WO2016037490A1 - 一种动态主机配置协议dhcp消息的处理方法及装置 - Google Patents

一种动态主机配置协议dhcp消息的处理方法及装置 Download PDF

Info

Publication number
WO2016037490A1
WO2016037490A1 PCT/CN2015/078990 CN2015078990W WO2016037490A1 WO 2016037490 A1 WO2016037490 A1 WO 2016037490A1 CN 2015078990 W CN2015078990 W CN 2015078990W WO 2016037490 A1 WO2016037490 A1 WO 2016037490A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
relay
dhcp
forwarding
exception
Prior art date
Application number
PCT/CN2015/078990
Other languages
English (en)
French (fr)
Inventor
黄志忠
田永江
隆春
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016037490A1 publication Critical patent/WO2016037490A1/zh

Links

Images

Definitions

  • This document relates to the field of communication technologies, and in particular, to a method and a device for processing a dynamic host configuration protocol DHCP message.
  • DHCPv6 Dynamic Host Configuration Protocol for IPv6
  • IPv6 address allocation methods manual configuration, stateless autoconfiguration through network prefix in router advertisement messages, etc.
  • DHCPv6 has an IPv6 address, IPv6 prefix, and other network configuration parameters.
  • DHCPv6 specifies a technical mechanism for transmitting IPv6 configuration information for users in a TCP/IP network
  • DHCPv6 does not provide a method for processing unknown message packets, and it is not clear when the DHCPv6 relay agent receives an unknown message.
  • a DHCPv6 message should be forwarded to the server or the client. Therefore, when an unknown type of DHCPv6 message is generated, the DHCPv6 relay agent may improperly discard these messages or cause other DHCPv6 relays. The agent improperly processes these messages to increase the load on the relay agent.
  • the related technology does not provide a method for quickly sensing, tracking, and obtaining the abnormal message of the DHCPv6 relay or the server abnormal packet. .
  • the technical problem to be solved by the embodiment of the present invention is to provide a method and a device for processing a DHCP message abnormality of a dynamic host configuration protocol, which solves the problem that the DHCPv6 protocol cannot correctly process an unknown type of DHCPv6 message in the related art.
  • the embodiment of the present invention provides a method for processing a dynamic host configuration protocol DHCP message, which is applicable to a DHCP relay agent, and includes:
  • the received DHCP message is an abnormal DHCP message
  • the abnormal type value of the abnormal DHCP message is obtained.
  • the configuring the first forwarding path for the DHCP packet, and generating the first relay forwarding message includes:
  • the hop count in the first relay forwarding message is set to zero.
  • the method further includes: when the relay agent cannot use the address in the link address field to identify the interface, in the option field of the first relay forwarding message, the ID option of the interface, and the first The link address field of the relayed message is set to 0.
  • the abnormal DHCP message includes:
  • the relay agent can identify the type of the DHCP message, but cannot determine the predetermined target of the DHCP message, or the relay agent cannot identify the type of the DHCP message;
  • the exception type value is included in an exception option field of a relay message option of the first relay forwarding message.
  • the method further includes:
  • the relayed message is obtained from the relay response message, and the relay message includes at least the abnormal type value;
  • the relay message option includes an interface ID option and the link address field in the relay response message is set to 0, then the second middle is sent on the link identified by the interface ID option. Following forwarding the message to the second forwarding path;
  • the second relay forwarding message is sent to the second forwarding path on the link identified by the link address field.
  • the embodiment of the invention further provides a method for processing a dynamic host configuration protocol DHCP message, which is applicable to a DHCP server, and includes:
  • the abnormal DHCP message and its abnormal type value are obtained from the relay forwarding message, and a first relay response message is generated;
  • the first relay response message includes a relay message option, where the relay message option includes the exception option field; when the received relay forwarding message includes an interface ID option, The relay message option also includes the interface ID option.
  • the relay message option of the first relay response message further includes a server response message.
  • the DHCP server After the DHCP server generates the first relay response message, deleting the abnormal DHCP Message.
  • the embodiment of the invention further provides a method for processing a dynamic host configuration protocol DHCP message, which is applicable to a client, and includes:
  • An exception report is generated based on the exception type value.
  • the method further includes:
  • the relay forwarding message is deleted; and the abnormality report is displayed on the client.
  • the embodiment of the invention further provides a device for processing a dynamic host configuration protocol DHCP message, which is applicable to a DHCP relay agent, and includes:
  • the first receiving module is configured to receive a DHCP packet, and determine whether the DHCP packet is an abnormal DHCP packet.
  • the first obtaining module is configured to acquire the abnormal DHCP message and its abnormal type value when the DHCP message is an abnormal DHCP message;
  • the first configuration generation module is configured to configure the first forwarding path of the abnormal DHCP message, and generate a first relay forwarding message, where the first relay forwarding message includes an exception option field;
  • the first sending module is configured to send the first relay forwarding message to the DHCP server according to the first forwarding path.
  • the first configuration generation module is configured to:
  • the hop count in the first relay forwarding message is set to zero.
  • the first configuration generating module is further configured to: when the relay agent cannot use the address identifier interface in the link address field, in the option field of the first relay forwarding message, the interface ID option and set the link address field of the first relay forwarded message to 0.
  • the abnormal DHCP message includes:
  • the relay agent can identify the type of the DHCP message, but cannot determine the predetermined target of the DHCP message, or the relay agent cannot identify the type of the DHCP message;
  • the exception type value is included in an exception option field of a relay message option of the first relay forwarding message.
  • the device further includes:
  • a second receiving module configured to receive a relay response message from the DHCPv6 server, and determine whether the relay response message includes an exception option field
  • a second acquiring module configured to: when the received relay response message includes an exception option field, obtain a relay message from the relay response message, where the relay message includes at least the abnormal type value;
  • a second configuration generating module configured to generate a second relay forwarding message according to the relay packet, and configure a second forwarding path, where the second relay forwarding message includes at least an exception option field, and the exception option
  • the field includes an exception option code and the exception type value.
  • the second sending module is configured to send the second relay forwarding message to the client or the upper relay agent according to the second forwarding path.
  • the second configuration generation module is further configured to:
  • the second relay forwarding message is sent to the second forwarding path on the link identified by the link address field.
  • the device further includes:
  • the first deleting module is configured to delete the first relay response message after acquiring the relay message from the relay response message and generating a second relay forwarding message.
  • the embodiment of the invention further provides a device for processing a dynamic host configuration protocol DHCP message, which is applicable to a server, and includes:
  • a third receiving module configured to receive a relay forwarding message from the relay agent, and determine whether the relay forwarding message includes an exception option field
  • the third obtaining module is configured to: when the relay forwarding message includes an exception option field, obtain an abnormal DHCP message and an abnormal type value thereof;
  • a third configuration generation module configured to generate a first relay response message for the relay forwarding message, where the relay response message includes at least the exception option field;
  • a third sending module configured to send the relay response message to the relay agent.
  • the third configuration generation module is configured to:
  • the third configuration generation module is further configured to:
  • the server response message is also included in the relay message option of the first relay response message.
  • the device further includes a third deleting module, configured to delete the abnormal DHCP message after generating the first relay response message.
  • the embodiment of the invention further provides a device for processing a dynamic host configuration protocol DHCP message, which is applicable to a client, and includes:
  • a fourth receiving module configured to receive a relay forwarding message from the relay agent, and determine whether the relay forwarding message includes an exception option field
  • a fourth acquiring module configured to acquire an abnormal type value of the abnormal DHCP message when the relay forwarding message includes an exception option field
  • a fourth generation module configured to generate an exception report according to the exception type
  • a display module configured to display the exception report.
  • the device further includes a fourth deleting module, configured to delete the relay forwarding message after acquiring the abnormal type value.
  • a fourth deleting module configured to delete the relay forwarding message after acquiring the abnormal type value.
  • the embodiment of the present invention further provides a computer readable storage medium, where the storage medium stores a computer program, where the computer program includes program instructions, when the program instruction is executed by a DHCP relay agent device, enabling the device to perform the above dynamic Host configuration protocol DHCP message processing method.
  • the embodiment of the present invention further provides a computer readable storage medium, where the storage medium stores a computer program, the computer program includes program instructions, when the program instruction is executed by a DHCP server device, enabling the device to perform the dynamic host configuration. Protocol DHCP message processing method.
  • An embodiment of the present invention further provides a computer readable storage medium, where the storage medium stores a computer program, the computer program includes program instructions, when the program instruction is executed by a client device, enabling the device to execute the dynamic host Configure the processing method of the protocol DHCP message.
  • the relay agent when the relay agent receives the abnormal DHCPv6 message, sends the abnormal DHCPv6 message to the DHCPv6 server for processing by using the first relay forwarding message and the configured first forwarding path. It is avoided that the DHCPv6 relay agent does not know how to process the message and improperly discards the message, or improperly processes the message to increase the burden on the relay agent.
  • the client can also find abnormal DHCPv6 messages in time. Or counterfeit the attack packets sent by the client, and take timely measures to effectively improve the security and stability of the system.
  • FIG. 1a is a schematic diagram of a working process of a related art DHCPv6 relay agent
  • FIG. 1b is a schematic structural diagram of a DHCPv6 relay message according to the related art
  • FIG. 1c is a schematic diagram of a DHCPv6 message option field in the related art
  • FIG. 1d is a schematic diagram of a relay option field of a related art DHCPv6 relay forwarding message
  • FIG. 2 is a schematic flowchart of a DHCPv6 relay agent forwarding an abnormal DHCPv6 message to a DHCPv6 server according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a DHCPv6 server responding to a DHCPv6 relay forwarding packet containing an abnormal field to a DHCPv6 relay agent according to an embodiment of the present invention
  • FIG. 4 is a schematic flowchart of a DHCPv6 client receiving a relay forwarding packet including an abnormal field according to an embodiment of the present invention
  • FIG. 5 is a schematic diagram of a DHCPv6 relay agent according to an exemplary embodiment of the present invention relaying an abnormal DHCPv6 message to a DHCPv6 server.
  • FIG. 6 is a relay forwarding message constructed by a DHCPv6 server according to an exemplary embodiment of the present invention in response to a relay agent.
  • FIG. 7 is a schematic diagram of a DHCPv6 relay agent according to an exemplary embodiment of the present invention relaying an abnormal relay response message to a client.
  • FIG. 8 is a schematic diagram of a fourth embodiment of the present invention for receiving a abnormal relay forwarding message from a DHCPv6 relay agent.
  • FIG. 9 is a schematic structural diagram 1 of a processing apparatus for processing an abnormality of a dynamic host configuration protocol DHCPv6 message according to an embodiment of the present invention, which is applicable to a relay agent;
  • FIG. 10 is a schematic structural diagram of a processing device for processing a DHCPv6 message abnormality of a dynamic host configuration protocol according to an embodiment of the present invention, which is applicable to a relay server;
  • FIG. 11 is a schematic structural diagram 3 of a device for processing an abnormality of a dynamic host configuration protocol DHCPv6 message according to an embodiment of the present disclosure, which is applicable to a client.
  • FIG. 1a is a schematic diagram of a DHCPv6 relay working process of the related art, as shown in FIG. 1.
  • the processing mode of the DHCPv6 client and the DHCPv6 server is basically the same as that of the DHCPv6 relay.
  • Figure 1 only illustrates the forwarding process of the DHCPv6 relay:
  • Step 101 The DHCPv6 client sends a request to the multicast address FF02::1:2 of all DHCPv6 servers and relays;
  • Step 102 After receiving the request, the DHCPv6 relay is encapsulated in a relay message option (Relay Message Option) of the relay-forward message, and sends the Relay-forward message to the DHCPv6 server.
  • a relay message option Relay Message Option
  • Step 103 The DHCPv6 server parses the request of the client from the Relay-forward message, selects an IPv6 address and other parameters for the client, constructs a response message, and encapsulates the response message in a relay-reply message relay. In the message option, the Relay-reply message is sent to the DHCPv6 relay.
  • Step 104 The DHCPv6 relay parses the response of the server from the Relay-reply message and forwards it to the DHCPv6 client.
  • the DHCPv6 client performs network configuration according to the IPv6 address/prefix and other parameters allocated by the DHCPv6 server.
  • the DHCPv6 relay resolves the response of the server from the relay-reply packet and forwards it to the server. State the first level relay.
  • Figure 1b is a schematic structural diagram of a DHCPv6 relay packet of the related art; as shown in Figure 1b, including:
  • Hop count indicates the number of relay agents that have received this message. If the set hop count maximum is exceeded, the receiving relay agent can discard this message.
  • Link Address A non-link local address that contains an interface assigned to a relay agent in the subnet where the client is located. Based on the link address, the server can determine the bucket address in the IPv6 range for assigning the address.
