WO2024045599A1 - 报文匹配方法、计算机设备和计算机可读存储介质 - Google Patents

报文匹配方法、计算机设备和计算机可读存储介质 Download PDF

Info

Publication number
WO2024045599A1
WO2024045599A1 PCT/CN2023/085162 CN2023085162W WO2024045599A1 WO 2024045599 A1 WO2024045599 A1 WO 2024045599A1 CN 2023085162 W CN2023085162 W CN 2023085162W WO 2024045599 A1 WO2024045599 A1 WO 2024045599A1
Authority
WO
WIPO (PCT)
Prior art keywords
matched
message
matching
matching result
field
Prior art date
Application number
PCT/CN2023/085162
Other languages
English (en)
French (fr)
Inventor
林宁
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2024045599A1 publication Critical patent/WO2024045599A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/06—Notations for structuring of protocol data, e.g. abstract syntax notation one [ASN.1]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/70—Admission control; Resource allocation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Definitions

  • the present application relates to the field of network communication technology, and in particular to a message matching method, computer equipment and computer-readable storage media.
  • Access Control List (ACL) resources of network devices are limited, and their resources are generally limited according to length and entries. For example, when matching 128 bytes, if the resource is 8K, then when matching 256 bytes, the resource will The number will become 4K. When matching 512 bytes, the number of resources will become 2K. With the development of tunnel services, it is often necessary to match tunnel-encapsulated packets on the network. Since the length of the tunnel header has consumed a relatively large amount of packet length, the requirements for the length of ACL resources are constantly increasing.
  • the same or repeated fields in multiple messages are called fixed fields, and the different or changing fields in multiple messages are called variable fields.
  • An ACL resource with a length equivalent to its length must be used for processing. For example, if 128 bytes are used in the tunnel header, then an ACL with a 256-byte resource must be used for internal matching, and often the fields that need to be matched may not be in the tunnel header.
  • the entire tunnel header information of the data flow is the same.
  • the same tunnel header information is called a fixed field. Matching the fixed fields of the tunnel message each time requires a large amount of resources. The above matching consumes the overall ACL resources. is very huge.
  • This application provides a message matching method, computer equipment and computer-readable storage medium.
  • this application provides a message matching method, applied to a first network device.
  • the method includes: dividing the access control list ACL matching resources of the first network device into fixed field resource groups and variable Field resource group, the fixed field resource group includes a set of fixed fields, and the variable field resource group includes a set of variable fields; receiving a message to be matched, according to the fixed fields in the fixed field resource group and the The variable field in the variable field resource group matches the message to be matched to obtain a first matching result; and a matching action for the message to be matched is determined based on the first matching result.
  • this application provides a message matching method, which is applied to a first network device.
  • the method includes: receiving a message to be matched, and matching the fixed fields according to the fixed field resource group of the first network device.
  • the first fixed field of the message to be matched is matched to obtain a first matching result; when the first matching result indicates that the first fixed field is matched, the message to be matched is sent to the first fixed field.
  • Two network devices so that the variable fields of the message to be matched are matched according to the variable fields in the variable field resource group of the second network device to obtain a second matching result; receiving the second network device The second matching result returned by the device; determining a matching action for the packet to be matched based on the second matching result.
  • this application provides a message matching method, applied to a first network device.
  • the method includes: receiving a message to be matched, and sending the message to be matched to a second network device, so that the message can be matched according to the The fixed field in the fixed field resource group of the second network device matches the second fixed field of the message to be matched, and a first matching result is obtained;
  • the second matching result determines the matching action for the packet to be matched.
  • this application provides a message matching method, applied to a second network device.
  • the method includes: receiving a message to be matched sent by a first network device; and matching a message according to a variable field of the second network device.
  • the variable fields in the resource group match the variable fields of the message to be matched, obtain a second matching result, and return the second matching result to the first network device, so that the first
  • the network device determines a matching action for the packet to be matched according to the second matching result.
  • the present application provides a message matching method, applied to a second network device.
  • the method includes: receiving a message to be matched sent by the first network device; and according to the fixed field resource of the second network device.
  • the fixed field in the group matches the second fixed field of the message to be matched, obtains a first matching result, and returns the first matching result to the first network device, so that the first network device
  • the device matches the variable field of the message to be matched according to the variable field in the variable field resource group of the first network device, obtains a second matching result, and determines the matching of the message based on the second matching result. Matching action for the packet to be matched.
  • the present application provides a computer device.
  • the computer device includes a memory and a processor.
  • Computer-readable instructions are stored in the memory, and the computer-readable instructions are executed by one or more of the processors.
  • one or more of the processors are caused to perform the steps of the method described in any one of the above first aspect, second aspect, third aspect, fourth aspect and fifth aspect.
  • the application also provides a computer-readable storage medium, which can be read and written by a processor.
  • the storage medium stores computer instructions, and the computer-readable instructions can be read and written by one or more processors. When executed, one or more processors are caused to perform the steps of the method described in any one of the above first aspect, second aspect, third aspect, fourth aspect and fifth aspect.
  • Figure 1 is a schematic flow chart of a packet matching method provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a sub-step of step S120 in Figure 1;
  • Figure 3 is a schematic flowchart of a message matching method provided by another embodiment of the present application.
  • Figure 4 is a schematic flowchart of a sub-step of step S130 in Figure 1;
  • Figure 5 is a schematic flowchart of a packet matching method provided by another embodiment of the present application.
  • Figure 6 is a schematic flowchart of a sub-step of step S240 in Figure 5;
  • Figure 7 is a schematic flowchart of a message matching method provided by another embodiment of the present application.
  • Figure 8 is a schematic flowchart of a sub-step of step S340 in Figure 7;
  • Figure 9 is a schematic flowchart of a message matching method provided by another embodiment of the present application.
  • Figure 10 is a schematic flowchart of a message matching method provided by another embodiment of the present application.
  • Figure 11 is a schematic diagram of loopback port matching provided by an embodiment of the present application.
  • Figure 12 is a schematic diagram of second network device matching provided by an embodiment of the present application.
  • Figure 13 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • Figure 14 is a schematic diagram of a message matching method in some situations.
  • the message includes a physical address MAC, a Virtual Local Area Network (VLAN) tag, an IP address, and message data DATA.
  • the message data may also include N ACL entries. , the length of this message is relatively long. When matching the ACL resources of the tunnel service, ACL resources of the same length as the message are used to match the corresponding entries one by one. The length of the ACL occupies more resources. If there are many, relatively few resources can be used, and more ACL resources are needed to complete packet matching.
  • embodiments of the present application provide a message matching method, computer equipment, and computer-readable storage media.
  • the embodiments of the present application include dividing the access control list ACL matching resources of the first network device into fixed field resource groups and available Variable field resource group, fixed field resource group includes a set of fixed fields, and variable field resource group includes a set of variable fields. By dividing ACL matching resources, it is helpful to filter the packets to be matched multiple times and reduce resource usage. ; Receive the message to be matched, match the message to be matched according to the fixed field in the fixed field resource group and the variable field in the variable field resource group, and obtain the first matching result.
  • use fixed Field resource groups match the packets to be matched, which can reduce resource usage and thus save overall ACL resource usage.
  • the embodiment of the present application performs hierarchical filtering on messages by dividing ACL matching resources. Can save the use of overall ACL resources.
  • this packet matching method is mainly used in scenarios where switches or routers have insufficient ACL resources or need to perform position matching of over-long packet fields. This method enriches the use of ACL and saves ACL resources. . This packet matching method is also applicable to the matching of short packets, and will not be described again here.
  • Figure 1 shows a schematic flow chart of a message matching method provided by an embodiment of the present application.
  • the message matching method provided by an embodiment of the present application is applied to a first network device, where the first network device can be a switch. , it can also be a router, and the first network device has a receiving port and a loopback port.
  • the message matching method includes but is not limited to step S110, step S120 and step S130.
  • Step S110 Divide the access control list ACL matching resources of the first network device into a fixed field resource group and a variable field resource group.
  • the fixed field resource group includes a set of fixed fields
  • the variable field resource group includes a set of variable fields.
  • the access control list ACL matching resource of the first network device is divided into a fixed field resource group and a variable field resource group.
  • the fixed field resource group includes a set of fixed fields, and the set of fixed fields conforms to the preset ACL matching rules are a set of fixed fields corresponding to packets.
  • ACL matching rules include matching length and matching entries.
  • the matching length can be 32 bytes or 64 bytes and can be set according to the length of the packet. I won’t go into details here; since fixed fields are the same or repeated fields in multiple messages, and the elements in the set are different, there is only one matching entry corresponding to the fixed field, which is beneficial to subsequent use of this matching entry to treat matching messages.
  • Fixed fields are used for matching, thereby reducing the use of ACL matching resources.
  • the variable field resource group includes a set of variable fields corresponding to the packets that comply with the preset ACL matching rules.
  • the set of variable fields is a set of variable fields corresponding to the packets that comply with the preset ACL matching rules.
  • the preset The ACL matching rules set include the matching length and matching entries.
  • the matching length can be 32 bytes or 64 bytes. It can be set according to the length of the message. I will not go into details here; the matching entry is the acceptable length of the message.
  • Multiple matching entries corresponding to variable fields that is to say, the matching entries enumerate the matching conditions of the variable fields one by one to achieve matching of different fields of the message. Dividing ACL matching resources into fixed field resource groups and variable field resource groups can achieve hierarchical filtering of packets, change the use of ACL matching resources from product consumption to additive consumption, and reduce resource usage.
  • Step S120 Receive the message to be matched, match the message to be matched according to the fixed field in the fixed field resource group and the variable field in the variable field resource group, and obtain the first matching result.
  • the packets to be matched are matched according to the fixed fields in the fixed field resource group and the variable fields in the variable field resource group to obtain the first matching result, including but not limited to the following steps:
  • Step S121 Match the first fixed field of the message to be matched according to the fixed field in the fixed field resource group to obtain the second matching result.
  • the first fixed field of the message to be matched is matched with the fixed field in the fixed field resource group to obtain the second matching result.
  • the fixed field information is used for the first fixed field of each message to be matched.
  • One matching entry in the source group is used for matching instead of multiple matching entries, which saves the use of ACL matching resources.
  • the first fixed field is the header field encapsulated in the outermost layer of the message to be matched, or the field that is first matched during the message matching process; the second matching result is the matching result of the first fixed field.
  • the second matching result indicates that the first fixed field is not matched, it means that the fixed field of the fixed field resource group matches the fixed field of the message to be matched and is rejected. If the packet to be matched is passed, or the fixed field of the fixed field resource group does not match the fixed field of the packet to be matched, no subsequent matching operation is performed, and the packet to be matched is directly discarded. Discarding packets to be matched helps limit network traffic and improve network performance.
  • Step S122 When the second matching result indicates that the first fixed field is matched, the variable fields of the message to be matched are matched according to the variable fields in the variable field resource group to obtain the first matching result.
  • the second matching result obtained in step S121 if the second matching result indicates that the first fixed field is matched, it means that the fixed field of the fixed field resource group matches the first fixed field of the message to be matched. field, and allows the first fixed field of the message to be matched to pass through, and uses the variable field in the variable field resource group to match the variable field of the message to be matched, to obtain the first matching result. Multi-level filtering of the packets to be matched through fixed field resource groups and variable field resource groups can reduce the matching length and matching entries, thereby reducing the use of overall ACL matching resources and avoiding the use of too long matching lengths that cause ACL Insufficient matching resources.
  • the first matching result is the result obtained by matching all fields of the message to be matched.
  • the packet matching method also includes but is not limited to the following steps:
  • Step S123 The receiving port of the first network device is configured with a fixed field resource group.
  • the receiving port is used to receive the message to be matched, and the first fixed field of the message to be matched is configured on the receiving port according to the fixed field in the fixed field resource group. Fields are matched to obtain the second matching result.
  • the message to be matched is received through the receiving port, and the first fixed field of the message to be matched is matched on the receiving port according to the configured fixed field resource group to obtain the second matching result.
  • the matching length used for matching can be reduced, thereby making sufficient use of ACL matching resources.
  • the physical address and label header in the tunnel message header are matched on the receiving port.
  • the label header is located between the physical address and the IP address in the message.
  • the physical address and label header are both Fixed field, use the fixed field in the fixed field resource group to match the physical address and label header. If the important fields to be matched are within the physical address, there is no need to match the packets to be matched, and subsequent execution actions are performed based on the matching results; if the important fields to be matched are not within the physical address, then matching processing in subsequent steps is performed.
