WO2017000878A1 - 报文处理 - Google Patents

报文处理 Download PDF

Info

Publication number
WO2017000878A1
WO2017000878A1 PCT/CN2016/087615 CN2016087615W WO2017000878A1 WO 2017000878 A1 WO2017000878 A1 WO 2017000878A1 CN 2016087615 W CN2016087615 W CN 2016087615W WO 2017000878 A1 WO2017000878 A1 WO 2017000878A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
entry
fast forwarding
forwarding entry
session
Prior art date
Application number
PCT/CN2016/087615
Other languages
English (en)
French (fr)
Inventor
柳佳佳
李�杰
Original Assignee
杭州华三通信技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州华三通信技术有限公司 filed Critical 杭州华三通信技术有限公司
Publication of WO2017000878A1 publication Critical patent/WO2017000878A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/54—Organization of routing tables
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management

Definitions

  • Session management is a public function abstracted to implement session-based processing such as Network Address Translation (NAT), ASPF (Advanced Stateful Packet Filter), attack detection, and prevention.
  • NAT Network Address Translation
  • ASPF Advanced Stateful Packet Filter
  • This function abstracts the interaction between the transport layer packets into a session, and updates and ages the session based on the packet information of the initiator and the responder. It supports multiple service features to process the same service packet.
  • FIG. 1 is a flowchart of a packet processing method according to an embodiment of the present application
  • FIG. 2 is a flowchart of a method for processing an IP unicast packet according to another embodiment of the present disclosure
  • FIG. 3 is a schematic structural diagram of a global forward fast forwarding entry according to an embodiment of the present disclosure
  • FIG. 4 is a flowchart of a method for processing an IP multicast packet according to an embodiment of the present disclosure
  • FIG. 5 is a schematic structural diagram of a packet processing apparatus according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of hardware of a device including a packet processing apparatus according to an embodiment of the present disclosure.
  • the system When the client initiates a connection request packet to the server, the system creates a session entry. This entry records the request packet information and response packet information corresponding to a session, including the source IP address/port number, destination IP address/port number, transport layer protocol type, application layer protocol type, and protocol protocol status. Wait.
  • Packet forwarding rate is a key indicator of device performance. According to the normal procedure, after receiving a packet, the device searches for the forwarding entry matching the forwarding table according to the destination address of the packet, and then determines an optimal path. The device also uses the packet according to the data link layer. The protocol is encapsulated and finally the message is forwarded.
  • Fast forwarding uses a cache to process messages and uses a stream-based technology.
  • Fast forwarding uses a 5-tuple (ie source IP address, source port number, destination IP address, destination port number, protocol number) to identify a data stream. After the first packet of a data stream is forwarded through the lookup routing table, the corresponding fast forwarding entry is generated in the cache, and the subsequent forwarding of the data packet can be forwarded by directly searching the fast forwarding table. This greatly reduces the queuing process of IP packets, reduces the packet forwarding time, and improves the forwarding rate of IP packets.
  • 5-tuple ie source IP address, source port number, destination IP address, destination port number, protocol number
  • the basic metric of a network device that can withstand the maximum new rate indicating the maximum number of connections that the network device can process per second without losing connectivity, in units of transactions per second (Transactions Per Second).
  • the client initiates an HTTP connection request to the server through the network device, and the network device performs NAT translation on the interactive packet. 2) After the connection is successfully established, the client obtains a small amount of data from the server through HTTP; 3) the client removes the HTTP connection; the above three steps are a complete transaction, and the new rate is completed in one second.
  • the total number of transactions which can reflect the common forwarding, fast forwarding, and service processing performance of network devices.
  • FIG. 1 is a flowchart of a packet processing method according to an embodiment of the present disclosure, where the steps are as follows:
  • Step 101 The intermediate network device receives the message.
  • Step 102 If the device does not find the fast forwarding entry corresponding to the packet, generate a fast forwarding entry for the packet, perform service processing on the packet, generate a corresponding session entry, and establish the fast forwarding entry and the The association of the session entry is performed, and the packet is forwarded according to the normal forwarding entry, and the association between the fast forwarding entry and the common forwarding entry is established; if the device finds the fast forwarding entry corresponding to the packet Then, the service is processed according to the session entry associated with the fast forwarding entry, and the packet is forwarded according to the fast forwarding entry.
  • the foregoing intermediate network device refers to a network device such as a firewall or a router. Subsequent devices refer to intermediate network devices unless otherwise specified.
  • TCP Transmission Control Protocol
  • NAT service Take the TCP (Transmission Control Protocol) connection with NAT service as an example.
  • the process of a Transaction is as follows:
  • the host initiates a SYN (synchronous) message, and the SYN message arrives at the intermediate network device.
  • the intermediate network device searches for the normal forwarding table according to the destination address of the SYN packet, and performs NAT processing on the source address of the SYN packet in the outbound service phase to establish NAT.
  • the session entry is configured to create a fast forwarding entry 1 according to the found normal forwarding entry, and send the SYN packet to the server according to the found normal forwarding entry.
  • the server receives the SYN packet, and responds to the SYN+ACK (synchronization + acknowledgment) packet.
  • the SYN+ACK packet arrives at the intermediate network device.
  • the intermediate network device searches for the NAT session entry established in step 1) in the inbound service phase.
  • the destination address of the ACK packet is processed by the NAT, and the normal forwarding table is searched according to the destination address of the converted SYN+ACK packet.
  • the fast forwarding entry 2 is established according to the found common forwarding entry.
  • the item sends a SYN+ACK packet to the Host.
  • the host receives the SYN+ACK packet and responds to the ACK packet, and the ACK packet arrives at the intermediate network device.
  • the intermediate network device finds the fast forwarding entry 1 according to the quintuple of the ACK packet, and searches for the step 1) in the outbound direction.
  • the NAT session entry is configured to perform NAT processing on the source address of the ACK packet, and send the ACK packet to the server according to the fast forwarding entry 1.
  • the server responds to the data packet, and the data packet arrives at the intermediate network device.
  • the intermediate network device searches for the fast forwarding entry 2 according to the quintuple of the data packet, and searches for the NAT session entry established in step 1) in the inbound service phase.
  • the destination address of the data packet is processed by NAT.
  • the data packet is sent to the host according to the fast forwarding entry 2.
  • the Transaction process corresponding to the TCP connection of the NAT server can be solved, and the packet forwarding and packet service processing are involved (the types of service processing are various, such as NAT, In the Transaction process of attack defense, packet filtering, etc., for example, the Transaction procedure corresponding to the HTTP connection with the NAT service, the Transaction procedure corresponding to the TCP connection with the packet filtering service, and the like.
