WO2015180113A1 - 一种网络地址转换方法及装置 - Google Patents

一种网络地址转换方法及装置 Download PDF

Info

Publication number
WO2015180113A1
WO2015180113A1 PCT/CN2014/078869 CN2014078869W WO2015180113A1 WO 2015180113 A1 WO2015180113 A1 WO 2015180113A1 CN 2014078869 W CN2014078869 W CN 2014078869W WO 2015180113 A1 WO2015180113 A1 WO 2015180113A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
data packet
flow entry
plane device
private
Prior art date
Application number
PCT/CN2014/078869
Other languages
English (en)
French (fr)
Inventor
胡渭琦
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201480008216.0A priority Critical patent/CN105556906A/zh
Priority to PCT/CN2014/078869 priority patent/WO2015180113A1/zh
Publication of WO2015180113A1 publication Critical patent/WO2015180113A1/zh

Links

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a network address translation method and apparatus. Background technique
  • Network Address Translation (English: Network Address T ns irritation, abbreviated: NAT) is an access to wide area network (English: Wide Area Network, abbreviation: WAN) technology, is a way to convert private addresses into legitimate Internet protocols (English: Internet Protocol, abbreviation : IP) Address translation technology, which is widely used in various types of networks.
  • Software Defined Networking (English: Software Defined Networking, abbreviation: SDN) is a new network architecture with control and forwarding decoupling, that is, the separation of control plane equipment and forwarding plane equipment. The control plane device performs logical decision and processing in the NAT process, and the forwarding plane device is only responsible for matching and forwarding, and does not participate in any logical processing.
  • control plane device is separated from the forwarding plane device in the SDN. Therefore, the process of performing the NA in the SDN is complicated.
  • the control plane device needs to send corresponding processing logic to the forwarding plane device for each specific private address, indicating the forwarding plane.
  • the device performs NAT operations. In each NAT operation, multiple signaling interactions need to be performed between the control plane device and the forwarding plane device. Therefore, the existing network address translation method increases the signaling burden, and multiple interactions also increase the network address translation. time.
  • the present invention provides a network address translation method and apparatus, which can reduce the number of interactions between a control plane device and a forwarding plane device, and improve network address translation efficiency.
  • the technical solution adopted by the present invention is:
  • the present invention provides a network address translation method, including:
  • the forwarding plane device receives the data packet, and the forwarding plane device is configured with a network address translation flow entry sent by the control plane device, where the network address translation flow entry includes a matching condition and a service logic, where the service logic is used for the network. Address translation; wherein, the forwarding plane device is used for packet forwarding, and the control plane device is configured to control the forwarding plane device to perform packet forwarding;
  • the forwarding plane device executes the service logic to complete network address translation of the data packet.
  • the network address translation flow entry is a first-class entry
  • the first flow entry includes a first matching condition and a first service logic
  • the determining that the data packet meets a matching condition in the network address translation flow entry includes:
  • the text satisfies a first matching condition in the first flow entry;
  • the forwarding plane device performs the service logic to complete the network address translation of the data packet, including:
  • the forwarding plane device executes the first service logic in the first flow entry to convert the private address stored in the source address field of the data packet into a public address.
  • the network address translation flow entry is a second flow entry, where the second flow entry includes a second matching condition and a second service logic;
  • Determining that the data packet meets a matching condition in the network address translation flow entry including:
  • the data packet is a packet from the external network, and/or the public address stored in the destination address field of the data packet belongs to a public address range that can be used for NAT, determining that the data packet is satisfied a second matching condition in the second flow entry;
  • the forwarding plane device performs the service logic to complete the network address translation of the data packet, including:
  • the forwarding plane device executes the second service logic in the second flow entry to convert the public address stored in the destination address field of the data packet into a private address.
  • the forwarding plane device performs the first service logic to enable a private address of a source address field of the data packet to be stored. Convert to a public address, including:
  • the forwarding plane device allocates an unallocated address to the private address and can be used for
  • the forwarding plane device replaces the content of the source address field of the data packet with the public address, and obtains a first data packet to be sent, and sends the first data packet to be sent, where the to-be-sent
  • the source address field of the first data message stores the public address.
  • the forwarding plane device performs the first service logic to enable a private address of a source address field of the data packet to be stored.
  • the conversion to a public address includes: when the public address corresponding to the private address stored in the source address field in the data packet exists in the correspondence between the stored private address and the public address, the forwarding plane device uses the public address Replacing the content of the source address field of the data packet, obtaining the first data packet to be sent, and sending the first data packet to be sent, where the source address field of the first data packet to be sent is stored The public address.
  • the forwarding plane device performs the second service logic to enable the public address of the destination address field of the data packet to be stored Convert to a private address, including:
  • the forwarding plane device When the private address corresponding to the public address stored in the destination address field of the data packet exists in the corresponding relationship between the stored private address and the public address, the forwarding plane device replaces the data packet by using the private address.
  • the content of the destination address field is obtained, and the second data packet to be sent is sent, and the second data packet to be sent is sent out, and the destination address field of the second data packet to be sent stores the private address.
  • a sixth possible implementation after the forwarding plane device allocates an unassigned public address that can be used for the NAT to the private address, :
  • the forwarding plane device generates a third flow entry and/or a fourth flow entry according to the private address and the allocated public address, where the third flow entry includes a third matching condition and is used to send the datagram
  • the private address of the source address field stored in the text is converted into the service logic of the public address assigned by the private address, and the third matching condition is used to indicate that the source address field of the data packet matching the third flow entry is private.
  • the address is equal to the private address, or the data packet matching the third flow entry is a packet from the internal network, and the private address of the source address field of the data packet is equal to the private address.
  • the fourth flow entry includes a fourth matching condition and a service logic for converting a public address stored in the destination address field of the data packet to a private address corresponding to the public address, where the fourth matching condition is used.
  • the public address that is stored in the destination address field of the data packet that matches the fourth flow entry is equal to the public address that is allocated, or the data packet that matches the fourth flow entry is Packets from an external network, and the public address of the destination address field of the data packet is equal to the assigned public IP address, the third stream matching entry priority higher than the first flow table entry, the The matching priority of the fourth flow entry is higher than the second flow entry.
  • the present invention provides a network address translation method, including:
  • the control plane device generates a network address translation flow entry
  • the forwarding plane device is configured to forward the packet, and the control plane device is configured to control the forwarding plane device to perform packet forwarding, where the network address translation flow entry includes a matching condition and a service logic, and is used to indicate the location.
  • the service logic is executed to complete network address translation of the data packet.
  • the matching condition is used to indicate that the data packet matching the network address translation flow entry is a packet from an intranet, and/or the matching
  • the private address stored in the source address field of the data packet of the network address translation flow entry belongs to a private address range that can access the external network through the NA;
  • the service logic is configured to indicate an operation of converting the private address stored in the source address field of the data packet matching the network address translation flow entry to a public address.
  • the matching condition is used to indicate that the data packet matching the network address translation flow entry is a packet from an external network, and/or the matching
  • the public address stored in the destination address field of the data packet of the network address translation flow entry belongs to a public address range that can be used for NAT;
  • the service logic is configured to indicate an operation of converting the public address stored in the destination address field of the data packet matching the network address translation flow entry into a private address.
  • the present invention further provides a network address translation device, where the device is configured with a network address translation flow entry sent by a control plane device, where the network address translation flow entry includes a matching condition and a service logic.
  • the service logic is used for network address translation, where the control plane device is configured to control the device to perform packet forwarding, and the device includes:
  • a first receiving module configured to receive a data packet
  • a first conversion module configured to: when it is determined that the data packet received by the first receiving module meets a matching condition in the network address translation flow entry, execute the service logic to complete a network address of the data packet Conversion.
  • the network address translation flow entry configured by the device is a first flow entry, where the first flow entry includes a first matching condition and a first service logic;
  • the first conversion module includes a first determining submodule and a first converting submodule, where the first determining submodule is configured to: when the data packet received by the first receiving module is a packet from an intranet, and Or, if the private address stored in the source address field of the data packet belongs to a private address range that can access the external network through the NAT, determining that the data message meets the first matching condition in the first flow entry;
  • the first conversion submodule is configured to: when the first determining submodule determines that the data packet meets a first matching condition in the first flow entry, perform the first one of the first flow entry.
  • the business logic converts the private address stored in the source address field of the data message to a public address.
  • the network address translation flow entry configured by the device is a second flow entry, where the second flow entry includes a second matching condition and a second service logic.
  • the first conversion module includes a second determining submodule and a second converting submodule,
  • the second determining submodule is configured to: when the data packet received by the first receiving module is a packet from an external network, and/or the public address stored in the destination address field of the data packet is applicable And determining, in the public address range of the NAT, that the data packet meets a second matching condition in the second flow entry;
  • the second conversion submodule is configured to: in the second determining submodule, determine that the data packet meets a second matching condition in the second flow entry, and execute the second in the second flow entry
  • the second service logic converts the public address stored in the destination address field of the data message into a private address.
  • the first conversion submodule includes:
  • An allocation submodule configured to allocate, when the stored private address and the public address have a public address corresponding to the private address, an unassigned public address that can be used for NAT
  • the first replacement sub-module is configured to replace the content of the source address field of the data packet with the public address, and obtain the first data packet to be sent. And sending the first data packet to be sent, where the source address field of the first data packet to be sent stores the public address.
  • the first conversion submodule includes: a second replacement submodule, configured to store the private address and the public address When there is a public address corresponding to the private address stored in the source address field in the data, the content of the source address field of the data packet is replaced by the public address, And obtaining a first data packet to be sent, and sending the first data packet to be sent, where the source address field of the first data packet to be sent stores the public address.
  • the second conversion submodule includes: a third replacement submodule, configured to store the private address and the public address When the private address corresponding to the public address stored in the destination address field of the data packet exists in the corresponding relationship, the content of the destination address field of the data packet is replaced by the private address, and the second data packet to be sent is obtained. And sending the second data packet to be sent, where the destination address field of the second data packet to be sent stores the private address.
  • the apparatus further includes:
  • a generating module configured to generate a third flow entry and/or a fourth flow entry according to the private address and the allocated public address in the allocation submodule, where the third flow entry includes the third matching condition and a service logic for converting a private address stored in a source address field of the data packet to a public address allocated by the private address, where the third matching condition is used to indicate data matching the third flow entry.
  • the private address of the source address field of the text is equal to the private address, or the data packet matching the third flow entry is a packet from the intranet, and the source address field of the data packet
  • the private address is equal to the private address
  • the fourth flow entry includes the fourth matching condition and a public address for storing the destination address field of the data packet into a private address corresponding to the public address.
  • the fourth matching condition is used to indicate that the data packet of the fourth flow entry that matches the fourth flow entry is a packet from the external network, and the destination of the data packet
  • the public address of the address field is equal to the public address of the allocation, the matching priority of the third flow entry is higher than the first flow entry, and the matching priority of the fourth flow entry is higher than the second Flow entry.
  • the present invention further provides a network address translation device, where the device includes: a first generation module, configured to generate a network address translation flow entry;
  • a first sending module configured to send the network address translation flow entry to the forwarding plane device, where the forwarding plane device is used for packet forwarding, where the network address translation flow entry includes a matching condition and a service logic,
  • the service logic is executed to complete network address translation of the data packet.
  • control plane device sends a network address translation flow entry to the forwarding plane device in advance, so that The forwarding plane device does not need to perform multiple signaling exchanges with the control plane device during NAT conversion, which improves network address translation efficiency.
  • FIG. 1 is a flowchart of a network address translation method according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a network address translation method according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of a method for performing a first service logic to complete a network address translation by a forwarding plane device according to an embodiment of the present invention
  • FIG. 4 is a flowchart of a network address translation method according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for performing a second service logic to complete a network address translation by a forwarding plane device according to an embodiment of the present invention
  • FIG. 6 is a flowchart of a network address translation method after a forwarding surface device generates a third flow entry according to an embodiment of the present invention
  • FIG. 7 is a flowchart of a method for converting a network address after a fourth flow entry is generated by a forwarding plane device according to an embodiment of the present invention
  • FIG. 8 is a flowchart of a network address translation method according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a network address translation apparatus according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of a network address translation apparatus according to an embodiment of the present invention.
  • FIG. 11 is a schematic diagram showing the hardware configuration of an intelligent terminal according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a network address translation method according to an embodiment of the present disclosure, where the method may include:
  • the forwarding plane device receives a data packet, where the forwarding plane device is configured with a network address translation flow entry sent by the control plane device, where the network address translation flow entry includes a matching condition and a service logic, where the service logic is used. Network address translation;
  • the forwarding plane device is configured to forward the packet, and the control plane device is configured to control the forwarding plane device to perform packet forwarding.
  • the control plane device determines the network address translation flow entry, and delivers the network address flow entry to the forwarding plane device.
  • the network address translation flow entry may be a general flow entry for processing the data packet sent by the internal network to the external network, or a general flow entry for processing the data packet sent by the external network to the internal network.
  • the network address translation flow entry includes two parts: a matching condition and a service logic, where the service logic is used to complete network address translation of the data packet.
  • the forwarding plane device When the forwarding plane device receives any data packet, it first determines whether the data packet satisfies the matching condition in the network address translation flow entry. If the forwarding plane device determines that the received data packet satisfies the matching condition in the network address translation flow entry, the forwarding plane device executes the service logic in the network address translation flow entry to complete the datagram. Text network address translation.
  • the forwarding plane device is configured with a network address translation flow entry that is sent by the control plane device and is used to process the data packet sent by the intranet to the external network, where the network address translation flow entry is the first flow.
  • the first flow entry includes a first matching condition and a first service logic, where the first service logic is used to convert a network address of a data packet from the internal network.
