WO2022002123A1 - Verification method and apparatus for network configuration - Google Patents

Abstract

The present application relates to the field of computer network communications, and provides a verification method and apparatus for a network configuration, used for reducing, when an incremental network configuration is performed on a network device, the amount of calculation for verifying the network configuration. The verification method for the network configuration is characterized by comprising: comparing a basic network configuration and an incremental network configuration, and comparing a forwarding table corresponding to the basic network configuration and a forwarding table corresponding to the incremental network configuration to obtain an interface where a forwarding policy is changed and/or a link where a forwarding routing is changed (S1301); obtaining a first reachable point pair (S1302); and searching for an association table corresponding to the basic network configuration to obtain a second reachable point pair, and comparing the second reachable point pair and the first reachable point pair to verify the incremental network configuration (S1303), wherein the association table indicates, in a network, the association relationship between the interface and/or link through which a path passes and a reachable point pair of the path, and the second reachable point pair indicates a pair of service access points of the path where the interface and/or link is located under the basic network configuration.

Description

Method and device for verifying network configuration

This application claims the priority of the Chinese patent application with the application number 202010615579.8 and the application title "Method and Device for Verification of Network Configuration", which was submitted to the State Intellectual Property Office on June 30, 2020, the entire contents of which are incorporated into this application by reference middle.

technical field

The present application relates to the field of computer network communication, and in particular, to a method and device for verifying network configuration.

Background technique

The computer network has become the infrastructure of the information age, and the correct network configuration is the basis for the normal operation of the computer network, because the services carried by the computer network are often changed, and the network configuration is constantly changing. The industry has proposed a network verification method to ensure the correctness of the network configuration, that is, it is not necessary to send probe packets in the computer network, but a mathematical model is used to verify the correctness of the network configuration. Specifically, the network verification method converts the network configuration and forwarding behavior of network devices into a mathematical model, calculates the reachability of the network interface according to the mathematical model, and compares it with the expected reachability intent, thereby judging whether the network configuration is correct.

When verifying the incremental network configuration, it is necessary to compare the reachability between the interfaces of the network device corresponding to the network configuration before the change, and the reachability between the interfaces of the network device corresponding to the network configuration after the change, to obtain the changed network configuration. The reachability between the interfaces of the network device is compared with the expected reachability intent to judge whether the incremental network configuration is correct.

Incremental network configuration often only affects the reachability between interfaces of some network devices. If for incremental network configuration, recalculating the mutual reachability of interfaces of network devices on the entire network will increase a great deal of calculation. quantity.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a method and apparatus for verifying network configuration, which are used to reduce the amount of computation for verifying incremental network configuration when incremental network configuration is performed on a network device.

To achieve the above object, the embodiments of the present application adopt the following technical solutions:

A first aspect provides a method for verifying a network configuration, including: comparing a basic network configuration and an incremental network configuration, and comparing a forwarding table corresponding to the basic network configuration and a forwarding table corresponding to the incremental network configuration to obtain a forwarding policy A changed interface and/or a link with a changed forwarding route; obtain a first reachable point pair, wherein the first reachable point pair indicates a part of the path where the interface and/or link is located under the incremental network configuration; For the service access point; look up the association table corresponding to the basic network configuration to obtain the second reachable point pair, and compare it with the first reachable point pair to verify the incremental network configuration; wherein, the association table indicates the network , the association between the interface and/or link that the path passes through and the reachable point pair of the path, and the second reachable point pair indicates the pair of service access points of the path where the interface and/or link is located under the basic network configuration .

The method for verifying the network configuration provided by the embodiment of the present application, by comparing the basic network configuration and the incremental network configuration, and comparing the forwarding table corresponding to the basic network configuration and the forwarding table corresponding to the incremental network configuration, so as to obtain the information that the forwarding policy has changed. A link whose interface and/or forwarding route has changed; obtain the first reachable point pair, which indicates a pair of service access points on the path where the interface and/or link is located under the incremental network configuration ; Look up the association table corresponding to the basic network configuration to obtain the second reachable point pair, and compare it with the first reachable point pair to verify the incremental network configuration; wherein, the association table indicates that in the network, the path through which the path passes The association relationship between the interface and/or link and the reachable point pair of the path, the second reachable point pair indicates a pair of service access points of the path where the interface and/or link is located under the basic network configuration. The first reachable point pair narrows the search range of reachable point pairs whose incremental network configuration may affect reachability to be related to the above-mentioned interface and/or link; and the second reachable point pair is the above-mentioned interface and/or link. Or the reachable pair of points that the link is involved in in the underlying network configuration. By comparing the two reachable point pairs, it is possible to accurately locate which reachable point pairs are affected by the incremental network configuration, and whether the above effects conform to the configuration intent, so as to verify the incremental network configuration. . Since it is not necessary to analyze the reachable point pairs of the whole network for the incremental network configuration, only the reachable point pairs related to the changed interface and/or link are analyzed, so the calculation amount for verifying the network configuration can be reduced. In addition, the association table includes the association relationship between the interface passed by the path and the reachable point pair of the path. Compared with the association relationship between the network device and the reachable point pair in the prior art, the association granularity is finer, which reduces the need to pass the association table. Finds the range of reachable point pairs, thus reducing the workload of validating incremental network configurations.

In one possible implementation, a link may be indicated by a combination of interfaces (eg, interface pairs) at both ends of the link.

In a possible implementation manner, the method further includes: parsing the reachability matrix corresponding to the basic network configuration to obtain an association table, where the reachability matrix refers to whether the service access points in the network are reachable in pairs matrix. The association table implements the association relationship between the interface and/or link and the reachable point pair. Compared with the association relationship between the network device and the reachable point pair, its granularity is finer, so that the reachable point pair can be searched according to the association table. The range can be narrowed when point-to-point.

In a possible implementation manner, the method further includes: updating the reachability matrix and the association table according to the first reachable point pair. The updated reachability matrix and association table can be used as the basis for the next verification of the incremental network configuration, and there is no need to repeat the calculation.

In a possible implementation manner, parsing the reachability matrix corresponding to the basic network configuration to obtain the association table, including: for each reachable path in the reachability matrix, extracting each cross-device link that constitutes the reachable path If the inbound and outbound interfaces are not service access points, establish the relationship between the inbound interface and the outbound interface and the reachable point pair of the reachable path; point-to-point relationship. That is to say, the inbound and outbound interfaces at both ends of the trail and the links in the middle of the trail are associated with reachable point pairs.

In a possible implementation manner, the basic network configuration and the incremental network configuration are compared, and the forwarding table corresponding to the basic network configuration is compared with the forwarding table corresponding to the incremental network configuration, so as to obtain the interface and the forwarding policy of the changed network in the network. / or the link whose forwarding route has changed, including: if the interface and/or link only exists in the basic network configuration or the corresponding forwarding table, add the interface and/or link to the deletion list, and mark the interface as a forwarding policy If there is a change, mark the link as a forwarding route change; if the interface and/or link only exists in the incremental network configuration or the corresponding forwarding table, add the interface and/or link to the increase list, and mark the interface as If the forwarding policy changes, the link will be marked as the forwarding route has changed; if the packet space of the forwarding policy of the interface in the basic network configuration and the incremental network configuration is inconsistent, the interface will be added to the modification list and marked as the forwarding policy has been changed. ; If the packet space of the forwarding route of the link in the basic network configuration and the incremental network configuration is inconsistent, the link is added to the modification list, and the forwarding route is marked as changed. This implementation subdivides the interfaces on which the forwarding policy has changed and/or the links on which the forwarding route has changed into several types: addition, deletion, and change, to help determine the impact on reachability after the incremental network configuration is issued. .

In a possible implementation manner, acquiring the first reachable point pair includes: calculating a first path through an interface and/or link under the incremental network configuration; acquiring a pair of service accesses at both ends of the first path point as the first reachable point pair.

In a possible implementation manner, calculating the first path through the interface and/or link under the incremental network configuration includes: for the interface where the forwarding policy is changed, using the interface as a starting point, and using the interface as a starting point in the incremental network Configure the message space of the corresponding forwarding policy as the initial message space, take all service access points as the end point, and traverse forward in the forwarding graph model of incremental network configuration to solve the first reachable path; Take the initial interface of the link as the starting point, take the packet space of the corresponding forwarding route configured on the incremental network as the initial packet space, take all service access points as the end point, and take the forwarding configured on the incremental network as the end point. The forward traversal in the graph model solves the first reachable path; starting from the starting point and the initial message space, with all service access points as the end point, reverse traversal in the forwarding graph model solves the second reachable path; take the first reachable path The intersection of the path and the second reachable path, if the intersection of the packet space of the first reachable path and the packet space of the second reachable path is not empty, then splicing the first reachable path and the second reachable path to get The first path, and the result of the intersection is used as the packet space of the first path. This embodiment ensures that the service access points at both ends of the path can communicate in both forward and reverse directions.

In a second aspect, a network configuration verification device is provided, including: a comparison module for comparing a basic network configuration with an incremental network configuration, and comparing a forwarding table corresponding to the basic network configuration with a forwarding table corresponding to the incremental network configuration , to obtain the interface whose forwarding policy is changed and/or the link whose forwarding route is changed; the obtaining module obtains the first reachable point pair, wherein the first reachable point pair indicates that the interface and/or link is in the incremental network Under the configuration, a pair of service access points of the path where it is located; the comparison module is also used to look up the association table corresponding to the basic network configuration to obtain the second reachable point pair, and compare it with the first reachable point pair to get Verify the incremental network configuration; wherein, the association table indicates the association relationship between the interface and/or link that the path passes through and the reachable point pair of the path in the network, and the second reachable point pair indicates that the interface and/or link are in the network. In the basic network configuration, a pair of service access points on the path.