  • Peer Address Contains the client IPv6 address from which this message was sent or the IPv6 address of the relay agent that forwarded this message.
  • the Relay Messages option contains the messages to be relayed and other relay options.
  • the "relay message” option encapsulates the DHCPv6 message exchanged between the client and the server.
  • FIG. 1c is a schematic diagram of a DHCPv6 message option field of the related art; as shown in FIG. 3, including an option code, an option length, and option data. among them,
  • Option Code Indicates the type of DHCPv6 option.
  • Option length Indicates the number of bytes in the option data field.
  • Option data Data that contains options, the format of which depends on the definition of the option.
  • Figure 1d is a schematic diagram of a relay message field of a DHCPv6 relay-backed packet of the related art, as shown in Figure 1d, including:
  • Option length the length of the DHCP relay message
  • the received message is placed in the relay-forward relay-message option and is relayed verbatim to the next relay agent or server;
  • the message copied and relayed to the relay agent or client is also placed in the relay-reply relay-message option, the address of the relay agent or client is at the opposite end of the Relay-reply message. - in the address field.
  • the relay agent relays messages to the server and the client respectively according to the message type, wherein the Relay-reply message sent by the server is sent to the client or other relay agent, and the relay agent Forwarding Relay-forward messages and other types of messages are sent to the server.
  • a destination address is specified in the relay-reply message sent by the server.
  • the relay agent parses the response message from the server from the relay-reply message and forwards it to the corresponding DHCPv6 client or other relay agent.
  • the related art does not explain how the DHCPv6 message should be handled if the relay agent receives an abnormality.
  • the abnormal packet received by the relay agent may come from the client or an attack packet from a client, or it may be an unexpected error of the relay message of other relay agents.
  • the embodiment of the invention provides a method and a device for processing an abnormality of a dynamic host configuration protocol DHCPv6 message.
  • the embodiment of the present invention stipulates that the following message belongs to a valid message:
  • the relay agent can identify the type of DHCPv6 message received, but cannot determine the intended destination of the message;
  • the relay agent does not recognize the received DHCPv6 message type.
  • abnormal DHCPv6 messages For the DHCPv6 protocol of the related art, the above two types of packets are abnormal DHCPv6 messages. For the convenience of description, they are defined as "abnormal DHCPv6 messages" in the embodiment of the present invention.
  • the basic idea of the embodiment of the present invention is that when the relay agent receives the abnormal DHCPv6 message, it constructs a relay forwarding message for them, and forwards the abnormal DHCPv6 message to the DHCPv6 server for processing.
  • the exception option field is added, so that when the DHCPv6 server receives the relay forwarding message, the corresponding processing is performed to alleviate the processing burden when the relay agent and/or the server receives the abnormal packet, and the processing is guaranteed.
  • an exception type value is carried.
  • the DHCPv6 server when the DHCPv6 server receives the relay forwarding message configured as described above, it can identify that the received relay forwarding message includes an exception option field, and then parse the abnormal type of the abnormal DHCPv6 message to generate a relay response message.
  • the exception option field is included in the corresponding relay response message of the DHCPv6, so that the relay agent recognizes and forwards the client or other relay to perform corresponding processing.
  • the exception option field may directly copy the exception option field in the relay forwarding message, including the exception type value, so that the client understands the nature of the abnormal message and takes corresponding countermeasures. In this way, the client can discover abnormal packets in the DHCPv6 system in time to prevent malicious attacks by hackers.
  • FIG. 2 is a schematic diagram of a method for processing an abnormality of a DHCPv6 message in a dynamic host configuration protocol according to the first embodiment of the present invention; as shown in FIG. 2, the method is applicable to a DHCPv6 relay, and includes:
  • Step 20 Receive a packet, and determine whether the received packet belongs to an abnormal DHCPv6 packet.
  • Step 21 When the received packet is an abnormal DHCPv6 packet, the abnormal DHCPv6 packet is obtained, and the type of the abnormality is determined.
  • determining whether the received packet belongs to an abnormal DHCPv6 packet includes determining whether the received packet belongs to one of the following situations:
  • the relay agent can identify the type of the received message, but cannot determine the intended destination of the message; or
  • the packet type is not recognized, but the link address and the client address are normal.
  • the packet may be an error packet from the client or an attack packet from the client.
  • thirteen types of messages such as requirements, announcements, requests, acknowledgments, updates, rebinds, replies, advertises, rejects, reconfigures, information requests, relays, and relay replies, are defined. All other message types belong to the unrecognized message type.
  • the exception information field is included in addition to the abnormal DHCPv6 message, so that the DHCPv6 server performs identification and processing.
  • the exception option field includes an option code and an exception type value.
  • Step 22 Configure a first forwarding path for the abnormal DHCPv6 message, and generate a first relay forwarding message, and add an exception option field to the first relay forwarding message.
  • the step of configuring the first forwarding path for the abnormal DHCPv6 message and generating the first relay forwarding message includes:
  • the relay agent must include the interface ID (Interface-ID) in the relay-forward message.
  • the interface ID option is included in an option field of the relayed message, and the link address field of the first relay forwarded message is set to zero.
  • the server receives the first relay forwarding message, the corresponding Relay-reply message generated will also include the Interface-ID option.
  • Step 23 Send the first relay forwarding message to the DHCPv6 server according to the first forwarding path.
  • the method for processing the DHCPv6 message abnormality of the dynamic host configuration protocol is provided by the embodiment of the present invention.
  • the relay agent When receiving the packet, the relay agent first determines whether the received packet belongs to the abnormal DHCPv6 packet defined by the embodiment of the present invention.
  • the abnormal DHCPv6 message defined by the embodiment the abnormal DHCPv6 message is obtained, and the abnormal type of the packet is determined, and a forwarding path is configured for the abnormal DHCPv6 message, and a relay forwarding message is generated, and the abnormal DHCPv6 message is passed.
  • the constructed relay forwarding message is sent to the DHCPv6 server for processing, which avoids how the DHCPv6 relay agent (DHCPv6 relay/DHCP relay agent/DHCP relay/relay agent/relay) does not know how to process the message.
  • the message is improperly discarded, or causes other DHCPv6 relay agents to improperly process the message to increase the relay agent load, thereby effectively improving the security and stability of the system.
  • the method further includes:
  • Step 24 Receive a relay-reply message returned by the server, and determine whether the received relay response message includes an exception option field.
  • Step 25 When the received relay response message includes an exception option field, parse the relay response message, obtain a server response message, and generate a second relay forwarding message, where the server response message includes at least an exception option. A field that includes the exception option field in the generated second forwarded message.
  • the exception option field is added in a relay message option of the generated second relay forwarding message, where the exception option field includes an option code and an exception type value;
  • the server responds to the message content, and according to the source of the abnormal packet of the configured relay forwarding message, if the abnormal DHCPv6 packet is forwarded from the upper-level relay, A corresponding server response message for the message may be included.
  • Step 26 Send the second relay forwarding message.
  • the second relay when the peer address of the received relay response message is a client, the second relay is turned Sending a message to the client;
  • the second relay forwarding message is sent to the upper relay agent.
  • the embodiment of the present invention further provides a method for processing a DHCPv6 message abnormality of a dynamic host configuration protocol, as shown in FIG. 3, which is applicable to a DHCPv6 server, and includes:
  • Step 30 Receive a relay forwarding message from the relay agent, and determine whether the relay forwarding message includes an exception option field.
  • Step 31 When the received relay forwarding message includes an exception option field, parse the relay forwarding message to obtain an abnormal type value.
  • Step 32 Generate a first relay response message for the relay forwarding message, and add an exception option field to the first relay response message.
  • the exception option field includes an option code and an exception type value
  • the server must record the content of the peer-address field in the received relay-forwarding message and the interface ID option included in the relay option to generate a first relay reply message;
  • the server may directly discard the abnormal type value and the address and link parameters of the first relay response message.
  • the server acquires the abnormal type value and the address of the first relay response message.
  • a corresponding server response needs to be generated for the DHCPv6 message forwarded by the upper-level intermediate agent, and the exception option field and the server response are included in the relay of the first relay response message. In the message options.
  • the exception option field is appended to the outermost relay message option of the first relay reply message.
  • the Relay-forward contains the exception option word because the server receives the relay agent configuration forwarding. Segment, the server must record the contents of the peer-address field in the received relay-forwarded message so that it can construct the appropriate Relay-reply message carrying the response from the server.
  • the server will further forward the relay reply message in addition to the hop count, link-address, and peer-address of the relay forwarded message.
  • the Interface-ID option and the exception option field are included in the relay-message option of the reply message.
  • Step 33 Send the first relay response message to the relay agent.
  • the method for processing the dynamic host configuration protocol DHCPv6 message exception provided by the embodiment of the present invention enables the server to explicitly process an unknown type of DHCPv6 message, which saves time and reduces the probability of failure.
  • the embodiment of the present invention further provides a method for processing a DHCPv6 message abnormality of a dynamic host configuration protocol, as shown in FIG. 4, which is applicable to a client, and includes:
  • Step 40 Receive a relay forwarding message from the relay agent, and determine whether the relay forwarding message includes an exception option field.
  • Step 41 When the received relay forwarding message includes an exception option field, obtain an abnormal type value of the abnormal DHCPv6 message from the relay forwarding message.
  • Step 42 Generate an exception report according to the abnormal type value.
  • Step 43 Display the exception report on the client.
  • the method for processing the DHCPv6 message abnormality of the dynamic host configuration protocol enables the client to obtain the current DHCPv6 server or the relay agent in real time by analyzing the abnormal type of the DHCPv6 message packet, thereby implementing corresponding security.
  • the policy is to reduce the occurrence of various attacks during the processing of DHCPv6 message packets.
  • the client after the client obtains the abnormal type value, the client directly deletes the relay forwarding message.
  • the dynamic host configuration protocol provided by the embodiment of the present invention is combined with an exemplary embodiment.
  • the processing method of the DHCPv6 message exception is specifically described.
  • the corresponding processing method needs to be added on the DHCPv6 relay, the DHCPv6 server, and the DHCPv6 client, respectively, based on the original DHCPv6 protocol.
  • the DHCPv6 relay agent relays an abnormal DHCPv6 message to the DHCPv6 server. As shown in Figure 5.
  • the relay agent receives the abnormal message, including:
  • the relay agent can identify the type of the received message, but cannot determine the intended destination of the message;
  • the relay agent does not recognize the type of the received message.
  • the relay agent receives the abnormal packet, which may come directly from the client or the counterfeit client, or it may come from the upper-level relay agent.
  • the relay agent may discover the abnormal packet from the client or the counterfeit client at the first time, and directly send the message to the server for processing by constructing the relay forwarding message.
  • the abnormal packet of the proxy is generally abnormal during the transmission process of the relay agent to the relay agent, and the relay packet of the relay forwards the packet (from the client or another superior relay) Agent) is a normal message.
  • the received message needs to be judged, including:
  • Step 50 Receive a packet from a client or a relay agent at a higher level
  • Step 51 Determine whether the received packet belongs to an abnormal DHCPv6 packet.
  • a relay-forward message is constructed in the following manner, and the abnormal DHCPv6 message is forwarded to the DHCPv6 server for processing.
  • Step 52 The relay agent configures a first forwarding path for the abnormal DHCPv6 message, and generates a first relay forwarding message.
  • Step 521 Set a hop count in the first relay forwarding message to 0;
  • Step 522 According to the received global address or site-wide address and prefix of the DHCPv6 message Obtaining a path message; filling the path message into a link address field of the first relay forwarding message; or
  • Step 523 If the relay agent cannot use the address in the link address field to identify the interface through which the received message is relayed, the relay agent must be in the option field of the constructed relay forwarding Relay-forward message.
  • the Interface-ID option is included, and the link address field of the first relay forwarding message is set to 0.
  • the server When the server receives the first relay forwarding message, the corresponding Relay-reply message generated will also include the Interface-ID option.
  • Step 53 Fill in the abnormal DHCPv6 message and the exception option field into an option field of the first relay forwarding message.
  • the abnormal DHCPv6 message is added to the Options option of the constructed relay forwarding message, and an exception option field is added; the exception option field includes an option code and an exception type value.
  • the specific value can be set according to your own needs, as long as it does not overlap with the option code specified by the existing DHCPv6 protocol, for example, it can be set to AA.
  • the value of the exception type can be represented by 1 bit. For example, 0 indicates the a) abnormal message and the 1 indicates the b) abnormal message.
