WO2014183579A1 - 控制数据转发的方法及逻辑交换机 - Google Patents

控制数据转发的方法及逻辑交换机 Download PDF

Info

Publication number
WO2014183579A1
WO2014183579A1 PCT/CN2014/076908 CN2014076908W WO2014183579A1 WO 2014183579 A1 WO2014183579 A1 WO 2014183579A1 CN 2014076908 W CN2014076908 W CN 2014076908W WO 2014183579 A1 WO2014183579 A1 WO 2014183579A1
Authority
WO
WIPO (PCT)
Prior art keywords
interface
logical switch
bridge
data packet
flow table
Prior art date
Application number
PCT/CN2014/076908
Other languages
English (en)
French (fr)
Inventor
梁乾灯
尤建洁
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2014183579A1 publication Critical patent/WO2014183579A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/64—Hybrid switching systems
    • H04L12/6418—Hybrid transport

Definitions

  • the present invention relates to the field of data forwarding in the OpenFlow protocol, and in particular, to a method and a logical switch for controlling data forwarding. Background technique
  • the OpenFlow switch converts the packet forwarding process, which was originally controlled by the switch/router, into an OpenFlow switch and a controller, thereby separating the data forwarding and routing control.
  • the controller can control the flow table in the OpenFlow switch by pre-specified interface operations, thereby achieving the purpose of controlling data forwarding.
  • a flow table consists of a large number of flow entries, and each flow entry is a forwarding rule.
  • the packets entering the switch are obtained by querying the flow table to obtain the destination port for forwarding. According to the description of the OpenFlow pipeline and the flow table, the encapsulated and decapsulated data packets need to be queried multiple times before and after the same type of flow table to obtain the destination port for forwarding.
  • OpenFlow pipeline processing stipulates that there is only one flow table of the same type in the pipeline and can only be queried once, and the flow table in the pipeline cannot jump to the matched flow table of the same type (cannot jump to the small serial number flow table) ) Processing again.
  • the solution supported by the existing OpenFlow protocol is to decompose the tunnel as much as possible, and to refine the description flow, for example, every user per tunnel.
  • the number of flow entries is too large, and the size of the flow table is expanded, so that the maintenance and update of the flow table is complicated.
  • the main purpose of the embodiments of the present invention is to provide a method for controlling data forwarding, which aims to achieve matching of received data packets to flow entries of a flow table of the same type, and effectively avoids the result of refining the flow table.
  • the scale of the flow table is expanded, and the flow table maintains and updates complex problems.
  • the embodiment of the present invention further provides a logical switch for controlling data forwarding, which aims to achieve matching of received data packets to flow entries of the same type of flow table, and effectively avoids the expansion of the flow table scale caused by the refined flow table. , flow tables maintain and update complex issues.
  • the embodiment of the invention provides a method for controlling data forwarding, the method comprising: When receiving the data packet, the first logical switch performs corresponding operations on the data packet according to the operation instruction corresponding to the flow entry matched by the flow table on the flow table pipe, and determines the corresponding outgoing interface; the first logical switch determines the Determining whether the outbound interface is a bridge interface; when the determined outbound interface is a bridge interface, the first logical switch sends the data packet that completes the corresponding operation to the second logical switch according to the bridging attribute of the preset bridge interface.
  • the method further includes: when the determined outbound interface is not a bridge interface, the first logical switch will complete the corresponding The data packet after the operation is sent according to the transmission mode matched by the flow table on the flow table pipe.
  • the bridging attribute of the preset bridging interface includes an identity of the second logical switch and an identity of the inbound interface of the data packet on the second logical switch.
  • the step of the first logical switch transmitting the data packet that completes the corresponding operation to the second logical switch according to the bridging attribute of the preset bridging interface comprises: filling the metadata to the second when the determined egress interface is a bridging interface
  • the logical switch, the metadata includes a number of bridged tokens, and the first logical switch sends the data packet and the metadata that complete the corresponding operation to the second logical switch according to the bridging attribute of the preset bridging interface.
  • the method further includes: The second logical switch acquires the metadata filled by the first logical switch, and determines the number of bridged tokens carried in the metadata, and determines whether the determined number of bridged tokens is 0; if the determined bridge is If the number of tokens is 0, the second logical switch discards or sends the received data packet to the controller.
  • the method further comprises: if the determined number of bridged tokens is not 0, then the second logical switch is configured according to the flow table pipeline The operation instruction corresponding to the flow table entry matched by the flow table performs corresponding operations on the sent data packet and determines the corresponding outgoing interface; The second logical switch determines whether the determined outbound interface is a bridge interface; when the determined outbound interface is a bridge interface, the number of bridge tokens in the metadata is decremented by one, and then the number of data packets and bridge tokens that complete the corresponding operation are completed. The decremented metadata is sent to the third logical switch according to the bridging attribute of the preset bridging interface.
  • a logical switch for controlling data forwarding includes: a data processing module, configured to: when receiving a data packet, perform corresponding operation on the data packet according to an operation instruction corresponding to the flow entry matched by the flow table on the flow table pipe And determining the corresponding outgoing interface; the analyzing module is configured to determine whether the determined outgoing interface is a bridge interface; and the data forwarding module is configured to: when the determined outgoing interface is a bridge interface, the data of the corresponding operation is completed The packet is sent to the second logical switch according to the bridging properties of the preset bridge interface.
  • the data forwarding module is further configured to: when the determined outbound interface is not a bridge interface, send the data packet that completes the corresponding operation according to the sending manner matched by the flow table on the flow table pipe.
  • the bridging attribute of the preset bridging interface includes an identity of the second logical switch and an identity of the ingress interface of the data packet on the second logical switch.
  • the data processing module is further configured to: when the determined outbound interface is a bridge interface, padding metadata to the second logical switch, where the metadata includes a number of bridged tokens; and the data forwarding module is further configured to The data packet that completes the corresponding operation is sent to the second logical switch according to the bridging attribute of the preset bridge interface.
  • the data processing module is further configured to acquire the metadata filled by the first logical switch, and determine the number of bridge tokens carried in the metadata; the analyzing module is further configured to determine the determined Whether the number of bridged tokens is 0; the data forwarding module is further configured to discard or send the received data packet to the controller if the determined number of bridged tokens is zero.
  • the data processing module is further configured to: if the determined number of bridged tokens is not 0, perform the sent data packet according to an operation instruction corresponding to the flow entry matched by the flow table on the flow table pipeline And correspondingly determining the corresponding outbound interface; the analyzing module is further configured to determine whether the determined outbound interface is a bridge interface; and the data processing module is further configured to: when the determined outbound interface is a bridge interface The number of the bridge tokens in the metadata is decreased by one; the data forwarding module is further configured to send the metadata of the data packet and the number of bridge tokens that have been reduced by the corresponding operation according to the bridge attribute of the preset bridge interface. Go to the third logical switch.
  • FIG. 1 is a specific flowchart of a first embodiment of a method for controlling data forwarding according to the present invention
  • FIG. 2 is a schematic diagram of an embodiment of a bridge structure for a logical switch in a method for controlling data forwarding according to the present invention
  • FIG. 4 is a specific architectural diagram of a flow table of a logical switch in a mobile IP (Internet Protocol) proxy scenario of FIG. 3
  • FIG. 5 is an L2VPN (layer 2) of FIG.
  • FIG. 6 is a specific structural diagram of a preferred embodiment of a logical switch for controlling data forwarding according to the present invention
  • FIG. 4 is a specific architectural diagram of a flow table of a logical switch in a mobile IP (Internet Protocol) proxy scenario of FIG. 3
  • FIG. 5 is an L2VPN (layer 2) of FIG.
  • FIG. 8 is a specific structural diagram of a flow table of a logical switch in the L2VPN and L3VPN bridging scenarios in FIG. 6;
  • FIG. 1 is a specific flowchart of a first embodiment of a method for controlling data forwarding according to the present invention
  • FIG. 2 is a schematic diagram of an embodiment of a bridge structure for a logical switch in a method for controlling data forwarding according to the present invention
  • the first logical switch performs corresponding operations on the data packet according to the operation instruction corresponding to the flow entry matched by the flow table on the flow table pipe, and determines the corresponding outgoing interface; the first logical switch determines the determined outgoing interface. Whether it is a bridge interface; when the determined outbound interface is a bridge interface, the first logical switch sends the data packet that completes the corresponding operation to the second logical switch according to the bridge attribute of the preset bridge interface.
  • Step S11 When receiving the data packet, the first logical switch performs the data packet according to the operation instruction corresponding to the flow entry matched by the flow table on the flow table pipe. Corresponding operations and determine the corresponding outgoing interface.
  • the first logical switch maintains a plurality of flow tables for matching the received data packets, where the flow table includes a plurality of flow entries for matching the operation instructions, and the data packets are matched with the flow entries.
  • the corresponding instruction for operating the data packet is matched and the corresponding outgoing interface is determined, for example, it may be an operation instruction for modifying, forwarding, or group table processing of the data packet.
  • the forwarding instruction is to forward the data packet to the next best-class table to perform flow entry matching or to send the data packet in a preset manner.
  • the preset manner may be that the data packet is sent to the controller or sent to the destination device through the preset port.
  • the packet for the Ethernet frame, including the header and payload.
  • the received data packet is matched with the flow entry in the flow table, and the operation instruction for modifying, forwarding, or group table processing of the data packet is matched, and the corresponding outgoing interface is determined, and it is determined whether the determined outgoing interface is
  • the bridge interface when the determined outbound interface is a bridge interface, fills the metadata to the second logical switch, and the metadata passed between the logical switches includes but is not limited to: the number of bridged tokens.