  • the second matching result indicates that the first fixed field is not matched, it means that the fixed field of the fixed field resource group matches the fixed field of the message to be matched and is rejected. If the packet to be matched is passed, or the fixed field of the fixed field resource group does not match the fixed field of the packet to be matched, no subsequent matching operation is performed, and the packet to be matched is directly discarded. Discarding packets to be matched helps limit network traffic and improve network performance.
  • Step S124 The fixed field resource group is configured on the first loopback port of the first network device. If the second matching result indicates that the first fixed field is matched, the fixed field resource group is configured on the first loopback port according to the first fixed field. The fixed field of the packet is matched with the second fixed field of the to-be-matched message to obtain a third matching result. The second fixed field is a fixed field other than the first fixed field.
  • a fixed field resource group is configured on the first loopback port of the first network device.
  • the second matching result indicates that the first fixed field is matched, it means that the fixed field of the fixed field resource group matches the The first fixed field of the packet to be matched, and the first fixed field of the packet to be matched is allowed to pass, the packet to be matched is redirected to the first loopback port, and the fixed field resource group is configured on the first loopback port according to The fixed field in is matched with the second fixed field of the to-be-matched message to obtain the third matching result.
  • the packets to be matched can be filtered again.
  • the second fixed field is a fixed field other than the first fixed field, which may be a message header field encapsulated in the outer layer of the message to be matched, or a field that is matched first and then matched in the message matching process;
  • the third matching result is the result of matching the second fixed field;
  • the first loopback port is a special interface, it is not
  • a physical interface is an invisible logical interface.
  • One or more loopback interfaces can be created through configuration commands on the first network device, and the IP address of the loopback interface can be configured in the same way as the physical interface. and mask.
  • the mask of the loopback interface is generally all 1s.
  • the first loopback port matches the IP address in the tunnel packet header. If the IP address is a fixed field, the fixed field in the fixed field resource group of the first loopback port is used. IP address matching. If the important fields to be matched are within the IP address, there is no need to match the packets to be matched, and subsequent execution actions will be performed based on the matching results; if the important fields to be matched are not within the IP address, then the packets to be matched will be relocated. To the second loopback port, the processing steps are similar to those for packet matching on the first loopback port, and will not be described again here. Through multi-level matching, it is possible to avoid using excessively long ACL matching lengths for matching, thereby saving overall ACL resource usage.
  • the third matching result indicates that the second fixed field is not matched, it means that the fixed field of the fixed field resource group matches the fixed field of the message to be matched and is rejected. If the packet to be matched is passed, or the fixed field of the fixed field resource group does not match the fixed field of the packet to be matched, no subsequent matching operation is performed, and the packet to be matched is directly discarded. Discarding packets to be matched helps limit network traffic and improve network performance.
  • Step S125 A variable field resource group is configured on the second loopback port of the first network device. If the third matching result indicates that the second fixed field is matched, the variable field resource group is configured on the second loopback port according to the variable field resource group. The variable fields in the group are matched with the variable fields of the packet to be matched, and the first matching result is obtained.
  • a fixed field resource group is configured on the second loopback port of the first network device.
  • the third matching result indicates that the second fixed field is matched, it means that the fixed field of the fixed field resource group matches the The second fixed field of the packet to be matched, and the second fixed field of the packet to be matched is allowed to pass, and the packet to be matched is redirected to the second loopback port, and the variable field resources are used on the second loopback port according to the The variable fields in the group are matched with the variable fields of the packet to be matched, and the first matching result is obtained.
  • the second loopback port is a special interface. It is not a physical interface, but an invisible logical interface.
  • the second loopback port matches the data part. If the data part is a variable field, the variable field in the variable field resource group of the second loopback port is used to match the data part. . If the important fields to be matched are within the data part, there is no need to match the packets to be matched, and subsequent execution actions are performed based on the matching results; if the important fields to be matched are not within the data part, then the packets to be matched are re-matched. Locate the next loopback port, and the processing steps are similar to the packet matching on the first loopback port. Match the remaining data parts, which will not be described here. Through multi-level matching, it is possible to avoid using excessively long ACL matching lengths for matching, thereby saving overall ACL resource usage.
  • Step S130 Determine the matching action for the packet to be matched based on the first matching result.
  • the matching action for the packet to be matched is determined based on the first matching result, including but not limited to the following steps:
  • Step S131 If the first matching result indicates that the variable field is matched, upload the message to be matched to the central processing unit or forward the message to be matched.
  • the first matching result obtained in step S120 if the first matching result indicates that the variable field is matched, it means that the fixed field resource group and the variable field resource group match all the messages to be matched. field, and the packet to be matched is allowed to pass, the packet to be matched is uploaded to the central processing unit or the packet to be matched is forwarded.
  • the central processing unit queries the forwarding table and forwards the packets to be matched; when forwarding packets to be matched, the packets are forwarded directly according to the destination address of the packets to be matched.
  • Step S132 If the first matching result indicates that the variable field is not matched, the matching ends and the message to be matched is discarded.
  • the first matching result obtained in step S120 if the first matching result indicates that the variable field is not matched, it means that the variable field resource group matches the variable field of the message to be matched and is rejected. If the message to be matched is passed, or the variable field resource group does not match the variable field of the message to be matched, no subsequent matching operation is performed, and the message to be matched is directly discarded. Discarding packets to be matched helps limit network traffic and improve network performance.
  • a variable field resource group is configured on the first loopback port of the first network device, and in the second matching structure If the indication matches the first fixed field, the variable fields of the packet to be matched are matched on the first loopback port according to the variable fields in the variable field resource group to obtain a third matching result.
  • the packets to be matched can be filtered again. Through hierarchical filtering, the use of ACL matching resources is changed from product consumption to additive consumption, reducing resource usage.
  • the third matching result is the result of matching the variable field.
  • Figure 11 shows a schematic diagram of loopback port matching provided by an embodiment of the present application.
  • the first network device is provided with a receiving port, loopback port 1 and loopback port 2.
  • the important matching fields are in the message data.
  • the packet to be matched is first obtained through the receiving port of the first network device, and the physical address and VLAN of the packet to be matched are matched based on the fixed field resource group on the receiving port to obtain the first matching result. If it indicates that there is no match, the packet to be matched is discarded; if the first matching result indicates that it is matched, the packet to be matched is redirected to loopback port 1 of the first network device.
  • On loopback port 1 Perform IP address matching based on the variable field resource group to obtain the second matching result; if the second matching result indicates that there is no match, discard the packet to be matched; if the second matching result indicates that there is a match, Redirect the packet to be matched to the loopback port 2 of the first network device, perform packet data matching on the loopback port 2 according to the variable field resource group, and obtain the third matching result; the third matching result indicates that there is no match. If the third matching result indicates matching, and the important field is matched, the first network device sends the matching message to the central processing unit. Matching different ACL entries through multiple loopback ports, using preset ACL matching rules for different ports to match ACL entries takes up less ACL resources, reducing resource usage.
  • the source physical address of the packets that need to be filtered is: 00:11:22:33:44:55
  • the destination physical address is: 00:55:44:33:22:11
  • the label is: 12345
  • the packet payload that needs to be matched is a field of 0xEFEFEF after the IP header. If this packet is matched, the packet will be sent to the central processing unit.
  • the matching method is as follows: first, the receiving port of the first network device receives the packet to be matched, and is configured with a fixed field resource group, and filters and matches the source physical address: 00:11:22:33:44:55, and the destination physical address: 00 :55:44:33:22:11, the packet with the label: 12345 is redirected to loopback port 1, and all packets with source and destination physical addresses and tunnel labels that meet the requirements enter loopback port 1; then loopback Set a variable field resource group on port 1, filter the packets matching destination IP address: 10.10.10.1, source IP address: 20.20.20.1 to loopback port 2, and send all packets matching destination IP address: 10.10.10.1, source IP address: The packet of 20.20.20.1 enters loopback port 2.
  • variable field resource group is set on loopback port 2.
  • the last 4 bytes of the matching IP header are filtered to 0xEFEFEFEF.
  • the execution action is to send all packets to the central processing unit. .
  • the packets can be correctly matched and sent to the central processing unit, and the ACL configuration length in each round does not exceed 32 bytes.
  • the resources used for matching in the embodiment of this application are 32*(N+1), while the traditional method uses 64*N ACL resources. Therefore, this packet matching method can effectively Reduce resource usage.
  • the important field for filtering and matching is the last 4 bytes of the message data part of the IP header.
  • the message data part may also include M ACL entries. If the matching data is located near the message data part, last position, or the IP header includes N ACL entries, you need to set up more loopback ports on the first network device and complete multiple ACL filters to expand the ACL's matching of over-long packets so that the packets In theory, matching can be not limited to the length of the ACL and can also reduce resource usage.
  • Figure 5 shows a schematic flow chart of a message matching method provided by another embodiment of the present application.
  • the message matching method provided by this embodiment of the present application is applied to a first network device, where the first network device can be A switch, which can also be a router, has a receive port and a loopback port on the first network device.
  • the message matching method includes but is not limited to step S210, step S220, step S230 and step S240.
  • Step S210 Receive the message to be matched, match the first fixed field of the message to be matched according to the fixed field in the fixed field resource group of the first network device, and obtain the first matching result.
  • a message to be matched is received, and then the first fixed field of the message to be matched is matched using a fixed field in a fixed field resource group of the first network device to obtain the first matching result.
  • the first fixed field of each packet to be matched one matching entry of the fixed field resource group is used for matching instead of using multiple matching entries.
  • Configuration entries are matched, saving the use of ACL matching resources.
  • the first fixed field is the header field of the message encapsulated in the outermost layer of the message to be matched, or the field that is first matched in the message matching process; the first matching result is the field to be matched on the first network device side. The matching result of the first fixed field of the message.
  • the first matching result indicates that the first fixed field is not matched, it means that the fixed field of the fixed field resource group matches the fixed field of the message to be matched and is rejected. If the packet to be matched is passed, or the fixed field of the fixed field resource group does not match the fixed field of the packet to be matched, no subsequent matching operation is performed, and the packet to be matched is directly discarded. Discarding packets to be matched helps limit network traffic and improve network performance.
  • Step S220 If the first matching result indicates that the first fixed field is matched, send the to-be-matched message to the second network device so that it can be treated according to the variable field in the variable field resource group of the second network device. Match the variable fields of the matching message to obtain the second matching result.
  • the first matching result obtained in step S210 when the first matching result indicates that the first fixed field is matched, it means that the fixed field of the fixed field resource group matches the first fixed field of the message to be matched. field, and allow the first fixed field of the message to be matched to pass, and send the message to be matched to the second network device, so that the message to be matched is treated according to the variable field in the variable field resource group of the second network device. Match the variable fields to get the second matching result. Send the packet to be matched to the second network device, and allocate the consumption of ACL matching resources to multiple devices to avoid insufficient ACL matching resources on one device.
  • the second matching result is a result obtained on the second network device.
  • Step S230 Receive the second matching result returned by the second network device.
  • multiple matching filters are implemented, thereby avoiding the use of a longer ACL for matching, thereby reducing the use of ACL resources.
  • Step S240 Determine the matching action for the packet to be matched according to the second matching result.
  • the matching action for the packet to be matched is determined based on the second matching result, including:
  • Step S241 If the second matching result indicates that the variable field is matched, upload the message to be matched to the central processing unit or forward the message to be matched.
  • the second matching result obtained in step S230 if the second matching result indicates that the variable field is matched, it means that the fixed field resource group and the variable field resource group match all the messages to be matched. field, and the packet to be matched is allowed to pass, the packet to be matched is uploaded to the central processing unit or the packet to be matched is forwarded.
  • the central processing unit queries the forwarding table and forwards the packets to be matched; when forwarding packets to be matched, the packets are forwarded directly according to the destination address of the packets to be matched.
  • Step S242 If the second matching result indicates that the variable field is not matched, the matching ends and the message to be matched is discarded.
  • the second matching result obtained in step S230 if the second matching result indicates that the variable field is not matched, it means that the variable field of the variable field resource group matches the possible field of the message to be matched. If the variable field is changed and the packet to be matched is rejected, or the variable field resource group does not match the variable field of the packet to be matched, no subsequent matching operation is performed, and the packet to be matched is directly discarded. Discarding packets to be matched helps limit network traffic and improve network performance.
  • Figure 7 shows a schematic flow chart of a message matching method provided by another embodiment of the present application.