  • FIG. 2 is a flowchart of a network address translation method according to an embodiment of the present disclosure, where the method may include:
  • the forwarding plane device receives the first flow entry that is sent by the control plane device, where the first flow entry includes the first matching condition and the first service logic.
  • the forwarding plane device receives a data packet.
  • S203 determining, when the data packet is a packet from an intranet, and/or a private address stored in a source address field of the data packet belongs to a private address range capable of accessing an external network through a NAT.
  • the data packet satisfies the first matching condition in the first flow entry.
  • the forwarding plane device determines whether the data packet is from the intranet, and/or determines a private address stored in a source address field of the data packet. Whether it is a private address range that can access an external network through NAT.
  • the first matching condition in the first flow entry in the embodiment may be used to indicate that the matching is performed.
  • the data packet of the first flow entry is a packet from the internal network, and may be used to indicate that the private address stored in the source address field of the data packet matching the first flow entry belongs to a network that can access the external network through NAT.
  • the private address range may also be used to indicate that the data packet matching the first flow entry is a packet from the internal network, and the private address stored in the source address field of the data packet belongs to the external network capable of accessing the external network through the NAT. Private address range.
  • the forwarding plane device When it is determined that the data packet meets the first matching condition in the first flow entry, the forwarding plane device performs a first service logic in the first flow entry to enable the data packet.
  • the private address stored in the source address field is converted to a public address.
  • FIG. 3 is a flowchart of a method for performing a first service logic to complete a network address translation process performed by a forwarding plane device according to an embodiment of the present disclosure.
  • the method includes:
  • the forwarding plane device determines whether the received data packet meets the first matching condition in the first flow entry.
  • the forwarding plane device queries whether the data packet exists in the correspondence between the stored private address and the public address.
  • the forwarding plane device when the forwarding plane device determines that the received data packet meets the first matching condition, the forwarding plane device queries and stores the data source address field in the corresponding relationship between the stored private address and the public address. The public address corresponding to the private address.
  • the public address and the private address in the correspondence between the private address and the public address may be stored by using a database entry.
  • the control plane device instructs the forwarding plane device to set a database entry for all public addresses or partial public addresses in the public address range that can be used for NAT.
  • the database entry includes a public address field and a private address field, where the public address field is used to store a public address, and the private address field is used to store a private address.
  • the database entry further includes a status identifier field for identifying a status of the database entry, and a communication peer address, where the communication peer address may include an IP address or both an IP address and a port number, and an occupation start time. And a time for recording that the public address and the private address start to occupy the database entry.
  • the forwarding plane device When there is no public address corresponding to the private address in the corresponding relationship between the stored private address and the public address, the forwarding plane device allocates an unassigned public address that can be used for NAT to the private address. And storing a correspondence between the private address and the public address. In this embodiment, when there is no public address corresponding to the private address in the corresponding relationship between the stored private address and the public address, the forwarding plane device allocates a private address to the private address that is not assigned to another private address.
  • the forwarding plane device replaces the content of the source address field of the data packet with the public address, and obtains a first data packet to be sent, and sends the first data packet to be sent.
  • the source address field of the first data packet to be sent stores the public address.
  • the forwarding plane device uses the public address when the forwarding plane device queries the public address corresponding to the private address stored in the source address field in the data in the corresponding relationship between the stored private address and the public address.
  • the public address replaces the content of the source address field of the data packet, and the first data packet to be sent is sent, and the first data packet to be sent is sent out, and the source address of the first data packet to be sent is sent.
  • the field stores the public address.
  • the forwarding plane device determines that the received data packet meets the first matching condition, the forwarding plane device queries whether there is a private address field stored in the database as the database entry of the private address, if there is no corresponding
  • the forwarding table device obtains a database entry that is a status identifier field, wherein the public address field of the database entry corresponds to an unassigned public address that can be used for NAT.
  • the forwarding plane device adds the private address to a private address field of the database entry, and modifies the status identifier field of the database entry to be busy, and then completes the location by using the public address in the database entry.
  • the network address translation of the data message is
  • the forwarding plane device learns that there is no database entry in the status identifier field, the forwarding plane device reports to the control plane device, and the control plane device instructs the forwarding plane device to adjust the database entry, such as adding a database table. Item for allocation of public addresses.
  • the forwarding plane device directly replaces the source address field of the data packet by using the public address stored in the public address field of the database entry.
  • the content completes the network address translation of the data message.
  • the forwarding plane device may further be configured with a network address translation flow entry that is sent by the control plane device for processing a data packet sent by the external network to the internal network, where the network address translation is performed.
  • the flow entry is a second flow entry, the second flow entry includes a second matching condition and a second service logic, and the second service logic is configured to convert a network address of the data packet from the internal network.
  • FIG. 4 is a flowchart of a network address translation method according to an embodiment of the present disclosure, where the method may include:
  • the forwarding plane device receives the second flow entry that is sent by the control plane device, where the second flow entry includes the second matching condition and the second service logic.
  • the forwarding plane device receives a data packet.
  • S403 determining, when the data packet is a packet from an external network, and/or a public address stored in a destination address field of the data packet belongs to a public address range that can be used for NAT, determining the data. The text satisfies the second matching condition in the second flow entry.
  • the forwarding plane device determines whether the data packet is a packet from an external network, and/or a destination address field of the data packet. Whether the stored public address belongs to a public address range that can be used for NAT.
  • the second matching condition in the second flow entry in the embodiment is used to indicate that the data packet matching the second flow entry is a packet from the external network, and may also be used to indicate the
  • the public address stored in the destination address field of the data packet matching the second flow entry belongs to a public address range that can be used for the NAT, and can also be used to indicate that the data packet matching the second flow entry is from the outside
  • the packet of the network and the public address stored in the destination address field of the data packet belong to a public address range that can be used for NAT.
  • FIG. 5 is a flowchart of a method for performing a second service logic to complete a network address translation process performed by a forwarding plane device according to an embodiment of the present disclosure.
  • the method includes:
  • S501 The forwarding plane device determines whether the received data packet meets the second matching condition in the second flow entry.
  • the forwarding plane device queries whether the datagram exists in the correspondence between the stored private address and the public address.
  • S503 The public address exists in the correspondence between the stored private address and the public address.
  • the forwarding plane device replaces the content of the destination address field of the data packet with the private address, and obtains a second data packet to be sent, and sends the second data packet to be sent. Going out, the destination address field of the second data packet to be sent stores the private address.
  • the forwarding plane device determines that the received data packet meets the second matching condition, the forwarding plane device queries the destination address field of the data packet in the corresponding relationship between the stored private address and the public address.
  • the private address corresponding to the stored public address translates the network address of the data packet.
  • control plane device sends the network address translation flow entry to the forwarding plane device in advance, so that the forwarding plane device does not need to perform multiple signaling exchanges with the control plane device when performing NAT conversion, thereby improving network address translation. effectiveness.
  • the present embodiment uses the fast matching flow entry to complete the network address translation.
  • the forwarding plane device in the foregoing S302 allocates an unallocated private address to the NAT.
  • the forwarding plane device may also generate a '1 idling match flow entry.
  • the forwarding plane device After the forwarding plane device allocates an unassigned public address step that can be used for the NAT to the private address, the forwarding plane device generates the first public address according to the private address and the private address.
  • At least one of the third-stream entry and the fourth flow entry is a fast match flow entry, where the third flow entry and the fourth flow entry are fast match flow entries, where the third flow entry a third matching condition and a service logic for converting a private address stored in a source address field of the data packet into a public address of the private address allocation, where the third matching condition is used to indicate that the third is matched
  • the private address stored in the source address field of the data packet of the flow entry is equal to a private address used to generate the third flow entry, and the fourth flow entry includes a fourth matching condition and is used to send the data packet.
  • the public address stored in the destination address field is converted into the service logic of the private address corresponding to the public address, and the fourth matching condition is used to indicate that the data packet matching the fourth flow entry is matched.
  • the public address of the destination address field is equal to a public address for generating the fourth flow entry, and the third flow entry has a higher matching priority than the first flow entry, and the fourth flow table The matching priority of the item is higher than the third flow entry.
  • the first step is to determine whether the data packet is satisfied before determining whether the received data packet meets the first matching condition in the first flow entry.
  • a third matching condition in the third flow entry package a third matching condition and a service logic for converting a private address stored in a source address field of the data packet into a public address of the private address allocation, the third matching condition being used to indicate that the third is matched
  • the private address stored in the source address field of the data packet of the flow entry is equal to a private address used to generate the third flow entry, or the third matching condition includes not only the foregoing condition but also the indication
  • the data packet is a packet from the intranet. Meanwhile, the third flow entry has a higher priority than the first flow entry.
  • FIG. 6 is a flowchart of a method for converting a network address after a third flow entry is generated by the forwarding plane device according to the embodiment. Specifically, the method may include:
  • the forwarding plane device determines whether the received data packet meets the third matching condition in the third flow entry, and if yes, proceeds to S602, and if no, proceeds to S603.
  • the forwarding plane device determines that the data packet meets the third flow entry, when the private address of the source address field of the data packet is equal to a private address used to generate the third flow entry. a third matching condition, otherwise, determining that the data message does not satisfy the third matching condition.
  • the forwarding plane device performs a service logic for converting a private address stored in a source address field of the data packet to a public address allocated by the private address to complete network address translation.
  • the forwarding plane device When the forwarding plane device determines that the received data packet meets the third matching condition in the third flow entry, the forwarding plane device performs, in the third flow entry, the datagram.
  • the service logic of the public address stored in the source address field of the text is converted into the public address of the private address to complete the network address translation of the data message.
  • the forwarding plane device replaces the content of the source address field of the data packet with a public address corresponding to the private address stored in the source address field of the data packet, to obtain a data packet to be sent, and the The data packet to be sent is sent out, and the source address field of the to-be-sent data packet stores the public address.
  • the forwarding plane device uses the fast matching flow entry to complete network address translation, reduces the number of times the network address is queried, and improves the efficiency of network address translation.
  • the forwarding plane device determines whether the data packet meets a first matching condition in the first flow entry, and if yes, proceeds to S604.
  • the forwarding plane device may determine whether the received data packet meets the first flow entry.
  • the first matching condition if satisfied, is performed S604.
  • the forwarding plane device executes the first service logic to convert a private address stored in a source address field of the data packet into a public address.
  • the forwarding plane device If the forwarding plane device generates the fourth flow entry, in this embodiment, before determining whether the received data packet meets the second matching condition in the second flow entry, first determining whether the data packet is And satisfying a fourth matching condition in the fourth flow entry.
  • the fourth flow entry includes a fourth matching condition and a service logic for converting a public address stored in the destination address field of the data packet to a private address corresponding to the public address, where the fourth matching
  • the condition is used to indicate that the public address stored in the destination address field of the data packet matching the fourth flow entry is equal to a public address used to generate the fourth flow entry, or the fourth matching condition includes The foregoing condition is also used to indicate that the data packet is a packet from an external network.
  • the fourth flow entry has a higher priority than the second flow entry.
  • FIG. 7 is a flowchart of a method for converting a network address after the fourth flow entry is generated by the forwarding plane device according to the embodiment.
  • the method may include:
  • S701 The forwarding plane device determines whether the received data packet meets the fourth matching condition in the fourth flow entry, and if yes, proceeds to S702. If not, proceeds to 7603.
  • the forwarding plane device determines that the data packet meets the The fourth matching condition in the fourth flow entry, otherwise, determining that the data message does not satisfy the fourth matching condition.
  • the forwarding plane device performs a service logic for converting a public address stored in a destination address field of the data packet to a private address corresponding to the public address to complete network address translation of the data.
  • the forwarding plane device determines that the received data packet satisfies the fourth matching condition in the fourth flow entry, the forwarding plane device performs, in the fourth flow entry, the datagram.
  • the service logic of the public address stored in the destination address field of the text is converted into the private address corresponding to the public address to complete the network address translation of the data packet.
  • the forwarding plane device replaces the data packet with a private address corresponding to a public address stored in a destination address field of the data packet.
  • the content of the destination address field, the data packet to be sent is sent, and the data packet to be sent is sent out, and the destination address field of the data packet to be sent stores the private address.
  • the forwarding plane device uses the fast matching flow entry to complete network address translation, reduces the number of times the network address is queried, and improves the efficiency of network address translation.
  • the forwarding plane device determines whether the data packet meets a second matching condition in the second flow entry, and if yes, proceeds to S704.
  • the forwarding plane device may determine whether the received data packet meets the second flow entry.
  • the second matching condition if satisfied, is performed S704.
  • the forwarding plane device executes the second service logic to convert a public address stored in a destination address field of the data packet into a private address.
  • the forwarding plane device After the forwarding plane device receives any one of the data packets, the data packet and the forwarding plane device generate a fast matching flow entry, that is, the third flow entry and the fourth flow entry.
  • the matching conditions are matched.
  • the forwarding plane device directly performs network address translation by using the service logic in the third flow entry or the fourth flow entry. If the matching fails, the forwarding plane device may match the data packet with the matching condition in the first flow entry and the second flow entry delivered by the control plane device, and if the matching succeeds, the forwarding device The network address translation is completed by using the service logic in the first flow entry or the second flow entry. If the matching is unsuccessful, the data packet may be discarded, and an error message is generated and reported to the control plane device.
  • the basic storage capability of the data information is provided to the forwarding plane device by introducing a database mechanism in the forwarding plane device.
  • control plane device may instruct the forwarding plane device to set a database entry in advance for all public addresses or partial public addresses that can be used in the public address range of NA.
  • the database entry may be set according to the type of the current network address translation.
  • the control plane device instructs the forwarding plane device to preset a database entry, and initializes the database entry.
  • the forwarding plane device logically sets a database for each public address that can be used for NAT. Entry.
  • Each of the database entries may include the following attribute fields, which are specifically: Private Address Field Private IP/Port, Public Address Field Public IP/Port