  • the number of bridged tokens indicates the number of logical switches that can continue to be bridged.
  • the number of bridged tokens in the metadata received by the first logical switch and found in the metadata is invalid.
  • the value (for example, -1) sets the initial value according to the system configuration (such as the bridge setting token reference initial value of the controller setting logical switch).
  • the system configuration such as the bridge setting token reference initial value of the controller setting logical switch.
  • the first logical switch When the first logical switch is bridged to the second logical switch, Subtract one of the current number of bridge tokens and populate the metadata to Table 0 of the flow table pipe of the second logical switch.
  • the first logical switch resets the metadata of the table 0. After the reset, the number of the bridged tokens in the metadata is an invalid value, and a new one is to be added.
  • the metadata is configured according to the business.
  • the first logical switch sends the data packet and the metadata for completing the corresponding operation to the second logical switch according to the bridging attribute of the preset bridging interface; or when the determined outgoing interface is not the bridging interface, the received data packet is according to the flow table pipeline.
  • the sending mode of the matching flow table is sent out.
  • the sending mode matched by the flow table on the flow table pipe may be a physical port configured for the logical switch according to the service requirement, and the data packet is forwarded to the corresponding physical port through the physical port.
  • On the device it is also possible to forward the data packet to the corresponding device or controller through any other preset port.
  • Step S13 When the determined outbound interface is a bridge interface, the first logical switch sends the data packet that completes the corresponding operation to the second logical switch according to the bridging attribute of the preset bridging interface.
  • the attribute of the bridge interface includes an identity of the second level logical switch and an identity of the ingress interface of the second logical switch of the data packet, where the bridge attribute of the preset bridge interface may be a controller or a configuration point is created.
  • the bridge interface is delivered according to service requirements, or it can be dynamically created or updated according to service requirements when updating the bridge interface.
  • the second logical switch and the first logical switch belong to the same physical forwarding device, and the second logical switch and the first logical switch may be the same logical switch.
  • the second logical switch is the same logical switch as the first logical switch, and the logical switch preset bridge interface is used to loop back the data packet at the bridge interface, and enter the logical switch and the flow table again.
  • the flow entry in the match is matched, and the corresponding instruction for the operation of the data packet is matched, that is, the logical switch performs its own loopback at the outbound interface, and the preset bridged data path identifier of the outbound interface is entered into the first logic.
  • the data path of the switch, and the identifier of the data path interface is the identifier of the first logical switch entry.
  • the data packet that completes the corresponding operation is sent to the first logical switch to match the flow entry in the flow table by entering the identifier of the data path of the first logical switch and the entry of the first logical switch, so as to obtain corresponding data packets. Operate and/or obtain the destination port to be forwarded.
  • the data packet that completes the corresponding operation is sent to the second logical switch according to the bridging attribute of the preset bridging interface, so that the received data packet matches the flow entry of the flow table of the same type, and the corresponding flow entry matching is completed.
  • the operation corresponding to the operation instruction effectively avoids the problem that the flow table is enlarged due to the refinement flow table, and the flow table maintenance and update are complicated. Referring to FIG.
  • the second logical switch is another logical switch that is different from the first logical switch in the same physical forwarding device.
  • the function of the preset bridge interface between the logical switches is to bridge the data packets after the corresponding operations are completed by the logical switch according to the preset bridge interface.
  • the attribute is forwarded to the second logical switch.
  • the second logical switch acquires the metadata filled by the first logical switch, and determines the number of bridge tokens carried in the metadata, and determines whether the determined number of bridged tokens is 0; if the determined bridge token is If the number is 0, the second logical switch discards or sends the received data packet to the controller.
  • the second logical switch performs corresponding operations on the sent data packets according to the operation instruction corresponding to the flow entry matched by the flow table on the flow table pipeline, and determines corresponding corresponding
  • the second logical switch determines whether the determined outbound interface is a bridge interface; when the determined outbound interface is a bridge interface, the number of bridged tokens in the metadata is reduced by one, and then the data packet and the bridging order of the corresponding operation are completed.
  • the metadata after the number of cards is decremented is sent to the third logical switch according to the bridging attribute of the preset bridging interface.
  • the third logical switch may be the same logical switch as the first logical switch or the second logical switch.
  • the metadata By filling the logical switch of the data packet with metadata, the metadata includes the number of bridged tokens, and when the number of bridged tokens of the data packet is 0, the data packet no longer enters the logical switch for matching processing, thereby avoiding the data packet being logically An abnormal loop between switches that blocks the data path.
  • FIG. 3 is a specific flowchart of a second embodiment of a method for controlling data forwarding according to the present invention
  • FIG. 4 is a flow of a logical switch in a mobile IP (Internet Protocol) proxy scenario of FIG.
  • FIG. 5 is a specific architecture diagram of the flow table of the logical switch in the L2VPN (Layer 2 Virtual Private Network) and L3VPN (Layer 3 Virtual Private Network) bridging scenarios in FIG.
  • L2VPN Layer 2 Virtual Private Network
  • L3VPN Layer 3 Virtual Private Network
  • Step S14 When the determined outbound interface is not a bridge interface, the first logical switch matches the data packet that completes the corresponding operation according to the flow table on the flow table pipeline. Send by sending method.
  • the sending mode of the flow table matching the flow table may be a physical port configured for the logical switch according to the service requirement, and the data packet is forwarded to the corresponding device through the physical port, or may be any other preset.
  • the port will forward the packet to the appropriate device or controller.
  • the destination port is determined by matching with the flow entry in the flow table, and the data is forwarded to the device corresponding to the determined destination port.
  • the corresponding flow entry of the inbound interface is obtained according to the table 0 in the logical switch 10, and the corresponding operation instruction is extracted, and the table 1 in the query 10 is jumped according to the data packet.
  • the IP address in the match is matched, and the outbound interface of the flow table is the bridge interface corresponding to the GRE (Generic Routing Encapsulation) tunnel, and the GRE tunnel encapsulation is performed on the data packet according to the GRE tunnel information, and the bridge token in the metadata filled in the data packet is updated. number.
  • the encapsulated GRE header and the data packet after the IP header carried by the outer layer are matched and processed from the GRE tunnel interface into the logical switch 20.
  • the corresponding flow entry of the inbound interface is obtained according to the table 0 in the logical switch 20, and the corresponding operation instruction is extracted, and the CAR speed limit is obtained according to the measurement table entry attached to the flow entry, and the jump to the logical switch 20 is performed.
  • Table 1 according to the IP address of the IP header (for the IP address of the foreign proxy device), the packet is forwarded to the table 2 in the logical switch 20, and the padding out interface and the next hop device IP continue to match, and the corresponding next hop is determined.
  • Layer 2 information of the device the required VLAN tag is pushed in, the MAC header is filled, and the packet is forwarded to the table 3 in the logical switch 20, and the control service based on the outbound interface and/or the VLAN is used, for example, the CAR speed limit, and the The outbound interface forwards the matched traffic data to the proxy device.
  • the GRE encapsulation of the data packet is obtained by querying the same type of routing table, and the destination proxy device IP is obtained, so that the network backhaul traffic is forwarded to the foreign agent.
  • a scenario in which an L2VPN (Virtual Private Network) and an L3VPN (Virtual Private Network) are bridged for example, a packet that traverses the L3VPN from the L2VPN bridge enters the logical switch 30 for matching.
  • the processing firstly matches the inbound interface (physical interface) in the table 0 of the logical switch 30, obtains the corresponding flow entry of the inbound interface, extracts the corresponding operation instruction, and jumps to the table 1 in the logical switch 30.
  • the tag is searched, and after the flow table entry is matched, it is determined that the interface is logical interface A, the current logical switch 30 matches the processing end, the outer label is popped up, and the number of bridge tokens in the metadata filled in the data packet is updated.
  • the data packet and the logical interface A are bridged to the logical interface B, re-entered the logical switch 40 for matching processing, and matched according to the inbound interface (logical interface B) in the table 0 in the logical switch 40, after matching the flow table entry, according to the entry
  • the jump rule points to Table 1.
  • the interface is an L3 interface.
  • the VPN ID is set in the data packet according to the obtained flow table entry information.
  • the route obtains the actual next hop information, including the outbound interface, the next hop device IP, the outgoing label, etc., pushes in the required label, fills out the outbound interface and the next hop IP, and then jumps to Table 3, according to the populated outgoing interface.
  • the IP address of the next hop device determine the Layer 2 information of the device corresponding to the next hop, push in the required VLAN tag, fill in the MAC header, and then continue to jump to Table 4 to perform control services based on the outbound interface or/and VLAN. For example, the CAR speed limit, and forward the packet from the outbound interface.
  • the bridging between the L2VPN and the L3VPN with different interface configuration requirements is implemented, so that the matching of the same data packet to the same type of routing table is matched.
  • the port forwards the packet to the destination device.
  • FIG. 6 is a specific structural diagram of a preferred embodiment of a logical switch for controlling data forwarding according to the present invention
  • FIG. 7 is a flow table of a logical switch in the mobile IP proxy scenario of FIG.
  • the specific architecture diagram FIG. 8 is a specific architecture diagram of the flow table of the logical switch in the L2VPN and L3VPN bridging scenarios in FIG.
  • the logical switch includes: a data processing module 100, an analysis module 200, and a data forwarding module 300.
  • the data processing module 100 is configured to perform corresponding operations on the data packet and determine the corresponding outgoing interface according to the operation corresponding to the flow entry matched by the flow table on the flow table pipe when the data packet is received.
  • the data processing module 100 maintains a plurality of flow tables for matching the received data packets, where the flow table includes a plurality of flow entries for matching the operation instructions, and the data packets are matched with the flow entries.