  • the types of service processing are various, such as NAT, In the Transaction process of attack defense, packet filtering, etc., for example, the Transaction procedure corresponding to the HTTP connection with the NAT service, the Transaction procedure corresponding to the TCP connection with the packet filtering service, and the like.
  • Each forward and reverse interaction requires a separate query of the NAT session table, which has a large impact on the forwarding performance.
  • steps 1) to 5) of the TCP connection establishment process searching for the normal/fast forwarding table and searching for the NAT entry are performed independently, that is, the table needs to be checked twice, once for the ordinary forwarding table, and once for the NAT table. This finding is time consuming and has a large impact on forwarding performance.
  • step 1) in the TCP connection establishment process 2) Both need to perform a normal forwarding process, which is time consuming and affects the host's online speed.
  • FIG. 2 is a flowchart of a method for processing an IP unicast packet according to another embodiment of the present disclosure, where the steps are as follows:
  • Step 200 Pre-set a section of the control information part of the management structure of the message to store the forward and reverse fast forwarding entries and the session entry index.
  • step 200 it is set: in the management structure of the packet, the session entry index is stored independently of the forward and reverse fast forwarding entries.
  • Step 201 The device receives the IP unicast packet, and according to the forward quintuple of the IP unicast packet, the corresponding fast forwarding entry is not found in the global fast forwarding table, and the management structure of the IP unicast packet is cached. A forward fast forwarding entry and a reverse fast forwarding entry are created in the preset space of the control information part.
  • the packet management structure stores the Layer 2-7 information of the packet in the process of the protocol stack, such as the MAC address, the source and destination IP addresses, the protocol type, and the port number.
  • the temporary information in the packet processing process can also be saved.
  • a space is reserved in the control information part of the packet management structure for storing the temporary information in the packet processing process, that is, the fast forwarding entry and the session entry index.
  • the content of the forward fast forwarding entry includes at least: a forward quintuple, a private network index, an inbound interface index, a forwarding entry index, and an adjacency entry;
  • the reverse fast forwarding entry includes at least: Reverse quintuple, private network index, inbound interface index, forwarding entry index, and adjacency entry index; and session entry index has been added to the global positive as shown in Figure 3. Forward to the fast forwarding entry.
  • the forward quintuple that is, the quintuple of the IP unicast packet, including the source IP address, the source port, the destination IP address, the destination port, and the protocol type;
  • the index of the forwarding entry is the index of the normal forwarding entry that is found according to the destination IP address of the IP unicast packet.
  • the normal forwarding entry includes at least the outbound interface and the next hop address.
  • the index of the adjacency entry that is, the index of the adjacency entry found according to the next hop address and the private network index
  • Inbound interface index that is, the index of the device receiving the packet interface
  • a reverse quintuple ie, a quintuple of reverse traffic of IP unicast packets
  • the reverse quintuple of the IP unicast packet is: the source IP address, the source port being the destination IP address of the IP unicast packet, the destination port, the destination IP address, and the destination port being the source IP address of the IP unicast packet.
  • Source port, the protocol type remains unchanged;
  • the reverse quintuple of the IP unicast packet is: the source IP address, and the source port is the IP unicast report.
  • the destination IP address, destination port, and destination IP address of the source IP address of the IP unicast packet are the source address of the IP unicast packet.
  • the protocol type remains unchanged.
  • the source address and the source port are processed by the NAT.
  • the reverse quintuple of the IP unicast packet is: the source IP address and the source port are The destination IP address, the destination port, the destination IP address, and the destination port of the IP unicast packet are the source IP address of the IP unicast packet, the address and port of the source port after NAT processing, and the protocol type remains unchanged.
  • the index of the forwarding entry is the index of the normal forwarding entry that is found based on the destination IP address of the reverse traffic of the IP unicast packet.
  • the normal forwarding entry includes at least the outbound interface and the next hop address.
  • the index of the adjacency entry that is, the index of the adjacency entry found according to the next hop address and the private network index
  • Inbound interface index index of the inbound interface of the reverse traffic of IP unicast packets
  • the outbound interface in the normal forwarding entry that is found according to the destination IP address of the IP unicast packet is the inbound interface of the IP unicast packet.
  • the device learns the routes to other devices on the network according to the dynamic routing protocol, or the administrators statically configure the routes of other devices on the network to the device.
  • the device generates common routes based on dynamically learned routes or statically configured routes.
  • Forwarding entries such as the forwarding information base (FIB) entries, include: destination IP address, next hop address, and outbound interface information.
  • the adjacency entry mainly includes the destination MAC address and the outbound port information, and the adjacency entry, for example, an ARP (Address Resolution Protocol) entry, is learned according to the ARP packet of the response type.
  • ARP Address Resolution Protocol
  • Step 202 When the fast forwarding entry is not found, the device performs the service processing on the received IP unicast packet according to the configured service information, generates a corresponding session entry and a session entry index, and saves the session entry index to the session entry.
  • the buffer is in a preset space of the control information part of the management structure of the IP unicast message.
  • the session entry index indicates where the session entry is stored in memory.
  • step 203 the IP unicast packet is forwarded, and the association between the forward and reverse fast forwarding entries and the session entry is established.
  • the forwarding process includes: the device performs Layer 2 encapsulation on the packet according to the adjacency entry corresponding to the IP unicast packet, and sends the packet according to the common forwarding entry corresponding to the IP unicast packet.
  • the association between the forward and reverse fast forwarding entries and the session entries is as follows: in the packet management structure, the session entry index is added to the forward and reverse fast forwarding entries respectively, and the session entry index is included. The forward and reverse fast forwarding entries are added to the global fast forwarding table.
  • the management structure of the IP unicast packet is deleted from the cache.
  • the session entry in order to save the memory space occupied by the session entry, the session entry usually does not include a quintuple.
  • the index of the forward and reverse fast forwarding entries of the IP unicast packet may be added to the In the associated session table entry.
  • the session entry index may be directly added to the fast forwarding entry in the management structure of the packet to establish an association between the fast forwarding entry and the session entry.
  • Step 204 The device receives the subsequent IP unicast packet, and finds the corresponding fast forwarding entry in the global fast forwarding table according to the quintuple of the IP unicast packet, and obtains the session entry according to the session entry in the fast forwarding entry.
  • the service processing of the IP unicast packet according to the session entry obtaining the corresponding adjacency entry according to the index of the adjacency entry in the fast forwarding entry, and the IP list according to the adjacency entry
  • the broadcast packet is encapsulated in the Layer 2 packet, and the corresponding forwarding entry is obtained according to the forwarding entry index in the fast forwarding entry, and the IP unicast packet is forwarded according to the common forwarding entry.
  • the fast forwarding entry can associate the common forwarding entry, the session entry, and the adjacency entry.
