Invention

An object of the embodiments of the present invention is to provide a method and an apparatus for detecting IPv6 address conflicts in an SDN network, so as to detect IPv6 address conflicts even when a flooding function is turned off.

The specific technical scheme is as follows:

in order to achieve the above object, an embodiment of the present invention provides a method for detecting an IPv6 address conflict in an SDN network, where the method is applied to an OVS, and the method includes:

receiving a multicast detection message sent by a first network device, wherein the multicast detection message comprises an MAC address of the first network device and an IPv6 address to be detected;

judging whether the IPv6 address to be detected exists in an IPv6 address list or not, wherein when any IPv6 address is detected to be on-line, any IPv6 address is added to the IPv6 address list;

if the judgment result is yes, converting the multicast detection message into a unicast detection message with a destination MAC address as the MAC address of second network equipment, wherein the second network equipment is the network equipment with the to-be-detected IPv6 address on line, sending the unicast detection message to the second network equipment, and recording the corresponding relation between the MAC address of the first network equipment and the to-be-detected IPv6 address;

Receiving a multicast response message sent by the second network device, converting the multicast response message into a unicast response message with a destination MAC address as the MAC address of the first network device based on the corresponding relationship between the MAC address of the first network device and the IPv6 address to be detected, and sending the unicast response message to the first network device.

Optionally, the recording a correspondence between the MAC address of the first network device and the IPv6 address to be tested includes:

based on a pre-stored learning flow table, generating a time-limited matching flow table entry for forwarding a multicast response message corresponding to the multicast detection message according to the multicast detection message, wherein the matching entry for time-limited matching the flow table entry comprises: the target IPv6 address is a multicast IPv6 address, the target IPv6 address is the IPv6 address to be tested, and the target IPv6 address is provided with a message identifier of a multicast response message; the action items of the time-limited matching flow table entry are as follows: and converting the destination MAC address of the multicast response message into the MAC address of the first network equipment.

Optionally, the method further includes:

receiving a learning flow table issued by a controller, wherein matching items of the learning flow table comprise: the source IPv6 address is all zero and has a message identifier of the multicast detection message; the action items of the learning flow table are as follows: and generating the time-limited matching flow table entry.

Optionally, the receiving a multicast response packet sent by the second network device includes:

acquiring a message to be matched received within a preset time after the time-limited matching flow table entry is generated;

and comparing the target IPv6 address, the target IPv6 address and the message identifier of the message to be matched with the matching item of the time-limited matching flow table entry, and if the target IPv6 address of the message to be matched is the multicast IPv6 address, the target IPv6 address is the IPv6 address to be detected and the message identifier is the message identifier of the multicast response message, determining the message to be matched as the multicast response message.

Optionally, when the expiration time of the time-limited matching flow table representation is reached, the time-limited matching flow table entry is deleted.

In order to achieve the above object, an embodiment of the present invention further provides an IPv6 address collision detection apparatus in an SDN network, which is applied to an OVS, where the apparatus includes:

the receiving module is used for receiving a multicast detection message sent by first network equipment, wherein the multicast detection message comprises an MAC address of the first network equipment and an IPv6 address to be detected;

the detection module is used for judging whether the IPv6 address to be detected exists in an IPv6 address list or not, wherein when any IPv6 address is detected to be on-line, any IPv6 address is added to the IPv6 address list;

A first conversion module, configured to convert the multicast detection packet into a unicast detection packet with a destination MAC address as an MAC address of a second network device if the determination result is yes, where the second network device is a network device with the to-be-detected IPv6 address online, send the unicast detection packet to the second network device, and record a corresponding relationship between the MAC address of the first network device and the to-be-detected IPv6 address;

and the second conversion module is used for receiving the multicast response message sent by the second network device, converting the multicast response message into a unicast response message with a destination MAC address being the MAC address of the first network device based on the corresponding relation between the MAC address of the first network device and the IPv6 address to be detected, and sending the unicast response message to the first network device.

Optionally, the first conversion module is specifically configured to:

Optionally, the apparatus further comprises:

the matching module is used for receiving a learning flow table issued by the controller, and the matching items of the learning flow table comprise: the source IPv6 address is all zero and has a message identifier of the multicast detection message; the action items of the learning flow table are as follows: and generating the time-limited matching flow table entry.