  • Step 54 Send the first relay forwarding message to the DHCPv6 server according to the first forwarding path.
  • Embodiment 2 The DHCPv6 server responds to a DHCPv6 relay forwarding message, as shown in FIG. 6, and includes:
  • Step 61 The DHCPv6 server receives the relay agent to forward the relay message.
  • Step 62 Determine whether the received relay forwarding message includes an exception field.
  • Step 63 If the received relay forwarding message includes an exception field, parse the relay forwarding message to obtain an abnormal type value. After acquiring the corresponding peer address and link parameters, generate a first relay response message.
  • the first relay response message includes at least an exception option field (including an exception code and an abnormal type value), and is carried in a relay message (relay-message) of the first relay response message.
  • exception option field including an exception code and an abnormal type value
  • the abnormal DHCPv6 message received by the relay agent may come from the client or the counterfeit client, or may be from the upper-level proxy. Therefore, the relay response message generated by the server includes the exception type field. It may also include a response message from the server to the normal DHCPv6 message contained in the relayed message.
  • the packet is directly discarded.
  • the exception option field is included, and the abnormal DHCPv6 response is not required; if the abnormal DHCPv6 message in the relay forwarding message received by the server containing the exception option field is from the upper relay
  • the DHCPv6 message text forwarded by the relay forwarding packet may be a normal packet, and an address error occurs during the relay forwarding process. Therefore, after the server parses the relay forwarding message, the server may The message responds normally and places the response message along with the exception option field in the Relay Message Options field of the generated Relay Reply message.
  • the relay response message generated by the server reaches the relay agent, it can be determined whether it is directly sent to the client or sent to the upper-level proxy according to the content of the relay message of the relay response message.
  • the server parses the relay forwarding message, it finds that the relay packet belongs to the two abnormal packets mentioned above, and can directly discard the packet without generating a server response message.
  • the relay response message generated by the server includes only the exception option field, and does not include other response content; after receiving the relay response message, the relay agent parses and sends the message to the level until the abnormal option field is sent. The client handles it.
  • the relay message of the relay response message also needs to include the Interface-ID option.
  • the server receives a Relay-forward message containing an exception option field. Relaying the message, the server will use the relay reply message to return the response to the relay agent; the server must record the contents of the peer-address field in the received relay-forward message so that it can construct the appropriate Relay carrying the response from the server- Reply message.
  • the server will include the Interface-ID option in its relay reply, message; the Interface-ID option is included with the exception option field. In the relay-message option of the relay reply message.
  • the DHCPv6 server needs to obtain the abnormal type value of the abnormal DHCPv6 from the relay forwarding message, and also includes a corresponding exception option field (an exception option code and an exception type value) in the generated response message, the abnormal type value. The same as the value of the exception type in the received relayed message.
  • Step 64 Send the first relay response message to the relay agent.
  • Embodiment 3 The DHCPv6 relay agent relays a message to the client, as shown in FIG. 7. include:
  • Step 71 The DHCPv6 relay agent receives a relay-reply message from the server.
  • Step 72 Determine whether the received relay response message includes an exception option field.
  • the message is processed as follows:
  • Step 73 After the relay agent obtains the Relay Message option and the necessary address (such as the address in the header of the response message) and the network parameters from the received relay response message, the other options are discarded.
  • Step 731 The relay agent extracts the exception type value from the Relay Message option, and forwards the exception type to the address contained in the peer-address field in the relay response message format.
  • Step 732 If the relay reply message includes the Interface-ID option and the link address field is set to 0, the relay agent relays the message and processing from the server to the client on the link identified by the Interface-ID option. After getting the content.
  • Step 733 If the relay response message includes an Interface-ID option, and the link address field is not set to 0, the relay agent relays the message and the processed content on the link identified by the link-address field. (The link address field has a higher priority than the interface-ID).
  • Embodiment 4 The client receives a relay forwarding message from DHCPv6. As shown in Figure 8, it includes:
  • Step 81 The client receives a relay forwarding message from the relay agent.
  • Step 82 Determine whether the relay forwarding message includes an exception option field.
  • Step 83 When the received relay forwarding message includes an exception option field, obtain an abnormal type value of the abnormal DHCPv6 packet from the relay forwarding message.
  • Step 84 Generate an exception report according to the abnormal type value.
  • Step 85 Display the exception report on the client.
  • the client can directly discard the relay forwarding message after receiving the exception type value, and the abnormality report is displayed on the client, so that the client dynamically obtains the current DHCPv6 server or relay. Whether there is a risk, and accordingly implement a corresponding security policy to reduce the occurrence of various attacks in the process of DHCPv6.
  • the embodiment of the present invention further provides a processing device for a dynamic host configuration protocol DHCPv6 message exception, which is applicable to a DHCPv6 relay agent side, including a processor, a program storage device, and a data storage device, as shown in FIG. ,Also includes:
  • the first receiving module 901 is configured to receive a DHCPv6 message, and determine whether the received DHCPv6 message is an abnormal DHCPv6 message;
  • the first obtaining module 902 is configured to acquire an abnormal type of the abnormal DHCPv6 message when the received DHCPv6 message is an abnormal DHCPv6 message;
  • the first configuration generation module 903 is configured to configure the first forwarding path of the abnormal DHCPv6 message, and generate a first relay forwarding message.
  • the first sending module 904 is configured to send the first relay forwarding message to the DHCPv6 server according to the first forwarding path.
  • the device for processing the DHCPv6 message abnormality of the dynamic host configuration protocol obtains the abnormal type of the abnormal DHCPv6 message and determines the abnormal DHCPv6 message when the received DHCPv6 message belongs to the abnormal DHCPv6 message. Configure a forwarding path and generate a relay forwarding message. The abnormal DHCPv6 message is sent to the DHCPv6 server through the forwarding path. This prevents the DHCPv6 relay agent from being illegible, and the packet is discarded. Or cause other DHCPv6 relay agents to improperly process the message to increase the relay agent load, which effectively improves the security and stability of the system.
  • the abnormal DHCPv6 message includes:
  • the relay agent can identify the type of the DHCPv6 message, but cannot determine the predetermined target of the DHCPv6 message, or the relay agent cannot identify the type of the DHCPv6 message.
  • the first configuration generating module 903 is configured to: set a hop count in the first relay forwarding message to 0, and obtain a path message according to a global address or a site range address and a prefix; according to the path message and the The abnormal DHCPv6 message and the exception type generate a first relay forwarding message.
  • an interface ID option is included in the first relay forwarding message. If the relay agent cannot use the address in the link address field to identify the interface through which the response to the client is relayed, the relay agent must include the Interface-ID option in the relayed message. The server will include the Interface-ID option in its relay reply message.
  • the first configuration generating module 903 is configured to fill the path message into the link address field of the first relay forwarding message, and fill in the abnormal DHCPv6 message and the abnormal type. In the option field of the first relay forwarding message.
  • the second receiving module 905 is configured to receive a relay response message from the DHCPv6 server, and determine whether the relay response message includes an exception option field.
  • the second obtaining module 906 is configured to: when the received relay response message includes an exception option field, obtain an exception type and a server response message from the relay response message;
  • the second generation module 907 is configured to generate a second relay forwarding message according to the abnormality type and the server response message, and configure a second forwarding path, where the second relay forwarding message includes at least an exception option field (an exception option) Code and exception type values);
  • the second sending module 908 is configured to send the second relay forwarding message to the client or the upper relay agent.
  • the second relay forwarding message is sent to the client;
  • the second relay forwarding message is sent to the upper relay agent.
  • the second configuration generation module 907 is configured to:
  • the second relay is sent on the link identified by the link address field Forwarding the message to the second forwarding path.
  • the processing apparatus further includes: a first deleting module 909, configured to acquire the abnormal type and a relay message option. After the content, the other content of the relay response message is deleted.
  • the link address field has a higher priority than the interface ID. Therefore, in the processing device provided by the embodiment of the present invention, the second sending module is configured to be the first relay.
  • the response message includes an interface ID option and a link address field in the first relay response message Set to 0, the second relay forwarding message is sent to the second forwarding path on the link identified by the interface ID option; if the link address field in the first relay response message is not When set to 0, the second relay forwarding message is sent to the second forwarding path on the link identified by the link address field.
  • the embodiment of the present invention further provides a processing device for a dynamic host configuration protocol DHCPv6 message exception, which is applicable to a DHCPv6 server, including a processor, a program memory, and a data storage.
  • a processing device for a dynamic host configuration protocol DHCPv6 message exception which is applicable to a DHCPv6 server, including a processor, a program memory, and a data storage.
  • the method further includes:
  • the third receiving module 1001 is configured to receive a relay forwarding message from the relay agent, and determine whether the relay forwarding message includes an exception option field;
  • the third obtaining module 1002 is configured to: when the relay forwarding message includes an exception option field, obtain an exception option field and necessary address and link parameter information from the relay forwarding message; and an abnormal DHCPv6 message.
  • the third configuration generation module 1003 is configured to generate a first relay response message for the relay forwarding message, and configure a forwarding path, where the relay message of the relay response message includes at least the exception option field (anomaly option) Code and exception type values);
  • the relay message of the first relay response message may further include other response messages of the server;
  • the server parses the relay forwarding message that contains the exception option field, if the abnormal DHCPv6 message contained in the relay packet of the relay forwarding message is from the client or the counterfeit client, the abnormal DHCPv6 is directly discarded. a packet; if the abnormal DHCPv6 message included in the relay message of the relay forwarding message is from the upper relay agent, and the DHCPv6 message forwarded by the upper relay agent is a normal message, the server Corresponding normal response is performed, and the content of the server response message is included in the relay message of the first relay response message together with the exception option field.
  • the exception option field is appended to the outermost relay message option of the first relay reply message.
  • the third sending module 1004 is configured to send the relay response message to the relay agent.
  • the processing device provided by the embodiment of the present invention further includes: a third deleting module 1405, configured to acquire the abnormal option field and generate address information of the relay response message, in order to save the storage space of the server and improve the running efficiency. After that, the relay forwarding message is deleted.
  • a third deleting module 1405 configured to acquire the abnormal option field and generate address information of the relay response message, in order to save the storage space of the server and improve the running efficiency. After that, the relay forwarding message is deleted.
  • the embodiment of the present invention further provides a processing device for a dynamic host configuration protocol DHCPv6 message exception, which is applicable to a client, including a processor, a program memory, and a data storage.
  • a processing device for a dynamic host configuration protocol DHCPv6 message exception which is applicable to a client, including a processor, a program memory, and a data storage.
  • the method further includes:
  • the fourth receiving module 1101 is configured to receive a relay forwarding message from the relay agent, and determine whether the relay forwarding message includes an exception option field.
  • the fourth obtaining module 1102 is configured to: when the relay forwarding message includes an exception option field, obtain an abnormal type of the abnormal DHCPv6 message from the relay forwarding message;
  • the fourth generation module 1103 is configured to generate an exception report according to the abnormal type
  • the display module 1104 is configured to display the exception report.
  • the processing device provided by the embodiment of the present invention further includes: a fourth deleting module 1105, configured to delete the relay forwarding message after acquiring the abnormal type.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • each device/function module/functional unit in the above embodiment When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the method and device for processing the dynamic host configuration protocol DHCPv6 message provided by the embodiment of the present invention, when the relay agent determines that the abnormal DHCPv6 message is received, the abnormal type value of the abnormal DHCPv6 message is obtained, and the DHCPv6 message configuration is configured. Transmitting a path, and generating a first relay forwarding message that includes the abnormal DHCPv6 message and the exception option field, and sending the first relay forwarding message to the server for processing according to the first forwarding path, which may avoid
  • the DHCPv6 relay agent does not know how to process the message and improperly discards the message, or improperly processes the message to increase the burden on the relay agent, thereby effectively improving the security and stability of the system.