  • the device receives the subsequent IP unicast packet, it can find it by searching the fast forwarding table.
  • the normal forwarding entries, session entries, and adjacency entries associated with the fast forwarding entry are found, thereby avoiding the three slow searching operations of the normal forwarding table, the session table, and the adjacency table.
  • the IP unicast packets in the embodiment of the present application are: UDP (Universal Datagram Protocol) such as HTTP, FTP (File Transfer Protocol), and other UDP (User Datagram Protocol) such as Trivial File Transfer Protocol (TFTP). Datagram Protocol) Unicast message.
  • UDP Universal Datagram Protocol
  • FTP File Transfer Protocol
  • TFTP Trivial File Transfer Protocol
  • TFTP Trivial File Transfer Protocol
  • FIG. 4 is a flowchart of a method for processing an IP multicast packet according to another embodiment of the present disclosure, and the specific steps are as follows:
  • Step 400 Pre-set a section of the control information part of the management structure of the packet to store the forward fast forwarding entry and the session entry index.
  • the reverse fast forwarding entry may be stored in the preset space of the control information part of the packet management structure, but the IP multicast packet is not generated. Reverse forwarding of entries automatically, so the contents of the reverse fast forwarding entry are always empty.
  • Step 401 The device receives the IP multicast packet, and according to the forward quintuple of the IP multicast packet, the corresponding fast forwarding entry is not found in the global fast forwarding table, and the IP multicast packet is cached. A forward fast forwarding entry is created in the preset space of the control information portion of the management structure.
  • the forward fast forwarding entry in the management structure of the IP multicast packet includes: a forward quintuple, a private network index, an inbound interface index, a forwarding entry index, and an adjacency entry index.
  • a forward quintuple As shown in FIG. 3, the forward fast forwarding entry in the management structure of the IP multicast packet includes: a forward quintuple, a private network index, an inbound interface index, a forwarding entry index, and an adjacency entry index.
  • the meaning of each content is as follows:
  • a forward quintuple that is, a quintuple of IP multicast messages
  • the index of the forwarding entry is the index of the normal forwarding entry that is found according to the destination IP address of the IP multicast packet, that is, the multicast address.
  • the normal forwarding entry includes at least the outbound interface and the next hop address.
  • the index of the adjacency entry that is, the index of the adjacency entry found according to the next hop address and the private network index
  • Inbound interface index receiving the index of the IP multicast packet interface
  • Step 402 When the fast forwarding entry is not found, the device performs service processing on the IP multicast packet according to the configured service information, generates a corresponding session entry and a session entry index, and saves the session entry index to the cache.
  • the preset space of the control information part of the management structure of the IP multicast packet.
  • the session entry index indicates where the session entry is stored in memory.
  • Service processing such as NAT, ASPF, attack detection and prevention, packet filtering, and other session-based service processing.
  • step 403 the IP multicast packet is forwarded, and the association between the forward fast forwarding entry and the session entry is established.
  • the forwarding process includes: the device performs Layer 2 encapsulation on the IP multicast packet according to the adjacency entry corresponding to the IP multicast packet, and the IP multicast packet is sent according to the common forwarding entry corresponding to the IP multicast packet. Send it out.
  • the association between the forward fast forwarding entry and the session entry is as follows: in the packet management structure, the session entry index is added to the forward fast forwarding entry, and the forward fast forwarding table including the session entry index is included. Items are added to the global fast forwarding table.
  • the management structure of the IP multicast packet is deleted from the cache.
  • the session entry in order to save the memory space occupied by the session entry, the session entry usually does not include a quintuple.
  • the index of the forward fast forwarding entry of the packet may be added to the associated session entry. in.
  • the session table can also be directly used.
  • the item index is added to the fast forwarding entry in the management structure of the packet to establish an association between the fast forwarding entry and the session entry.
  • Step 404 The device receives the subsequent IP multicast packet, and according to the quintuple of the IP multicast packet, finds the corresponding fast forwarding entry in the global fast forwarding table, according to the session table in the fast forwarding entry.
  • the item index obtains the corresponding session entry, performs the service processing on the IP multicast packet according to the session entry, and obtains the corresponding adjacency entry according to the index of the adjacency entry in the fast forwarding entry, according to the adjacency list.
  • the IP multicast packet is encapsulated in the layer 2, and the corresponding forwarding entry is obtained according to the forwarding entry in the fast forwarding entry, and the IP multicast packet is forwarded according to the common forwarding entry.
  • the process is the same as the process shown in FIG. 2 after the intermediate device receives the IP unicast packet.
  • the Host initiates a SYN packet, and the SYN packet reaches the intermediate network device.
  • the intermediate network device If the intermediate network device does not find the corresponding fast forwarding entry according to the quintuple of the SYN packet, the intermediate network device:
  • a. Perform NAT processing on the source address of the SYN packet in the outbound service phase to generate a NAT session entry, and put the index of the NAT session entry into the preset space of the control information part of the SYN packet management structure;
  • a forward and reverse fast forwarding entry is created in a preset space of the control information part of the management structure of the SYN packet;
  • the content of the forward fast forwarding entry includes at least: a forward quintuple, a private network index, an inbound interface index, a forwarding entry index, and an adjacency entry;
  • the reverse fast forwarding entry includes at least: a reverse quintuple, Private network index, inbound interface index, forwarding entry index, and adjacency entry index.
  • the source IP address and source port of the reverse quintuple are the destination IP address of the SYN packet. Address and destination port; the destination IP address of the reverse quintuple is the address of the source IP address of the SYN packet processed by the NAT, and the destination port is the source port of the SYN packet; or the destination IP address of the reverse quintuple
  • the destination port is the source IP address of the SYN packet and the address and port of the source port processed by NAT.
  • the SYN packet is forwarded and processed.
  • the index of the NAT session entry is added to the forward and reverse fast forwarding entries, and the NAT session entry is included.
  • the forward and reverse fast forwarding entries of the index are stored in the global fast forwarding table.
  • the server receives the SYN packet and responds to the SYN+ACK (synchronization + acknowledgment) message, and the SYN+ACK packet arrives at the intermediate network device;
  • the intermediate network device searches for the corresponding fast forwarding entry (ie, the reverse fast forwarding entry in the above 1) in the global fast forwarding table according to the quintuple of the SYN+ACK packet, according to the common in the fast forwarding entry.
  • the forwarding entry index and the adjacency entry get the corresponding common forwarding entry and the adjacency entry, and obtain the corresponding NAT session entry according to the NAT session entry in the fast forwarding entry, and the SYN according to the NAT session entry.
  • the destination address of the ACK packet is processed by the NAT.
  • the SYN+ACK packet is encapsulated in the Layer 2 packet according to the obtained adjacency entry.