  • the size of the database entry in this embodiment should be determined by the control plane device, and the control The noodle device can support the number of intranet users with external network access rights according to current needs, and the number of extranet IPs that can be used to provide NAT translation.
  • the control plane device may determine the number of the database entries according to a smaller value of a number of public addresses that can be used for NAT and a number of private addresses that can access the external network through NAT. .
  • the establishment of the database entry may be completed during system initialization, and may optionally instruct the forwarding device to add, modify, or delete several database entries when the control device considers it necessary. Therefore, in another implementation manner, when the control plane device cannot accurately know the number of intranet users that need NAT, the control plane device may first indicate that the forwarding plane device sets a certain number of database entries, and indicates that the forwarding plane device cannot be found. When a new user obtains a public address of an idle external network, it is up to the control plane device. When the control plane device receives the message that the database entry fails to be obtained or the number of intranet users that need NA changes, the control plane device may instruct the forwarding plane device to further establish a batch of database entries.
  • Static NAT type The correspondence between the private address and the public address in the forwarding plane device is fixed. At this time, all public addresses are fixedly assigned to the private address of a specific user, and other users cannot obtain the NAT service.
  • Full cone NAT type Also commonly referred to as a one-to-one NAT type, this type of NAT can receive packets from all external hosts. Once an intranet port is mapped to an external network port, all packets sent from the intranet port are sent out via the external network port. Any external host can send data packets to the intranet port by sending the external network port.
  • control plane device When the control plane device sends a database entry to the forwarding plane device, set a database entry for each public IP address or external network port to be used, and set all database entries to be idle.
  • the field is set to an initial state such as null or 0.
  • Restricted address cone NA Type The forwarding plane device only receives packets that have been sent to the IP address of the peer. Once an intranet port is mapped to an external network port, all packets sent from the intranet port are sent out via the external network port. Any external host can pass to the external network The outgoing packet arrives at the intranet port, but the premise is: The intranet port has previously sent a packet to any external host.
  • the database table entry is the same as the full cone NAT type setting, but the Peer IP field is also used as one of the database query conditions in the database table entry setting of the limit address cone NA type.
  • Restricted port cone NA Type This NAT type only receives packets that have been sent to the peer's IP address and port. Similar to the restricted address cone NA type above, but this type adds port restrictions. Once an intranet port is mapped to an external network port, all packets sent from the intranet port are sent out via the external network port. The premise that an external host can send a packet to the intranet port is: The packet was sent to the external host before the intranet port.
  • the database entry setting method of this type is the same as the full cone NAT type. However, in the database table entry setting of the restricted port cone NA type, the Peer IP/Port field is also used as one of the database query conditions.
  • Symmetric NAT type In this NAT type, requests from the same private IP address and intranet port are mapped to a public IP address and an external port. The data from the public IP address and the external port can reach the internal host through the NAT gateway.
  • the setting method of the database table entry in this type is the same as the full cone NAT type. However, in the database entry setting of the symmetric NAT type, the destination address and the target port are also used as one of the database query conditions, and the Peer is The address and port fields are also used as one of the database query conditions.
  • FIG. 8 is a flowchart of a network address translation method according to an embodiment, where the method includes:
  • the control plane device generates a network address translation flow entry.
  • the control plane device sends the network address translation flow entry to the forwarding plane device, where the forwarding plane device is used for packet forwarding, and the control plane device is configured to control the forwarding plane device to perform packet transmission.
  • the network address translation flow entry includes a matching condition and a service logic, and is configured to: when the forwarding plane device receives the data packet that matches the matching condition, execute the service logic to complete the Network address translation of data packets.
  • the matching condition may be used to indicate that the data packet matching the network address translation flow entry is a packet from the intranet, and/or the matching the network address translation flow entry
  • the private address stored in the source address field of the data packet belongs to the ability to access the external network through NAT. Private address range;
  • the service logic is configured to indicate an operation of converting the private address stored in the source address field of the data packet matching the network address translation flow entry to a public address.
  • the matching condition may be used to indicate that the data packet matching the network address translation flow entry is a packet from the external network, and/or the matching the network address translation flow entry
  • the public address stored in the destination address field of the data packet belongs to a public address range that can be used for NAT;
  • the service logic is configured to indicate an operation of converting the public address stored in the destination address field of the data packet matching the network address translation flow entry into a private address.
  • a new operation type is defined in the openflow protocol adopted by the forwarding plane device, and the operation type includes an operation matching condition, a first instruction set, and a second instruction set.
  • the forwarding plane device executes the first instruction set, otherwise the forwarding plane device executes the second instruction set.
  • the service logic in the network address translation flow entry sent by the control plane device to the forwarding plane device can be implemented by the newly defined operation type in the openflow protocol.
  • the operation matching condition in the operation type is that, in the correspondence between the stored private address and the public address, the public address corresponding to the private address stored in the source address field in the data is queried, when the foregoing matching
  • the forwarding plane device performs a first instruction set in the operation type, that is, the content of the source address field of the data packet is replaced by the public address, and the first data packet to be sent is obtained, and And sending the first data packet to be sent, where the source address field of the first data packet to be sent stores the public address.
  • the forwarding plane device performs a second instruction set in the operation type, that is, assigns an unassigned public address that can be used for NAT to the private address, and stores the private address.
  • a second instruction set in the operation type that is, assigns an unassigned public address that can be used for NAT to the private address, and stores the private address.
  • the content of the source address field of the data packet is replaced by the public address, and the first data packet to be sent is sent, and the first data packet to be sent is sent out.
  • the source address field of the first data packet to be sent stores the public address.
  • the first business logic may be implemented in the first flow entry using the following pseudo code.
  • ActionSet4EXI ⁇ Set S_IP/S_Port ⁇ according to the corresponding Public_IP/Port
  • the action of dropping the message, reporting the controller, or returning an error message is selected according to the preset configuration information.
  • In_Port refers to the port input by 4 ⁇
  • Private_Port refers to the port number connected to the internal network
  • S_IP/S_Port refers to the source IP/Port included in the text
  • D_IP/D_Port refers to the destination IP/Port included in the text
  • DB refers to the * field of the corresponding entry in the database.
  • the Match part of the first flow entry indicates that the forwarding plane device selects to receive a data packet from the intranet port, and the data packet is from a host that has the right to access the external network and needs to perform NAT translation, and only the data packet with the above conditions is successfully matched. Subsequent NAT conversion is required.
  • a database entry equal to the source address of the message. If found, the description has been assigned to the user, access, or application (the object size of the NAT translation varies depending on the NAT type, and the subsequent translation of the object to be written as a user or object) is assigned a corresponding public address.
  • the user assigns a new public address and implements the binding.
  • an idle database entry (the busy and idle flag is idle) should be found from the database, and the public address recorded therein is assigned to the user, and the database entry is set. For busy, and modify the value of the corresponding field of the database table entry, and then use the newly assigned public address to modify the source address of the data. If no free entry is found in the database, it indicates that the currently available public address is all occupied. In this case, you should choose to discard the data packet according to the preset policy configuration information.
  • the forwarding plane device After the forwarding plane device performs the NAT translation of the data packet, the forwarding plane device sends the converted data packet from the external network port connected to the external network, and completes the entire NAT conversion process.
  • the first instruction set and the second instruction set that need to be executed in the success and failure of the matching condition are respectively placed in two groups, and the message is delivered to different groups according to the query result, and the processing can be continued.
  • the above method can make the information contained in the newly defined operation type more formatted, and the length thereof is fixed to be smaller, which facilitates the design of the flow entry of the device on the forwarding plane, and does not need to process the flow entry of a very long length. Referring to FIG. 9, FIG. 9, FIG.
  • FIG. 9 is a schematic structural diagram of a network address translation apparatus according to an embodiment of the present disclosure, where the apparatus is configured with a network address translation flow entry delivered by a control plane device, where the network address translation flow entry includes a matching condition and a service logic, where the service logic is used for network address translation, where the control plane device is configured to control the device to perform packet forwarding, and the device includes:
  • the first receiving module 901 is configured to receive a data packet.
  • the first conversion module 902 is configured to: when determining that the data packet received by the first receiving module meets a matching condition in the network address translation flow entry, execute the service logic to complete the network of the data packet Address translation.
  • the network address translation flow entry configured by the device is a first flow entry, where the first flow entry includes a first matching condition and a first service logic;
  • the first conversion module includes a first determining submodule and a first converting submodule
  • the first determining submodule is configured to: when the data packet received by the first receiving module is a packet from an intranet, and/or the private address stored in a source address field of the data packet belongs to When the NAT accesses the private address range of the external network, the data is determined to meet the first matching condition in the first flow entry.
  • the first conversion submodule is configured to: when the first determining submodule determines that the data packet meets a first matching condition in the first flow entry, perform the first one of the first flow entry
  • the business logic converts the private address stored in the source address field of the data message to a public address.
  • the network address translation flow entry configured by the device is a second flow entry, and the second flow entry includes a second matching condition and a second service logic.
  • the first conversion module includes a second determining submodule and a second converting submodule
  • the second determining submodule is configured to: when the data packet received by the first receiving module is a packet from an external network, and/or the public address stored in the destination address field of the data packet is applicable And determining, in the public address range of the NAT, that the data packet meets a second matching condition in the second flow entry;
  • the second conversion submodule is configured to: in the second determining submodule, determine that the data packet meets a second matching condition in the second flow entry, and execute the second in the second flow entry
  • the second service logic converts the public address stored in the destination address field of the data message into a private address.
  • the first conversion submodule includes:
  • An allocation submodule configured to allocate, when the stored private address and the public address have a public address corresponding to the private address, an unassigned public address that can be used for NAT
  • the first replacement sub-module is configured to replace the content of the source address field of the data packet with the public address, and obtain the first data packet to be sent. And sending the first data packet to be sent, where the source address field of the first data packet to be sent stores the public address.
  • the first conversion submodule may further include: a second replacement submodule, configured to: when the stored correspondence between the private address and the public address exists, corresponding to the private address stored in the source address field in the data packet
  • the public address is used to replace the content of the source address field of the data with the public address, and the first data packet to be sent is sent, and the first data packet to be sent is sent out.
  • a source address field of a data message stores the public address.
  • the second conversion submodule includes: a third replacement submodule, configured to: when the stored correspondence between the private address and the public address exists, corresponding to the public address stored in the destination address field of the data packet
  • a third replacement submodule configured to: when the stored correspondence between the private address and the public address exists, corresponding to the public address stored in the destination address field of the data packet
  • the content of the destination address field of the data packet is replaced by the private address, and the second data packet to be sent is sent, and the second data packet to be sent is sent out, and the second data packet to be sent is sent.
  • the destination address field of the data message stores the private address.
  • the device may further include:
  • a generating module configured to generate a third flow entry and/or a fourth flow entry according to the private address and the allocated public address in the allocation submodule, where the third flow entry includes the third matching condition and a service logic for converting a private address stored in a source address field of the data packet to a public address of the private address allocation, where the third matching condition is used to indicate data matching the third flow entry.
  • the private address of the source address field of the text is equal to the private address, or the data packet matching the third flow entry is a packet from the intranet, and the source address field of the data packet is The private address is equal to the private address, and the fourth flow entry includes the fourth matching condition and a public address for storing the destination address field of the data packet into a private address corresponding to the public address.
  • the fourth matching condition is used to indicate that the data packet of the fourth flow entry that matches the fourth flow entry is a packet from the external network, and the destination of the data packet Ground
  • the public address of the address field is equal to the public address of the allocation, the matching priority of the third flow entry is higher than the first flow entry, and the matching priority of the fourth flow entry is higher than the second Flow entry.
  • FIG. 10 is a schematic structural diagram of a network address translation apparatus according to an embodiment of the present disclosure, where the apparatus may include:
  • the first generating module 1001 is configured to generate a network address translation flow entry.
  • the first sending module 1002 is configured to send the network address translation flow entry to the forwarding plane device, where the forwarding plane device is used for packet forwarding, and the network address translation flow entry includes a matching condition and a service logic.
  • the forwarding plane device receives the data packet that matches the matching condition, the service logic is executed to complete network address translation of the data packet.
  • the matching condition is used to indicate that the data packet matching the network address translation flow entry is a text from the internal network, and/or the data matching the network address translation flow entry is 3 ⁇ 4
  • the private address stored in the source address field of the text belongs to a private address range capable of accessing the external network through the NAT;
  • the service logic is configured to indicate that the source address field of the data packet matching the network address translation flow entry is stored The operation of converting a private address to a public address.
  • the matching condition may be further used to indicate that the data packet matching the network address translation flow entry is a packet from the external network, and/or the data packet matching the network address translation flow entry.
  • the public address stored in the destination address field of the text belongs to the public address range that can be used for NAT;
  • the service logic is configured to indicate an operation of converting the public address stored in the destination address field of the data packet matching the network address translation flow entry into a private address.
  • the embodiments of the present invention further provide hardware configurations of the smart terminals. At least one processor (e.g., a CPU), at least one network interface or other communication interface, memory, and at least one communication bus may be included for enabling connection communication between the devices.
  • the processor is configured to execute an executable module, such as a computer program, stored in the memory.
  • the memory may include a high speed random access memory (RAM: Random Access Memory), and may also include a non-volatile memory such as at least one disk memory.
  • RAM Random Access Memory
  • the communication connection between the system gateway and at least one other network element may be implemented through at least one network interface (which may be wired or wireless), and may use an Internet, a wide area network, a local network, a metropolitan area network, or the like.
  • program instructions are stored in the memory, and the program instructions may be executed by the processor.
  • the program instructions may be executed by the processor.
  • each embodiment focuses on the differences from the other embodiments.
  • the device and the system embodiment since it is basically similar to the method embodiment, it is described in a relatively simple manner, and the relevant parts can be referred to the description of the method embodiment.
  • the apparatus and system embodiments described above are merely illustrative, and may or may not be physical units as separate components, ie may be located in one place, or may be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without any creative effort.
  • the above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalents, improvements, etc. made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