Abstract

一种动态主机配置协议DHCPv6消息的处理方法及装置，其中，处理方法包括：接收DHCPv6报文，判断接收的DHCPv6报文是否为异常DHCPv6报文，当接收的DHCPv6报文是异常DHCPv6报文时，获取所述异常DHCPv6报文的异常类型值；为所述DHCPv6报文配置第一转发路径，并生成包含所述异常DHCPv6报文和异常选项字段的第一中继转发消息；根据所述第一转发路径将所述第一中继转发消息发送至服务器。当中继代理接收到异常DHCPv6报文时，将该异常DHCPv6报文通过构造的第一中继转发消息和配置的第一转发路径，发送到DHCPv6服务器进行处理，可以避免因DHCPv6中继代理不明确如何处理该报文而不恰当地丢弃该报文，或者不恰当地处理该报文而增加中继代理的负担，有效提高系统的安全性以及稳定性。

Description

一种动态主机配置协议DHCP消息的处理方法及装置 技术领域
本文涉及通信技术领域，特别是一种动态主机配置协议DHCP消息的处理方法及装置。
背景技术
虽然DHCPv6(Dynamic Host Configuration Protocol for IPv6)与其他IPv6地址分配方式(手工配置、通过路由器公告消息中的网络前缀无状态自动配置等)相比，DHCPv6具有分配IPv6地址、IPv6前缀和其他网络配置参数的协议等优点，但在下列几种情景中，DHCPv6协议本身却存在先天不足：
1、当攻击者冒充客户端发送大量的非法DHCPv6请求消息给DHCP v6服务器，以请求DHCPv6服务器为其分配相应的IPv6地址/前缀和网络配置参数，从而就会引发DoS(拒绝服务)攻击。
2、虽然DHCPv6规定了为TCP/IP网络中的用户传输IPv6配置信息的技术机制，但是DHCPv6并没有提供对未知类型的消息报文的处理方法，同时也未明确当DHCPv6中继代理收到未知类型的DHCPv6消息报文后应该将其中继给服务器还是客户端，因此当出现未知类型的DHCPv6消息报文时，可能会导致DHCPv6中继代理不恰当的丢弃这些报文，或者导致其它DHCPv6中继代理不恰当的处理这些报文，以增加中继代理的负载。
3、当DHCPv6中继或者服务器因接收到一些异常的报文而消耗相应系统资源的时候，相关技术并没有提供对DHCPv6中继或服务器异常报文进行快速的感知、跟踪并获取异常消息的方法。
在上述情景中，如果攻击者利用DHCPv6协议这些自身所固有的缺陷和脆弱性，都会引发相应的DoS攻击，从而增加DHCPv6服务器或DHCPv6中继的负载，大量消耗其CPU、内存等资源，直至整个系统瘫痪。
发明内容
本发明实施例要解决的技术问题是提供一种动态主机配置协议DHCP消息异常的处理方法及装置，解决相关技术中DHCPv6协议针对未知类型的DHCPv6消息报文无法正确处理的问题。
为解决上述技术问题，本发明实施例提供了一种动态主机配置协议DHCP消息的处理方法，适用于DHCP中继代理，包括：
接收DHCP报文，判断所述报文是否为异常DHCP报文；
当接收的DHCP报文是异常DHCP报文时，获取所述异常DHCP报文的异常类型值；
为所述异常类型DHCP报文配置第一转发路径，并生成第一中继转发消息，所述第一中继转发消息包含异常选项字段；
根据所述第一转发路径将所述第一中继转发消息发送至DHCP服务器。
可选地，其中,为所述DHCP报文配置第一转发路径，并生成第一中继转发消息包括：
根据所述异常DHCP报文的全球地址或站点范围地址以及前缀得到路径消息；将所述路径消息填入所述第一中继转发消息的链路地址字段中，将所述DHCP报文和异常类型值填入所述第一中继转发消息的选项字段中；
所述第一中继转发消息中的跳计数设置为0。
可选地，所述方法还包括：当中继代理不能使用链路地址字段中的地址标识接口时，在所述第一中继转发消息的选项字段中所述接口的ID选项，并将第一中继转发消息的链路地址字段设置为0。
可选地，其中，所述异常DHCP报文包括：
所述中继代理能够识别DHCP报文的类型，但不能确定所述DHCP报文的预定目标，或者所述中继代理不能识别DHCP报文的类型；
在所述异常类型值包含在所述第一中继转发消息的中继报文选项的异常选项字段中。
可选地，其中，在将所述第一中继转发消息发送至DHCP服务器之后还包括：
接收所述DHCP服务器返回的中继应答消息；
当接收的中继应答消息包含异常选项字段时，从所述中继应答消息中获取所中继报文，所述中继报文至少包括所述异常类型值；
根据所述中继报文生成第二中继转发消息，配置第二转发路径，将所述第二中继转发消息发送给客户端或上一级中继代理；其中，所述第二中继转发消息至少包含异常选项字段，所述异常选项字段包括异常选项代码和和所述异常类型值。
可选地，其中，
当所述中继报文选项中包括接口ID选项且所述中继应答消息中的链路地址字段设置为0时，则在由所述接口ID选项标识的链路上发送所述第二中继转发消息至所述第二转发路径；
当所述中继应答消息中的链路地址字段未设置为0时，则在由所述链路地址字段标识的链路上发送所述第二中继转发消息至所述第二转发路径。
本发明实施例还提供一种动态主机配置协议DHCP消息的处理方法，适用于DHCP服务器，包括：
接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
当所述中继转发消息包含异常选项字段时，从所述中继转发消息中获取异常DHCP报文及其异常类型值，生成第一中继应答消息；
将所述第一中继应答消息发送至所述中继代理。
可选地，其中，所述第一中继应答消息包括中继报文选项，所述中继报文选项包含所述异常选项字段；当接收的中继转发消息包含接口ID选项时，所述中继报文选项还包括所述接口ID选项。
可选地，其中，当所述中继转发消息中包含的异常DHCP报文是来自上一级中继代理时，所述第一中继应答消息的中继报文选项中还包含服务器应答消息；
所述DHCP服务器生成所述第一中继应答消息后，删除所述异常DHCP 报文。
本发明实施例还提供一种动态主机配置协议DHCP消息的处理方法，适用于客户端，包括：
接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
当所述中继转发消息包含异常选项字段时，从所述中继转发消息中获取异常DHCP报文的异常类型值；
根据所述异常类型值生成异常报告。
可选地，所述方法还包括：
获取所述异常DHCP报文的异常类型值后，删除所述中继转发消息；并在所述客户端显示所述异常报告。
本发明实施例还提供一种动态主机配置协议DHCP消息的处理装置，适用于DHCP中继代理，包括：
第一接收模块，设置为接收DHCP报文，判断所述DHCP报文是否为异常DHCP报文；
第一获取模块，设置为当所述DHCP报文是异常DHCP报文时，获取所述异常DHCP报文及其异常类型值；
第一配置生成模块，设置成为所述异常DHCP报文配置第一转发路径，并生成第一中继转发消息，所述第一中继转发消息包含异常选项字段；
第一发送模块，设置为根据所述第一转发路径将所述第一中继转发消息发送至DHCP服务器。
可选地，其中所述第一配置生成模块是设置为：
根据所述异常DHCP报文的全球地址或站点范围地址以及前缀得到路径消息；
将所述路径消息填入所述第一中继转发消息的链路地址字段中，将所述DHCP报文和异常类型填入所述第一中继转发消息的选项字段中；
所述第一中继转发消息中的跳计数设置为0。
可选地，其中，所述第一配置生成模块还设置为：当中继代理不能使用链路地址字段中的地址标识接口时，在所述第一中继转发消息的选项字段中所述接口的ID选项，并将第一中继转发消息的链路地址字段设置为0。
可选地，其中，所述异常DHCP报文包括：
所述中继代理能够识别DHCP报文的类型，但不能确定所述DHCP报文的预定目标，或者所述中继代理不能识别DHCP报文的类型；
所述异常类型值包含在所述第一中继转发消息的中继报文选项的异常选项字段中。
可选地，所述装置还包括：
第二接收模块，设置为接收来自DHCPv6服务器的中继应答消息，判断所述中继应答消息是否包括异常选项字段；
第二获取模块，设置为当接收的中继应答消息包含异常选项字段时，从所述中继应答消息中获取中继报文，所述中继报文至少包括所述异常类型值；
第二配置生成模块，设置为根据所述中继报文，生成第二中继转发消息，配置第二转发路径；其中，所述第二中继转发消息至少包含异常选项字段，所述异常选项字段包括异常选项代码和和所述异常类型值。
第二发送模块，设置为根据所述第二转发路径，将所述第二中继转发消息发送给客户端或上一级中继代理。
可选地，其中，所述第二配置生成模块还设置为：
当所述中继应答消息包括接口ID选项且所述中继应答消息中的链路地址字段设置为0时，在由所述接口ID选项标识的链路上发送所述第二中继转发消息至所述第二转发路径；
当所述中继应答消息中的链路地址字段未设置为0时，在由所述链路地址字段标识的链路上发送所述第二中继转发消息至所述第二转发路径。
可选地，所述装置还包括：
第一删除模块，设置为在从所述中继应答消息中获取所述中继报文，生成第二中继转发消息后，删除所述第一中继应答消息。
本发明实施例还提供一种动态主机配置协议DHCP消息的处理装置，适用于服务器，包括：
第三接收模块，设置为接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
第三获取模块，设置为当所述中继转发消息包含异常选项字段时，获取异常DHCP报文及其异常类型值；
第三配置生成模块，设置为针对所述中继转发消息生成第一中继应答消息，所述中继应答消息至少包含所述异常选项字段；
第三发送模块，设置为将所述中继应答消息发送至所述中继代理。
可选地，其中，所述第三配置生成模块是设置为：
将所述异常选项字段包含在所述第一中继应答消息的中继报文选项中，当接收的中继转发消息包含接口ID选项时，还将所述接口ID选项包含在所述中继报文选项中。
可选地，其中，所述第三配置生成模块还设置为：
当所述中继转发消息中包含的异常DHCP报文是来自上一级中继代理时，还将服务器应答消息包含在所述第一中继应答消息的中继报文选项中。
可选地，所述装置还包括第三删除模块，设置为在生成所述第一中继应答消息后，删除所述异常DHCP报文。
本发明实施例还提供一种动态主机配置协议DHCP消息的处理装置，适用于客户端，包括：
第四接收模块，设置为接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
第四获取模块，设置为当所述中继转发消息包含异常选项字段时，获取异常DHCP报文的异常类型值；
第四生成模块，设置为根据所述异常类型生成异常报告；
显示模块，设置为显示所述异常报告。