  • the SYN+ACK packet is sent to the Host according to the obtained common forwarding entry.
  • the NAT session entry includes: an IP address before the NAT processing and an IP address processed by the NAT, and the intermediate network device confirms the destination address of the SYN+ACK packet and the NAT in the NAT session entry. If the address matches, the acknowledgment should be performed on the destination address of the SYN+ACK packet. The destination address of the SYN+ACK packet is changed to the address before the NAT processing in the NAT session entry.
  • the NAT session entry includes: an IP address before NAT processing. Address, port address, and IP address and port address after NAT processing.
  • the intermediate network device confirms that the destination IP address of the SYN+ACK packet matches the NAT-processed address in the NAT session entry, and then the SYN+ACK packet is received.
  • the destination IP address can be changed to the IP address before the NAT processing in the NAT session entry.
  • the intermediate network device confirms that the destination port address of the SYN+ACK packet matches the NAT-processed port address in the NAT session entry.
  • the destination port address of the SYN+ACK packet can be changed to the port address before NAT processing in the NAT session entry.
  • the Host receives the SYN+ACK packet, responds to the ACK packet, and the ACK packet arrives at the intermediate network device.
  • the intermediate network device searches for the corresponding fast forwarding entry in the global fast forwarding table according to the quintuple of the ACK packet, that is, the forward fast forwarding entry in the above 1), according to the ordinary forwarding table in the fast forwarding entry.
  • the entry index and the adjacency entry obtain the corresponding normal forwarding entry and the adjacency entry, and obtain the corresponding NAT session entry according to the NAT session entry in the fast forwarding entry, and the ACK packet is obtained according to the NAT session entry.
  • the source address is processed by the NAT, and the ACK packet is encapsulated in the Layer 2 packet according to the obtained adjacency entry.
  • the ACK packet is sent to the server according to the obtained common forwarding entry.
  • the operation of checking the session table in the forwarding process is reduced, the forwarding performance is greatly improved, and the uplink speed of the device is accelerated. Increased build rate.
  • the device receives the first packet of the data stream, and triggers the establishment of the forward fast forwarding entry and the reverse fast forwarding entry, so that the first packet of the reverse data stream can be forwarded according to the reverse fast forwarding entry.
  • the first packet of the reverse data stream is slowed according to the normal forwarding entry. In terms of transmission, the forwarding performance is improved, the speed of the device is accelerated, and the new rate is also increased.
  • FIG. 5 is a schematic structural diagram of a packet processing apparatus 50 according to an embodiment of the present disclosure, where the apparatus mainly includes:
  • the receiving module 51 receiving the message, sending the message to the processing and forwarding module 52;
  • the processing and forwarding module 52 if the fast forwarding entry corresponding to the packet is not found, generates a fast forwarding entry of the packet, performs service processing on the packet, generates a corresponding session entry, and establishes the fast forwarding entry. Correlation with the session entry, and forwarding the packet according to the normal forwarding entry; if the fast forwarding entry corresponding to the packet is found, the session entry associated with the fast forwarding entry is found. The packet is processed by the service, and the packet is forwarded according to the fast forwarding entry.
  • the method further includes: generating a session entry index, indicating location information of the session entry in the memory; and the processing and forwarding module 52 establishing the fast
  • the association between the forwarding entry and the session entry includes: adding the session entry index to the fast forwarding entry.
  • the processing and forwarding module 52 when the packet received by the receiving module 51 is a unicast packet, the processing and forwarding module 52 generates a fast forwarding entry of the packet, including: according to the forward quintuple of the packet The forward forwarding entry of the packet is generated, and the reverse fast forwarding entry of the packet is generated according to the reverse quintuple of the packet; the processing and forwarding module 52 adds the index of the session entry to the fast forwarding of the packet.
  • the publication item includes: adding the session entry index to the forward fast forwarding entry and the reverse fast forwarding entry of the packet respectively.
  • the processing and forwarding module 52 when the packet received by the receiving module 51 is a multicast packet, the processing and forwarding module 52 generates a fast forwarding entry of the packet, including: according to the forward five-element of the packet The group forwards the forward forwarding entry of the packet; the processing and forwarding module 52 adds the session entry index to the fast forwarding entry of the packet, including: adding the session entry index Forward forwarding entries to the packet.
  • the forward quintuple according to the processing and forwarding module 52 includes a source IP address, a source port, a destination IP address, a destination port, and a protocol type of the packet; the reverse quintuple includes The source IP address and the source port are the destination IP address and the destination port of the packet. The destination IP address and the destination port are the source IP address and the source port of the packet. The protocol type is the packet. Type of agreement.
  • the processing and forwarding module 52 is further configured to: save the fast forwarding entry of the packet into the management structure of the packet; After generating the session entry index, the module 52 is further configured to: save the session entry index into the management structure of the packet; and the processing and forwarding module 52 establishes the fast forwarding entry and the session entry.
  • the association includes: adding, in the management structure of the packet, the session entry index to the fast forwarding entry of the packet, and storing the fast forwarding entry including the session entry index into the global fast forwarding table. .
  • FIG. 6 is a schematic structural diagram of hardware of a device including a packet processing apparatus according to an embodiment of the present disclosure.
  • the device includes: a machine readable storage medium 62, a CPU 61, and other hardware, wherein:
  • the machine readable storage medium 62 an instruction code that stores message processing logic; the operations performed when the instruction code is executed by the CPU 61 are mainly functions performed by the message processing device 50.
  • the CPU 61 communicates with the machine readable storage medium 62, reads and executes the instruction code stored in the machine readable storage medium 62, and performs the functions performed by the message processing apparatus 50 described above.
  • the message processing apparatus 50 described above functions as a logically significant device, it is formed by the CPU 61 executing corresponding computer program instructions in the machine readable storage medium 62.
  • the formed message processing means 50 is configured to perform the corresponding operations in accordance with the message processing method in the above embodiment.
  • Machine-readable storage medium 62 can be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, and so forth.
  • the machine-readable storage medium 62 can be: RAM (Radom Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as a hard drive), solid state drive, any type of storage.
  • RAM Random Access Memory
  • volatile memory volatile memory
  • non-volatile memory such as a hard drive
  • solid state drive any type of storage.
  • a disk such as a compact disc, dvd, etc.