  • the message matching method provided by this embodiment of the present application is applied to a first network device, where the first network device can be A switch, which can also be a router, has a receive port and a loopback port on the first network device.
  • the message matching method includes but is not limited to step S310, step S320, step S330 and step S340.
  • Step S310 Receive the message to be matched and send the message to be matched to the second network device, so that the second fixed field of the message to be matched is matched according to the fixed field in the fixed field resource group of the second network device to obtain The first matching result.
  • the first fixed field of the message to be matched can be matched through the fixed field of the fixed field resource group of the first network device, and the fixed field of the fixed field resource group of the message to be matched can be matched. If the first fixed field of the message matches, the message to be matched is sent to the second network device, so that the second fixed field of the message to be matched is processed according to the fixed field in the fixed field resource group of the second network device. Match and get the first matching result. It is also possible that the first network device does not process and directly sends the packet to be matched to the second network device for matching. Multiple second network devices are set up, and a fixed field resource group is configured on one second network device.
  • the fixed field matches the first fixed field of the packet to be matched, and then redirects the packet to be matched to another second network device, so that the packet to be matched is matched according to the fixed field in the fixed field resource group of the second network device.
  • Match the second fixed field of the text to obtain the first matching result.
  • the second fixed field is a fixed field other than the first fixed field, which can be a message header field encapsulated in the outer layer of the message to be matched, or a field that is matched first and then matched in the message matching process.
  • the first matching result is the result obtained on the second network device; there can be multiple second network devices, and the message to be matched can be forwarded on multiple second network devices for matching.
  • Step S320 Receive the first matching result returned by the second network device.
  • multiple matching filters are implemented, thereby avoiding the use of a longer ACL for matching, thereby reducing the use of ACL resources.
  • the first matching result indicates that the second fixed field is not matched, it means that the fixed field of the fixed field resource group matches the fixed field of the message to be matched and is rejected. If the packet to be matched is passed, or the fixed field of the fixed field resource group does not match the fixed field of the packet to be matched, no subsequent matching operation is performed, and the packet to be matched is directly discarded. Discarding packets to be matched helps limit network traffic and improve network performance.
  • Step S330 When the first matching result indicates that the second fixed field is matched, match the variable field of the message to be matched according to the variable field in the variable field resource group of the first network device to obtain the second match. result.
  • the variable fields in the variable field resource group of the first network device are used to match the variable fields of the to-be-matched message to obtain the second fixed field.
  • Two matching results Multi-level filtering of the packets to be matched through fixed field resource groups and variable field resource groups can reduce the matching length and matching entries, thereby reducing the use of overall ACL matching resources and avoiding the use of too long matching lengths that cause ACL Insufficient matching resources.
  • the second matching result is a result obtained by matching all fields of the packet to be matched on the first network device side.
  • Step S340 Determine the matching action for the packet to be matched according to the second matching result.
  • the matching action for the packet to be matched is determined based on the second matching result, including:
  • Step S341 If the second matching result indicates that the variable field is matched, upload the message to be matched to the central processing unit or forward the message to be matched.
  • the second matching result obtained in step S330 if the second matching result indicates that the variable field is matched, it means that the fixed field resource group and the variable field resource group match all the messages to be matched. field, and the packet to be matched is allowed to pass, the packet to be matched is uploaded to the central processing unit or the packet to be matched is forwarded.
  • the central processing unit queries the forwarding table and forwards the packets to be matched; when forwarding packets to be matched, the packets are forwarded directly according to the destination address of the packets to be matched.
  • Step S342 If the second matching result indicates that the variable field is not matched, the matching ends and the message to be matched is discarded.
  • the second matching result obtained in step S330 if the second matching result indicates that the variable field is not matched, it means that the variable field of the variable field resource group matches the possible field of the message to be matched. If the variable field is changed and the packet to be matched is rejected, or the variable field of the variable field resource group does not match the variable field of the packet to be matched, subsequent matching operations will not be performed and the packet to be matched will be discarded directly. Discarding packets to be matched helps limit network traffic and improve network performance.
  • Figure 9 shows a schematic flow chart of a message matching method provided by another embodiment of the present application.
  • the message matching method provided by this embodiment of the present application is applied to a second network device, where the second network device can be
  • the switch may also be a router, and the second network device may be multiple.
  • the message matching method includes but is not limited to step S410 and step S420.
  • Step S410 Receive the message to be matched sent by the first network device.
  • receiving a message to be matched sent by the first network device indicates that the message to be matched has passed the matching on the first network device side, which may be passing the matching of the fixed fields of the message to be matched, or it may be Passed the message to be matched
  • the matching of the variable fields facilitates subsequent matching of the packet to be matched by the second network device to determine whether to forward the packet to be matched.
  • Step S420 Match the variable fields of the packet to be matched according to the variable fields in the variable field resource group of the second network device to obtain a second matching result, and return the second matching result to the first network device to The first network device is caused to determine a matching action for the packet to be matched according to the second matching result.
  • variable field in the variable field resource group of the second network device is used to match the variable field of the received message to be matched, to obtain the second matching result, and return the second matching result to The first network device is so that the first network device determines a matching action for the packet to be matched according to the second matching result.
  • Figure 10 shows a schematic flow chart of a message matching method provided by another embodiment of the present application.
  • the message matching method provided by this embodiment of the present application is applied to a second network device, where the second network device can be
  • the switch may also be a router, and the second network device may be multiple units.
  • the message matching method includes but is not limited to step S510 and step S520.
  • Step S510 Receive the message to be matched sent by the first network device.
  • receiving a message to be matched sent by the first network device indicates that the message to be matched has passed the matching on the first network device side, and may have passed the matching of the first fixed field of the message to be matched, or has not been matched.
  • the matching is performed and the packet to be matched is directly sent to the second network device, which facilitates subsequent matching of the packet to be matched by the second network device to determine whether to forward the packet to be matched.
  • Step S520 Match the second fixed field of the message to be matched according to the fixed field in the fixed field resource group of the second network device, obtain the first matching result, and return the first matching result to the first network device, so that The first network device matches the variable field of the message to be matched according to the variable field in the variable field resource group of the first network device, obtains the second matching result, and determines the matching action of the message to be matched according to the second matching result.
  • the fixed field in the fixed field resource group on the first network device side matches the first fixed field of the message to be matched and allows the message to be matched to be passed to utilize the fixed field resource group of the second network device.
  • the fixed field in matches the second fixed field of the received message to be matched, obtains the first matching result, and returns the second matching result to the first network device, so that the first network device determines based on the second matching result Matching action for matching packets.
  • a second network device uses a fixed field in a fixed field resource group of another second network device to match the second fixed field of the received message to be matched, obtains the first matching result, and sends the second matching result Returned to the first network device, so that the first network device determines a matching action for the packet to be matched based on the second matching result.
  • the second matching result is the matching result of the fixed field on the second network device side.
  • Figure 12 shows a second network device matching schematic diagram provided by an embodiment of the present application.
  • the important matching fields are in the message data part.
  • the message to be matched is first obtained through the first network device, and the physical address of the message to be matched is determined based on the fixed field of the fixed field resource group. Match with the VLAN to obtain the first matching result. If the first matching result indicates that there is no match, discard the packet to be matched; if the first matching result indicates that there is a match, redirect the packet to be matched.
  • the second network device perform IP address matching based on the fixed field of the fixed field resource group on the second network device, and obtain the second matching result; if the second matching result indicates that there is no match, discard the packet to be matched. ;
  • the second matching result indicates a match, redirect the message to be matched to the first network device, and the first network device matches the message data according to the variable field of the variable field resource group to obtain the third match Result; if the third matching result indicates that there is no match, the packet to be matched will be discarded; if the third matching result indicates that there is a match, that is, an important field is matched, the first network device will upload the packet to be matched. sent to the central processing unit.
  • Matching of different ACL entries is performed through multiple network devices. Matching ACL entries with preset ACL matching rules on different ports takes up less ACL resources, reducing resource usage.
  • the source physical address of the packets that need to be filtered is: 00:11:22:33:44:55
  • the destination physical address is: 00:55:44:33:22:11
  • the packet payload that needs to be matched is a field of 0xEFEFEF after the IP header , if this message is matched, the message will be sent to the central processing unit.
  • the matching method is as follows: first, the receiving port of the first network device receives the packet to be matched, and is configured with a fixed field resource group, and filters and matches the source physical address: 00:11:22:33:44:55, and the destination physical address: 00 :55:44:33:22:11, the packet with the label: 12345 is redirected to port 2 connected to the second network device, and all packets with source and destination physical addresses and tunnel labels that meet the requirements are sent through port 2.
  • the packets can be correctly matched and sent to the central processing unit of the first network device, and the ACL configuration length in each round does not exceed 32 bytes. If there are N entries that need to be matched here, the resources used for matching in this embodiment of the present application are 32*(N+1), of which a 32-byte ACL matching resource is shared to the second network device.
  • the important field for filtering and matching is the last 4 bytes of the message data part of the IP header.
  • the message data part may also include M ACL entries. If the matching data is located near the message data part, In the latter position, it is necessary to complete multiple ACL filters through multiple network devices, which can expand the ACL's matching of over-long packets, so that the matching of packets can theoretically not be limited by the length of the ACL.
  • loopback port matching and the second network device matching shown in Figures 11 and 12 do not constitute a limitation on the embodiments of the present application, and may include more or fewer modules than shown in the figures. , or combining certain components, or different component arrangements.
  • Figure 13 shows a computer device 900 provided by an embodiment of the present application.
  • the computer device 900 may be a server or a terminal.
  • the internal structure of the computer device 900 includes but is not limited to:
  • Memory 910 used to store programs
  • the processor 920 is configured to execute the program stored in the memory 910.
  • the processor 920 executes the program stored in the memory 910, the processor 920 is configured to execute the above message matching method.
  • the processor 920 and the memory 910 may be connected through a bus or other means.
  • the memory 910 can be used to store non-transitory software programs and non-transitory computer executable programs, such as the message matching method described in any embodiment of this application.
  • the processor 920 implements the above message matching method by running non-transient software programs and instructions stored in the memory 910 .
  • the memory 910 may include a program storage area and a data storage area, where the program storage area may store an operating system and an application program required for at least one function; the storage data area may store the above message matching method.
  • memory 910 may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage device.
  • the memory 910 may include memory located remotely relative to the processor 920, and these remote memories may be connected to the processor 920 through a network. Examples of the above-mentioned networks include but are not limited to the Internet, intranets, local area networks, mobile communication networks and combinations thereof.
  • the non-transitory software programs and instructions required to implement the above message matching method are stored in the memory 910.
  • the message matching method provided by any embodiment of the present application is executed.
  • Embodiments of the present application also provide a computer-readable storage medium that stores computer-executable instructions, and the computer-executable instructions are used to execute the above message matching method.
  • the storage medium stores computer-executable instructions, which are executed by one or more Execution by one control processor 920, for example, by one processor 920 in the above-mentioned computer device 900, can cause the above-mentioned one or more processors 920 to execute the message matching method provided by any embodiment of the present application.
  • Embodiments of the present application include: dividing the access control list ACL matching resources of the first network device into a fixed field resource group and a variable field resource group.
  • the fixed field resource group includes a set of fixed fields, and the variable field The resource group includes a set of variable fields.
  • the embodiment of the present application performs hierarchical filtering on messages by dividing ACL matching resources. Can save the use of overall ACL resources.
  • Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disk (DVD) or other optical disk storage, magnetic cassettes, tapes, disk storage or other magnetic storage devices, or may Any other medium used to store the desired information and that can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as or other transport mechanisms and may include any information delivery media.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种报文匹配方法、计算机设备和计算机可读存储介质，涉及网络通信领域，该报文匹配方法包括：将第一网络设备的访问控制列表ACL匹配资源划分为固定字段资源组和可变字段资源组，固定字段资源组包括固定字段的集合，可变字段资源组包括可变字段的集合（S110）；接收待匹配报文，根据固定字段资源组中的固定字段和可变字段资源组中的可变字段对待匹配报文进行匹配，得到第一匹配结果（S120）；根据第一匹配结果确定对待匹配报文的匹配动作（S130）。