In a possible implementation manner, the method further includes: a parsing module, configured to parse a reachability matrix corresponding to the basic network configuration to obtain an association table, where the reachability matrix refers to a pair of service access points used to represent the network A matrix of reachability between.

In a possible implementation manner, the method further includes: an update module, configured to update the reachability matrix and the association table according to the first reachable point pair.

In a possible implementation manner, the parsing module is specifically configured to: for each reachable path in the reachable matrix, extract the inbound interface and outbound interface of each cross-device link constituting the reachable path, and establish the inbound interface The association relationship between the outgoing interface and the reachable point pair of the reachable path; if neither the incoming interface nor the outgoing interface is a service access point, the association relationship between the link and the reachable point pair of the reachable path is established.

In a possible implementation manner, the comparison module is specifically configured to: if the interface and/or link exists only in the basic network configuration or the corresponding forwarding table, add the interface and/or link to the deletion list, and mark the interface If the forwarding policy changes, mark the link as a forwarding route change; if the interface and/or link only exists in the incremental network configuration or the corresponding forwarding table, add the interface and/or link to the increase list, and The interface is marked as the forwarding policy has changed, and the link is marked as the forwarding route has been changed; if the packet space of the forwarding policy of the interface in the basic network configuration and the incremental network configuration is inconsistent, the interface is added to the modification list and marked as forwarding The policy is changed; if the packet space of the forwarding route of the link in the basic network configuration and the incremental network configuration is inconsistent, the link is added to the modification list and marked as the forwarding route changed.

In a possible implementation manner, the obtaining module is specifically configured to: calculate the first path passing through the interface and/or link under the incremental network configuration; take a pair of service access points at both ends of the first path as the first path A point-to-point pair.

In a possible implementation manner, the acquiring module is specifically configured to: for an interface whose forwarding policy is changed, the interface is used as a starting point, and the message space of the corresponding forwarding policy configured on the interface in the incremental network is used as the initial message space, Taking all service access points as the end point, forward traversal in the forwarding graph model of incremental network configuration to solve the first reachable path; for the link whose forwarding route has changed, the starting interface of the link is The message space corresponding to the forwarding route configured in the incremental network is used as the initial message space, with all service access points as the end point, and the forward traversal is performed in the forwarding graph model of the incremental network configuration to solve the first reachable path; Starting from the initial message space, with all service access points as the end point, reverse traversal in the forwarding graph model to solve the second reachable path; take the intersection of the first reachable path and the second reachable path, if the first reachable path is The intersection of the packet space of the path and the packet space of the second reachable path is not empty, then the first path is obtained by splicing the first reachable path and the second reachable path, and the result of the intersection is used as the report of the first path. text space.

In a third aspect, there is provided an apparatus for verifying a network configuration, comprising a processor, the processor is connected to a memory, the memory is used for storing a computer program, and the processor is used for executing the computer program stored in the memory, so that the apparatus executes the first aspect and the method of any embodiment thereof.

In a fourth aspect, a computer-readable storage medium is provided, and a computer program is stored in the computer-readable storage medium, and when it is run on a computer, the computer is made to execute the first aspect and any one of the embodiments thereof. method.

In a fifth aspect, there is provided a computer program product comprising instructions which, when run on a computer or processor, cause the computer or processor to perform the method of the first aspect and any one of the embodiments.

Regarding the technical effects of the content of the second aspect to the fifth aspect, refer to the technical effects of the first aspect and any of its embodiments, which will not be repeated here.

Description of drawings

FIG. 1 is a schematic diagram of the architecture of a communication system provided by an embodiment of the present application;

2 is a schematic flowchart of a method for verifying a network configuration provided by an embodiment of the present application;

3 is a schematic diagram of the architecture of a communication network including a switch provided by an embodiment of the present application;

4 is a schematic flowchart of another method for verifying a network configuration provided by an embodiment of the present application;

5 is a schematic structural diagram of another communication network including a switch provided by an embodiment of the present application;

6 is a schematic diagram of the architecture of another communication network including a switch provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of yet another communication network including a switch provided by an embodiment of the present application;

8 is a schematic diagram of a process for establishing a forwarding graph model of a network configuration provided by an embodiment of the present application;

9 is a schematic diagram of a forwarding graph model of a basic network configuration provided by an embodiment of the present application;

10 is a schematic diagram of a forwarding graph model of an incremental network configuration provided by an embodiment of the present application;

11 is a schematic diagram of a process for obtaining a reachability matrix corresponding to a basic network configuration according to an embodiment of the present application;

12 is a schematic diagram of a process for obtaining an association table corresponding to a basic network configuration provided by an embodiment of the present application;

13 is a schematic flowchart of another method for verifying network configuration provided by an embodiment of the present application;

14 is a schematic diagram of a process for obtaining an interface with a changed forwarding policy and/or a link with a changed forwarding route according to an embodiment of the present application;

15 is a schematic diagram of a process for obtaining a first path according to an embodiment of the present application;

16 is a schematic structural diagram of an apparatus for verifying a network configuration provided by an embodiment of the present application;

FIG. 17 is a schematic structural diagram of another apparatus for verifying a network configuration provided by an embodiment of the present application.

detailed description

First, the concepts involved in this application are described:

Network configuration: refers to the configuration related to the network forwarding behavior issued by the software defined network (SDN) controller to the network device. For example, border gateway protocol (BGP) Ethernet virtual private network (ethernet virtual private network, EVPN) configuration, ACL policy configuration, etc.

Basic network configuration: refers to the existing network configuration of each network device before the new network configuration is issued by the SDN controller.

Incremental network configuration: refers to the new network configuration delivered by the SDN controller.

Interface: The port provided by the network device for internal communication between the network device, or the port used for communication with other network devices, virtual machines or the Internet.

Service access point: an interface provided by a network device for connecting to a virtual machine where services are deployed, or for connecting to the Internet. Usually at both ends of the path.

Point-to-point: Any two service access points in the entire network constitute a point-to-point pair, and a path may or may not exist between the two service access points.

Link: Indicates that two interfaces can communicate directly without going through other interfaces. These two interfaces are called an interface pair. That is, a link can be indicated by a combination of interfaces at both ends of the link.

Packet space: a set of header fields of a group of packets. Common header fields of packets include but are not limited to source internet protocol (IP) address, destination IP address, source port, destination port and protocol type . The message space can be expressed as space={(src_ip, dst_ip, src_port, dst_port, protocol)}, ie {(source IP address, destination IP address, source port, destination port, protocol type)}.

Forwarding graph model: a graph model that describes the link in which packets are forwarded according to forwarding rules in the network. Forwarding according to forwarding rules includes policy forwarding according to access control lists (ACLs), (forwarding info base, FIB) forwarding table for routing and forwarding. The forwarding graph model includes points and edges, where a point represents an interface of a network device, and an edge represents a link between two interfaces. A packet space is attached to the edge, which indicates the set of packets that can be forwarded by the link corresponding to the edge. For example, if there is a link between two interfaces across devices in the network topology, in the forwarding graph model, the points corresponding to the two interfaces can be connected together by an edge, and the additional packet space on the edge can be calculated by the forwarding table Or, for example, within the same network device, the packets received from one interface can be sent from another interface according to the forwarding table, then in the forwarding graph model, the points corresponding to these two interfaces can also be connected together by edges, The additional packet space on the edge is the intersection of the packet spaces of the forwarding policies of the two interfaces.

Path: It includes at least one link, and two links with a common interface are connected end to end to obtain a path. Corresponding to the forwarding graph model, that is, the edges with common points are connected end-to-end in sequence. The message space corresponding to the path is defined as the intersection of the additional message spaces on the edges corresponding to the links constituting the path.

Reachable and unreachable: According to the packet forwarding rules, if there is at least one path between two service access points with a non-empty packet space, the two service access points are reachable, otherwise they are unreachable.

Reachable point pair: point, which is used to represent an interface in the forwarding graph model, a point pair, that is, a pair of points, that is, a pair of interfaces, and a reachable point pair, that is, this pair of points is reachable, also There is a packet transmission path between the pair of interfaces, or in other words, packet transmission can be performed. A reachable point pair can be understood as a pair of service access points at both ends of a path, including a start point and an end point.

Reachability matrix: A matrix that indicates whether service access points in the network are reachable in pairs. If two service access points are reachable (a pair of reachable points), the corresponding matrix item has a value (eg Y), otherwise the corresponding matrix item is empty.

As shown in FIG. 1 , an embodiment of the present application provides a communication system, which may refer to a data center network (DCN), and the communication system includes an SDN controller 11 and a plurality of network devices 12 .

The user can manage the network device 12 through the SDN controller 11 , obtain the latest network configuration from the network device 12 , and deliver the incremental network configuration to the network device 12 . The user can also change the network configuration of the network device through the SDN controller 11 to meet the changing requirements of the network service. For example, the SDN controller 11 provides an interface for editing network topology and an interface for issuing policies, enabling users to add and delete logical devices, while ensuring that service changes can be correctly mapped to network configurations on corresponding network devices. In addition, the user can also use the SDN controller 11 to query whether the current network configuration and status of the network conform to the management and control intent (for example, whether there is a loop in the network), and whether the network configuration to be delivered conforms to the management and control intent (for example, between certain network segments). whether they can communicate with each other), for example, implement the network configuration verification method in this embodiment of the present application.

In the scenario that the embodiments of the present application can be used to verify the incremental network configuration, the basic network configuration is periodically obtained from the network device or system database, and the network physical link topology (referred to as the network topology) is periodically obtained from the network device or system database, Receive the service change request issued by the user, generate the incremental network configuration on the corresponding network device, and verify whether the incremental network configuration to be issued conforms to the management and control intention. Implements the function of quickly performing network-wide impact analysis on incremental network configurations.