  • the corresponding instruction for operating the data packet is matched and the corresponding outgoing interface is determined, for example, it may be an operation instruction for modifying, forwarding, or group table processing of the data packet.
  • the forwarding instruction is that the data forwarding module 300 forwards the data packet to the next-class table to perform flow entry matching or sends the data packet in a preset manner.
  • the preset manner may be that the data forwarding module 300 sends the data packet to the controller or to the destination device through the preset port.
  • the packet for the Ethernet frame, including the header and payload.
  • the analysis module 200 determines whether the determined outgoing interface is a bridge interface.
  • the analysis module 200 is configured to determine whether the determined outbound interface is a bridge interface.
  • the data processing module 100 matches the received data packet with the flow entry in the flow table, matches an operation instruction such as modifying, forwarding, or group table processing of the data packet, and determines a corresponding outgoing interface, and the analysis module 200 Determining whether the determined outbound interface is a bridge interface or not, and when the determined outbound interface is a bridge interface, the data processing module 100 fills the metadata to the second logical switch, and the metadata transmitted between the logical switches includes But not limited to: the number of bridged tokens, the number of bridged tokens indicates the number of logical switches that can continue to be bridged, and the number of bridged tokens in the metadata received by the first logical switch and found in the metadata is invalid (for example - 1) setting an initial value according to a system configuration (for example, a bridge setting token reference initial value of the controller setting logical switch).
  • the data processing module 100 For the processing of the current data packet, when the first logical switch is bridged to the second logical switch, the data processing module 100 Subtract one of the current number of bridge tokens and populate the metadata to Table 0 of the second logical switch flow table pipe.
  • the data processing module 100 resets the metadata of the table 0. After the reset, the number of bridged tokens in the metadata is an invalid value, and a new one is waiting.
  • the metadata is configured according to the business.
  • the data forwarding module 300 will complete the corresponding operation of the data packet and the metadata according to the preset bridge interface.
  • the bridge attribute is sent to the second logical switch; or when the determined outbound interface is not a bridge interface, the data forwarding module 300 sends the received data packet according to a sending manner matched by the flow table on the flow table pipe, and the flow table pipeline
  • the sending mode matched by the flow table may be a physical port configured for the logical switch according to the service requirement, and the data packet is forwarded to the corresponding device through the physical port, and the data packet may be sent through any other preset port. Forward to the appropriate device.
  • the data forwarding module 300 is configured to: when the determined outbound interface is a bridge interface, send the data packet that completes the corresponding operation to the next logical switch according to the bridging attribute of the preset bridging interface.
  • the attribute of the bridge interface includes an identity of the second level logical switch and an identity of the ingress interface of the second logical switch of the data packet, where the bridge attribute of the preset bridge interface may be that the controller is creating the logic
  • the interface is delivered according to service requirements. It can also be dynamically created or updated according to business requirements when updating the logical interface.
  • the second logical switch and the first logical switch belong to the same physical forwarding device, and the second logical switch and the first logical switch may be the same logical switch.
  • the second logical switch is the same logical switch as the first logical switch, and the function of the preset bridge interface is to loop back the data packet at the bridge interface, and enter the logical switch and the flow table again.
  • the flow entry matches, and the corresponding instruction for the operation of the data packet is matched, that is, the logical switch performs its own loopback at the outbound interface, and the preset bridged data path identifier of the outgoing interface is the data that enters the logical switch.
  • Path the identifier of the data path interface is the identifier of the logical switch entry.
  • the data packet that enters the logical path of the logical switch and the identifier data forwarding module 300 of the logical switch is sent to the logical switch to perform matching of the flow entry in the flow table, so as to obtain the pair through the data processing module 100.
  • the data packet performs corresponding operations and/or obtains a destination port to be forwarded.
  • the data forwarding module 300 sends the data packet that completes the corresponding operation to the second logical switch according to the bridging attribute of the preset bridging interface, so that the received data packet matches the flow entry of the flow table of the same type, and the corresponding The operation corresponding to the operation instruction matched by the flow entry can effectively avoid the problem that the size of the flow table is enlarged due to the refined flow table, and the maintenance and update of the flow table is complicated.
  • the second logical switch is another logical switch that is different from the first logical switch and is in the same physical forwarding device.
  • the function of the preset bridge interface between the logical switches is to forward the data packets that have undergone the corresponding operations through the logical switch to another logical switch according to the bridging attributes of the preset bridge interface.
  • the data packets can enter other logical switches as needed to flow in the flow table.
  • the matching of the entries enables the data processing module 100 to obtain the forwarded destination port after the matching of the flow entry, and forwards the data packet that completes the corresponding operation to the destination port corresponding to the obtained forwarding through the data forwarding module 300. device.
  • the data processing module 100 acquires the metadata filled by the first logical switch, and determines the number of bridge tokens carried in the metadata, and the analysis module 200 determines whether the determined number of bridged tokens is 0. If the determined number of bridged tokens is 0, the data forwarding module 300 discards or sends the received data packet to the controller; if the determined number of bridged tokens is not 0, the data processing module 100 follows the flow table pipeline.
  • the operation instruction corresponding to the flow table entry matched by the flow table performs corresponding operations on the sent data packet and determines the corresponding outgoing interface; the analysis module 200 determines whether the determined outgoing interface is a bridge interface; when the determined outgoing interface is When the interface is bridged, the number of bridge tokens in the metadata is decremented by one, and the data forwarding module 300 sends the metadata of the corresponding operation packet and the number of bridge tokens minus one according to the bridge attribute of the preset bridge interface to the first
  • the third logical switch may be the same logical switch as the first logical switch or the second logical switch.
  • the metadata By filling the logical switch of the data packet with metadata, the metadata includes the number of bridged tokens, and when the number of bridged tokens of the data packet is 0, the data packet no longer enters the logical switch for matching processing, thereby avoiding the data packet being logically An abnormal loop between switches that blocks the data path.
  • the data processing module 100 acquires the corresponding flow entry of the inbound interface according to the table 0 in the logical switch 10, and extracts the corresponding operation instruction, and jumps to the table 1 in the query 10.
  • the outbound interface of the flow table is the bridge interface corresponding to the GRE tunnel, and the GRE tunnel encapsulation is performed on the data packet according to the GRE tunnel information, and the number of bridge tokens in the metadata filled in the data packet is updated.
  • the encapsulated GRE header and the packet behind the IP header carried by the outer layer are matched by the logical switch 20 from the GRE tunnel interface.
  • the data processing module 100 obtains the corresponding flow entry of the inbound interface according to the table 0 in the logical switch 20, extracts the corresponding operation instruction, and performs the CAR speed limit according to the measurement table entry attached to the flow entry, and jumps to the logic.
  • Table 1 in the switch 10 matches the destination IP address of the IP header (the IP address of the foreign proxy device), jumps to the table 2 in the logical switch 20, and fills the outbound interface with the next hop device IP to continue matching, determining the corresponding The Layer 2 information of the next hop device, the required VLAN tag is pushed in, the MAC header is filled, and the packet is forwarded to Table 3, and the control service is based on the outbound interface and/or the VLAN, for example, the CAR speed limit, the data forwarding module 300 The matched traffic data is forwarded to the proxy device through the outbound interface.
  • the data processing module 100 performs GRE encapsulation on the data packet by querying the same type of routing table, acquires the destination proxy device IP, and implements network backhaul traffic forwarding to the foreign agent.
  • the scenario of bridging the L2VPN (Virtual Private Network of the standard 2) and the Virtual Private Network of the L3VPN (Virtual Private Network) is taken as an example, and the data packet traversing the L3VPN from the L2VPN bridge enters the logical switch 30.
  • Perform matching processing and the data processing module 100 performs the matching according to
  • the interface (physical interface) is matched in the table 0 of the logical switch 30, and the corresponding flow entry of the inbound interface is obtained, and the corresponding operation instruction is extracted, and the table 1 of 30 is searched for label search, and the flow table is matched.
  • the interface is logical interface A
  • the current matching process ends, the outer label is popped up, and the number of bridge tokens in the metadata filled in the data packet is updated.
  • the data packet and the logical interface A are bridged to the logical interface B, and are transmitted to the logical switch 40 for matching processing.
  • the data processing module 100 matches in the table 0 according to the inbound interface (logical interface B), and after matching the flow table entry, according to the entry
  • the jump rule points to Table 1.
  • the interface is an L3 interface. Set the VPN ID in the data packet according to the obtained flow table entry information. Jump to Table 1 to continue matching according to the destination IP and VPN ID in the data packet.
  • the route obtains the actual next hop information, including the outbound interface, the next hop device IP, the outgoing label, etc., pushes in the required label, fills out the outbound interface and the next hop IP, and then jumps to Table 3, according to the metadata padding.
  • the outbound interface and the next hop device IP continue to match, determine the Layer 2 information of the next hop device, push in the required VLAN tag, fill the MAC header, and then continue to jump to Table 4, after hitting based on the outbound interface or /
  • the control service of the VLAN such as the CAR rate limit
  • the data forwarding module 300 forwards the data packet out of the outbound interface.
  • the bridging between the L2VPN and the L3VPN with different interface configuration requirements is implemented, so that the matching of the same data packet to the same type of routing table is matched.
  • the port forwards the packet to the destination device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种控制数据转发的方法及逻辑交换机，本发明通过将完成相应流表操作的数据包按照预设桥接接口的桥接属性发送到第二逻辑交换机，实现了接收的数据包对同一类型的流表的流表项的匹配，并完成相应的流表项匹配出的操作指令对应的操作，有效避免了因细化流表带来的流表规模扩大，流表维护和更新复杂的问题。