Description

报文匹配方法、计算机设备和计算机可读存储介质
相关申请的交叉引用
本申请基于申请号为202211048413.8、申请日为2022年08月30日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及网络通信技术领域，特别涉及一种报文匹配方法、计算机设备和计算机可读存储介质。
背景技术
网络设备的访问控制列表(Access Control List，ACL)资源是有限的，其资源一般是按照长度和条目进行限制的，比如匹配128字节时，资源如果是8K，那么匹配256字节时，资源数量就会变成4K，匹配512字节时，资源数量就会变成2K。随着隧道业务的发展，经常需要对网络上的隧道封装的报文进行匹配，由于隧道头的长度已经消耗了比较多的报文长度，因此，对于ACL资源长度要求在不断的变长。
一般情况下，将多个报文中的相同或者重复字段称为固定字段，将多个报文中的不相同或者变化字段称为可变字段。相关技术中，如果需要对一个隧道封装的报文内部的某个位置进行流量匹配。就必须使用一个与其长度相当的ACL资源进行处理，例如隧道头部已经用去了128字节，则再往内部匹配就必须使用256字节资源的ACL，而往往需要匹配的字段可能不在隧道头部，而数据流的整个隧道头部信息都是一样的，将一样的隧道头部信息称为固定字段，每次匹配隧道报文的固定字段需要耗费大量资源，上述匹配对ACL整体资源的消耗是非常巨大的。
发明内容
本申请提供一种报文匹配方法、计算机设备和计算机可读存储介质。
本申请实施例的技术方案如下：
第一方面，本申请提供了一种报文匹配方法，应用于第一网络设备，所述方法包括：将所述第一网络设备的访问控制列表ACL匹配资源划分为固定字段资源组和可变字段资源组，所述固定字段资源组包括固定字段的集合，所述可变字段资源组包括可变字段的集合；接收待匹配报文，根据所述固定字段资源组中的固定字段和所述可变字段资源组中的可变字段对所述待匹配报文进行匹配，得到第一匹配结果；根据所述第一匹配结果确定对所述待匹配报文的匹配动作。
第二方面，本申请提供了一种报文匹配方法，应用于第一网络设备，所述方法包括：接收待匹配报文，根据所述第一网络设备的固定字段资源组中的固定字段对所述待匹配报文的第一固定字段进行匹配，得到第一匹配结果；在所述第一匹配结果指示匹配到所述第一固定字段的情况下，将所述待匹配报文发送给第二网络设备，以使根据所述第二网络设备的可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到第二匹配结果；接收所述第二网络设备返回的所述第二匹配结果；根据所述第二匹配结果确定对所述待匹配报文的匹配动作。
第三方面，本申请提供了一种报文匹配方法，应用于第一网络设备，所述方法包括：接收待匹配报文，将所述待匹配报文发送给第二网络设备，以使根据所述第二网络设备的固定字段资源组中的固定字段对所述待匹配报文的第二固定字段进行匹配，得到第一匹配结果；
接收所述第二网络设备返回的所述第一匹配结果；在所述第一匹配结果指示匹配到所述 第二固定字段的情况下，根据所述第一网络设备的可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到第二匹配结果；根据所述第二匹配结果确定对所述待匹配报文的匹配动作。
第四方面，本申请提供了一种报文匹配方法，应用于第二网络设备，所述方法包括：接收第一网络设备发送的待匹配报文；根据所述第二网络设备的可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到第二匹配结果，并将所述第二匹配结果返回给所述第一网络设备，以使所述第一网络设备根据所述第二匹配结果确定对所述待匹配报文的匹配动作。
第五方面，本申请提供了一种报文匹配方法，应用于第二网络设备，所述方法包括：接收第一网络设备发送的待匹配报文；根据所述第二网络设备的固定字段资源组中的固定字段对所述待匹配报文的第二固定字段进行匹配，得到第一匹配结果，并将所述第一匹配结果返回给所述第一网络设备，以使所述第一网络设备根据所述第一网络设备的可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到第二匹配结果，根据所述第二匹配结果确定对所述待匹配报文的匹配动作。
第六方面，本申请提供了一种计算机设备，所述计算机设备包括存储器和处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被一个或多个所述处理器执行时，使得一个或多个所述处理器执行如上第一方面、第二方面、第三方面、第四方面和第五方面描述的任一项所述方法的步骤。
第七方面，本申请还提供了一种计算机可读存储介质，所述存储介质可被处理器读写，所述存储介质存储有计算机指令，所述计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行如上第一方面、第二方面、第三方面、第四方面和第五方面描述的任一项所述方法的步骤。
附图说明
图1是本申请的一个实施例提供的报文匹配方法的流程示意图；
图2是图1中步骤S120的一个子步骤流程示意图；
图3是本申请的另一个实施例提供的报文匹配方法的流程示意图；
图4是图1中步骤S130的一个子步骤流程示意图；
图5是本申请的另一个实施例提供的报文匹配方法的流程示意图；
图6是图5中步骤S240的一个子步骤流程示意图；
图7是本申请的另一个实施例提供的报文匹配方法的流程示意图；
图8是图7中步骤S340的一个子步骤流程示意图；
图9是本申请的另一个实施例提供的报文匹配方法的流程示意图；
图10是本申请的另一个实施例提供的报文匹配方法的流程示意图；
图11是本申请的一个实施例提供的环回端口匹配示意图；
图12是本申请的一个实施例提供的第二网络设备匹配示意图；
图13是本申请实施例提供的计算机设备的结构示意图；
图14是在一些情形下的报文匹配方法的示意图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的实施例仅仅用以解释本申请，并不用于限定本申请。
需要说明的是，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于流程图中的顺序执行所示出或描述的步骤。说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
相关技术中，如图14所示，报文包括物理地址MAC、虚拟局域网(Virtual Local Area Network，VLAN)标签、IP地址、以及报文数据DATA，在报文数据中可能还包括N个ACL条目，该报文的报文长度较长，在进行隧道业务的ACL资源匹配时，采用与报文等长的ACL资源对该报文进行对应的条目进行一一匹配，ACL的长度占用的资源较多，能够使用的资源就相对较少，完成报文匹配需要占用更多的ACL资源。
基于此，本申请实施例提供了一种报文匹配方法、计算机设备和计算机可读存储介质，本申请实施例包括将第一网络设备的访问控制列表ACL匹配资源划分为固定字段资源组和可变字段资源组，固定字段资源组包括固定字段的集合，可变字段资源组包括可变字段的集合，通过对ACL匹配资源进行划分，有利于对待匹配的报文进行多次筛选，减少资源使用；接收待匹配报文，根据固定字段资源组中的固定字段和可变字段资源组中的可变字段对待匹配报文进行匹配，得到第一匹配结果，由于集合中不包括重复元素，利用固定字段资源组对待匹配报文进行匹配，能够减少资源的使用，进而能够节省整体的ACL资源使用。根据第一匹配结果确定对待匹配报文的匹配动作。与在一些情形下使用与待匹配报文长度相当的ACL资源对固定字段的报文进行处理，消耗大量资源相比，本申请实施例通过将ACL匹配资源进行划分，对报文进行层级筛选，能够节省整体ACL资源的使用。
在一实施例中，该报文匹配方法主要应用于交换机或者路由器在ACL资源不足，或者需要进行超长的报文字段位置匹配的场景中，丰富了ACL的使用方法，并且节省了ACL的资源。该报文匹配方法对短报文的匹配也同样适用，这里不作赘述。
下面结合附图，对本申请实施例作进一步阐述。
参见图1，图1示出了本申请一个实施例提供的报文匹配方法的流程示意图，本申请实施例提供的报文匹配方法应用于第一网络设备，其中，第一网络设备可以为交换机，也可以为路由器，第一网络设备上具有接收端口和环回端口。该报文匹配方法包括但不限于有步骤S110、步骤S120和步骤S130。
步骤S110，将第一网络设备的访问控制列表ACL匹配资源划分为固定字段资源组和可变字段资源组，固定字段资源组包括固定字段的集合，可变字段资源组包括可变字段的集合。
在一实施例中，将第一网络设备的访问控制列表ACL匹配资源划分为固定字段资源组和可变字段资源组，固定字段资源组包括固定字段的集合，固定字段的集合为符合预设的ACL匹配规则的报文对应的固定字段构成的集合，ACL匹配规则包含了匹配长度和匹配条目，该匹配长度可以为32字节，也可以为64字节，能够根据报文长度进行设定，这里不作赘述；由于固定字段为多个报文中的相同或者重复字段，集合中的元素都是不同的，固定字段对应的匹配条目只有一条，有利于后续使用这一条匹配条目对待匹配报文的固定字段进行匹配，从而减少对ACL匹配资源的使用。可变字段资源组包括符合预设的ACL匹配规则的报文对应的可变字段的集合，可变字段的集合为符合预设的ACL匹配规则的报文对应的可变字段构成的集合，预设的ACL匹配规则包含了匹配长度和匹配条目，该匹配长度可以为32字节，也可以为64字节，能够根据报文长度进行设定，这里不作赘述；该匹配条目为报文的可变字段对应的多个匹配条目，即是说，匹配条目是对可变字段匹配情况的一一列举，实现对报文的不同字段的匹配。将ACL匹配资源划分为固定字段资源组和可变字段资源组，能够实现报文的层级筛选，将对ACL匹配资源的使用从乘积消耗转变为加法消耗，减少资源的使用。
步骤S120，接收待匹配报文，根据固定字段资源组中的固定字段和可变字段资源组中的可变字段对待匹配报文进行匹配，得到第一匹配结果。