Optionally, the second conversion module is specifically configured to:

acquiring a message to be matched received within preset time after the time-limited matching flow table entry is generated;

Optionally, the apparatus further comprises:

and the deleting module is used for deleting the time-limited matching flow table entries when the failure time of the time-limited matching flow table is reached.

In order to achieve the above object, an embodiment of the present invention further provides an electronic device, which is a virtual machine and includes a processor, a communication interface, a memory, and a communication bus, where the processor and the communication interface are used, and the memory completes mutual communication through the communication bus;

A memory for storing a computer program;

and a processor for implementing any of the above method steps when executing the program stored in the memory.

To achieve the above object, an embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, and the computer program, when executed by a processor, implements any of the above method steps.

The embodiment of the invention has the following beneficial effects:

by applying the IPv6 address conflict detection method and device in the SDN, the OVS obtains a multicast detection message sent by the first network equipment, wherein the multicast detection message comprises the MAC address of the first network equipment and the IPv6 address to be detected; judging whether the IPv6 address list has an IPv6 address to be detected or not; if the judgment result is yes, the multicast detection message is converted into a unicast detection message of which the destination MAC address is the MAC address of the second network equipment, and the unicast detection message is sent to the second network equipment; acquiring a multicast response message sent by second network equipment, converting the multicast response message into a unicast response message with a destination MAC address as the MAC address of the first equipment based on the corresponding relation between the source MAC address of the first network equipment and the IPv6 address to be detected, and sending the unicast response message to the first network equipment. Therefore, after receiving the multicast detection message, the OVS records the corresponding relationship between the MAC address of the first network device and the IPv6 address to be detected, so that after receiving the response message sent by the second network device, the OVS can change the destination MAC address of the response message into the MAC address of the first device according to the corresponding relationship, and further can send the response message to the first network device, so that the situation that the response message is returned to the second network device does not occur, and the IPv6 address conflict can be detected when the flooding function is turned off.

Of course, it is not necessary for any product or method to achieve all of the above-described advantages at the same time for practicing the invention.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art that other embodiments can be obtained by using the drawings without creative efforts.

Fig. 1 is a schematic structural diagram of an SDN network according to an embodiment of the present invention;

fig. 2 is a schematic flowchart of an IPv6 address conflict detection method in an SDN network according to an embodiment of the present invention;

fig. 3 is a schematic structural diagram of a multicast detection packet according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of a multicast response packet according to an embodiment of the present invention;

fig. 5 is a schematic structural diagram of a unicast reply packet according to an embodiment of the present invention;

fig. 6 is a signaling diagram of an IPv6 address collision detection method in an SDN network according to an embodiment of the present invention;

Fig. 7 is a schematic structural diagram of an IPv6 address collision detection apparatus in an SDN network according to an embodiment of the present invention;

fig. 8 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

In order to solve the technical problem that the IPv6 address conflict cannot be detected when the flooding function is turned off, embodiments of the present invention provide a method and an apparatus for detecting IPv6 address conflict in an SDN network, where the method may be applied to a virtual switch OVS in the SDN network, and the OVS forms a switching component by using a software manner, and may also be referred to as a software switch. Referring to fig. 1, fig. 1 is a schematic structural diagram of an SDN network according to an embodiment of the present invention, where the SDN network further includes an SDN controller and a network device, the OVS may forward a packet for the network device, and the SDN controller may issue a flow table to the OVS to control the OVS to forward the packet. The first network device and the second network device mentioned in the embodiments of the present invention may be Virtual Machines (VMs).

As shown in fig. 2, a method for detecting an IPv6 address conflict in an SDN network according to an embodiment of the present invention may include the following steps:

s201: and receiving a multicast detection message sent by the first network equipment, wherein the multicast detection message comprises the MAC address of the first network equipment and the IPv6 address to be detected.

In the embodiment of the invention, the multicast detection message represents a multicast-type message for detecting the IPv6 address conflict.

In the embodiment of the present invention, when a first network device needs to access an SDN network, an SDN controller may allocate an IPv6 address to the first network device, before formally enabling the allocated IPv6 address, the first network device needs to perform collision detection on the IPv6 address, and determine whether the IPv6 address is already occupied through IPv6 address collision detection.

In the embodiment of the present invention, the IPv6 address allocated to the first network device is recorded as an IPv6 address to be tested.

