CN115834233A - A message filtering method and device - Google Patents

Abstract

The embodiment of the invention provides a message filtering method and a device, which relate to the technical field of networks and are applied to network equipment, wherein a target interface of the network equipment is configured with an IPSG function, and a network chip in the network equipment stores: record SCL table entry and ACL table entry recorded with metadata identification of the corresponding relation between IP address and metadata identification, the length of the metadata identification is smaller than the length of the IP address, the above-mentioned method includes: after receiving a message through a target interface, searching a target SCL table entry recording a source IP address of the message from the stored SCL table entries; if the target SCL table entry is found, adding a metadata identifier recorded in the target SCL table entry for the message; and carrying out ACL table item matching on the message based on the metadata identifier carried by the message, and forwarding the message under the condition of matching the target ACL table item recorded with the metadata identifier.

Description

A message filtering method and device

technical field

The invention relates to the field of network technology, in particular to a message filtering method and device.

Background technique

The IPSG (Internet Protocol Source Guard, Internet Protocol Source Guard) function is used to filter and control packets received by the interface of the network device, and is usually bound to the user-side interface of the network device. The IPSG function can be realized by issuing ACL (Access Control Lists, access control list) entries. After receiving the message, the user-side interface bound to the IPSG function can check the received message based on the preset ACL entry. After matching, only the packets that match the ACL entries will be forwarded by the network device, otherwise the packets will be discarded by the network device, so that the packets can be filtered.

Specifically, an IP address can be recorded in an ACL entry, and only packets with the same source address as the IP address recorded in the ACL entry can be forwarded by the network device. Only packets sent by user terminals with the same IP address can be forwarded by the network device, so that network access can be performed normally. However, when a large number of user terminals go online in the network, a large number of different ACL entries need to be configured in the network device so that a large number of user terminals can normally access the network. A large number of ACL entries will occupy a large amount of ACL resources, but the ACL resources used to store ACL entries in the network chip in the network device are limited, making it difficult for the network device to provide network access services for a large number of user terminals.

Contents of the invention

The purpose of the embodiments of the present invention is to provide a message filtering method and device to save ACL resources in a network chip. The specific technical scheme is as follows:

In the first aspect, the embodiment of the present invention provides a message filtering method, which is applied to a network device. The target interface of the network device is configured with an Internet interconnection protocol source guard IPSG function, and the network chip in the network device stores There are: an SCL entry that records the correspondence between the IP address and the metadata identifier and an ACL entry that records the metadata identifier, wherein the length of the metadata identifier is less than the length of the IP address, and the method include:

After receiving the message through the target interface, search for the target SCL entry that records the source IP address of the message from the stored SCL entry;

If the target SCL entry is found, adding the metadata identifier recorded in the target SCL entry to the message;

Perform ACL entry matching on the packet based on the metadata identifier carried in the packet, and forward the packet when a target ACL entry recorded with the metadata identifier is matched.

In an embodiment of the present invention, the metadata identifier and the media access control MAC address are recorded in the ACL entry, and the ACL entry matching is performed on the packet based on the metadata identifier carried in the packet. When the target ACL entry recorded with the metadata identifier is matched, the packet is forwarded, including:

Based on the metadata identifier carried by the packet and the source MAC address of the packet, perform ACL entry matching on the packet, and when the target ACL table with the metadata identifier and the source MAC address is matched, In the case of the item, the message is forwarded.

In one embodiment of the present invention, the IP address recorded in the SCL entry includes an IPv4 address and an IPv6 address, wherein the SCL entry recorded with the IPv4 address is stored in SCL HASH1, and the SCL entry recorded with the IPv6 address is stored in in SCL HASH0.

In an embodiment of the present invention, the ACL entry recorded with the metadata identifier occupies one ACL resource bit.

