Packet forwarding method, device, switch, apparatus, and storage medium

1. A method for packet forwarding, applicable to a switch, comprising:

obtaining a packet to be forwarded;

detecting whether a first data table contains connection cache information corresponding to the packet;

obtaining a first identifier of the connection cache information from the first data table if the first data table contains the connection cache information corresponding to the packet, wherein the first identifier is a first connection identifier corresponding to the connection cache information when the connection cache information is established;

obtaining connection information corresponding to the connection cache information from a second data table, and determining a second identifier of the connection cache information according to the connection information corresponding to the connection cache information, wherein the second identifier is a current connection identifier corresponding to the connection cache information and changes when the connection information changes; and

forwarding the packet based on the connection cache information if the second identifier is the same as the first identifier,

wherein the connection cache information corresponding to the packet comprises: a transmission path of the packet and identifiers of packet sending/receiving devices on the transmission path, and

wherein the connection information corresponding to the connection cache information comprises: connection identifiers of packet sending/receiving devices corresponding to the connection cache information, or connection identifiers of users corresponding to the connection cache information.

2. The method of claim 1 , further comprising:

obtaining a second connection identifier sent by a device with an updated configuration, wherein the device with the updated configuration is a packet sending/receiving device with the connection information changed; and

updating the second data table with connection information corresponding to the second connection identifier sent by the device with the updated configuration.

3. The method of claim 2 , further comprising:

deleting the connection cache information corresponding to the packet from the first data table if the second identifier is different from the first identifier;

obtaining a destination address of the packet and determining a transmission path for the packet according to the destination address;

using the transmission path for the packet as current connection cache information;

obtaining connection information corresponding to the current connection cache information from the second data table, and determining a third connection identifier for the current connection cache information according to the connection information corresponding to the current connection cache information;

using the third connection identifier for the current connection cache information as the first identifier of the current connection cache information, and recording the current connection cache information and the first identifier of the current connection cache information into the first data table; and

forwarding the packet according to the transmission path for the packet.

4. The method of claim 3 , wherein obtaining the destination address of the packet and determining the transmission path for the packet according to the destination address comprises:

performing a lookup on a MAC address table to determine path information for the packet if the destination address is in a same network segment as an address of the switch, wherein the path information comprises a forwarding address, the forwarding address being an address of a next-hop device for receiving the packet;

determining a device to be applied a security group rule according to the forwarding address in the path information, and applying the security group rule on the device; and

using the device as a receiver of the packet if the security group rule is matched, so as to determine the transmission path for the packet.

5. The method of claim 3 , wherein obtaining the destination address of the packet and determining the transmission path for the packet according to the destination address comprises:

performing a lookup on an access control list if the destination address is not in a same network segment as an address of the switch;

performing a lookup on a routing table and a neighbor table to determine path information for the packet when the access control list allows the packet to be forwarded, wherein the path information comprises a forwarding address, the forwarding address being an address of a next-hop device for receiving the packet;

determining a device to be applied a security group rule according to the forwarding address in the path information, and applying the security group rule on the device; and

using the device as a receiver of the packet if the security group rule is matched, so as to determine the transmission path for the packet.

6. The method of claim 1 , wherein obtaining the first identifier of the connection cache information from the first data table if the first data table contains the connection cache information corresponding to the packet comprises:

searching the first data table for a key corresponding to a five-tuple of the packet if the first data table contains the connection cache information corresponding to the packet, and using the key as a key of the packet;

obtaining a linked list head pointer at the key of the packet in the first data table in a form of Hash bucket; and

searching in a linked list pointed to by the linked list head pointer, to obtain the connection cache information and the first identifier of the connection cache information.

7. The method of claim 1 , further comprising:

obtaining a destination address of the packet if the first data table does not contain the connection cache information corresponding to the packet;

performing a lookup on a MAC address table to determine path information for the packet if the destination address is in a same network segment as an address of the switch, wherein the path information comprises a forwarding address, the forwarding address being an address of a next-hop device for receiving the packet;

determining a device to be applied a security group rule according to the forwarding address in the path information, and applying the security group rule on the device;

using the device as a receiver of the packet if the security group rule is matched, so as to determine the transmission path for the packet;

using the transmission path for the packet as current connection cache information;

obtaining connection information corresponding to the current connection cache information from the second data table, determining a fourth connection identifier for the current connection cache information, using the fourth connection identifier for the current connection cache information as the first identifier of the current connection cache information, and recording the current connection cache information and the first identifier of the current connection cache information into the first data table; and

forwarding the packet according to the transmission path for the packet.

8. The method of claim 1 , further comprising:

obtaining a destination address of the packet if the first data table does not contain the connection cache information corresponding to the packet;

performing a lookup on an access control list if the destination address is not in a same network segment as an address of the switch;

performing a lookup on a routing table and a neighbor table to determine path information for the packet when the access control list allows the packet to be forwarded, wherein the path information comprises a forwarding address, the forwarding address being an address of a next-hop device for receiving the packet;

determining a device to be applied a security group rule according to the forwarding address in the path information, and applying the security group rule on the device;

using the device as a receiver of the packet if the security group rule is matched, so as to determine a transmission path for the packet;

using the transmission path for the packet as current connection cache information;

obtaining connection information corresponding to the current connection cache information from the second data table, determining a fifth connection identifier for the current connection cache information, using the fifth connection identifier for the current connection cache information as the first identifier of the current connection cache information, and recording the current connection cache information and the first identifier of the current connection cache information into the first data table; and

forwarding the packet according to the transmission path for the packet.