Description

控制数据转发的方法及逻辑交换机 技术领域 本发明涉及到 OpenFlow协议下的数据转发领域， 特别涉及到一种控制数据转发 的方法及逻辑交换机。 背景技术
OpenFlow 交换机将原来完全由交换机 /路由器控制的数据包转发过程转化为由 OpenFlow交换机 （OpenFlow Switch) 和控制器 （Controller) 来共同完成， 从而实现 了数据转发和路由控制的分离。 控制器可以通过事先规定好的接口操作来控制 OpenFlow交换机中的流表，从而达到控制数据转发的目的。流表由很多个流表项组成， 每个流表项就是一个转发规则。 进入交换机的数据包通过查询流表来获得转发的目的 端口。 根据 OpenFlow管道及流表的描述， 针对经过封装和解封装的数据包， 需要前后 多次查询相同类型的流表， 才能获取到转发的目的端口。 然而 OpenFlow的管道处理 规定， 管道中相同类型的流表只有一个且只能查询一次， 且管道中的流表不能跳转到 已匹配过的同类型的流表 （不能跳转到小序号流表） 上再次处理。 针对该问题， 现有 OpenFlow协议支持的解决方法是尽可能分解隧道， 细化描述流，例如每用户每隧道展 开流表项。 但这样的方式导致流表项过多， 流表规模扩大， 使得流表的维护和更新复 杂化。 发明内容 本发明实施例的主要目的为提供一种控制数据转发的方法， 旨在实现接收的数据 包对同一类型的流表的流表项的匹配，同时有效避免因细化流表带来的流表规模扩大， 流表维护和更新复杂的问题。 本发明实施例还提出一种控制数据转发的逻辑交换机， 旨在实现接收的数据包对 同一类型的流表的流表项的匹配， 同时有效避免因细化流表带来的流表规模扩大， 流 表维护和更新复杂的问题。
本发明实施例提出一种控制数据转发的方法， 该方法包括: 当接收到数据包时， 第一逻辑交换机按照流表管道上的流表匹配出的流表项对应 的操作指令对数据包进行相应的操作并确定对应的出接口； 第一逻辑交换机判断所述确定的出接口是否是桥接接口； 当所述确定的出接口是桥接接口时， 第一逻辑交换机将完成相应操作的数据包按 照预设桥接接口的桥接属性发送到第二逻辑交换机。 优选地， 在所述第一逻辑交换机判断所述确定的出接口是否是桥接接口的步骤之 后， 该方法还包括： 当所述确定的出接口不是桥接接口时， 则第一逻辑交换机将完成相应操作之后的 数据包按照流表管道上的流表匹配出的发送方式发送出去。 优选地， 所述预设桥接接口的桥接属性包括第二逻辑交换机的身份标识和该数据 包在所述的第二逻辑交换机上的入接口的身份标识。 优选地， 所述第一逻辑交换机将完成相应操作的数据包按照预设桥接接口的桥接 属性发送到第二逻辑交换机的步骤包括： 当确定的出接口是桥接接口时， 填充元数据给第二逻辑交换机， 所述元数据包括 桥接令牌数， 第一逻辑交换机将完成相应操作的数据包及元数据按照预设桥接接口的 桥接属性发送到第二逻辑交换机。 优选地， 在所述当确定的出接口是桥接接口时， 第一逻辑交换机将完成相应操作 的数据包按照预设桥接接口的桥接属性发送到第二逻辑交换机的步骤之后， 该方法还 包括： 所述第二逻辑交换机获取所述的第一逻辑交换机填充的元数据， 并确定元数据中 携带的桥接令牌数， 判断所述确定的桥接令牌数是否为 0; 若所述确定的桥接令牌数是 0， 则所述第二逻辑交换机将接收到的数据包丢弃或 发送至控制器。 优选地，在所述判断所述确定的桥接令牌数是否为 0的步骤之后，该方法还包括: 若所述确定的桥接令牌数不为 0， 则第二逻辑交换机按照流表管道上的流表匹配 出的流表项对应的操作指令对发送来的数据包进行相应的操作并确定对应的出接口； 第二逻辑交换机判断确定的出接口是否是桥接接口； 当确定的出接口是桥接接口时， 将元数据中的桥接令牌数减一， 然后将完成相应 的操作的数据包及桥接令牌数减一后的元数据按照预设桥接接口的桥接属性发送到第 三逻辑交换机。
一种控制数据转发的逻辑交换机， 该逻辑交换机包括： 数据处理模块， 设置为当接收到数据包时， 按照流表管道上的流表匹配出的流表 项对应的操作指令对数据包进行相应的操作并确定对应的出接口； 分析模块， 设置为判断所述确定的出接口是否是桥接接口； 数据转发模块， 设置为当所述确定的出接口是桥接接口时， 将完成相应操作的数 据包按照预设桥接接口的桥接属性发送到第二逻辑交换机。 优选地， 所述数据转发模块， 还设置为当所述确定的出接口不是桥接接口时， 将 完成相应操作的数据包按照流表管道上的流表匹配出的发送方式发送出去。 优选地， 所述预设桥接接口的桥接属性包括第二逻辑交换机的身份标识和该数据 包在所述第二逻辑交换机上的入接口的身份标识。 优选地， 所述数据处理模块， 还设置为当确定的出接口是桥接接口时， 填充元数 据给第二逻辑交换机， 所述元数据包括桥接令牌数； 所述数据转发模块， 还设置为将完成相应操作的数据包按照预设的桥接接口的桥 接属性发送到第二逻辑交换机。 优选地，所述数据处理模块，还设置为获取所述的第一逻辑交换机填充的元数据， 并确定元数据中携带的桥接令牌数； 所述分析模块， 还设置为判断所述确定的桥接令牌数是否为 0; 所述数据转发模块， 还设置为若所述确定的桥接令牌数是 0， 则将接收到的数据 包丢弃或发送至控制器。 优选地， 所述数据处理模块， 还设置为若所述确定的桥接令牌数不为 0， 按照流 表管道上的流表匹配出的流表项对应的操作指令对发送来的数据包进行相应的操作并 确定对应的出接口； 所述分析模块， 还设置为判断所述确定的出接口是否是桥接接口； 所述数据处理模块， 还设置为当所述确定的出接口是桥接接口时， 将元数据中的 桥接令牌数减一； 所述数据转发模块， 还设置为将完成相应操作的数据包及桥接令牌数减一后的元 数据按照预设的桥接接口的桥接属性发送到第三逻辑交换机。
相对现有技术， 本发明实施例通过将完成相应操作的数据包按照预设的桥接接口 的桥接属性发送到第二逻辑交换机， 实现了接收的数据包对同一类型的流表的流表项 的匹配， 并完成相应的流表项匹配出的操作指令对应的操作， 有效避免了因细化流表 带来的流表规模扩大， 流表维护和更新复杂的问题。 附图说明 图 1为本发明控制数据转发的方法的第一实施例的具体流程图； 图 2为本发明控制数据转发的方法中逻辑交换机的桥接结构一实施例的示意图； 图 3为本发明控制数据转发的方法的第二实施例的具体流程图； 图 4为图 3中移动 IP (互联网协议）代理场景中的逻辑交换机的流表的具体架构 图； 图 5为图 3中 L2VPN (2层虚拟私人网络）和 L3VPN (3层虚拟私人网络）桥接 场景中的逻辑交换机的流表的具体架构图； 图 6为本发明控制数据转发的逻辑交换机的较佳实施例的具体架构图； 图 7为图 6中移动 IP代理场景中的逻辑交换机的流表的具体架构图； 图 8为图 6中 L2VPN和 L3VPN桥接场景中的逻辑交换机的流表的具体架构图。 本发明目的的实现、 功能特点及优点将结合实施例， 参照附图做进一步说明。 