WO2021151301A1 - Ovs-based data packet processing method and apparatus, computer device, and computer readable storage medium - Google Patents

Abstract

The present application relates to the technical field of computers and provides an OVS-based data packet processing method and related devices. The OVS-based data packet processing method comprises: extracting a first key information from a data packet; calculating a first hash value of the data packet; determining whether a mask index related to the first hash value is present in a pre-set mask index table; if no related mask index is present in the pre-set mask index table, searching, according to a first mask, the first key information, and the pre-set flow mask table, multiple general flow tables for a target flow table of the data packet; if no target flow table of the data packet is found from the multiple general flow tables, searching, according to the first mask, the first key information, and the pre-set flow mask table, the default flow table for a target flow table of the data packet; executing a processing instruction on the data packet according to the target flow table of the data packet. In the present application, data packets are processed according to a flow table, thereby enhancing the accuracy of data packet processing.

Description

OVS-based data packet processing method, device, computer equipment and computer readable storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on August 7, 2020, with the application number CN202010788980.1 and the invention title "OVS-based data packet processing method and related equipment", the entire content of which is incorporated by reference Incorporated in this application.

Technical field

This application relates to the field of computer technology, and in particular to an OVS-based data packet processing method, device, computer equipment, and computer-readable storage medium.

Background technique

OVS (Openvswitch, Open Virtual Switch) is an open source software widely used in virtual platforms. OVS forms switch components through software, which can realize the processing functions of traditional physical switches for data packets and other network characteristics.

technical problem

The inventor realizes that when the data packet is processed according to the flow table, there may be inaccurate matching between the flow table and the data packet. Inaccurate matching between the flow table and the data packet will reduce the accuracy of data packet processing. How to improve the accuracy of data packet processing has become a problem to be solved.

Technical solutions

An OVS-based data packet processing method, the OVS-based data packet processing method includes:

Obtain a data packet, the first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables, and a default flow table, where the plurality of ordinary flow tables includes routing the data A processing instruction to the virtual machine, the default flow table includes a processing instruction to route data to the gateway;

Extracting the first key information from the data packet;

Calculating the first hash value of the data packet;

Judging whether there is an associated mask index of the first hash value in the preset mask index table;

When the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask table from the multiple ordinary streams Look up the target flow table of the data packet in the table;

When the target flow table of the data packet is not found from the multiple ordinary flow tables, the data packet is retrieved from the missing data according to the first mask, the first key information, and the preset flow mask table. Searching the target flow table of the data packet in the provincial flow table;

The processing instruction for the data packet is executed according to the target flow table of the data packet.

An OVS-based data packet processing device, the OVS-based data packet processing device includes:

The obtaining module is used to obtain a data packet, the first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables and a default flow table, the plurality of ordinary flows The table includes processing instructions for routing data to the virtual machine, and the default flow table includes processing instructions for routing data to the gateway;

An extraction module for extracting the first key information from the data packet;

A calculation module for calculating the first hash value of the data packet;

A judging module, configured to judge whether there is an associated mask index of the first hash value in the preset mask index table;

The first search module is configured to, when the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask table Searching for the target flow table of the data packet from the multiple ordinary flow tables;

The second searching module is configured to, when the target flow table of the data packet is not found from the multiple ordinary flow tables, according to the first mask, the first key information and the preset flow The mask table searches the target flow table of the data packet from the default flow table;

The execution module is configured to execute processing instructions for the data packet according to the target flow table of the data packet.

A computer device includes a processor, and the processor implements the following steps when the processor is configured to execute computer-readable instructions stored in a memory:

Obtain a data packet, the first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables, and a default flow table, where the plurality of ordinary flow tables includes routing the data A processing instruction to the virtual machine, the default flow table includes a processing instruction to route data to the gateway;

Extracting the first key information from the data packet;

Calculating the first hash value of the data packet;

Judging whether there is an associated mask index of the first hash value in the preset mask index table;

When the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask table from the multiple ordinary streams Look up the target flow table of the data packet in the table;

When the target flow table of the data packet is not found from the multiple ordinary flow tables, the data packet is retrieved from the missing data according to the first mask, the first key information, and the preset flow mask table. Searching the target flow table of the data packet in the provincial flow table;

The processing instruction for the data packet is executed according to the target flow table of the data packet.

A fourth aspect of the present application provides a computer-readable storage medium having computer-readable instructions stored thereon, and when the computer-readable instructions are executed by a processor, the following steps are implemented:

Obtain a data packet, the first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables, and a default flow table, where the plurality of ordinary flow tables includes routing the data A processing instruction to the virtual machine, the default flow table includes a processing instruction to route data to the gateway;

Extracting the first key information from the data packet;

Calculating the first hash value of the data packet;

Judging whether there is an associated mask index of the first hash value in the preset mask index table;

When the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask table from the multiple ordinary streams Look up the target flow table of the data packet in the table;

When the target flow table of the data packet is not found from the multiple ordinary flow tables, the data packet is retrieved from the missing data according to the first mask, the first key information, and the preset flow mask table. Searching the target flow table of the data packet in the provincial flow table;

The processing instruction for the data packet is executed according to the target flow table of the data packet.