9. An apparatus for packet forwarding, applicable to a switch, comprising:

a processor; and

a memory, configured to store instructions executable by the processor,

wherein the processor is configured to run a program corresponding to the instructions by reading the instructions stored in the memory, so as to perform operations comprising:

obtaining a packet to be forwarded;

detecting whether a first data table contains connection cache information corresponding to the packet;

obtaining a first identifier of the connection cache information from the first data table if the first data table contains the connection cache information corresponding to the packet, wherein the first identifier is a first connection identifier corresponding to the connection cache information when the connection cache information is established;

obtaining connection information corresponding to the connection cache information from a second data table, and determining a second identifier of the connection cache information according to the connection information corresponding to the connection cache information, wherein the second identifier is a current connection identifier corresponding to the connection cache information and changes when the connection information changes; and

forwarding the packet based on the connection cache information if the second identifier is the same as the first identifier,

wherein the connection cache information corresponding to the packet comprises: a transmission path of the packet and identifiers of packet sending/receiving devices on the transmission path, and

wherein the connection information corresponding to the connection cache information comprises: connection identifiers of packet sending/receiving devices corresponding to the connection cache information, or connection identifiers of users corresponding to the connection cache information.

10. The apparatus of claim 9 , wherein the operations further comprise:

obtaining a second connection identifier sent by a device with an updated configuration, wherein the device with the updated configuration is a packet sending/receiving device with the connection information changed; and

updating the second data table with connection information corresponding to the second connection identifier sent by the device with the updated configuration.

11. The apparatus of claim 10 , wherein the operations further comprise:

deleting the connection cache information corresponding to the packet from the first data table if the second identifier is different from the first identifier;

obtaining a destination address of the packet and determining a transmission path for the packet according to the destination address;

using the transmission path for the packet as current connection cache information, obtaining connection information corresponding to the current connection cache information from the second data table, and determining a third connection identifier for the current connection cache information according to the connection information corresponding to the current connection cache information;

using the third connection identifier for the current connection cache information as the first identifier of the current connection cache information, and recording the current connection cache information and the first identifier of the current connection cache information into the first data table; and

forwarding the packet according to the transmission path for the packet.

12. The apparatus of claim 11 , wherein the operations further comprise:

performing a lookup on a MAC address table to determine path information for the packet if the destination address is in a same network segment as an address of the switch, wherein the path information comprises a forwarding address, the forwarding address being an address of a next-hop device for receiving the packet;

determining a device to be applied a security group rule according to the forwarding address in the path information, and applying the security group rule on the device; and

using the device as a receiver of the packet if the security group rule is matched, so as to determine the transmission path for the packet.

13. The apparatus of claim 11 , wherein the operations further comprise:

performing a lookup on an access control list if the destination address is not in a same network segment as an address of the switch;

performing a lookup on a routing table and a neighbor table to determine path information for the packet when the access control list allows the packet to be forwarded, wherein the path information comprises a forwarding address, the forwarding address being an address of a next-hop device for receiving the packet;

determining a device to be applied a security group rule according to the forwarding address in the path information, and applying the security group rule on the device; and

using the device as a receiver of the packet if the security group rule is matched, so as to determine the transmission path for the packet.

14. The apparatus of claim 9 , wherein the operations further comprise:

searching the first data table for a key corresponding to a five-tuple of the packet if the first data table contains the connection cache information corresponding to the packet, and using the key as a key of the packet;

obtaining a linked list head pointer at the key of the packet in the first data table in a form of Hash bucket; and

searching in a linked list pointed to by the linked list head pointer, to obtain the connection cache information and the first identifier of the connection cache information.

15. The apparatus of claim 9 , wherein the operations further comprise:

obtaining a destination address of the packet if the first data table does not contain the connection cache information corresponding to the packet, wherein the destination address is an address of a destination of the packet;

performing a lookup on a MAC address table to determine path information for the packet if the destination address is in a same network segment as an address of the switch, wherein the path information comprises a forwarding address, the forwarding address being an address of a next-hop device for receiving the packet;

determining a device to be applied a security group rule according to the forwarding address in the path information, and applying the security group rule on the device;

using the device as a receiver of the packet if the security group rule is matched, so as to determine the transmission path for the packet;

using the transmission path for the packet as current connection cache information;

obtaining connection information corresponding to the current connection cache information from the second data table, determining a fourth connection identifier for the current connection cache information, using the fourth connection identifier for the current connection cache information as the first identifier of the current connection cache information, and recording the current connection cache information and the first identifier of the current connection cache information into the first data table; and

forwarding the packet according to the transmission path for the packet.

16. The apparatus of claim 9 , wherein the operations further comprise:

obtaining a destination address of the packet if the first data table does not contain the connection cache information corresponding to the packet, wherein the destination address is an address of a destination of the packet;

performing a lookup on an access control list if the destination address is not in a same network segment as an address of the switch;

performing a lookup on a routing table and a neighbor table to determine path information for the packet when the access control list allows the packet to be forwarded, wherein the path information comprises a forwarding address, the forwarding address being an address of a next-hop device for receiving the packet;

determining a device to be applied a security group rule according to the forwarding address in the path information, and applying the security group rule on the device;

using the device as a receiver of the packet if the security group rule is matched, so as to determine a transmission path for the packet;

using the transmission path for the packet as current connection cache information;

obtaining connection information corresponding to the current connection cache information from the second data table, determining a fifth connection identifier for the current connection cache information, using the fifth connection identifier for the current connection cache information as the first identifier of the current connection cache information, and recording the current connection cache information and the first identifier of the current connection cache information into the first data table; and

forwarding the packet according to the transmission path for the packet.