In the second aspect, the embodiment of the present invention provides a message filtering device, which is applied to a network device. The target interface of the network device is configured with an Internet interconnection protocol source guard IPSG function, and the network chip in the network device stores There are: an SCL entry that records the correspondence between the IP address and the metadata identifier and an ACL entry that records the metadata identifier, wherein the length of the metadata identifier is less than the length of the IP address, and the device include:

The SCL entry search module is used to search the stored SCL entry for the target SCL entry that records the source IP address of the message after receiving the message through the target interface;

A tag adding module, configured to add the metadata identifier recorded in the target SCL entry to the message if the target SCL entry is found;

The ACL entry matching module is configured to perform ACL entry matching on the packet based on the metadata identifier carried by the packet, and perform the ACL entry matching on the packet when the target ACL entry recorded with the metadata identifier is matched. Packets are forwarded.

In one embodiment of the present invention, metadata identifiers and media access control MAC addresses are recorded in the ACL entries, and the ACL entry matching module is specifically used for:

Based on the metadata identifier carried by the packet and the source MAC address of the packet, perform ACL entry matching on the packet, and when the target ACL table with the metadata identifier and the source MAC address is matched, In the case of the item, the message is forwarded.

In one embodiment of the present invention, the IP address recorded in the SCL entry includes an IPv4 address and an IPv6 address, wherein the SCL entry recorded with the IPv4 address is stored in SCL HASH1, and the SCL entry recorded with the IPv6 address is stored in in SCL HASH0.

In an embodiment of the present invention, the ACL entry recorded with the metadata identifier occupies one ACL resource bit.

In a third aspect, an embodiment of the present invention provides a network device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory complete communication with each other through the communication bus;

memory for storing computer programs;

The processor is configured to implement the method steps described in any one of the first aspect when executing the program stored in the memory.

In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, any method described in the first aspect is implemented. step.

In the fifth aspect, the embodiment of the present invention further provides a computer program product containing instructions, which, when run on a computer, causes the computer to execute the method described in any one of the above first aspects.

Beneficial effects of the embodiments of the present invention:

The message filtering method provided by the embodiment of the present invention is applied to a network device, and the target interface of the network device is configured with an IPSG function, that is, the target interface is an interface that needs to perform message filtering. The network chip of the network device stores SCL entries and ACL entries, and the SCL entry records the correspondence between the metadata identifier and the IP address. After the network device receives the message through the target interface, it can based on the SCL table The item determines the metadata identifier corresponding to the source IP address of the message and adds the source data identifier to the message. Afterwards, the network device continues to match the packet based on the ACL entry recorded with the metadata identifier, and if the match passes, it continues to forward the packet, thereby implementing packet filtering.

It can be seen from the above that the network chip of the above network device stores the SCL entry that records the correspondence between the IP address and the metadata identifier, and the tight coupling between the IP address and the metadata identifier is realized through the SCL entry. Therefore, the network device can determine the metadata identifier corresponding to the IP address based on the SCL entry, which is equivalent to adding a metadata identifier corresponding to the source IP address to the packet through the SCL entry. Matching makes it unnecessary to record the IP address in the prior art in the ACL entry for matching the message, but record the metadata identifier, and the length of the metadata identifier is less than the length of the IP address, so the present invention implements In the scheme provided by the example, the metadata identifier with a short length is recorded in the ACL entry, that is, the length of the ACL entry can be shortened through the scheme provided by the embodiment of the present invention, thereby saving ACL resources in the network chip and making the network device It can simultaneously provide network access services for a large number of user terminals.

Of course, implementing any product or method of the present invention does not necessarily need to achieve all the above-mentioned advantages at the same time.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention, and those skilled in the art can also obtain other embodiments according to these drawings.

FIG. 1 is a schematic flowchart of a first message filtering method provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a second message filtering method provided by an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a message filtering device provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a network device provided by an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art based on the present invention belong to the protection scope of the present invention.

Due to the limited ACL resources used to store ACL entries in the network chip in the network device in the prior art, it is difficult for the network device to provide network access services for a large number of user terminals. In order to solve the above problem, the embodiments of the present invention provide A message filtering method and device.