  • a similar storage medium or a combination thereof.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

中间网络设备接收报文，若未查找到报文对应的快速转发表项，则生成报文的快速转发表项，对报文进行业务处理、生成对应的会话表项，建立所述快速转发表项和所述会话表项的关联，并根据普通转发表项对报文进行转发处理；若查找到报文对应的快速转发表项，则根据查找到的快速转发表项关联的会话表项，对报文进行业务处理，并根据查找到的快速转发表项对报文进行转发处理。

Description

报文处理 背景技术
会话管理是为了实现NAT(Network Address Translation，网络地址转换)、ASPF(Advanced Stateful Packet Filter，高级状态包过滤)、攻击检测及防范等基于会话进行处理的业务而抽象出来的公共功能。此功能把传输层报文之间的交互关系抽象为会话，并根据发起方和响应方的报文信息对会话进行状态更新和老化，支持多个业务特性对同一个业务报文进行处理。
附图简要说明
图1为本申请一实施例提供的报文处理方法流程图；
图2为本申请另一实施例提供的IP单播报文处理方法流程图；
图3为本申请实施例提供的全局正向快速转发表项的结构示意图；
图4为本申请实施例提供的IP组播报文处理方法流程图；
图5为本申请实施例提供的报文处理装置的组成示意图；
图6为本申请实施例提供的包含报文处理装置的设备的硬件结构示意图。
实施方式
客户端向服务器发起连接请求报文的时候，系统会创建一个会话表项。该表项中记录了一个会话所对应的请求报文信息和回应报文信息，包括源IP地址/端口号、目的IP地址/端口号、传输层协议类型、应用层协议类型、会话的协议状态等。
报文转发速率是衡量设备性能的一项关键指标。按照常规流程，设备收到一个报文后，根据报文的目的地址寻找转发表中与之匹配的转发表项，然后确定一条最佳的路径，同时还将报文按照数据链路层上使用的协议进行封装，最后进行报文转发。
快速转发是采用高速缓存来处理报文，采用了基于数据流的技术。
快速转发使用5元组(即源IP地址、源端口号、目的IP地址、目的端口号、协议号)来标识一条数据流。当一条数据流的第一个报文通过查找路由表转发后，在高速缓存中生成相应的快速转发表项，该数据流后续报文的转发就可以通过直接查找快速转发表进行转发。这样便大大缩减了IP报文的排队流程，减少报文的转发时间，提高IP报文的转发速率。
一台网络设备所能承受最大新建速率的基本指标，说明了该网络设备在不丢失连接的基础上每秒能处理的最大连接数，其单位为连接/秒(Transactions Per Second)。
以带NAT服务的HTTP(Hyper Text Transfer Protocol，超文本传输协议)连接的新建速率测试过程为例：1)客户端通过网络设备向服务器发起HTTP连接请求，网络设备会对交互报文进行NAT转换；2)连接建立成功后，客户端通过HTTP从服务器获取少量的数据；3)客户端拆除该HTTP连接；以上三个步骤为一个完整的transaction，而新建速率则是一秒时间内能完成的transaction总数，这个速率能够综合体现网络设备的普通转发、快速转发、业务处理性能。
图1为本申请一实施例提供的报文处理方法流程图，其步骤如下：
步骤101：中间网络设备接收报文。
步骤102：若设备未查找到报文对应的快速转发表项，则生成报文的快速转发表项，对报文进行业务处理、生成对应的会话表项，建立所述快速转发表项和所述会话表项的关联，并根据普通转发表项对报文进行转发处理，同时建立所述快速转发表项和所述普通转发表项的关联；若设备查找到报文对应的快速转发表项，则根据查找到的快速转发表项关联的会话表项，对报文进行业务处理，并根据查找到的快速转发表项对报文进行转发处理。
在一个实施例中，上述中间网络设备是指防火墙、路由器等网络设备。后续涉及的设备如果未特殊说明均指中间网络设备。
以带NAT服务的TCP(Transmission Control Protocol，传输控制协议)连接为例，一个Transaction的过程如下：
1)Host(主机)发起连接请求：
Host发起SYN(同步)报文，SYN报文到达中间网络设备；中间网络设备根据SYN报文的目的地址查找普通转发表，在出方向业务阶段对SYN报文的源地址进行NAT处理，建立NAT会话表项，根据查找到的普通转发表项建立快速转发表项1，根据查找到的普通转发表项将SYN报文发送给Server(服务器)。
2)Server回应连接请求：
Server收到SYN报文，回应SYN+ACK(同步+确认)报文，SYN+ACK报文到达中间网络设备；中间网络设备在入方向业务阶段查找步骤1)建立的NAT会话表项，对SYN+ACK报文的目的地址进行NAT处理，根据转换后的SYN+ACK报文的目的地址查找普通转发表，根据查找到的普通转发表项建立快速转发表项2，根据查找到的普通转发表项将SYN+ACK报文发送给Host。
3)Host确认连接：
Host收到SYN+ACK报文，回应ACK报文，ACK报文到达中间网络设备；中间网络设备根据ACK报文的五元组查找到快速转发表项1，在出方向业务阶段查找步骤1)建立的NAT会话表项，对ACK报文的源地址进行NAT处理，根据快速转发表项1将ACK报文发送给Server。
4)Host向Server请求数据：与步骤3)相同。
5)Server回应数据报文：
Server回应数据报文，数据报文到达中间网络设备；中间网络设备根据数据报文的五元组查找到快速转发表项2，在入方向业务阶段查找步骤1)建立的NAT会话表项，对数据报文的目的地址进行NAT处理，根据快速转发表项2将数据报文发送给Host。
通过采用本申请图1所示的实施例，可以解决上述NAT服务器的TCP连接所对应的Transaction过程中，以及涉及到报文转发、报文业务处理(业务处理的类型有多种，例如NAT、攻击防范、包过滤等)的Transaction过程中，例如，带NAT服务的HTTP连接对应的Transaction过程，带包过滤服务的TCP连接所对应的Transaction过程等出现的下列问题。
每一次正向和反向交互，都需要执行一次单独查询NAT会话表的动作，对转发性能有较大影响。例如：TCP连接建立过程中的步骤1)～5)中，查找普通/快速转发表和查找NAT表项是独立进行的，即需要查两次表，一次是普通转发表，一次是NAT表，这样查找比较耗时，对转发性能影响较大。
普通转发过程中，正向和反向的报文需要分别执行一次普通转发过程，对上线速度有较大影响。例如：TCP连接建立过程中的步骤1)、 2)都需要执行一次普通转发过程，这样比较耗时，影响了Host的上线速度。