It should be noted that the network topology will not be modified when configuring the network configuration, so the network topology of the incremental network configuration is equivalent to the network topology of the basic network configuration.

As shown in Figure 2, the prior art provides a method for verifying network configuration, including:

S201. Obtain basic network configuration and network topology, and obtain a corresponding forwarding graph model.

S202. Determine a service access point pair and calculate a reachability matrix according to the forwarding graph model and service characteristics corresponding to the basic network configuration.

Assuming that there are N service access points, the reachability matrix includes N2 point pairs, and N2 calculations are performed when calculating the reachability matrix. If each calculation has a starting point and an ending point, the reachable path is calculated according to the depth-first search, which may calculate the reachable path or the unreachable path.

In addition, an association relationship between network devices and point pairs passed by the reachable path and the unreachable path is established, that is, the point pair here may be an unreachable point pair.

S203. Acquire an incremental network configuration, and combine the acquired network topology to obtain a forwarding graph model of the incremental network configuration.

S204. Obtain a list of network devices whose forwarding policies and/or forwarding routes are changed in the network according to the basic network configuration and the incremental network configuration.

S205. According to the list of network devices whose forwarding policies and/or forwarding routes are changed in the network, search for the association relationship between the network device and the point-to-point pair, find out the list of the point-to-point pairs that may be affected, and configure it in the incremental network In the forwarding graph model, the reachable path of a point pair is recalculated, and compared with the old reachable path, it is determined whether the point pair is a new reachable point pair, a reachable point pair is deleted, or a reachable point pair is modified.

The above scheme adopts the association relationship between network equipment and point-to-point, and has the following shortcomings:

(1) When calculating the reachability matrix, it is necessary to calculate the N2 point pairs. On the one hand, the calculation amount is large, and on the other hand, some scenarios still cannot calculate the newly added reachable point pairs.

(2) The granularity of the association is too coarse, and there is repeated calculation.

The reason for the first deficiency is that, because the information of unreachable point pairs needs to be stored, the calculation can only be performed for N2 point pairs, which requires a large amount of calculation. If the newly added reachable point pair is caused by the incremental network configuration of the network device at the edge of the network, then this method can find the newly added reachable point pair, but if the newly added reachable point pair is caused by the network equipment in the middle of the network. Due to the incremental network configuration changes of network devices, this method cannot calculate such reachable point pairs, because there is no association between corresponding network devices and point pairs, so there is a possibility of omission.

Exemplarily, as shown in FIG. 3 , the network device includes border leaf (Border Leaf) switches BL1 and BL2, and also includes top-of-rack leaf (ToR Leaf) switches L1-L4. The service access points A, B, C, and D are the interfaces of switches L1, L2, L3, and L4, respectively. Initially, if interface A to interface D is unreachable, switch L1 will store the unreachable information of the point pair (A, D). If the network configuration of switch L1 is modified so that interface A and interface D are reachable, the newly added point pair ( A, D) reachability information. However, if the network configuration of the switch BL2 is modified so that the interface A and the interface D are reachable, the reachability information of the newly added point pair (A, D) cannot be obtained because the association relationship is not stored on the switch BL2.

The second reason is that when network devices are used as the granularity to associate reachable point pairs, a network device often includes multiple interfaces, so that multiple reachable paths (that is, multiple reachable point pairs) will pass through the same network. equipment. If the network configuration of an interface is changed, if the network device is used as the granularity, the reachability information of all reachable point pairs involved in the network device will be recalculated, so there is repeated calculation.

Exemplarily, as shown in FIG. 3 , assuming that in the initial state, interface A to interface B is reachable, and interface A to interface C are reachable, and they all pass through switch BL1, then switch BL1 will be associated with a point pair (A, B) and the point pair (A,C). Suppose that the network configuration of an interface of switch BL1 on the path from interface A to interface C is modified, resulting in unreachable interfaces A to C. According to the above scheme, the point pair (A, B) and point pair (A, C) will be recalculated. ) is reachable, although it can be found that the point pair (A, C) is no longer reachable, but at the same time, it will recalculate whether the point pair (A, B) is reachable, so there is repeated calculation.

As shown in Figure 4, another method for verifying network configuration is provided in the prior art, including:

S401. Obtain basic network configuration and network topology, and obtain a corresponding forwarding graph model.

S402. Calculate the reachability matrix according to the forwarding graph model corresponding to the basic network configuration; and store all flow information (including the starting point and message space of each flow) passing through each node of the forwarding graph model.

S403. Acquire an incremental network configuration, and combine the acquired network topology to obtain a forwarding graph model of the incremental network configuration.

S404. Obtain a list of interfaces whose forwarding policies and/or forwarding routes are changed in the network according to the basic network configuration and the incremental network configuration, and convert it into a list of changed points and edges in the forwarding graph model.

S405. Calculate incremental reachability information according to the list of points and edges where the forwarding policy and/or the forwarding route are changed in the network of the forwarding graph model.

If it is a new edge and the starting point of the edge exists in the forwarding graph model corresponding to the basic network configuration, then extract all flow information that the edge passes through, and in the forwarding graph model corresponding to the incremental network configuration, calculate the reachability from the starting point. point pair, and the obtained reachable point pair is the newly added reachable point pair.

If the edge is deleted and the starting point of the edge exists in the forwarding graph model corresponding to the basic network configuration, extract all flow information that the edge passes through, and in the forwarding graph model corresponding to the basic network configuration, the reachable point pair is calculated from the starting point. , the obtained reachable point pair is the deleted reachable point pair.

If it is a modified edge, extract all flow information passed by the starting point, calculate reachable point pairs from the starting point in the forwarding graph model corresponding to the basic network configuration and the forwarding graph model corresponding to the incremental network configuration, and compare the reachable point pair results. Obtain the newly added reachable point pair, the deleted reachable point pair and the modified reachable point pair.

Exemplarily, as shown in Figure 5, it is assumed that in the initial state, interface A to interface B is reachable, the flow from interface A to interface C is blocked by the ACL policy on switch BL1, and the flow from interface A to interface D is blocked on interface A. ACL policy blocking. Then interface A will store the flow information of {(A->B,f1),(A->C,f2),(A->D,f3)}, where f1, f2, f3 are different packets Head space; switch BL1 will store the flow information of {(A->C,f2)}. Assuming that the incremental network configuration modifies the ACL policy of interface A and allows f3 to pass, then extracting (A->D, f3) can calculate the reachable flow from interface A to interface D. Assuming that the incremental network configuration modifies the ACL policy of switch BL1, the reachable flow from interface A to interface C can be calculated by extracting (A->C, f2). By storing the complete flow information (including reachable and unreachable), the shortcomings of the previous scheme can be avoided.

However, this scheme also has the following shortcomings:

(1) Because the association between switches and reachable point pairs is not stored, if the incremental network is configured to delete or modify edges, it is necessary to recalculate the reachable point pairs in the forwarding graph model of the basic network configuration.

(2) Each point in the forwarding graph model must store the flow information, including the final reachable and final unreachable flows, and the storage capacity is large; and a flow will be stored at all points of the passing path, and there are Duplicate storage problem.

The basic network configuration and incremental network configuration are described below by way of example:

Exemplarily, in the DCN shown in FIG. 6 , four interfaces A, B, C, and D are included, which belong to network segments of different services, and are used to attach virtual machines that carry services, as shown in Table 1. Interface A belongs to the virtual routing forwarding (VRF) VRF1 corresponding to the virtual private cloud (VPC), the network segment is 20.1.0.0/24, and belongs to the ToR Leaf switch L1; interface B belongs to the VPC VRF1, the network segment It is 20.1.1.0/24, which belongs to ToR Leaf switch L2; interface C belongs to VPC VRF2, and the network segment is 20.2.0.0/24, which belongs to ToR Leaf switch L3; interface D belongs to VPC VRF3, and the network segment is 20.2.1.0/24, which belongs to ToR Leaf switch L4. The DCN also includes the Border Leaf switch BL1, which is responsible for cross-VPC communication and intercommunication with the external Internet (Internet).

Exemplarily, the basic network configuration is as follows: the border gateway protocol (BGP) Ethernet virtual private network (ethernet virtual private network, EVPN) configuration is imported on the switches L1-L4 and BL1 respectively, and virtual extensions can be established with each other. For a local area network (virtual extensible local area network, VXLAN) tunnel, the virtual tunnel end point (VTEP) IP used by each switch to establish the tunnel is shown in Table 2. In the initial state, network segments belonging to the same VPC can communicate with each other, that is, interface A and interface B can communicate with each other. In addition, a static route for inter-VPC inter-VPC communication between interface A and interface C is configured on switch BL1:

ip route-static vpn-instance VRF2 20.1.0.0 255.255.255.0 VRF1;

ip route-static vpn-instance VRF1 20.2.0.0 255.255.255.0 VRF2.

Import the above static route configuration into the BGP EVPN configuration, and interface A and interface C can communicate with each other.

After the basic network configuration is issued, the forwarding table on switch BL1 is shown in Table 3, the forwarding table on switch L1 is shown in Table 4, the forwarding table on switch L2 is shown in Table 5, and the forwarding table on switch L3 is shown in Table 3. As shown in Table 6, the outgoing interface is another VRF, indicating that it needs to jump to other VRFs to further match the outgoing interface and next-hop IP; the outgoing interface is VXLAN, indicating that it is about to enter the VXLAN tunnel, and the source IP address of the tunnel is the local VTEP IP. The destination IP address is the next hop IP. Interface A and interface B communicate directly through the tunnel between them, and interface A and interface C must pass through the switch BL1 to communicate.