The embodiment of the present invention provides a message filtering method, which is applied to a network device. The target interface of the above network device is configured with an IPSG function. The network chip in the above network device stores: a record between the IP address and the metadata identifier The SCL (Service Classification List, service classification table) entry of the corresponding relationship and the ACL entry recorded with the metadata identifier, wherein the length of the metadata identifier is less than the length of the IP address, and the method includes:

After receiving the message through the above-mentioned target interface, search for the target SCL table entry that records the source IP address of the above-mentioned message from the stored SCL table entry;

If the above-mentioned target SCL entry is found, add the metadata identifier recorded in the above-mentioned target SCL entry for the above-mentioned message;

Match the above-mentioned message based on the stored ACL entry and the metadata identifier carried by the above-mentioned message, and forward the above-mentioned message when the target ACL entry is found.

It can be seen from the above that the network chip of the above network device stores the SCL entry that records the correspondence between the IP address and the metadata identifier, and the tight coupling between the IP address and the metadata identifier is realized through the SCL entry. Therefore, the network device can determine the metadata identifier corresponding to the IP address based on the SCL entry, which is equivalent to adding a metadata identifier corresponding to the source IP address to the packet through the SCL entry. Matching makes it unnecessary to record the IP address in the prior art in the ACL entry for matching the message, but record the metadata identifier, and the length of the metadata identifier is less than the length of the IP address, so the present invention implements In the scheme provided by the example, the metadata identifier with a short length is recorded in the ACL entry, that is, the length of the ACL entry can be shortened through the scheme provided by the embodiment of the present invention, thereby saving ACL resources in the network chip and making the network device It can simultaneously provide network access services for a large number of user terminals.

Referring to FIG. 1 , it is a schematic flowchart of a first packet filtering method provided by an embodiment of the present invention, which is applied to a network device, and the above network device may be a router, a switch, or the like. The target interface of the above-mentioned network device is configured with an IPSG function, and the network chip in the above-mentioned network device stores: an SCL entry recording the correspondence between the IP address and the metadata identifier (MetaData) and an ACL table recording the metadata identifier item, wherein the length of the metadata identifier is less than the length of the IP address.

Specifically, there is a one-to-one correspondence between the above-mentioned IP addresses and metadata identifiers, and the metadata identifiers corresponding to different IP addresses are different. The IP address in the above-mentioned SCL entry indicates that: when the source address is The network device is allowed to forward the packet after the packet with the IP address, and the above SCL entry and ACL entry can be manually set or dynamically obtained. Each SCL entry records an IP address and a metadata identifier corresponding to the IP address. A metadata identifier is recorded in each ACL entry.

In addition, the IP addresses recorded in the above SCL entries include IPv4 addresses and IPv6 addresses, and the SCL entries recorded with IPv4 addresses are stored in SCL HASH (Service Classification List Hash, service classification hash table) 1, and those recorded with IPv6 addresses SCL entries are stored in SCL HASH0. Among them, SCL HASH0 and SCL HASH1 are two storage partitions of SCL entries.

In addition, the embodiment of the present invention can run under the situation that the switch-mode (switch operating mode) of network equipment configuration is ACL-hash (access control list-hash) mode, after the network equipment is configured to ACL-hash mode, need After the configuration is saved, the network device is restarted, and the SCL entry and the ACL entry are delivered, and the solution provided by the embodiment of the present invention can take effect.

The above method includes the following steps S101-S103.

S101: After receiving the message through the above-mentioned target interface, search for the target SCL entry in which the source IP address of the above-mentioned message is recorded from the stored SCL entries.

In one embodiment of the present invention, the stored SCL entries can be traversed to search for the target SCL entry that records the source IP address of the received message. If the above-mentioned target SCL entry can be found, it means that the network After the device receives the message whose source IP address is the IP address recorded in the target SCL entry through the target interface, the network device allows the forwarding of the message, and then continues to perform subsequent steps S102-S103, if the target SCL table is not found item, it means that there is no target SCL entry that records the source IP address of the above message, and it means that the network device does not forward the message after receiving the message through the target interface, then the message can be discarded or processed. For other forms of processing, the subsequent steps S102-S103 are not performed.

S102: If the above-mentioned target SCL entry is found, add the metadata identifier recorded in the above-mentioned target SCL entry to the above-mentioned message.

S103: Perform ACL entry matching on the packet based on the metadata identifier carried in the packet, and forward the packet if a target ACL entry recorded with the metadata identifier is matched.