公开一种网络地址转换方法，包括：转发面设备接收数据报文，所述转发面设备配置有控制面设备下发的网络地址转换流表项，所述网络地址转换流表项包括匹配条件和业务逻辑，所述业务逻辑用于网络地址转换（S101）；其中，所述转发面设备用于报文转发，所述控制面设备用于控制所述转发面设备进行报文转发；当确定所述数据报文满足所述网络地址转换流表项中的匹配条件时，所述转发面设备执行所述业务逻辑以完成所述数据报文的网络地址转换（S102）。控制面设备预先下发网络地址转换流表项至转发面设备，使得转发面设备在进行网络地址转换时不需要与控制面设备进行多次信令交换，提高了网络地址转换效率。

Description

一种网络地址转换方法及装置
技术领域
本发明涉及通信技术领域， 具体涉及一种网络地址转换方法及装置。 背景技术
网络地址转换 (英文： Network Address T nsktion, 缩写： NAT)属接入广 域网（英文： Wide Area Network, 缩写： WAN)技术， 是一种将私有地址转化 为合法互联网协议 （英文： Internet Protocol , 缩写： IP) 地址的转换技术， 它 被广泛应用于各种类型的网络中。 软件定义网络（英文： Software Defined Networking, 缩写： SDN)是一种新出现的网络架构， 具有控制与转发解耦， 即控制面设备与转发面设备分离的特点。 其中， 控制面设备进行 NAT过程中 的逻辑判决和处理， 而转发面设备只是筒单的负责匹配和转发， 不参与任何 逻辑处理。
目前， 由于 SDN中控制面设备与转发面设备分离， 所以在 SDN中进行 NA 的过程较复杂， 控制面设备需要针对每个特定的私有地址向转发面设备 下发对应的处理逻辑，指示转发面设备进行 NAT操作。并且在每一次的 NAT 操作中， 控制面设备和转发面设备之间需要完成多次信令交互， 所以， 现有 的网络地址转换方法增加信令负担， 同时多次交互也增加了网络地址转换的 时间。
发明内容
本发明提供了一种网络地址转换方法及装置， 能够減少控制面设备与转 发面设备的交互次数， 提高网络地址转换效率。
为了解决以上技术问题， 本发明采取的技术方案是：
第一方面， 本发明提供了一种网络地址转换方法， 包括：
转发面设备接收数据报文， 所述转发面设备配置有控制面设备下发的网 络地址转换流表项， 所述网络地址转换流表项包括匹配条件和业务逻辑， 所 述业务逻辑用于网络地址转换； 其中， 所述转发面设备用于报文转发， 所述 控制面设备用于控制所述转发面设备进行报文转发；
当确定所述数据报文满足所述网络地址转换流表项中的匹配条件时， 所 述转发面设备执行所述业务逻辑以完成所述数据报文的网络地址转换。
在第一方面的第一种可能的实现方式中， 所述网络地址转换流表项为第 一流表项， 所述第一流表项包括第一匹配条件和第一业务逻辑； 所述确定所述数据报文满足所述网络地址转换流表项中的匹配条件， 包 括：
当所述数据报文为来自内网的报文， 和 /或， 所述数据报文的源地址字段 存储的私有地址属于能够通过 NAT访问外部网络的私有地址范围时，则确定 所述数据报文满足所述第一流表项中的第一匹配条件；
所述转发面设备执行所述业务逻辑完成所述数据报文的网络地址转换， 包括：
所述转发面设备执行所述第一流表项中的第一业务逻辑以使所述数据报 文的源地址字段存储的私有地址转换为公有地址。
在第一方面的第二种可能的实现方式中， 所述网络地址转换流表项为第 二流表项， 所述第二流表项包括第二匹配条件和第二业务逻辑；
所述确定所述数据报文满足所述网络地址转换流表项中的匹配条件， 包 括：
当所述数据报文为来自外网的报文， 和 /或， 所述数据报文的目的地址字 段存储的公有地址属于能够用于 NAT的公有地址范围时，则确定所述数据报 文满足所述第二流表项中的第二匹配条件；
所述转发面设备执行所述业务逻辑完成所述数据报文的网络地址转换， 包括：
所述转发面设备执行所述第二流表项中的第二业务逻辑以使所述数据报 文的目的地址字段存储的公有地址转换为私有地址。
结合第一方面的第一种可能的实现方式， 在第三种可能的实现方式中， 所述转发面设备执行所述第一业务逻辑以使所述数据报文的源地址字段存储 的私有地址转换为公有地址， 包括：
当存储的私有地址和公有地址的对应关系中不存在与所述私有地址对应 的公有地址时， 所述转发面设备为所述私有地址分配一未被分配的能够用于
NA 的公有地址， 并存储所述私有地址和所述公有地址的对应关系；
所述转发面设备利用所述公有地址替换所述数据报文的源地址字段的内 容， 得到待发送第一数据报文， 并将所述待发送第一数据报文发送出去， 所 述待发送第一数据报文的源地址字段存储所述公有地址。 结合第一方面的第一种可能的实现方式， 在第四种可能的实现方式中， 所述转发面设备执行所述第一业务逻辑以使所述数据报文的源地址字段存储 的私有地址转换为公有地址， 包括： 当存储的私有地址和公有地址的对应关 系中存在与所述数据报文中源地址字段存储的私有地址对应的公有地址时， 所述转发面设备利用所述公有地址替换所述数据报文的源地址字段的内容， 得到待发送第一数据报文， 并将所述待发送第一数据报文发送出去， 所述待 发送第一数据报文的源地址字段存储所述公有地址。
结合第一方面的第二种可能的实现方式， 在第五种可能的实现方式中， 所述转发面设备执行所述第二业务逻辑以使所述数据报文的目的地址字段存 储的公有地址转换为私有地址， 包括：
当存储的私有地址和公有地址的对应关系中存在与所述数据报文的目的 地址字段存储的公有地址对应的私有地址时， 所述转发面设备利用所述私有 地址替换所述数据报文的目的地址字段的内容， 得到待发送第二数据报文， 并将所述待发送第二数据报文发送出去， 所述待发送第二数据报文的目的地 址字段存储所述私有地址。
结合第一方面的第三种可能的实现方式， 在第六种可能的实现方式中， 所述转发面设备为所述私有地址分配一未被分配的能够用于 NAT 的公有地 址之后， 还包括：
所述转发面设备根据所述私有地址和分配的公有地址生成第三流表项和 /或第四流表项，所述第三流表项包括第三匹配条件和用于将所述数据报文的 源地址字段存储的私有地址转换为所述私有地址分配的公有地址的业务逻 辑， 所述第三匹配条件用于指示匹配所述第三流表项的数据报文的源地址字 段的私有地址等于所述私有地址， 或， 所述匹配所述第三流表项的数据报文 为来自内网的报文， 且所述数据报文的源地址字段的私有地址等于所述私有 地址， 所述第四流表项包括第四匹配条件和用于将所述数据报文的目的地址 字段存储的公有地址转换为所述公有地址对应的私有地址的业务逻辑， 所述 第四匹配条件用于指示匹配所述第四流表项的数据报文的目的地址字段存储 的公有地址等于所述分配的公有地址， 或， 所述匹配所述第四流表项的数据 报文为来自外网的报文， 且所述数据报文的目的地址字段的公有地址等于所 述分配的公有地址， 所述第三流表项的匹配优先级高于所述第一流表项， 所 述第四流表项的匹配优先级高于所述第二流表项。
第二方面， 本发明提供了一种网络地址转换方法， 包括：
控制面设备生成网络地址转换流表项；
所述控制面设备向转发面设备发送所述网络地址转换流表项；
其中， 所述转发面设备用于报文转发， 所述控制面设备用于控制所述转 发面设备进行报文转发，所述网络地址转换流表项包括匹配条件和业务逻辑， 用于指示所述转发面设备当收到与所述匹配条件匹配的数据报文时， 执行所 述业务逻辑以完成对所述数据报文的网络地址转换。
在第二方面的第一种可能的实现方式中， 所述匹配条件用于指示匹配所 述网络地址转换流表项的数据报文为来自内网的报文， 和 /或， 所述匹配所述 网络地址转换流表项的数据报文的源地址字段存储的私有地址属于能够通过 NA 访问外部网络的私有地址范围；
所述业务逻辑用以指示将所述匹配所述网络地址转换流表项的数据报文 的源地址字段存储的私有地址转换为公有地址的操作。
在第二方面的第二种可能的实现方式中， 所述匹配条件用于指示匹配所 述网络地址转换流表项的数据报文为来自外网的报文， 和 /或， 所述匹配所述 网络地址转换流表项的数据报文的目的地址字段存储的公有地址属于能够用 于 NAT的公有地址范围；
所述业务逻辑用以指示将所述匹配所述网络地址转换流表项的数据报文 的目的地址字段存储的公有地址转换为私有地址的操作。
第三方面， 本发明还提供了一种网络地址转换装置， 所述装置配置有控 制面设备下发的网络地址转换流表项， 所述网络地址转换流表项包括匹配条 件和业务逻辑， 所述业务逻辑用于网络地址转换， 其中， 所述控制面设备用 于控制所述装置进行报文转发， 所述装置包括：
第一接收模块， 用于接收数据报文；
第一转换模块， 用于当确定所述第一接收模块接收的数据报文满足所述 网络地址转换流表项中的匹配条件时， 执行所述业务逻辑以完成所述数据报 文的网络地址转换。
在第三方面的第一种可能的实现方式中， 所述装置配置的网络地址转换 流表项为第一流表项， 所述第一流表项包括第一匹配条件和第一业务逻辑； 所述第一转换模块包括第一确定子模块和第一转换子模块， 所述第一确定子模块， 用于当所述第一接收模块接收的数据报文为来自 内网的报文， 和 /或， 所述数据报文的源地址字段存储的私有地址属于能够通 过 NAT访问外部网络的私有地址范围时，则确定所述数据 文满足所述第一 流表项中的第一匹配条件；
所述第一转换子模块， 用于在所述第一确定子模块确定所述数据报文满 足所述第一流表项中的第一匹配条件时， 执行所述第一流表项中的第一业务 逻辑以使所述数据报文的源地址字段存储的私有地址转换为公有地址。
在第三方面的第二种可能的实现方式中， 所述装置配置的网络地址转换 流表项为第二流表项， 所述第二流表项包括第二匹配条件和第二业务逻辑； 所述第一转换模块包括第二确定子模块和第二转换子模块，
所述第二确定子模块， 用于当所述第一接收模块接收的数据报文为来自 外网的报文， 和 /或， 所述数据报文的目的地址字段存储的公有地址属于能够 用于 NAT的公有地址范围时，则确定所述数据报文满足所述第二流表项中的 第二匹配条件；
所述第二转换子模块， 用于在所述第二确定子模块确定所述数据报文满 足所述第二流表项中的第二匹配条件， 执行所述第二流表项中的第二业务逻 辑以使所述数据报文的目的地址字段存储的公有地址转换为私有地址。
结合第三方面的第一种可能的实现方式， 在第三种可能的实现方式中， 所述第一转换子模块， 包括：
分配子模块， 用于当存储的私有地址和公有地址的对应关系中不存在与 所述私有地址对应的公有地址时， 为所述私有地址分配一未被分配的能够用 于 NAT的公有地址， 并存储所述私有地址和所述公有地址的对应关系； 第一替换子模块， 用于利用所述公有地址替换所述数据报文的源地址字 段的内容， 得到待发送第一数据报文， 并将所述待发送第一数据报文发送出 去， 所述待发送第一数据报文的源地址字段存储所述公有地址。
结合第三方面的第一种可能的实现方式， 在第四种可能的实现方式中， 所述第一转换子模块， 包括： 第二替换子模块， 用于当存储的私有地址和公 有地址的对应关系中存在与所述数据 ^艮文中源地址字段存储的私有地址对应 的公有地址时， 利用所述公有地址替换所述数据报文的源地址字段的内容， 得到待发送第一数据报文， 并将所述待发送第一数据报文发送出去， 所述待 发送第一数据报文的源地址字段存储所述公有地址。
结合第三方面的第二种可能的实现方式， 在第五种可能的实现方式中， 所述第二转换子模块， 包括： 第三替换子模块， 用于当存储的私有地址和公 有地址的对应关系中存在与所述数据报文的目的地址字段存储的公有地址对 应的私有地址时， 利用所述私有地址替换所述数据报文的目的地址字段的内 容， 得到待发送第二数据报文， 并将所述待发送第二数据报文发送出去， 所 述待发送第二数据报文的目的地址字段存储所述私有地址。
结合第三方面的第三种可能的实现方式， 在第六种可能的实现方式中， 所述装置还包括：
生成模块， 用于根据所述分配子模块中的私有地址和分配的公有地址生 成第三流表项和 /或第四流表项，所述第三流表项包括所述第三匹配条件和用 于将所述数据报文的源地址字段存储的私有地址转换为所述私有地址分配的 公有地址的业务逻辑， 所述第三匹配条件用于指示匹配所述第三流表项的数 据^艮文的源地址字段的私有地址等于所述私有地址， 或， 所述匹配所述第三 流表项的数据报文为来自内网的报文， 且所述数据报文的源地址字段的私有 地址等于所述私有地址， 所述第四流表项包括所述第四匹配条件和用于将所 述数据报文的目的地址字段存储的公有地址转换为所述公有地址对应的私有 地址的业务逻辑， 所述第四匹配条件用于指示匹配所述第四流表项的数据报 所述第四流表项的数据报文为来自外网的报文， 且所述数据报文的目的地址 字段的公有地址等于所述分配的公有地址， 所述第三流表项的匹配优先级高 于所述第一流表项， 所述第四流表项的匹配优先级高于所述第二流表项。