Beneficial effect

In this application, the common flow table and the default flow table are matched with the data packet to reduce the occurrence of incorrect matching between the flow table and the data packet, thereby improving the accuracy of processing the data packet according to the flow table.

Description of the drawings

Fig. 1 is a flowchart of an OVS-based data packet processing method provided by an embodiment of the present application.

Fig. 2 is a structural diagram of an OVS-based data packet processing device provided by an embodiment of the present application.

Fig. 3 is a schematic diagram of a computer device provided by an embodiment of the present application.

Embodiments of the present invention

In order to be able to understand the above objectives, features and advantages of the application more clearly, the application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the embodiments of the application and the features in the embodiments can be combined with each other if there is no conflict.

In the following description, many specific details are set forth in order to fully understand the present application. The described embodiments are only a part of the embodiments of the present application, rather than all the embodiments.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field of this application. The terms used in the specification of the application herein are only for the purpose of describing specific embodiments, and are not intended to limit the application.

Preferably, the OVS-based data packet processing method of this application is applied to one or more computer devices. The computer device is a device that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions. Its hardware includes, but is not limited to, a microprocessor, an application specific integrated circuit (Application Specific Integrated Circuit). Specific Integrated Circuit, ASIC), Programmable Gate Array (Field-Programmable Gate Array, FPGA), Digital Signal Processor (DSP), embedded devices, etc.

The computer device may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The computer device can interact with the user through a keyboard, a mouse, a remote control, a touch panel, or a voice control device.

Example one

Fig. 1 is a flowchart of an OVS-based data packet processing method provided in Embodiment 1 of the present application. The OVS-based data packet processing method is applied to a virtual switch in a computer device, and is used to process data packets according to a flow table to improve the accuracy of data packet processing.

As shown in Figure 1, the OVS-based data packet processing method includes:

101. Acquire a data packet, a first mask of the data packet, a preset mask index table, a preset flow mask table, multiple ordinary flow tables, and a default flow table, where the multiple ordinary flow tables include The data is routed to the processing instruction of the virtual machine, and the default flow table includes the processing instruction of the data route to the gateway.

The data packet, the first mask, the preset mask index table, the preset flow mask table, the multiple ordinary flow tables, and the default flow table can be read from a local database .

The data packet, the first mask, the preset mask index table, the preset flow mask table, the multiple ordinary flow tables, and the default flow table can be pulled from the network .

The data packet may come from a first virtual machine in the computer device or a first virtual machine in a virtual network where the computer device is located. The multiple ordinary flow tables include processing instructions for routing data to the second virtual machine.

The flow table can be classified according to the mask. Each mask corresponds to a mask index, and the mask can be searched through the mask index. All mask indexes constitute the mask index table. All masks constitute the preset mask table.

102. Extract the first key information from the data packet.

The first key information is a prerequisite for searching the flow table. The first key information includes the source IP, destination IP address, and IP mask of the data packet.

The value value of the first key information can be extracted from the key value corresponding to the first key information.

Specifically, key information of the physical layer, key information of the MAC layer, key information of the network layer, key information of the transport layer, etc. can be extracted.

103. Calculate the first hash value of the data packet.

The first hash value can be calculated by a preset hash algorithm.

Specifically, the first hash value is calculated based on the MD5 algorithm according to the data packet, the first mask, and the first key information.

Calculate the first hash value according to the data packet based on the SHA-1 algorithm.

104. Determine whether the associated mask index of the first hash value exists in the preset mask index table.

The preset mask index table uses hash values as the main key, and each hash value corresponds to a mask index. The correlation mask index may be searched according to the first hash value.

When the first hash value is queried from the preset mask index table, the mask index corresponding to the first hash value is confirmed as the association mask index.

When the first hash value is not queried from the preset mask index table, the association mask index does not exist in the preset mask index table.

105. When the associated mask index does not exist in the preset mask index table, use the first mask, the first key information, and the preset flow mask table from the multiple Look up the target flow table of the data packet in the ordinary flow table.

For example, the four virtual machines are a, b, c, and d, and the three common flow tables are B, C, and D. According to the common flow table B, data packets can be directed from virtual machine a to virtual machine b. The ordinary flow table C directs the data packet from the virtual machine a to the virtual machine c, and the data packet can be directed from the virtual machine a to the virtual machine d according to the ordinary flow table D. The target flow table (such as B, C, or D) of the data packet can be searched from multiple common flow tables according to the first mask, the first key information, and the preset flow mask table, so as to remove the data packet from the target flow table. The virtual machine a is forwarded to the virtual machine (such as b, c, d) corresponding to the target flow table.

In a specific embodiment, the search for the target flow table of the data packet from the multiple ordinary flow tables according to the first mask, the first key information, and the preset flow mask table include:

Acquiring a maximum index value and a target index value of the preset mask table, where the maximum index value is greater than the target index value;

Acquire a second mask from the preset mask table one by one in the order from the maximum index value to the target index value, and the second mask corresponds to a plurality of designated flow tables in the plurality of ordinary flow tables ；

For each designated flow table in the plurality of designated flow tables, acquiring the second key information of the designated flow table and the second hash value of the designated flow table;

Search from the plurality of ordinary flow tables for the second mask to match the first mask, the second key information to match the first key information, and the second hash value to match the first key information. The first hash value matches the flow table.