Table 1

interface	Owning VPC	configured network segment
A	VRF1	20.1.0.0/24
B	VRF1	20.1.1.0/24
C	VRF2	20.2.0.0/24
D	VRF3	20.2.1.0/24

Table 2

switch	VTEP IP
L1	1.1.1.1
L2	2.2.2.2
L3	3.3.3.3
L4	4.4.4.4
BL1	11.11.11.11

table 3

Table 4

table 5

Table 6

Exemplarily, as shown in FIG. 7 , incremental network configuration is performed on the DCN shown in FIG. 6 , services are migrated from interface C to interface D, and an ACL is issued to block the communication between interface A and interface B at the same time. Configure a static route for inter-VPC communication between interface A and interface D on switch BL1:

ip route-static vpn-instance VRF3 20.1.1.0 255.255.255.0 VRF1;

ip route-static vpn-instance VRF1 20.2.1.0 255.255.255.0 VRF3.

Import the above static route configuration into BGP EVPN, and interface A and interface D can communicate with each other. And delete the inter-VPC interworking static route between interface A and interface C:

ip route-static vpn-instance VRF2 20.1.0.0 255.255.255.0 VRF1;

ip route-static vpn-instance VRF1 20.2.0.0 255.255.255.0 VRF2.

At the same time, configure an ACL access policy on the inbound direction of interface A to prohibit the virtual machine attached to interface A from accessing the 20.1.1.10 virtual machine attached to interface B. The ACL access policy can be implemented through the modular QoS command line (MQC):

traffic policy p1

classifier c1 behavior b1

traffic behavior b1

deny

traffic classifier c1

if-match acl 1001

acl number 1001

rule 5 deny ip destination 20.1.1.10 0.

In addition, the following command is added to the configuration of interface A, where inbound indicates the inbound direction:

traffic-policy p1inbound

After the incremental network configuration is issued, the forwarding table on switch BL1 is shown in Table 7, the forwarding table on switch L1 is shown in Table 8, and the forwarding table on switch L4 is shown in Table 9.

Table 7

Table 8

Table 9

The embodiment of the present application provides a method for verifying a network configuration. When verifying an incremental network configuration for the first time, a corresponding forwarding graph model can be established based on the basic network configuration, and a reachability matrix corresponding to the basic network configuration can be obtained. From the reachability matrix corresponding to the basic network configuration, an association table corresponding to the basic network configuration can be obtained, where the association table indicates the association relationship between the interface and/or link passed by the path and the reachable point pair of the path in the network. When the incremental network configuration is not verified for the first time, the association table corresponding to the existing basic network configuration can be used.

Then, by comparing the basic network configuration with the incremental network configuration, and comparing the forwarding table corresponding to the basic network configuration with the forwarding table corresponding to the incremental network configuration, the interface for which the forwarding policy is changed and/or the chain for which the forwarding route is changed can be obtained. road. Then obtain the first reachable point pair of the path where the above-mentioned interface and/or link are located under the incremental network configuration, and obtain the first reachable point pair of the path where the above-mentioned interface and/or link are located under the basic network configuration by looking up the above-mentioned association table. Two reachable pairs. The first reachable point pair narrows the search range of reachable point pairs whose incremental network configuration may affect reachability to be related to the above-mentioned interface and/or link; and the second reachable point pair is the above-mentioned interface and/or link. Or the reachable pair of points that the link is involved in in the underlying network configuration. By comparing the two reachable point pairs, it is possible to accurately locate which reachable point pairs are affected by the incremental network configuration, and whether the above effects conform to the configuration intent, so as to verify the incremental network configuration. .

Corresponding forwarding graph models may be established for the basic network configuration and the incremental network configuration, respectively. For the forwarding graph model, see the previous description, which will not be repeated here. As shown in FIG. 8 , in the method for verifying the network configuration provided by the embodiment of the present application, the process of establishing the forwarding graph model of the network configuration includes:

S801. Convert the network configuration file into a network configuration model.

The network configuration file includes the configuration files on each network device. The configuration file on each network device defines the protocol used and the specific configuration of the protocol, such as BGP EVPN configuration, static route configuration, and ACL policy configuration. The converted network configuration model includes the configuration models on each network device, and the configuration model on each network device defines the protocol objects used and the properties of the protocol. The conversion process is to convert the configuration text into an internally stored configuration model.

For the DCN shown in Figure 6, taking the static route configured on switch BL1 as an example, the conversion process will create two static route objects, among which: ip route-static vpn-instance VRF2 20.1.0.0 255.255.255.0 VRF1 converts one The static route object includes the following attributes: the VPC it belongs to is VRF2, the destination network segment is 20.1.0.0/24, the outbound interface is VRF1, and the next hop IP is NULL by default.

Configuration models such as BGP EVPN configuration and ACL policy configuration can also be established accordingly.

S802. Generate a forwarding table corresponding to the network configuration according to the network configuration model and the network topology file.

According to each protocol object defined in the network configuration model, combined with the network topology, according to the protocol running process, the route advertisement is published, the optimal route is selected, and finally the route converges to form a forwarding table on each network device. The operation process of the protocol (such as the BGP protocol) belongs to the public knowledge in the field, and will not be described in detail here.

S803. Generate a forwarding graph model of the network configuration according to the network configuration model, the forwarding table and the network topology.

As mentioned earlier, the forwarding graph model consists of points and edges, where a point represents an interface of a network device, and an edge is used to connect two interfaces. According to the route forwarding behavior described in the forwarding table, that is, the outgoing interface of the forwarding table entry and the next hop IP (the corresponding cross-device interface can be found), the two cross-device interfaces can be connected together through an edge. The packet space represented by all forwarding rules belonging to the same outgoing interface will be aggregated together, and the packet space represented by each forwarding rule will be calculated according to the longest prefix matching principle.

Two interfaces of the same network device can be connected together by an edge according to the policy forwarding behavior described in the configuration model. If an ACL policy is configured on the inbound interface, the packet space represented by all policy rules belonging to the same ACL policy will be aggregated to represent, and the packet space represented by each policy rule will be calculated according to the configured priority principle. . In addition, if an ACL policy is also configured on the outgoing interface, the packet space of the forwarding policy corresponding to this edge is the intersection of the packet space of the ACL policy of the ingress interface and the outgoing interface.

For example, packets in the inbound direction of the I1 interface can be forwarded in the outbound direction of the I2 interface. An ACL policy is configured on the inbound direction of the I1 interface to allow only some packets to pass through. The ACL policy is configured in the direction to allow only some packets to pass through, and the packet space is represented as space2, then the packet space on the edge between the I1 interface and the I2 interface is represented as space1&space2.

For the convenience of calculation, the message space can be represented by a Boolean expression, or by a binary decision diagram (BDD) data structure.

In addition, the ACL policy is only a forwarding policy behavior, and micro-segmentation or policy routing also belong to the forwarding policy.

For the DCN shown in Figure 6, the obtained forwarding graph model of the basic network configuration is shown in Figure 9. Exemplarily, the packet space of the edge (L1, VXLAN)->(L2, VXLAN) can be expressed as: {(*,20.1.1.0/24,*,*,*)}, where * represents the full space, for example, the source IP address is *, which represents 0.0.0.0/0, because Table 4 represents from switch L1 to switch L2 The forwarding entry of the VXLAN tunnel is only the second entry; the packet space of the edge (L1,A)->(L1,VXLAN) is {(*,*,*,*,*)}, because interface A is connected to the VXLAN The interface is not configured with any forwarding policy, and all packets can pass by default. For the DCN shown in FIG. 7 , the forwarding graph model of the incremental network configuration obtained is shown in FIG. 10 , in which the relevant part of the switch L3 is deleted and the relevant part of the switch L4 is added. The message space of the edge is similar to the forwarding graph model of the basic network configuration. For example, the message space of the edge (BL1, VXLAN)->(L4, VXLAN) can be expressed as: {(*,20.2.1.0/24,* ,*,*)}, because there is only the third entry in the forwarding table representing the VXLAN tunnel from switch BL to switch L4 in Table 7; the message space of the edge (L1,A)->(L1,VXLAN) is updated It is: {(*,*,*,*,*)-(*,20.1.1.10/32,*,*,*)}, because an ACL forwarding that blocks access to the 20.1.1.10 virtual machine is configured on interface A Strategy.

For the forwarding graph model of the basic network configuration, the reachability matrix corresponding to the basic network configuration can be obtained. For the reachability matrix, see the previous description, which will not be repeated here. As shown in FIG. 11 , in the network configuration verification method provided by the embodiment of the present application, the process of obtaining the reachability matrix corresponding to the basic network configuration includes:

S1101. Identify the interface as a service access point, and use all service access points as a starting point for finding a reachable path.

According to the service characteristics, such as all bridge-domain interfaces on the ToR Leaf switch, or, according to the service information such as the outbound interface corresponding to the logic switch (logic switch) on the SDN controller, the outbound interface on the Border Leaf switch, etc. Some interfaces are identified as service access points.

S1102: Select an uncalculated starting point, take all access points as the end point, traverse all reachable paths in the forwarding graph model, and fill in the corresponding positions of the reachability matrix.

One traversal method is the depth-first search algorithm. For example, any service access point is taken as the starting point, the message space in the forwarding graph model is the full space, and the search is performed according to depth-first until it reaches a certain access point (ie the end point). ), marking a reachable path at this time; or the result of the packet space intersection operation is empty. Then search for the next reachable path until all edges of the forwarding graph model are traversed.

For the example in Figure 6, the finally established reachability matrix is shown in Table 10.