如图2所示，根据固定字段资源组中的固定字段和可变字段资源组中的可变字段对待匹配报文进行匹配，得到第一匹配结果，包括但不限于有以下步骤：
步骤S121，根据固定字段资源组中的固定字段对待匹配报文的第一固定字段进行匹配，得到第二匹配结果。
在一实施例中，通过固定字段资源组中的固定字段对待匹配报文的第一固定字段进行匹配，得到第二匹配结果。对于每一个待匹配报文的第一固定字段来说，均采用该固定字段资 源组的一条匹配条目进行匹配，而不是使用多条匹配条目进行匹配，节省了对ACL匹配资源的使用。其中，第一固定字段为封装在待匹配报文最外层的报文头部字段，或者为在报文匹配过程中最先匹配的字段；第二匹配结果为第一固定字段的匹配结果。
在一实施例中，根据得到的第二匹配结果，在第二匹配结果指示未匹配到第一固定字段的情况下，表示固定字段资源组的固定字段匹配到待匹配报文的固定字段并且拒绝通过该待匹配报文，或者固定字段资源组的固定字段没有匹配到待匹配报文的固定字段，不再进行后续匹配操作，直接丢弃该待匹配报文。丢弃待匹配报文有利于限制网络流量，提高网络性能。
步骤S122，在第二匹配结果指示匹配到第一固定字段的情况下，根据可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第一匹配结果。
在一实施例中，根据步骤S121得到的第二匹配结果，在第二匹配结果指示匹配到第一固定字段的情况下，表示固定字段资源组的固定字段匹配到待匹配报文的第一固定字段，并且允许该待匹配报文的第一固定字段通过，利用可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第一匹配结果。通过固定字段资源组和可变字段资源组对待匹配报文进行多级筛选，能够减少匹配长度和匹配条目，从而减少对整体ACL匹配资源的使用，避免了使用过长的匹配长度，而导致ACL匹配资源不足。其中，第一匹配结果为对待匹配报文的字段均进行匹配后得到的结果。
如图3所示，该报文匹配方法还包括但不限于有以下步骤：
步骤S123，第一网络设备的接收端口上配置有固定字段资源组，接收端口用于接收待匹配报文，并在接收端口上根据固定字段资源组中的固定字段对待匹配报文的第一固定字段进行匹配，得到第二匹配结果。
在一实施例中，通过接收端口接收待匹配报文，在接收端口上根据配置的固定字段资源组对待匹配报文的第一固定字段进行匹配，得到第二匹配结果。通过在接收端口上进行第一固定字段的匹配，而不是所有字段均进行匹配，能够减少匹配使用的匹配长度，从而使得有充足的ACL匹配资源使用。
在一实施例中，在接收端口上对隧道报文头部中的物理地址和标签头部进行匹配，标签头部位于报文中物理地址和IP地址之间，物理地址和标签头部均为固定字段，利用固定字段资源组中的固定字段进行物理地址和标签头部的匹配。若要匹配的重要字段在物理地址内，则无需再对待匹配报文进行匹配，根据匹配结果执行后续执行动作；若要匹配的重要字段没在物理地址内，则再进行后续步骤的匹配处理。
在一实施例中，根据得到的第二匹配结果，在第二匹配结果指示未匹配到第一固定字段的情况下，表示固定字段资源组的固定字段匹配到待匹配报文的固定字段并且拒绝通过该待匹配报文，或者固定字段资源组的固定字段没有匹配到待匹配报文的固定字段，不再进行后续匹配操作，直接丢弃该待匹配报文。丢弃待匹配报文有利于限制网络流量，提高网络性能。
步骤S124，第一网络设备的第一环回端口上配置有固定字段资源组，在第二匹配结果指示匹配到第一固定字段的情况下，在第一环回端口上根据固定字段资源组中的固定字段对待匹配报文的第二固定字段进行匹配，得到第三匹配结果，第二固定字段为除了第一固定字段以外的固定字段。
在一实施例中，第一网络设备的第一环回端口上配置有固定字段资源组，在第二匹配结果指示匹配到第一固定字段的情况下，表示固定字段资源组的固定字段匹配到待匹配报文的第一固定字段，并且允许该待匹配报文的第一固定字段通过，将待匹配报文重定向至第一环回端口，在第一环回端口上根据固定字段资源组中的固定字段对待匹配报文的第二固定字段进行匹配，得到第三匹配结果。通过在第一环回端口上进行第二固定字段的匹配，能够对待匹配报文再次进行筛选，通过层级筛选，将对ACL匹配资源的使用从乘积消耗转变为加法消耗，减少资源的使用。其中，第二固定字段为除了第一固定字段以外的固定字段可以为封装在待匹配报文次外层的报文头部字段，或者为在报文匹配过程中最先匹配之后匹配的字段；第三匹配结果为对第二固定字段进行匹配的结果；第一环回端口是一种特殊的接口，它不是 物理接口，而是一种看不见摸不着的逻辑接口，在第一网络设备上可以通过配置命令来创建一个或多个环回接口，并且可以和配置物理接口一样，配置环回接口的IP地址和掩码，环回接口的掩码一般为全1。
在一实施例中，在第一环回端口对隧道报文头部中的IP地址进行匹配，IP地址为固定字段的情况下，利用第一环回端口的固定字段资源组中的固定字段进行IP地址的匹配。若要匹配的重要字段在IP地址内，则无需再对待匹配报文进行匹配，根据匹配结果执行后续执行动作；若要匹配的重要字段没在IP地址内，则再将待匹配报文重定位至第二环回端口，处理步骤与第一环回端口的报文匹配类似，这里不作赘述。通过多级匹配，从而避免使用超长的ACL匹配长度进行匹配，进而能够节省整体的ACL资源使用。
在一实施例中，根据得到的第三匹配结果，在第三匹配结果指示未匹配到第二固定字段的情况下，表示固定字段资源组的固定字段匹配到待匹配报文的固定字段并且拒绝通过该待匹配报文，或者固定字段资源组的固定字段没有匹配到待匹配报文的固定字段，不再进行后续匹配操作，直接丢弃该待匹配报文。丢弃待匹配报文有利于限制网络流量，提高网络性能。
步骤S125，第一网络设备的第二环回端口上配置有可变字段资源组，在第三匹配结果指示匹配到第二固定字段的情况下，在第二环回端口上根据可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第一匹配结果。
在一实施例中，第一网络设备的第二环回端口上配置有固定字段资源组，在第三匹配结果指示匹配到第二固定字段的情况下，表示固定字段资源组的固定字段匹配到待匹配报文的第二固定字段，并且允许该待匹配报文的第二固定字段通过，将待匹配报文重定向至第二环回端口，在第二环回端口上根据可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第一匹配结果。通过上述层级筛选，不仅能够得到最终转发的报文，还能够将对ACL匹配资源的使用从乘积消耗转变为加法消耗，节省整体ACL匹配资源的使用。第二环回端口是一种特殊的接口，它不是物理接口，而是一种看不见摸不着的逻辑接口。
在一实施例中，在第二环回端口对数据部分进行匹配，数据部分为可变字段的情况下，利用第二环回端口的可变字段资源组中的可变字段进行数据部分的匹配。若要匹配的重要字段在数据部分内，则无需再对待匹配报文进行匹配，根据匹配结果执行后续执行动作；若要匹配的重要字段没在该数据部分内，则再将待匹配报文重定位至下一个环回端口，处理步骤与第一环回端口的报文匹配类似，进行剩余数据部分的匹配，这里不作赘述。通过多级匹配，从而避免使用超长的ACL匹配长度进行匹配，进而能够节省整体的ACL资源使用。
步骤S130，根据第一匹配结果确定对待匹配报文的匹配动作。
如图4所示，根据第一匹配结果确定对待匹配报文的匹配动作，包括但不限于有以下步骤：
步骤S131，在第一匹配结果指示匹配到可变字段的情况下，上传待匹配报文至中央处理单元或者转发待匹配报文。
在一实施例中，根据步骤S120得到的第一匹配结果，在第一匹配结果指示匹配到可变字段的情况下，表示固定字段资源组和可变字段资源组匹配到待匹配报文的所有字段，并且允许该待匹配报文通过，则上传待匹配报文至中央处理单元或者转发待匹配报文。当为上传待匹配报文至中央处理单元，通过中央处理单元查询转发表，进行待匹配报文转发；当为转发待匹配报文，直接根据待匹配报文的目的地址进行报文转发。
步骤S132，在第一匹配结果指示未匹配到可变字段的情况下，结束匹配，丢弃待匹配报文。
在一实施例中，根据步骤S120得到的第一匹配结果，在第一匹配结果指示未匹配到可变字段的情况下，表示可变字段资源组匹配到待匹配报文的可变字段并且拒绝通过该待匹配报文，或者可变字段资源组没有匹配到待匹配报文的可变字段，不再进行后续匹配操作，直接丢弃该待匹配报文。丢弃待匹配报文有利于限制网络流量，提高网络性能。
在一实施例中，第一网络设备的第一环回端口上配置有可变字段资源组，在第二匹配结 果指示匹配到第一固定字段的情况下，在第一环回端口上根据可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第三匹配结果。通过在第一环回端口上进行可变字段的匹配，能够对待匹配报文再次进行筛选，通过层级筛选，将对ACL匹配资源的使用从乘积消耗转变为加法消耗，减少资源的使用。其中，第三匹配结果为对可变字段匹配的结果。
参见图11，图11示出了本申请一个实施例提供的环回端口匹配示意图，第一网络设备上设置有接收端口、环回端口1和环回端口2，匹配的重要字段在报文数据部分，先通过第一网络设备的接收端口获取待匹配报文，并在接收端口上根据固定字段资源组对待匹配报文进行物理地址和VLAN进行匹配，得到第一匹配结果，在第一匹配结果指示没有匹配到的情况下，将待匹配报文丢弃；在第一匹配结果指示匹配到的情况下，将待匹配报文重定向至第一网络设备的环回端口1，在环回端口1上根据可变字段资源组进行IP地址匹配，得到第二匹配结果；在第二匹配结果指示没有匹配到的情况下，将待匹配报文丢弃；在第二匹配结果指示匹配到的情况下，将待匹配报文重定向至第一网络设备的环回端口2，在环回端口2上根据可变字段资源组进行报文数据匹配，得到第三匹配结果；在第三匹配结果指示没有匹配到的情况下，将待匹配报文丢弃；在第三匹配结果指示匹配到的情况下，并且匹配到重要字段，第一网络设备将待匹配报文上送至中央处理单元。通过多个环回端口进行匹配不同ACL条目的匹配，利用不同端口预设的ACL匹配规则匹配ACL条目占用的ACL资源较少，减少了资源占用。