Specifically, based on the masked_flow_lookup method, the second mask matches the first mask, the second key information matches the first key information, and the second key information matches the first key information from the multiple ordinary flow tables. A flow table whose hash value matches the first hash value.

The target index value may be 1. The maximum index value is the maximum value among all index values.

106. When the target flow table of the data packet is not found from the multiple ordinary flow tables, follow all data packets according to the first mask, the first key information, and the preset flow mask table. Look up the target flow table of the data packet in the default flow table.

For example, gateway e, the default flow table E, can direct data packets from virtual machine a to gateway e according to the default flow table E. When the target flow table of the data packet is not found from multiple ordinary flow tables (B, C, D), according to the first mask, the first key information and the preset flow mask table from the default flow table E Look up the target flow table of the packet.

In a specific embodiment, the searching for the target flow table of the data packet from the default flow table according to the first mask, the first key information, and the preset flow mask table includes :

Obtaining the minimum index value of the preset mask table;

Obtaining a third mask corresponding to the default flow table from the preset mask table according to the minimum index value;

Acquiring multiple given flow tables in the default flow table;

For each given flow table in the plurality of given flow tables, acquiring the third key information of the given flow table and the third hash value of the given flow table;

From the plurality of given flow tables, search for the third mask to match the first mask, the third key information to match the first key information, and the third hash value to match the first key information. The first hash value matches the flow table.

The minimum index value may be zero. The masks corresponding to the multiple given flow tables are the same.

When the target flow table of the data packet is not found from the multiple ordinary flow tables, that is, when the data packet does not match the multiple ordinary flow tables, the default flow table is searched With the packet.

In another embodiment, when the target flow table of the data packet is found from the multiple ordinary flow tables, the OVS-based data packet processing method further includes:

Acquiring the fourth mask corresponding to the target flow table of the data packet;

Determining the index value of the fourth mask as the associated mask index;

The first hash value and the associated mask index are stored in association.

In another embodiment, when the target flow table of the data packet is not found in the default flow table, the OVS-based data packet processing method further includes:

Delete the data package so that the data package is not uploaded to the user layer.

When the target flow table of the data packet is not found in the default flow table, the data packet will be discarded or deleted, and will not be uploaded to the user layer through the upcall method.

107. Execute a processing instruction for the data packet according to the target flow table of the data packet.

In a specific embodiment, the executing the processing instruction for the data packet according to the target flow table of the data packet includes:

The data packet is forwarded to the target gateway according to the target flow table of the data packet.

The target flow table of the data packet includes a basic field, a matching field, and an action field. The basis automatically includes the flow table identifier, the effective time of the flow table, the entry to which the flow table belongs, and the like. The matching field includes port number, layer 2 protocol type, link layer source or destination MAC address, source IP address, IP mask, destination IP address, etc. The action field includes "output:port sends the data packet from the port interface", "enqueue:port:queue enqueues the data packet into the specified queue of the specified port", and "all sends the data packet to other than the receiving interface" All interfaces", "drop drop packets", etc. The action information of the flow table can be obtained from the action field, and the corresponding action can be executed according to the action information.

In another embodiment, after the data packet is forwarded to the target gateway according to the target flow table of the data packet, the OVS-based data packet processing method further includes:

Determine the target virtual machine that the data packet needs to reach through the target gateway;

Receiving the ordinary flow table of the target gateway;

When receiving the same-stream data packet with the same hash value as the data packet, forward the same-stream data packet to the target virtual machine according to the received normal flow table of the target gateway.

The OVS-based data packet processing method of the first embodiment uses the normal flow table and the default flow table to match the data packet to reduce the occurrence of incorrect matching of the flow table and the data packet, thereby improving the accuracy of processing the data packet according to the flow table. In the first embodiment, data packets are processed according to the flow table to improve the accuracy of data packet processing.

Example two

Fig. 2 is a structural diagram of an OVS-based data packet processing device provided in the second embodiment of the present application. The OVS-based data packet processing device 20 is applied to a virtual switch in a computer device. The OVS-based data packet processing device 20 is used to process data packets according to the flow table to improve the accuracy of data packet processing.

As shown in FIG. 2, the OVS-based data packet processing device 20 may include an acquisition module 201, an extraction module 202, a calculation module 203, a judgment module 204, a first search module 205, a second search module 206, and an execution module 207.

The obtaining module 201 is configured to obtain a data packet, a first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables, and a default flow table. The flow table includes processing instructions for routing data to the virtual machine, and the default flow table includes processing instructions for routing data to the gateway.

The data packet, the first mask, the preset mask index table, the preset flow mask table, the multiple ordinary flow tables, and the default flow table can be read from a local database .

The data packet, the first mask, the preset mask index table, the preset flow mask table, the multiple ordinary flow tables, and the default flow table can be pulled from the network .

The data packet may come from a first virtual machine in the computer device or a first virtual machine in a virtual network where the computer device is located. The multiple ordinary flow tables include processing instructions for routing data to the second virtual machine.