Specifically, the metadata identifier in the ACL entry stored in the network device indicates that the network device is allowed to forward the packet carrying the metadata identifier, then the target ACL entry that records the metadata identifier carried by the above packet is matched In the case of , the network device can forward the above message. If the above-mentioned target ACL entry is not matched, the above-mentioned packet can be discarded or processed in other ways, and the above-mentioned packet is not forwarded.

It can be seen from the above that the network chip of the above network device stores the SCL entry that records the correspondence between the IP address and the metadata identifier, and the tight coupling between the IP address and the metadata identifier is realized through the SCL entry. Therefore, the network device can determine the metadata identifier corresponding to the IP address based on the SCL entry, which is equivalent to adding a metadata identifier corresponding to the source IP address to the packet through the SCL entry. Matching makes it unnecessary to record the IP address in the prior art in the ACL entry for matching the message, but record the metadata identifier, and the length of the metadata identifier is less than the length of the IP address, so the present invention implements In the scheme provided by the example, the metadata identifier with a short length is recorded in the ACL entry, that is, the length of the ACL entry can be shortened through the scheme provided by the embodiment of the present invention, thereby saving ACL resources in the network chip and making the network device It can simultaneously provide network access services for a large number of user terminals.

In addition, the bit width of the ACL entry recorded with the metadata identifier provided by the embodiment of the present invention can be 160 bits, occupying 1 ACL resource bit, while the bit width of the ACL entry directly recording the IPv4 address in the prior art is 320 bits, Two ACL resource bits are occupied. In the prior art, the bit width of the ACL entry directly recording the IPv6 address is 640 bits, and four ACL resource bits are occupied. It can be seen that the ACL resource occupied by each ACL entry can be reduced by adopting the embodiment of the present invention, thereby saving the ACL resource in the network chip.

In addition, the ACL resources in the inbound direction of the network chip are divided into 8 blocks, numbered 0-7. The number of resource bits included in each ACL resource block in the first 4 blocks is 1536, and the bit width of each resource bit is 160 bits, and the number of resource bits included in each ACL resource block in the last 4 blocks is 512. Among them, the ACL resource block numbered 0 at the front is used to store the protocol group, which will be occupied by default after the network device is initialized, and the ACL resource block numbered 1-6 is used to store ACL entries that are not enlarged. ACL resources of 7 are used to store ACL entries for amplification processing, wherein the ACL entries involved in the solution provided by the embodiment of the present invention can be stored in ACL resource blocks numbered 1-6, and each ACL entry Occupies one ACL resource bit, and the ACL resource blocks numbered 1-6 contain 1536+1536+1536+512+512+512=6144 ACL resource bits in total, and can store 6144 ACL entries in total. If each entry corresponds to For one user terminal, through the solution provided by the embodiment of the present invention, more than 6,000 ACL entries can be accommodated in the ACL resource in one network chip, thereby theoretically providing network access services for more than 6,000 user terminals.

Furthermore, in the prior art, since each ACL entry containing an IP address occupies more ACL resources, in order to normally provide network access services for a large number of user terminals, in the prior art, stacking of multiple network devices can Increases ACL resources, but stacking network devices in this way will increase the hardware economic cost of the network system, and the stacking of network devices needs to consider the stability of the stack and the problems that may occur when forwarding messages across boards, increasing the operation and maintenance of the network system cost. However, the solution provided by the embodiment of the present invention can save the ACL resources occupied by the ACL entries by reducing the data volume of each ACL entry, so that the ACL resources in the network chip in a network device can accommodate more ACLs. Table entries, therefore, by adopting the solution provided by the embodiment of the present invention, the superposition of network devices can be avoided as much as possible, and the economic cost of hardware and the cost of operation and maintenance can be saved.

In addition, the SCL entry stored in the embodiment of the present invention records the corresponding relationship between the IP address and the metadata identifier, and the packet filtering based on the IP address is realized by means of the metadata identifier, so the embodiment of the present invention provides The solution is applicable to packet filtering based on IP address, but not applicable to IPSG bottom drop rules, Free VLAN (Free Virtual Local Area Network, release virtual local area network) release rules, binding rules that do not contain IP addresses, etc. that have nothing to do with IP addresses Message filtering rules, such message filtering rules can be implemented through SCL entries in the way of the prior art, and do not occupy ACL resources, and can be configured and deployed together with the scheme provided by the embodiment of the present invention to expand the capacity of IPSG binding entries. Specification.