第四方面， 本发明还提供了一种网络地址转换装置， 所述装置包括： 第一生成模块， 用于生成网络地址转换流表项；
第一发送模块， 用于向转发面设备发送所述网络地址转换流表项； 其中， 所述转发面设备用于报文转发， 所述网络地址转换流表项包括匹 配条件和业务逻辑， 用于指示所述转发面设备当收到与所述匹配条件匹配的 数据报文时， 执行所述业务逻辑以完成对所述数据报文的网络地址转换。
本发明中控制面设备预先下发网络地址转换流表项至转发面设备， 使得 转发面设备在进行 NAT转换时不再需要与控制面设备进行多次信令交换，提 高了网络地址转换效率。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案， 下面将对实 施例或现有技术描述中所需要使用的附图作筒单地介绍， 显而易见地， 下面 描述中的附图仅仅是本发明的一些实施例， 对于本领域普通技术人员来讲， 在不付出创造性劳动的前提下， 还可以根据这些附图获得其他的附图。
图 1是本发明实施例提供的网络地址转换方法流程图；
图 2是本发明实施例提供的网络地址转换方法流程图；
图 3 是本发明实施例提供的转发面设备执行第一业务逻辑完成网络地址 转换方法的流程图；
图 4是本发明实施例提供的网络地址转换方法流程图；
图 5 是本发明实施例提供的转发面设备执行第二业务逻辑完成网络地址 转换方法的流程图；
图 6 是本发明实施例提供的转发面设备生成了第三流表项之后的网络地 址转换方法流程图；
图 7 是本发明实施例提供的转发面设备生成了第四流表项之后的网络地 址转换方法流程图；
图 8是本发明实施例提供的网络地址转换方法流程图；
图 9是本发明实施例提供的网络地址转换装置结构示意图；
图 10是本发明实施例提供的网络地址转换装置结构示意图；
图 11是本发明实施例智能终端的硬件构成示意图。
具体实施方式
为了使本技术领域的人员更好地理解本发明实施例的方案， 下面结合附 图和实施方式对本发明实施例作进一步的详细说明。
参考图 1， 图 1为本实施例提供的网络地址转换方法流程图， 其中， 所述 方法可以包括：
S101 : 转发面设备接收数据报文， 所述转发面设备配置有控制面设备下 发的网络地址转换流表项， 所述网络地址转换流表项包括匹配条件和业务逻 辑， 所述业务逻辑用于网络地址转换； 其中， 所述转发面设备用于报文转发， 所述控制面设备用于控制所述转 发面设备进行报文转发。
S102 : 当确定所述数据报文满足所述网络地址转换流表项中的匹配条件 时，所述转发面设备执行所述业务逻辑以完成所述数据报文的网络地址转换。
本实施例中， 控制面设备确定网络地址转换流表项， 并将所述网络地址 流表项下发至转发面设备。 网络地址转换流表项可以为处理由内网发送至外 网数据报文的通用流表项， 也可以为处理由外网发送至内网数据报文的通用 流表项。 其中， 所述网络地址转换流表项均包括匹配条件和业务逻辑两部分， 所述业务逻辑用于完成数据报文的网络地址转换。
当转发面设备接收到任意一个数据报文时， 首先判断所述数据报文是否 满足所述网络地址转换流表项中的匹配条件。 如果所述转发面设备确定接收 的数据报文满足所述网络地址转换流表项中的匹配条件， 所述转发面设备执 行所述网络地址转换流表项中的业务逻辑以完成所述数据报文的网络地址转 换。
实际应用中， 转发面设备配置有控制面设备下发的用于处理由内网发送 至外网的数据报文的网络地址转换流表项， 其中， 所述网络地址转换流表项 为第一流表项， 所述第一流表项包括第一匹配条件和第一业务逻辑， 所述第 一业务逻辑用于转换来自内网的数据报文的网络地址。
参考图 2， 图 2为本实施例提供的网络地址转换方法流程图， 其中， 所述 方法可以包括：
S201 : 转发面设备接收控制面设备下发的第一流表项， 所述第一流表项 包括第一匹配条件和第一业务逻辑。
S202 : 所述转发面设备接收数据报文。
S203 : 当所述数据报文为来自内网的报文， 和 /或， 所述数据报文的源地 址字段存储的私有地址属于能够通过 NAT访问外部网络的私有地址范围时， 则确定所述数据报文满足所述第一流表项中的第一匹配条件。
实际操作中， 当转发面设备接收任意一个数据报文时， 所述转发面设备 判断所述数据报文是否来自内网， 和 /或， 判断所述数据报文的源地址字段存 储的私有地址是否属于能够通过 NAT访问外部网络的私有地址范围。
本实施例中的所述第一流表项中的第一匹配条件可以用于指示匹配所述 第一流表项的数据报文为来自内网的报文， 也可以用于指示所述匹配所述第 一流表项的数据报文的源地址字段存储的私有地址属于能够通过 NAT 访问 外部网络的私有地址范围、 还可以用于指示所述匹配所述第一流表项的数据 报文为来自内网的报文且所述数据报文的源地址字段存储的私有地址属于能 够通过 NAT访问外部网络的私有地址范围。
S204： 当确定所述数据报文满足所述第一流表项中的第一匹配条件时， 所述转发面设备执行所述第一流表项中的第一业务逻辑以使所述数据报文的 源地址字段存储的私有地址转换为公有地址。
具体的， 参考图 3， 图 3为本实施例提供的转发面设备执行第一业务逻辑 完成网络地址转换方法的流程图。 其中， 所述方法包括：
5301： 转发面设备判断接收的数据报文是否满足所述第一流表项中的第 一匹配条件。
5302： 当确定所述数据报文满足所述第一流表项中的第一匹配条件时， 所述转发面设备在存储的私有地址和公有地址的对应关系中查询是否存在与 所述数据报文中源地址字段存储的私有地址对应的公有地址。
本实施例中， 当转发面设备确定接收的数据报文满足第一匹配条件时， 所述转发面设备在存储的私有地址和公有地址的对应关系中查询与所述数据 文源地址字段存储的私有地址对应的公有地址。
其中， 私有地址和公有地址的对应关系中的公有地址和私有地址可以利 用数据库表项存储。 具体的， 本实施例在进行网络地址转换之前， 所述控制 面设备指示所述转发面设备预先为所述能够用于 NAT 的公有地址范围内的 全部公有地址或者部分公有地址设置数据库表项， 所述数据库表项包括公有 地址字段和私有地址字段， 所述公有地址字段用于存储公有地址， 所述私有 地址字段用于存储私有地址。 另外， 所述数据库表项还包括用于标识数据库 表项状态的状态标识字段， 通信对端地址， 所述通信对端地址可以包括 IP地 址或者同时包括 IP地址与端口号， 还包括占用开始时间， 用于记录所述公有 地址和私有地址开始占用所述数据库表项的时间。
5303： 当存储的私有地址和公有地址的对应关系中不存在与所述私有地 址对应的公有地址时， 所述转发面设备为所述私有地址分配一未被分配的能 够用于 NAT的公有地址， 并存储所述私有地址和所述公有地址的对应关系。 本实施例中， 当存储的私有地址和公有地址的对应关系中不存在与所述 私有地址对应的公有地址时， 所述转发面设备为所述私有地址分配一个没有 被分配给其他私有地址的能够用于 NAT的公有地址，并存储所述私有地址与 分配的公有地址的对应关系， 以便当所述转发面设备接收到源地址字段存储 所述私有地址的数据 文时， 可以通过该存储的对应关系直接完成网络地址 的转换， 无需执行分配步驟。
S304 : 所述转发面设备利用所述公有地址替换所述数据报文的源地址字 段的内容， 得到待发送第一数据报文， 并将所述待发送第一数据报文发送出 去， 所述待发送第一数据报文的源地址字段存储所述公有地址。
S305 : 当所述转发面设备在存储的私有地址和公有地址的对应关系中查 询到与所述数据^艮文中源地址字段存储的私有地址对应的公有地址时， 所述 转发面设备利用所述公有地址替换所述数据报文的源地址字段的内容， 得到 待发送第一数据报文， 并将所述待发送第一数据报文发送出去， 所述待发送 第一数据报文的源地址字段存储所述公有地址。
本实施例中， 当转发面设备确定接收的数据报文满足第一匹配条件后， 所述转发面设备查询数据库中是否存在私有地址字段存储为所述私有地址的 数据库表项， 如果不存在相应的数据库表项， 则所述转发面设备获取一个状 态标识字段为空闲的数据库表项， 其中， 所述数据库表项的公有地址字段对 应于一个未分配的能够用于 NAT的公有地址。所述转发面设备将所述私有地 址添加到所述数据库表项的私有地址字段， 并将所述数据库表项的状态标识 字段修改为繁忙， 进而利用所述数据库表项中的公有地址完成所述数据报文 的网络地址转换。
如果所述转发面设备获知不存在状态标识字段为空闲的数据库表项， 所 述转发面设备上报至控制面设备， 所述控制面设备指示所述转发面设备调整 数据库表项， 如增加数据库表项以用于公有地址的分配。
如果数据库中存在私有地址字段存储为所述私有地址的数据库表项， 则 所述转发面设备直接利用所述数据库表项的公有地址字段中存储的公有地址 替换所述数据报文的源地址字段的内容完成所述数据报文的网络地址转换。
实际应用中， 转发面设备还可以配置有控制面设备下发的用于处理由外 网发送至内网的数据报文的网络地址转换流表项， 其中， 所述网络地址转换 流表项为第二流表项， 所述第二流表项包括第二匹配条件和第二业务逻辑， 所述第二业务逻辑用于转换来自内网的数据报文的网络地址。
参考图 4， 图 4为本实施例提供的网络地址转换方法流程图， 其中， 所述 方法可以包括：
S401 : 转发面设备接收控制面设备下发的第二流表项， 所述第二流表项 包括第二匹配条件和第二业务逻辑。
S402 : 所述转发面设备接收数据报文。
S403 : 当所述数据报文为来自外网的报文， 和 /或， 所述数据报文的目的 地址字段存储的公有地址属于能够用于 NAT的公有地址范围时，则确定所述 数据 ^¾文满足所述第二流表项中的第二匹配条件。
实际应用中， 当转发面设备接收到任意一个数据报文时， 所述转发面设 备判断所述数据报文是否为来自外网的报文， 和 /或， 所述数据报文的目的地 址字段存储的公有地址是否属于能够用于 NAT的公有地址范围。
其中， 本实施例中的所述第二流表项中的第二匹配条件用于指示匹配所 述第二流表项的数据报文为来自外网的报文， 也可以用于指示所述匹配所述 第二流表项的数据报文的目的地址字段存储的公有地址属于能够用于 NAT 的公有地址范围， 还可以用于指示匹配所述第二流表项的数据报文为来自外 网的报文且所述数据报文的目的地址字段存储的公有地址属于能够用于 NAT 的公有地址范围。
S404 : 当确定所述数据报文满足所述第二流表项中的第二匹配条件时， 所述转发面设备执行所述第二流表项中的第二业务逻辑以使所述数据报文的 目的地址字段存储的公有地址转换为私有地址。
具体的， 参考图 5， 图 5为本实施例提供的转发面设备执行第二业务逻辑 完成网络地址转换方法的流程图。 其中， 所述方法包括：
S501 : 转发面设备判断接收的数据报文是否满足所述第二流表项中的第 二匹配条件。
S502： 当确定所述数据报文满足所述第二流表项中的第二匹配条件时， 所述转发面设备在存储的私有地址和公有地址的对应关系中查询是否存在与 所述数据报文的目的地址字段存储的公有地址对应的私有地址；
S503： 当存储的私有地址和公有地址的对应关系中存在与所述公有地址 对应的私有地址时， 所述转发面设备利用所述私有地址替换所述数据报文的 目的地址字段的内容， 得到待发送第二数据报文， 并将所述待发送第二数据 报文发送出去，所述待发送第二数据报文的目的地址字段存储所述私有地址。
本实施例中， 当转发面设备确定接收的数据报文满足第二匹配条件时， 所述转发面设备在存储的私有地址和公有地址的对应关系中查询与所述数据 报文的目的地址字段存储的公有地址对应的私有地址转换所述数据报文的网 络地址。
本实施例中， 控制面设备预先下发网络地址转换流表项至转发面设备， 使得转发面设备在进行 NAT 转换时不再需要与控制面设备进行多次信令交 换， 提高了网络地址转换效率。
为了进一步提高网络地址转换效率， 本实施例采用快速匹配流表项完成 网络地址转换， 具体的， 本实施例在上述 S302的转发面设备为所述私有地址 分配一未被分配的能够用于 NAT的公有地址步驟之后，所述转发面设备还可 以生成' 1夬速匹配流表项。
具体的，转发面设备为所述私有地址分配一未被分配的能够用于 NAT的 公有地址步驟之后， 所述转发面设备根据所述私有地址和所述私有地址被分 配到的公有地址生成第三流表项和第四流表项中的至少一个快速匹配流表 项， 所述第三流表项和第四流表项均为快速匹配流表项， 其中， 所述第三流 表项包括第三匹配条件和用于将所述数据报文的源地址字段存储的私有地址 转换为所述私有地址分配的公有地址的业务逻辑， 所述第三匹配条件用于指 示匹配所述第三流表项的数据报文的源地址字段存储的私有地址等于一个用 于生成第三流表项的私有地址， 所述第四流表项包括第四匹配条件和用于将 所述数据报文的目的地址字段存储的公有地址转换为所述公有地址对应的私 有地址的业务逻辑， 所述第四匹配条件用于指示匹配所述第四流表项的数据 报文的目的地址字段存储的公有地址等于一个用于生成所述第四流表项的公 有地址， 所述第三流表项的匹配优先级高于所述第一流表项， 所述第四流表 项的匹配优先级高于所述第三流表项。