The flow table can be classified according to the mask. Each mask corresponds to a mask index, and the mask can be searched through the mask index. All mask indexes constitute the mask index table. All masks constitute the preset mask table.

The extraction module 202 is configured to extract the first key information from the data packet.

The first key information is a prerequisite for searching the flow table. The first key information includes the source IP, destination IP address, and IP mask of the data packet.

The value value of the first key information can be extracted from the key value corresponding to the first key information.

Specifically, key information of the physical layer, key information of the MAC layer, key information of the network layer, key information of the transport layer, etc. can be extracted.

The calculation module 203 is configured to calculate the first hash value of the data packet.

The first hash value can be calculated by a preset hash algorithm.

Specifically, the first hash value is calculated based on the MD5 algorithm according to the data packet, the first mask, and the first key information.

Calculate the first hash value according to the data packet based on the SHA-1 algorithm.

The determining module 204 is configured to determine whether the associated mask index of the first hash value exists in the preset mask index table.

The preset mask index table uses hash values as the main key, and each hash value corresponds to a mask index. The correlation mask index may be searched according to the first hash value.

When the first hash value is queried from the preset mask index table, the mask index corresponding to the first hash value is confirmed as the association mask index.

When the first hash value is not queried from the preset mask index table, the association mask index does not exist in the preset mask index table.

The first search module 205 is configured to, when the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask The table searches the target flow table of the data packet from the multiple ordinary flow tables.

For example, the four virtual machines are a, b, c, and d, and the three common flow tables are B, C, and D. According to the common flow table B, data packets can be directed from virtual machine a to virtual machine b. The ordinary flow table C directs the data packet from the virtual machine a to the virtual machine c, and the data packet can be directed from the virtual machine a to the virtual machine d according to the ordinary flow table D. The target flow table (such as B, C, or D) of the data packet can be searched from multiple common flow tables according to the first mask, the first key information, and the preset flow mask table, so as to remove the data packet from the target flow table. The virtual machine a is forwarded to the virtual machine (such as b, c, d) corresponding to the target flow table.

In a specific embodiment, the search for the target flow table of the data packet from the multiple ordinary flow tables according to the first mask, the first key information, and the preset flow mask table include:

Acquiring a maximum index value and a target index value of the preset mask table, where the maximum index value is greater than the target index value;

Acquire a second mask from the preset mask table one by one in the order from the maximum index value to the target index value, and the second mask corresponds to a plurality of designated flow tables in the plurality of ordinary flow tables ；

For each designated flow table in the plurality of designated flow tables, acquiring the second key information of the designated flow table and the second hash value of the designated flow table;

Search from the plurality of ordinary flow tables for the second mask to match the first mask, the second key information to match the first key information, and the second hash value to match the first key information. The first hash value matches the flow table.

Specifically, based on the masked_flow_lookup method, the second mask matches the first mask, the second key information matches the first key information, and the second key information matches the first key information from the multiple ordinary flow tables. A flow table whose hash value matches the first hash value.

The target index value may be 1. The maximum index value is the maximum value among all index values.

The second searching module 206 is configured to, when the target flow table of the data packet is not found from the multiple ordinary flow tables, according to the first mask, the first key information and the preset The flow mask table searches the default flow table for the target flow table of the data packet.

For example, gateway e, the default flow table E, can direct data packets from virtual machine a to gateway e according to the default flow table E. When the target flow table of the data packet is not found from multiple ordinary flow tables (B, C, D), according to the first mask, the first key information and the preset flow mask table from the default flow table E Look up the target flow table of the packet.

In a specific embodiment, the searching for the target flow table of the data packet from the default flow table according to the first mask, the first key information, and the preset flow mask table includes :

Obtaining the minimum index value of the preset mask table;

Obtaining a third mask corresponding to the default flow table from the preset mask table according to the minimum index value;

Acquiring multiple given flow tables in the default flow table;

For each given flow table in the plurality of given flow tables, acquiring the third key information of the given flow table and the third hash value of the given flow table;

From the plurality of given flow tables, search for the third mask to match the first mask, the third key information to match the first key information, and the third hash value to match the first key information. The first hash value matches the flow table.

The minimum index value may be zero. The masks corresponding to the multiple given flow tables are the same.

When the target flow table of the data packet is not found from the multiple ordinary flow tables, that is, when the data packet does not match the multiple ordinary flow tables, the default flow table is searched With the packet.

In another embodiment, when the target flow table of the data packet is found from the multiple ordinary flow tables, the OVS-based data packet processing apparatus further includes a storage module for obtaining the target flow table of the data packet The fourth mask corresponding to the flow table;

Determining the index value of the fourth mask as the associated mask index;

The first hash value and the associated mask index are stored in association.

In another embodiment, when the target flow table of the data packet is not found in the default flow table, the OVS-based data packet processing device further includes a deleting device for deleting the data packet , So that the data package is not uploaded to the user layer.

When the target flow table of the data packet is not found in the default flow table, the data packet will be discarded or deleted, and will not be uploaded to the user layer through the upcall method.

The execution module 207 is configured to execute processing instructions for the data packet according to the target flow table of the data packet.