Specifically, the first network device may send a message for detecting an address conflict to the OVS, and those skilled in the art can understand that the message for detecting an address conflict contains a specific message identifier, which is denoted as a multicast detection message in the embodiment of the present invention. The message follows icmpv6 protocol, and carries multicast detection message identification, namely icmp type: 135. in addition, the source IPv6 address of the multicast detection message is ":", namely all zeros.

In the embodiment of the invention, the multicast detection message contains the source MAC address of the first network equipment. In addition, the multicast detection packet carries a target IPv6 address, and the target IPv6 address is the to-be-detected IPv6 address.

That is to say, the first network device wants to send the multicast detection message to the MAC address corresponding to the IPv6 address to be detected, but the first network device does not know the MAC address corresponding to the IPv6 address to be detected, and therefore can only send the message to the OVS in the form of multicast.

In addition, those skilled in the art can understand that the destination IPv6 address of the multicast detection message is the multicast IPv6 address of the requested node. The multicast IPv6 address may be expressed as: FF02: 1: FFXX: XXXX, wherein XX: XXXX is taken from the last 24 bits of target IPv 6. For example, if the target IPv6 of the message is: 1: 1234:5678, the multicast IPv6 address of the corresponding requested node is: FF02: 1: FF34: 5678.

The destination MAC address of the multicast detection message is a multicast MAC address corresponding to the destination IPv6 address of the message, and the multicast MAC address can be expressed as 33:33: XX: XX: XX: XX, wherein XX: XX: XX: XX is taken from the last 32 bits of the destination IPv6 address. For example, if the destination IPv6 of the message is 1: 1234:5678: abcd, the corresponding destination multicast MAC address is: 33:33:56:78: ab: cd.

As an example, referring to fig. 3, fig. 3 is a schematic structural diagram of a multicast detection message according to an embodiment of the present invention, as shown in fig. 3, the multicast detection message includes a source IPv6 address ":", that is, an all-zero IPv6 address, and the multicast detection message includes a target IPv6 address 1::1111, where the target IPv6 address is also an IPv6 to be detected, and also includes an MAC address 00:10:94:00:00:02 of a first network device, and also includes a message identifier of the multicast detection message, that is, an icmp type: 135. In addition, the multicast detection message further includes a destination IPv6 address FF02: 1: FF00:1111 in a multicast format, and further includes a destination MAC address 33:33: FF:00:11:11 in a multicast format, where the generation manners of the destination IPv6 address and the destination MAC address may be referred to above and are not described again.

S202: and judging whether the IPv6 address list has the IPv6 address to be tested or not, wherein when any IPv6 address is detected to be on-line, any IPv6 address is added to the IPv6 address list.

In the embodiment of the invention, the OVS is used as a virtual switch and can sense the online of the IPv6 address. That is, if a network device formally comes online with an IPv6 address, and the OVS can know that the IPv6 address has come online, the OVS can record the IPv6 address and list it in the IPv6 address list. In addition, the OVS can also determine and record the MAC address of the network device online with the IPv6 address.

In the embodiment of the invention, the OVS can compare the IPv6 address to be tested with all IPv6 addresses contained in the current IPv6 address list, and can determine whether the IPv6 address to be tested exists in the IPv6 address list.

S203: if the judgment result is yes, the multicast detection message is converted into a unicast detection message with the destination MAC address as the MAC address of the second network equipment, the second network equipment is the network equipment on the line of the IPv6 address to be detected, the unicast detection message is sent to the second network equipment, and the corresponding relation between the MAC address of the first network equipment and the IPv6 address to be detected is recorded.

In the embodiment of the invention, the OVS can sense the online of the IPv6 address. The OVS can record the online IPv6 addresses, as well as the MAC addresses of the network devices that are online with the respective online IPv6 addresses. When the OVS detects that the IPv6 address list has the IPv6 address to be detected, namely the IPv6 address to be detected belongs to the recorded online IPv6 address, the MAC address of the network device which is online by the IPv6 address to be detected can be determined according to the history.

In the embodiment of the invention, because the OVS can only sense the IPv6 address going online and cannot sense the IPv6 address going offline, the OVS cannot determine whether the IPv6 address to be detected is still in an online state at present, and the OVS needs to forward a detection message to the second network device, and determine whether the IPv6 address to be detected is still in an online state at present according to whether a response message of the second network device is received.