在一实施例中，需要筛选的报文的源物理地址为：00:11:22:33:44:55，目的物理地址为：00:55:44:33:22:11，标签为：12345，目的IP地址：10.10.10.1，源IP地址：20.20.20.1，需要匹配的报文载荷为IP头部后面的一个为0xEFEFEFEF的字段，若匹配到此报文则将此报文上送中央处理单元。匹配方式如下：首先第一网络设备的接收端口收到待匹配报文，并配置有固定字段资源组，筛选匹配源物理地址：00:11:22:33:44:55，目的物理地址：00:55:44:33:22:11，标签为：12345的报文，重定向到环回端口1，将所有源目的物理地址和隧道标签符合要求的报文进入环回端口1；然后环回端口1上设置可变字段资源组，筛选匹配目的IP地址：10.10.10.1，源IP地址：20.20.20.1的报文到环回端口2，所有符合目的IP地址：10.10.10.1，源IP地址：20.20.20.1的报文进入环回端口2，最后环回端口2上设置可变字段资源组，筛选匹配IP头部的后4个字节为0xEFEFEFEF，执行动作为所有报文上送中央处理单元。通过三轮筛选，即可将报文正确匹配出来上送至中央处理单元，且每一轮ACL的配置长度均未超过32字节。然而，如果用普通的ACL匹配方式，要匹配到此位置的报文则要使用一个64字节长度的ACL才可以。如果此处需要匹配的条目有N条，本申请实施例匹配使用的资源为32*(N+1)，而传统方法要使用64*N的ACL资源，因此，该报文匹配方法能够有效地减少资源的使用。
在一实施例中，筛选匹配的重要字段为IP头部的后4个字节的报文数据部分，报文数据部分还可以包括M个ACL条目，若匹配的数据处于报文数据部分的靠后位置，或者IP头部包括N个ACL条目，则需在第一网络设备上设置较多的环回端口，完成多次ACL筛选，能够扩展ACL对超长报文的匹配，使得对报文的匹配理论上可以不受限于ACL的长度，还能够减少资源的使用。
参见图5，图5示出了本申请另一个实施例提供的报文匹配方法的流程示意图，本申请实施例提供的报文匹配方法应用于第一网络设备，其中，第一网络设备可以为交换机，也可以为路由器，第一网络设备上具有接收端口和环回端口。该报文匹配方法包括但不限于有步骤S210、步骤S220、步骤S230和步骤S240。
步骤S210，接收待匹配报文，根据第一网络设备的固定字段资源组中的固定字段对待匹配报文的第一固定字段进行匹配，得到第一匹配结果。
在一实施例中，接收到待匹配报文，然后通过第一网络设备的固定字段资源组中的固定字段对待匹配报文的第一固定字段进行匹配，得到第一匹配结果。对于每一个待匹配报文的第一固定字段来说，均采用该固定字段资源组的一条匹配条目进行匹配，而不是使用多条匹 配条目进行匹配，节省了对ACL匹配资源的使用。其中，第一固定字段为封装在待匹配报文最外层的报文头部字段，或者为在报文匹配过程中最先匹配的字段；第一匹配结果为在第一网络设备侧对待匹配报文的第一固定字段的匹配结果。
在一实施例中，根据得到的第一匹配结果，在第一匹配结果指示未匹配到第一固定字段的情况下，表示固定字段资源组的固定字段匹配到待匹配报文的固定字段并且拒绝通过该待匹配报文，或者固定字段资源组的固定字段没有匹配到待匹配报文的固定字段，不再进行后续匹配操作，直接丢弃该待匹配报文。丢弃待匹配报文有利于限制网络流量，提高网络性能。
步骤S220，在第一匹配结果指示匹配到第一固定字段的情况下，将待匹配报文发送给第二网络设备，以使根据第二网络设备的可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第二匹配结果。
在一实施例中，根据步骤S210得到的第一匹配结果，在第一匹配结果指示匹配到第一固定字段的情况下，表示固定字段资源组的固定字段匹配到待匹配报文的第一固定字段，并且允许该待匹配报文的第一固定字段通过，将待匹配报文发送给第二网络设备，以使根据第二网络设备的可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第二匹配结果。将待匹配报文发送给第二网络设备，通过将ACL匹配资源的消耗分配到多台设备上，避免一台设备上ACL匹配资源不足的情况。其中，第二匹配结果为在第二网络设备上得到的结果。
步骤S230，接收第二网络设备返回的第二匹配结果。
在一实施例中，接收到第二网络设备发送的第二匹配结果，实现了多次匹配筛选，从而避免了使用较长的ACL进行匹配，从而能够减少ACL资源的使用。
步骤S240，根据第二匹配结果确定对待匹配报文的匹配动作。
如图6所示，根据第二匹配结果确定对待匹配报文的匹配动作，包括：
步骤S241，在第二匹配结果指示匹配到可变字段的情况下，上传待匹配报文至中央处理单元或者转发待匹配报文。
在一实施例中，根据步骤S230得到的第二匹配结果，在第二匹配结果指示匹配到可变字段的情况下，表示固定字段资源组和可变字段资源组匹配到待匹配报文的所有字段，并且允许该待匹配报文通过，则上传待匹配报文至中央处理单元或者转发待匹配报文。当为上传待匹配报文至中央处理单元，通过中央处理单元查询转发表，进行待匹配报文转发；当为转发待匹配报文，直接根据待匹配报文的目的地址进行报文转发。
步骤S242，在第二匹配结果指示未匹配到可变字段的情况下，结束匹配，丢弃待匹配报文。
在一实施例中，根据步骤S230得到的第二匹配结果，在第二匹配结果指示未匹配到可变字段的情况下，表示可变字段资源组的可变字段匹配到待匹配报文的可变字段并且拒绝通过该待匹配报文，或者可变字段资源组没有匹配到待匹配报文的可变字段，不再进行后续匹配操作，直接丢弃该待匹配报文。丢弃待匹配报文有利于限制网络流量，提高网络性能。
参见图7，图7示出了本申请另一个实施例提供的报文匹配方法的流程示意图，本申请实施例提供的报文匹配方法应用于第一网络设备，其中，第一网络设备可以为交换机，也可以为路由器，第一网络设备上具有接收端口和环回端口。该报文匹配方法包括但不限于有步骤S310、步骤S320、步骤S330和步骤S340。
步骤S310，接收待匹配报文，将待匹配报文发送给第二网络设备，以使根据第二网络设备的固定字段资源组中的固定字段对待匹配报文的第二固定字段进行匹配，得到第一匹配结果。
在一实施例中，首先接收待匹配报文，可以先通过第一网络设备的固定字段资源组的固定字段对待匹配报文的第一固定字段进行匹配，固定字段资源组的固定字段对待匹配报文的第一固定字段相匹配的情况下，将待匹配报文发送给第二网络设备，以使根据第二网络设备的固定字段资源组中的固定字段对待匹配报文的第二固定字段进行匹配，得到第一匹配结果。 也可以为第一网络设备不进行处理，直接将待匹配报文发送给第二网络设备进行匹配，设置有多台第二网络设备，在一台第二网络设备上通过配置固定字段资源组的固定字段对待匹配报文的第一固定字段进行匹配，再将待匹配报文重定向至另一台第二网络设备，以使根据第二网络设备的固定字段资源组中的固定字段对待匹配报文的第二固定字段进行匹配，得到第一匹配结果。通过将ACL匹配资源的消耗分配到多台设备上，避免一台设备上ACL匹配资源不足的情况。其中，第二固定字段为除了第一固定字段以外的固定字段，可以为封装在待匹配报文次外层的报文头部字段，或者为在报文匹配过程中最先匹配之后匹配的字段；第一匹配结果为在第二网络设备上得到的结果；第二网络设备可以有多台，待匹配报文能够在多台第二网络设备转发以进行匹配。
步骤S320，接收第二网络设备返回的第一匹配结果。
在一实施例中，接收到第二网络设备发送的第一匹配结果，实现了多次匹配筛选，从而避免了使用较长的ACL进行匹配，从而能够减少ACL资源的使用。
在一实施例中，根据得到的第一匹配结果，在第一匹配结果指示未匹配到第二固定字段的情况下，表示固定字段资源组的固定字段匹配到待匹配报文的固定字段并且拒绝通过该待匹配报文，或者固定字段资源组的固定字段没有匹配到待匹配报文的固定字段，不再进行后续匹配操作，直接丢弃该待匹配报文。丢弃待匹配报文有利于限制网络流量，提高网络性能。
步骤S330，在第一匹配结果指示匹配到第二固定字段的情况下，根据第一网络设备的可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第二匹配结果。
在一实施例中，在第一匹配结果匹配到第二固定字段的情况下，利用第一网络设备的可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第二匹配结果。通过固定字段资源组和可变字段资源组对待匹配报文进行多级筛选，能够减少匹配长度和匹配条目，从而减少对整体ACL匹配资源的使用，避免了使用过长的匹配长度，而导致ACL匹配资源不足。其中，第二匹配结果为第一网络设备侧对待匹配报文的字段均进行匹配后得到的结果。
步骤S340，根据第二匹配结果确定对待匹配报文的匹配动作。
如图8所示，根据第二匹配结果确定对待匹配报文的匹配动作，包括：
步骤S341，在第二匹配结果指示匹配到可变字段的情况下，上传待匹配报文至中央处理单元或者转发待匹配报文。
在一实施例中，根据步骤S330得到的第二匹配结果，在第二匹配结果指示匹配到可变字段的情况下，表示固定字段资源组和可变字段资源组匹配到待匹配报文的所有字段，并且允许该待匹配报文通过，则上传待匹配报文至中央处理单元或者转发待匹配报文。当为上传待匹配报文至中央处理单元，通过中央处理单元查询转发表，进行待匹配报文转发；当为转发待匹配报文，直接根据待匹配报文的目的地址进行报文转发。
步骤S342，在第二匹配结果指示未匹配到可变字段的情况下，结束匹配，丢弃待匹配报文。
在一实施例中，根据步骤S330得到的第二匹配结果，在第二匹配结果指示未匹配到可变字段的情况下，表示可变字段资源组的可变字段匹配到待匹配报文的可变字段并且拒绝通过该待匹配报文，或者可变字段资源组的可变字段没有匹配到待匹配报文的可变字段，不再进行后续匹配操作，直接丢弃该待匹配报文。丢弃待匹配报文有利于限制网络流量，提高网络性能。
参见图9，图9示出了本申请另一个实施例提供的报文匹配方法的流程示意图，本申请实施例提供的报文匹配方法应用于第二网络设备，其中，第二网络设备可以为交换机，也可以为路由器，第二网络设备可以为多台。该报文匹配方法包括但不限于有步骤S410和步骤S420。