具体实施方式 应当理解，此处所描述的具体实施例仅仅用以解释本发明， 并不用于限定本发明。 如图 1和图 2所示， 图 1为本发明控制数据转发的方法的第一实施例的具体流程 图； 图 2为本发明控制数据转发的方法中逻辑交换机的桥接结构一实施例的示意图。 需要强调的是： 图 1所示流程图仅为一个较佳实施例， 本领域的技术人员当知， 任何围绕本发明思想构建的实施例都不应脱离于如下技术方案涵盖的范围： 当接收到数据包时， 第一逻辑交换机按照流表管道上的流表匹配出的流表项对应 的操作指令对数据包进行相应的操作并确定对应的出接口； 第一逻辑交换机判断该确 定的出接口是否是桥接接口； 当该确定的出接口是桥接接口时， 第一逻辑交换机将完 成相应操作的数据包按照预设的桥接接口的桥接属性发送到第二逻辑交换机。 以下是本实施例逐步实现控制数据转发的具体步骤： 步骤 Sll， 当接收到数据包时， 第一逻辑交换机按照流表管道上的流表匹配出的 流表项对应的操作指令对数据包进行相应的操作并确定对应的出接口。 优选地， 该第一逻辑交换机维护有多个用于匹配接收的数据包的流表， 该流表包 括多个用于匹配出操作指令的流表项， 通过数据包与流表项的匹配， 匹配出相应的对 数据包进行操作的指令并确定对应的出接口， 例如， 可以是对数据包进行修改、 转发 或组表处理等操作指令。 该转发指令为将数据包转发至下一流表进行流表项匹配或将 数据包按照预设的方式发送出去。 该预设的方式可以是通过预设的端口将数据包发送 给控制器或发送给目的设备。 该数据包： 为以太网帧， 包括报头和有效载荷。 当按照 流表项对应的操作指令对数据包完成与该操作指令对应的操作之后， 第一逻辑交换机 判断确定的出接口是否是桥接接口。 步骤 S12， 第一逻辑交换机判断该确定的出接口是否是桥接接口。 优选地，接收的数据包通过与流表中的流表项的匹配， 匹配出对数据包进行修改、 转发或组表处理等操作指令并确定对应的出接口， 判断该确定的出接口是否是桥接接 口， 当该确定的出接口是桥接接口时， 填充元数据给第二逻辑交换机， 该逻辑交换机 间传递的元数据包括但不限于： 桥接令牌数。 该桥接令牌数表示当前能继续桥接的逻 辑交换机数量， 由第一逻辑交换机在收到数据包并发现元数据中的桥接令牌数为无效 值 （例如 -1 ) 时根据系统配置 （例如控制器设置逻辑交换机的桥接令牌参考初值） 设 置初始值， 对于当前数据包的处理而言， 第一逻辑交换机桥接到第二逻辑交换机时， 将当前桥接令牌数减一后填充该元数据给第二逻辑交换机的流表管道的表 0。 当前的 数据包在该的第一逻辑交换机中处理完毕时，第一逻辑交换机重置其表 0的该元数据， 重置后， 该元数据中桥接令牌数为无效值， 待有新的业务需求时， 再根据业务配置元 数据。 第一逻辑交换机将完成相应操作的数据包及元数据按照预设桥接接口的桥接属 性发送到第二逻辑交换机； 或当该确定的出接口不是桥接接口时， 将接收的数据包按 照流表管道上的流表匹配出的发送方式发送出去， 该按照流表管道上的流表匹配出的 发送方式可以是根据业务需要给逻辑交换机配置的物理端口， 通过该物理端口将数据 包转发至相应的设备上， 也还可以是通过其他任意预设的端口将数据包转发至相应的 设备或控制器。 交换机定义的逻辑端口， 可以指定链路汇聚组， 隧道或环回接口。 步骤 S13， 当该确定的出接口是桥接接口时， 第一逻辑交换机将完成相应操作的 数据包按照预设桥接接口的桥接属性发送到第二逻辑交换机。 优选地， 该桥接接口的属性包括第二级逻辑交换机的身份标识和该数据包的第二 逻辑交换机的入接口的身份标识， 该预设桥接接口的桥接属性可以是控制器或配置点 在创建该桥接接口时根据业务需求下发， 也可以是在更新该桥接接口时根据业务需求 动态创建或更新。 该第二逻辑交换机和第一逻辑交换机归属于同一物理转发设备， 该 第二逻辑交换机和第一逻辑交换机可以为同一逻辑交换机。 若桥接的是同一逻辑交换 机， 该第二逻辑交换机即与第一逻辑交换机为同一逻辑交换机， 逻辑交换机预设桥接 接口的作用是在桥接接口处环回数据包， 再次进入该逻辑交换机与流表中的流表项进 行匹配， 匹配出相应的对该数据包进行的操作的指令， 即实现逻辑交换机在出接口处 的自身环回， 该出接口预设的桥接数据路径标识为进入第一逻辑交换机的数据路径， 数据路径接口的标识为第一逻辑交换机入口的标识。 即通过进入第一逻辑交换机的数 据路径和第一逻辑交换机的入口的标识将完成相应操作的数据包发送至第一逻辑交换 机进行流表中流表项的匹配， 以获得对该数据包进行相应的操作及 /或获取到转发的目 的端口。 通过将完成相应操作的数据包按照预设桥接接口的桥接属性发送到第二逻辑 交换机， 实现了接收的数据包对同一类型的流表的流表项的匹配， 并完成相应的流表 项匹配出的操作指令对应的操作， 有效避免了因细化流表带来的流表规模扩大， 流表 维护和更新复杂的问题。 参照图 2， 若桥接的不是同一逻辑交换机， 该第二逻辑交换机为与第一逻辑交换 机不同的在同一物理转发设备内的另外一个逻辑交换机。 逻辑交换机间预设的桥接接 口的作用是将经过该逻辑交换机完成相应操作之后的数据包根据预设桥接接口的桥接 属性转发至第二逻辑交换机。 通过在不同的逻辑交换机之间设置桥接接口， 并根据预 设桥接接口的桥接属性将完成相应操作之后的数据包发送至第二逻辑交换机， 数据包 可以根据需要进入其他逻辑交换机进行流表中的流表项的匹配， 使得数据包可以经过 流表项的匹配后获取到转发的目的端口， 并将完成相应操作之后的数据包按照获取到 的转发的目的端口转发至与转发的目的端口对应的目的设备。
优选地， 该第二逻辑交换机获取该第一逻辑交换机填充的元数据， 并确定元数据 中携带的桥接令牌数，判断该确定的桥接令牌数是否为 0;若该确定的桥接令牌数是 0， 则该第二逻辑交换机将接收到的数据包丢弃或发送至控制器。 若该确定的桥接令牌数 不为 0， 则第二逻辑交换机按照流表管道上的流表匹配出的流表项对应的操作指令对 发送来的数据包进行相应的操作并确定对应的出接口； 第二逻辑交换机判断确定的出 接口是否是桥接接口； 当确定的出接口是桥接接口时，将元数据中的桥接令牌数减一， 然后将完成相应的操作的数据包及桥接令牌数减一后的元数据按照预设桥接接口的桥 接属性发送到第三逻辑交换机， 同样的， 该第三逻辑交换机可以是与第一逻辑交换机 或者第二逻辑交换机为同一逻辑交换机。 通过给数据包的逻辑交换机填充元数据， 该 元数据包括桥接令牌数， 且在数据包的桥接令牌数为 0时， 数据包不再进入逻辑交换 机进行匹配处理， 避免了数据包在逻辑交换机之间的异常循环， 阻塞数据路径。