That is to say, in order to determine whether an address conflict exists in the IPv6 address to be tested, the OVS needs to forward the multicast detection packet to the IPv6 address to be tested. In the embodiment of the invention, when the flooding function is closed, the multicast message is not allowed to be directly forwarded, and the multicast message can be forwarded only by converting the multicast message into a unicast message.

That is, the OVS converts the multicast detection packet into a unicast detection packet, and sends the unicast detection packet to the second network device, where if the second network device still occupies the IPv6 address to be detected currently, the second network device feeds back a corresponding packet; and if the second network equipment is offline currently, the corresponding message cannot be fed back.

Specifically, the OVS may change the multicast IPv6 address in the multicast detection message to the target IPv6 address carried in the message, that is, the to-be-detected IPv6 address. And changing the destination MAC address in the multicast detection message into the MAC address of the second network equipment to obtain a unicast detection message, wherein the unicast detection message can be sent to the second network equipment.

In addition, the OVS may record a corresponding relationship between the MAC address of the first network device and the IPv6 address to be detected, where the corresponding relationship is used to process the multicast response packet fed back by the second network device, which is specifically referred to below.

S204: and receiving a multicast response message sent by the second network equipment, converting the multicast response message into a unicast response message of which the destination MAC address is the MAC address of the first network equipment based on the corresponding relation between the source MAC address of the first network equipment and the IPv6 address to be detected, and sending the unicast response message to the first network equipment.

In the embodiment of the present invention, if the second network device still occupies the IPv6 address to be detected currently, after receiving the unicast detection message sent by the OVS, the second network device needs to feed back a response message to notify the first network device that there is an IPv6 address conflict. When the first network equipment sends the multicast detection message, the source IPv6 address is set to be all zero:', so that the unicast detection message received by the second network equipment does not carry the IPv6 address of the first network equipment. And the protocol specifies that the response message of the address conflict detection is a multicast message, so the second network device needs to send the response message in a multicast form. In addition, the target IPv6 address in the multicast response message sent by the second network device is still the above-mentioned IPv6 address to be tested.

As an example, referring to fig. 4, fig. 4 is a schematic structural diagram of a multicast response message provided in the embodiment of the present invention, as shown in fig. 4, the multicast response message includes a source IPv6 address "1:: 1111", where the source IPv6 address "1:: 1111" is an IPv6 address of the second network device, and is the same as an IPv6 address to be detected, the multicast response message further includes a destination IPv6 address in a multicast form, where the destination IPv6 address in the multicast form is a multicast address for all nodes in a link, specifically FF02::1, the multicast response message may further include a source MAC address 0c: da:41:1d: 3:71 of the second network device, may further include a destination MAC address 33:33: 00:11:11 in the multicast form, and may further include a message identifier of the multicast response message, that is icmp type 136, and may further include a destination IPv6 address 1: 1111, the target IPv6 address is the same as the IPv6 address to be tested.

In the embodiment of the present invention, because the target IPv6 address in the multicast response packet sent by the second network device is the to-be-tested IPv6 address, and the source IPv6 address of the multicast response packet is the IPv6 address of the second network device, which is the same as the to-be-tested IP. Therefore, if the multicast response message is directly converted into the unicast response message, the message will be returned to the second network device. In the embodiment of the present invention, in order to enable the first network device to receive the response message, the multicast response message may be converted according to the recorded correspondence between the MAC address of the first network device and the IPv6 address to be detected. Specifically, after receiving the multicast response message with the target IPv6 address being the IPv6 address to be detected, the OVS changes the target MAC address of the multicast response message to the MAC address of the first network device to obtain the unicast response message, that is, sends the unicast response message to the first network device.

In the above example, the multicast response message may be converted according to a corresponding relationship between the MAC address of the first network device and the IPv6 address to be detected, so as to obtain the unicast response message, referring to fig. 5, fig. 5 is a schematic structural diagram of the unicast response message provided in the embodiment of the present invention, as shown in fig. 5, a destination MAC address in the converted unicast response message is changed to the MAC address 00:10:94:00:00: 00:02 of the first network device, and then the unicast response message may be sent to the first network device.