Table 10

	A	B	C	D
A	Y	Y	Y
B	Y	Y
C	Y		Y
D				Y

A value (Y) in the matrix indicates that the two are reachable, and no value indicates that they are not reachable. Each reachable item of the reachability matrix corresponds to the following reachability information: reachable path and reachable packet space, which can be expressed as: {(path_i,space_i)}, where i∈[0,n), n is reachable number of paths. path_i consists of a series of links, that is, path_i can be expressed as {link_j}, where j∈[0,l), and l is the number of links. space_i can be expressed as {(src_ip, dst_ip, src_port, dst_port, protocol)_k}, namely {(source IP address, destination IP address, source port, destination port, protocol type)_k}, where k∈[0,t) , t is the number of quintuples.

For example, in Table 10, the value of the reachable item (A, B) is Y, indicating that the interface A to the interface B is reachable. The first reachable path path_0 corresponding to the reachable item (A, B) can be expressed as: {start->(L1,A)->(L1,VXLAN)->(L2,VXLAN)->(L2,B )->end}. Among them, start->(L1,A) indicates that the link "receives from interface A of switch L1", which is the inbound direction of the interface, and (L1,VXLAN)->(L2,VXLAN) indicates that the link "from switch L1 to switch L2" tunnel", (L2,B)->end indicates that the link is "sent from interface B of switch L2", which is the outgoing direction of the interface. The first reachable packet space space_0 corresponding to the reachable item (A, B) can be expressed as: {(*,20.1.1.0/24,*,*,*)}, where * means the full space, such as the source IP is *, which means 0.0.0.0/0.

By analyzing the reachability matrix corresponding to the basic network configuration, an association table corresponding to the basic network configuration can be obtained.

Each matrix item in the reachability matrix represents whether the path between two service access points is reachable, and a reachable point pair is a pair of service access points at both ends of the path. Each path can include at least one link. The two ends of each link are an inbound interface and an outbound interface. The inbound interface and the outbound interface belong to different network devices. The inbound interface and the outbound interface form a pair of interface pairs. Both the interface and the interface pair are traversed by the path, so an association table can be established, where the association table indicates the association relationship between the interface and/or link traversed by the path and the reachable point pair of the path in the network. And the association table reflects the association relationship between the interface and/or link and the reachable point pair under the basic network configuration.

Specifically, as shown in FIG. 12 , in the network configuration verification method provided by the embodiment of the present application, the process of parsing the reachability matrix corresponding to the basic network configuration to obtain the association table corresponding to the basic network configuration includes:

S1201. For each reachable path in the reachable matrix, extract the inbound interface and outbound interface of each cross-device link that constitutes the reachable path, and establish an association between the inbound interface and the outbound interface and the reachable point pairs of the reachable path relation.

Among them, start->(L1,A), (L2,B)->end belong to special cross-device links, and only record the association relationship between interface (L1,A) and interface (L2,B).

Exemplarily, taking the reachability information from interface A to interface B as an example, the established association relationship between the ingress interface and the reachable point pair of the reachable path and the association relationship between the outgoing interface and the reachable point pair of the reachable path are shown in Table 11. shown

S1202. If neither the inbound interface nor the outbound interface is a service access point, establish an association relationship between the link and the reachable point pair of the reachable path.

Exemplarily, taking the reachability information from interface A to interface B as an example, the association relationship between the established link and the reachable point pair of the reachable path is shown in Table 11:

Table 11

The association relationships established for all reachable information are shown in Table 12:

Table 12

As shown in FIG. 13 , in the method for verifying the network configuration provided by the embodiment of the present application, the specific process of verifying the network configuration includes:

S1301. Compare the basic network configuration with the incremental network configuration, and compare the forwarding table corresponding to the basic network configuration with the forwarding table corresponding to the incremental network configuration, so as to obtain the interface on which the forwarding policy is changed and/or the forwarding route on the network. link.

Specifically, as shown in FIG. 14, for each interface and/or link, step S1301 includes:

S13011. If a certain interface and/or link exists only in the basic network configuration or the corresponding forwarding table, add the interface and/or link to the deletion (DEL) list, and mark the interface as the forwarding policy has changed, Mark the link as forwarding route change.

The deletion list includes interfaces and/or links deleted by the incremental network configuration or corresponding forwarding table relative to the base network configuration or corresponding forwarding table.

S13012. If a certain interface and/or link exists only in the incremental network configuration or the corresponding forwarding table, add the interface and/or link to the add (ADD) list, and mark the interface as a forwarding policy change , mark the link as a forwarding route change.

The added list includes the interfaces and/or links added by the incremental network configuration or corresponding forwarding table relative to the base network configuration or corresponding forwarding table.

S13013. If the packet spaces of the forwarding policies of an interface in the basic network configuration and the incremental network configuration are inconsistent, add the interface to a modification (MOD) list, and mark it as a change in the forwarding policy.

S13014. If the packet spaces of the forwarding routes of a link in the basic network configuration and the incremental network configuration are inconsistent, add the link to a modification (MOD) list, and mark the forwarding route as changed.

The modification list includes the interfaces and/or links whose incremental network configuration has changed relative to the base network configuration.

Exemplarily, for the examples in FIG. 6 and FIG. 7 , by comparing the forwarding tables before and after the increment of the switch BL1 (ie, Table 3 and Table 7), you can find the newly added links (BL1, VXLAN, L4, VXLAN), delete them. Links (BL1, VXLAN, L3, VXLAN). By comparing the forwarding tables before and after the increment of switch L1 (that is, Table 4 and Table 8), it can be found that the packet space of the forwarding route of the link (L1, VXLAN, BL1, VXLAN) has been modified, from {(*, 20.2. 0.0/24,*,*,*)} is changed to {(*,20.2.1.0/24,*,*,*)}; by comparing the network configuration before and after the increment of switch L1, you can find (L1,A) The packet space of the forwarding policy in the inbound direction of the interface is modified.

Finally, after the incremental network configuration is delivered, the interfaces whose forwarding policies are changed and/or the links whose forwarding routes are changed include:

Added (ADD) list: (BL1, VXLAN, L4, VXLAN), (L4, VXLAN, BL1, VXLAN).

Delete (DEL) list: (BL1, VXLAN, L3, VXLAN), (L3, VXLAN, BL1, VXLAN).

Modify (MOD) list: (L1, VXLAN, BL1, VXLAN), (L1, A) interface inbound direction.

S1302. Obtain a first reachable point pair.

The first reachable point is a pair of service access points at both ends of the path where the interface indicating the change of the forwarding policy and/or the link with the change of the forwarding route in the network is located under the incremental network configuration.

Specifically, under the incremental network configuration, the first path of the interface whose forwarding policy is changed and/or the link whose forwarding route is changed can be calculated; a pair of service access points at both ends of the first path is taken as the first possible path. Up to the point. As shown in Figure 15, the process of obtaining the first path includes:

S13021. For the interface whose forwarding policy is changed, take the interface as the starting point, take the packet space of the corresponding forwarding policy configured on the interface in the incremental network as the initial packet space, take all service access points as the end point, and take the incremental network In the forwarding graph model of network configuration, forward traversal is used to solve the first reachable path.

Exemplarily, for the example in FIG. 7, for the interface (L1,A), the interface (L1,A) is taken as the starting point, and the message space of the corresponding forwarding policy configured on the incremental network for the interface is used as the initial message space, The same depth-first search algorithm as in step S1101 is used until a certain access point (ie, the end point) is reached, and a reachable path is marked at this time, or until the packet space intersection is empty. Then search for the next reachable path until all edges of the forwarding graph model are traversed, and the first reachable path finally found is:

(L1,A)->(L1,VXLAN)->(L2,VXLAN)->(L2,B)->end, the message space is: {(*,20.1.1.0/24,*,*,* )-(*,20.1.1.10/32,*,*,*)}.

(L1,A)->(L1,VXLAN)->(BL1,VXLAN)->(L4,VXLAN)->(L4,D)->end, the message space is {(*,20.2.1.0/24 ,*,*,*)}.

S13022. For the link whose forwarding route is changed, take the starting interface of the link as the starting point, take the message space of the forwarding route corresponding to the link in the incremental network configuration as the initial message space, and use all service access points as the initial message space. The point is the end point, and the first reachable path is solved by forward traversal in the forwarding graph model of the incremental network configuration.

The packet space of the forwarding route may refer to the packet space in the forwarding table.

Exemplarily, for the example in FIG. 7, for the link (BL1, VXLAN, L4, VXLAN), the starting interface (BL1, VXLAN) of the link is used as the starting point, and the corresponding link is configured in the incremental network. The message space in the forwarding table is the initial message space, with all service access points as the end point, using the same depth-first search algorithm as in step S1101, until it reaches a certain access point (ie, the end point), at this time, mark an available service point. up to the path, or until the packet space intersection is empty. Then search for the next reachable path until all edges of the forwarding graph model are traversed, and the first reachable path finally found is:

(BL1,VXLAN)->(L4,VXLAN); (L4,D)->end, the message space is: {(*,20.2.1.0/24,*,*,*)}.

For a link (L4, VXLAN, BL1, VXLAN), take the starting interface (L4, VXLAN) of the link as the starting point, and take the message space of the link in the forwarding table corresponding to the incremental network configuration as the initial report. In the message space, the same depth-first search algorithm as in step S1101 is used until a certain access point (ie, the end point) is reached, and a reachable path is marked at this time, or until the message space intersection is empty. Then search for the next reachable path until all edges of the forwarding graph model are traversed, and the first reachable path finally found is:

(L4,VXLAN)->(BL1,VXLAN)->(L1,VXLAN)->(L1,A)->end, the message space is: {(*,20.1.0.0/24,*,*,* )}.