如图 3、 图 4、 图 5所示， 图 3为本发明控制数据转发方法的第二实施例的具体流 程图， 图 4为图 3中移动 IP (互联网协议） 代理场景中的逻辑交换机的流表的具体架 构图， 图 5为图 3中 L2VPN (2层虚拟私人网络） 和 L3VPN (3层虚拟私人网络） 桥 接场景中的逻辑交换机的流表的具体架构图。 基于上述第一实施例， 在步骤 S12之后还包括： 步骤 S14， 当确定的出接口不是桥接接口时， 则第一逻辑交换机将完成相应操作 的数据包按照流表管道上的流表匹配出的发送方式发送出去。 该流表管道上的流表匹配出的发送方式可以是根据业务需要给逻辑交换机配置的 物理端口， 通过该物理端口将数据包转发至相应的设备上， 也还可以是通过其他任意 预设的端口将将数据包转发至相应的设备或控制器。 通过将完成相应操作的数据包发 送至相应的设备或者控制器， 通过与流表中的流表项匹配确定目的端口并将数据转发 到与确定目的端口对应的设备。 参照图 4， 以移动 IP代理为例， 根据逻辑交换机 10中的表 0获取到入接口的对 应的流表项， 提取到对应的操作指令， 跳转到查询 10 中的表 1， 根据数据包中的 IP 进行匹配， 确定流表的出接口是 GRE (通用路由封装） 隧道对应的桥接接口， 根据 GRE隧道信息对数据包做 GRE隧道封装， 并更新数据包填充的元数据中的桥接令牌 数。封装了的 GRE头和外层承载的 IP头后的数据包从 GRE隧道接口进人逻辑交换机 20进行匹配处理。 根据逻辑交换机 20中的表 0获取到入接口的对应的流表项， 提取 到对应的操作指令，根据该流表项挂接的测量表条目做 CAR限速，跳转到逻辑交换机 20中的表 1， 根据 IP头的目的 IP (为外地代理设备的 IP地址） 进行匹配， 跳转入逻 辑交换机 20中的表 2， 填充出接口和下一跳设备 IP继续匹配， 确定对应的下一跳设 备的二层信息， 压入需要的 VLAN标签， 填充 MAC头， 跳转至逻辑交换机 20中的表 3， 做基于出接口及 /或 VLAN的控制业务， 例如可以是 CAR限速， 并通过该出接口 将匹配后的流量数据转发至代理设备上。 通过设置的桥接接口， 通过查询同一类型的 路由表对数据包进行 GRE封装、 获取目的代理设备 IP， 实现网络回程流量转发到外 地代理上。
参照图 5， 以 L2VPN (二层虚拟私人网络， Virtual Private Network)和 L3VPN (三 层虚拟私人网络， Virtual Private Network)桥接的场景为例，从 L2VPN桥接穿越 L3VPN 的数据包进入逻辑交换机 30进行匹配处理， 首先根据入接口 （物理接口）在逻辑交换 机 30中的表 0中匹配， 获取到入接口的对应的流表项， 提取到对应的操作指令， 跳转 到逻辑交换机 30中的表 1做标签查找， 匹配到流表条目后确定出接口是逻辑接口 A， 当前逻辑交换机 30匹配处理结束， 弹出外层标签， 并更新数据包填充的元数据中的桥 接令牌数。 数据包与逻辑接口 A桥接到逻辑接口 B， 重新进入逻辑交换机 40进行匹配处理， 根据入接口 （逻辑接口 B)在逻辑交换机 40中的表 0匹配， 匹配到流表条目后， 根据 该条目中的跳转规则指向表 1继续查路由可知该接口为 L3接口， 依据获取的流表条 目信息在数据包中设置 VPN ID, 跳转到表 1继续根据数据包中的目的 IP和 VPN ID 继续匹配路由获得实际的下一跳信息， 包括出接口、 下一跳设备 IP、 出标签等， 压入 需要的标签， 填充出接口和下一跳 IP， 然后跳转到表 3， 根据填充的出接口和下一跳 设备 IP继续匹配， 确定对应下一跳设备的二层信息， 压入需要的 VLAN标签， 填充 MAC头， 然后继续跳转到表 4， 做基于出接口或 /和 VLAN的控制业务， 例如 CAR限 速， 并从该出接口转发出包。 在本实施例中， 通过将逻辑接口 A和逻辑接口 B进行桥接， 实现了接口配置要求 不同的 L2VPN和 L3VPN之间的桥接， 进而使得同一数据包对同一类型的路由表的匹 配， 匹配出目的端口将数据包转发至目的设备。
如图 6、 图 7、 图 8所示， 图 6为本发明控制数据转发的逻辑交换机的较佳实施例 的具体架构图， 图 7为图 6中移动 IP代理场景中的逻辑交换机的流表的具体架构图； 图 8为图 6中 L2VPN和 L3VPN桥接场景中的逻辑交换机的流表的具体架构图。该逻 辑交换机包括： 数据处理模块 100， 分析模块 200及数据转发模块 300。 数据处理模块 100， 设置为当接收到数据包时， 按照流表管道上的流表匹配出的 流表项对应的操作对数据包进行相应的操作并确定对应的出接口。 优选地， 该数据处理模块 100维护有多个用于匹配接收的数据包的流表， 该流表 包括多个用于匹配出操作指令的流表项， 通过数据包与流表项的匹配， 匹配出相应的 对数据包进行操作的指令并确定对应的出接口， 例如， 可以是对数据包进行修改、 转 发或组表处理等操作指令。 该转发指令为数据转发模块 300将数据包转发至下一流表 进行流表项匹配或将数据包按照预设的方式发送出去。 该预设的方式可以是数据转发 模块 300通过预设的端口将数据包发送至控制器或发送给目的设备。 该数据包： 为以 太网帧， 包括报头和有效载荷。 在按照流表项对应的操作指令对数据包完成与该操作 指令对应的操作时， 分析模块 200判断确定的出接口是否是桥接接口。 分析模块 200， 设置为判断该确定的出接口是否是桥接接口。 优选地， 数据处理模块 100将接收的数据包通过与流表中的流表项的匹配， 匹配 出对数据包进行修改、转发或组表处理等操作指令并确定对应的出接口，分析模块 200 判断该确定的出接口是否是桥接接口是否是桥接接口， 当该确定的出接口是桥接接口 时， 数据处理模块 100填充元数据给第二逻辑交换机， 所述的逻辑交换机间传递的元 数据包括但不限于： 桥接令牌数， 该桥接令牌数表示当前能继续桥接的逻辑交换机数 量， 由第一逻辑交换机在收到数据包并发现元数据中的桥接令牌数为无效值（例如 -1 ) 时根据系统配置 （例如控制器设置逻辑交换机的桥接令牌参考初值） 设置初始值， 对 于当前数据包的处理而言， 第一逻辑交换机桥接到第二逻辑交换机时， 数据处理模块 100将当前桥接令牌数减一后填充该元数据给第二逻辑交换机流表管道的表 0。当前的 数据包在该的第一逻辑交换机中处理完毕时， 数据处理模块 100重置其表 0的该元数 据， 重置后， 该元数据中桥接令牌数为无效值， 待有新的业务需求时， 再根据业务配 置元数据。 数据转发模块 300将完成相应操作的数据包及元数据按照预设桥接接口的 桥接属性发送到第二逻辑交换机； 或当该确定的出接口不是桥接接口时， 数据转发模 块 300将接收的数据包按照流表管道上的流表匹配出的发送方式发送出去， 该流表管 道上的流表匹配出的发送方式可以是根据业务需要给逻辑交换机配置的物理端口， 通 过该物理端口将数据包转发至相应的设备， 也还可以是通过其他任意预设的端口将将 数据包转发至相应的设备。 交换机定义的逻辑端口， 可以指定链路汇聚组， 隧道或环 回接口。 数据转发模块 300， 设置为当该确定的出接口是桥接接口时， 将完成相应操作的 数据包按照预设桥接接口的桥接属性发送到下一个逻辑交换机。 