And the first network equipment receives the unicast response message, and can know that the address of the IPv6 to be detected has address conflict, thereby completing address conflict detection.

By applying the IPv6 address conflict detection method in the SDN, the OVS obtains a multicast detection message sent by the first network equipment, wherein the multicast detection message comprises the MAC address of the first network equipment and the IPv6 address to be detected; judging whether the IPv6 address list has an IPv6 address to be detected or not; if the judgment result is yes, converting the multicast detection message into a unicast detection message with the destination MAC address being the MAC address of the second network equipment, and sending the unicast detection message to the second network equipment; acquiring a multicast response message sent by second network equipment, converting the multicast response message into a unicast response message with a destination MAC address as the MAC address of the first equipment based on the corresponding relation between the source MAC address of the first network equipment and the IPv6 address to be detected, and sending the unicast response message to the first network equipment. Therefore, after receiving the multicast detection message, the OVS records the corresponding relationship between the MAC address of the first network device and the IPv6 address to be detected, so that after receiving the response message sent by the second network device, the OVS can change the destination MAC address of the response message into the MAC address of the first device according to the corresponding relationship, and further can send the response message to the first network device, so that the situation that the response message is returned to the second network device does not occur, and the IPv6 address conflict can be detected when the flooding function is turned off.

In an embodiment of the present invention, the step of recording a correspondence between the MAC address of the first network device and the IPv6 address to be tested may include:

based on a prestored learning flow table, generating a time-limited matching flow table entry for forwarding a multicast response message corresponding to the multicast detection message according to the multicast detection message, wherein the matching entry for time-limited matching the flow table entry comprises: the target IPv6 address is a multicast IPv6 address, the target IPv6 address is an IPv6 address to be tested, and the target IPv6 address is provided with a message identifier of a multicast response message; the action items for time-limited matching of the flow table entry are as follows: and converting the destination MAC address of the multicast response message into the MAC address of the first network equipment.

That is, the OVS can be controlled to forward the packet by learning the flow table.

Specifically, when detecting that the IPv6 address to be detected exists in the IPv6 address list, the OVS may generate a time-limited matching flow table entry for the multicast response packet according to a pre-stored learning flow table.

The learning flow table is issued to the OVS in advance by the SDN controller, and the learning flow table generates a new flow table entry according to a specific message, so as to guide the forwarding of a subsequent message.

In the embodiment of the invention, when the OVS receives the multicast detection message sent by the first network device, the matching item of the learning flow table is triggered, and the time-limited matching flow table entry is further generated.

Wherein learning the matching entry of the flow table may include: the source IPv6 address is all zero and has the message identification of the multicast detection message. The protocol of icmpv6 specifies that icmp type in the packet is "135" to indicate that the packet is a multicast detection packet, that is, icmp type:135 can be used as a packet identifier of the multicast detection packet.

As an example, the matching entry of the learning flow table may be: the protocol is icmpv6, the source address is ": and" icmp type is 135.

And triggering an action item of the learning flow table if the multicast detection message sent by the first network equipment can be matched with the matching item of the learning flow table, wherein the action item of the learning flow table is a generated time-limited matching flow table item.

In the embodiment of the present invention, the matching items for matching the table entries of the flow table in a time-limited manner include: the destination IPv6 address is a multicast IPv6 address, the target IPv6 address is an IPv6 address to be tested, and the target IPv6 address is provided with a message identifier of the multicast response message. The icmpv6 protocol specifies that icmp type in the message is "136" which means that the message is a multicast response message, i.e. icmp type:136 can be used as the message identifier of the multicast response message.

As an example, the matching entry that matches the table entry of the flow table in a time-limited manner may be: the protocol is icmpv6, the destination IPv6 address is a multicast IPv6 address, the icmp type is 136, and the target IPv6 address is the to-be-tested IPv6 address.

In the embodiment of the invention, the time-limited matching flow table entry can only take effect within the preset time, and after the time-limited matching flow table entry is generated, the message to be matched received within the preset time after the time-limited matching flow table entry is generated can be obtained; and comparing the target IPv6 address, the target IPv6 address and the message identifier of the message to be matched with the matching item of the time-limited matching flow table entry, and if the target IPv6 address of the message to be matched is the multicast IPv6 address, the target IPv6 address is the IPv6 address to be detected and the message identifier is the message identifier of the multicast response message, determining the message to be matched as the multicast response message.