In one embodiment of the present invention, the above-mentioned ACL entry is recorded with a metadata identifier and a MAC (Media Access Control Address, Media Access Control Address) address, indicating that the network device is allowed to forward the metadata identifier recorded in the ACL entry. and the source MAC address is the MAC address recorded in the ACL entry.

On this basis, referring to FIG. 2 , it is a schematic flowchart of a second message filtering method provided by an embodiment of the present invention. Compared with the embodiment shown in FIG. 1 , the above step S103 can be realized by the following step S103A.

S103A: Perform ACL entry matching on the above-mentioned message based on the metadata identifier carried by the above-mentioned message and the source MAC address of the above-mentioned message, and when the target ACL entry that records the above-mentioned metadata identifier and the above-mentioned source MAC address is matched Next, the above packet is forwarded.

In one embodiment of the present invention, the metadata identifier and the MAC address are recorded in the above-mentioned ACL entry. If the source MAC address of the packet is the same as the target ACL entry, it means that the network device is allowed to forward the packet, so the packet can be forwarded.

As can be seen from the above, the ACL entry in the solution provided by the embodiment of the present invention records the MAC address and the metadata identifier, and the metadata identifier and the IP address are tightly coupled, that is, the metadata identifier can represent the IP address, so the MAC address and the IP address are recorded. The ACL entry identified by the metadata is equivalent to the ACL entry that records the MAC address and the IP address. Therefore, the solution provided by the embodiment of the present invention can filter packets based on both the IP address and the MAC address, thereby further improving the security of the network.

Corresponding to the aforementioned message filtering method applied to network equipment, the embodiment of the present invention also provides a message filtering device applied to network equipment.

Referring to FIG. 3 , it is a schematic structural diagram of a message filtering device provided by an embodiment of the present invention, which is applied to network equipment. The target interface of the above-mentioned network equipment is configured with an IPSG function, and the network chip in the above-mentioned network equipment stores: The SCL entry of the corresponding relationship between the IP address and the metadata identifier and the ACL entry recorded with the metadata identifier, wherein the length of the metadata identifier is less than the length of the IP address, and the above-mentioned device includes:

The SCL entry search module 301 is configured to search for a target SCL entry that records the source IP address of the message from the stored SCL entries after receiving the message through the target interface;

A tag adding module 302, configured to add the metadata identifier recorded in the target SCL entry to the message if the target SCL entry is found;

The ACL entry matching module 303 is configured to perform ACL entry matching on the packet based on the metadata identifier carried by the packet, and perform ACL entry matching on the packet when the target ACL entry recorded with the metadata identifier is matched. The above message is forwarded.

It can be seen from the above that the network chip of the above network device stores the SCL entry that records the correspondence between the IP address and the metadata identifier, and the tight coupling between the IP address and the metadata identifier is realized through the SCL entry. Therefore, the network device can determine the metadata identifier corresponding to the IP address based on the SCL entry, which is equivalent to adding a metadata identifier corresponding to the source IP address to the packet through the SCL entry. Matching makes it unnecessary to record the IP address in the prior art in the ACL entry for matching the message, but record the metadata identifier, and the length of the metadata identifier is less than the length of the IP address, so the present invention implements In the scheme provided by the example, the metadata identifier with a short length is recorded in the ACL entry, that is, the length of the ACL entry can be shortened through the scheme provided by the embodiment of the present invention, thereby saving ACL resources in the network chip and making the network device It can simultaneously provide network access services for a large number of user terminals.

In an embodiment of the present invention, metadata identifiers and media access control MAC addresses are recorded in the ACL entries, and the ACL entry matching module 303 is specifically used for:

Based on the metadata identifier carried by the packet and the source MAC address of the packet, perform ACL entry matching on the packet, and when the target ACL table with the metadata identifier and the source MAC address is matched, In the case of the item, the message is forwarded.