For a link (L1, VXLAN, BL1, VXLAN), take the starting interface (L1, VXLAN) of the link as the starting point, and take the message space of the link in the forwarding table corresponding to the incremental network configuration as the initial report. In the message space, the same depth-first search algorithm as in step S1101 is used until a certain access point (ie, the end point) is reached, and a reachable path is marked at this time, or until the message space intersection is empty. Then search for the next reachable path until all edges of the forwarding graph model are traversed, and the first reachable path finally found is:

(L1,VXLAN)->(BL1,VXLAN)->(L4,VXLAN)->(L4,D)->end, the message space is: {(*,20.2.1.0/24,*,*,* )}.

S13023 , starting from the starting point and the initial message space, and taking all service access points as the end point, reverse traversal in the forwarding graph model of the incremental network configuration to solve the second reachable path.

Exemplarily, for the example in FIG. 7, for the interface (L1,A), the interface (L1,A) is taken as the starting point, and the message space of the corresponding forwarding policy configured on the incremental network for the interface is used as the initial message space, Using the same depth-first search algorithm as in step S1101, reverse traversal and solution in the forwarding graph model until a certain access point (ie, the end point) is reached, and a reachable path is marked at this time, or, until the packet space intersection is empty . Then search for the next reachable path until all edges of the forwarding graph model are traversed, and the second reachable path finally found is:

start->(L1,A), the message space is {(*,*,*,*,*)-(*,20.1.1.10/32,*,*,*)}.

For a link (BL1, VXLAN, L4, VXLAN), take the starting interface (BL1, VXLAN) of the link as the starting point, and take the message space of the link in the forwarding table corresponding to the incremental network configuration as the initial report In the message space, using the same depth-first search algorithm as in step S1101, the forwarding graph model is reversely traversed and solved until a certain access point (ie, the end point) is reached, and a reachable path is marked at this time, or, until the message space The intersection is empty. Then search for the next reachable path until all edges of the forwarding graph model are traversed, and the second reachable path finally found is:

start->(L1,A)->(L1,VXLAN)->(BL1,VXLAN), the message space is {(*,20.2.1.0/24,*,*,*)}.

For a link (L4, VXLAN, BL1, VXLAN), take the starting interface (L4, VXLAN) of the link as the starting point, and take the message space of the link in the forwarding table corresponding to the incremental network configuration as the initial report. In the message space, using the same depth-first search algorithm as in step S1101, the forwarding graph model is reversely traversed and solved until a certain access point (ie, the end point) is reached, and a reachable path is marked at this time, or, until the message space The intersection is empty. Then search for the next reachable path until all edges of the forwarding graph model are traversed, and the second reachable path finally found is:

start->(L4,D)->(L4,VXLAN), the message space is {(*,20.1.0.0/24,*,*,*)}.

For a link (L1, VXLAN, BL1, VXLAN), take the starting interface (L1, VXLAN) of the link as the starting point, and take the message space of the link in the forwarding table corresponding to the incremental network configuration as the initial report. In the message space, using the same depth-first search algorithm as in step S1101, the forwarding graph model is reversely traversed and solved until a certain access point (ie, the end point) is reached, and a reachable path is marked at this time, or, until the message space The intersection is empty. Then search for the next reachable path until all edges of the forwarding graph model are traversed, and the second reachable path finally found is:

start->(L1,A)->(L1,VXLAN), the message space is {(*,20.2.1.0/24,*,*,*)}.

S13024. Take the intersection of the first reachable path and the second reachable path, and if the intersection of the packet space of the first reachable path and the packet space of the second reachable path is not empty, splicing the first reachable path and the second reachable path to obtain the first path, and use the result of the intersection as the packet space of the first path.

Exemplarily, for the example in FIG. 7, for the interface (L1, A), the first path is:

start->(L1,A)->(L1,VXLAN)->(L2,VXLAN)->(L2,B)->end, the message space is: {(*,20.1.1.0/24,*, *,*)-(*,20.1.1.10/32,*,*,*)}.

start->(L1,A)->(L1,VXLAN)->(BL1,VXLAN)->(L4,VXLAN)->(L4,D)->end, the message space is {(*,20.2. 1.0/24,*,*,*)}.

For links (BL1, VXLAN, L4, VXLAN), the first path is:

start->(L1,A)->(L1,VXLAN)->(BL1,VXLAN)->(L4,VXLAN)->(L4,D)->end, the message space is {(*,20.2. 1.0/24,*,*,*)}.

For links (L4, VXLAN, BL1, VXLAN), the first path is:

start->(L4,D)->(L4,VXLAN)->(BL1,VXLAN)->(L1,VXLAN)->(L1,A)->end, the message space is {(*,20.1. 0.0/24,*,*,*)}.

For links (L1, VXLAN, BL1, VXLAN), the first path is:

start->(L1,A)->(L1,VXLAN)->(BL1,VXLAN)->(L4,VXLAN)->(L4,D)->end, the message space is: {(*,20.2 .1.0/24,*,*,*)}.

It should be noted that, the interface and/or the link where the forwarding route is changed may be the interface and/or link in the above-mentioned add (ADD) list and modify (MOD) list, because for The interfaces and/or links in the delete (DEL) list no longer exist in the incremental network configuration, so no reachable paths are available.

Taking a pair of service access points at both ends of each first path, the first reachable point pair includes (A, B), (A, D), and (D, A). In addition, the link list of the first reachable point pair and the corresponding packet space can also be obtained.

S1303. Search the association table corresponding to the basic network configuration to obtain the second reachable point pair, and compare it with the first reachable point pair to verify the incremental network configuration.

The second reachable point is a pair of service access points at both ends of the path where the interface indicating the change of the forwarding policy and/or the link with the change of the forwarding route in the network is configured under the basic network configuration.

Exemplarily, for the interface and/or link (BL1, VXLAN, L2, VXLAN) in the deletion (DEL) list, searching the association table can obtain the corresponding second reachable point pair: (A, C), (C , A). For the inbound direction of the interface and/or link (L1, VXLAN, BL1, VXLAN) and (L1, A) in the modified (MOD) list, look up the association table to obtain the corresponding second reachable point pair: (A, C), {(A,B),(A,C)}. After these reachable point pairs are merged, a second reachable point pair including (A, B) and (A, C) can be finally obtained.

Comparing the second reachable point pair (A,B), (A,C) with the first reachable point pair (A,B), (A,D), (D,A), we can get:

Deleted reachable point pairs: (A,C), (C,A).

Modified reachable point pair: (A,B). Its message space changes from {(*,20.1.1.0/24,*,*,*)} to {(*,20.1.1.0/24-20.1.1.10,*,*,*)}.

The newly added reachable point pair: (A, D). Among them, the new path corresponding to the reachable point pair is: start->(L1,A)->(L1,VXLAN)->(BL1,VXLAN)->(L4,VXLAN)->(L4,D) -> end. The new message space corresponding to the reachable point pair is {(*,20.2.1.0/24,*,*,*)}.

The newly added reachable point pair: (D,A). Among them, the new path corresponding to the reachable point pair is: start->(L4,D)->(L4,VXLAN)->(BL1,VXLAN)->(L1,VXLAN)->(L1,A) -> end. The new message space corresponding to the reachable point pair is {(*,20.1.0.0/24,*,*,*)}.

Through the above analysis, it is possible to verify the incremental network configuration, that is, to verify whether the above-mentioned reachable point pair is consistent with the expected reachability after the incremental network configuration is issued.

In addition, the reachability matrix and the association table can also be updated according to the first reachable point pair and the second reachable point pair, which is equivalent to using the current incremental network configuration as the basic network configuration for the next incremental network configuration, so that there is no need to Repeated computation of reachability matrices and association tables.

For updating the reachability matrix according to the first reachable point pair and the second reachable point pair, delete the matrix item corresponding to the delete list, add the matrix item corresponding to the add list, and modify the availability of the matrix item corresponding to the modification list. information.

For updating the association table according to the first reachable point pair and the second reachable point pair, delete the association relationship corresponding to the delete list in the association table, add the association relationship corresponding to the add list, and modify the association relationship corresponding to the modification list. .

Exemplarily, the reachability matrix is updated according to the first reachable point pair and the second reachable point pair as shown in Table 13: For example, a new reachable point pair (D, A) is added, and the item is modified to Y.

Table 13

	A	B	C	D
A	Y	Y		Y
B	Y	Y
C			Y
D	Y			Y

Exemplarily, the association table is updated according to the first reachable point pair and the second reachable point pair, as shown in Table 14: For example, in the inbound direction of the interface, the interface (L4, D) and the reachable point pair (D, D, D) are added. A), the association of (L3,C) with the reachable point pair (C,A) is deleted.

Table 14

The method for verifying the network configuration provided by the embodiment of the present application, by comparing the basic network configuration and the incremental network configuration, and comparing the forwarding table corresponding to the basic network configuration and the forwarding table corresponding to the incremental network configuration, so as to obtain the information that the forwarding policy has changed. A link whose interface and/or forwarding route has changed; obtain the first reachable point pair, which indicates a pair of service access points on the path where the interface and/or link is located under the incremental network configuration ; Look up the association table corresponding to the basic network configuration to obtain the second reachable point pair, and compare it with the first reachable point pair to verify the incremental network configuration; wherein, the association table indicates that in the network, the path through which the path passes The association relationship between the interface and/or link and the reachable point pair of the path, the second reachable point pair indicates a pair of service access points of the path where the interface and/or link is located under the basic network configuration. The first reachable point pair narrows the search range of reachable point pairs whose incremental network configuration may affect reachability to be related to the above-mentioned interface and/or link; and the second reachable point pair is the above-mentioned interface and/or link. Or the reachable pair of points that the link is involved in in the underlying network configuration. By comparing the two reachable point pairs, it is possible to accurately locate which reachable point pairs are affected by the incremental network configuration, and whether the above effects conform to the configuration intent, so as to verify the incremental network configuration. . Since it is not necessary to analyze the reachable point pairs of the whole network for the incremental network configuration, only the reachable point pairs related to the changed interface and/or link are analyzed, so the calculation amount for verifying the network configuration can be reduced.