In a specific embodiment, the executing the processing instruction for the data packet according to the target flow table of the data packet includes:

The data packet is forwarded to the target gateway according to the target flow table of the data packet.

The target flow table of the data packet includes a basic field, a matching field, and an action field. The basis automatically includes the flow table identifier, the effective time of the flow table, the entry to which the flow table belongs, and the like. The matching field includes port number, layer 2 protocol type, link layer source or destination MAC address, source IP address, IP mask, destination IP address, etc. The action field includes "output:port sends the data packet from the port interface", "enqueue:port:queue enqueues the data packet into the specified queue of the specified port", and "all sends the data packet to other than the receiving interface" All interfaces", "drop drop packets", etc. The action information of the flow table can be obtained from the action field, and the corresponding action can be executed according to the action information.

In another embodiment, after the data packet is forwarded to the target gateway according to the target flow table of the data packet, the OVS-based data packet processing apparatus further includes a forwarding module for passing the target The gateway determines the target virtual machine that the data packet needs to reach;

Receiving the ordinary flow table of the target gateway;

When receiving the same-stream data packet with the same hash value as the data packet, forward the same-stream data packet to the target virtual machine according to the received normal flow table of the target gateway.

The OVS-based data packet processing device 20 of the second embodiment matches the data packet with the normal flow table and the default flow table, reducing the occurrence of incorrect matching of the flow table and the data packet, thereby improving the accuracy of processing data packets according to the flow table . In the second embodiment, data packets are processed according to the flow table to improve the accuracy of data packet processing.

Example three

This embodiment provides a computer-readable storage medium. The computer-readable storage medium may be volatile or nonvolatile. The computer-readable storage medium stores computer-readable instructions, and the computer can When the read instruction is executed by the processor, the steps in the above-mentioned OVS-based data packet processing method embodiment are implemented, for example, steps 101-107 shown in Fig. 1:

101. Acquire a data packet, a first mask of the data packet, a preset mask index table, a preset flow mask table, multiple ordinary flow tables, and a default flow table, where the multiple ordinary flow tables include A processing instruction for routing data to a virtual machine, and the default flow table includes a processing instruction for routing data to a gateway;

102. Extract the first key information from the data packet;

103. Calculate the first hash value of the data packet.

104. Determine whether there is an associated mask index of the first hash value in the preset mask index table;

105. When the associated mask index does not exist in the preset mask index table, use the first mask, the first key information, and the preset flow mask table from the multiple Look up the target flow table of the data packet in the ordinary flow table;

106. When the target flow table of the data packet is not found from the plurality of ordinary flow tables, follow all data packets according to the first mask, the first key information, and the preset flow mask table. Searching the target flow table of the data packet in the default flow table;

107. Execute a processing instruction for the data packet according to the target flow table of the data packet.

Or, when the computer-readable instruction is executed by the processor, the function of each module in the above-mentioned device embodiment is realized, for example, the modules 201-207 in Fig. 2:

The obtaining module 201 is configured to obtain a data packet, a first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables, and a default flow table. The flow table includes processing instructions for routing data to the virtual machine, and the default flow table includes processing instructions for routing data to the gateway;

The extraction module 202 is configured to extract the first key information from the data packet;

The calculation module 203 is configured to calculate the first hash value of the data packet;

The determining module 204 is configured to determine whether the associated mask index of the first hash value exists in the preset mask index table;

The first search module 205 is configured to, when the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask Looking up the target flow table of the data packet from the multiple ordinary flow tables;

The second searching module 206 is configured to, when the target flow table of the data packet is not found from the multiple ordinary flow tables, according to the first mask, the first key information and the preset The flow mask table searches the default flow table for the target flow table of the data packet;

The execution module 207 is configured to execute processing instructions for the data packet according to the target flow table of the data packet.

Example four

FIG. 3 is a schematic diagram of a computer device provided in Embodiment 3 of this application. The computer device 30 includes a memory 301, a processor 302, and computer-readable instructions 303 stored in the memory 301 and running on the processor 302, such as an OVS-based data packet processing program. When the processor 302 executes the computer-readable instructions 303, the steps in the above-mentioned OVS-based data packet processing method embodiment are implemented, for example, 101-107 shown in FIG. 1:

101. Acquire a data packet, a first mask of the data packet, a preset mask index table, a preset flow mask table, multiple ordinary flow tables, and a default flow table, where the multiple ordinary flow tables include A processing instruction for routing data to a virtual machine, and the default flow table includes a processing instruction for routing data to a gateway;

102. Extract the first key information from the data packet;

103. Calculate the first hash value of the data packet.

104. Determine whether there is an associated mask index of the first hash value in the preset mask index table;

105. When the associated mask index does not exist in the preset mask index table, use the first mask, the first key information, and the preset flow mask table from the multiple Look up the target flow table of the data packet in the ordinary flow table;

106. When the target flow table of the data packet is not found from the plurality of ordinary flow tables, follow all data packets according to the first mask, the first key information, and the preset flow mask table. Searching the target flow table of the data packet in the default flow table;