如果所述转发面设备生成了第三流表项， 本实施例在确定接收的数据报 文是否满足所述第一流表项中的第一匹配条件步驟之前， 首先判断所述数据 报文是否满足所述第三流表项中的第三匹配条件。 其中， 所述第三流表项包 括第三匹配条件和用于将所述数据报文的源地址字段存储的私有地址转换为 所述私有地址分配的公有地址的业务逻辑， 所述第三匹配条件用于指示匹配 所述第三流表项的数据报文的源地址字段存储的私有地址等于一个用于生成 所述第三流表项的私有地址， 或者， 所述第三匹配条件不仅包括上述条件还 同时用于指示所述数据报文为来自内网的报文。 同时， 所述第三流表项的优 先级高于所述第一流表项。
参考图 6，图 6为本实施例提供的转发面设备生成了第三流表项之后的网 络地址转换方法流程图， 具体的， 所述方法可包括：
S601： 所述转发面设备判断接收的数据报文是否满足所述第三流表项中 的第三匹配条件， 如果是， 则进入 S602 , 如果否， 则进入 S603。
本实施例中， 当所述转发面设备接收的数据报文的源地址字段的私有地 址等于一个用于生成第三流表项的私有地址时， 或者当所述数据报文为来自 内网的报文， 且所述数据报文的源地址字段的私有地址等于一个用于生成第 三流表项的私有地址时， 所述转发面设备确定所述数据报文满足所述第三流 表项中的第三匹配条件， 否则， 确定所述数据报文不满足所述第三匹配条件。
S602： 所述转发面设备执行用于将所述数据报文的源地址字段存储的私 有地址转换为所述私有地址分配的公有地址的业务逻辑完成网络地址转换。
当所述转发面设备确定接收的数据报文满足所述第三流表项中的第三匹 配条件时， 所述转发面设备执行所述第三流表项中的用于将所述数据报文的 源地址字段存储的私有地址转换为所述私有地址分配的公有地址的业务逻辑 完成所述数据报文的网络地址转换。 具体的， 所述转发面设备利用与所述数 据报文的源地址字段存储的私有地址对应的公有地址替换所述数据报文的源 地址字段的内容， 得到待发送数据报文， 将所述待发送数据报文发送出去， 所述待发送数据报文的源地址字段存储所述公有地址。
所述转发面设备利用快速匹配流表项完成网络地址转换， 減少了查询网 络地址的次数， 提高了网络地址转换的效率。
S603： 所述转发面设备判断所述数据报文是否满足所述第一流表项中的 第一匹配条件， 如果是， 则进入 S604。
当所述转发面设备确定所述数据报文不满足所述第三流表项中的第三匹 配条件时， 所述转发面设备可以判断接收的数据报文是否满足第一流表项中 的第一匹配条件， 如果满足， 则执行 S604。
S604 : 所述转发面设备执行所述第一业务逻辑以使所述数据报文的源地 址字段存储的私有地址转换为公有地址。
如果所述转发面设备生成了第四流表项， 本实施例在确定接收的数据报 文是否满足所述第二流表项中的第二匹配条件步驟之前， 首先判断所述数据 报文是否满足所述第四流表项中的第四匹配条件。 其中， 所述第四流表项包 括第四匹配条件和用于将所述数据报文的目的地址字段存储的公有地址转换 为所述公有地址对应的私有地址的业务逻辑， 所述第四匹配条件用于指示匹 配所述第四流表项的数据报文的目的地址字段存储的公有地址等于一个用于 生成所述第四流表项的公有地址， 或者， 所述第四匹配条件不仅包括上述条 件还同时用于指示所述数据报文为来自外网的报文。 同时， 所述第四流表项 的优先级高于所述第二流表项。
参考图 7，图 7为本实施例提供的转发面设备生成了第四流表项之后的网 络地址转换方法流程图， 具体的， 所述方法可包括：
S701 : 所述转发面设备判断接收的数据报文是否满足所述第四流表项中 的第四匹配条件， 如果是， 则进入 S702 , 如果否， 则进入 7603。
本实施例中， 当所述转发面设备接收的数据报文的目的地址字段的公有 地址等于一个用于生成所述第三流表项的公有地址时， 或者， 当所述数据报 文为来自外网的报文， 且所述数据报文的目的地址字段的公有地址等于一个 用于生成所述第三流表项的公有地址时， 所述转发面设备确定所述数据报文 满足所述第四流表项中的第四匹配条件， 否则， 确定所述数据报文不满足所 述第四匹配条件。
S702 : 所述转发面设备执行用于将所述数据报文的目的地址字段存储的 公有地址转换为所述公有地址对应的私有地址的业务逻辑完成所述数据 ^艮文 的网络地址转换。
当所述转发面设备确定接收的数据报文满足所述第四流表项中的第四匹 配条件时， 所述转发面设备执行所述第四流表项中的用于将所述数据报文的 目的地址字段存储的公有地址转换为所述公有地址对应的私有地址的业务逻 辑完成所述数据报文的网络地址转换。 具体的， 所述转发面设备利用与所述 数据报文的目的地址字段存储的公有地址对应的私有地址替换所述数据报文 的目的地址字段的内容， 得到待发送数据报文， 将所述待发送数据报文发送 出去， 所述待发送数据报文的目的地址字段存储所述私有地址。
所述转发面设备利用快速匹配流表项完成网络地址转换， 減少了查询网 络地址的次数， 提高了网络地址转换的效率。
S703 : 所述转发面设备判断所述数据报文是否满足所述第二流表项中的 第二匹配条件， 如果是， 则进入 S704。
当所述转发面设备确定所述数据报文不满足所述第四流表项中的第四匹 配条件时， 所述转发面设备可以判断接收的数据报文是否满足第二流表项中 的第二匹配条件， 如果满足， 则执行 S704。
S704 : 所述转发面设备执行所述第二业务逻辑以使所述数据报文的目的 地址字段存储的公有地址转换为私有地址。
实际应用中， 当转发面设备接收到任意一个数据报文后， 首先将所述数 据报文与所述转发面设备生成快速匹配流表项， 即第三流表项和第四流表项 中的匹配条件相匹配， 当匹配成功时， 所述转发面设备直接利用第三流表项 或第四流表项中的业务逻辑完成网络地址转换。 如果匹配失败， 所述转发面 设备可以将所述数据报文与控制面设备下发的第一流表项、 第二流表项中的 匹配条件相匹配， 如果匹配成功， 则所述转发面设备利用第一流表项或第二 流表项中业务逻辑完成网络地址转换。 如果匹配均不成功， 则可以丢弃所述 数据报文， 并产生错误提示上报至所述控制面设备。 本实施例通过在转发面 设备中引入数据库机制为转发面设备提供数据信息的基本存储能力。
实际操作中， 所述控制面设备可以指示所述转发面设备预先为能够用于 NA 的公有地址范围内的全部公有地址或者部分公有地址设置数据库表项。 具体的， 可以根据当前网络地址转换的类型设置数据库表项。
本实施例中， 控制面设备指示转发面设备预先设置数据库表项， 并对所 述数据库表项进行初始化， 具体的， 转发面设备为每个能够用于 NAT的公有 地址在逻辑上设置一条数据库表项。 其中， 每条数据库表项中可以包含如下 属性字段，具体为 "私有地址字段 Private IP/Port,公有地址字段 Public IP/Port
(KEY) , 通信对端地址字段 Peer IP/Port， 状态标识字段， 占用开始时间"， 并以 Public IP/Port字段作为其关键字。
另外， 本实施例中的数据库表项的规模应该由控制面设备决定， 所述控 制面设备可以依据当前需要支持具有外网访问权限的内网用户的数量， 以及 能用于提供 NAT转换的外网 IP数量决定。 一种实施方式中， 所述控制面设 备可以根据能够用于 NAT的公有地址的个数和能够通过 NAT访问外部网络 的私有地址的个数中的较小值确定所述数据库表项的个数。
实际操作中， 数据库表项的建立可以在系统初始化时完成， 并且在控制 面设备认为必要的时候可以任意指示转发面设备增加、 修改或删除若干数据 库表项。 所以， 另一种实现方式中， 当控制面设备无法准确获知需要 NAT的 内网用户数量， 控制面设备可以先指示转发面设备设置若干数量的数据库表 项， 并指示转发面设备在发现无法为新用户获取空闲外网公有地址时上 ¾-至 控制面设备。 当所述控制面设备收到获取数据库表项失败的消息或者需要 NA 的内网用户数量发生变化时， 所述控制面设备可以指示转发面设备再追 加建立一批数据库表项。
由于 NAT类型较多，针对不同的 NAT类型数据库表项的建立通常不同， 如下针对各种 NAT类型的数据库表项设置方法分别说明：
1、 静态 NAT类型： 在转发面设备中所述私有地址和公有地址的对应关 系是固定的。 此时， 所有的公有地址都固定分配给特定用户的私有地址， 其 他用户均不能获得 NAT服务。
设置方法： 控制面设备向转发面设备下发数据库表项时， 逐一在数据库 表项中设置私有 IP地址或者内网端口和与其对应的公有 IP地址或者外网端 口， 并将所有数据库表项均设置为繁忙状态。
2、 全 cone NAT类型： 通常也被称作一对一 （one-to-one) NAT类型， 使用这种 NAT类型可以接收所有外部主机发来的数据包。一旦一个内网端口 映射到外网端口，所有发自该内网端口的数据包都经由该外网端口向外发送。 任意一台外部主机都能通过给该外网端口发送数据包至该内网端口。
设置方法： 控制面设备向转发面设备下发数据库表项时， 仅为每一个待 使用的公有 IP地址或者外网端口设置一条数据库表项， 并设置所有的数据库 表项为状态为空闲， 其它字段置为 null或者 0等初始状态。
3、 限制地址 cone NA 类型： 转发面设备只接收曾经发送到对端的 IP地 址来的数据包。 一旦一个内网端口映射到外网端口， 所有发自该内网端口的 数据包都经由该外网端口向外发送。 任意一台外部主机都能通过向该外网端 口发数据包到达该内网端口， 但是， 其前提是： 该内网端口之前已经发送过 数据包到任意一台外网主机。
设置方法： 数据库表项与全 cone NAT 类型的设置相同， 但该限制地址 cone NA 类型的数据库表项设置中， 将 Peer IP字段也作为数据库查询条件 之一。
4、 限制端口 cone NA 类型： 该 NAT类型只接收曾经发送到对端的 IP 地址和端口的数据包。 与上述受限制地址 cone NA 类型相似，但是该类型增 加了端口限制。 一旦一个内网端口映射到外网端口， 所有发自该内网端口的 数据包都经由该外网端口向外发送。 一个外部主机能够发送数据包到达该内 网端口的前提是： 通过该内网端口之前发送过数据包至该外部主机。
设置方法： 该类型的数据库表项设置方法与全 cone NAT类型相同，但在 该限制端口 cone NA 类型的数据库表项设置中， 将 Peer IP/Port字段也作为 数据库查询条件之一。
5、 对称 NAT类型： 该 NAT类型中， 来自同一私有 IP地址与内网端口 的请求被映射到一个公有 IP地址和外部端口。 来自该公有 IP地址和外部端 口的数据^艮文， 可以通过 NAT网关到达内部主机。
设置方法： 该类型中数据库表项的设置方法与全 cone NAT类型相同，但 在该对称 NAT类型的数据库表项设置中，将目的地址和目标端口也作为数据 库查询条件之一， 并在将 Peer地址和端口字段也作为数据库查询条件之一。
参考图 8， 图 8为本实施例提供的一种网络地址转换方法流程图， 所述方 法包括：
S801： 控制面设备生成网络地址转换流表项；
S802 : 所述控制面设备向转发面设备发送所述网络地址转换流表项； 其中， 所述转发面设备用于报文转发， 所述控制面设备用于控制所述转 发面设备进行报文转发，所述网络地址转换流表项包括匹配条件和业务逻辑， 用于指示所述转发面设备当收到与所述匹配条件匹配的数据报文时， 执行所 述业务逻辑以完成对所述数据报文的网络地址转换。
一种情况下， 所述匹配条件可以用于指示匹配所述网络地址转换流表项 的数据报文为来自内网的报文， 和 /或， 所述匹配所述网络地址转换流表项的 数据报文的源地址字段存储的私有地址属于能够通过 NAT 访问外部网络的 私有地址范围；
所述业务逻辑用以指示将所述匹配所述网络地址转换流表项的数据报文 的源地址字段存储的私有地址转换为公有地址的操作。
另一种情况中， 所述匹配条件可以用于指示匹配所述网络地址转换流表 项的数据报文为来自外网的报文， 和 /或， 所述匹配所述网络地址转换流表项 的数据报文的目的地址字段存储的公有地址属于能够用于 NAT 的公有地址 范围；
所述业务逻辑用以指示将所述匹配所述网络地址转换流表项的数据报文 的目的地址字段存储的公有地址转换为私有地址的操作。