As can be seen from the above, the ACL entry in the solution provided by the embodiment of the present invention records the MAC address and the metadata identifier, and the metadata identifier and the IP address are tightly coupled, that is, the metadata identifier can represent the IP address, so the MAC address and the IP address are recorded. The ACL entry identified by the metadata is equivalent to the ACL entry that records the MAC address and the IP address. Therefore, the solution provided by the embodiment of the present invention can filter packets based on both the IP address and the MAC address, thereby further improving the security of the network.

In one embodiment of the present invention, the IP address recorded in the SCL entry includes an IPv4 address and an IPv6 address, wherein the SCL entry recorded with the IPv4 address is stored in SCL HASH1, and the SCL entry recorded with the IPv6 address is stored in in SCL HASH0.

In an embodiment of the present invention, the ACL entry recorded with the metadata identifier occupies one ACL resource bit.

The embodiment of the present invention also provides a network device, as shown in FIG. complete the mutual communication,

Memory 403, used to store computer programs;

The processor 401 is configured to implement the method steps shown in any one of the above packet filtering methods when executing the program stored in the memory 403 .

When the network device provided by the embodiment of the present invention is used for message filtering, the network chip of the above network device stores an SCL entry that records the correspondence between the IP address and the metadata identifier, and the IP address and Tight coupling between metadata identifiers. Therefore, the network device can determine the metadata identifier corresponding to the IP address based on the SCL entry, which is equivalent to adding a metadata identifier corresponding to the source IP address to the packet through the SCL entry. Matching makes it unnecessary to record the IP address in the prior art in the ACL entry for matching the message, but record the metadata identifier, and the length of the metadata identifier is less than the length of the IP address, so the present invention implements In the scheme provided by the example, the metadata identifier with a short length is recorded in the ACL entry, that is, the length of the ACL entry can be shortened through the scheme provided by the embodiment of the present invention, thereby saving ACL resources in the network chip and making the network device It can simultaneously provide network access services for a large number of user terminals.

The communication bus mentioned in the above network device may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA) bus or the like. The communication bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

The communication interface is used for communication between the above-mentioned network device and other devices.

The memory may include a random access memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-Volatile Memory, NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located far away from the aforementioned processor.

Above-mentioned processor can be general-purpose processor, comprises central processing unit (Central Processing Unit, CPU), network processor (Network Processor, NP) etc.; It can also be Digital Signal Processor (Digital Signal Processor, DSP), ASIC (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

In yet another embodiment provided by the present invention, a computer-readable storage medium is also provided, and a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, any of the above-mentioned message filtering method steps.

When the computer program provided by the embodiment of the present invention is used for message filtering, the network chip of the above-mentioned network device stores an SCL entry that records the correspondence between the IP address and the metadata identifier, and the IP address and the metadata identifier are realized through the SCL entry. Tight coupling between metadata identifiers. Therefore, the network device can determine the metadata identifier corresponding to the IP address based on the SCL entry, which is equivalent to adding a metadata identifier corresponding to the source IP address to the packet through the SCL entry. Matching makes it unnecessary to record the IP address in the prior art in the ACL entry for matching the message, but record the metadata identifier, and the length of the metadata identifier is less than the length of the IP address, so the present invention implements In the scheme provided by the example, the metadata identifier with a short length is recorded in the ACL entry, that is, the length of the ACL entry can be shortened through the scheme provided by the embodiment of the present invention, thereby saving ACL resources in the network chip and making the network device It can simultaneously provide network access services for a large number of user terminals.

In yet another embodiment provided by the present invention, a computer program product including instructions is also provided, and when it is run on a computer, it causes the computer to execute any packet filtering method in the above embodiments.

When the computer program product provided by the embodiment of the present invention is used for message filtering, the network chip of the above-mentioned network device stores an SCL entry that records the correspondence between the IP address and the metadata identifier, and the IP address is realized through the SCL entry. Tight coupling with metadata identification. Therefore, the network device can determine the metadata identifier corresponding to the IP address based on the SCL entry, which is equivalent to adding a metadata identifier corresponding to the source IP address to the packet through the SCL entry. Matching makes it unnecessary to record the IP address in the prior art in the ACL entry for matching the message, but record the metadata identifier, and the length of the metadata identifier is less than the length of the IP address, so the present invention implements In the scheme provided by the example, the metadata identifier with a short length is recorded in the ACL entry, that is, the length of the ACL entry can be shortened through the scheme provided by the embodiment of the present invention, thereby saving ACL resources in the network chip and making the network device It can simultaneously provide network access services for a large number of user terminals.