107. Execute a processing instruction for the data packet according to the target flow table of the data packet.

Or, when the computer-readable instruction is executed by the processor, the function of each module in the above-mentioned device embodiment is realized, for example, the modules 201-207 in Fig. 2:

The obtaining module 201 is configured to obtain a data packet, a first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables, and a default flow table. The flow table includes processing instructions for routing data to the virtual machine, and the default flow table includes processing instructions for routing data to the gateway;

The extraction module 202 is configured to extract the first key information from the data packet;

The calculation module 203 is configured to calculate the first hash value of the data packet;

The determining module 204 is configured to determine whether the associated mask index of the first hash value exists in the preset mask index table;

The first search module 205 is configured to, when the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask Looking up the target flow table of the data packet from the multiple ordinary flow tables;

The second searching module 206 is configured to, when the target flow table of the data packet is not found from the multiple ordinary flow tables, according to the first mask, the first key information and the preset The flow mask table searches the default flow table for the target flow table of the data packet;

The execution module 207 is configured to execute processing instructions for the data packet according to the target flow table of the data packet.

Exemplarily, the computer-readable instruction 303 may be divided into one or more modules, and the one or more modules are stored in the memory 301 and executed by the processor 302 to complete the method. . The one or more modules may be a series of computer-readable instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer-readable instruction 303 in the computer device 30. For example, the computer-readable instruction 303 can be divided into the acquisition module 201, the extraction module 202, the calculation module 203, the judgment module 204, the first search module 205, the second search module 206, and the execution module 207 in FIG. Refer to the second embodiment for the specific functions of the module.

Those skilled in the art can understand that the schematic diagram 3 is only an example of the computer device 30, and does not constitute a limitation on the computer device 30. It may include more or less components than those shown in the figure, or combine certain components, or different components. For example, the computer device 30 may also include input and output devices, network access devices, buses, and so on.

The so-called processor 302 may be a central processing unit (Central Processing Unit, CPU), other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor 302 can also be any conventional processor, etc. The processor 302 is the control center of the computer device 30, which uses various interfaces and lines to connect the entire computer device 30. Various parts.

The memory 301 can be used to store the computer-readable instructions 303, and the processor 302 executes or executes the computer-readable instructions or modules stored in the memory 301 and calls data stored in the memory 301 to implement Various functions of the computer device 30. The memory 301 may mainly include a storage program area and a storage data area. The storage program area may store an operating system, an application program required by at least one function (such as a sound playback function, an image playback function, etc.), etc.; the storage data area may Data and the like created in accordance with the use of the computer device 30 are stored. In addition, the memory 301 may include a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a Secure Digital (SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory Devices, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), or other non-volatile/volatile storage devices.

If the integrated module of the computer device 30 is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, this application implements all or part of the processes in the above-mentioned embodiments and methods, and can also be completed by instructing relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. Here, when the computer-readable instruction is executed by the processor, it can implement the steps of the foregoing method embodiments. Wherein, the computer-readable instruction includes computer-readable instruction code, and the computer-readable instruction code may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer-readable instruction code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory Take memory (RAM) and so on.

In another embodiment, the OVS-based data packet processing method provided by this application further ensures the privacy and security of all the above-mentioned data, all the above-mentioned data can also be stored in a node of a blockchain. For example, ordinary flow tables and target flow tables, etc., these data can be stored in the blockchain node.

It should be noted that the blockchain referred to in this application is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware, or in the form of hardware plus software functional modules.

The above-mentioned integrated modules implemented in the form of software functional modules may be stored in a computer readable storage medium. The above-mentioned software function module is stored in a storage medium, and includes several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor execute the OVS-based Part of the steps of the packet processing method.

For those skilled in the art, it is obvious that the present application is not limited to the details of the foregoing exemplary embodiments, and the present application can be implemented in other specific forms without departing from the spirit or basic characteristics of the present application. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-limiting. The scope of this application is defined by the appended claims rather than the above description, and therefore it is intended to fall into the claims. All changes in the meaning and scope of the equivalent elements of are included in this application. Any reference signs in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "including" does not exclude other modules or steps, and the singular does not exclude the plural. Multiple modules or devices stated in the system claims can also be implemented by one module or device through software or hardware. Words such as first and second are used to denote names, but do not denote any specific order.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the application and not to limit them. Although the application has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the application can be Make modifications or equivalent replacements without departing from the spirit and scope of the technical solution of the present application.

Claims (20)

1. An OVS-based data packet processing method, wherein the OVS-based data packet processing method includes:

   Obtain a data packet, the first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables, and a default flow table, where the plurality of ordinary flow tables includes routing the data A processing instruction to the virtual machine, the default flow table includes a processing instruction to route data to the gateway;

   Extracting the first key information from the data packet;

   Calculating the first hash value of the data packet;

   Judging whether there is an associated mask index of the first hash value in the preset mask index table;

   When the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask table from the multiple ordinary streams Look up the target flow table of the data packet in the table;

   When the target flow table of the data packet is not found from the multiple ordinary flow tables, the data packet is retrieved from the missing data according to the first mask, the first key information, and the preset flow mask table. Searching the target flow table of the data packet in the provincial flow table;