步骤S410，接收第一网络设备发送的待匹配报文。
在一实施例中，接收第一网络设备发送的待匹配报文，表示待匹配报文通过了第一网络设备侧的匹配，可以为通过了待匹配报文的固定字段的匹配，也可以为通过了待匹配报文的 可变字段的匹配，有利于后续第二网络设备对该待匹配报文进行匹配，以确定是否转发该待匹配报文。
步骤S420，根据第二网络设备的可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第二匹配结果，并将第二匹配结果返回给第一网络设备，以使第一网络设备根据第二匹配结果确定对待匹配报文的匹配动作。
在一实施例中，利用第二网络设备的可变字段资源组中的可变字段对接收的待匹配报文的可变字段进行匹配，得到第二匹配结果，并将第二匹配结果返回给第一网络设备，以使第一网络设备根据第二匹配结果确定对待匹配报文的匹配动作。通过将ACL匹配资源的消耗分配到多台第二网络设备上，能够避免第一网络设备上ACL匹配资源不足的情况。
参见图10，图10示出了本申请另一个实施例提供的报文匹配方法的流程示意图，本申请实施例提供的报文匹配方法应用于第二网络设备，其中，第二网络设备可以为交换机，也可以为路由器，第二网络设备可以为多台。该报文匹配方法包括但不限于有步骤S510和步骤S520。
步骤S510，接收第一网络设备发送的待匹配报文。
在一实施例中，接收第一网络设备发送的待匹配报文，表示待匹配报文通过了第一网络设备侧的匹配，可以通过了待匹配报文的第一固定字段的匹配，或者未进行匹配直接将待匹配报文发送给第二网络设备，有利于后续第二网络设备对该待匹配报文进行匹配，以确定是否转发该待匹配报文。
步骤S520，根据第二网络设备的固定字段资源组中的固定字段对待匹配报文的第二固定字段进行匹配，得到第一匹配结果，并将第一匹配结果返回给第一网络设备，以使第一网络设备根据第一网络设备的可变字段资源组中的可变字段对待匹配报文的可变字段进行匹配，得到第二匹配结果，根据第二匹配结果确定对待匹配报文的匹配动作。
在一实施例中，在第一网络设备侧固定字段资源组中的固定字段与待匹配报文的第一固定字段相匹配且允许通过待匹配报文，利用第二网络设备的固定字段资源组中的固定字段对接收的待匹配报文的第二固定字段进行匹配，得到第一匹配结果，并将第二匹配结果返回给第一网络设备，以使第一网络设备根据第二匹配结果确定对待匹配报文的匹配动作。还可以为利用一台第二网络设备的固定字段资源组中的固定字段与待匹配报文的第一固定字段相匹配且允许通过待匹配报文，再将待匹配报文重定向至另一台第二网络设备，利用另一台第二网络设备的固定字段资源组中的固定字段对接收的待匹配报文的第二固定字段进行匹配，得到第一匹配结果，并将第二匹配结果返回给第一网络设备，以使第一网络设备根据第二匹配结果确定对待匹配报文的匹配动作。通过将ACL匹配资源的消耗分配到多台第二网络设备上，能够避免第一网络设备上ACL匹配资源不足的情况。其中，第二匹配结果为第二网络设备侧固定字段的匹配结果。
参见图12，图12示出了本申请实施例提供的第二网络设备匹配示意图。第一网络设备上未设置有环回端口，匹配的重要字段在报文数据部分，先通过第一网络设备获取待匹配报文，并根据固定字段资源组的固定字段对待匹配报文进行物理地址和VLAN进行匹配，得到第一匹配结果，在第一匹配结果指示没有匹配到的情况下，将待匹配报文丢弃；在第一匹配结果指示匹配到的情况下，将待匹配报文重定向至第二网络设备，在第二网络设备上根据固定字段资源组的固定字段进行IP地址匹配，得到第二匹配结果；在第二匹配结果指示没有匹配到的情况下，将待匹配报文丢弃；在第二匹配结果指示匹配到的情况下，将待匹配报文重定向至第一网络设备，第一网络设备根据可变字段资源组的可变字段进行报文数据匹配，得到第三匹配结果；在第三匹配结果指示没有匹配到的情况下，将待匹配报文丢弃；在第三匹配结果指示匹配到的情况下，即匹配到重要字段，第一网络设备将待匹配报文上送至中央处理单元。通过多个网络设备进行匹配不同ACL条目的匹配，不同端口预设的ACL匹配规则匹配ACL条目占用的ACL资源较少，减少了资源占用。
在一实施例中，需要筛选的报文的源物理地址为：00:11:22:33:44:55，目的物理地址为： 00:55:44:33:22:11，标签为：12345，目的IP地址：10.10.10.1，源IP地址：20.20.20.1，需要匹配的报文载荷为IP头部后面的一个为0xEFEFEFEF的字段，若匹配到此报文则将此报文上送中央处理单元。匹配方式如下：首先第一网络设备的接收端口收到待匹配报文，并配置有固定字段资源组，筛选匹配源物理地址：00:11:22:33:44:55，目的物理地址：00:55:44:33:22:11，标签为：12345的报文，重定向到与第二网络设备相连的端口2，将所有源目的物理地址和隧道标签符合要求的报文通过端口2发往给第二网络设备；然后第二网络设备的接收端口2上设置固定字段资源组，筛选匹配目的IP地址：10.10.10.1，源IP地址：20.20.20.1到第二网络设备的接收端口3，所有符合目的IP地址：10.10.10.1，源IP地址：20.20.20.1的报文通过端口3发回给第一网络设备，最后第一网络设备端口3上设置可变字段资源组，筛选匹配IP头部的后4个字节为0xEFEFEFEF，执行动作为所有报文上送中央处理单元。通过两台设备之间的三轮筛选，即可将报文正确匹配出来上送至第一网络设备的中央处理单元，且每一轮ACL的配置长度，均未超过32字节。如果此处需要匹配的条目有N条，本申请实施例匹配使用的资源为32*(N+1)，其中有一个32字节的ACL匹配资源，被分担到了第二网络设备上。
在一实施例中，筛选匹配的重要字段为IP头部的后4个字节的报文数据部分，报文数据部分还可以包括M个ACL条目，若匹配的数据处于报文数据部分的靠后位置，则需通过多个网络设备，完成多次ACL筛选，能够扩展ACL对超长报文的匹配，使得对报文的匹配理论上可以不受限于ACL的长度。
本申请实施例描述的设备以及应用场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域技术人员可知，随着新应用场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本领域技术人员可以理解的是，图11和图12中示出的环回端口匹配和第二网络设备匹配并不构成对本申请实施例的限定，可以包括比图示更多或更少的模块，或者组合某些部件，或者不同的部件布置。
上述实施方式描述的处理流程是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，若存在多路径的隧道业务或者其他业务模式也同样适用。
参见图13，图13示出了本申请实施例提供的计算机设备900。该计算机设备900可以是服务器或者终端，该计算机设备900的内部结构包括但不限于：
存储器910，用于存储程序；
处理器920，用于执行存储器910存储的程序，当处理器920执行存储器910存储的程序时，处理器920用于执行上述的报文匹配方法。
处理器920和存储器910可以通过总线或者其他方式连接。
存储器910作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序以及非暂态性计算机可执行程序，如本申请任意实施例描述的报文匹配方法。处理器920通过运行存储在存储器910中的非暂态软件程序以及指令，从而实现上述的报文匹配方法。
存储器910可以包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需要的应用程序；存储数据区可存储执行上述的报文匹配方法。此外，存储器910可以包括高速随机存取存储器，还可以包括非暂态存储器，比如至少一个磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施方式中，存储器910可包括相对于处理器920远程设置的存储器，这些远程存储器可以通过网络连接至该处理器920。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
实现上述的报文匹配方法所需的非暂态软件程序以及指令存储在存储器910中，当被一个或者多个处理器920执行时，执行本申请任意实施例提供的报文匹配方法。
本申请实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，计算机可执行指令用于执行上述的报文匹配方法。
在一实施例中，该存储介质存储有计算机可执行指令，该计算机可执行指令被一个或多 个控制处理器920执行，比如，被上述计算机设备900中的一个处理器920执行，可使得上述一个或多个处理器920执行本申请任意实施例提供的报文匹配方法。
本申请实施例包括：将所述第一网络设备的访问控制列表ACL匹配资源划分为固定字段资源组和可变字段资源组，所述固定字段资源组包括固定字段的集合，所述可变字段资源组包括可变字段的集合，通过对ACL匹配资源进行划分，有利于对待匹配的报文进行多次筛选，减少资源使用；接收待匹配报文，根据所述固定字段资源组中的固定字段和所述可变字段资源组中的可变字段对所述待匹配报文进行匹配，得到第一匹配结果，由于集合中不包括重复元素，利用固定字段资源组对待匹配报文进行匹配，能够减少资源的使用，进而能够节省整体的ACL资源使用。根据第一匹配结果确定对待匹配报文的匹配动作。与在一些情形下使用与待匹配报文长度相当的ACL资源对固定字段的报文进行处理，消耗大量资源相比，本申请实施例通过将ACL匹配资源进行划分，对报文进行层级筛选，能够节省整体ACL资源的使用。
以上所描述的实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统可以被实施为软件、固件、硬件及其适当的组合。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包括计算机可读指令、数据结构、程序模块或者诸如或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。