可选地，所述装置还包括第四删除模块，设置为：在获取所述异常类型值后，删除所述中继转发消息。
本发明实施例还提供一种计算机可读存储介质，所述存储介质存储有计算机程序，该计算机程序包括程序指令，当该程序指令被DHCP中继代理设备执行时，使得该设备可执行上述动态主机配置协议DHCP消息的处理方法。
本发明实施例还提供一种计算机可读存储介质，所述存储介质存储有计算机程序，该计算机程序包括程序指令，当该程序指令被DHCP服务器设备执行时，使得该设备可执行上述动态主机配置协议DHCP消息的处理方法。
本发明实施例还提供一种计算机可读存储介质，所述存储介质存储有计算机程序，该计算机程序包括程序指令，当该程序指令被客户端设备执行时，使得该设备可执行上述的动态主机配置协议DHCP消息的处理方法。
本发明实施例提供的方案，当中继代理接收到异常DHCPv6报文时，将该异常DHCPv6报文通过构造的第一中继转发消息和配置的第一转发路径，发送到DHCPv6服务器进行处理，可以避免因DHCPv6中继代理不明确如何处理该报文而不恰当地丢弃该报文，或者不恰当地处理该报文而增加中继代理的负担；同时，客户端也能够及时发现异常DHCPv6报文或仿冒该客户端发出的攻击报文，及时采取措施，从而有效提高系统的安全性以及稳定性。
附图概述
图1a为相关技术的DHCPv6中继代理工作过程示意图；
图1b为相关技术的DHCPv6中继报文结构示意图；
图1c为相关技术的DHCPv6报文选项字段示意图；
图1d为相关技术的DHCPv6中继转发报文的中继选项字段示意图；
图2为本发明实施例的DHCPv6中继代理转发一个异常DHCPv6报文给DHCPv6服务器的流程示意图；
图3为本发明实施例的DHCPv6服务器应答一个包含异常字段的DHCPv6中继转发报文给DHCPv6中继代理的流程示意图；
图4为本发明实施例的DHCPv6客户端接收一个包含异常字段的中继转发报文的流程示意图；
图5为本发明提供的示范性实施例一的DHCPv6中继代理中继一个异常DHCPv6报文到DHCPv6服务器。
图6为本发明提供的示范性实施例二的DHCPv6服务器响应一个中继代理构造的中继转发消息。
图7为本发明提供的示范性实施例三的DHCPv6中继代理中继一个异常中继应答消息到客户端。
图8为本发明提供的示范性实施例四的客户端接收一个来自DHCPv6中继代理的异常中继转发消息。
图9为本发明实施例的动态主机配置协议DHCPv6消息异常的处理装置结构示意图一，适用于中继代理；
图10为本发明实施例的动态主机配置协议DHCPv6消息异常的处理装置结构示意图二，适用于中继服务器；
图11为本发明实施例的动态主机配置协议DHCPv6消息异常的处理装置结构示意图三，适用于客户端。
本发明的较佳实施方式
下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
图1a是相关技术的DHCPv6中继工作过程示意图，如图1所示。
通过DHCPv6中继动态获取IPv6地址/前缀和其他网络配置参数的过程中，DHCPv6客户端与DHCPv6服务器的处理方式与不通过DHCPv6中继时的处理方式基本相同。图1只说明DHCPv6中继的转发过程：
步骤101：DHCPv6客户端向所有DHCPv6服务器和中继的组播地址FF02::1:2发送请求；
步骤102：DHCPv6中继接收到请求后，将其封装在中继转发(Relay-forward)报文的中继消息选项(Relay Message Option)中，并将Relay-forward报文发送给DHCPv6服务器；
步骤103：DHCPv6服务器从Relay-forward报文中解析出客户端的请求，为客户端选取IPv6地址和其他参数，构造应答消息，将应答消息封装在中继应答(Relay-reply)报文的中继消息选项中，并将Relay-reply报文发送给DHCPv6中继；
步骤104：DHCPv6中继从Relay-reply报文中解析出服务器的应答，转发给DHCPv6客户端；DHCPv6客户端根据DHCPv6服务器分配的IPv6地址/前缀和其他参数进行网络配置。
此外，如果DHCPv6中继收到的报文不是直接来自于客户端，而是来自于上一级中继，则所述DHCPv6中继从relay-reply报文中解析出服务器的应答，转发给所述上一级中继。
图1b是相关技术的DHCPv6中继报文结构示意图；如图1b所示，包括：
跳计数：表示已接收到此报文的中继代理的数量，如果超过设置的跳计数最大值，则接收中继代理可以丢弃此报文。
链路地址：包含分配给客户机所在子网中的中继代理的某个接口的非链路本地地址。根据链路地址，服务器能够决定用于分配地址的IPv6范围中的争取地址。
对等地址：包含了发出此报文的客户机IPv6地址或前一个转发此报文的中继代理的IPv6地址。
选项字段，它用于表示“中继报文”选项。“中继报文”选项中包含要中继的报文和其它中继选项。“中继报文”选项封装了客户机和服务器间交换的DHCPv6报文。
图1c是相关技术的DHCPv6报文选项字段示意图；如图3所示，包括选项代码、选项长度和选项数据。其中，
选项代码：表示DHCPv6选项的类型。
选项长度：表示选项数据字段的字节数。
选项数据：包含了选项的数据，此数据的格式取决于选项的定义。
图1d为相关技术的DHCPv6中继转发报文的中继选项(Relay Message)字段示意图，如图1d所示，包括：
选项代码：OPTION_RELAY_MSG；
选项长度：DHCP中继消息的长度；
DHCP中继消息(Relay-Message)：
在中继转发消息中，收到的消息，放在relay-forward的relay-message选项中，被逐字中继到下一个中继代理或服务器；
在中继响应消息中，被复制和被中继到中继代理或客户端的消息也放在relay-reply的relay-message选项中，该中继代理或客户端的地址在Relay-reply消息的对端-地址字段中。
根据目前的动态主机配置协议DHCPv6协议约定，中继代理是根据消息类型分别中继消息到服务器和客户端，其中服务器发送的Relay-reply消息被发送到客户端或其它中继代理，中继代理转发Relay-forward消息和其它类型的消息被发送给服务器。
服务器发送的relay-reply消息中指定了一个目的地址，中继代理会从relay-reply消息中解析出服务器的应答消息，并转发给相应的DHCPv6客户端或其它中继代理。但是，相关技术没有说明如果中继代理收到异常DHCPv6报文应该如何处理。
中继代理收到的异常报文，可能来自客户端或来自假冒某个客户端的攻击报文，也可能是其他中继代理的中继转发消息的意外出错。
本发明实施例提供了一种动态主机配置协议DHCPv6报文异常的处理方法及装置。
首先，本发明实施例约定以下报文属于有效报文：
a)中继代理能够识别接收的DHCPv6报文类型，但不能确定报文的预定目标；或者
b)中继代理不能识别接收的DHCPv6报文类型。
对于相关技术的DHCPv6协议来说，上述两种报文均属于非正常DHCPv6报文。为便于描述，本发明实施例中将它们定义为“异常DHCPv6报文”。
本发明实施例的基本思想是，当中继代理收到上述异常DHCPv6报文时，为它们专门构造一个中继转发消息，将异常DHCPv6报文转发到DHCPv6服务器进行处理。在构造的中继转发消息中，增加异常选项字段，以便DHCPv6服务器收到该中继转发消息时，进行相应的处理，减轻中继代理和/或服务器收到异常报文时的处理负担，保证系统的健壮性。
较佳地，在所述异常选项字段中，携带异常类型值。
相应地，DHCPv6服务器收到上述构造的中继转发消息时，可以识别收到的中继转发消息包含异常选项字段，进而解析得到异常DHCPv6报文的异常类型，生成中继应答消息。
较佳地，在DHCPv6的相应中继应答消息中包含异常选项字段，以便中继代理识别，并转发客户端或其它中继进行相应的处理。
较佳地，所述异常选项字段，可以直接复制中继转发消息中的异常选项字段，包含异常类型值，以便客户端了解异常报文的性质，并采取相应的对策。这样，客户就可以及时发现DHCPv6系统中的异常报文，防范黑客的恶意攻击。
图2为本发明实施例一的动态主机配置协议DHCPv6报文异常的处理方法示意图；如图2所示，适用于DHCPv6中继，包括：
步骤20：接收报文，判断接收的报文是否属于异常DHCPv6报文；
步骤21：当收到的报文是异常DHCPv6报文时，获取该异常DHCPv6报文，确定异常类型；
具体地，判断接收的报文是否属于异常DHCPv6报文，包括判断接收的报文是否属于以下情形之一：
1)中继代理能够识别接收的报文类型，但不能确定该报文的预定目标；或者
2)中继代理不能识别接收的报文类型。
其中，情形1)中，仅是报文的目标地址出错，即原始的链路地址、客户端地址都是正常的，报文类型也是正常的；例如，在多次中继转发过程中，可能由于某种原因，出现了目标地址出错。
情形2)中，报文类型不能识别，但链路地址、客户端地址等都是正常的；例如，这些报文可能是来自客户端的错误报文，也可能是仿冒客户端的攻击报文。现有技术中定义了要求、公告、请求、确认、更新、重新绑定、应答、发布、拒绝、重新配置、信息请求、中继转发、中继应答等十三种报文类型，除此之外的其它报文类型都属于不能识别的报文类型。
针对上述两种类型的异常报文，在生成第一中继转发消息时，除了包括所述异常DHCPv6报文外，还包括异常选项字段，以便DHCPv6服务器进行识别和处理。
可选地，所述异常选项字段，包括选项代码和异常类型值。
步骤22：为所述异常DHCPv6报文配置第一转发路径，并生成第一中继转发消息，在所述第一中继转发消息中增加异常选项字段。
其中，为所述异常DHCPv6报文配置第一转发路径，并生成第一中继转发消息的步骤包括：
将所述第一中继转发消息中的跳计数设置为0；
根据所述异常DHCPv6报文的全球地址或站点范围地址以及前缀得到路径消息；将所述路径消息填入所述第一中继转发消息的链路地址字段中，将所述异常DHCPv6报文和异常选项字段填入所述第一中继转发消息的选项字段中；
如果中继代理不能使用链路地址字段中的地址标识接口(通过该接口中继对客户端的响应)，中继代理必须在中继转发(Relay-forward)消息中包括接口ID(Interface-ID)选项，在中继转发消息的选项字段中包含所述接口ID选项，同时将第一中继转发消息的链路地址字段设置为0。服务器在收到所述第一中继转发消息时，生成的相应中继应答(Relay-reply)消息中也将包括Interface-ID选项。
步骤23：根据第一转发路径，将所述第一中继转发消息发送至DHCPv6服务器。