   The processing instruction for the data packet is executed according to the target flow table of the data packet.
2. The OVS-based data packet processing method according to claim 1, wherein the said first mask, said first key information, and said preset flow mask table are selected from said plurality of ordinary flow tables. The target flow table of the data packet searched in includes:

   Acquiring a maximum index value and a target index value of the preset mask table, where the maximum index value is greater than the target index value;

   Acquire a second mask from the preset mask table one by one in the order from the maximum index value to the target index value, and the second mask corresponds to a plurality of designated flow tables in the plurality of ordinary flow tables ；

   For each designated flow table in the plurality of designated flow tables, acquiring the second key information of the designated flow table and the second hash value of the designated flow table;

   Search from the plurality of ordinary flow tables for the second mask to match the first mask, the second key information to match the first key information, and the second hash value to match the first key information. The first hash value matches the flow table.
3. The OVS-based data packet processing method according to claim 1, wherein the first mask, the first key information, and the preset flow mask table are selected from the default flow table. Finding the target flow table of the data packet includes:

   Obtaining the minimum index value of the preset mask table;

   Obtaining a third mask corresponding to the default flow table from the preset mask table according to the minimum index value;

   Acquiring multiple given flow tables in the default flow table;

   For each given flow table in the plurality of given flow tables, acquiring the third key information of the given flow table and the third hash value of the given flow table;

   From the plurality of given flow tables, search for the third mask to match the first mask, the third key information to match the first key information, and the third hash value to match the first key information. The first hash value matches the flow table.
4. The OVS-based data packet processing method according to claim 1, wherein when the target flow table of the data packet is found from the multiple ordinary flow tables, the OVS-based data packet processing method further comprises :

   Acquiring the fourth mask corresponding to the target flow table of the data packet;

   Determining the index value of the fourth mask as the associated mask index;

   The first hash value and the associated mask index are stored in association.
5. The OVS-based data packet processing method of claim 1, wherein, when the target flow table of the data packet is not found in the default flow table, the OVS-based data packet processing method further comprises :

   Delete the data package so that the data package is not uploaded to the user layer.
6. The OVS-based data packet processing method according to claim 1, wherein the executing the processing instruction on the data packet according to the target flow table of the data packet comprises:

   The data packet is forwarded to the target gateway according to the target flow table of the data packet.
7. The OVS-based data packet processing method of claim 6, wherein after the data packet is forwarded to the target gateway according to the target flow table of the data packet, the OVS-based data packet processing method further include:

   Determine the target virtual machine that the data packet needs to reach through the target gateway;

   Receiving the ordinary flow table of the target gateway;

   When receiving the same-stream data packet with the same hash value as the data packet, forward the same-stream data packet to the target virtual machine according to the received normal flow table of the target gateway.
8. An OVS-based data packet processing device, wherein the OVS-based data packet processing device includes:

   The obtaining module is used to obtain a data packet, the first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables and a default flow table, the plurality of ordinary flows The table includes processing instructions for routing data to the virtual machine, and the default flow table includes processing instructions for routing data to the gateway;

   An extraction module for extracting the first key information from the data packet;

   A calculation module for calculating the first hash value of the data packet;

   A judging module, configured to judge whether there is an associated mask index of the first hash value in the preset mask index table;

   The first search module is configured to, when the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask table Searching for the target flow table of the data packet from the multiple ordinary flow tables;

   The second searching module is configured to, when the target flow table of the data packet is not found from the multiple ordinary flow tables, according to the first mask, the first key information and the preset flow The mask table searches the target flow table of the data packet from the default flow table;

   The execution module is configured to execute processing instructions for the data packet according to the target flow table of the data packet.
9. A computer device, wherein the computer device includes a processor and a memory, and the processor is configured to execute computer-readable instructions stored in the memory to implement the following steps:

   Obtain a data packet, the first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables, and a default flow table, where the plurality of ordinary flow tables includes routing the data A processing instruction to the virtual machine, the default flow table includes a processing instruction to route data to the gateway;

   Extracting the first key information from the data packet;

   Calculating the first hash value of the data packet;

   Judging whether there is an associated mask index of the first hash value in the preset mask index table;

   When the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask table from the multiple ordinary streams Look up the target flow table of the data packet in the table;

   When the target flow table of the data packet is not found from the multiple ordinary flow tables, the data packet is retrieved from the missing data according to the first mask, the first key information, and the preset flow mask table. Searching the target flow table of the data packet in the provincial flow table;

   The processing instruction for the data packet is executed according to the target flow table of the data packet.
10. The computer device according to claim 9, wherein the data is searched from the plurality of ordinary flow tables according to the first mask, the first key information, and the preset flow mask table The target flow table of the package includes:

    Acquiring a maximum index value and a target index value of the preset mask table, where the maximum index value is greater than the target index value;

    Acquire a second mask from the preset mask table one by one in the order from the maximum index value to the target index value, and the second mask corresponds to a plurality of designated flow tables in the plurality of ordinary flow tables ；

    For each designated flow table in the plurality of designated flow tables, acquiring the second key information of the designated flow table and the second hash value of the designated flow table;