具体的网络地址转换过程可以参照上述实施例的描述， 在此不再赘述。 本实施例中， 转发面设备采用的 openflow协议中定义了一种新的操作类 型， 所述操作类型包括操作匹配条件、 第一指令集和第二指令集。 实际操作 中， 当满足所述操作匹配条件时， 转发面设备执行所述第一指令集， 否则所 述转发面设备执行所述第二指令集。
实际应用中， 控制面设备向转发面设备下发的网络地址转换流表项中的 业务逻辑可以通过 openflow协议中新定义的操作类型实现。
以下以第一流表项中的第一业务逻辑为例， 介绍如何利用上述新的操作 类型实现第一业务逻辑。 具体的， 所述操作类型中的操作匹配条件为在存储 的私有地址和公有地址的对应关系中查询到存在与所述数据^艮文中源地址字 段存储的私有地址对应的公有地址， 当上述匹配条件满足时， 所述转发面设 备执行所述操作类型中的第一指令集， 即利用所述公有地址替换所述数据报 文的源地址字段的内容， 得到待发送第一数据报文， 并将所述待发送第一数 据报文发送出去，所述待发送第一数据报文的源地址字段存储所述公有地址。 如果不满足上述匹配条件， 所述转发面设备执行所述操作类型中的第二指令 集， 即为所述私有地址分配一未被分配的能够用于 NAT的公有地址， 并存储 所述私有地址和所述公有地址的对应关系， 利用所述公有地址替换所述数据 报文的源地址字段的内容， 得到待发送第一数据报文， 并将所述待发送第一 数据报文发送出去， 所述待发送第一数据报文的源地址字段存储所述公有地 址。
实际应用中， 可以使用如下伪代码实现第一流表项中的第一匹配条件和 第一业务逻辑：
Match： In—Port = Private—Port
S_IP in {需要 NAT的内网 IP段}〃第一匹配条件
Instruction： / /第一业务逗辑
II： Apply-Action Existence -Search-DB：
Search-Condition= S_IP/S_Port & DB.忙闲标志 =busy 等等
ActionSet4EXI= {根据对应的 Public_IP/Port设置 S_IP/S_Port}
ActionSet4INE= {从数据库中查找一个 DB.忙闲标志 =idle的表项， 并在对 应的 DB表项中设置：
Figure imgf000021_0001
location]，
DB.Peer_IP/Port<= D_IP/D_Port [type=packet, location]，
DB.忙闲标志 < =busy，
DB.占用开始时间 <=系统当前时间，
S_IP/S_Port<=DB.Public_IP/Port. }
如果找不到标记为空闲的数据库表项， 则根据预设的配置信息来选择丢 掉该报文、 上报 controller或者返回出错信息等动作。
12： Apply-Action Output Public—port。
其中， In_Port 指 4艮文输入的端口， Private_Port 指连接内网的端口号， S_IP/S_Port指^艮文中包含的源 IP/Port， D_IP/D_Port指 ^艮文中包含的目的 IP/Port, DB.*指数据库中相应表项的 *字段。
第一流表项中的 Match部分指示转发面设备选择从内网端口接收数据报 文， 并且所述数据 文来自具有访问外网权限并需要进行 NAT转换的主机， 只有上述条件匹配成功的数据报文才需要后续进行 NAT转换。
随后， 转发面设备在数据库中已经置忙 （DB.忙闲标志=1^ ） 的数据库 表项中搜索 DB.Private_IP/Port (视 NAT 类型不同， 转换过程中涉及到的识 别及改写字域有所不同， 为筒便起见， 相关字域后续筒写为 IP) 等于报文的 源地址的数据库表项。 如果找到， 说明已经为该用户、 访问或者应用 （NAT 转换的对象粒度视不同 NAT类型而有所不同， 为筒便起见， 后续将转换对象 筒写为用户或者对象） 分配了对应的公有地址， 则使用被记录在相应数据库 表项中的公有地址来改写该数据报文的源地址； 如果没有找到， 说明需要为 该用户分配新的公有地址并实施绑定， 此时应从数据库中找到一个空闲的数 据库表项 （其忙闲标志为空闲）， 将其中记录的公有地址分配给该用户， 将该 数据库表项置为 busy, 并修改该数据库表项相应字段的数值， 然后使用新分 配的公有地址修改该数据 文的源地址。如果在数据库中找不到空闲的表项， 表示当前可用的公有地址已经全部被占用， 此时应根据预先设定的策略配置 信息来选择丢弃该数据报文等动作。
当转发面设备进行所述数据报文的 NAT转换后，所述转发面设备从连接 外网的外网端口将转换后的数据报文发出， 完成整个 NAT转换过程。 本实施例中， 可以把上述匹配条件成功和失败所需要执行的第一指令集 和第二指令集分别放到两个 Group中，根据查询结果将报文交给不同的 Group 继续处理即可。上述方法可以使新定义的操作类型中所包含的信息更格式化， 其长度固定也更小， 便于筒化转发面设备的流表项的设计， 不需要去处理非 常长的流表项。 参考图 9， 图 9为本实施例提供的一种网络地址转换装置结构示意图， 其 中， 所述装置配置有控制面设备下发的网络地址转换流表项， 所述网络地址 转换流表项包括匹配条件和业务逻辑， 所述业务逻辑用于网络地址转换， 其 中， 所述控制面设备用于控制所述装置进行报文转发， 所述装置包括：
第一接收模块 901， 用于接收数据报文；
第一转换模块 902，用于当确定所述第一接收模块接收的数据报文满足所 述网络地址转换流表项中的匹配条件时， 执行所述业务逻辑以完成所述数据 报文的网络地址转换。
具体的， 所述装置配置的网络地址转换流表项为第一流表项， 所述第一 流表项包括第一匹配条件和第一业务逻辑；
所述第一转换模块包括第一确定子模块和第一转换子模块，
所述第一确定子模块， 用于当所述第一接收模块接收的数据报文为来自 内网的报文， 和 /或， 所述数据报文的源地址字段存储的私有地址属于能够通 过 NAT访问外部网络的私有地址范围时，则确定所述数据 文满足所述第一 流表项中的第一匹配条件； 所述第一转换子模块， 用于在所述第一确定子模块确定所述数据报文满 足所述第一流表项中的第一匹配条件时， 执行所述第一流表项中的第一业务 逻辑以使所述数据报文的源地址字段存储的私有地址转换为公有地址。
具体的， 所述装置配置的网络地址转换流表项为第二流表项， 所述第二 流表项包括第二匹配条件和第二业务逻辑；
所述第一转换模块包括第二确定子模块和第二转换子模块，
所述第二确定子模块， 用于当所述第一接收模块接收的数据报文为来自 外网的报文， 和 /或， 所述数据报文的目的地址字段存储的公有地址属于能够 用于 NAT的公有地址范围时，则确定所述数据报文满足所述第二流表项中的 第二匹配条件；
所述第二转换子模块， 用于在所述第二确定子模块确定所述数据报文满 足所述第二流表项中的第二匹配条件， 执行所述第二流表项中的第二业务逻 辑以使所述数据报文的目的地址字段存储的公有地址转换为私有地址。
实际应用中， 所述第一转换子模块， 包括：
分配子模块， 用于当存储的私有地址和公有地址的对应关系中不存在与 所述私有地址对应的公有地址时， 为所述私有地址分配一未被分配的能够用 于 NAT的公有地址， 并存储所述私有地址和所述公有地址的对应关系； 第一替换子模块， 用于利用所述公有地址替换所述数据报文的源地址字 段的内容， 得到待发送第一数据报文， 并将所述待发送第一数据报文发送出 去， 所述待发送第一数据报文的源地址字段存储所述公有地址。
另外， 所述第一转换子模块， 还可以包括： 第二替换子模块， 用于当存 储的私有地址和公有地址的对应关系中存在与所述数据报文中源地址字段存 储的私有地址对应的公有地址时， 利用所述公有地址替换所述数据 文的源 地址字段的内容， 得到待发送第一数据报文， 并将所述待发送第一数据报文 发送出去， 所述待发送第一数据报文的源地址字段存储所述公有地址。
具体的， 所述第二转换子模块， 包括： 第三替换子模块， 用于当存储的 私有地址和公有地址的对应关系中存在与所述数据报文的目的地址字段存储 的公有地址对应的私有地址时， 利用所述私有地址替换所述数据 文的目的 地址字段的内容， 得到待发送第二数据报文， 并将所述待发送第二数据报文 发送出去， 所述待发送第二数据报文的目的地址字段存储所述私有地址。 为了提高网络地址转换效率， 所述装置还可以包括：
生成模块， 用于根据所述分配子模块中的私有地址和分配的公有地址生 成第三流表项和 /或第四流表项，所述第三流表项包括所述第三匹配条件和用 于将所述数据报文的源地址字段存储的私有地址转换为所述私有地址分配的 公有地址的业务逻辑， 所述第三匹配条件用于指示匹配所述第三流表项的数 据¾-文的源地址字段的私有地址等于所述私有地址， 或， 所述匹配所述第三 流表项的数据报文为来自内网的报文， 且所述数据报文的源地址字段的私有 地址等于所述私有地址， 所述第四流表项包括所述第四匹配条件和用于将所 述数据报文的目的地址字段存储的公有地址转换为所述公有地址对应的私有 地址的业务逻辑， 所述第四匹配条件用于指示匹配所述第四流表项的数据报 所述第四流表项的数据报文为来自外网的报文， 且所述数据报文的目的地址 字段的公有地址等于所述分配的公有地址， 所述第三流表项的匹配优先级高 于所述第一流表项， 所述第四流表项的匹配优先级高于所述第二流表项。 参考图 10， 图 10为本实施例提供的一种网络地址转换装置结构示意图， 所述装置可以包括：
第一生成模块 1001， 用于生成网络地址转换流表项；
第一发送模块 1002， 用于向转发面设备发送所述网络地址转换流表项； 其中， 所述转发面设备用于报文转发， 所述网络地址转换流表项包括匹 配条件和业务逻辑， 用于指示所述转发面设备当收到与所述匹配条件匹配的 数据报文时， 执行所述业务逻辑以完成对所述数据报文的网络地址转换。
具体的， 所述匹配条件用于指示匹配所述网络地址转换流表项的数据报 文为来自内网的¾-文， 和 /或， 所述匹配所述网络地址转换流表项的数据 ¾-文 的源地址字段存储的私有地址属于能够通过 NAT 访问外部网络的私有地址 范围； 所述业务逻辑用以指示将所述匹配所述网络地址转换流表项的数据报 文的源地址字段存储的私有地址转换为公有地址的操作。
另外， 所述匹配条件还可以用于指示匹配所述网络地址转换流表项的数 据报文为来自外网的报文， 和 /或， 所述匹配所述网络地址转换流表项的数据 报文的目的地址字段存储的公有地址属于能够用于 NAT的公有地址范围；所 述业务逻辑用以指示将所述匹配所述网络地址转换流表项的数据报文的目的 地址字段存储的公有地址转换为私有地址的操作。 进一步地， 本发明实施例还分别提供了智能终端的硬件构成。 可包括至 少一个处理器 （例如 CPU ), 至少一个网络接口或者其他通信接口， 存储器， 和至少一个通信总线， 用于实现这些装置之间的连接通信。 处理器用于执行 存储器中存储的可执行模块， 例如计算机程序。 存储器可能包含高速随机存 取存储器（RAM: Random Access Memory ), 也可能还包括非不稳定的存储 器（ non- volatile memory ), 例如至少一个磁盘存储器。 通过至少一个网络接 口 （可以是有线或者无线） 实现该系统网关与至少一个其他网元之间的通信 连接， 可以使用互联网， 广域网， 本地网， 城域网等。
参见图 9， 在一些实施方式中， 存储器中存储了程序指令， 程序指令可 以被处理器执行， 具体实现可参见图 8所揭示的相应单元， 这里不再赘述。
通过以上的实施方式的描述可知， 本领域的技术人员可以清楚地了解到 上述实施例方法中的全部或部分步驟可借助软件加必需的通用硬件平台的方 式来实现。 基于这样的理解， 本发明的技术方案本质上或者说对现有技术做 出贡献的部分可以以软件产品的形式体现出来， 该计算机软件产品可以存储 在存储介质中， 如 ROM/RAM、 磁碟、 光盘等， 包括若干指令用以使得一台 计算机设备 （可以是个人计算机， 服务器， 或者诸如媒体网关等网络通信设 备， 等等） 执行本发明各个实施例或者实施例的某些部分所述的方法。 实施例之间相同相似的部分互相参见即可， 每个实施例重点说明的都是与其 他实施例的不同之处。 尤其， 对于设备及系统实施例而言， 由于其基本相似 于方法实施例， 所以描述得比较筒单， 相关之处参见方法实施例的部分说明 即可。 以上所描述的设备及系统实施例仅仅是示意性的， 其中作为分离部件 是或者也可以不是物理单元， 即可以位于一个地方， 或者也可以分布到多个 网络单元上。 可以根据实际的需要选择其中的部分或者全部模块来实现本实 施例方案的目的。 本领域普通技术人员在不付出创造性劳动的情况下， 即可 以理解并实施。 以上所述仅为本发明的较佳实施例而已， 并非用于限定本发明的保护范 围。 凡在本发明的精神和原则之内所作的任何修改、 等同替换、 改进等， 均 包含在本发明的保护范围内。