The verification method of the network configuration of FIG. 13 is compared with the verification method of the network configuration of FIG. 2:

First, the problem that the association table cannot find the newly added reachable point pair can be solved. In the examples of FIG. 6 and FIG. 7 , for the newly added reachable point pair (A, D), no association relationship can be established in FIG. 2 because there is no reachable path from interface A to interface D. The solution in FIG. 13 obtains the newly added reachable point pair by finding the first path, so the reachable point pair (A, D) can be found, and there is no problem of omission.

Secondly, it can solve the problem of repeated calculation caused by too coarse association granularity. In the examples of Figure 6 and Figure 7, if the solution of Figure 2 is adopted (the network device is used as the granularity for association), then the switch L1 will associate the reachable point pairs (A, B) and (A, C), when the interface A When the forwarding policy of the switch is changed, it will be considered that the switch L1 has been changed, so it will recalculate the availability between the point pairs (A,B), (A,C), (B,A), (C,A). reachability. There is no change in the reachability of the point pair (B, A), which does not need to be calculated. If the switch L1 carries more reachable point pairs, the double-counting problem is more serious. The solution in FIG. 13 is based on changing interfaces and links to find the first path, rather than performing association based on the granularity of network devices, which avoids repeated calculation of the reachability of the point pair (B, A).

The verification method of the network configuration in FIG. 13 is compared with the verification method of the network configuration in FIG. 4 : it can solve the problems of repeated calculation and large storage overhead caused by full-flow storage.

In the examples of Figure 6 and Figure 7, if the solution of Figure 4 (full flow storage) is adopted, without establishing an association table, each interface stores the flow that may pass through, for example, interface A will store the flow object:

A->B,(*,20.1.0.0/24,*,*,*)

A->C,(*,20.2.0.0/24,*,*,*)

A->D,(*,20.2.1.0/24,*,*,*)

When the forwarding policy of interface A changes, on the one hand, the reachability of the three flows is calculated based on the forwarding graph model of the basic network configuration, and finally the reachability of interface A to interface B and the reachability of interface A to interface C are obtained. On the one hand, based on the forwarding graph model of incremental network configuration, the reachability of these three flows is solved, and finally the reachability of interface A to interface B and the reachability of interface A to interface D are obtained, so as to compare the interfaces whose forwarding policies have changed. . In this process, the solution of the forwarding graph model based on the basic network configuration is a repetitive calculation.

In addition, each interface needs to store all possible flows, including flows that cannot be reached in the end. For example, interface A stores flows from interface A to interface D, and also stores specific flow information. The solution in FIG. 13 only stores associated reachable point pairs for each interface, and does not need to store unreachable point pairs, which reduces storage overhead. In addition, in complex scenarios (for example, when a forwarding policy is configured to allow only some packets to pass through), the flow information needs to express the packet space explicitly, so it includes various combinations of IP and port (Port). The scheme does not need to store specific flow information, which reduces storage overhead.

The solutions provided by the embodiments of the present application can be applied not only to the scenario of verifying the incremental network configuration, but also to the scenario of verifying the incremental data plane. In the scenario of verifying the incremental data plane, the forwarding table is obtained not by performing protocol simulation on the basic network configuration, but by grabbing the forwarding table of the network device. The scenario of verifying the data plane is more suitable for post-event verification, that is, after the network configuration is delivered to the network device and takes effect, the forwarding table actually generated by the network device is captured, and the captured network configuration information is used to verify whether the network state meets the operating intent.

The embodiment of the present application also provides a network configuration verification device, which is used to implement the above-mentioned various methods. The device for verifying the network configuration may be the SDN controller in the above method embodiments, or a device including the above SDN controller, or a chip or functional module in the SDN controller.

It can be understood that, in order to realize the above-mentioned functions, the verification apparatus of the network configuration includes corresponding hardware structures and/or software modules for executing each function. Those skilled in the art should easily realize that the present application can be implemented in hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

In this embodiment of the present application, functional modules may be divided for the verification device of the network configuration according to the foregoing method embodiments. For example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. . The above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation.

For example, it is assumed that the device for verifying the network configuration is the SDN controller in the above method embodiment. FIG. 16 shows a schematic structural diagram of a verification apparatus 160 for a network configuration. The network configuration verification device 160 includes a comparison module 1601 , an acquisition module 1602 , an analysis module 1603 , and optionally, an update module 1604 . The comparison module 1601 may perform step S1301 in FIG. 13 and steps S13011-S13014 in FIG. 14 . The obtaining module 1602 may execute step S1302 in FIG. 13 and steps S13021-S13024 in FIG. 15 . The parsing module 1603 may execute steps S1201-S1202 in FIG. 12 and step S1303 in FIG. 13 .

Exemplarily, the comparison module 1601 is configured to compare the basic network configuration and the incremental network configuration, and compare the forwarding table corresponding to the basic network configuration with the forwarding table corresponding to the incremental network configuration, so as to obtain the interface and/or the forwarding policy changed. or forwarding a link whose route has changed; the obtaining module 1602 obtains a first reachable point pair, wherein the first reachable point pair indicates a pair of services of the path where the interface and/or link is located under the incremental network configuration access point; the comparison module 1601 is further configured to look up the association table corresponding to the basic network configuration to obtain the second reachable point pair, and compare it with the first reachable point pair to verify the incremental network configuration; wherein , the association table indicates the association relationship between the interface and/or link that the path passes through and the reachable point pair of the path in the network, and the second reachable point pair indicates that the interface and/or link is located in one of the paths in the basic network configuration. to the service access point.

In a possible implementation manner, the method further includes: a parsing module 1603, configured to parse a reachability matrix corresponding to the basic network configuration to obtain an association table, wherein the reachability matrix refers to a two-dimensional representation of service access points in the network. A matrix of reachability between two.

In a possible implementation manner, the method further includes: an update module 1604, configured to update the reachability matrix and the association table according to the first reachable point pair.

In a possible implementation manner, the parsing module 1603 is specifically configured to: for each reachable path in the reachable matrix, extract the inbound interface and outbound interface of each cross-device link that constitutes the reachable path, and establish an inbound interface and an outbound interface of each cross-device link constituting the reachable path. The association relationship between the interface and the outgoing interface and the reachable point pair of the reachable path; if neither the incoming interface nor the outgoing interface is a service access point, the association relationship between the link and the reachable point pair of the reachable path is established.

In a possible implementation manner, the comparison module 1601 is specifically configured to: if the interface and/or link exists only in the basic network configuration or the corresponding forwarding table, add the interface and/or link to the deletion list, and add the interface and/or link to the deletion list. Mark as the forwarding policy has changed, and mark the link as the forwarding route has changed; if the interface and/or link only exists in the incremental network configuration or the corresponding forwarding table, add the interface and/or link to the increase list, Mark the interface as having changed the forwarding policy, and mark the link as having changed the forwarding route; if the packet space of the forwarding policy of the interface in the basic network configuration and the incremental network configuration is inconsistent, add the interface to the modification list and mark it as The forwarding policy is changed; if the packet space of the forwarding route of the link in the basic network configuration and the incremental network configuration is inconsistent, the link is added to the modification list and marked as the forwarding route changed.

In a possible implementation manner, the obtaining module 1602 is specifically configured to: calculate the first path passing through the interface and/or link under the incremental network configuration; take a pair of service access points at both ends of the first path as The first reachable point pair.

In a possible implementation manner, the obtaining module 1602 is specifically configured to: for an interface whose forwarding policy is changed, the interface is used as the starting point, and the message space of the corresponding forwarding policy configured on the interface in the incremental network is used as the initial message space , with all service access points as the end point, forward traversal in the forwarding graph model of incremental network configuration to solve the first reachable path; The message space of the forwarding route corresponding to the incremental network configuration is used as the initial message space, with all service access points as the end point, and forward traversal in the forwarding graph model of the incremental network configuration is used to solve the first reachable path; from the starting point Starting from the initial message space, with all service access points as the end point, reverse traversal in the forwarding graph model to solve the second reachable path; take the intersection of the first reachable path and the second reachable path, if the first reachable path is If the intersection of the packet space of the reachable path and the packet space of the second reachable path is not empty, the first path is obtained by splicing the first reachable path and the second reachable path, and the result of the intersection is used as the result of the first path. message space.

In this embodiment, the verification apparatus 160 of the network configuration is presented in the form of dividing each functional module in an integrated manner. "Module" herein may refer to a specific ASIC, circuit, processor and memory executing one or more software or firmware programs, integrated logic circuit, and/or other device that may provide the functions described above.

Specifically, the function/implementation process of each module in FIG. 8 can be implemented by the processor in the terminal device calling the computer execution instructions stored in the memory.

Since the apparatus 160 for verifying the network configuration provided in this embodiment can perform the above method, the technical effect that can be obtained can be referred to the above method embodiments, and details are not repeated here.

As shown in FIG. 17 , an embodiment of the present application further provides an apparatus for verifying a network configuration. The apparatus 170 for verifying a network configuration includes a processor 1701 , a memory 1702 and a network interface 1703 , and the processor 1701 , the memory 1702 and the network interface 1703 Coupling, when the processor 1701 executes computer programs or instructions in the memory 1702, the corresponding methods in FIGS. 12-15 are performed.

Embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when it runs on a computer or a processor, the computer or the processor causes the computer or the processor to execute the programs shown in FIGS. 12 to 15 . corresponding method.

The embodiments of the present application also provide a computer program product containing instructions, when the instructions are executed on a computer or a processor, the computer or processor can execute the corresponding methods in FIGS. 12-15 .