优选地， 该桥接接口的属性包括第二级逻辑交换机的身份标识和该数据包的第二 逻辑交换机的入接口的身份标识， 该预设的桥接接口的桥接属性可以是控制器在创建 该逻辑接口时根据业务需求下发， 也还可以是在更新该逻辑接口时根据业务需求动态 创建或更新。 该第二逻辑交换机和第一逻辑交换机归属于同一物理转发设备， 该第二 逻辑交换机和第一逻辑交换机可以为同一逻辑交换机。 若桥接的是同一逻辑交换机， 该第二逻辑交换机即与第一逻辑交换机为同一逻辑交换机， 预设桥接接口的作用是在 桥接接口处环回数据包， 再次进入该逻辑交换机与流表中的流表项进行匹配， 匹配出 相应的对该数据包进行的操作的指令， 即实现逻辑交换机在出接口处的自身环回， 该 出接口预设的桥接数据路径标识为进入该逻辑交换机的数据路径， 数据路径接口的标 识为该逻辑交换机入口的标识。 即通过进入该逻辑交换机的数据路径和该逻辑交换机 的入口的标识数据转发模块 300将完成相应操作的数据包发送至该逻辑交换机进行流 表中流表项的匹配， 以通过数据处理模块 100获得对该数据包进行相应的操作及 /或获 取到转发的目的端口。 通过数据转发模块 300将完成相应操作的数据包按照预设的桥 接接口的桥接属性发送到第二逻辑交换机， 实现了接收的数据包对同一类型的流表的 流表项的匹配， 并完成相应的流表项匹配出的操作指令对应的操作， 有效避免了因细 化流表带来的流表规模扩大， 流表维护和更新复杂的问题。 在本发明其他实施例中， 若桥接的不是同一逻辑交换机， 该第二逻辑交换机为与 第一逻辑交换机不同的在同一物理转发设备内的另外一个逻辑交换机。 逻辑交换机间 预设的桥接接口的作用是将经过该逻辑交换机完成相应操作的数据包根据预设桥接接 口的桥接属性转发至另一个逻辑交换机。通过在不同的逻辑交换机之间设置桥接接口， 并根据预设桥接接口的桥接属性将完成相应操作的数据包发送至另一个逻辑交换机， 数据包可以根据需要进入其他逻辑交换机进行流表中的流表项的匹配， 使得数据处理 模块 100可以经过流表项的匹配后获取到转发的目的端口， 并通过数据转发模块 300 将完成相应操作的数据包转发至与获取的转发的目的端口对应的目的设备。 优选地， 数据处理模块 100获取该第一逻辑交换机填充的元数据， 并确定元数据 中携带的桥接令牌数， 分析模块 200判断该确定的桥接令牌数是否为 0。 若该确定的 桥接令牌数是 0， 数据转发模块 300将接收到的数据包丢弃或发送至控制器； 若该确 定的桥接令牌数不为 0， 数据处理模块 100按照流表管道上的流表匹配出的流表项对 应的操作指令对发送来的数据包进行相应的操作并确定对应的出接口； 分析模块 200 判断该确定的出接口是否是桥接接口； 当该确定的出接口是桥接接口时， 将元数据中 的桥接令牌数减一， 数据转发模块 300将完成相应的操作的数据包及桥接令牌数减一 后的元数据按照预设桥接接口的桥接属性发送到第三逻辑交换机， 同样的， 该第三逻 辑交换机可以是与第一逻辑交换机或者第二逻辑交换机为同一逻辑交换机。 通过给数 据包的逻辑交换机填充元数据， 该元数据包括桥接令牌数， 且在数据包的桥接令牌数 为 0时， 数据包不再进入逻辑交换机进行匹配处理， 避免了数据包在逻辑交换机之间 的异常循环， 阻塞数据路径。
参照图 7， 以移动 IP代理为例， 数据处理模块 100根据逻辑交换机 10中的表 0 获取入接口的对应的流表项， 并提取到对应的操作指令， 跳转到查询 10中的表 1， 根 据数据包中的 IP进行匹配，确定流表的出接口是 GRE隧道对应的桥接接口，根据 GRE 隧道信息对数据包做 GRE隧道封装， 并更新数据包填充的元数据中的桥接令牌数。封 装了的 GRE头和外层承载的 IP头后的数据包从 GRE隧道接口进行逻辑交换机 20进 行匹配处理。数据处理模块 100根据逻辑交换机 20中的表 0获取到入接口的对应的流 表项， 提取到对应的操作指令， 根据该流表项挂接的测量表条目做 CAR限速， 跳转到 逻辑交换机 10中的表 1， 根据 IP头的目的 IP (为外地代理设备的 IP地址）进行匹配， 跳转入逻辑交换机 20中的表 2， 填充出接口和下一跳设备 IP继续匹配， 确定对应的 下一跳设备的二层信息， 压入需要的 VLAN标签， 填充 MAC头， 跳转至表 3， 做基 于出接口及 /或 VLAN的控制业务， 例如可以是 CAR限速， 数据转发模块 300通过该 出接口将匹配后的流量数据转发至代理设备上。 通过设置的桥接接口， 数据处理模块 100通过查询同一类型的路由表对数据包进行 GRE封装、获取目的代理设备 IP， 实现 网络回程流量转发到外地代理上。
参照图 8， 以 L2VPN (标准 2的虚拟私人网络， Virtual Private Network)和 L3VPN (标准 3的虚拟私人网络， Virtual Private Network)桥接的场景为例， 从 L2VPN桥接 穿越 L3VPN的数据包进入逻辑交换机 30进行匹配处理， 数据处理模块 100根据入接 口 （物理接口）在逻辑交换机 30中的表 0中匹配， 获取到入接口的对应的流表项， 提 取到对应的操作指令，跳转到 30中的表 1做标签查找， 匹配到流表条目后确定出接口 是逻辑接口 A， 当前匹配处理结束， 弹出外层标签， 并更新数据包填充的元数据中的 桥接令牌数。 数据包与逻辑接口 A桥接到逻辑接口 B， 传输至逻辑交换机 40进行匹配处理， 数据处理模块 100根据入接口 （逻辑接口 B) 在表 0中匹配， 匹配到流表条目后， 根 据该条目中的跳转规则指向表 1继续查路由可知该接口为 L3接口， 依据获取的流表 条目信息在数据包中设置 VPN ID,跳转到表 1继续根据数据包中的目的 IP和 VPN ID 继续匹配路由获得实际的下一跳信息， 包括出接口、 下一跳设备 IP、 出标签等， 压入 需要的标签， 填充出接口和下一跳 IP， 然后跳转到表 3， 根据元数据中填充的出接口 和下一跳设备 IP继续匹配， 确定对应下一跳设备的二层信息， 压入需要的 VLAN标 签， 填充 MAC头， 然后继续跳转到表 4， 命中后做基于出接口或 /和 VLAN的控制业 务， 例如 CAR限速， 数据转发模块 300将数据包从该出接口转发出包。 在本实施例中， 通过将逻辑接口 A和逻辑接口 B进行桥接， 实现了接口配置要求 不同的 L2VPN和 L3VPN之间的桥接， 进而使得同一数据包对同一类型的路由表的匹 配， 匹配出目的端口将数据包转发至目的设备。
以上所述仅为本发明的优选实施例， 并非因此限制本发明的专利范围， 凡是利用 本发明说明书及附图内容所作的等效结构或等效流程变换， 或直接或间接运用在其他 相关的技术领域， 均同理包括在本发明的专利保护范围内。 工业实用性 本发明实施例提供的技术方案可以应用于 OpenFlow协议下的数据转发领域， 实 现了接收的数据包对同一类型的流表的流表项的匹配， 并完成相应的流表项匹配出的 操作指令对应的操作， 有效避免了因细化流表带来的流表规模扩大， 流表维护和更新 复杂的问题。