In the embodiment of the present invention, the action items for time-limited matching of the table entry of the flow table are: and setting the MAC address of the message triggering the learning flow table as a destination MAC address. In the embodiment of the present invention, the packet triggering the learning flow table is a multicast response packet sent by the first network device, so that the action item matching the table entry of the flow table in a time-limited manner is to convert the destination MAC address of the multicast response packet into the MAC address of the first network device.

As shown in fig. 4, if the multicast response packet matches with the matching entry of the time-limited matching flow table entry, the OVS may execute the action entry of the time-limited matching flow table entry, where the action entry of the time-limited matching flow table entry is to set the MAC address of the first network device as the destination MAC address, as described above. As can be seen, the OVS may convert the multicast response packet into a unicast response packet whose destination MAC address is the MAC address of the first network device, and then send the unicast response packet to the first network device.

It can be seen that, in the embodiment of the present invention, an SDN controller may issue a learning flow table to an OVS, and when the learning flow table is matched with a multicast detection packet, a new time-limited matching flow table entry is generated, and the time-limited matching flow table entry can be matched with the multicast detection packet sent by a second network device, and the OVS may execute an action item of the time-limited matching flow table entry, and convert the multicast detection packet into a unicast response packet whose destination MAC address is an MAC address of a first network device, so that the first network device can receive the unicast response packet and know that there is a conflict in IPv6 addresses. It can be seen that IPv6 address collision can also be detected when the flooding function is turned off.

In an embodiment of the present invention, in order to reduce memory usage, an effective time of a time-limited matching flow table entry may be preset, for example, the effective time is 5 seconds, and when the time-limited matching flow table entry expires, the time-limited matching flow table entry is deleted.

In an embodiment of the present invention, if there is no to-be-detected IPv6 address in the IPv6 address list, the operation of converting the multicast detection packet into the unicast detection packet may not be performed, and the first network device may not receive a response packet for the IP detection. If the first network device does not receive the response message for the IP detection within the preset time, it may be considered that there is no address conflict in the IPv6 address to be detected.

In addition, if the second network device is offline, the second network device cannot feed back the response message, and in this case, the first network device does not receive the response message for the IP detection. Similarly, if the first network device does not receive a response message for the IP detection within a preset time, it may be considered that there is no address conflict in the to-be-detected IPv6 address.

For convenience of understanding, the following further describes, with reference to fig. 6, a method for detecting an IPv6 address conflict in an SDN network according to an embodiment of the present invention, where fig. 6 is a signaling diagram of the method for detecting an IPv6 address conflict in an SDN network according to an embodiment of the present invention, as shown in fig. 6, including the following steps:

s601: the first network equipment sends a multicast detection message to the OVS.

S602: and the OVS converts the multicast detection message into a unicast detection message.

Specifically, the OVS performs MAC address resolution according to the target IPv6 address carried in the multicast detection packet, determines the MAC address of the second network device, and converts the multicast detection packet into a unicast detection packet and sends the unicast detection packet to the second network device.

S603: and matching the learning flow table and generating a time-limited matching flow table entry.

And if the matching of the multicast detection message and the prestored matching item of the learning flow table is successful, generating a time-limited matching flow table item.

In the embodiment of the present invention, the execution sequence of S602 and S603 is not limited.

S604: and the OVS sends a unicast detection message to the second network equipment.

S605: and the second network equipment sends the multicast response message to the OVS.

S606: and matching the flow table entries in a time-limited manner, and converting the multicast response message into a unicast response message with a destination MAC address as the MAC address of the first equipment by the OVS.

If the multicast response message can be successfully matched with the matching item of the time-limited matching flow table entry, the OVS executes the action item of the time-limited matching flow table entry, that is: and converting the destination MAC address of the multicast response message into the MAC address of the first network equipment to obtain a unicast response message.

S607: and the OVS sends a unicast response message to the first network equipment.

It can be seen that, in the state of closing the flooding, the first network device may also receive a response packet for detecting the IP collision, so that the IPv6 address collision can be detected even when the flooding function is closed.