Claims

权 利 要 求
1、 一种网络地址转换方法， 其特征在于， 包括：
转发面设备接收数据报文， 所述转发面设备配置有控制面设备下发的网 络地址转换流表项， 所述网络地址转换流表项包括匹配条件和业务逻辑， 所 述业务逻辑用于网络地址转换； 其中， 所述转发面设备用于报文转发， 所述 控制面设备用于控制所述转发面设备进行报文转发；
当确定所述数据报文满足所述网络地址转换流表项中的匹配条件时， 所 述转发面设备执行所述业务逻辑以完成所述数据报文的网络地址转换。
2、 根据权利要求 1所述的方法， 其特征在于， 所述网络地址转换流表项 为第一流表项， 所述第一流表项包括第一匹配条件和第一业务逻辑；
所述确定所述数据报文满足所述网络地址转换流表项中的匹配条件， 包 括：
当所述数据报文为来自内网的报文， 和 /或， 所述数据报文的源地址字段 存储的私有地址属于能够通过 NAT访问外部网络的私有地址范围时，则确定 所述数据报文满足所述第一流表项中的第一匹配条件；
所述转发面设备执行所述业务逻辑完成所述数据报文的网络地址转换， 包括：
所述转发面设备执行所述第一流表项中的第一业务逻辑以使所述数据报 文的源地址字段存储的私有地址转换为公有地址。
3、 根据权利要求 1所述的方法， 其特征在于， 所述网络地址转换流表项 为第二流表项， 所述第二流表项包括第二匹配条件和第二业务逻辑；
所述确定所述数据报文满足所述网络地址转换流表项中的匹配条件， 包 括：
当所述数据报文为来自外网的报文， 和 /或， 所述数据报文的目的地址字 段存储的公有地址属于能够用于 NAT的公有地址范围时，则确定所述数据报 文满足所述第二流表项中的第二匹配条件；
所述转发面设备执行所述业务逻辑完成所述数据报文的网络地址转换， 包括：
所述转发面设备执行所述第二流表项中的第二业务逻辑以使所述数据报 文的目的地址字段存储的公有地址转换为私有地址。
4、 根据权利要求 2所述的方法， 其特征在于， 所述转发面设备执行所述 第一业务逻辑以使所述数据报文的源地址字段存储的私有地址转换为公有地 址， 包括：
当存储的私有地址和公有地址的对应关系中不存在与所述私有地址对应 的公有地址时， 所述转发面设备为所述私有地址分配一未被分配的能够用于 NA 的公有地址， 并存储所述私有地址和所述公有地址的对应关系；
所述转发面设备利用所述公有地址替换所述数据报文的源地址字段的内 容， 得到待发送第一数据报文， 并将所述待发送第一数据报文发送出去， 所 述待发送第一数据报文的源地址字段存储所述公有地址。
5、 根据权利要求 2所述的方法， 其特征在于， 所述转发面设备执行所述 第一业务逻辑以使所述数据报文的源地址字段存储的私有地址转换为公有地 址， 包括： 当存储的私有地址和公有地址的对应关系中存在与所述数据报文 中源地址字段存储的私有地址对应的公有地址时， 所述转发面设备利用所述 公有地址替换所述数据报文的源地址字段的内容，得到待发送第一数据报文， 并将所述待发送第一数据报文发送出去， 所述待发送第一数据报文的源地址 字段存储所述公有地址。
6、 根据权利要求 3所述的方法， 其特征在于， 所述转发面设备执行所述 第二业务逻辑以使所述数据报文的目的地址字段存储的公有地址转换为私有 地址， 包括：
当存储的私有地址和公有地址的对应关系中存在与所述数据报文的目的 地址字段存储的公有地址对应的私有地址时， 所述转发面设备利用所述私有 地址替换所述数据报文的目的地址字段的内容， 得到待发送第二数据报文， 并将所述待发送第二数据报文发送出去， 所述待发送第二数据报文的目的地 址字段存储所述私有地址。
7、 根据权利要求 4所述的方法， 其特征在于， 所述转发面设备为所述私 有地址分配一未被分配的能够用于 NAT的公有地址之后， 还包括：
所述转发面设备根据所述私有地址和分配的公有地址生成第三流表项和 /或第四流表项，所述第三流表项包括第三匹配条件和用于将所述数据报文的 源地址字段存储的私有地址转换为所述私有地址分配的公有地址的业务逻 辑， 所述第三匹配条件用于指示匹配所述第三流表项的数据报文的源地址字 段的私有地址等于所述私有地址， 或， 所述匹配所述第三流表项的数据报文 为来自内网的报文， 且所述数据报文的源地址字段的私有地址等于所述私有 地址， 所述第四流表项包括第四匹配条件和用于将所述数据报文的目的地址 字段存储的公有地址转换为所述公有地址对应的私有地址的业务逻辑， 所述 第四匹配条件用于指示匹配所述第四流表项的数据报文的目的地址字段存储 的公有地址等于所述分配的公有地址， 或， 所述匹配所述第四流表项的数据 报文为来自外网的报文， 且所述数据报文的目的地址字段的公有地址等于所 述分配的公有地址， 所述第三流表项的匹配优先级高于所述第一流表项， 所 述第四流表项的匹配优先级高于所述第二流表项。
8、 一种网络地址转换方法， 其特征在于， 包括：
控制面设备生成网络地址转换流表项；
所述控制面设备向转发面设备发送所述网络地址转换流表项；
其中， 所述转发面设备用于报文转发， 所述控制面设备用于控制所述转 发面设备进行报文转发，所述网络地址转换流表项包括匹配条件和业务逻辑， 用于指示所述转发面设备当收到与所述匹配条件匹配的数据报文时， 执行所 述业务逻辑以完成对所述数据报文的网络地址转换。
9、 根据权利要求 8所述的方法， 其特征在于，
所述匹配条件用于指示匹配所述网络地址转换流表项的数据报文为来自 内网的 文， 和 /或， 所述匹配所述网络地址转换流表项的数据 文的源地址 字段存储的私有地址属于能够通过 NAT访问外部网络的私有地址范围；
所述业务逻辑用以指示将所述匹配所述网络地址转换流表项的数据报文 的源地址字段存储的私有地址转换为公有地址的操作。
10、 根据权利要求 8所述的方法， 其特征在于，
所述匹配条件用于指示匹配所述网络地址转换流表项的数据报文为来自 外网的报文， 和 /或， 所述匹配所述网络地址转换流表项的数据报文的目的地 址字段存储的公有地址属于能够用于 NAT的公有地址范围；
所述业务逻辑用以指示将所述匹配所述网络地址转换流表项的数据报文 的目的地址字段存储的公有地址转换为私有地址的操作。
11、 一种网络地址转换装置， 其特征在于， 所述装置配置有控制面设备 下发的网络地址转换流表项， 所述网络地址转换流表项包括匹配条件和业务 逻辑， 所述业务逻辑用于网络地址转换， 其中， 所述控制面设备用于控制所 述装置进行报文转发， 所述装置包括：
第一接收模块， 用于接收数据报文；
第一转换模块， 用于当确定所述第一接收模块接收的数据报文满足所述 网络地址转换流表项中的匹配条件时， 执行所述业务逻辑以完成所述数据报 文的网络地址转换。
12、 根据权利要求 11所述的装置， 其特征在于， 所述装置配置的网络地 址转换流表项为第一流表项， 所述第一流表项包括第一匹配条件和第一业务 逻辑；
所述第一转换模块包括第一确定子模块和第一转换子模块，
所述第一确定子模块， 用于当所述第一接收模块接收的数据报文为来自 内网的报文， 和 /或， 所述数据报文的源地址字段存储的私有地址属于能够通 过 NAT访问外部网络的私有地址范围时，则确定所述数据 文满足所述第一 流表项中的第一匹配条件；
所述第一转换子模块， 用于在所述第一确定子模块确定所述数据报文满 足所述第一流表项中的第一匹配条件时， 执行所述第一流表项中的第一业务 逻辑以使所述数据报文的源地址字段存储的私有地址转换为公有地址。
13、 根据权利要求 11所述的装置， 其特征在于， 所述装置配置的网络地 址转换流表项为第二流表项， 所述第二流表项包括第二匹配条件和第二业务 逻辑；
所述第一转换模块包括第二确定子模块和第二转换子模块，
所述第二确定子模块， 用于当所述第一接收模块接收的数据报文为来自 外网的报文， 和 /或， 所述数据报文的目的地址字段存储的公有地址属于能够 用于 NAT的公有地址范围时，则确定所述数据报文满足所述第二流表项中的 第二匹配条件；
所述第二转换子模块， 用于在所述第二确定子模块确定所述数据报文满 足所述第二流表项中的第二匹配条件， 执行所述第二流表项中的第二业务逻 辑以使所述数据报文的目的地址字段存储的公有地址转换为私有地址。
14、 根据权利要求 12所述的装置， 其特征在于， 所述第一转换子模块， 包括： 分配子模块， 用于当存储的私有地址和公有地址的对应关系中不存在与 所述私有地址对应的公有地址时， 为所述私有地址分配一未被分配的能够用 于 NAT的公有地址， 并存储所述私有地址和所述公有地址的对应关系； 第一替换子模块， 用于利用所述公有地址替换所述数据报文的源地址字 段的内容， 得到待发送第一数据报文， 并将所述待发送第一数据报文发送出 去， 所述待发送第一数据报文的源地址字段存储所述公有地址。
15、 根据权利要求 12所述的装置， 其特征在于， 所述第一转换子模块， 包括： 第二替换子模块， 用于当存储的私有地址和公有地址的对应关系中存 在与所述数据报文中源地址字段存储的私有地址对应的公有地址时， 利用所 述公有地址替换所述数据报文的源地址字段的内容， 得到待发送第一数据报 文， 并将所述待发送第一数据报文发送出去， 所述待发送第一数据报文的源 地址字段存储所述公有地址。
16、 根据权利要求 13所述的装置， 其特征在于， 所述第二转换子模块， 包括： 第三替换子模块， 用于当存储的私有地址和公有地址的对应关系中存 在与所述数据报文的目的地址字段存储的公有地址对应的私有地址时， 利用 所述私有地址替换所述数据报文的目的地址字段的内容， 得到待发送第二数 据报文， 并将所述待发送第二数据报文发送出去， 所述待发送第二数据报文 的目的地址字段存储所述私有地址。
17、 根据权利要求 14所述的装置， 其特征在于， 所述装置还包括： 生成模块， 用于根据所述分配子模块中的私有地址和分配的公有地址生 成第三流表项和 /或第四流表项，所述第三流表项包括所述第三匹配条件和用 于将所述数据报文的源地址字段存储的私有地址转换为所述私有地址分配的 公有地址的业务逻辑， 所述第三匹配条件用于指示匹配所述第三流表项的数 据¾-文的源地址字段的私有地址等于所述私有地址， 或， 所述匹配所述第三 流表项的数据报文为来自内网的报文， 且所述数据报文的源地址字段的私有 地址等于所述私有地址， 所述第四流表项包括所述第四匹配条件和用于将所 述数据报文的目的地址字段存储的公有地址转换为所述公有地址对应的私有 地址的业务逻辑， 所述第四匹配条件用于指示匹配所述第四流表项的数据报 所述第四流表项的数据报文为来自外网的报文， 且所述数据报文的目的地址 字段的公有地址等于所述分配的公有地址， 所述第三流表项的匹配优先级高 于所述第一流表项， 所述第四流表项的匹配优先级高于所述第二流表项。
18、 一种网络地址转换装置， 其特征在于， 所述装置包括：
第一生成模块， 用于生成网络地址转换流表项；
第一发送模块， 用于向转发面设备发送所述网络地址转换流表项； 其中， 所述转发面设备用于报文转发， 所述网络地址转换流表项包括匹 配条件和业务逻辑， 用于指示所述转发面设备当收到与所述匹配条件匹配的 数据报文时， 执行所述业务逻辑以完成对所述数据报文的网络地址转换。
PCT/CN2014/078869 2014-05-30 2014-05-30 一种网络地址转换方法及装置 WO2015180113A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201480008216.0A CN105556906A (zh) 2014-05-30 2014-05-30 一种网络地址转换方法及装置
PCT/CN2014/078869 WO2015180113A1 (zh) 2014-05-30 2014-05-30 一种网络地址转换方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/078869 WO2015180113A1 (zh) 2014-05-30 2014-05-30 一种网络地址转换方法及装置

Publications (1)

Publication Number Publication Date
WO2015180113A1 true WO2015180113A1 (zh) 2015-12-03

Family

ID=54697892

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/078869 WO2015180113A1 (zh) 2014-05-30 2014-05-30 一种网络地址转换方法及装置

Country Status (2)

Country Link
CN (1) CN105556906A (zh)
WO (1) WO2015180113A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112118129A (zh) * 2020-08-24 2020-12-22 烽火通信科技股份有限公司 一种基于业务流的故障定位方法和装置

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109525518B (zh) * 2018-12-25 2021-01-12 北京物芯科技有限责任公司 一种基于fpga的ip报文网络地址转换方法及装置
CN111314497B (zh) * 2020-01-20 2022-03-11 广州芯德通信科技股份有限公司 一种同时支持多种nat类型生效方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102546405A (zh) * 2011-12-27 2012-07-04 华为技术有限公司 协议栈的业务处理方法及装置
CN102739549A (zh) * 2012-07-13 2012-10-17 华为技术有限公司 接收报文的方法、发送报文的方法及装置
CN103067534A (zh) * 2012-12-26 2013-04-24 中兴通讯股份有限公司 一种NAT实现系统、方法及Openflow交换机
WO2013104375A1 (en) * 2012-01-09 2013-07-18 Telefonaktiebolaget L M Ericsson (Publ) Network device control in a software defined network
CN103493439A (zh) * 2012-04-12 2014-01-01 华为技术有限公司 接收信息的方法、发送信息的方法及装置
CN103747026A (zh) * 2013-10-29 2014-04-23 盛科网络（苏州）有限公司 openflow流表的告警方法及告警装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101079798A (zh) * 2006-05-26 2007-11-28 华为技术有限公司 网络地址转换方法及实现访问控制列表的方法
CN102685006A (zh) * 2012-05-03 2012-09-19 中兴通讯股份有限公司 一种转发数据报文的方法及装置
CN104040966B (zh) * 2012-11-09 2017-04-26 华为技术有限公司 处理报文的方法、转发面装置及网络设备
CN103731370B (zh) * 2013-12-30 2016-07-13 浙江大学 有效降低域内重构过程中网络丢包率的交换机缓存方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102546405A (zh) * 2011-12-27 2012-07-04 华为技术有限公司 协议栈的业务处理方法及装置
WO2013104375A1 (en) * 2012-01-09 2013-07-18 Telefonaktiebolaget L M Ericsson (Publ) Network device control in a software defined network
CN103493439A (zh) * 2012-04-12 2014-01-01 华为技术有限公司 接收信息的方法、发送信息的方法及装置
CN102739549A (zh) * 2012-07-13 2012-10-17 华为技术有限公司 接收报文的方法、发送报文的方法及装置
CN103067534A (zh) * 2012-12-26 2013-04-24 中兴通讯股份有限公司 一种NAT实现系统、方法及Openflow交换机
CN103747026A (zh) * 2013-10-29 2014-04-23 盛科网络（苏州）有限公司 openflow流表的告警方法及告警装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112118129A (zh) * 2020-08-24 2020-12-22 烽火通信科技股份有限公司 一种基于业务流的故障定位方法和装置
CN112118129B (zh) * 2020-08-24 2022-08-12 烽火通信科技股份有限公司 一种基于业务流的故障定位方法和装置

Also Published As

Publication number Publication date
CN105556906A (zh) 2016-05-04

Similar Documents

Publication Publication Date Title
WO2019096050A1 (zh) 数据传输方法、装置、设备及可读取存储介质
CA2968964C (en) Source ip address transparency systems and methods
US9571382B2 (en) Method, controller, and system for processing data packet
WO2014101777A1 (zh) 流表匹配方法和装置以及交换机
WO2014190791A1 (zh) 一种网关设备身份设置的方法及管理网关设备
US9602428B2 (en) Method and apparatus for locality sensitive hash-based load balancing
WO2015149563A1 (zh) 通信方法、系统、资源池管理系统、交换机和控制装置
US10742697B2 (en) Packet forwarding apparatus for handling multicast packet
WO2014015664A1 (zh) 一种通信方法和系统
WO2015180040A1 (zh) 流表管理方法及相关设备和系统
WO2017133647A1 (zh) 一种报文处理方法、流分类器和业务功能实例
WO2016206511A1 (zh) 一种实现nat的方法和装置
WO2014154040A1 (zh) 访问控制方法及设备、系统
TWI661698B (zh) 轉發乙太網路封包的方法和裝置
WO2010139238A1 (zh) 实现强制mac转发功能的方法和装置
WO2011120370A1 (zh) 一种建立fcoe通信连接的方法、装置、名字服务器和系统
WO2016134624A1 (zh) 路由方法、装置及系统、网关调度方法及装置
WO2014079005A1 (zh) Mac地址强制转发装置及方法
WO2016184283A1 (zh) 一种虚拟机数据流管理方法和系统
WO2011157126A2 (zh) 一种报文转发方法和网间路由装置
WO2024093064A1 (zh) 一种大规模多模态网络中标识管理及优化转发方法和装置
JP2021530158A (ja) Ｂｇｐメッセージ送信方法、ｂｇｐメッセージ受信方法、及びデバイス
WO2014070590A1 (en) Otv scaling using site virtual mac addresses
US10581740B2 (en) Packet forwarding method and related apparatus
WO2011107052A2 (zh) 一种防止地址冲突的方法及接入节点

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 201480008216.0

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14893468

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14893468

Country of ref document: EP

Kind code of ref document: A1