随着网络应用的规模不断扩大，目前的防火墙设备需要支持较高的业务新建速率如：500K connections per sec，而现有的Transaction过程由于多次查会话表、多次普通转发，极大地制约着新建速率的提升。
图2为本申请另一实施例提供的IP单播报文处理方法流程图，其步骤如下：
步骤200：预先设定报文的管理结构的控制信息部分的一段空间专用于存放正、反向快速转发表项和会话表项索引。
步骤200中，是设定：在报文的管理结构中，是将会话表项索引独立于正、反向快速转发表项存放。
步骤201：设备接收到IP单播报文，根据IP单播报文的正向五元组在全局快速转发表中未查找到对应的快速转发表项，则在缓存中该IP单播报文的管理结构的控制信息部分的预设空间中创建正向快速转发表项和反向快速转发表项。
报文管理结构保存报文在协议栈处理过程中的2-7层信息，比如MAC地址、源和目的IP地址、协议类型、端口号等，还可以保存报文处理过程中的临时信息，本申请实施例中，在报文管理结构的控制信息部分专门预留了一段空间用于保存报文处理过程中的临时信息即，快速转发表项和会话表项索引。
如图3所示，正向快速转发表项的内容至少包括：正向五元组、私网索引、入接口索引、转发表项索引和邻接表项索引；反向快速转发表项至少包括：反向五元组、私网索引、入接口索引、转发表项索引和邻接表项索引；并且会话表项索引已被添加至图3所示的全局正 向快速转发表项中。
正向快速转发表项中的各项内容的含义如下：
1)正向五元组即，IP单播报文的五元组，包括源IP地址、源端口、目的IP地址、目的端口和协议类型；
2)转发表项索引即，根据IP单播报文的目的IP地址查找到的普通转发表项的索引，普通转发表项至少包括出接口、下一跳地址等；
3)邻接表项索引即，根据下一跳地址和私网索引查找到的邻接表项的索引；
4)入接口索引，即设备接收报文接口的索引；
5)私网索引，与入接口绑定。
反向快速转发表项中的各项内容的含义如下：
1)反向五元组即，IP单播报文的反向流量的五元组；
其中，IP单播报文的反向五元组为：源IP地址、源端口为该IP单播报文的目的IP地址、目的端口，目的IP地址、目的端口为该IP单播报文的源IP地址、源端口，协议类型保持不变；
在一种实施例中，IP单播报文进入设备后，在设备上进行了源地址的NAT处理，则IP单播报文的反向五元组为：源IP地址、源端口为该IP单播报文的目的IP地址、目的端口，目的IP地址为该IP单播报文的源IP地址经NAT处理后的地址、目的端口为该IP单播报文的源端口，协议类型保持不变。
在一种实施例中，IP单播报文进入设备后，在设备上进行了源地址和源端口的NAT处理，则IP单播报文的反向五元组为：源IP地址、源端口为该IP单播报文的目的IP地址、目的端口，目的IP地址、目的端口为该IP单播报文的源IP地址、源端口经NAT处理后地址和端口，协议类型保持不变。
2)转发表项索引即，根据IP单播报文的反向流量的目的IP地址查找到的普通转发表项的索引，普通转发表项至少包括出接口、下一跳地址等；
3)邻接表项索引即，根据下一跳地址和私网索引查找到的邻接表项的索引；
4)入接口索引，IP单播报文的反向流量的入接口的索引；
对于设备接收到的当前正向流向的IP单播报文而言，根据该IP单播报文的目的IP地址查找到的普通转发表项中的出接口即为此处的入接口；
5)私网索引，与反向流量的入接口绑定。
设备会根据动态路由协议学习到到达网络中的其他设备的路由，或者管理员等将到达网络中的其他设备的路由静态配置到设备上，设备根据动态学习到的路由或者静态配置的路由生成普通转发表项如：FIB(Forwarding Information Base，转发信息库)表项，普通转发表项主要包括：目的IP地址、下一跳地址和出接口信息；
邻接表项主要包括：目的MAC地址和出端口信息，邻接表项例如：ARP(Address Resolution Protocol，地址解析协议)表项，是根据应答类型的ARP报文学习到的。
步骤202：在未查找到快速转发表项时，设备根据配置的业务信息对接收的IP单播报文进行业务处理，生成对应的会话表项以及会话表项索引，将该会话表项索引保存到缓存中该IP单播报文的管理结构的控制信息部分的预设空间中。
会话表项索引指示了会话表项在内存中的存储位置。
业务处理如：NAT、ASPF、攻击检测及防范等基于会话进行的业务处理。
步骤203：对IP单播报文进行转发处理，在转发处理的同时，建立正、反向快速转发表项和会话表项的关联。
上述转发处理包括：设备根据该IP单播报文对应的邻接表项对该报文进行二层封装，根据该IP单播报文对应的普通转发表项将该报文发送出去。
建立正、反向快速转发表项和会话表项的关联包括：在报文管理结构中，将会话表项索引分别添加到正、反向快速转发表项中，将包含了会话表项索引的正、反向快速转发表项添加到全局快速转发表。
在IP单播报文转发出去后，该IP单播报文的管理结构就从缓存中删除了。
另外，为了节省会话表项占用的内存空间，会话表项中通常不包含五元组，在一种实施例中，还可以将IP单播报文的正、反向快速转发表项的索引添加到关联的会话表项中。
在一种实施例中，在生成会话表项索引后，还可以直接将会话表项索引添加到报文的管理结构中的快速转发表项中以建立快速转发表项和会话表项的关联。
步骤204：设备接收到后续IP单播报文，根据IP单播报文的五元组在全局快速转发表中查找到对应的快速转发表项，则根据该快速转发表项中的会话表项索引获取对应的会话表项，根据该会话表项对该IP单播报文进行业务处理，根据该快速转发表项中的邻接表项索引获取到对应的邻接表项，根据该邻接表项对该IP单播报文进行二层封装，根据该快速转发表项中的转发表项索引获取到对应的普通转发表项，根据该普通转发表项将该IP单播报文转发出去。也就是说，快速转发表项可以将普通转发表项，会话表项，邻接表项关联。当设备接收到后续IP单播报文时，通过查找快速转发表，可以找到与该 查找到的快速转发表项相关联的普通转发表项，会话表项以及邻接表项，从而避免三次慢速的查找普通转发表，会话表以及邻接表的动作。
本申请实施例中的IP单播报文如：HTTP、FTP(File Transfer Protocol，文件传输协议)等TCP单播报文、TFTP(Trivial File Transfer Protocol，简单文件传输协议)等UDP(User Datagram Protocol，用户数据报协议)单播报文。
图4为本申请另一实施例提供的IP组播报文处理方法流程图，其具体步骤如下：
步骤400：预先设定报文的管理结构的控制信息部分的一段空间专用于存放正向快速转发表项和会话表项索引。