    Search from the plurality of ordinary flow tables for the second mask to match the first mask, the second key information to match the first key information, and the second hash value to match the first key information. The first hash value matches the flow table.
11. The computer device according to claim 9, wherein the data packet is searched from the default flow table according to the first mask, the first key information, and the preset flow mask table The target flow table includes:

    Obtaining the minimum index value of the preset mask table;

    Obtaining a third mask corresponding to the default flow table from the preset mask table according to the minimum index value;

    Acquiring multiple given flow tables in the default flow table;

    For each given flow table in the plurality of given flow tables, acquiring the third key information of the given flow table and the third hash value of the given flow table;

    From the plurality of given flow tables, search for the third mask to match the first mask, the third key information to match the first key information, and the third hash value to match the first key information. The first hash value matches the flow table.
12. The computer device according to claim 9, wherein when the target flow table of the data packet is found from the plurality of ordinary flow tables, the processor is configured to execute the computer-readable instructions stored in the memory to further implement The following steps:

    Acquiring the fourth mask corresponding to the target flow table of the data packet;

    Determining the index value of the fourth mask as the associated mask index;

    The first hash value and the associated mask index are stored in association.
13. The computer device according to claim 9, wherein, when the target flow table of the data packet is not found in the default flow table, the processor is configured to execute the computer-readable instructions stored in the memory to further implement The following steps:

    Delete the data package so that the data package is not uploaded to the user layer.
14. 9. The computer device according to claim 9, wherein the executing the processing instruction on the data packet according to the target flow table of the data packet comprises:

    The data packet is forwarded to the target gateway according to the target flow table of the data packet.
15. The computer device according to claim 14, wherein, after the data packet is forwarded to the target gateway according to the target flow table of the data packet, the processor is configured to execute the computer-readable instructions stored in the memory and further To achieve the following steps:

    Determine the target virtual machine that the data packet needs to reach through the target gateway;

    Receiving the ordinary flow table of the target gateway;

    When receiving the same-stream data packet with the same hash value as the data packet, forward the same-stream data packet to the target virtual machine according to the received normal flow table of the target gateway.
16. A computer-readable storage medium having computer-readable instructions stored thereon, wherein the computer-readable instructions implement the following steps when executed by a processor:

    Obtain a data packet, the first mask of the data packet, a preset mask index table, a preset flow mask table, a plurality of ordinary flow tables, and a default flow table, where the plurality of ordinary flow tables includes routing the data A processing instruction to the virtual machine, the default flow table includes a processing instruction to route data to the gateway;

    Extracting the first key information from the data packet;

    Calculating the first hash value of the data packet;

    Judging whether there is an associated mask index of the first hash value in the preset mask index table;

    When the associated mask index does not exist in the preset mask index table, according to the first mask, the first key information, and the preset flow mask table from the multiple ordinary streams Look up the target flow table of the data packet in the table;

    When the target flow table of the data packet is not found from the multiple ordinary flow tables, the data packet is retrieved from the missing data according to the first mask, the first key information, and the preset flow mask table. Searching the target flow table of the data packet in the provincial flow table;

    The processing instruction for the data packet is executed according to the target flow table of the data packet.
17. The computer-readable storage medium of claim 16, wherein the search is performed from the plurality of ordinary flow tables according to the first mask, the first key information, and the preset flow mask table The target flow table of the data packet includes:

    Acquiring a maximum index value and a target index value of the preset mask table, where the maximum index value is greater than the target index value;

    Acquire a second mask from the preset mask table one by one in the order from the maximum index value to the target index value, and the second mask corresponds to a plurality of designated flow tables in the plurality of ordinary flow tables ；

    For each designated flow table in the plurality of designated flow tables, acquiring the second key information of the designated flow table and the second hash value of the designated flow table;

    Search from the plurality of ordinary flow tables for the second mask to match the first mask, the second key information to match the first key information, and the second hash value to match the first key information. The first hash value matches the flow table.
18. The computer-readable storage medium according to claim 16, wherein the search is performed from the default flow table according to the first mask, the first key information, and the preset flow mask table. The target flow table of the data packet includes:

    Obtaining the minimum index value of the preset mask table;

    Obtaining a third mask corresponding to the default flow table from the preset mask table according to the minimum index value;

    Acquiring multiple given flow tables in the default flow table;

    For each given flow table in the plurality of given flow tables, acquiring the third key information of the given flow table and the third hash value of the given flow table;

    From the plurality of given flow tables, search for the third mask to match the first mask, the third key information to match the first key information, and the third hash value to match the first key information. The first hash value matches the flow table.
19. The computer-readable storage medium according to claim 16, wherein when the target flow table of the data packet is found from the plurality of ordinary flow tables, the computer-readable instruction also implements when being executed by the processor The following steps:

    Acquiring the fourth mask corresponding to the target flow table of the data packet;

    Determining the index value of the fourth mask as the associated mask index;

    The first hash value and the associated mask index are stored in association.
20. The computer-readable storage medium according to claim 16, wherein, when the target flow table of the data packet is not found in the default flow table, the computer-readable instructions further implement when being executed by the processor The following steps:

    Delete the data package so that the data package is not uploaded to the user layer.