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present invention will be generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media. The available medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a Solid State Disk (SSD)).

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. There is no such actual relationship or order between them. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

Each embodiment in this specification is described in a related manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the apparatus, network equipment, computer-readable storage medium and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for relevant parts, please refer to the part of the description of the method embodiments.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.

Claims (10)

1. a message filtering method, it is characterized in that, be applied to network equipment, the target interface of described network equipment is configured with Internet Interconnection Protocol source protection IPSG function, is stored in the network chip in the described network equipment: record has The service classification table SCL entry of the corresponding relationship between the IP address and the metadata identifier and the access control list ACL entry recorded with the metadata identifier, wherein the length of the metadata identifier is less than the length of the IP address, and the method includes : After receiving the message through the target interface, search for the target SCL entry that records the source IP address of the message from the stored SCL entry; If the target SCL entry is found, adding the metadata identifier recorded in the target SCL entry to the message; Perform ACL entry matching on the packet based on the metadata identifier carried in the packet, and forward the packet when a target ACL entry recorded with the metadata identifier is matched. 2. The method according to claim 1, wherein metadata identifiers and media access control MAC addresses are recorded in the ACL entry, and the packet is identified based on the metadata identifier carried by the packet. Perform ACL entry matching, and forward the message if the target ACL entry recorded with the metadata identifier is matched, including: Based on the metadata identifier carried by the packet and the source MAC address of the packet, perform ACL entry matching on the packet, and when the target ACL table with the metadata identifier and the source MAC address is matched, In the case of the item, the message is forwarded. 3. The method according to claim 1, wherein the IP address recorded in the SCL entry includes an IPv4 address and an IPv6 address, wherein the SCL entry recorded with the IPv4 address is stored in the service classification hash table SCL In HASH1, the SCL entry that records the IPv6 address is stored in SCL HASH0. 4. The method according to any one of claims 1-3, wherein the ACL entry recorded with the metadata identifier occupies one ACL resource bit. 5. A message filtering device, characterized in that it is applied to network equipment, the target interface of the network equipment is configured with an Internet Protocol source protection IPSG function, stored in the network chip in the network equipment: the record has The service classification table SCL entry of the corresponding relationship between the IP address and the metadata identifier and the access control list ACL entry recorded with the metadata identifier, wherein the length of the metadata identifier is less than the length of the IP address, and the device includes : The SCL entry search module is used to search the stored SCL entry for the target SCL entry that records the source IP address of the message after receiving the message through the target interface; A tag adding module, configured to add the metadata identifier recorded in the target SCL entry to the message if the target SCL entry is found; The ACL entry matching module is configured to perform ACL entry matching on the packet based on the metadata identifier carried by the packet, and perform the ACL entry matching on the packet when the target ACL entry recorded with the metadata identifier is matched. Packets are forwarded. 6. The device according to claim 5, wherein metadata identifiers and media access control MAC addresses are recorded in the ACL entry, and the ACL entry matching module is specifically used for: Based on the metadata identifier carried by the packet and the source MAC address of the packet, perform ACL entry matching on the packet, and when the target ACL table with the metadata identifier and the source MAC address is matched, In the case of the item, the message is forwarded. 7. The device according to claim 5, wherein the IP address recorded in the SCL entry includes an IPv4 address and an IPv6 address, wherein the SCL entry recorded with the IPv4 address is stored in the service classification hash table SCL In HASH1, the SCL entry that records the IPv6 address is stored in SCL HASH0. 8. The device according to any one of claims 5-7, wherein the ACL entry recorded with the metadata identifier occupies one ACL resource bit. 9. A network device, characterized in that it includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory complete mutual communication through the communication bus; memory for storing computer programs; When the processor is used to execute the program stored in the memory, it realizes the method steps described in any one of claims 1-4. 10. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method steps of any one of claims 1-4 are implemented.

Images