An embodiment of the present application provides a chip system, where the chip system includes a processor, and an apparatus for verifying a network configuration executes the corresponding methods in FIGS. 12-15 .

In a possible design, the chip system further includes a memory for storing necessary program instructions and data. The chip system may include chips, integrated circuits, or chips and other discrete devices, which are not specifically limited in this embodiment of the present application.

Wherein, the network configuration verification device, chip, computer storage medium, computer program product or chip system provided in this application are all used to execute the method described above, therefore, the beneficial effects that can be achieved can be referred to the above provided The beneficial effects in the implementation manner are not repeated here.

The processor involved in the embodiments of the present application may be a chip. For example, it can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), or a central processing unit. It can be a central processor unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), or a microcontroller (MCU) , it can also be a programmable logic device (PLD) or other integrated chips.

The memory involved in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory may be random access memory (RAM), which acts as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM) ) and direct memory bus random access memory (direct rambus RAM, DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but not be limited to, these and any other suitable types of memory.

It should be understood that, in various embodiments of the present application, the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be dealt with in the embodiments of the present application. implementation constitutes any limitation.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described systems, devices and units may refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other manners. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server or data center by wire (eg coaxial cable, optical fiber, Digital Subscriber Line, DSL) or wireless (eg infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or data storage devices including one or more servers, data centers, etc. that can be integrated with the medium. The usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a Solid State Disk (SSD)), and the like.

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited to this. should be covered within the scope of protection of this application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims (16)

1. A method for verifying network configuration, comprising:

   Comparing the basic network configuration and the incremental network configuration, and comparing the forwarding table corresponding to the basic network configuration and the forwarding table corresponding to the incremental network configuration, to obtain the interface and/or the forwarding route in which the forwarding policy has changed in the network. changed link;

   acquiring a first reachable point pair, wherein the first reachable point pair indicates a pair of service access points of the path where the interface and/or the link is located under the incremental network configuration;

   looking up an association table corresponding to the basic network configuration to obtain a second reachable point pair, and comparing it with the first reachable point pair to verify the incremental network configuration; wherein the association table Indicate the association relationship between the interface and/or link passed by the path and the reachable point pair of the path in the network, and the second reachable point pair indicates that the interface and/or link are in the basic network Under configuration, a pair of service access points on the path.
2. The method of claim 1, further comprising:

   The reachability matrix corresponding to the basic network configuration is parsed to obtain the association table, wherein the reachability matrix refers to a matrix used to indicate whether two service access points in the network are reachable.
3. The method of claim 2, further comprising:

   The reachability matrix and the association table are updated according to the first reachable point pair.
4. The method according to claim 2 or 3, wherein the parsing a reachability matrix corresponding to the basic network configuration to obtain the association table comprises:

   For each reachable path in the reachable matrix, extract the inbound interface and outbound interface of each cross-device link that constitutes the reachable path, and establish the inbound interface and the outbound interface and the reachable interface. The relationship between the reachable point pairs of the path;

   If neither the inbound interface nor the outbound interface is a service access point, establish an association relationship between the link and the reachable point pair of the reachable path, and the link uses the inbound interface and the outbound interface as the service access point. The combined indication of the outgoing interface.
5. The method according to any one of claims 1-4, wherein the comparing the basic network configuration and the incremental network configuration, and comparing the forwarding table corresponding to the basic network configuration and the incremental network Configure the corresponding forwarding table to obtain the interface whose forwarding policy has changed and/or the link whose forwarding route has changed in the network, including:

   If the interface and/or the link only exists in the basic network configuration or the corresponding forwarding table, add the interface and/or the link to the deletion list, and mark the interface as having changed the forwarding policy , marking the link as a forwarding route change;

   If the interface and/or the link exists only in the incremental network configuration or the corresponding forwarding table, add the interface and/or the link to an increase list, and mark the interface as forwarding When the policy is changed, the link is marked as a change in the forwarding route;

   If the packet space of the forwarding policy of the interface in the basic network configuration and the incremental network configuration is inconsistent, adding the interface to the modification list and marking it as a change in the forwarding policy;

   If the packet space of the forwarding route of the link in the basic network configuration and the incremental network configuration is inconsistent, the link is added to the modification list, and the forwarding route is marked as changed.
6. The method according to any one of claims 1-5, wherein the acquiring the first reachable point pair comprises:

   calculating a first path through the interface and/or link under the incremental network configuration;

   A pair of service access points at both ends of the first path is taken as the first reachable point pair.
7. The method according to claim 6, wherein the calculating the first path through the interface and/or link under the incremental network configuration comprises:

   For the interface whose forwarding policy is changed, take the interface as the starting point, take the packet space of the interface corresponding to the forwarding policy configured on the incremental network as the initial packet space, take all service access points as the end point, and use the interface as the starting point. The forward traversal in the forwarding graph model of the incremental network configuration solves the first reachable path;

   For a link whose forwarding route is changed, the starting interface of the link is used as the starting point, the message space of the corresponding forwarding route configured on the incremental network for the link is used as the initial message space, and all services are used as the initial message space. The access point is the end point, and the first reachable path is solved by forward traversal in the forwarding graph model of the incremental network configuration;

   Starting from the starting point and the initial message space, and taking all service access points as the end point, reverse traversal in the forwarding graph model to solve the second reachable path;

   Take the intersection of the first reachable path and the second reachable path, if the intersection of the packet space of the first reachable path and the packet space of the second reachable path is not empty, then The first path is obtained by splicing the first reachable path and the second reachable path, and the result of the intersection is used as the packet space of the first path.
8. A device for verifying network configuration, comprising:

   A comparison module, configured to compare the basic network configuration and the incremental network configuration, and compare the forwarding table corresponding to the basic network configuration with the forwarding table corresponding to the incremental network configuration, so as to obtain the interface and/or the interface for which the forwarding policy has been changed and/or Forwarding the link whose route has changed;

   an obtaining module, obtaining a first reachable point pair, wherein the first reachable point pair indicates a pair of service accesses of the path where the interface and/or the link is located under the incremental network configuration point;

   The comparison module is further configured to look up the association table corresponding to the basic network configuration to obtain a second reachable point pair, and compare it with the first reachable point pair to perform a comparison of the incremental network configuration. Verification; wherein the association table indicates the association relationship between the interface and/or link passed by the path and the reachable point pair of the path in the network, and the second reachable point pair indicates the interface and/or the reachable point pair. Or a pair of service access points of the path where the link is located under the basic network configuration.
9. The device of claim 8, further comprising:

   A parsing module, configured to parse the reachability matrix corresponding to the basic network configuration to obtain the association table, wherein the reachability matrix refers to a parameter used to indicate whether the service access points in the network are reachable in pairs matrix.
10. The device of claim 9, further comprising:

    An update module, configured to update the reachability matrix and the association table according to the first reachable point pair.
11. The device according to claim 9 or 10, wherein the parsing module is specifically used for:

    For each reachable path in the reachable matrix, extract the inbound interface and outbound interface of each cross-device link that constitutes the reachable path, and establish the inbound interface and the outbound interface and the reachable interface. The relationship between the reachable point pairs of the path;

    If neither the inbound interface nor the outbound interface is a service access point, an association relationship between the link and the reachable point pair of the reachable path is established.
12. The device according to any one of claims 8-11, wherein the comparison module is specifically used for:

    If the interface and/or the link only exists in the basic network configuration or the corresponding forwarding table, add the interface and/or the link to the deletion list, and mark the interface as having changed the forwarding policy , marking the link as a forwarding route change;

    If the interface and/or the link exists only in the incremental network configuration or the corresponding forwarding table, add the interface and/or the link to an increase list, and mark the interface as forwarding When the policy is changed, the link is marked as a change in the forwarding route;

    If the packet space of the forwarding policy of the interface in the basic network configuration and the incremental network configuration is inconsistent, adding the interface to the modification list, and marking it as a change in the forwarding policy;

    If the packet space of the forwarding route of the link in the basic network configuration and the incremental network configuration is inconsistent, the link is added to the modification list, and the forwarding route is marked as changed.
13. The device according to any one of claims 8-12, wherein the acquisition module is specifically configured to:

    calculating a first path through the interface and/or link under the incremental network configuration;

    A pair of service access points at both ends of the first path is taken as the first reachable point pair.
14. The device according to claim 13, wherein the acquisition module is specifically configured to:

    For the interface whose forwarding policy is changed, the interface is used as the starting point, the message space of the corresponding forwarding policy configured on the interface in the incremental network is used as the initial message space, and all service access points are used as the end point. The forward traversal in the forwarding graph model of the incremental network configuration solves the first reachable path;

    For a link whose forwarding route is changed, the starting interface of the link is used as the starting point, the message space of the corresponding forwarding route configured on the incremental network for the link is used as the initial message space, and all services are used as the initial message space. The access point is the end point, and the first reachable path is solved by forward traversal in the forwarding graph model of the incremental network configuration;

    Starting from the starting point and the initial message space, taking all service access points as the end point, reverse traversal in the forwarding graph model to solve the second reachable path;

    Take the intersection of the first reachable path and the second reachable path, if the intersection of the packet space of the first reachable path and the packet space of the second reachable path is not empty, then The first path is obtained by splicing the first reachable path and the second reachable path, and the result of the intersection is used as the packet space of the first path.
15. A device for verifying network configuration, comprising:

    memory for storing computer programs;

    A processor connected to the memory for causing the apparatus to perform the method according to any one of claims 1 to 7 by invoking a computer program stored in the memory.
16. A computer-readable storage medium, characterized by comprising a computer program, which, when the computer program is run on a computer, causes the computer to execute the method according to any one of claims 1 to 7.

Images