本发明实施例提供的动态主机配置协议DHCPv6消息异常的处理方法，中继代理在接收报文时，首先判断接收的报文是否属于本发明实施例定义的异常DHCPv6报文，如果发现收到本发明实施例定义的异常DHCPv6报文，则获取该异常DHCPv6报文，确定该报文的异常类型，并为所述异常DHCPv6报文配置转发路径，生成中继转发消息，将异常DHCPv6报文通过构造的中继转发消息，发送到DHCPv6服务器进行处理，避免了因DHCPv6中继代理(DHCPv6中继/DHCP中继代理/DHCP中继/中继代理/中继)不明确如何处理该报文，导致不恰当地丢弃该报文，或者导致其它DHCPv6中继代理不恰当地处理该报文以增加中继代理负载，有效提高了系统的安全性以及稳定性。
较佳地，本发明实施例提供的所述处理方法中将所述第一中继转发消息发送至DHCPv6服务器之后还包括：
步骤24：接收所述服务器返回的中继应答(relay-reply)消息，判断接收的中继应答消息是否包含异常选项字段；
步骤25：当接收的中继应答消息中包含异常选项字段时，解析所述中继应答消息，获取服务器应答消息，生成第二中继转发消息；其中，所述服务器应答消息中至少包含异常选项字段，在生成的第二转发消息中包含该异常选项字段。
可选地，将所述异常选项字段添加在生成的第二中继转发消息的中继报文选项中，所述异常选项字段包含选项代码和异常类型值；
其中，服务器应答消息内容，根据构造的中继转发消息的异常报文的来源，除了包含异常选项字段外，如果中继转发的异常DHCPv6报文是来自上一级中继转发的报文，还可以包括针对该报文的相应的服务器应答消息。
步骤26：发送所述第二中继转发消息。
其中，当接收的中继应答消息的对端地址是客户端时，所述第二中继转 发消息发送给所述客户端；
当接收的中继应到消息的对端地址是上一级中继代理时，所述第二中继转发消息发送给所述上一级中继代理。
为了解决上述技术问题，本发明实施例还提供了一种动态主机配置协议DHCPv6消息异常的处理方法，如图3所示，适用于DHCPv6服务器，包括：
步骤30：接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
步骤31：当接收的中继转发消息包含异常选项字段时，解析该中继转发消息，获取异常类型值；
步骤32：针对所述中继转发消息生成第一中继应答消息，在所述第一中继应答消息中增加异常选项字段；
可选地，所述异常选项字段包含选项代码和异常类型值；
所述服务器必须记录收到的中继转发消息中对端-地址字段的内容，以及或包含在中继选项中的接口ID选项，以便生成第一中继应答消息；
其中，如果服务器解析得到的中继报文是直接来自客户端的异常DHCPv6报文，所述服务器获取异常类型值和生成所述第一中继应答消息的地址和链路参数后，可以直接丢弃该异常DHCPv6报文；在所述第一中继应答消息的中继报文中包含所述异常选项字段即可，服务器无需对所述异常DHCPv6报文生成应答；
如果服务器解析得到的中继报文是所述中继代理转发的来自上一级中继代理的中继转发消息，所述服务器除了获取异常类型值和生成所述第一中继应答消息的地址和链路参数外，需要针对该上一级中级代理转发的DHCPv6报文生成相应的服务器应答，将所述异常选项字段和所述服务器应答一起包含在所述第一中继应答消息的中继报文选项中。
较佳地，所述异常选项字段附加在所述第一中继应答消息的最外层中继报文选项中。
由于服务器接收到中继代理构造转发的Relay-forward包含异常选项字 段，服务器必须记录收到的中继转发消息中对端-地址字段的内容，以便它能够构建携带来自服务器响应的适当Relay-reply消息。
如果所述中继转发消息中包括接口ID选项，则服务器将在生成中继应答消息时，除了复制所述中继转发消息的hop count、link-address和peer-address外，还要在中继应答消息的中继报文(relay-message)选项中包括所述Interface-ID选项和异常选项字段。
步骤33：将所述第一中继应答消息发送至所述中继代理。
本发明实施例提供的所述动态主机配置协议DHCPv6消息异常的处理方法使得服务器能够明确处理未知类型的DHCPv6消息报文，节省了时间，降低了出现故障的机率。
为了解决上述技术问题，本发明实施例还提供了一种动态主机配置协议DHCPv6消息异常的处理方法，如图4所示，适用于客户端，包括：
步骤40：接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
步骤41：当接收的中继转发消息包含异常选项字段时，从所述中继转发消息中获取异常DHCPv6报文的异常类型值；
步骤42：根据所述异常类型值生成异常报告；
步骤43：在客户端显示所述异常报告。
本发明实施例提供的所述动态主机配置协议DHCPv6消息异常的处理方法使得客户端通过解析DHCPv6消息报文的异常类型实时获取当前DHCPv6服务器或者中继代理是否存在风险，从而对其实施相应的安全策略，以此减少DHCPv6消息报文处理过程中各种攻击的发生。
为了节省客户端的存储空间以及提高运行效率，本发明实施例提供的所述处理方法，客户端在获取所述异常类型值后，直接删除所述中继转发消息。
下面结合示范性实施例，对本发明实施例提供的所述动态主机配置协议 DHCPv6消息异常的处理方法进行具体说明。
在以下的示范性实施例中，为完成对异常DHCPv6报文的处理，需要在DHCPv6协议原有基础之上，在DHCPv6中继、DHCPv6服务器和DHCPv6客服端，分别增加相应的处理方法。
实施例一、DHCPv6中继代理中继一个异常DHCPv6报文到DHCPv6服务器。如图5所示。在本实施例中，中继代理接收到异常报文包括：
a)中继代理能够识别接收的报文的类型，但不能确定该报文的预定目标；或者
b)中继代理不能识别接收的报文的类型。
中继代理收到异常报文，可能直接来自于客户端或仿冒的客户端，也可能来自上一级中继代理。其中，根据本发明实施例的方法，中继代理可以第一时间发现来自客户端或仿冒客户端的异常报文，通过构造中继转发消息，直接发送给服务器进行相应处理，因此，来自上一级代理的异常报文，一般是在上一级中继代理到本中继代理的传输过程中出现了异常，该中继转发报文的中继报文本身(来自客户端或另一上级中继代理)是正常报文。
具体地，在中继代理侧，首先需要对接收的消息进行判断，包括：
步骤50、接收一个来自客户端或上一级中继代理的报文；
步骤51、判断接收的报文是否属于异常DHCPv6报文；
当中继代理确认收到一个异常DHCPv6报文时，按照下列方式构造一个中继转发(Relay-forward)消息，将该异常DHCPv6报文转发到DHCPv6服务器进行处理。
步骤52：中继代理为所述异常DHCPv6报文配置第一转发路径，并生成第一中继转发消息。
具体地包括：
步骤521：将所述第一中继转发消息中的跳计数设置为0；
步骤522：根据收到的DHCPv6报文的全球地址或站点范围地址以及前缀 得到路径消息；将所述路径消息填入所述第一中继转发消息的链路地址字段中；或者
步骤523：如果中继代理不能使用链路地址字段中的地址标识接口(通过该接口中继对收到的报文)，中继代理必须在构造的中继转发Relay-forward消息的选项字段中包含所述Interface-ID选项，同时将第一中继转发消息的链路地址字段设置为0。
服务器在收到所述第一中继转发消息时，生成的相应中继应答(Relay-reply)消息中也将包括Interface-ID选项。
步骤53：将所述异常DHCPv6报文和异常选项字段填入所述第一中继转发消息的选项字段中。
可选地，将该异常DHCPv6报文添加到构造的中继转发消息的Options选项中，并增加一个异常选项字段；该异常选项字段包括选项代码和异常类型值。
在选项字段中增设异常字段选项代码，具体数值可以根据自己的需要进行设定，只要不与现有DHCPv6协议规定的选项代码发生重叠即可，例如可以设为AA。异常类型值可以采用1bit表示，如0表示前述的a)类异常报文，1表示前述的b)类异常报文。
也可以将异常字段的选项数据中选取一个字节，包括异常标志位和异常类型值两部份，只要能够指示异常报文的类型即可，在此不另敷述。
步骤54：根据第一转发路径，将第一中继转发消息发送给DHCPv6服务器。
实施例二、DHCPv6服务器响应一个DHCPv6中继转发消息，如图6所示，包括：
步骤61：DHCPv6服务器接收中继代理转发中继消息；
步骤62：判断接收的中继转发消息是否包含异常字段；
步骤63：如果收到的中继转发消息包含异常字段，则解析该中继转发消息，获取异常类型值；在获取相应的对端地址和链路参数后，生成第一中继应答消息。
所述第一中继应答消息中至少包含异常选项字段(包括异常代码和异常类型值)，携带在第一中继应答消息的中继报文(relay-message)中。
其中，由于中继代理收到的异常DHCPv6报文，可能来自客户端或仿冒的客户端，也可能来自上一级代理，因此，服务器生成的中继应答消息中，除了包含该异常类型字段外，还可能包含服务器对中继转发消息中包含的正常DHCPv6报文的响应消息。
具体地，如果服务器收到的包含异常选项字段的中继转发消息中的异常DHCPv6报文是来自客户端或仿冒的客户端(即不是来自上一级中继代理)，则直接丢弃该报文，在中继应答消息中包含异常选项字段即可，无需对该异常DHCPv6进行响应；如果服务器收到的包含异常选项字段的中继转发消息中的异常DHCPv6报文，是来自上一级中继的中继转发报文，则该中继转发报文所转发的DHCPv6报文本身可能是正常报文，在中继转发过程中出现了地址错误，因此服务器解析中继转发消息后，可以对该报文进行正常响应，并将响应消息和异常选项字段一起，放在生成的中继应答消息的中继报文选项字段中。
这样，服务器生成的中继应答消息到达中继代理时，可以根据该中继应答消息的中继报文内容，确定是直接发给客户端，还是发给上一级代理。
当然，如果服务器解析中继转发消息后，发现该中继报文也属于前述的两种异常报文，可以直接丢弃该报文，不生成服务器应答消息。这样，服务器生成的中继应答消息中，仅包含异常选项字段，不包含其它应答内容；中继代理收到该中继应答消息后，解析后逐级发送，直至将该异常选项字段发送的相应的客户端进行处理。
其中，如果收到的中继转发(Relay-forward)消息中包括Interface-ID选项，在中继应答消息的中继报文(relay message)也需要包括所述Interface-ID选项。
由于服务器接收到包含异常选项字段的Relay-forward消息也属于正常 中继转发消息，服务器会使用中继应答消息返回响应给中继代理；服务器必须记录收到的中继转发消息中对端-地址字段的内容，以便它能够构建携带来自服务器响应的适当Relay-reply消息。