本步骤中，为了与IP单播报文的处理过程兼容，也可以在报文的管理结构的控制信息部分的预设空间中存放反向快速转发表项，但由于IP组播报文不会生成反向快速转发表项，因此，反向快速转发表项的内容始终为空。
步骤401：设备接收到IP组播报文，根据IP组播报文的正向五元组在全局快速转发表中未查找到对应的快速转发表项，则在缓存中该IP组播报文的管理结构的控制信息部分的预设空间中创建正向快速转发表项。
如图3所示，IP组播报文的管理结构中的正向快速转发表项包括：正向五元组、私网索引、入接口索引、转发表项索引和邻接表项索引。其中，各项内容的含义具体如下：
1)正向五元组即，IP组播报文的五元组；
2)转发表项索引即，根据IP组播报文的目的IP地址(即组播地址)查找到的普通转发表项的索引，普通转发表项至少包括出接口、下一跳地址等；
3)邻接表项索引即，根据下一跳地址和私网索引查找到的邻接表项的索引；
4)入接口索引，接收IP组播报文接口的索引；
5)私网索引，与入接口绑定。
步骤402：在未查找到快速转发表项时，设备根据配置的业务信息对IP组播报文进行业务处理，生成对应的会话表项以及会话表项索引，将该会话表项索引保存到缓存中该IP组播报文的管理结构的控制信息部分的预设空间中。
会话表项索引指示了会话表项在内存中的存储位置。
业务处理如：NAT、ASPF、攻击检测及防范、包过滤等基于会话进行的业务处理。
步骤403：对IP组播报文进行转发处理，在转发处理的同时，建立正向快速转发表项和会话表项的关联。
上述转发处理包括：设备根据该IP组播报文对应的邻接表项对该IP组播报文进行二层封装，根据该IP组播报文对应的普通转发表项将该IP组播报文发送出去。
建立正向快速转发表项和会话表项的关联包括：在报文管理结构中，将会话表项索引添加到正向快速转发表项中，将包含了会话表项索引的正向快速转发表项添加到全局快速转发表。
在IP组播报文转发出去后，该IP组播报文的管理结构就从缓存中删除了。
另外，为了节省会话表项占用的内存空间，会话表项中通常不包含五元组，在一种实施例中，还可以将报文的正向快速转发表项的索引添加到关联会话表项中。
在一种实施例中，在生成会话表项索引后，还可以直接将会话表 项索引添加到报文的管理结构中的快速转发表项中以建立快速转发表项和会话表项的关联。
步骤404：设备接收到后续IP组播报文，根据该IP组播报文的五元组在全局快速转发表中查找到对应的快速转发表项，则根据该快速转发表项中的会话表项索引获取到对应的会话表项，根据该会话表项对该IP组播报文进行业务处理，根据该快速转发表项中的邻接表项索引获取到对应的邻接表项，根据该邻接表项对该IP组播报文进行二层封装，根据该快速转发表项中的转发表项索引获取到对应的普通转发表项，根据该普通转发表项将该IP组播报文转发出去。
在一种实施例中，如果有针对IP组播报文回复的IP单播报文，当中间设备收到IP单播报文后，处理过程与图2所示流程相同。
仍以带NAT服务的TCP连接为例，给出本发明的一个应用示例：
1)Host发起连接请求：
Host发起SYN报文，SYN报文到达中间网络设备；
中间网络设备根据SYN报文的五元组未查找到对应的快速转发表项，则：
a、在出方向业务阶段对SYN报文的源地址进行NAT处理，生成NAT会话表项，将NAT会话表项的索引放入SYN报文的管理结构的控制信息部分的预设空间中；在SYN报文的管理结构的控制信息部分的预设空间内创建正、反向快速转发表项；
正向快速转发表项的内容至少包括：正向五元组、私网索引、入接口索引、转发表项索引和邻接表项索引；反向快速转发表项至少包括：反向五元组、私网索引、入接口索引、转发表项索引和邻接表项索引。
其中，反向五元组的源IP地址、源端口为SYN报文的目的IP 地址、目的端口；反向五元组的目的IP地址为SYN报文的源IP地址经NAT处理后的地址、目的端口为SYN报文的源端口；或者，反向五元组的目的IP地址、目的端口为SYN报文的源IP地址、源端口经NAT处理后的地址、端口。
b、对SYN报文进行转发处理，在转发处理的同时，在该SYN报文的管理结构中将NAT会话表项的索引添加到正、反向快速转发表项，并将包含NAT会话表项的索引的正、反向快速转发表项存入全局快速转发表中。
2)Server回应连接请求：
Server收到SYN报文，回应SYN+ACK(同步+确认)报文，SYN+ACK报文到达中间网络设备；
中间网络设备根据SYN+ACK报文的五元组在全局快速转发表中查找到对应的快速转发表项(即上述1)中的反向快速转发表项)，根据快速转发表项中的普通转发表项索引和邻接表项索引获取到对应的普通转发表项和邻接表项，根据快速转发表项中的NAT会话表项索引获取对应的NAT会话表项，根据该NAT会话表项对SYN+ACK报文的目的地址进行NAT处理，根据获取到的邻接表项对SYN+ACK报文进行二层封装，根据获取到的普通转发表项将SYN+ACK报文发送给Host。
在一种实施例中，NAT会话表项中包含：NAT处理前的IP地址和NAT处理后的IP地址，中间网络设备确认SYN+ACK报文的目的地址与NAT会话表项中的NAT处理后的地址匹配，则确认应该对SYN+ACK报文的目的地址进行NAT处理，将SYN+ACK报文的目的地址修改为NAT会话表项中的NAT处理前的地址即可。
在另一种实施例中，NAT会话表项中包含：NAT处理前的IP地 址、端口地址和NAT处理后的IP地址、端口地址，中间网络设备确认SYN+ACK报文的目的IP地址与NAT会话表项中的NAT处理后的地址匹配，则将SYN+ACK报文的目的IP地址修改为NAT会话表项中的NAT处理前的IP地址即可；中间网络设备确认SYN+ACK报文的目的端口地址与NAT会话表项中的NAT处理后的端口地址匹配，则将SYN+ACK报文的目的端口地址修改为NAT会话表项中的NAT处理前的端口地址即可。
3)Host确认连接：
Host收到SYN+ACK报文，回应ACK报文，ACK报文到达中间网络设备；
中间网络设备根据ACK报文的五元组在全局快速转发表中查找到对应的快速转发表项(即上述1)中的正向快速转发表项)，根据快速转发表项中的普通转发表项索引和邻接表项索引获取到对应的普通转发表项和邻接表项，根据快速转发表项中的NAT会话表项索引获取对应的NAT会话表项，根据该NAT会话表项对ACK报文的源地址进行NAT处理，根据获取到的邻接表项对ACK报文进行二层封装，根据获取到的普通转发表项将ACK报文发送给Server。
4)Host向Server请求数据：与步骤3)相同。
5)Server回应数据：与步骤2)相同。