Corresponding to the embodiment of the method for detecting an IPv6 address conflict in an SDN network provided by the embodiment of the present invention, an embodiment of the present invention further provides a device for detecting an IPv6 address conflict in an SDN network, where, referring to fig. 7, the device may include the following modules:

A receiving module 701, configured to receive a multicast detection message sent by a first network device, where the multicast detection message includes an MAC address of the first network device and an IPv6 address to be detected;

the detection module 702 is configured to determine whether an IPv6 address to be detected exists in the IPv6 address list, where when detecting that any IPv6 address is online, any IPv6 address is added to the IPv6 address list;

a first conversion module 703, configured to, if the determination result is yes, convert the multicast detection packet into a unicast detection packet with a destination MAC address being an MAC address of the second network device, where the second network device is a network device on the line of the to-be-detected IPv6 address, send the unicast detection packet to the second network device, and record a corresponding relationship between the MAC address of the first network device and the to-be-detected IPv6 address;

the second conversion module 704 is configured to receive a multicast response packet sent by the second network device, convert the multicast response packet into a unicast response packet with a destination MAC address being the MAC address of the first network device based on a corresponding relationship between the MAC address of the first network device and the IPv6 address to be detected, and send the unicast response packet to the first network device.

By applying the IPv6 address conflict detection device in the SDN, the OVS obtains a multicast detection message sent by the first network equipment, wherein the multicast detection message comprises the MAC address of the first network equipment and the IPv6 address to be detected; judging whether the IPv6 address list has an IPv6 address to be detected or not; if the judgment result is yes, converting the multicast detection message into a unicast detection message with the destination MAC address being the MAC address of the second network equipment, and sending the unicast detection message to the second network equipment; acquiring a multicast response message sent by second network equipment, converting the multicast response message into a unicast response message with a destination MAC address as the MAC address of the first equipment based on the corresponding relation between the source MAC address of the first network equipment and the IPv6 address to be detected, and sending the unicast response message to the first network equipment. Therefore, after receiving the multicast detection message, the OVS records the corresponding relationship between the MAC address of the first network device and the IPv6 address to be detected, so that after receiving the response message sent by the second network device, the OVS can change the destination MAC address of the response message into the MAC address of the first device according to the corresponding relationship, and further can send the response message to the first network device, so that the situation that the response message is returned to the second network device does not occur, and the IPv6 address conflict can be detected when the flooding function is turned off.

In an embodiment of the present invention, the first conversion module 703 may be specifically configured to:

In an embodiment of the present invention, on the basis of the apparatus shown in fig. 7, a matching module may further be included, and the matching module may specifically be configured to:

receiving a learning flow table issued by a controller, wherein matching items of the learning flow table comprise: the source IPv6 address is all zero and has a message identifier of the multicast detection message; the action items of the learning flow table are: and generating a time-limited matching flow table entry.

In an embodiment of the present invention, the second converting module 704 may specifically be configured to:

acquiring a message to be matched received within preset time after generating a time-limited matching flow table entry;

In an embodiment of the present invention, on the basis of the apparatus shown in fig. 7, the apparatus may further include:

Based on the same inventive concept, according to the above embodiment of the IPv6 address collision detection method in the SDN network, an embodiment of the present invention further provides an electronic device, which can be used as a virtual machine, as shown in fig. 8, and includes a processor 801, a communication interface 802, a memory 803, and a communication bus 804, where the processor 801, the communication interface 802, and the memory 803 complete mutual communication through the communication bus 804,

a memory 803 for storing a computer program;

the processor 801 is configured to implement the following steps when executing the program stored in the memory 803:

receiving a multicast detection message sent by first network equipment, wherein the multicast detection message comprises an MAC address of the first network equipment and an IPv6 address to be detected;

Judging whether the IPv6 address list has an IPv6 address to be detected or not, wherein when any IPv6 address is detected to be on-line, any IPv6 address is added to the IPv6 address list;

if the judgment result is yes, converting the multicast detection message into a unicast detection message with the destination MAC address as the MAC address of the second network equipment, wherein the second network equipment is the network equipment on the line of the IPv6 address to be detected, sending the unicast detection message to the second network equipment, and recording the corresponding relation between the MAC address of the first network equipment and the IPv6 address to be detected;

and receiving a multicast response message sent by the second network equipment, converting the multicast response message into a unicast response message with a destination MAC address as the MAC address of the first network equipment based on the corresponding relation between the MAC address of the first network equipment and the IPv6 address to be detected, and sending the unicast response message to the first network equipment.