如果中继代理在构造的第一中继转发消息中包括Interface-ID选项，则服务器将在它的中继应答、消息中包括Interface-ID选项；该Interface-ID选项和异常选项字段一起包含在中继应答消息的中继报文(relay-message)选项中。
与生成一般的中继应答消息的不同之处主要在于：
1)DHCPv6服务器需要从所述中继转发消息中获取异常DHCPv6的异常类型值，并在生成的应答消息中也包含相应的异常选项字段(异常选项代码和异常类型值)，所述异常类型值与收到中继转发消息中异常类型值相同。
2)获取对端-地址字段的内容或包含在中继选项中的Interface-ID项后，直接丢弃该异常DHCPv6报文(来自客户端或仿冒的客户端)，或响应中继转发消息中携带的正常DHCPv6报文(来自上一级中继代理的转发的中继报文)。
步骤64：将所述第一中继应答消息发送给所述中继代理。
实施例三、DHCPv6中继代理中继一个消息到客户端，如图7所示。包括：
步骤71：DHCPv6中继代理接收来自服务器的中继应答(relay-reply)消息；
步骤72：判断接收的中继应答消息是否包含异常选项字段；
如果中继代理接收的中继应答消息包含异常选项字段，则按照如下方式处理消息：
步骤73：中继代理从接收的中继应答消息中获取Relay Message选项和必要的地址(如应答消息首部中的地址)和网络参数后，丢弃其它选项。
具体包括以下情形：
步骤731：中继代理从Relay Message选项中提取异常类型值，并将该异常类型中继转发到中继应答消息格式中的对端-地址字段中包含的地址。
步骤732：如果中继应答消息包括Interface-ID选项，且链路地址字段设置为0，则中继代理在由Interface-ID选项标识的链路上，从服务器到客户端中继该消息和处理后得到的内容。
步骤733：如果中继应答消息包括Interface-ID选项，且链路地址字段没有设置为0，则中继代理在由链路-地址字段标识的链路上中继该消息和处理后得到的内容(链路地址字段的优先级高于接口-ID)。
实施例四、客户端接收一个来自DHCPv6的中继转发消息。如图8所示，包括：
步骤81：客户端接收来自中继代理的中继转发消息；
步骤82：判断所述中继转发消息是否包含异常选项字段；
步骤83：当接收的中继转发消息包含异常选项字段时，从所述中继转发消息中获取异常DHCPv6报文的异常类型值；
步骤84：根据所述异常类型值生成异常报告；
步骤85：在客户端上显示所述异常报告。
客户端针对所接收到携带异常标志的中继转发消息时，获取异常类型值后，可以直接丢弃该中继转发消息，同时在客户端显示异常报告，使客户动态地获取当前DHCPv6服务器或者中继是否存在风险，从而对其实施相应的安全策略，以此减少DHCPv6处理过程中各种攻击的发生。
为了解决上述技术问题，本发明实施例还提供了一种动态主机配置协议DHCPv6消息异常的处理装置，适用于DHCPv6中继代理侧，包括处理器、程序存储设备和数据存储设备如图9所示，还包括：
第一接收模块901：设置为接收DHCPv6报文，判断接收的DHCPv6报文是否为异常DHCPv6报文；
第一获取模块902，设置为当接收的DHCPv6报文是异常DHCPv6报文时，获取所述异常DHCPv6报文的异常类型；
第一配置生成模块903，设置成为所述异常DHCPv6报文配置第一转发路径，并生成第一中继转发消息；
第一发送模块904，设置为根据所述第一转发路径将所述第一中继转发消息发送至DHCPv6服务器。
本发明实施例提供的所述动态主机配置协议DHCPv6消息异常的处理装置，在判断接收的DHCPv6报文属于异常DHCPv6报文时，获取该异常DHCPv6报文的异常类型，并为该异常DHCPv6报文配置转发路径，并生成中继转发消息，将异常DHCPv6报文通过转发路径发送到DHCPv6服务器进行处理，避免了因DHCPv6中继代理不明确如何处理该报文，导致不恰当的丢弃该报文，或者导致其它DHCPv6中继代理不恰当的处理该报文以增加中继代理负载，有效提高了系统的安全性以及稳定性。
具体地，所述异常DHCPv6报文包括：
所述中继代理能够识别DHCPv6报文的类型，但不能确定所述DHCPv6报文的预定目标，或者所述中继代理不能识别DHCPv6报文的类型。
进一步地，第一配置生成模块903是设置为：将所述第一中继转发消息中的跳计数设置为0，根据全球地址或站点范围地址以及前缀得到路径消息；根据所述路径消息以及所述异常DHCPv6报文和异常类型生成第一中继转发消息。
可选地，在所述第一中继转发消息中包括接口ID选项。如果中继代理不能使用链路地址字段中的地址标识接口(通过该接口中继对客户端的响应)，中继代理必须在中继转发消息中包括Interface-ID选项。服务器将在它的中继应答消息中包括Interface-ID选项。
较佳地，所述第一配置生成模块903是设置为将所述路径消息填入所述第一中继转发消息的链路地址字段中，将所述异常DHCPv6报文和异常类型填入所述第一中继转发消息的选项字段中。
本发明实施例提供的所述处理装置中还包括：
第二接收模块905，设置为接收来自DHCPv6服务器的中继应答消息，判断所述中继应答消息是否包含异常选项字段；
第二获取模块906，设置为设置为当接收的中继应答消息包含异常选项字段时，从所述中继应答消息中获取异常类型和服务器应答消息；
第二生成模块907，设置为根据所述异常类型和服务器应答消息，生成第二中继转发消息，配置第二转发路径，其中，所述第二中继转发消息至少包含异常选项字段(异常选项代码和异常类型值)；
第二发送模块908，设置为将所述第二中继转发消息发送给客户端或上一级中继代理。
其中，如果中继应答消息的中继报文中仅包含异常选项字段，则将所述第二中继转发消息发送给客户端；
如果中继应答消息的中继报文中除了包含异常选项字段外，还包含其它服务器应答消息的内容，则所述第二中继转发消息发送给上一级中继代理。
较佳地，其中所述第二配置生成模块907是设置为：
当所述中继应答消息包括接口ID选项且所述中继应答消息中的链路地址字段设置为0时，在由所述接口ID选项标识的链路上发送所述第二中继转发消息至所述第二转发路径；
当所述中继应答消息包括接口ID选项但所述中继应答消息中的链路地址字段未设置为0时，在由所述链路地址字段标识的链路上发送所述第二中继转发消息至所述第二转发路径。
为了节省中继代理的存储空间以及提高运行速度，本发明实施例提供的所述处理装置还包括：第一删除模块909，设置为在获取所述异常类型以及中继报文(relay message)选项内容后，删除所述中继应答消息的其它内容。
在中继代理的本地传输中，链路地址字段的优先级高于接口ID，所以，本发明实施例提供的所述处理装置中，所述第二发送模块设置为若所述第一中继应答消息包括接口ID选项且所述第一中继应答消息中的链路地址字段 设置为0，则在由所述接口ID选项标识的链路上发送所述第二中继转发消息至所述第二转发路径；若所述第一中继应答消息中的链路地址字段未设置为0，则在由所述链路地址字段标识的链路上发送所述第二中继转发消息至所述第二转发路径。
为了解决上述技术问题，本发明实施例还提供了一种动态主机配置协议DHCPv6消息异常的处理装置，适用于DHCPv6服务器，包括处理器、程序存储器和数据存储器，如图10所示，还包括：
第三接收模块1001，设置为接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
第三获取模块1002，设置为当所述中继转发消息包含异常选项字段时，从所述中继转发消息中获取异常选项字段以及必要的地址和链路参数信息；以及异常DHCPv6报文。
第三配置生成模块1003，设置为针对所述中继转发消息生成第一中继应答消息，配置转发路径，所述中继应答消息的中继报文中至少包含所述异常选项字段(异常选项代码和异常类型值)；
可选地，所述第一中继应答消息的中继报文中还可以包含服务器的其它应答消息；
其中，当服务器解析包含异常选项字段的中继转发消息时，如果该中继转发消息的中继报文中包含的异常DHCPv6报文，来自客户端或仿冒的客户端，则直接丢弃该异常DHCPv6报文；如果该中继转发消息的中继报文中包含的异常DHCPv6报文来自上一级中继代理，而该上一级中继代理转发的DHCPv6报文本身是正常报文，则服务器进行相应的正常响应，并将该服务器应答消息的内容和异常选项字段一起，包含在所述第一中继应答消息的中继报文中。
较佳地，所述异常选项字段附加在所述第一中继应答消息的最外层中继报文选项中。
第三发送模块1004，设置为将所述中继应答消息发送至所述中继代理。
为了节省服务器的存储空间以及提高运行效率，本发明实施例提供的所述处理装置还包括：第三删除模块1405，设置为在获取所述异常选项字段以及生成所述中继应答消息的地址信息后，删除所述中继转发消息。
为了解决上述技术问题，本发明实施例还提供了一种动态主机配置协议DHCPv6消息异常的处理装置，适用于客户端，包括处理器、程序存储器和数据存储器，如图11所示，还包括：
第四接收模块1101，设置为接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
第四获取模块1102，设置为当所述中继转发消息包含异常选项字段时，从所述中继转发消息中获取异常DHCPv6报文的异常类型；
第四生成模块1103，设置为根据所述异常类型生成异常报告；
显示模块1104，设置为将所述异常报告进行显示。
为了节省客户端的存储空间以及提高运行效率，本发明实施例提供的所述处理装置还包括：第四删除模块1105，设置为在获取所述异常类型后，删除所述中继转发消息。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
上述实施例中的各装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的各装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求所述的保护范围为准。
工业实用性
本发明实施例提供的动态主机配置协议DHCPv6消息的处理方法及装置，当中继代理判断接收到异常DHCPv6报文时，获取所述异常DHCPv6报文的异常类型值，为所述DHCPv6报文配置第一转发路径，并生成包含所述异常DHCPv6报文和异常选项字段的第一中继转发消息，根据所述第一转发路径将所述第一中继转发消息发送至服务器进行处理，可以避免因DHCPv6中继代理不明确如何处理该报文而不恰当地丢弃该报文，或者不恰当地处理该报文而增加中继代理的负担，有效提高系统的安全性以及稳定性。

Claims (27)

  1. 一种动态主机配置协议DHCP消息的处理方法，适用于DHCP中继代理，包括：
    接收DHCP报文，判断所述报文是否为异常DHCP报文；
    当接收的DHCP报文是异常DHCP报文时，获取所述异常DHCP报文的异常类型值；
    为所述异常类型DHCP报文配置第一转发路径，并生成第一中继转发消息，所述第一中继转发消息包含异常选项字段；
    根据所述第一转发路径将所述第一中继转发消息发送至DHCP服务器。
  2. 如权利要求1所述的方法，其中,为所述DHCP报文配置第一转发路径，并生成第一中继转发消息包括：
    根据所述异常DHCP报文的全球地址或站点范围地址以及前缀得到路径消息；将所述路径消息填入所述第一中继转发消息的链路地址字段中，将所述DHCP报文和异常类型值填入所述第一中继转发消息的选项字段中；
    所述第一中继转发消息中的跳计数设置为0。
  3. 如权利要求2所述的方法，还包括：当中继代理不能使用链路地址字段中的地址标识接口时，在所述第一中继转发消息的选项字段中所述接口的ID选项，并将第一中继转发消息的链路地址字段设置为0。
  4. 如权利要求1～3任一项所述的方法，其中，所述异常DHCP报文包括：
    所述中继代理能够识别DHCP报文的类型，但不能确定所述DHCP报文的预定目标，或者所述中继代理不能识别DHCP报文的类型；
    在所述异常类型值包含在所述第一中继转发消息的中继报文选项的异常选项字段中。
  5. 如权利要求1所述的方法，其中，在将所述第一中继转发消息发送至DHCP服务器之后还包括：
    接收所述DHCP服务器返回的中继应答消息；
    当接收的中继应答消息包含异常选项字段时，从所述中继应答消息中获取所中继报文，所述中继报文至少包括所述异常类型值；
    根据所述中继报文生成第二中继转发消息，配置第二转发路径，将所述第二中继转发消息发送给客户端或上一级中继代理；其中，所述第二中继转发消息至少包含异常选项字段，所述异常选项字段包括异常选项代码和和所述异常类型值。
  6. 如权利要求5所述的处理方法，其中，
    当所述中继报文选项中包括接口ID选项且所述中继应答消息中的链路地址字段设置为0时，则在由所述接口ID选项标识的链路上发送所述第二中继转发消息至所述第二转发路径；
    当所述中继应答消息中的链路地址字段未设置为0时，则在由所述链路地址字段标识的链路上发送所述第二中继转发消息至所述第二转发路径。
  7. 一种动态主机配置协议DHCP消息的处理方法，适用于DHCP服务器，包括：
    接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
    当所述中继转发消息包含异常选项字段时，从所述中继转发消息中获取异常DHCP报文及其异常类型值，生成第一中继应答消息；
    将所述第一中继应答消息发送至所述中继代理。
  8. 如权利要求7所述的方法，其中，所述第一中继应答消息包括中继报文选项，所述中继报文选项包含所述异常选项字段；当接收的中继转发消息包含接口ID选项时，所述中继报文选项还包括所述接口ID选项。
  9. 如权利要求7或8所述的方法，其中，当所述中继转发消息中包含的异常DHCP报文是来自上一级中继代理时，所述第一中继应答消息的中继报文选项中还包含服务器的其它应答消息；
    所述DHCP服务器生成所述第一中继应答消息后，删除所述异常DHCP 报文。
  10. 一种动态主机配置协议DHCP消息的处理方法，适用于客户端，包括：
    接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
    当所述中继转发消息包含异常选项字段时，从所述中继转发消息中获取异常DHCP报文的异常类型值；
    根据所述异常类型值生成异常报告。
  11. 如权利要求10所述的方法，还包括：
    获取所述异常DHCP报文的异常类型值后，删除所述中继转发消息；并在所述客户端显示所述异常报告。
  12. 一种动态主机配置协议DHCP消息的处理装置，适用于DHCP中继代理，包括：
    第一接收模块，设置为接收DHCP报文，判断所述DHCP报文是否为异常DHCP报文；
    第一获取模块，设置为当所述DHCP报文是异常DHCP报文时，获取所述异常DHCP报文及其异常类型值；
    第一配置生成模块，设置成为所述异常DHCP报文配置第一转发路径，并生成第一中继转发消息，所述第一中继转发消息包含异常选项字段；
    第一发送模块，设置为根据所述第一转发路径将所述第一中继转发消息发送至DHCP服务器。
  13. 如权利要求12所述的装置，其中所述第一配置生成模块是设置为：
    根据所述异常DHCP报文的全球地址或站点范围地址以及前缀得到路径消息；
    将所述路径消息填入所述第一中继转发消息的链路地址字段中，将所述DHCP报文和异常类型填入所述第一中继转发消息的选项字段中；
    所述第一中继转发消息中的跳计数设置为0。
  14. 如权利要求13所述的装置，其中，所述第一配置生成模块还设置为：当中继代理不能使用链路地址字段中的地址标识接口时，在所述第一中继转发消息的选项字段中所述接口的ID选项，并将第一中继转发消息的链路地址字段设置为0。
  15. 如权利要求12～14所述的装置，其中，所述异常DHCP报文包括：
    所述中继代理能够识别DHCP报文的类型，但不能确定所述DHCP报文的预定目标，或者所述中继代理不能识别DHCP报文的类型；
    所述异常类型值包含在所述第一中继转发消息的中继报文选项的异常选项字段中。
  16. 如权利要求15所述的装置，还包括：
    第二接收模块，设置为接收来自DHCPv6服务器的中继应答消息，判断所述中继应答消息是否包括异常选项字段；
    第二获取模块，设置为当接收的中继应答消息包含异常选项字段时，从所述中继应答消息中获取中继报文，所述中继报文至少包括所述异常类型值；
    第二配置生成模块，设置为根据所述中继报文，生成第二中继转发消息，配置第二转发路径；其中，所述第二中继转发消息至少包含异常选项字段，所述异常选项字段包括异常选项代码和和所述异常类型值；
    第二发送模块，设置为根据所述第二转发路径，将所述第二中继转发消息发送给客户端或上一级中继代理。
  17. 如权利要求16所述的装置，其中，所述第二配置生成模块还设置为：
    当所述中继应答消息包括接口ID选项且所述中继应答消息中的链路地址字段设置为0时，在由所述接口ID选项标识的链路上发送所述第二中继转发消息至所述第二转发路径；
    当所述中继应答消息中的链路地址字段未设置为0时，在由所述链路地址字段标识的链路上发送所述第二中继转发消息至所述第二转发路径。
  18. 如权利要求12所述的装置，还包括：
    第一删除模块，设置为在从所述中继应答消息中获取所述中继报文，生成第二中继转发消息后，删除所述第一中继应答消息。
  19. 一种动态主机配置协议DHCP消息的处理装置，适用于服务器，包括：
    第三接收模块，设置为接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
    第三获取模块，设置为当所述中继转发消息包含异常选项字段时，获取异常DHCP报文及其异常类型值；
    第三配置生成模块，设置为针对所述中继转发消息生成第一中继应答消息，所述中继应答消息至少包含所述异常选项字段；
    第三发送模块，设置为将所述中继应答消息发送至所述中继代理。
  20. 如权利要求19所述的装置，其中，所述第三配置生成模块是设置为：
    将所述异常选项字段包含在所述第一中继应答消息的中继报文选项中，当接收的中继转发消息包含接口ID选项时，还将所述接口ID选项包含在所述中继报文选项中。
  21. 如权利要求20所述的装置，其中，所述第三配置生成模块还设置为：
    当所述中继转发消息中包含的异常DHCP报文是来自上一级中继代理时，还将服务器的其它应答消息包含在所述第一中继应答消息的中继报文选项中。
  22. 如权利要求19所述的装置，还包括第三删除模块，设置为在生成所述第一中继应答消息后，删除所述异常DHCP报文。
  23. 一种动态主机配置协议DHCP消息的处理装置，适用于客户端，包括：
    第四接收模块，设置为接收来自中继代理的中继转发消息，判断所述中继转发消息是否包含异常选项字段；
    第四获取模块，设置为当所述中继转发消息包含异常选项字段时，获取异常DHCP报文的异常类型值；
    第四生成模块，设置为根据所述异常类型生成异常报告；
    显示模块，设置为显示所述异常报告。
  24. 如权利要求23所述的装置，还包括第四删除模块，设置为：在获取所述异常类型值后，删除所述中继转发消息。
  25. 一种计算机可读存储介质，所述存储介质存储有计算机程序，该计算机程序包括程序指令，当该程序指令被DHCP中继代理设备执行时，使得该设备可执行权利要求1-6任一项的方法。
  26. 一种计算机可读存储介质，所述存储介质存储有计算机程序，该计算机程序包括程序指令，当该程序指令被DHCP服务器设备执行时，使得该设备可执行权利要求7-9任一项的方法。
  27. 一种计算机可读存储介质，所述存储介质存储有计算机程序，该计算机程序包括程序指令，当该程序指令被客户端设备执行时，使得该设备可执行权利要求10-11任一项的方法。
PCT/CN2015/078990 2014-09-12 2015-05-14 一种动态主机配置协议dhcp消息的处理方法及装置 WO2016037490A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410465493.6 2014-09-12
CN201410465493.6A CN105471615A (zh) 2014-09-12 2014-09-12 一种动态主机配置协议dhcp信息异常的处理方法及装置

Publications (1)

Publication Number Publication Date
WO2016037490A1 true WO2016037490A1 (zh) 2016-03-17

Family

ID=55458325

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/078990 WO2016037490A1 (zh) 2014-09-12 2015-05-14 一种动态主机配置协议dhcp消息的处理方法及装置

Country Status (2)

Country Link
CN (1) CN105471615A (zh)
WO (1) WO2016037490A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116846060A (zh) * 2023-03-08 2023-10-03 国网江苏省电力有限公司淮安供电分公司 Iec61850智能变电站工况安全学习系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101364877A (zh) * 2008-09-28 2009-02-11 福建星网锐捷网络有限公司 安全策略配置方法及其装置
CN102035724A (zh) * 2009-09-30 2011-04-27 华为技术有限公司 一种实现报文转发的方法、装置和系统
CN102281594A (zh) * 2011-09-06 2011-12-14 华为技术有限公司 一种报文转发方法及无线访问节点、系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101453495B (zh) * 2008-12-30 2011-06-15 杭州华三通信技术有限公司 防止授权地址解析协议信息丢失的方法、系统和设备
CN101572712B (zh) * 2009-06-09 2012-06-27 杭州华三通信技术有限公司 一种防止伪造报文攻击的方法和中继设备
CN102082835B (zh) * 2009-11-27 2013-04-17 华为技术有限公司 Ip地址的分配方法及装置
CN101834870A (zh) * 2010-05-13 2010-09-15 中兴通讯股份有限公司 一种防止mac地址欺骗攻击的方法和装置
CN102143164B (zh) * 2011-01-24 2015-04-01 中兴通讯股份有限公司 报文中继方法、装置及基站
CN102638390A (zh) * 2012-01-18 2012-08-15 神州数码网络(北京)有限公司 基于dhcp snooping的三层交换装置及方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101364877A (zh) * 2008-09-28 2009-02-11 福建星网锐捷网络有限公司 安全策略配置方法及其装置
CN102035724A (zh) * 2009-09-30 2011-04-27 华为技术有限公司 一种实现报文转发的方法、装置和系统
CN102281594A (zh) * 2011-09-06 2011-12-14 华为技术有限公司 一种报文转发方法及无线访问节点、系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116846060A (zh) * 2023-03-08 2023-10-03 国网江苏省电力有限公司淮安供电分公司 Iec61850智能变电站工况安全学习系统

Also Published As

Publication number Publication date
CN105471615A (zh) 2016-04-06

Similar Documents

Publication Publication Date Title
US10673718B2 (en) Traceroutes for discovering the network path of inbound packets transmitted from a specified network node
US9923984B2 (en) Methods, systems, and computer readable media for remote authentication dial in user service (RADIUS) message loop detection and mitigation
US10200264B2 (en) Link status monitoring based on packet loss detection
US10148573B2 (en) Packet processing method, node, and system
CN112422481B (zh) 网络威胁的诱捕方法、系统和转发设备
US9712559B2 (en) Identifying frames
US11979322B2 (en) Method and apparatus for providing service for traffic flow
US8650326B2 (en) Smart client routing
CN106412142B (zh) 一种资源设备地址获取方法及装置
JP2018528679A (ja) 負荷平衡システムにおいて接続を確立するデバイス及び方法
US20160285820A1 (en) Method for processing address resolution protocol message, switch, and controller
EP2469787A1 (en) Method and device for preventing network attacks
US20200153735A1 (en) Data link layer-based communication method, device, and system
WO2018121257A1 (zh) 报文发送方法、装置、系统以及存储介质
US10827041B2 (en) Packet fragmentation control
US20190068762A1 (en) Packet Parsing Method and Device
CN112383559B (zh) 地址解析协议攻击的防护方法及装置
WO2020052499A1 (zh) 防仿冒攻击检查的方法、设备和系统
WO2016037490A1 (zh) 一种动态主机配置协议dhcp消息的处理方法及装置
US9912557B2 (en) Node information detection apparatus, node information detection method, and program
CN114915492B (zh) 一种流量转发方法、装置、设备及介质
CN113132230A (zh) 发送报文的方法、设备及计算机存储介质
CN117081990B (zh) 一种mpls流量代理方法、系统、设备及存储介质
CN104717313B (zh) mDNS网关地址配置方法与装置
US20230098972A1 (en) Preventing dhcp pool exhaustion and starvation with centralized arp protocol messages

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15840685

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15840685

Country of ref document: EP

Kind code of ref document: A1