Claims

权 利 要 求 书 、 一种控制数据转发的方法， 该方法包括：
当接收到数据包时， 第一逻辑交换机按照流表管道上的流表匹配出的流表 项对应的操作指令对数据包进行相应的操作并确定对应的出接口；
第一逻辑交换机判断所述确定的出接口是否是桥接接口；
当所述确定的出接口是桥接接口时， 第一逻辑交换机将完成相应操作的数 据包按照预设桥接接口的桥接属性发送到第二逻辑交换机。 、 根据权利要求 1所述的控制数据转发的方法， 其中， 在所述第一逻辑交换机判 断所述确定的出接口是否是桥接接口的步骤之后， 该方法还包括：
当所述确定的出接口不是桥接接口时， 则第一逻辑交换机将完成相应操作 之后的数据包按照流表管道上的流表匹配出的发送方式发送出去。 、 根据权利要求 1所述的控制数据转发的方法， 其中，
所述预设桥接接口的桥接属性包括第二逻辑交换机的身份标识和该数据包 在所述第二逻辑交换机上的入接口的身份标识。 、 根据权利要求 1所述的控制数据转发的方法， 其中， 所述第一逻辑交换机将完 成相应操作的数据包按照预设桥接接口的桥接属性发送到第二逻辑交换机的步 骤包括：
当确定的出接口是桥接接口时， 填充元数据给第二逻辑交换机， 所述元数 据包括桥接令牌数；
第一逻辑交换机将完成相应操作的数据包及元数据按照预设桥接接口的桥 接属性发送到第二逻辑交换机。 、 根据权利要求 4所述的控制数据转发的方法， 其中， 在所述第一逻辑交换机将 完成相应操作的数据包及元数据按照预设桥接接口的桥接属性发送到第二逻辑 交换机的步骤之后， 该方法还包括：
所述第二逻辑交换机获取所述第一逻辑交换机填充的元数据， 并确定元数 据中携带的桥接令牌数， 判断所述确定的桥接令牌数是否为 0; 若所述确定的桥接令牌数是 0， 则所述第二逻辑交换机将接收到的数据包 丢弃或发送至控制器。 、 根据权利要求 5所述的控制数据转发的方法， 其中， 在所述判断所述确定的桥 接令牌数是否为 0的步骤之后， 该方法还包括：
若所述确定的桥接令牌数不为 0， 则第二逻辑交换机按照流表管道上的流 表匹配出的流表项对应的操作指令对发送来的数据包进行相应的操作并确定对 应的出接口；
第二逻辑交换机判断确定的出接口是否是桥接接口；
当确定的出接口是桥接接口时， 将元数据中的桥接令牌数减一， 然后将完 成相应的操作的数据包及桥接令牌数减一后的元数据按照预设桥接接口的桥接 属性发送到第三逻辑交换机。 、 一种控制数据转发的逻辑交换机， 该逻辑交换机包括：
数据处理模块， 设置为当接收到数据包时， 按照流表管道上的流表匹配出 的流表项对应的操作指令对数据包进行相应的操作并确定对应的出接口； 分析模块， 设置为判断所述确定的出接口是否是桥接接口；
数据转发模块， 设置为当所述确定的出接口是桥接接口时， 将完成相应操 作的数据包按照预设桥接接口的桥接属性发送到第二逻辑交换机。 、 根据权利要求 7所述的控制数据转发的逻辑交换机， 其中， 所述数据转发模块， 还设置为当所述确定的出接口不是桥接接口时， 将完 成相应操作的数据包按照流表管道上的流表匹配出的发送方式发送出去。 、 根据权利要求 7所述的控制数据转发的逻辑交换机， 其中， 所述预设桥接接口的桥接属性包括第二逻辑交换机的身份标识和该数据包 在所述第二逻辑交换机上的入接口的身份标识。 0、 根据权利要求 7所述的控制数据转发的逻辑交换机， 其中， 所述数据处理模块， 还设置为当确定的出接口是桥接接口时， 填充元数据 给第二逻辑交换机， 所述元数据包括桥接令牌数；
所述数据转发模块， 还设置为将完成相应操作的数据包按照预设桥接接口 的桥接属性发送到第二逻辑交换机。 、 根据权利要求 10所述的控制数据转发的逻辑交换机， 其中， 所述数据处理模块， 还设置为获取所述第一逻辑交换机填充的元数据， 并 确定元数据中携带的桥接令牌数；
所述分析模块， 还设置为判断所述确定的桥接令牌数是否为 0; 所述数据转发模块， 还设置为若所述确定的桥接令牌数是 0， 将接收到的 数据包丢弃或发送至控制器。 、 根据权利要求 11所述的控制数据转发的逻辑交换机， 其中，
所述数据处理模块， 还设置为若所述确定的桥接令牌数不为 0， 按照流表 管道上的流表匹配出的流表项对应的操作指令对发送来的数据包进行相应的操 作并确定对应的出接口；
所述分析模块， 还设置为判断确定的出接口是否是桥接接口； 所述数据处理模块， 还设置为当确定的出接口是桥接接口时， 将元数据中 的桥接令牌数减一；
所述数据转发模块， 还设置为将完成相应操作的数据包及桥接令牌数减一 后的元数据按照预设的桥接接口的桥接属性发送到第三逻辑交换机。
PCT/CN2014/076908 2013-07-05 2014-05-06 控制数据转发的方法及逻辑交换机 WO2014183579A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310282435.5A CN104283814B (zh) 2013-07-05 2013-07-05 控制数据转发的方法及逻辑交换机
CN201310282435.5 2013-07-05

Publications (1)

Publication Number Publication Date
WO2014183579A1 true WO2014183579A1 (zh) 2014-11-20

Family

ID=51897701

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/076908 WO2014183579A1 (zh) 2013-07-05 2014-05-06 控制数据转发的方法及逻辑交换机

Country Status (2)

Country Link
CN (1) CN104283814B (zh)
WO (1) WO2014183579A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105227896B (zh) * 2015-08-27 2020-10-16 北京华夏创新科技有限公司 一种在透明模式下视频会议优化技术方法和系统
WO2017092009A1 (zh) * 2015-12-03 2017-06-08 华为技术有限公司 一种交换机进行配置处理的方法和装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102349268A (zh) * 2009-03-09 2012-02-08 日本电气株式会社 OpenFlow通信系统和OpenFlow通信方法
CN102595358A (zh) * 2011-11-25 2012-07-18 中兴通讯股份有限公司 一种防止短消息循环的处理方法和装置
WO2012120990A1 (ja) * 2011-03-09 2012-09-13 日本電気株式会社 コンピュータシステム、サーバ、オープンフローコントローラ及び通信方法
CN103081418A (zh) * 2010-09-09 2013-05-01 日本电气株式会社 计算机系统和计算机系统中的通信方法
CN103095583A (zh) * 2012-11-09 2013-05-08 盛科网络（苏州）有限公司 通过芯片环回实现Openflow两级流表的方法及系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102843299A (zh) * 2012-09-12 2012-12-26 盛科网络（苏州）有限公司 基于TCAM实现Openflow多级流表的方法及系统
CN102957603A (zh) * 2012-11-09 2013-03-06 盛科网络（苏州）有限公司 基于多级流表的Openflow报文转发方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102349268A (zh) * 2009-03-09 2012-02-08 日本电气株式会社 OpenFlow通信系统和OpenFlow通信方法
CN103081418A (zh) * 2010-09-09 2013-05-01 日本电气株式会社 计算机系统和计算机系统中的通信方法
WO2012120990A1 (ja) * 2011-03-09 2012-09-13 日本電気株式会社 コンピュータシステム、サーバ、オープンフローコントローラ及び通信方法
CN102595358A (zh) * 2011-11-25 2012-07-18 中兴通讯股份有限公司 一种防止短消息循环的处理方法和装置
CN103095583A (zh) * 2012-11-09 2013-05-08 盛科网络（苏州）有限公司 通过芯片环回实现Openflow两级流表的方法及系统

Also Published As

Publication number Publication date
CN104283814A (zh) 2015-01-14
CN104283814B (zh) 2018-03-30

Similar Documents

Publication Publication Date Title
EP3958521A1 (en) Method and apparatus for providing service for service flow
Kempf et al. Moving the mobile evolved packet core to the cloud
CN103391296B (zh) 一种控制器、转发器及通道建立方法和系统
US8879569B2 (en) Virtual network connection method, network system, and network device
US9531663B2 (en) Method and device for storing and sending MAC address entry, and system
US9900238B2 (en) Overlay network-based original packet flow mapping apparatus and method therefor
CN104901891A (zh) 一种组播报文的转发方法及装置
US10003503B2 (en) Tunnel type selection method and apparatus
EP3113425B1 (en) Encapsulation method for service routing packet, service forwarding entity and control plane
EP3095216B1 (en) Single hop overlay architecture for line rate performance in campus networks
WO2011160517A1 (zh) 一种多协议标签交换业务隧道切换的方法及系统
WO2014198064A1 (zh) 一种处理报文的方法和转发器
EP3032782B1 (en) Packet transmission method and apparatus
KR101140453B1 (ko) Ｉｐ 인터워킹 ｖｌｌ을 통한 회로 에뮬레이션 방법 및 시스템
CN102420772B (zh) 隧道报文收发方法和装置
CN108075991B (zh) 报文转发方法及装置
CN104158743B (zh) 分布式路由器的报文跨卡转发方法及装置
US20160094367A1 (en) Migrating multicast flow
WO2013107056A1 (zh) 报文转发的方法及装置
WO2014183579A1 (zh) 控制数据转发的方法及逻辑交换机
WO2012062106A1 (zh) 线性保护组隧道复用方法和隧道尾节点
JP5840211B2 (ja) オフセットを用いてインバンド制御チャネルを提供する疑似ワイヤ
KR20160062688A (ko) 오버레이 네트워크 기반에서의 오리지널 패킷 플로우 매핑 장치 및 그 방법
CN110505137B (zh) 功能扩展式有线网络装置
WO2019071585A1 (zh) 路径切换过程中快速恢复业务的方法、装置和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14797803

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14797803

Country of ref document: EP

Kind code of ref document: A1