The communication bus mentioned in the electronic device may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown, but this does not mean that there is only one bus or one type of bus.

The communication interface is used for communication between the electronic equipment and other equipment.

The Memory may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.

The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components.

By applying the electronic device provided by the embodiment of the invention, the OVS acquires a multicast detection message sent by the first network device, wherein the multicast detection message comprises the MAC address of the first network device and the IPv6 address to be detected; judging whether the IPv6 address list has an IPv6 address to be detected or not; if the judgment result is yes, converting the multicast detection message into a unicast detection message with the destination MAC address being the MAC address of the second network equipment, and sending the unicast detection message to the second network equipment; acquiring a multicast response message sent by second network equipment, converting the multicast response message into a unicast response message with a destination MAC address as the MAC address of the first equipment based on the corresponding relation between the source MAC address of the first network equipment and the IPv6 address to be detected, and sending the unicast response message to the first network equipment. Therefore, after receiving the multicast detection message, the OVS records the corresponding relationship between the MAC address of the first network device and the IPv6 address to be detected, so that after receiving the response message sent by the second network device, the OVS can change the destination MAC address of the response message into the MAC address of the first device according to the corresponding relationship, and further can send the response message to the first network device, so that the situation that the response message is returned to the second network device does not occur, and the IPv6 address conflict can be detected when the flooding function is turned off.

In another embodiment provided by the present invention, a computer-readable storage medium is further provided, where a computer program is stored in the computer-readable storage medium, and when executed by a processor, the computer program implements the steps of the IPv6 address collision detection method in any SDN network.

In yet another embodiment of the present invention, there is further provided a computer program product containing instructions, which when run on a computer, causes the computer to perform the steps of the IPv6 address collision detection method in any SDN network in the above embodiments.

In the above embodiments, all or part of the implementation may be realized by software, hardware, firmware, or any combination thereof. When implemented in software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the invention to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.

It should be noted that, in this document, relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in the process, method, article, or apparatus that comprises the element.

All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. Particularly, for the IPv6 address collision detection apparatus, the electronic device, the computer-readable storage medium, and the computer program product in the SDN network, since the embodiments are substantially similar to the embodiments of the IPv6 address collision detection method in the SDN network, the description is relatively simple, and for relevant points, reference may be made to part of the description of the embodiments of the IPv6 address collision detection method in the SDN network.

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall fall within the protection scope of the present invention.

Claims

1. An IPv6 address conflict detection method in an SDN network is applied to an OVS, and the method comprises the following steps:

2. The method according to claim 1, wherein the recording the correspondence between the MAC address of the first network device and the IPv6 address to be tested comprises:

3. The method of claim 2, further comprising:

4. The method according to claim 2, wherein the receiving the multicast response packet sent by the second network device comprises:

5. The method of claim 2 wherein the time-bounded matching flow table entry is deleted when the expiration time of the time-bounded matching flow table representation is reached.

6. An IPv6 address conflict detection device in an SDN network, which is applied to an OVS (virtual switching system), and comprises:

the receiving module is used for receiving a message sent by first network equipment, wherein the message comprises an MAC address of the first network equipment and an IPv6 address to be detected;

A first conversion module, configured to, if the determination result is yes, convert the packet into a unicast detection packet with a destination MAC address as an MAC address of a second network device, where the second network device is a network device on line with the to-be-detected IPv6 address, send the unicast detection packet to the second network device, and record a corresponding relationship between the MAC address of the first network device and the to-be-detected IPv6 address;

7. The apparatus of claim 6, wherein the first conversion module is specifically configured to:

based on a prestored learning flow table, generating a time-limited matching flow table entry for forwarding a multicast response message corresponding to the message according to the message, wherein the matching entry for the time-limited matching flow table entry comprises: the target IPv6 address is a multicast IPv6 address, the target IPv6 address is the IPv6 address to be tested, and the target IPv6 address is provided with a message identifier of a multicast response message; the action items of the time-limited matching flow table entry are as follows: and converting the destination MAC address of the multicast response message into the MAC address of the first network equipment.

8. The apparatus of claim 7, further comprising:

9. The apparatus of claim 7, wherein the second conversion module is specifically configured to:

10. The apparatus of claim 7, further comprising: