WO2018176272A1 - 处理报文的方法和装置 - Google Patents

处理报文的方法和装置 Download PDF

Info

Publication number
WO2018176272A1
WO2018176272A1 PCT/CN2017/078608 CN2017078608W WO2018176272A1 WO 2018176272 A1 WO2018176272 A1 WO 2018176272A1 CN 2017078608 W CN2017078608 W CN 2017078608W WO 2018176272 A1 WO2018176272 A1 WO 2018176272A1
Authority
WO
WIPO (PCT)
Prior art keywords
rule
service flow
packet
nsh
flow packet
Prior art date
Application number
PCT/CN2017/078608
Other languages
English (en)
French (fr)
Inventor
倪慧
李永翠
高晓峰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2017/078608 priority Critical patent/WO2018176272A1/zh
Priority to EP17902970.7A priority patent/EP3589024A4/en
Priority to CN201780088660.1A priority patent/CN110431885B/zh
Publication of WO2018176272A1 publication Critical patent/WO2018176272A1/zh
Priority to US16/585,454 priority patent/US20200028779A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/30—Routing of multiclass traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing

Definitions

  • the present application relates to the field of communications and, more particularly, to a method and apparatus for processing messages.
  • the Service Function Chain is a network technology currently being researched and standardized.
  • the Network Service Header (NSH) is an application protocol for implementing SFC.
  • the NSH is used to describe the network service information carried by the Header along the data path (Service Path, SP), which is intended to be independent of transmission. "Service Plane”.
  • the packet returned by the SF device received by the SP device is a protocol layer packet without NSH, for example, a network layer packet, a transport layer packet, or an application layer packet.
  • the SP device needs to restore the NSH header by matching the protocol layer header feature, and forward the processed protocol layer packet to the Service Function Forwarder (SFF).
  • SFF Service Function Forwarder
  • the packet header feature of the protocol layer in the same service chain is dynamically changed. Therefore, the SP device needs to report the service flow packet from the SF device to the SFC controller to obtain the forwarding rule for restoring the NSH. This results in a large amount of signaling overhead between the SFC controller and the SP device, and cannot meet the requirements for real-time processing of packets.
  • the embodiment of the present invention provides a method and an apparatus for processing a message, which are beneficial to reducing the overhead of control signaling.
  • the first aspect provides a method for processing a packet, where the method includes: the forwarding device receives a first rule from a service function chain controller, where the first rule includes a matching domain, and the matching domain is a network service header. And the forwarding device receives the first service flow packet, and matches the packet header feature of the first service flow packet with the matching domain of the first rule; if the first service flow packet is The packet header feature is successfully matched with the matching domain of the first rule, and the forwarding device creates a second rule and a third rule according to the first rule, where the second rule and the third rule have a high priority In the first rule.
  • the rules mentioned in the embodiments of the present application may refer to a specific rule, and may also refer to a type of rule.
  • the first rule may include multiple specific rules.
  • the first rule may also include more specific rules, as are the second rule and the third rule.
  • the forwarding device is an SFF or an SP device, and the forwarding device has the capability of creating a rule, and the forwarding device may create a second rule and a third rule according to the first rule delivered by the SFC controller, thereby
  • the service flow packet from the SFF, the SF device, or the classifier can be processed according to the second rule and the third rule, and the corresponding rule is not obtained by reporting the SFC controller each time, and then the packet is implemented according to the rule delivered by the SFC. Therefore, it is advantageous to reduce the overhead of control signaling.
  • a large number of forwarding rules are not stored on the forwarding device, thereby reducing the storage overhead of the forwarding device.
  • the matching domain of the first rule further includes a protocol layer header feature.
  • the matching domain of the second rule is an NSH
  • the method further includes: The forwarding device receives the second service flow packet from the service function forwarder SFF or the classifier, and matches the packet header feature of the second service flow packet with the matching domain of the second rule, where the second service The packet header feature of the flow packet includes an NSH; if the packet header feature of the second service flow packet matches the matching domain of the second rule, the action of the second rule is performed: removing the The NSH of the service flow packet is forwarded to the service function SF device.
  • the message from the classifier or the SFF is a service flow message including the NSH, and the matching field of the second rule is an NSH, and the forwarding device can process the message from the SFF or the classifier according to the second rule.
  • the matching domain of the second rule further includes a protocol layer header feature.
  • the matching domain of the third rule is a packet header feature
  • the method further includes:
  • the forwarding device receives a third service flow packet from the SF device,
  • the action of the third rule is performed: adding an NSH to the third service flow packet.
  • the packet from the SF device is a protocol layer packet that does not include the NSH, and the matching field of the third rule is a protocol layer header feature, and the forwarding device can process the packet from the SF device according to the third rule.
  • the forwarding device is an SFF
  • the method further includes:
  • the forwarding device is an SP device, and the method further includes:
  • the third service flow packet with the added NSH is forwarded to the SFF.
  • the first service flow message, the second service flow message, and the third service flow message belong to the same service flow.
  • an apparatus for processing a message comprising means for performing the method of the first aspect or various implementations thereof.
  • an apparatus for processing a message includes a processor, a memory, a first network interface, a second network interface, and a third network interface.
  • the first network interface, the second network interface, the third network interface, a communication connection between the processor and the memory the memory is for storing a program
  • the processor is configured to execute a program, when the program is executed, The processor executes the method of the first aspect based on the first network interface, the second network interface, and the third network interface.
  • a fourth aspect a system for processing a message, comprising: a device for processing a data message and a control device provided by the second aspect, wherein the control device is configured to send a first rule to the device that processes the message, where The matching field of the first rule is the network service header NSH.
  • a computer readable medium storing program code for execution by a computer, the program code comprising instructions for performing the method of the first aspect.
  • a computer program product comprises program code executable by a computer, the program code comprising instructions for performing the method of the first aspect.
  • the forwarding device may generate two second rules and a third rule with higher priority according to the first rule sent by the service function chain SFC controller, thereby The service flow message from the classifier, the SFF or the SF device may be processed according to the second rule and the third rule. Therefore, the forwarding device does not need to obtain the rule for restoring the NSH by reporting the SFC controller, thereby facilitating Reduce the overhead of control signaling.
  • FIG. 1 is a schematic diagram of an example of a network architecture applicable to an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a method for processing a message according to an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a method for processing a message according to an embodiment of the present application when the forwarding device is an SP device;
  • FIG. 4 is a flowchart of an example of a method for processing a message according to an embodiment of the present application when the forwarding device is an SP device;
  • FIG. 5 is a schematic flowchart of a method for processing a message according to an embodiment of the present application when the forwarding device is an SFF device;
  • FIG. 6 is a flowchart of an example of a method for processing a message according to an embodiment of the present application when the forwarding device is an SFF device;
  • FIG. 7 is a schematic block diagram of an apparatus for processing a data message according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a hardware implementation of an apparatus for processing a data message according to an embodiment of the present application.
  • FIG. 9 is a schematic block diagram of a system for processing data messages in accordance with an embodiment of the present application.
  • FIG. 1 is a schematic diagram of a network architecture applicable to an embodiment of the present application. It should be understood that the network architecture shown in FIG. 1 is only for helping a person skilled in the art to better understand the embodiment of the present application, and does not limit the present application. The scope of the examples.
  • the network architecture includes:
  • the SFC controller is configured to construct a service function path (SFP), and deliver path information to a node (such as a classifier or an SFF) on the service function path, for example, the path message includes a classification rule, a forwarding rule, and the like;
  • SFP service function path
  • a node such as a classifier or an SFF
  • a classifier is used to classify the service flow according to the classification rule, and transfer it to the corresponding service function path for processing;
  • the SFF is used to forward service flow packets according to the forwarding rule.
  • the SFF may be a physical or virtual forwarding device such as a router or a switch.
  • the SP device is used to implement support for the SFC when the SF does not support the SFC.
  • the SF device is a service function for performing value-added service processing on the service flow.
  • the SF device may be a virtual element or a functional entity embedded in the physical network device. For example, firewall, deep packet inspection (DPI), network address translation (NAT), or load balancing (LB).
  • DPI deep packet inspection
  • NAT network address translation
  • LB load balancing
  • the process of processing a service flow message is as follows: the SFC controller constructs a service function path, and the service function path is an ordered set of service functions. After the service flow message is classified by the classifier, it is forwarded by SFF.
  • the SF devices in the SFP are traversed to implement processing of service flow packets.
  • the service path identifier SPI
  • SPI service index
  • an SFP is Firewall->DPI- > QoS
  • SPI is 1
  • the initial value of the SI is 3.
  • the SI becomes 2, and so on.
  • the QoS process completes the message the SI becomes 0, and the service flow packet is processed.
  • the SP device needs to perform the NSH header processing on the service flow packets sent to the SF device, and add the NSH header processing to the service flow packets from the SF device.
  • SP device from SF device The received service flow packet is a protocol layer packet without NSH, for example, a network layer (or L3) packet, a transport layer (or L4) packet, or an application layer (or L7) packet.
  • the SP device matches the protocol layer header feature (or the protocol layer header feature) with the forwarding rule of the SP device to restore the NSH packet header and forward the processed service flow packet to the SFF, but the same
  • the protocol layer header feature of a service function path is dynamically changed. Therefore, the forwarding rules on the SP device need to cover all protocol layer header characteristics.
  • the SFC controller is reported to obtain the forwarding rule for restoring the NSH. This causes a large amount of signaling overhead between the SFC controller and the SP device, and cannot meet the requirements for real-time processing of the packet.
  • the embodiment of the present application provides a method for processing a packet, and the forwarding device may generate two second rules and a third rule with higher priority according to the first rule sent by the SFC controller, where the forwarding is performed.
  • the device may process the service flow message from the classifier, the SFF or the SF device according to the second rule and the third rule, so that the forwarding device does not need to obtain the rule for restoring the NSH by reporting the SFC controller, thereby facilitating Reduce the overhead of control signaling.
  • the forwarding device has the capability of creating a rule
  • the forwarding device may be an SP device, or the forwarding device may also be an SFF, and the SFF in this case is equivalent to the combination of the SFF and the SP device.
  • the forwarding device may be an SP device, the SP device has the ability to create rules, and the SFF2 device does not have the ability to create rules.
  • the forwarding device may be an SFF1 device, and the SFF1 device has the capability of creating rules.
  • the function of the SFF1 device at this time is equivalent to that of the SFF2 device and the SP device.
  • a collection of features or, the actual scenario includes multiple SFFs, and some of the multiple SFFs may have the ability to create rules, and another part does not have the ability to create rules.
  • the SFF1 device has the ability to create rules, and the SFF2 device does not have the creation rule. ability.
  • FIG. 2 is a schematic flowchart of a method for processing a message according to an embodiment of the present application.
  • the method 200 of FIG. 2 may be performed by a forwarding device, for example, an SFF or SP device, as shown in FIG. 2, the method includes:
  • the forwarding device receives the first rule from the service function chain controller, where the first rule includes a matching domain, and the matching domain is a network service header NSH;
  • the forwarding device receives the first service flow packet, and matches the packet header feature of the first service flow packet with the matching domain of the first rule.
  • the forwarding device creates a second rule and a third rule according to the first rule.
  • the second rule and the third rule have higher priority than the first rule.
  • the SFC controller first constructs a service function path, and sends a corresponding rule to the network element on the service function path.
  • the SFC controller sends a first rule to the forwarding device, where the matching domain of the first rule is an NSH.
  • the matching domain of the first rule may further include a protocol layer header. feature.
  • the forwarding device may receive a first service flow message from the classifier or the SFF, where the first service flow message belongs to a service flow, and the service function path is used to indicate a forwarding path of the service flow.
  • the first service flow packet is a service flow packet of the service flow at a processing location of the service function path.
  • the forwarding device may match the packet header feature of the first service flow packet with the matching domain of the first rule, if the first service flow
  • the packet header feature of the packet matches the matching domain of the first rule
  • the forwarding device performs an action: creating a second rule and a third rule, and Transferring to the second rule or the third rule to process the first service flow message, wherein the second rule and the third rule have a higher priority than the first rule,
  • the second rule and the third rule are used to process the service flow message according to the second rule or the third rule preferentially when the forwarding device subsequently receives the service flow message.
  • the forwarding device may first send the packet header feature of the second service flow packet to the second rule, because the priority of the second rule and the third rule is higher than the first rule.
  • the matching field of the rule is matched. If the matching is successful, the second service flow packet is processed according to the action of the second rule. If the matching fails, the packet header of the second service flow packet is further processed. The feature is matched with the matching domain of the third rule. If the matching is successful, the second service flow packet is processed according to the action of the third rule.
  • the forwarding device may first match the packet header feature of the second service flow packet with the matching domain of the third rule, and then select the packet header feature of the second service flow packet. Matching with the matching domain of the second rule, the matching domain of the second rule and the third rule is used by the forwarding device in the embodiment of the present application, and the second service flow packet is used.
  • the matching of the header features of the packet header is not limited.
  • the forwarding device may continue to match the forwarding device.
  • Other rules if the matching domain of a certain rule is successfully matched, the action of the rule is performed, for example, if the packet header feature of the second service flow packet is related to the second rule and the third rule If the matching domain does not match, the forwarding device continues to match the matching domain of the other rules in the forwarding device. If the matching domain of the first rule is successfully matched, the action of the first rule is performed. If the matching domain of each rule in the forwarding device does not match, the forwarding device may discard the second service flow packet, or may forward the second service flow packet to the SFC controller. The SFC controller determines how to process the second traffic flow message.
  • the forwarding device may further determine whether to match the second rule or the third rule according to a header feature of the service flow message. For example, if the service flow message is an NSH message, the forwarding device determines to match the second rule. When the service flow packet is an L3/L4/L7 packet, it is determined that the third rule is matched. For example, the forwarding device receives the second service flow packet, and the second service flow packet is an NSH packet, and the forwarding device matches the packet header feature of the second service flow packet with the matching domain of the second rule. If the success is successful, the second service flow packet is processed according to the action of the second rule. If the matching fails, the forwarding device discards the second service flow message or reports the SFC controller.
  • the service flow message is an NSH message
  • the forwarding device determines to match the second rule.
  • the service flow packet is an L3/L4/L7 packet
  • the forwarding device matches the packet header feature of the second service flow packet with the matching domain of the second rule. If the success is successful, the
  • the forwarding device receives the second service flow packet, and the second service flow packet is a protocol layer packet, and the forwarding device matches the packet header feature of the second service flow packet with the matching domain of the third rule. If the matching succeeds, the second service flow packet is processed according to the action of the third rule. If the matching fails, the forwarding device discards the second service flow message or reports the SFC controller.
  • the rules mentioned in the embodiments of the present application may refer to a specific rule, and may also refer to a type of rule.
  • the first rule may include multiple specific rules.
  • the first rule may further include more specific rules, and the same is also the case for the second rule and the third rule, and details are not described herein again.
  • the forwarding device may further determine that the first service flow packet is in the service function path. Processing location.
  • the processing location of the first service flow packet on the service function path may be determined according to the SI. If the SI is not zero, the processing location of the service flow packet may not be determined as the end location, and the forwarding device may create the first Two rules and the third rule. If the SI is zero, that is, the current processing location is the end of the service function path, the forwarding device may remove the NSH of the first service flow packet, and forward the first service flow packet that removes the NSH to the network. .
  • the second rule and the third rule are that the packet header feature of the service flow packet matches the matching domain of the first rule, and the processing location of the service flow packet is not the end location. If the packet header feature of the service flow packet matches the matching domain of the first rule, but the processing location of the service flow packet is the end location, the forwarding device directly removes the service flow packet. The NSH forwards the NSH service flow packet to the network.
  • the following describes in detail how the forwarding device processes the service flow message according to the second rule and the third rule.
  • the matching field of the second rule is an NSH
  • the method further includes:
  • the action of the second rule is performed: removing the NSH of the second service flow packet, and processing
  • the second service flow packet is forwarded to the service function SF device.
  • the forwarding device may receive the second service flow packet from the classifier.
  • the second service flow packet may be the first service flow packet.
  • the forwarding device may further receive a service flow message from the SFF.
  • the forwarding device is an SFF1 device
  • the second service flow message may be a service flow message from the SFF2 device. That is, the second rule can be used to process messages from the SFF or from the classifier.
  • the matching domain of the second rule is an NSH.
  • the matching domain of the second rule further includes a protocol layer header feature.
  • protocol layer header features include network layer header features, transport layer header features, or application layer header features.
  • the network layer header feature includes a source Internet Protocol (IP) address, a destination IP address, or a network layer port number.
  • the transport layer header feature includes a transport layer port number or a tunnel endpoint identifier (TEID).
  • the application layer header feature includes the message type.
  • the forwarding device may perform the packet header feature of the second service flow packet and the matching domain of the second rule. Matching, if the matching is successful, the forwarding device performs the action of the second rule: removing the NSH of the second service flow message, and forwarding the processed second service flow message to the SF device, where The SF device is the next SF device on the service function path.
  • the matching domain of the third rule is a protocol layer header feature, and the method further includes:
  • the forwarding device receives a third service flow packet from the SF device,
  • the action of the third rule is performed: adding an NSH to the third service flow packet.
  • the matching domain of the third rule is a protocol layer header feature
  • the protocol layer header feature includes a network.
  • Layer header feature, transport layer header feature, or application layer header feature includes a source IP address, a destination IP address, or a network layer port number.
  • the transport layer header feature includes a transport layer port number or a tunnel endpoint identifier TEID.
  • the application layer header feature includes the message type.
  • the forwarding device receives the third service flow packet from the SF device, the third service flow packet from the SF device is a protocol layer packet, so the packet header feature of the third service flow packet is an agreement.
  • the layer header feature the forwarding device may match the packet header feature of the third service flow packet with the matching domain of the third rule. If the packet header feature of the third service flow packet matches the matching domain of the third rule, the forwarding device performs the action of the third rule: adding an NSH to the third service flow packet. Header, set the NSH header field, and send the processed third service flow packet to the next hop.
  • the NSH header field includes SPI and SI, and the next hop can be SFF, or other rules.
  • the address of the SFF can be represented by the MAC address of the SFF, or the IP address.
  • the embodiment of the present disclosure is not limited. The following embodiment uses a MAC address as an example for illustration.
  • the forwarding device forwards the third service flow packet that adds the NSH to the fourth rule for processing, where the matching field of the fourth rule is NSH header features, including SPI and SI.
  • the SI is 0, it indicates that the service function path corresponding to the SPI has been processed. Otherwise, the service function path corresponding to the SPI is not processed.
  • the action of the fourth rule is specifically: the forwarding device sends the third service flow packet after adding the NSH to the next hop, where the next hop refers to the forwarding device.
  • next hop may be the first rule; if the SI in the NSH is zero, the action of the fourth rule is specifically: the forwarding device removes the third service flow packet after the NSH is added The NSH forwards the third service flow message that removes the NSH to the network.
  • the forwarding device may also be an SP device.
  • the forwarding device forwards the third service flow packet with the added NSH to the SFF, where the SFF process adds the NSH.
  • the third service flow packet specifically, the SFF may process the third service flow packet according to the fourth rule, and is not described here for brevity.
  • the first service flow message, the second service flow message, and the third service flow message belong to the same service flow.
  • FIG. 3 is a schematic flowchart of a method for processing a message according to an embodiment of the present application, where the forwarding device is an SP device. As shown in FIG. 3, the method includes:
  • the SFC controller constructs a service function path and sends a corresponding rule to the network element on the service function path.
  • the SFC may send the rule 0 to the classifier, where the matching field of the rule 0 is a protocol layer header feature, for example, an L3/L4/L7 feature, and after receiving the service flow message, the classifier will The packet header feature of the service flow packet is matched with the matching domain of the rule 0. If the packet header feature of the service flow packet matches the matching domain of the rule 0, the classifier performs The action is: adding an NSH to the service flow message, setting the SPI and the SI in the NSH, and forwarding the service flow message with the NSH added to the next hop. Among them, the next hop is SFF.
  • the address of the SFF may be represented by a Media Access Control (MAC) address of the SFF, or may be represented by an IP address of the SFF.
  • MAC Media Access Control
  • the rule 0 in the classifier may be delivered by the SFC controller, or may be implemented by deploying a DPI before or in the classifier, and the classifier may report the service flow according to the DPI.
  • the detection result of the depth detection is obtained by the rule 0.
  • the classifier can also implement the packet header feature of the service flow packet according to the protocol layer header feature (for example, the L3/L4/L7 feature). Classification processing.
  • the classifier can process the service flow message A according to rule 0;
  • the matching field of the rule 0 is a protocol layer header feature
  • the classifier can match the packet header feature of the received service flow packet A with the matching domain of the rule 0, if the service flow
  • the packet header feature of the packet A is successfully matched with the matching field of the rule 0, and the classifier performs the action of the rule 0: adding an NSH to the service flow packet A, and setting the SPI and the SI in the NSH.
  • the service flow packet after the NSH is added is recorded as the service flow packet B.
  • the next hop of the service flow packet B is SFF, and the address of the SFF can be represented by the MAC address or IP address of the SFF.
  • the classifier sends the service flow message B to the SFF.
  • the SFF receives the service flow packet B and processes the service flow packet B.
  • the rule that is sent by the SFC controller to the SFF in the 301 is the rule 1
  • the matching field of the rule 1 is the NSH
  • the SFF receives the service flow packet B.
  • the SFF processes the service flow packet B according to the rule 1. Specifically, the packet header feature of the service flow packet B is matched with the matching domain of the rule 1. If the specific rule that the SI is zero is matched, the NSH of the service flow packet is removed, and the service flow packet B that removes the NSH is forwarded to the network; if the specific rule that the SI is not zero is matched, the service is The flow message B is sent to the next hop.
  • the specific rule that the SI is zero is matched
  • the next hop of the service flow packet B is an SP device, and the address of the SP device may be represented by a MAC address of the SP device, or may be represented by an IP address of the SP device.
  • the MAC address of the SP device is taken as an example for description.
  • the service flow packet B processed in step 303 is referred to as a service flow packet C.
  • the SFF sends the service flow message C to the SP device.
  • the SP device receives the service flow message C and processes the service flow message C.
  • the rule that the SFC controller sends to the SP device in the 301 is the rule 2
  • the matching field of the rule 2 is the NSH
  • the SP device receives the service flow packet C The packet header feature of the service flow packet C is matched with the matching domain of the rule 2. If the matching succeeds, the rule 3 and the rule 4 are created, and the service flow packet C is transferred to the rule 3. Or rule 4 performs processing, wherein the rules 3 and 4 have higher priority than the rule 2.
  • the matching field of the rule 3 is an NSH. If the packet header feature of the service flow packet C matches the matching domain of the rule 3, the action of the rule 3 is performed: removing the NSH, and The service flow message C is forwarded to the next hop.
  • the next hop of the service flow packet C is an SF device, and can be represented by a MAC address or an IP address of the SF device.
  • the matching field of the rule 4 is a protocol layer header feature. If the matching is successful, the action of the rule 4 is: adding an NSH to the service flow message C, setting an SPI, SI of the NSH, and adding the NSH service. The flow message C is forwarded to the SFF.
  • the following describes the process of processing service flow packets and the service function path of service flow packet A.
  • Firewall->LB from firewall device to load balancing device.
  • the SPI of the service function path is 1 and the service index SI is 2.
  • the L3 feature of the service flow packet A is 1.1.1.2, the destination IP address is 3.1.1.2, the source port number is 3, and the destination port number is 6.
  • the service flow packet is an L3 packet.
  • the SP device may be the SP device in the network architecture shown in FIG. 1
  • the SFF may be the SFF2 in the network architecture shown in FIG. 1.
  • the firewall device and the load balancing device may be the network architecture shown in FIG.
  • the SF3 and SF4 are described by taking SF3 as the firewall device and SF4 as the load balancing device.
  • the classifier may match the packet header feature of the service flow packet A with the matching domain of the rule 0 in the classifier, and the matching is successful.
  • the classifier adds an NSH to the service flow message A, and sets the SPI in the NSH to be 1, and the SI is 2, and the service flow message A after the NSH is added is recorded as the service flow message B, and the service flow is Message B is forwarded to SFF.
  • rule 0 on the classifier is specifically expressed as follows:
  • the matching field of the rule 0 is the source IP address is 1.1.1.2, the destination IP address is 3.1.1.2, the source port is 3, and the destination port is 6.
  • the action is: add the NSH, and send the NSH service flow packet to the SFF. That is, when the source IP address of the service flow packet received by the classifier is 1.1.1.2, the destination IP address is 3.1.1.2, the source port is 3, and the destination port is 6, the classifier performs the service flow packet.
  • the following processing is performed: the NSH is added, the SPI is set to 1, the SI is 2, and the service flow packet to which the NSH is added is sent to the SFF.
  • the SFF receives the service flow packet B, and processes the service flow packet B according to rule 1 in the SFF.
  • the SFF will be the service
  • the destination address of the flow message B is set to the MAC address or IP address of the SP device and forwarded to the SP device.
  • the service flow packet B processed by the SFF is recorded as the service flow packet C.
  • the matching is successful, the following action is performed: setting the address of the service flow message to the MAC address of the SP, that is, when The header feature of the service flow packet received by the SFF is that the SPI is 1.
  • the SFF sends the service flow packet to the SP.
  • the matching is successful, the following actions are performed: the NSH header of the service flow packet is removed, and sent to the network, that is, when The header feature of the service flow packet received by the SFF is that the SPI is 1.
  • the SI is 0, the SFF removes the service flow packet from the NSH and sends it to the network.
  • the packet header feature of the service flow packet B is matched with the matching domain of the specific rule 1 of the rule 1, that is, the packet header feature of the service flow packet B is successfully matched with the rule 1, and then executed.
  • the action of the specific rule 1 sends the service flow message C to the SP device.
  • the SP device receives the service flow message C, and processes the service flow message C according to rule 2 in the SP device.
  • the SP device matches the packet header feature of the service flow packet C with the matching domain of the rule 2, and matches the specific rule corresponding to the SPI to 1, the SI is 2, and creates the rule 3 and the rule. 4. Transfer the service flow message C to rule 3 or rule 4 for processing.
  • the service flow message C processed by the SP is recorded as the service flow message D.
  • the matching is successful, the following actions are performed: the rule 3 and the rule 4 are created, and the message is transferred to the rule 3 for processing. That is, when the header feature of the service flow packet received by the SP device is SPI is 1, and the SI is 2, the SP device creates two rules: rule 3 and team 4, and receives the received service flow message. Go to rule 3 for processing.
  • Rule 3 created according to Rule 2 is described as follows:
  • the matching is successful, the following actions are performed: setting the address of the service flow packet to the address of the firewall, that is, when the SP device The header feature of the received service flow packet is that the SPI is 1, and when the SI is 2, the SP device sends the service flow packet to the Firewall.
  • Rule 4 created according to Rule 2 is expressed as follows:
  • the device performs the following actions on the received service flow packet when the source IP address of the service flow packet is 1.1.1.2, the destination IP address is 3.1.1.2, the source port is 3, and the destination port is 6. Add the NSH, set the SPI to 1, and set the SI to 1, and send the service flow packet with the NSH added to the SFF.
  • the packet header feature of the service flow packet C is matched with the matching domain of the rule 3, and the SP performs the action of the rule 3: the NSH of the service flow packet C is removed, and the service of the NSH is removed.
  • Stream message C is sent to the next hop.
  • the next hop of the service flow packet C with the NSH removed is a firewall device, and the address of the firewall device may be represented by a MAC address or an IP address of the firewall device.
  • the service flow message C with the NSH removed is referred to as the service flow message D only by using the MAC address as an example.
  • the firewall device After receiving the service flow packet D, the firewall device processes the service flow packet D, and sends the processed service flow packet D to the SP device.
  • the service flow packet D processed by the firewall is referred to as a service flow packet E.
  • the SP device After receiving the service flow packet E, the SP device can match the packet header feature of the service flow packet E with the matching domain of the rule 4 in the SP device. If the matching succeeds, the service is the service.
  • the flow message E is added with the NSH, and the SPI in the NSH is set to 1, and the SI is 1.
  • the destination address of the service flow packet E is set to the MAC address or IP address of the SFF, and the service flow packet E is set. Forward to SFF.
  • the service flow message E is recorded as the service flow message F.
  • the SFF After receiving the service flow packet F, the SFF processes the service flow message F according to the rule 1 in the SFF. Specifically, determining that the SI of the NSH of the service flow message F is not zero, The destination address of the service flow packet F is set to the MAC address or IP address of the SP device, and the service flow packet F is forwarded to the SP device.
  • the SP device After receiving the service flow packet F, the SP device matches the rules according to the priorities of the SP devices, and first matches the rule 3 or the rule 4. If the matching is unsuccessful, the matching rule 2 continues.
  • the SP device continues to match other rules in the SP, for example, rule 2. If the matching is successful, according to rule 2, two high-priority rules 5 and 6 are created, and the service flow message F is transferred to the rule. 5 for processing.
  • the matching field of the rule 5 is the NSH, and the action of the rule 5 is: removing the NSH and sending the received service flow packet to the next hop.
  • the next hop of the received service flow packet is an SF device, and the address of the SF device may be represented by a MAC address of the SF device, or may be represented by an IP address of the SF device. limited.
  • the matching field of the rule 6 is a protocol layer header feature.
  • the action of the rule 6 is: adding an NSH header, and sending the received service flow packet to the next hop.
  • the next hop of the received service flow packet is SFF, which may be represented by the SFF MAC address, or may be represented by the SFF IP address, which is not limited in this embodiment.
  • rule 2 in this embodiment is a type of rule, and includes multiple specific rules.
  • specific rules described in S3 the following rules may also be included:
  • the matching is successful, the following actions are performed: creating rules 5 and 6 and forwarding the service flow packet to the rule. 5 for processing. That is, when the SPI of the service flow packet received by the SFF is 1, and the SI is 1, the SFF creates two high-priority rules: rule 5 and rule 6, and forwards the service flow packet to rule 5. deal with.
  • the SFF performs the following processing on the service flow packet: the NSH header is removed, and the service flow packet with the NSH header removed is sent to the LB. device.
  • the SP device After receiving the service flow packet F, the SP device sequentially matches the rules on the SP device according to the rule priority. If the matching with rule 2 is successful, the action of rule 2 is executed, and two high-priority rules are created: rule 5 and rule 6, and the service flow message F is transferred to rule 5. The NSH header feature of the service flow packet F is matched with the matching domain of the rule 5. If the matching is successful, the action of the rule 5 is performed: the NSH of the service flow packet E is removed, and the service flow packet E with the NSH removed is sent to LB device. In the embodiment of the present application, the service flow packet F with the NSH removed is referred to as a service flow packet G.
  • the LB device processes the service flow message G, forwards the processed service flow message G to the SP device, and records the processed service flow message G as a service.
  • Flow message H after receiving the service flow message G, the LB device processes the service flow message G, forwards the processed service flow message G to the SP device, and records the processed service flow message G as a service.
  • the SP device After receiving the service flow packet H, the SP device matches the priorities according to the rules in the SP. With the foregoing example, if the packet header feature of the service flow packet H matches the matching domain of the rule 6, the action of the rule 6 is performed: adding the NSH, setting the SPI to 1, the SI is 0, and adding the NSH.
  • the service flow message is sent to SFF.
  • the address of the SFF can be represented by the MAC address or IP address of the SFF, and the service flow message H of the NSH is added as the service flow message I.
  • the SFF after receiving the service flow message I, the SFF processes the service flow message I according to the rule 1 in the SFF, and at this time, the SI is zero, that is, the end position of the service function path is reached.
  • the SFF performs the action of the specific rule 2 included in the rule 1: the NSH of the service flow message I is removed, and the service flow message I from which the NSH is removed is forwarded to the network.
  • FIG. 5 is a schematic flowchart of a method for processing a message according to an embodiment of the present application when the forwarding device is an SFF. That is to say, in the embodiment, the ability to create a rule is SFF. As shown in FIG. 5, the method includes the following contents:
  • the SFC controller constructs a service function chain SFC, and sends a corresponding rule to the network element on the service function path.
  • the rule sent by the SFC controller in 501 is rule 1
  • the matching field of the rule 1 is a protocol layer header feature.
  • the classifier processes the traffic flow message A according to rule 1 in the classifier.
  • the classifier may match the packet header feature of the received service flow packet A with the matching domain of the rule 1, if the packet header feature of the service flow packet A and the rule 1 The match field is successfully matched, and the classifier performs the action of the rule 1: adding an NSH to the service flow message A, setting an SPI and an SI in the NSH, and adding the service flow packet A of the NSH. Send to SFF.
  • the service flow packet A after the NSH is added is recorded as the service flow packet B.
  • the service flow message B is forwarded to the SFF.
  • the SFF receives the service flow packet B and processes the service flow packet B.
  • the rule sent by the SFC controller in 501 is rule 2
  • the matching field of the rule 2 is an NSH
  • the service flow is The packet header feature of the packet B is matched with the matching field of the rule 2. If the matching to the SI is zero, the NSH of the service flow packet B is removed, and the service flow packet B of the NSH is forwarded to the network. Matching to SI is not zero, creating rule 3 and rule 4, and processing the service flow message B according to rule 3 or rule 4, wherein the rules 3 and 4 have higher priority than rule 2.
  • the matching field of the rule 3 is an NSH.
  • the action of the rule 3 is: removing the NSH, setting the destination address of the service flow packet to the MAC address or IP address of the SF, and forwarding the service flow packet.
  • the matching field of the rule 4 is a protocol layer header feature. If the matching is successful, the action of the rule 4 is: for the service flow.
  • the message is added to the NSH, and the SPI and the SI of the NSH are modified, and the service flow packet of the added NSH is processed according to the foregoing fourth rule. For brevity, details are not described herein again.
  • the process of processing the service flow packet is described in the following example.
  • the service function path of the service flow packet A is Firewall->LB, that is, from the firewall device to the load balancing device.
  • the SPI of the service function path is 1 and the service index SI is 2.
  • the L3 feature of the service flow packet A is 1.1.1.2, the destination IP address is 3.1.1.2, the source port number is 3, and the destination port number is 6.
  • the service flow packet is an L3 packet.
  • the SFF device may be the SFF1 device in the network architecture shown in FIG. 1.
  • the firewall device and the load balancing device may be SF1 and SF2 in the network architecture shown in FIG. 1, with SF1 as the firewall device, and SF2 as the firewall device.
  • the load balancing device is described as an example.
  • the classifier may match the packet header feature of the service flow packet A with the matching domain of the rule 1, and the matching is successful, and the classifier is
  • the service flow packet A is added with an NSH, and the SPI in the NSH is set to 1 and the SI is 2, and the service flow packet A after the NSH is added is recorded as the service flow packet B, and the service flow packet B is set.
  • the destination address is the MAC address or IP address of the SFF, and the service flow packet B is forwarded to the SFF.
  • the classifier performs the following processing on the service flow packet: NSH, set the SPI to 1, and the SI to 2, and send the service flow packet with the NSH added to the SFF.
  • the SFF processes the service flow packet B according to the rule 2, and specifically, matches the packet header feature of the service flow packet B with the matching domain of the rule 2, and matches the SPI to 1, If SI is 2, the SFF creates two high-priority rules: rule 3 and rule 4, and transfers the service flow message B to rule 3 for processing.
  • the matching field of the rule 3 is the NSH, and includes the SP and the SI.
  • the action of the rule 3 is: the SFF removes the NSH of the service flow packet, and sends the service flow packet with the NSH removed to the SF.
  • the matching field of the rule 4 is a protocol layer header feature.
  • the action of the rule 4 is: SFF adds an NSH to the service flow message, sets the SPI and the SI, and pushes the service flow packet with the NSH added to the rule 2 for processing.
  • the SFF Indicates that when the SFF receives the traffic stream header feature as SPI and the SI is 2, the SFF creates two high-priority rules and forwards the service flow packets to rule 3.
  • the SFF removes the service flow packet from the NSH and sends it to the network.
  • the SP device sends the service flow packet to the firewall device when the SPI is 1 and the SI is 2.
  • the high priority rule 4 created according to rule 2 is described as follows:
  • the device performs the following actions on the received service flow packet when the source IP address of the service flow packet is 1.1.1.2, the destination IP address is 3.1.1.2, the source port is 3, and the destination port is 6. Add the NSH, set the SPI to 1, and set the SI to 1, and transfer the service flow packet with the added NSH to rule 2.
  • the firewall device if the packet header feature of the service flow packet B matches the matching domain of the rule 3, the action of the rule 3 is performed, and the service flow packet B processed by the SFF is recorded as a service flow report. In the text C, the service flow packet C is sent to the firewall device.
  • the firewall device After receiving the service flow message C, the firewall device processes the service flow message C, and sends the processed service flow message C to the SFF.
  • the SFF After receiving the service flow packet C processed by the firewall device, the SFF performs matching according to the priority of the rule in the SFF, until a certain rule is matched, and then performs a corresponding action.
  • the service flow message C is an L3 message, and the packet header feature of the service flow message C is matched with the matching field of the rule 4. If the matching is successful, the action of the rule 4 is performed. Adding an NSH to the service flow message C, and setting the SPI of the NSH to 1 and the SI to be 1, and the service flow message C of the NSH is added as the service flow message D, and then the service is performed according to the rule 2.
  • the flow message D is processed.
  • rule 2 in this embodiment refers to a type of rule.
  • specific rules may be included:
  • SPI 1
  • the packet header feature of the service flow packet is considered to be The matching domain of the rule 2 is successfully matched.
  • the SFF performs the following actions: The SFF is removed, and the service flow packet is sent to the LB device.
  • the high priority rule 6 created according to rule 2 is described as follows:
  • the SFF performs the following actions on the received service flow packet: NSH, set the SPI to 1, and the SI to 0, and transfer the service flow packet with the added NSH to rule 2.
  • the packet header feature of the service flow packet D is matched with the matching domain of the rule 5, and the action of the rule 5 is performed: the NSH of the service flow packet D is removed, and the service flow packet with the NSH removed is called a service.
  • the flow message E sends the service flow message E to the LB device.
  • the LB device After receiving the service flow packet E, the LB device processes the service flow packet E and forwards the processed service flow packet E to the SFF.
  • the SFF After receiving the service flow packet E processed by the LB device, the SFF performs matching according to the priority of the rule in the SFF, until a certain rule is matched, and then performs a corresponding action.
  • the packet header of the service flow packet E is characterized by the L3 feature. If the matching field of the rule 6 is successfully matched, the SFF performs the action of the rule 6: adding an NSH to the service flow packet E, and setting the SPI to 1. SI is 0, and the service flow packet with the added NSH is transferred to rule 2.
  • the service flow packet E to which the NSH is added is referred to as a service flow packet F.
  • the specific rule 2 corresponding to 0, that is, the end position of the service function path is reached, and the SFF removes the service flow packet.
  • the NSF of the F forwards the service flow packet F of the NSH to the network.
  • the processing of the service flow packet A ends.
  • the forwarding device may generate two second rules and a third rule with higher priority according to the first rule sent by the SFC controller, so that The rule and the third rule process the service flow message from the classifier, the SFF or the SF device. Therefore, the forwarding device does not need to obtain the rule for restoring the NSH by reporting the SFC controller, thereby facilitating the reduction of the control signaling overhead. . On the other hand, it is also beneficial to avoid waste of storage space by storing a large number of forwarding rules on the forwarding device.
  • FIG. 7 is a schematic block diagram of an apparatus for processing a message according to an embodiment of the present application.
  • An example of the apparatus 700 of Figure 7 is a forwarding device, such as an SFF or SP.
  • the apparatus 700 includes a receiving module 710, a matching module 720, and an operating module 730.
  • the receiving module 710 is configured to receive, by the service function chain controller, a first rule, where the first rule includes a matching domain, where the matching domain is a network service packet header NSH,
  • the receiving module 710 is further configured to receive a first service flow packet.
  • the matching module 720 is configured to match the packet header feature of the first service flow packet with the matching domain of the first rule.
  • the operation module 730 is configured to create a second rule and a third rule according to the first rule, if the matching between the packet header feature of the first service flow packet and the matching domain of the first rule is successful, The second rule and the third rule have higher priority than the first rule.
  • the matching domain of the first rule further includes a protocol layer header feature.
  • the matching domain of the second rule is an NSH
  • the receiving module 710 is further configured to:
  • the matching module 720 is further configured to:
  • the operation module 730 is further configured to: if the packet header feature of the second service flow packet matches the matching domain of the second rule, perform the action of the second rule: removing the second service
  • the NSH of the packet is forwarded, and the processed second service flow packet is forwarded to the service function SF device.
  • the matching domain of the second rule further includes a protocol layer header feature.
  • the matching domain of the third rule is a protocol layer header feature
  • the receiving module 710 is further configured to:
  • the matching module 720 is further configured to:
  • the operation module 730 is further configured to:
  • the action of the third rule is performed: adding an NSH to the third service flow packet.
  • the forwarding device is an SFF
  • the operation module is further configured to:
  • the forwarding device is an SP device, and the device further includes:
  • a sending module configured to forward the third service flow packet with the added NSH to the SFF.
  • the first service flow message, the second service flow message, and the third service flow message belong to the same service flow.
  • the device 700 may correspond to the forwarding device in the method 200 for processing a message according to an embodiment of the present application, or the SP device in the method shown in FIG. 3, or the SFF in the method shown in FIG.
  • a physical unit is included for performing the forwarding device in method 200 of FIG. 2, or the method of the SP device of FIG. 3 or SFF of FIG.
  • each physical unit in the device 700 and the other operations and/or functions described above are respectively implemented in order to implement the forwarding device in the method 200 in FIG. 2, or the corresponding process in the SP device in FIG. 3 or the SFF in FIG. No longer.
  • the device may be a forwarding device, exemplarily, may be an SFF or SP device.
  • the apparatus includes a processor, a memory, a first network interface, a second network interface, and a third network interface.
  • the first network interface can be connected to the control device for interaction.
  • the control device can be an SFC controller.
  • the second network interface is used as an input port of the device, and can be used to receive service flow packets.
  • the third network interface as an output port of the device, can be used to send a service flow message processed by the processor.
  • each network interface can include multiple input and output ports.
  • the first, second, and third network interfaces may be mutually independent network interfaces, or may be combined into one network interface; the memory may be a semiconductor storage unit that is directly accessible by the processor.
  • the memory is used to store a computer-executable program code, and the program code is used to execute the method for processing a message as shown in FIG. 2, FIG. 3 or FIG. 5, and for storing the flow entry provided by the embodiment of the present application.
  • the processor is configured to execute the method for processing the message as shown in FIG. 2, FIG. 3 or FIG. 5 according to the computer-executable program code stored in the memory, and process the received service flow message.
  • Another embodiment of the present application further provides a system for processing a message.
  • the system includes a forwarding device 910 and a control device 920.
  • the system for processing a message may further include a classifier.
  • the forwarding device 910 may be the device 700 shown in FIG. 7, and the control device 920 may be the SFC controller shown in FIG. 1, or may also be the method 200 shown in FIG. The SFC controller in Figure 5.
  • the embodiment of the present application further provides a computer readable medium storing program code for executing by a computer, the program code for performing processing data as shown in FIG. 2, FIG. 3 or FIG. The method of the message.
  • the embodiment of the present application also provides a computer program product.
  • the computer program product includes program code executable by a computer for executing a method of processing a data message as shown in FIG. 2, FIG. 3 or FIG.
  • the size of the sequence numbers of the foregoing processes does not mean the order of execution sequence, and the order of execution of each process should be determined by its function and internal logic, and should not be applied to the embodiment of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present application which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like.
  • the medium of the code includes: a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供了一种处理报文的方法和装置，有利于降低控制信令的开销和存储开销，所述方法包括：转发设备从业务功能链控制器接收第一规则，所述第一规则包括匹配域，所述匹配域为网络服务包头NSH；所述转发设备接收第一业务流报文，将所述第一业务流报文的报文头特征与所述第一规则的匹配域进行匹配；若所述第一业务流报文的报文头特征与所述第一规则的匹配域匹配成功，所述转发设备根据所述第一规则创建第二规则和第三规则，所述第二规则和所述第三规则的优先级高于所述第一规则。

Description

处理报文的方法和装置 技术领域
本申请涉及通信领域，并且更具体地，涉及处理报文的方法和装置。
背景技术
业务功能链(Service Function Chain，SFC)是目前正在研究和标准化的一种网络技术。网络服务包头(Network Service Header，NSH)是一种实现SFC的应用协议，NSH用于描述数据面的Header沿着服务路径(Service Path，SP)承载的网络服务信息，意在实现与传输独立的“服务面”(Service Plane)。
但是当前大多数业务功能(Service Function，SF)设备不支持NSH协议，因此需要部署业务功能链代理(Service Function Chain Proxy，SP)设备实现对NSH协议的支持。此时，SP设备收到的SF设备返回的报文是无NSH的协议层报文，例如，网络层报文，传输层报文或应用层报文。SP设备需要通过匹配协议层报文头特征来恢复NSH头，并将处理后的协议层报文转发给业务功能转发器(Service Function Forwarder，SFF)。由于同一个业务链中的协议层报文头特征是动态变化的，因此，需要SP设备每次接收到来自SF设备的业务流报文后，通过上报SFC控制器以获取恢复NSH的转发规则，这导致了SFC控制器与SP设备之间大量的信令开销，无法满足对报文的实时性处理的要求。
发明内容
本申请实施例提供一种处理报文的方法和装置，有利于降低控制信令的开销。
第一方面，提供了一种处理报文的方法，其特征在于，包括：转发设备从业务功能链控制器接收第一规则，所述第一规则包括匹配域，所述匹配域为网络服务包头NSH；所述转发设备接收第一业务流报文，将所述第一业务流报文的报文头特征与所述第一规则的匹配域进行匹配；若所述第一业务流报文的报文头特征与所述第一规则的匹配域匹配成功，所述转发设备根据所述第一规则创建第二规则和第三规则，所述第二规则和所述第三规则的优先级高于所述第一规则。
应理解，本申请实施例提到的规则，可以指一个具体的规则，也可以指一类规则，例如，所述第一规则可能包含多个具体规则，例如，所述多个具体规则可以包括具体规则1和具体规则2，其中，所述具体规则1对应的匹配域为SPI＝1、SI＝2，所述具体规则2对应的匹配域为SPI＝2、SI＝3，可选地，所述第一规则还可以包括更多个具体规则，对于所述第二规则和所述第三规则亦是如此。
可选地，所述转发设备为SFF或SP设备，所述转发设备具有创建规则的能力，所述转发设备可以根据SFC控制器下发的第一规则，创建第二规则和第三规则，从而可以根据第二规则和第三规则对来自SFF、SF设备或分类器的业务流报文进行处理，不必每次通过上报SFC控制器获取相应的规则，然后根据SFC下发的规则实现对报文的处理，因此，有利于降低控制信令的开销，从另一方面来讲，在转发设备上也不用存储大量的转发规则，因此，降低转发设备的存储开销。
可选地，在一些实施例中，所述第一规则的匹配域还包括协议层包头特征。
可选地，在一些实施例中，所述第二规则的匹配域为NSH，所述方法还包括：所述 转发设备从业务功能转发器SFF或分类器接收第二业务流报文，将所述第二业务流报文的报文头特征与所述第二规则的匹配域进行匹配，所述第二业务流报文的报文头特征包括NSH；若所述第二业务流报文的报文头特征与所述第二规则的匹配域匹配成功，执行所述第二规则的动作：去除所述第二业务流报文的NSH，并将处理后的第二业务流报文转发至业务功能SF设备。
由于来自分类器或SFF的报文为包括NSH的业务流报文，所述第二规则的匹配域为NSH，所述转发设备可以根据第二规则处理来自SFF或分类器的报文。
可选地，在一些实施例中，所述第二规则的匹配域还包括协议层包头特征。
可选地，在一些实施例中，所述第三规则的匹配域为报文头特征，所述方法还包括：
所述转发设备从SF设备接收第三业务流报文，
将所述第三业务流报文的报文头特征与所述第三规则的匹配域进行匹配；
若所述第三业务流报文的报文头特征与所述第三规则的匹配域匹配成功，执行所述第三规则的动作：为所述第三业务流报文添加NSH。
由于来自SF设备的报文为不包括NSH的协议层报文，所述第三规则的匹配域为协议层包头特征，所述转发设备可以根据第三规则处理来自SF设备的报文。
可选地，在一些实施例中，所述转发设备为SFF，所述方法还包括：
处理已添加NSH的所述第三业务流报文。
可选地，在一些实施例中，所述转发设备为SP设备，所述方法还包括：
将已添加NSH的所述第三业务流报文转发至SFF。
可选地，在一些实施例中，所述第一业务流报文、所述第二业务流报文和所述第三业务流报文属于同一业务流。
第二方面，提供了一种处理报文的装置，包括用于执行第一方面或其各种实现方式中的方法的单元。
第三方面，提供一种处理报文的装置，包括处理器、存储器、第一网络接口，第二网络接口和第三网络接口。其中第一网络接口，第二网络接口，第三网络接口，处理器和存储器之间通信连接，所述存储器用于存储程序，所述处理器用于执行程序，当所述程序被执行时，所述处理器基于所述第一网络接口，第二网络接口和第三网络接口执行第一方面中的方法。
第四方面，提供一种处理报文的系统，包括第二方面提供的处理数据报文的装置和控制设备，所述控制设备用于向所述处理报文的装置下发第一规则，所述第一规则的匹配域为网络服务包头NSH。
第五方面，提供一种计算机可读介质，所述计算机可读介质存储用于计算机执行的程序代码，所述程序代码包括用于执行第一方面中的方法的指令。
第六方面，提供一种计算机程序产品。所述计算机程序产品包括能够被计算机执行的程序代码，所述程序代码包括用于执行第一方面中的方法的指令。
基于上述技术方案，本申请实施例的处理报文的方法，转发设备可以根据业务功能链SFC控制器下发的第一规则，生成两个优先级较高的第二规则和第三规则，从而可以根据所述第二规则和所述第三规则处理来自分类器，SFF或SF设备的业务流报文，因此，所述转发设备不用通过上报SFC控制器获取恢复NSH的规则，从而，有利于降低控制信令的开销。
附图说明
图1是适用于本申请实施例的网络架构的一例的示意图；
图2是根据本申请实施例的处理报文的方法的示意性流程图；
图3是转发设备为SP设备时，根据本申请实施例的处理报文的方法的示意性流程图；
图4是转发设备为SP设备时，根据本申请实施例的处理报文的方法的一例流程图；
图5是转发设备为SFF设备时，根据本申请实施例的处理报文的方法的示意性流程图；
图6是转发设备为SFF设备时，根据本申请实施例的处理报文的方法的一例流程图；
图7是根据本申请实施例的处理数据报文的装置的示意框图；
图8是根据本申请实施例的处理数据报文的装置的一种硬件实现的结构示意图；
图9是根据本申请实施例的处理数据报文的系统的示意框图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
图1所示为适用于本申请实施例的一种网络架构的示意图，应理解，图1所示的网络架构只是为了帮助本领域技术人员更好地理解本申请实施例，而非限制本申请实施例的范围。
如图1所示，该网络架构包括：
SFC控制器，用于构造业务功能路径(Service Function Path，SFP)，并向业务功能路径上的节点(如分类器或SFF)下发路径信息，例如，路径消息包括分类规则、转发规则等；
分类器(classifier)，用于根据分类规则对业务流进行分类处理，将其转入相应的业务功能路径中进行处理；
SFF，用于根据转发规则转发业务流报文，SFF可以为路由器、交换机等物理或虚拟的转发设备；
SP设备，用于在SF不支持SFC时，实现对SFC的支持；
SF设备，用于对业务流进行增值服务处理的业务功能，SF设备可以是一个虚拟的元素，也可以是嵌入在物理网络设备上的某种功能实体。例如，防火墙(Firewall)、深度报文检测(Deep Packet Inspection，DPI)、网络地址转换(Network Address Translation，NAT)或负载均衡(Load Balance,LB)等。
例如，业务流报文的处理过程如下：SFC控制器构建业务功能路径，所述业务功能路径是一系列业务功能的有序集合，业务流报文经分类器分类后，通过SFF的转发，依次遍历SFP中的各个SF设备，从而实现对业务流报文的处理。具体的，可以用业务路径标识(Service Path Identifier，SPI)指示是哪条SFP，可以用业务索引(Service Index，SI)指示业务流报文的处理位置，例如，一条SFP为Firewall->DPI->QoS，SPI为1，SI初始值为3，当Firewall处理完业务流报文时，SI变为2，依次类推，QoS处理完报文时，SI变为0，业务流报文处理完毕。
由于大多数SF设备不支持NSH，需要部署SP设备对发往SF设备的业务流报文做去NSH头处理，并对来自SF设备的业务流报文做添加NSH头处理。SP设备从SF设备 接收的业务流报文为无NSH的协议层报文，例如，网络层(或者说，L3)报文，传输层(或者说，L4)报文，或应用层(或者说，L7)报文，SP设备将协议层报文头特征(或者说，协议层包头特征)与SP设备的转发规则进行匹配，以恢复NSH报文头，并将处理后的业务流报文转发给SFF，但是同一个业务功能路径的协议层包头特征是动态变化的，因此SP设备上的转发规则需要涵盖所有协议层包头特征情况，这导致了SP设备每次接收到来自SF设备的业务流报文后，通过上报SFC控制器以获取恢复NSH的转发规则，这导致了SFC控制器与SP设备之间大量的信令开销，无法满足对报文的实时性处理的要求。
有鉴于此，本申请实施例提出一种处理报文的方法，转发设备可以根据SFC控制器下发的第一规则，生成两个优先级较高的第二规则和第三规则，所述转发设备可以根据所述第二规则和所述第三规则处理来自分类器，SFF或SF设备的业务流报文，从而所述转发设备不用通过上报SFC控制器获取恢复NSH的规则，因此，有利于降低控制信令的开销。
应理解，本申请实施例中，转发设备具有创建规则的能力，所述转发设备可以为SP设备，或者所述转发设备也可以为SFF，此情况下的SFF相当于SFF和SP设备的结合。例如，若实际场景为图1所示的右半部分，即包括SP设备和SFF2，所述转发设备可以为SP设备，SP设备具有创建规则的能力，SFF2设备不具备创建规则能力。或者，若实际场景为图1中的左半部分，即只包括SFF1，所述转发设备可以为SFF1设备，SFF1设备具备创建规则能力，此时的SFF1设备的功能相当于SFF2设备和SP设备的功能的集合。或者，实际场景中包括多个SFF，所述多个SFF中的部分SFF可以具有创建规则的能力，另一部分不具备创建规则的能力，例如，SFF1设备具有创建规则能力，SFF2设备不具备创建规则能力。
图2是根据本申请实施例的处理报文的方法的示意性流程图，图2的方法200可以由转发设备执行，例如，SFF或SP设备，如图2所示，所述方法包括：
在210中，转发设备从业务功能链控制器接收第一规则，所述第一规则包括匹配域，所述匹配域为网络服务包头NSH；
在220中，所述转发设备接收第一业务流报文，将所述第一业务流报文的报文头特征与所述第一规则的匹配域进行匹配；
在230中，若所述第一业务流报文的报文头特征与所述第一规则的匹配域匹配成功，所述转发设备根据所述第一规则创建第二规则和第三规则，所述第二规则和所述第三规则的优先级高于所述第一规则。
具体的，SFC控制器首先构建业务功能路径，并向所述业务功能路径上的网元发送相应的规则。对于转发设备而言，所述SFC控制器向所述转发设备发送第一规则，所述第一规则的匹配域为NSH，可选地，所述第一规则的匹配域还可以包括协议层包头特征。所述转发设备可以接收来自分类器或SFF的第一业务流报文，所述第一业务流报文属于某一业务流，所述业务功能路径用于指示所述业务流的转发路径，所述第一业务流报文为所述业务流在所述业务功能路径的某个处理位置的业务流报文。
所述转发设备接收到所述第一业务流报文后，可以将所述第一业务流报文的报文头特征与所述第一规则的匹配域进行匹配，若所述第一业务流报文的报文头特征和所述第一规则的匹配域匹配成功，所述转发设备执行的动作：创建第二规则和第三规则，并将 转入至所述第二规则或所述第三规则处理所述第一业务流报文，其中，所述第二规则和所述第三规则的优先级高于所述第一规则，所述第二规则和所述第三规则用于在所述转发设备后续接收到业务流报文时，优先根据第二规则或第三规则，对该业务流报文进行处理。
例如，由于所述第二规则和所述第三规则的优先级高于所述第一规则，所述转发设备可以先将所述第二业务流报文的报文头特征与所述第二规则的匹配域进行匹配，若匹配成功，则根据所述第二规则的动作对所述第二业务流报文进行处理，若匹配失败，再将所述第二业务流报文的报文头特征与所述第三规则的匹配域进行匹配，若匹配成功，则根据所述第三规则的动作对所述第二业务流报文进行处理。
或者，所述转发设备也可以先将所述第二业务流报文的报文头特征与所述第三规则的匹配域进行匹配，再将所述第二业务流报文的报文头特征与所述第二规则的匹配域进行匹配，本申请实施例对于所述转发设备先使用所述第二规则和所述第三规则中的哪个规则的匹配域与所述第二业务流报文的报文头特征进行匹配不作限定。
可选地，若所述第二业务流报文的报文头特征与所述第二规则和所述第三规则的匹配域都匹配失败，所述转发设备可以继续匹配所述转发设备中的其他规则，如果与某个规则的匹配域匹配成功，则执行该规则的动作，例如，若所述第二业务流报文的报文头特征与所述第二规则和所述第三规则的匹配域均不匹配，所述转发设备继续匹配转发设备中的其它规则的匹配域，若与第一规则的匹配域匹配成功，则执行所述第一规则的动作。若与所述转发设备中的每个规则的匹配域都不匹配，所述转发设备可以丢弃所述第二业务流报文，或者可以将所述第二业务流报文转发至SFC控制器，由所述SFC控制器确定如何对所述第二业务流报文进行处理。
可选地，转发设备还可以根据业务流报文的头特征决定匹配所述第二规则还是所述第三规则。例如，若业务流报文是NSH报文，所述转发设备确定匹配第二规则。当业务流报文是L3/L4/L7报文时，确定匹配第三规则。例如，转发设备接收第二业务流报文，第二业务流报文是NSH报文，则转发设备将第二业务流报文的报文头特征与第二规则的匹配域进行匹配，若匹配成功，则根据所述第二规则的动作对所述第二业务流报文进行处理，若匹配失败，则转发设备丢弃该第二业务流报文或上报SFC控制器。再例如，转发设备接收第二业务流报文，第二业务流报文是协议层报文，则转发设备将该第二业务流报文的报文头特征与第三规则的匹配域进行匹配，若匹配成功，则根据所述第三规则的动作对所述第二业务流报文进行处理，若匹配失败，则转发设备丢弃该第二业务流报文或上报SFC控制器。
需要说明的是，本申请实施例提到的规则，可以指一个具体的规则，也可以指一类规则，例如，所述第一规则可能包含多个具体规则。举例来说，所述多个具体规则可以包括具体规则1和具体规则2，其中，所述具体规则1对应的匹配域为SPI＝1、SI＝2，所述具体规则2对应的匹配域为SPI＝2、SI＝3，当业务流报文的报文头特征与所述第一规则包括的多个具体规则中的任一具体规则匹配成功，即可认为所述业务流报文的报文头特征与所述第一规则的匹配域匹配成功。可选地，所述第一规则还可以包括更多个具体规则，对于所述第二规则和所述第三规则亦是如此，这里不再赘述。
可选地，若所述第一业务流报文的报文头特征和所述第一规则的匹配域匹配成功，所述转发设备还可以进一步确定所述第一业务流报文在业务功能路径的处理位置。例如， 可以根据SI确定所述第一业务流报文在业务功能路径上的处理位置，若SI不为零，则可确定业务流报文的处理位置不是结束位置，所述转发设备可以创建所述第二规则和所述第三规则。若SI为零，即当前的处理位置为业务功能路径的结束位置，所述转发设备可以去除所述第一业务流报文的NSH，将去除NSH的所述第一业务流报文转发至网络。
也就是说，所述第二规则和所述第三规则是在业务流报文的报文头特征与第一规则的匹配域匹配成功，并且所述业务流报文的处理位置不是结束位置的情况下创建的，若所述业务流报文的报文头特征与第一规则的匹配域匹配成功，但是所述业务流报文的处理位置是结束位置，则转发设备直接去除业务流报文的NSH，将去除NSH的业务流报文转发至网络。
以下，详细描述所述转发设备如何根据所述第二规则和所述第三规则对业务流报文进行处理。
可选地，在一些实施例中，所述第二规则的匹配域为NSH，所述方法还包括：
所述转发设备从业务功能转发器SFF或分类器接收第二业务流报文；
将所述第二业务流报文的报文头特征与所述第二规则的匹配域进行匹配，所述第二业务流报文的报文头特征包括NSH；
若所述第二业务流报文的报文头特征与所述第二规则的匹配域匹配成功，执行所述第二规则的动作：去除所述第二业务流报文的NSH，并将处理后的第二业务流报文转发至业务功能SF设备。
具体的，所述转发设备可以接收到来自分类器的第二业务流报文，此情况下，所述第二业务流报文可以为所述第一业务流报文。或者，所述转发设备还可以接收来自SFF的业务流报文，例如，若所述转发设备为SFF1设备，所述第二业务流报文可以为来自SFF2设备的业务流报文。也就是说，所述第二规则可以用于处理来自SFF或来自分类器的报文。
所述第二规则的匹配域为NSH，可选地，所述第二规则的匹配域还包括协议层包头特征。例如，协议层包头特征包括网络层包头特征、传输层包头特征或应用层包头特征。其中，网络层包头特征包括源互联网协议(Internet Protocol，IP)地址、目的IP地址或网络层端口号。传输层包头特征包括传输层端口号或隧道端点标识(Tunnelling Endpoint IDentifier，TEID)。应用层包头特征包括报文类型。
在所述转发设备接收到来自SFF或分类器的第二业务流报文时，所述转发设备可以将所述第二业务流报文的报文头特征与所述第二规则的匹配域进行匹配，若匹配成功，所述转发设备执行所述第二规则的动作：去除所述第二业务流报文的NSH，并将处理后的所述第二业务流报文转发至SF设备，所述SF设备为业务功能路径上的下一个SF设备。
可选地，在一些实施例中，所述第三规则的匹配域为协议层包头特征，所述方法还包括：
所述转发设备从SF设备接收第三业务流报文，
将所述第三业务流报文的报文头特征与所述第三规则的匹配域进行匹配；
若所述第三业务流报文的报文头特征与所述第三规则的匹配域匹配成功，执行所述第三规则的动作：为所述第三业务流报文添加NSH。
具体的，所述第三规则的匹配域为协议层包头特征，例如，协议层包头特征包括网 络层包头特征、传输层包头特征或应用层包头特征。网络层包头特征包括源IP地址、目的IP地址或网络层端口号。传输层包头特征包括传输层端口号或隧道端点标识TEID。应用层包头特征包括报文类型。
若所述转发设备接收到来自SF设备的第三业务流报文，来自SF设备的第三业务流报文为协议层报文，所以所述第三业务流报文的报文头特征为协议层包头特征，所述转发设备可以将所述第三业务流报文的报文头特征与所述第三规则的匹配域进行匹配。若所述第三业务流报文的报文头特征与所述第三规则的匹配域匹配成功，所述转发设备执行所述第三规则的动作：为所述第三业务流报文添加NSH头、设置NSH头域、并将处理后的第三业务流报文发往下一跳。其中，NSH头域包括SPI、SI，下一跳可以是SFF，还可以是其它规则。当下一跳是SFF时，SFF的地址可以用SFF的MAC地址，或IP地址表示，本申请实施例不做限定，以下实施例以MAC地址为例进行举例说明。
可选的，若所述转发设备为SFF，此情况下，所述转发设备将添加NSH的所述第三业务流报文转入至第四规则进行处理，所述第四规则的匹配域为NSH头特征，包括SPI和SI。当SI为0时，表明SPI对应的业务功能路径已经处理完毕，反之则表明SPI对应的业务功能路径没有处理完毕。若NSH中的SI不为零，所述第四规则的动作具体为：转发设备将添加NSH后的所述第三业务流报文发送至下一跳，该下一跳指的是转发设备的其它规则，例如，下一跳可以为所述第一规则；若NSH中的SI为零，所述第四规则的动作具体为：转发设备去除添加了NSH后的所述第三业务流报文的NSH，将去除NSH的所述第三业务流报文转发至网络。
可选的，所述转发设备还可以为SP设备，此情况下，所述转发设备将已添加NSH的所述第三业务流报文转发至SFF，由所述SFF处理添加NSH的所述第三业务流报文，具体的，所述SFF可以根据上述第四规则处理所述第三业务流报文，为了简洁，这里不再赘述。
应理解，在本申请实施例中，所述第一业务流报文、所述第二业务流报文和所述第三业务流报文属于同一业务流。
需要说明的是，本申请实施例中的具体规则，可以由Openflow协议中的流表项实现。后续实施例中，均以Openflow协议中的流表项来标识具体规则。
以下，结合图3至图6，介绍转发设备为SP设备或SFF时，根据本申请实施例的处理报文的方法。
图3是当转发设备为SP设备的情况下，根据本申请实施例的处理报文的方法的示意性流程图。如图3所示，所述方法包括：
在301中，SFC控制器构建业务功能路径，并向所述业务功能路径上的网元发送相应的规则。
具体地，所述SFC可以向分类器下发规则0，所述规则0的匹配域为协议层包头特征，例如，L3/L4/L7特征，所述分类器接收到业务流报文后，将所述业务流报文的报文头特征与所述规则0的匹配域进行匹配，若所述业务流报文的报文头特征与所述规则0的匹配域匹配成功，所述分类器执行的动作为：为所述业务流报文添加NSH，并设置NSH中的SPI和SI，并将添加了NSH的所述业务流报文转发至下一跳。其中，下一跳为SFF。所述SFF的地址可以用SFF的媒体接入控制(Media Access Control，MAC)地址表示，也可以用SFF的IP地址表示。
需要说明的是，分类器中的规则0可以是SFC控制器下发的，也可以通过如下方式实现：在分类器之前或之中部署DPI，所述分类器可以根据所述DPI对业务流报文进行深度检测的检测结果获取规则0，此情况下，所述分类器可以同样实现根据协议层包头特征(例如，L3/L4/L7特征)对所述业务流报文的报文头特征进行分类处理。
在302中，分类器可以根据规则0对所述业务流报文A进行处理；
具体的，所述规则0的匹配域为协议层包头特征，所述分类器可以将接收的业务流报文A的报文头特征与所述规则0的匹配域进行匹配，若所述业务流报文A的报文头特征与所述规则0的匹配域匹配成功，所述分类器执行所述规则0的动作：为所述业务流报文A添加NSH，并设置NSH中的SPI和SI，并将添加了NSH后的业务流报文发送至下一跳。本实施例中，将添加了NSH后的业务流报文记为业务流报文B。其中，业务流报文B的下一跳为SFF，所述SFF的地址可以用SFF的MAC地址或IP地址表示。
在303中，所述分类器向SFF发送所述业务流报文B。
在304中，所述SFF接收所述业务流报文B，并对所述业务流报文B进行处理。
对于SFF而言，在301中所述SFC控制器给所述SFF下发的规则为规则1，所述规则1的匹配域为NSH，所述SFF接收到所述业务流报文B时，所述SFF根据所述规则1对所述业务流报文B进行处理，具体的，将所述业务流报文B的报文头特征与所述规则1的匹配域进行匹配。若匹配到SI为零的具体规则，则去除业务流报文的NSH并将去除NSH的所述业务流报文B转发至网络；若匹配到SI不为零的具体规则，则将所述业务流报文B发送至下一跳。在图3的例子中，所述业务流报文B的下一跳为SP设备，所述SP设备的地址可以用SP设备的MAC地址表示，也可以用SP设备的IP地址表示，本申请实施例对此不作限定，仅以SP设备的MAC地址为例进行说明。
需要说明的是，此处的规则1表示的是一类规则，包含多个具体的规则，例如，可以包含2条具体的规则，分别是SI不等于0对应的具体规则、和SI＝0对应的具体规则，无论业务流报文的报文头特征与两个具体规则中的哪个具体规则匹配成功，都可以认为是与所述规则1匹配成功。
在本实施例中，将步骤303处理后的所述业务流报文B称为业务流报文C。
在305中，所述SFF向SP设备发送所述业务流报文C。
在306中，所述SP设备接收所述业务流报文C，并对所述业务流报文C进行处理。
对于SP设备，在301中所述SFC控制器给所述SP设备下发的规则为规则2，所述规则2的匹配域为NSH，所述SP设备接收到所述业务流报文C时，将所述业务流报文C的报文头特征与所述规则2的匹配域进行匹配，若匹配成功，则创建规则3和规则4，并将所述业务流报文C转入至规则3或规则4进行处理，其中，所述规则3和规则4的优先级高于规则2。
具体的，所述规则3的匹配域为NSH，若所述业务流报文C的报文头特征与规则3的匹配域匹配成功，则执行所述规则3的动作：去除NSH，并将所述业务流报文C转发至下一跳。其中，所述业务流报文C的下一跳为SF设备，可以用SF设备的MAC地址或IP地址表示。所述规则4的匹配域为协议层包头特征，若匹配成功，执行所述规则4的动作为：为所述业务流报文C添加NSH，设置NSH的SPI，SI，并将添加NSH的业务流报文C转发至SFF。
以下，结合具体示例介绍对业务流报文的处理过程，业务流报文A的业务功能路径 为Firewall->LB，即从防火墙设备到负载均衡设备。该业务功能路径的SPI为1，业务索引SI为2，该业务流报文A的L3特征为源IP为1.1.1.2，目的IP为3.1.1.2，源端口号为3，目的端口号为6，该业务流报文为L3报文。
在本示例中，SP设备可以为图1所示的网络架构中的SP设备，SFF可以为图1所示的网络架构中的SFF2，防火墙设备和负载均衡设备可以为图1所示的网络架构中的SF3和SF4，以SF3为防火墙设备，SF4为负载均衡设备为例进行描述。
以下，结合图4，详细介绍对业务流报文A的处理过程。
S1，所述分类器接收到所述业务流报文A后，可以将所述业务流报文A的报文头特征与所述分类器中的规则0的匹配域进行匹配，匹配成功，所述分类器为所述业务流报文A添加NSH，并设置NSH中的SPI为1，SI为2，将添加NSH后的业务流报文A记为业务流报文B，将所述业务流报文B转发给SFF。
具体的，分类器上的规则0具体表示如下：
Match：source IP＝1.1.1.2,destination IP＝3.1.1.2,source port＝3,destination port＝6；
Action:PUSH_NSH,set_NSH_field(SPI＝1,SI＝2),set_MAC_field(SFF MAC),output。
即所述规则0的匹配域为源IP为1.1.1.2，目的IP为3.1.1.2，源端口为3，目的端口为6，动作为：添加NSH，将添加NSH的业务流报文发送至SFF，也就是说，当分类器接收到的业务流报文的源IP为1.1.1.2，目的IP为3.1.1.2，源端口为3，目的端口为6，则分类器对该业务流报文执行如下处理：添加NSH，设置SPI为1，SI为2，并将添加了NSH的业务流报文发送至SFF。
S2，SFF接收业务流报文B，并根据所述SFF中的规则1对所述业务流报文B进行处理；
将所述业务流报文B的报文头特征与所述规则1的匹配域进行匹配，匹配到SPI为1，SI为2，即SI不为零对应的具体规则1，SFF将所述业务流报文B的目的地址设置为SP设备的MAC地址或IP地址，并转发至SP设备。在本实施例中，将SFF处理后的业务流报文B记为业务流报文C。
具体的，SFF上的规则1描述如下：
Match：NSH(SPI＝1,SI≠0)；
Action:set_MAC_field(SP MAC),output。
也就是所述规则1包括匹配域为SPI＝1,SI≠0的具体规则1，当匹配成功时，执行如下动作：将业务流报文的地址设置为SP的MAC地址，也就是说，当SFF接收到的业务流报文的头特征为SPI为1，SI不为0时，SFF将所述业务流报文发送至SP。
Match：NSH(SPI＝1,SI＝0)；
Action:POP_NSH,output。
也就是所述规则1包括匹配域为SPI＝1,SI＝0的具体规则2，当匹配成功时，执行如下动作：去除业务流报文的NSH头，并发送至网络，也就是说，当SFF接收到的业务流报文的头特征为SPI为1，SI为0时，SFF将所述业务流报文去除NSH，并发送至网络。
总的来说，SFF中的规则1可以包括两个具体规则，即SPI＝1,SI≠0对应的具体规则1和SPI＝1,SI＝0对应的具体规则2，当业务流报文的报文头特征与所述规则1包括具体规则1或具体规则2中的任一具体规则匹配成功，即可认为所述业务流报文的报文头特征与所述规则1的匹配域匹配成功。
结合前述示例，所述业务流报文B的报文头特征与规则1的具体规则1的匹配域匹配成功，即所述业务流报文B的报文头特征与规则1匹配成功，则执行具体规则1的动作，将业务流报文C发送至SP设备。
S3，SP设备接收业务流报文C，并根据所述SP设备中的规则2对所述业务流报文C进行处理。
具体的，所述SP设备将所述业务流报文C的报文头特征与所述规则2的匹配域进行匹配，匹配到SPI为1，SI为2对应的具体规则，创建规则3和规则4，并将业务流报文C转入至规则3或规则4进行处理。在本实施例中，将SP处理后的业务流报文C记为业务流报文D。
SP设备上的规则2描述如下：
Match:NSH_header(SPI＝1,SI＝2)；
Action:create_rule(rule3),create_rule(rule4),gotorule(rule3)。
也就是所述规则2包括匹配域为SPI＝1,SI＝2对应的具体规则，当匹配成功时，执行如下动作：创建规则3和规则4，并将报文转入至规则3进行处理。也就是说，当SP设备接收到的业务流报文的头特征为SPI为1，SI为2时，SP设备创建2个规则：规则3和队则4，并将接收到的业务流报文转入至规则3进行处理。
其中，根据规则2创建的规则3描述如下：
Match:NSH_header(SPI＝1,SI＝2)；
Action:POP_NSH,set_MAC_field(Firewall MAC),output。
也就是所述规则3包括匹配域为SPI＝1,SI＝2对应的具体规则，当匹配成功时，执行如下动作：设置业务流报文的地址为防火墙的地址，也就是说，当SP设备接收到的业务流报文的头特征为SPI为1，SI为2时，SP设备将所述业务流报文发送至Firewall。
根据规则2创建的规则4表示如下：
Match:source IP＝1.1.1.2,destination IP＝3.1.1.2,source port＝3,destination port＝6；
Action:PUSH_NSH,set_NSH_field(SPI＝1,SI＝1),set_MAC_field(SFF MAC),output。
表示当SP设备接收到的业务流报文的源IP为1.1.1.2，目标IP为3.1.1.2，源端口为3，目的端口为6，则SP设备对接收到的业务流报文执行如下动作：添加NSH，设置SPI为1，SI为1，并将添加了NSH的业务流报文发送至SFF。
结合前述示例，业务流报文C的报文头特征与规则3的匹配域匹配成功，所述SP执行规则3的动作：去除所述业务流报文C的NSH，并将去除了NSH的业务流报文C发送至下一跳。其中，所述去除了NSH的业务流报文C的下一跳为防火墙设备，所述防火墙设备的地址可以用防火墙设备的MAC地址或IP地址表示。本实施例中，仅以用MAC地址表示作为示例，将去除了NSH的业务流报文C称为业务流报文D。
S4，防火墙设备接收到业务流报文D后，对所述业务流报文D进行处理，并将处理后的业务流报文D发送至SP设备。本实施例中，将经防火墙处理后的业务流报文D称为业务流报文E。
S5，SP设备接收到业务流流报文E后，可以将业务流报文E的报文头特征与所述SP设备中的规则4的匹配域进行匹配，若匹配成功，则为所述业务流报文E添加NSH，并设置NSH中的SPI为1，SI为1，将所述业务流报文E的目的地址设置为SFF的MAC地址或IP地址，并将所述业务流报文E转发至SFF。本实施例中，将SP设备处理后的 业务流报文E记为业务流报文F。
S6，SFF接收到所述业务流报文F后，根据所述SFF中的规则1对业务流报文F进行处理，具体的，判定业务流报文F的NSH的SI不为零，将所述业务流报文F的目的地址设置为SP设备的MAC地址或IP地址，将业务流报文F转发给SP设备。
S7，SP设备接收到业务流报文F后，按照所述SP设备中的规则的优先级依次匹配，先匹配规则3或规则4，若匹配不成功，继续匹配规则2。
结合前述示例，SP设备接收到业务流报文F后，因为业务流报文F是NSH头报文，且NSH中的SPI＝1，SI＝1，因此与规则3和规则4匹配失败。所述SP设备继续匹配所述SP中的其他规则，例如，规则2，若匹配成功，根据规则2，创建2个高先级规则5和规则6，并将业务流报文F转入至规则5进行处理。
其中，规则5的匹配域为NSH，规则5的动作为：去除NSH，并将接收到的业务流报文发送至下一跳。其中，所述接收到的业务流报文的下一跳为SF设备，所述SF设备的地址可以用SF设备的MAC地址表示，也可以由SF设备的IP地址表示，本申请实施例不做限定。规则6的匹配域为协议层包头特征，所述规则6的动作为：添加NSH头，并将接收到的业务流报文发送至下一跳。其中，所述接收到的业务流报文的下一跳为SFF，可以用SFF的MAC地址表示，也可以用SFF的IP地址表示，本申请实施例不做限定。
需要说明的是，本实施例中的规则2是一类规则，包含多个具体的规则，除了包含S3中描述的具体规则外，还可以包括如下规则：
Match:NSH_header(SPI＝1,SI＝1)；
Action:create_rule(rule5),create_rule(rule6),gotorule(rule5)。
也就是所述规则1还可以包括匹配域为SPI＝1,SI＝1对应的具体规则3，当匹配成功时，执行如下动作：创建规则5和规则6，将业务流报文转入至规则5进行处理。也就是说，当SFF接收到的业务流报文的SPI为1，SI为1时，SFF创建2个高优先级规则：规则5和规则6，并将业务流报文转入至规则5进行处理。
总的来说，所述规则2可以包括如下具体规则：SPI＝1,SI＝2对应的具体规则1，SPI＝1,SI＝0对应的具体规则2，SPI＝1,SI＝1对应的具体规则3。当业务流报文的报文头特征与所述规则2包括具体规则1～具体规则3中的任一具体规则匹配成功，即可认为所述业务流报文的报文头特征与所述规则2的匹配域匹配成功。
规则5的描述如下：
Match:NSH_header(SPI＝1,SI＝1)；
Action:POP_NSH,set_MAC_field(LB MAC),output。
表示的是当SFF接收到的业务流报文的SPI为1，SI为1时，SFF对业务流报文执行如下处理：去除NSH头，并将去除了NSH头的业务流报文发送至LB设备。
根据规则2创建的规则6描述如下：
Match:source IP＝1.1.1.2,destination IP＝3.1.1.2,source port＝3,destination port＝6；
Action:PUSH_NSH,set_NSH_field(SPI＝1,SI＝0),set_MAC_field(SFF MAC),output。
表示当SP设备接收到的业务流报文的源IP为1.1.1.2，目标IP为3.1.1.2，源端口为3，目的端口为6时，则SP设备对接收到的业务流报文执行如下动作：添加NSH，设置SPI为1，SI为0，并将添加了NSH的业务流报文发送至SFF。
在本实施例中，SP设备接收业务流报文F后，按照规则优先级依次匹配SP设备上的规则。与规则2匹配成功，执行规则2的动作，创建2个高先级规则：规则5和规则6，并将业务流报文F转入至规则5。将业务流报文F的NSH头特征与规则5的匹配域进行匹配，匹配成功，则执行规则5的动作：去除业务流报文E的NSH，将去除了NSH的业务流报文E发送至LB设备。本申请实施例中，将去除了NSH的业务流报文F称为业务流报文G。
S8，LB设备接收到业务流报文G后，对所述业务流报文G进行处理，将处理后的业务流报文G转发至SP设备，将处理后的业务流报文G记为业务流报文H。
S9，SP设备接收到业务流报文H后，按照所述SP中的规则的优先级依次匹配。结合前述示例，所述业务流报文H的报文头特征与规则6的匹配域匹配成功，则执行规则6的动作：添加NSH，设置SPI为1，SI为0，并将添加了NSH的业务流报文发送至SFF。其中，SFF的地址可以用SFF的MAC地址或IP地址表示，将添加NSH的业务流报文H记为业务流报文I。
S10，SFF接收到业务流报文I后，根据所述SFF中的规则1对所述业务流报文I进行处理，由于此时，SI为零，即到达业务功能路径的结束位置，所述SFF执行规则1包括的具体规则2的动作：去除业务流报文I的NSH，将去除NSH的业务流报文I转发至网络。
图5所示为当转发设备为SFF时，根据本申请实施例的处理报文的方法的示意性流程图。也就是说，在本实施例中，具备创建规则能力的为SFF，如图5所示，所述方法包括如下内容：
501，SFC控制器构建业务功能链SFC，并向所述业务功能路径上的网元发送相应的规则。
具体的，对于分类器，在501中所述SFC控制器下发的规则为规则1，所述规则1的匹配域为协议层包头特征。
在502中，所述分类器根据所述分类器中的规则1对业务流报文A进行处理。
具体的，所述分类器可以将接收的业务流报文A的报文头特征与所述规则1的匹配域进行匹配，若所述业务流报文A的报文头特征与所述规则1的匹配域匹配成功，所述分类器执行所述规则1的动作：为所述业务流报文A添加NSH，并设置NSH中的SPI和SI，并将添加NSH的所述业务流报文A发送至SFF。本实施例中，将添加了NSH后的业务流报文A记为业务流报文B。
在503中，将所述业务流报文B转发给SFF。
在504中，所述SFF接收所述业务流报文B，并对业务流报文B进行处理。
对于SFF而言，在501中所述SFC控制器下发的规则为规则2，所述规则2的匹配域为NSH，所述SFF接收到所述业务流报文B时，将所述业务流报文B的报文头特征与所述规则2的匹配域进行匹配，若匹配到SI为零，则去除业务流报文B的NSH并将去除NSH的业务流报文B转发至网络，若匹配到SI不为零，创建规则3和规则4，并根据规则3或规则4对所述业务流报文B进行处理，其中，所述规则3和规则4的优先级高于规则2。所述规则3的匹配域为NSH，若匹配成功，所述规则3的动作为：去除NSH，将业务流报文的目的地址设置为SF的MAC地址或IP地址，并将业务流报文转发至SF。所述规则4的匹配域为协议层包头特征，若匹配成功，所述规则4的动作为：为业务流 报文添加NSH，并修改NSH的SPI和SI，并根据前述的第四规则处理已添加NSH的所述业务流报文，为了简洁，这里不再赘述。
以下，结合具体示例介绍对业务流报文的处理过程，业务流报文A的业务功能路径为Firewall->LB，即从防火墙设备到负载均衡设备。该业务功能路径的SPI为1，业务索引SI为2，该业务流报文A的L3特征为源IP为1.1.1.2，目的IP为3.1.1.2，源端口号为3，目的端口号为6，该业务流报文为L3报文。
在本示例中，SFF设备可以为图1所示的网络架构中的SFF1设备，防火墙设备和负载均衡设备可以为图1所示的网络架构中的SF1和SF2，以SF1为防火墙设备，SF2为负载均衡设备为例进行描述。
以下，结合图6，详细介绍对业务流报文A的处理过程。
S1，所述分类器接收到所述业务流报文A后，可以将所述业务流报文A的报文头特征与所述规则1的匹配域进行匹配，匹配成功，所述分类器为所述业务流报文A添加NSH，并设置NSH中的SPI为1，SI为2，将添加NSH后的业务流报文A记为业务流报文B，并设置所述业务流报文B的目的地址为SFF的MAC地址或IP地址，将所述业务流报文B转发给SFF。
具体的，规则1的描述如下：
Match：source IP＝1.1.1.2,destination IP＝3.1.1.2,source port＝3,destination port＝6；
Action:PUSH_NSH,set_NSH_field(SPI＝1,SI＝2),set_MAC_field(SFF MAC),output。
表示当分类器接收到的业务流报文的源IP为1.1.1.2，目的IP为3.1.1.2，源端口为3，目的端口为6，则分类器对该业务流报文执行如下处理：添加NSH，设置SPI为1，SI为2，并将添加了NSH的业务流报文发送至SFF。
S2，SFF根据规则2对所述业务流报文B进行处理，具体的，将所述业务流报文B的报文头特征与所述规则2的匹配域进行匹配，匹配到SPI为1，SI为2，则SFF创建2个高优先级规则：规则3和规则4，并将该业务流报文B转入至规则3进行处理。
其中，规则3的匹配域为NSH，包括SP、SI，所述规则3的动作为：SFF去除业务流报文的NSH，并将去除NSH的业务流报文发送至SF。规则4的匹配域为协议层包头特征，所述规则4的动作为：SFF为业务流报文添加NSH，设置SPI、SI，并将添加了NSH的业务流报文推送至规则2进行处理。
结合前述示例，规则2的描述如下：
Match：NSH(SPI＝1,SI＝2)；
Action:create_rule(rule3),create_rule(rule4),gotorule(rule3)。
表示当SFF接收到的业务流报文头特征为SPI为1，SI为2时，SFF创建2个高先级规则，并将业务流报文转入至规则3进行处理。
Match：NSH(SPI＝1,SI＝0)；
Action:POP_NSH,output。
表示当SFF接收到的业务流报文的头特征为SPI为1，SI为0时，SFF将所述业务流报文去除NSH，并发送至网络。
根据规则2创建的高优先级规则3的描述如下：
Match:NSH_header(SPI＝1,SI＝2)；
Action:POP_NSH,set_MAC_field(Firewall MAC),output；
表示当SP设备接收到的业务流报文的头特征为SPI为1，SI为2时，SP设备将所述业务流报文发送至防火墙设备。
根据规则2创建的高优先级规则4描述如下：
Match:source IP＝1.1.1.2,destination IP＝3.1.1.2,source port＝3,destination port＝6；
Action:PUSH_NSH,set_NSH_field(SPI＝1,SI＝1),gotorule(rule2)。
表示当SP设备接收到的业务流报文的源IP为1.1.1.2，目标IP为3.1.1.2，源端口为3，目的端口为6，则SP设备对接收到的业务流报文执行如下动作：添加NSH，设置SPI为1，SI为1，并将添加了NSH的业务流报文转入至规则2。
结合前述示例，所述业务流报文B的报文头特征与规则3的匹配域匹配成功，则执行规则3的动作，将经SFF处理后的所述业务流报文B记为业务流报文C，将业务流报文C发送给防火墙设备。
S3，防火墙设备接收到所述业务流报文C后，对所述业务流报文C进行处理，并将处理后的业务流报文C发送至SFF。
S4，SFF接收到经所述防火墙设备处理后的所述业务流流报文C后，按照所述SFF中的规则的优先级依次进行匹配，直至匹配到某一规则，则执行相应的动作。
结合前述示例，所述业务流报文C为L3报文，将所述业务流报文C的报文头特征与所述规则4的匹配域进行匹配，若匹配成功，则执行规则4的动作：为所述业务流报文C添加NSH，并设置NSH中的SPI为1，SI为1，将添加NSH的业务流报文C记为业务流报文D，然后根据规则2对所述业务流报文D进行处理。
需要说明的是，本实施例的规则2指的是一类规则，除了包含S2中所示的具体规则外，还可以包括如下具体规则：
Match：NSH(SPI＝1,SI＝1)；
Action:create_rule(rule5),create_rule(rule6),gotorule(rule5)。
表示当SFF接收到的业务流报文头特征为SPI为1，SI为1时，SFF创建2个高先级规则：规则5和规则6，并将业务流报文转入至规则5进行处理。
也就是说，所述规则2可以包括如下具体规则：SPI＝1,SI＝2对应的具体规则1，SPI＝1,SI＝0对应的具体规则2，SPI＝1,SI＝1对应的具体规则3，当业务流报文的报文头特征与所述规则2包括具体规则1～具体规则3中的任一具体规则匹配成功，即可认为所述业务流报文的报文头特征与所述规则2的匹配域匹配成功。。
根据规则2创建的高优先级规则5的描述如下：
Match:NSH_header(SPI＝1,SI＝1)；
Action:POP_NSH,set_MAC_field(LB MAC),output。
表示当SFF接收到的业务流报文的头特征为SPI为1，SI为1时，SFF执行如下动作：去除NSH头，并将所述业务流报文发送至LB设备。
根据规则2创建的高优先级规则6描述如下：
Match:source IP＝1.1.1.2,destination IP＝3.1.1.2,source port＝3,destination port＝6；
Action:PUSH_NSH,set_NSH_field(SPI＝1,SI＝0),gotorule(rule2)。
表示当SFF接收到的业务流报文的源IP为1.1.1.2，目标IP为3.1.1.2，源端口为3，目的端口为6，则SFF对接收到的业务流报文执行如下动作：添加NSH，设置SPI为1，SI为0，并将添加了NSH的业务流报文转入至规则2。
结合前述示例，业务流报文D的报文头特征与规则5的匹配域匹配成功，执行规则5的动作：去除业务流报文D的NSH，将去除了NSH的业务流报文称为业务流报文E，将业务流报文E发送至LB设备。
S5，LB设备接收到业务流报文E后，对所述业务流报文E进行处理，将处理后的业务流报文E转发至SFF。
S6，SFF接收到经LB设备处理后的所述业务流流报文E后，按照所述SFF中的规则的优先级依次进行匹配，直至匹配到某一规则，则执行相应的动作。
需要说明的是，SFF中的规则3、规则4、规则5、规则6的优先级相同，且都高于规则2。
所述业务流流报文E的报文头特征为L3特征，与规则6的匹配域匹配成功，则SFF执行规则6的动作：为所述业务流报文E添加NSH，设置SPI为1，SI为0，并将添加了NSH的业务流报文转入至规则2。本实施例中，将添加了NSH的业务流报文E称为业务流报文F。
此时，业务流报文F中的SI为0，匹配到规则2的中SPI＝1，SI为0对应的具体规则2，即到达业务功能路径的结束位置，所述SFF去除业务流报文F的NSH，将去除NSH的业务流报文F转发至网络，至此，所述业务流报文A的处理过程结束。
因此，本申请实施例的处理报文的方法，转发设备可以根据SFC控制器下发的第一规则，生成两个优先级较高的第二规则和第三规则，从而可以根据所述第二规则和所述第三规则处理来自分类器，SFF或SF设备的业务流报文，因此，所述转发设备不用通过上报SFC控制器获取恢复NSH的规则，从而，有利于降低控制信令的开销。从另一方面来讲，也有利于避免转发设备上存储大量的转发规则对存储空间的浪费。
上文结合图2至图6，详细描述了本申请的方法实施例，下文结合图7至图9，描述本申请的装置实施例，应理解，装置实施例与方法实施例相互对应，类似的描述可以参照方法实施例。
图7是根据本申请实施例的处理报文的装置的示意框图。图7的装置700的一个例子是转发设备，例如，SFF或SP。装置700包括接收模块710，匹配模块720和操作模块730。
接收模块710，用于从业务功能链控制器接收第一规则，所述第一规则包括匹配域，所述匹配域为网络服务包头NSH，
所述接收模块710还用于接收第一业务流报文；
匹配模块720，用于将所述第一业务流报文的报文头特征与所述第一规则的匹配域进行匹配；
操作模块730，用于在所述第一业务流报文的报文头特征与所述第一规则的匹配域匹配成功的情况下，根据所述第一规则创建第二规则和第三规则，所述第二规则和所述第三规则的优先级高于所述第一规则。
可选地，在一些实施例中，所述第一规则的匹配域还包括协议层包头特征。
可选地，在一些实施例中，所述第二规则的匹配域为NSH，所述接收模块710还用于：
从业务功能转发器SFF或分类器接收第二业务流报文，
所述匹配模块720还用于：
将所述第二业务流报文的报文头特征与所述第二规则的匹配域进行匹配，所述第二业务流报文的报文头特征包括NSH；
所述操作模块730还用于：若所述第二业务流报文的报文头特征与所述第二规则的匹配域匹配成功，执行所述第二规则的动作：去除所述第二业务流报文的NSH，并将处理后的第二业务流报文转发至业务功能SF设备。
可选地，在一些实施例中，所述第二规则的匹配域还包括协议层包头特征。
可选地，在一些实施例中，所述第三规则的匹配域为协议层包头特征，所述接收模块710还用于：
从SF设备接收第三业务流报文，
所述匹配模块720还用于：
将所述第三业务流报文的报文头特征与所述第三规则的匹配域进行匹配；
所述操作模块730还用于：
若所述第三业务流报文的报文头特征与所述第三规则的匹配域匹配成功，执行所述第三规则的动作：为所述第三业务流报文添加NSH。
可选地，在一些实施例中，所述转发设备为SFF，所述操作模块还用于：
处理已添加NSH的所述第三业务流报文。
可选地，在一些实施例中，所述转发设备为SP设备，所述装置还包括：
发送模块，用于将已添加NSH的所述第三业务流报文转发至SFF。
可选地，在一些实施例中，所述第一业务流报文、所述第二业务流报文和所述第三业务流报文属于同一业务流。
具体地，该装置700可对应于根据本申请实施例的处理报文的方法200中的转发设备，或图3所示方法中SP设备，或图5所示方法中的SFF，该装置700可以包括用于执行图2中方法200中转发设备，或图3中SP设备或图5中SFF执行的方法的实体单元。并且，该装置700中的各实体单元和上述其他操作和/或功能分别为了实现图2中方法200中转发设备，或图3中SP设备或图5中SFF的相应流程，为了简洁，在此不再赘述。
如图8所示，本申请实施例提供一种处理数据报文的装置的其中一种硬件实现。该装置可以是转发设备，示例性的，可以是SFF或SP设备。
该装置包括处理器、存储器、第一网络接口，第二网络接口和第三网络接口。其中第一网络接口，第二网络接口，第三网络接口，处理器和存储器之间通信连接。第一网络接口可以与控制设备连接，进行交互，示例性的，该控制设备可以是SFC控制器。第二网络接口作为该装置的输入端口，可以用于接收业务流报文。第三网络接口作为该装置的输出端口，可以用于发送经过处理器处理的业务流报文。示例性的，每个网络接口可以包含多个输入和输出端口。第一、第二和第三网络接口可以是相互独立的网络接口，也可相互合并为一个网络接口；存储器可以为半导体存储单元，可以直接被处理器访问。
其中，存储器用于存储计算机可执行的程序代码，该程序代码用来执行如图2，图3或图5所示的处理报文的方法，以及用于存储本申请实施例提供的流表项。处理器，用于根据存储器存储的计算机可执行的程序代码，执行如图2，图3或图5所示的处理报文的方法，对接收到的业务流报文进行处理。
本申请另一实施例还提供一种处理报文的系统，如图9所示，该系统包括转发设备910和控制设备920。
可选地，所述处理报文的系统还可以包括分类器。示例性的，所述转发设备910可以为图7所示的装置700，所述控制设备920可以为图1所示的SFC控制器，或也可以为图2所示的方法200，图3或图5中的SFC控制器。
本申请实施例还提供了一种计算机可读介质，所述计算机可读介质存储用于计算机执行的程序代码，所述程序代码用于执行如图2，图3或图5所示的处理数据报文的方法。
本申请实施例还提供一种计算机程序产品。该计算机程序产品包括能够被计算机执行的程序代码，该程序代码用来执行如图2，图3或图5所示的处理数据报文的方法。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序 代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (18)

  1. 一种处理报文的方法，其特征在于，包括：
    转发设备从业务功能链控制器接收第一规则，所述第一规则包括匹配域，所述匹配域为网络服务包头NSH；
    所述转发设备接收第一业务流报文，将所述第一业务流报文的报文头特征与所述第一规则的匹配域进行匹配；
    若所述第一业务流报文的报文头特征与所述第一规则的匹配域匹配成功，所述转发设备根据所述第一规则创建第二规则和第三规则，所述第二规则和所述第三规则的优先级高于所述第一规则。
  2. 根据权利要求1所述的方法，其特征在于，所述第一规则的匹配域还包括协议层包头特征。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第二规则的匹配域为NSH，所述方法还包括：
    所述转发设备从业务功能转发器SFF或分类器接收第二业务流报文，
    将所述第二业务流报文的报文头特征与所述第二规则的匹配域进行匹配，所述第二业务流报文的报文头特征包括NSH；
    若所述第二业务流报文的报文头特征与所述第二规则的匹配域匹配成功，执行所述第二规则的动作：去除所述第二业务流报文的NSH，并将处理后的第二业务流报文转发至业务功能SF设备。
  4. 根据权利要求3所述的方法，其特征在于，所述第二规则的匹配域还包括协议层包头特征。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述第三规则的匹配域为协议层包头特征，所述方法还包括：
    所述转发设备从SF设备接收第三业务流报文，
    将所述第三业务流报文的报文头特征与所述第三规则的匹配域进行匹配；
    若所述第三业务流报文的报文头特征与所述第三规则的匹配域匹配成功，执行所述第三规则的动作：为所述第三业务流报文添加NSH。
  6. 根据权利要求5所述的方法，其特征在于，所述转发设备为SFF，所述方法还包括：
    处理已添加NSH的所述第三业务流报文。
  7. 根据权利要求5所述的方法，其特征在于，所述转发设备为SP设备，所述方法还包括：
    将已添加NSH的所述第三业务流报文转发至SFF。
  8. 根据权利要求5至7中任一项所述的方法，其特征在于，所述第一业务流报文、所述第二业务流报文和所述第三业务流报文属于同一业务流。
  9. 一种处理报文的装置，其特征在于，包括：
    接收模块，用于从业务功能链控制器接收第一规则，所述第一规则包括匹配域，所述匹配域为网络服务包头NSH，
    所述接收模块还用于接收第一业务流报文；
    匹配模块，用于将所述第一业务流报文的报文头特征与所述第一规则的匹配域进行 匹配；
    操作模块，用于在所述第一业务流报文的报文头特征与所述第一规则的匹配域匹配成功的情况下，根据所述第一规则创建第二规则和第三规则，所述第二规则和所述第三规则的优先级高于所述第一规则。
  10. 根据权利要求9所述的装置，其特征在于，所述第一规则的匹配域还包括协议层包头特征。
  11. 根据权利要求9或10所述的装置，其特征在于，所述第二规则的匹配域为NSH，所述接收模块还用于：
    从业务功能转发器SFF或分类器接收第二业务流报文，
    所述匹配模块还用于：
    将所述第二业务流报文的报文头特征与所述第二规则的匹配域进行匹配，所述第二业务流报文的报文头特征包括NSH；
    所述操作模块还用于：
    若所述第二业务流报文的报文头特征与所述第二规则的匹配域匹配成功，执行所述第二规则的动作：去除所述第二业务流报文的NSH，并将处理后的第二业务流报文转发至业务功能SF设备。
  12. 根据权利要求11所述的装置，其特征在于，所述第二规则的匹配域还包括协议层包头特征。
  13. 根据权利要求9至12中任一项所述的装置，其特征在于，所述第三规则的匹配域为协议层包头特征，所述接收模块还用于：
    从SF设备接收第三业务流报文，
    所述匹配模块还用于：
    将所述第三业务流报文的报文头特征与所述第三规则的匹配域进行匹配；
    所述操作模块还用于：
    若所述第三业务流报文的报文头特征与所述第三规则的匹配域匹配成功，执行所述第三规则的动作：为所述第三业务流报文添加NSH。
  14. 根据权利要求13所述的装置，其特征在于，所述转发设备为SFF，所述操作模块还用于：
    处理已添加NSH的所述第三业务流报文。
  15. 根据权利要求13所述的装置，其特征在于，所述转发设备为SP设备，所述装置还包括：
    发送模块，用于将已添加NSH的所述第三业务流报文转发至SFF。
  16. 根据权利要求13至15中任一项所述的装置，其特征在于，所述第一业务流报文、所述第二业务流报文和所述第三业务流报文属于同一业务流。
  17. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行如权利要求1至8中任一项所述的方法。
  18. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如权利要求1至8中任一项所述的方法。
PCT/CN2017/078608 2017-03-29 2017-03-29 处理报文的方法和装置 WO2018176272A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
PCT/CN2017/078608 WO2018176272A1 (zh) 2017-03-29 2017-03-29 处理报文的方法和装置
EP17902970.7A EP3589024A4 (en) 2017-03-29 2017-03-29 METHOD AND DEVICE FOR PROCESSING A MESSAGE
CN201780088660.1A CN110431885B (zh) 2017-03-29 2017-03-29 处理报文的方法和装置
US16/585,454 US20200028779A1 (en) 2017-03-29 2019-09-27 Packet processing method and apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/078608 WO2018176272A1 (zh) 2017-03-29 2017-03-29 处理报文的方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/585,454 Continuation US20200028779A1 (en) 2017-03-29 2019-09-27 Packet processing method and apparatus

Publications (1)

Publication Number Publication Date
WO2018176272A1 true WO2018176272A1 (zh) 2018-10-04

Family

ID=63673970

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/078608 WO2018176272A1 (zh) 2017-03-29 2017-03-29 处理报文的方法和装置

Country Status (4)

Country Link
US (1) US20200028779A1 (zh)
EP (1) EP3589024A4 (zh)
CN (1) CN110431885B (zh)
WO (1) WO2018176272A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2576323B (en) * 2018-08-13 2021-01-06 Metaswitch Networks Ltd Programmable packet data processing system
US11411843B2 (en) * 2019-08-14 2022-08-09 Verizon Patent And Licensing Inc. Method and system for packet inspection in virtual network service chains
CN115277582B (zh) * 2022-07-13 2024-03-26 清华大学 一种软件数据包分类加速方法、装置、设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2011099724A2 (ko) * 2010-02-11 2011-08-18 (주)팬택 반송파 집합화에서 지시 정보를 송수신하는 방법 및 장치
CN104518969A (zh) * 2014-12-12 2015-04-15 北京智谷睿拓技术服务有限公司 数据报文处理方法、装置及交换机
WO2015100650A1 (zh) * 2013-12-31 2015-07-09 华为技术有限公司 一种报文处理方法、装置及系统
WO2016127398A1 (zh) * 2015-02-13 2016-08-18 华为技术有限公司 控制接入的装置、系统和方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104639404A (zh) * 2013-11-08 2015-05-20 天津瑞辰永道信息科技有限公司 一种多媒体宽带接入网络系统
US10003530B2 (en) * 2014-07-22 2018-06-19 Futurewei Technologies, Inc. Service chain header and metadata transport
CN105453493B (zh) * 2014-07-23 2019-02-05 华为技术有限公司 业务报文转发方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2011099724A2 (ko) * 2010-02-11 2011-08-18 (주)팬택 반송파 집합화에서 지시 정보를 송수신하는 방법 및 장치
WO2015100650A1 (zh) * 2013-12-31 2015-07-09 华为技术有限公司 一种报文处理方法、装置及系统
CN104518969A (zh) * 2014-12-12 2015-04-15 北京智谷睿拓技术服务有限公司 数据报文处理方法、装置及交换机
WO2016127398A1 (zh) * 2015-02-13 2016-08-18 华为技术有限公司 控制接入的装置、系统和方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3589024A4 *

Also Published As

Publication number Publication date
US20200028779A1 (en) 2020-01-23
EP3589024A1 (en) 2020-01-01
CN110431885B (zh) 2021-02-26
EP3589024A4 (en) 2020-01-08
CN110431885A (zh) 2019-11-08

Similar Documents

Publication Publication Date Title
US10135636B2 (en) Method for generating forwarding information, controller, and service forwarding entity
CN108141416B (zh) 一种报文处理方法、计算设备以及报文处理装置
US10630578B2 (en) Systems and methods for software defined networking service function chaining
CN108702331B (zh) Sr应用段与服务功能链(sfc)报头元数据的集成
US9887917B2 (en) Port extender
US10749794B2 (en) Enhanced error signaling and error handling in a network environment with segment routing
US9847934B2 (en) Reducing packet reordering in flow-based networks
US9973419B2 (en) Routing management method, routing method, network controller, and router
EP2676411B1 (en) Method and system for classification and management of inter-blade network traffic in a blade server
WO2019057199A1 (zh) 一种报文转发的方法及网络设备
WO2017206793A1 (zh) 一种业务功能链的创建方法及系统
EP3278513B1 (en) Transforming a service packet from a first domain to a second domain
JP7080983B2 (ja) 統一ｓｒラベルスタックを用いてメッセージ処理を行う方法および装置
CN109361606B (zh) 一种报文处理系统及网络设备
CN108574638B (zh) 一种数据报文的转发方法和设备
EP3094053A1 (en) Predictive egress packet classification for quality of service
WO2018036254A1 (zh) 报文转发方法及装置
US20200028779A1 (en) Packet processing method and apparatus
US20220052950A1 (en) Service Function Chaining Congestion Tracking
JP5534033B2 (ja) 通信システム、ノード、パケット転送方法およびプログラム
CN114338510B (zh) 控制和转发分离的数据转发方法和系统
US7978728B2 (en) Network clustering for improving connection management and re-routing capabilities
US10177935B2 (en) Data transfer system, data transfer server, data transfer method, and program recording medium
EP3166273B1 (en) Method and system for processing service node ability
US9356864B2 (en) Packet transfer apparatus and packet relay method

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17902970

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017902970

Country of ref document: EP

Effective date: 20190923