Claims (15)

  1. 一种报文匹配方法，应用于第一网络设备，所述方法包括：
    将所述第一网络设备的访问控制列表ACL匹配资源划分为固定字段资源组和可变字段资源组，所述固定字段资源组包括固定字段的集合，所述可变字段资源组包括可变字段的集合；
    接收待匹配报文，根据所述固定字段资源组中的固定字段和所述可变字段资源组中的可变字段对所述待匹配报文进行匹配，得到第一匹配结果；
    根据所述第一匹配结果确定对所述待匹配报文的匹配动作。
  2. 根据权利要求1所述的方法，其中，所述根据所述固定字段资源组中的固定字段和所述可变字段资源组中的可变字段对所述待匹配报文进行匹配，得到第一匹配结果，包括：
    根据所述固定字段资源组中的固定字段对所述待匹配报文的第一固定字段进行匹配，得到第二匹配结果；
    在所述第二匹配结果指示匹配到所述第一固定字段的情况下，根据所述可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到所述第一匹配结果。
  3. 根据权利要求2所述的方法，其中，所述第一网络设备的接收端口上配置有所述固定字段资源组，所述接收端口用于接收所述待匹配报文，并在所述接收端口上根据所述固定字段资源组中的固定字段对所述待匹配报文的第一固定字段进行匹配，得到第二匹配结果；
    所述第一网络设备的第一环回端口上配置有所述固定字段资源组，在所述第二匹配结果指示匹配到所述第一固定字段的情况下，在所述第一环回端口上根据所述固定字段资源组中的固定字段对所述待匹配报文的第二固定字段进行匹配，得到第三匹配结果，所述第二固定字段为除了所述第一固定字段以外的固定字段；
    所述第一网络设备的第二环回端口上配置有所述可变字段资源组，在所述第三匹配结果指示匹配到所述第二固定字段的情况下，在所述第二环回端口上根据所述可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到第一匹配结果。
  4. 根据权利要求2或3所述的方法，其中，在所述根据所述固定字段资源组中的固定字段对所述待匹配报文的第一固定字段进行匹配，得到第二匹配结果之后，所述方法还包括：
    在所述第二匹配结果指示未匹配到所述第一固定字段的情况下，结束匹配，丢弃所述待匹配报文。
  5. 根据权利要求2所述的方法，其中，所述根据所述第一匹配结果确定对所述待匹配报文的匹配动作，包括：
    在所述第一匹配结果指示匹配到所述可变字段的情况下，上传所述待匹配报文至中央处理单元或者转发所述待匹配报文；
    在所述第一匹配结果指示未匹配到所述可变字段的情况下，结束匹配，丢弃所述待匹配报文。
  6. 一种报文匹配方法，应用于第一网络设备，所述方法包括：
    接收待匹配报文，根据所述第一网络设备的固定字段资源组中的固定字段对所述待匹配报文的第一固定字段进行匹配，得到第一匹配结果；
    在所述第一匹配结果指示匹配到所述第一固定字段的情况下，将所述待匹配报文发送给第二网络设备，以使根据所述第二网络设备的可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到第二匹配结果；
    接收所述第二网络设备返回的所述第二匹配结果；
    根据所述第二匹配结果确定对所述待匹配报文的匹配动作。
  7. 根据权利要求6所述的方法，其中，在所述接收待匹配报文，根据所述第一网络设备的固定字段资源组中的固定字段对所述待匹配报文的第一固定字段进行匹配，得到第一匹配结果之后，所述方法还包括：
    在所述第一匹配结果指示未匹配到所述第一固定字段的情况下，结束匹配，丢弃所述待匹配报文。
  8. 根据权利要求6所述的方法，其中，所述根据所述第二匹配结果确定对所述待匹配报文的匹配动作，包括：
    在所述第二匹配结果指示匹配到所述可变字段的情况下，上传所述待匹配报文至中央处理单元或者转发所述待匹配报文；
    在所述第二匹配结果指示未匹配到所述可变字段的情况下，结束匹配，丢弃所述待匹配报文。
  9. 一种报文匹配方法，应用于第一网络设备，所述方法包括：
    接收待匹配报文，将所述待匹配报文发送给第二网络设备，以使根据所述第二网络设备的固定字段资源组中的固定字段对所述待匹配报文的第二固定字段进行匹配，得到第一匹配结果；
    接收所述第二网络设备返回的所述第一匹配结果；
    在所述第一匹配结果指示匹配到所述第二固定字段的情况下，根据所述第一网络设备的可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到第二匹配结果；
    根据所述第二匹配结果确定对所述待匹配报文的匹配动作。
  10. 根据权利要求9所述的方法，其中，在所述接收所述第二网络设备返回的所述第一匹配结果之后，所述方法还包括：
    在所述第一匹配结果指示未匹配到所述第二固定字段的情况下，结束匹配，丢弃所述待匹配报文。
  11. 根据权利要求9所述的方法，其中，所述根据所述第二匹配结果确定对所述待匹配报文的匹配动作，包括：
    在所述第二匹配结果指示匹配到所述可变字段的情况下，上传所述待匹配报文至中央处理单元或者转发所述待匹配报文；
    在所述第二匹配结果指示未匹配到所述可变字段的情况下，结束匹配，丢弃所述待匹配报文。
  12. 一种报文匹配方法，应用于第二网络设备，所述方法包括：
    接收第一网络设备发送的待匹配报文；
    根据所述第二网络设备的可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到第二匹配结果，并将所述第二匹配结果返回给所述第一网络设备，以使所述第一网络设备根据所述第二匹配结果确定对所述待匹配报文的匹配动作。
  13. 一种报文匹配方法，应用于第二网络设备，所述方法包括：
    接收第一网络设备发送的待匹配报文；
    根据所述第二网络设备的固定字段资源组中的固定字段对所述待匹配报文的第二固定字段进行匹配，得到第一匹配结果，并将所述第一匹配结果返回给所述第一网络设备，以使所述第一网络设备根据所述第一网络设备的可变字段资源组中的可变字段对所述待匹配报文的可变字段进行匹配，得到第二匹配结果，根据所述第二匹配结果确定对所述待匹配报文的匹配动作。
  14. 一种计算机设备，所述计算机设备包括存储器和处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被一个或多个所述处理器执行时，使得一个或多个所述处理器执行如权利要求1至5、6至8、9至11、12、13中任一项所述方法的步骤。
  15. 一种计算机可读存储介质，所述存储介质可被处理器读写，所述存储介质存储有计算机指令，所述计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行如权利要求1至5、6至8、9至11、12、13中任一项所述方法的步骤。
PCT/CN2023/085162 2022-08-30 2023-03-30 报文匹配方法、计算机设备和计算机可读存储介质 WO2024045599A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211048413.8 2022-08-30
CN202211048413.8A CN115314564A (zh) 2022-08-30 2022-08-30 报文匹配方法、计算机设备和计算机可读存储介质

Publications (1)

Publication Number Publication Date
WO2024045599A1 true WO2024045599A1 (zh) 2024-03-07

Family

ID=83863748

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/085162 WO2024045599A1 (zh) 2022-08-30 2023-03-30 报文匹配方法、计算机设备和计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN115314564A (zh)
WO (1) WO2024045599A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060092947A1 (en) * 2004-11-03 2006-05-04 3Com Corporation Rules engine for access control lists in network units
CN101409677A (zh) * 2008-11-27 2009-04-15 福建星网锐捷网络有限公司 一种接入控制方法及装置
CN103354522A (zh) * 2013-06-28 2013-10-16 华为技术有限公司 一种多级流表查找方法和装置
CN113452594A (zh) * 2021-06-28 2021-09-28 新华三信息安全技术有限公司 一种隧道报文的内层报文匹配方法及装置
CN114760108A (zh) * 2022-03-22 2022-07-15 杭州迪普科技股份有限公司 报文匹配方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060092947A1 (en) * 2004-11-03 2006-05-04 3Com Corporation Rules engine for access control lists in network units
CN101409677A (zh) * 2008-11-27 2009-04-15 福建星网锐捷网络有限公司 一种接入控制方法及装置
CN103354522A (zh) * 2013-06-28 2013-10-16 华为技术有限公司 一种多级流表查找方法和装置
CN113452594A (zh) * 2021-06-28 2021-09-28 新华三信息安全技术有限公司 一种隧道报文的内层报文匹配方法及装置
CN114760108A (zh) * 2022-03-22 2022-07-15 杭州迪普科技股份有限公司 报文匹配方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
NEC: "Updates to solution 1 regarding identifiers matching", 3GPP DRAFT; S2-142634_AESE_EXTENSIONS_V03, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Dublin, Ireland; 20140706 - 20140711, 2 July 2014 (2014-07-02), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP050837065 *

Also Published As

Publication number Publication date
CN115314564A (zh) 2022-11-08

Similar Documents

Publication Publication Date Title
US10735325B1 (en) Congestion avoidance in multipath routed flows
WO2020236273A1 (en) System and method for facilitating hybrid message matching in a network interface controller (nic)
EP3366014A1 (en) Reduced orthogonal network policy set selection
US11652735B2 (en) Multicast data packet processing method, and apparatus
US10397116B1 (en) Access control based on range-matching
US9590922B2 (en) Programmable and high performance switch for data center networks
US11637787B2 (en) Preventing duplication of packets in a network
CN106685827B (zh) 一种下行报文的转发方法及ap设备
CN106713144B (zh) 一种报文出口信息的读写方法及转发引擎
CN110932890B (zh) 一种数据传输方法、服务器及计算机可读存储介质
US10819640B1 (en) Congestion avoidance in multipath routed flows using virtual output queue statistics
US20230145093A1 (en) Packet processing method and device, advertisement method and device, bridge node, source apparatus, storage medium, and packet processing system
CN109391551B (zh) 一种多端口组播方法、设备及计算机可读存储介质
US11646976B2 (en) Establishment of fast forwarding table
US20240106751A1 (en) Method and apparatus for processing detnet data packet
WO2024093064A1 (zh) 一种大规模多模态网络中标识管理及优化转发方法和装置
US11126249B1 (en) Power reduction methods for variable sized tables
WO2020083095A1 (zh) 反向路径检查方法、装置、设备以及存储介质
WO2024045599A1 (zh) 报文匹配方法、计算机设备和计算机可读存储介质
US10506044B1 (en) Statistics collecting architecture
CN107517161B (zh) 一种网络处理器查表方法、网络处理器和查表系统
CN113132273A (zh) 一种数据转发方法及装置
CN106059935B (zh) 未知组播报文的处理方法和装置
US11658903B2 (en) Network device route programming
CN109167731B (zh) 报文发送方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23858640

Country of ref document: EP

Kind code of ref document: A1