从本申请实施例可以看出：通过将快速转发表项与会话表项进行关联，从而：减少了转发过程中的查会话表操作，大大提高了转发性能，加快了设备的上线速度，同时也提升了新建速率。
另外，设备接收数据流首报文，同时触发正向快速转发表项、反向快速转发表项的建立，可以使反向数据流首报文按照反向快速转发表项进行快速转发，相比反向数据流首报文按照普通转发表项的慢转 发而言，提高了转发性能，加快了设备的上线速度，同时也提升了新建速率。
图5为本申请实施例提供的报文处理装置50的组成示意图，该装置主要包括：
接收模块51：接收报文，将报文发送给处理及转发模块52；
处理及转发模块52：若未查找到报文对应的快速转发表项，则生成报文的快速转发表项，对报文进行业务处理、生成对应的会话表项，建立所述快速转发表项和所述会话表项的关联，并根据普通转发表项对报文进行转发处理；若查找到报文对应的快速转发表项，则根据查找到的快速转发表项关联的会话表项，对报文进行业务处理，并根据查找到的快速转发表项对报文进行转发处理。
在一种实施例中，处理及转发模块52生成会话表项后，还用于：生成会话表项索引，指示会话表项在内存中的位置信息；所述处理及转发模块52建立所述快速转发表项和所述会话表项的关联，包括：将会话表项索引添加到快速转发表项。
在一种实施例中，当接收模块51接收到的所述报文为单播报文时，所述处理及转发模块52生成报文的快速转发表项包括：根据报文的正向五元组生成报文的正向快速转发表项，根据报文的反向五元组生成报文的反向快速转发表项；所述处理及转发模块52将会话表项索引添加到报文的快速转发表项包括：将会话表项索引分别添加到报文的正向快速转发表项和反向快速转发表项。
在一种实施例中，当接收模块51接收到的所述报文为组播报文时，所述处理及转发模块52生成报文的快速转发表项包括：根据报文的正向五元组生成报文的正向快速转发表项；所述处理及转发模块52将会话表项索引添加到报文的快速转发表项包括：将会话表项索引添加 到报文的正向快速转发表项。
在一种实施例中，所述处理及转发模块52根据的正向五元组包括所述报文的源IP地址、源端口、目的IP地址、目的端口和协议类型；反向五元组包括的源IP地址、源端口为所述报文的目的IP地址、目的端口，包括的目的IP地址、目的端口为所述报文的源IP地址、源端口，包括的协议类型为所述报文的协议类型。
在一种实施例中，所述处理及转发模块52生成报文的快速转发表项之后，还用于：将报文的快速转发表项保存到报文的管理结构中；所述处理及转发模块52生成会话表项索引之后，还用于：将所述会话表项索引保存到报文的管理结构中；所述处理及转发模块52建立所述快速转发表项和所述会话表项的关联包括：在所述报文的管理结构中，将所述会话表项索引添加到所述报文的快速转发表项中，将包含会话表项索引的快速转发表项存入全局快速转发表。
本申请实施例提供的设备可以是软硬件结合的可编程设备，从硬件层面而言，设备的硬件架构示意图具体可以参见图6。图6为本申请实施例提供的包含报文处理装置的设备的硬件结构示意图。该设备中包括：机器可读存储介质62、CPU 61和其它硬件，其中：
机器可读存储介质62：存储报文处理逻辑的指令代码；所述指令代码被CPU 61执行时完成的操作主要为报文处理装置50完成的功能。
CPU 61：与机器可读存储介质62通信，读取和执行机器可读存储介质62中存储的所述指令代码，完成上述报文处理装置50完成的功能。
当上述报文处理装置50作为一个逻辑意义上的装置时，其是通过CPU 61运行机器可读存储介质62中对应的计算机程序指令形成的。 当对应的计算机程序指令被执行时，形成的报文处理装置50用于按照上述实施例中的报文处理方法执行相应操作。
机器可读存储介质62可以是任何电子、磁性、光学或其它物理存储装置，可以包含或存储信息，如可执行指令、数据，等等。例如，机器可读存储介质62可以是：RAM(Radom Access Memory，随机存取存储器)、易失存储器、非易失性存储器、闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、dvd等)，或者类似的存储介质，或者它们的组合。
本申请所描述的任一机器可读存储介质都可以被认为是非暂时性的。

Claims (12)

  1. 一种报文处理方法，其特征在于，该方法包括：
    中间网络设备接收报文，若未查找到报文对应的快速转发表项，则生成报文的快速转发表项，对报文进行业务处理、生成对应的会话表项，建立所述快速转发表项和所述会话表项的关联，并根据普通转发表项对报文进行转发处理；
    若查找到报文对应的快速转发表项，则根据查找到的快速转发表项关联的会话表项，对报文进行业务处理，并根据查找到的快速转发表项对报文进行转发处理。
  2. 根据权利要求1所述的方法，其特征在于，生成会话表项后，所述方法还包括：生成会话表项索引，指示会话表项在内存中的位置信息；
    所述建立所述快速转发表项和所述会话表项的关联，包括：将会话表项索引添加到快速转发表项。
  3. 根据权利要求2所述的方法，其特征在于，当所述报文为单播报文时，
    所述生成报文的快速转发表项包括：根据报文的正向五元组生成报文的正向快速转发表项，根据报文的反向五元组生成报文的反向快速转发表项；
    所述将会话表项索引添加到报文的快速转发表项包括：
    将会话表项索引分别添加到报文的正向快速转发表项和反向快速转发表项。
  4. 根据权利要求2所述的方法，其特征在于，当所述报文为组播报文时，
    所述生成报文的快速转发表项包括：
    根据报文的正向五元组生成报文的正向快速转发表项；
    所述将会话表项索引添加到报文的快速转发表项包括：
    将会话表项索引添加到报文的正向快速转发表项。
  5. 根据权利要求3或4所述的方法，其特征在于，
    所述正向五元组包括所述报文的源IP地址、源端口、目的IP地址、目的端口和协议类型；
    所述反向五元组包括的源IP地址、源端口为所述报文的目的IP地址、目的端口，包括的目的IP地址、目的端口为所述报文的源IP地址、源端口，包括的协议类型为所述报文的协议类型。
  6. 根据权利要求2所述的方法，其特征在于，
    所述生成报文的快速转发表项之后，所述方法还包括：将报文的快速转发表项保存到报文的管理结构中；
    所述生成会话表项索引之后，所述方法还包括：将所述会话表项索引保存到报文的管理结构中；
    所述建立所述快速转发表项和所述会话表项的关联包括：在所述报文的管理结构中，将所述会话表项索引添加到所述报文的快速转发表项中，将包含会话表项索引的快速转发表项存入全局快速转发表。
  7. 一种设备，其特征在于，该设备至少包括处理器和机器可读存储介质，其中，所述机器可读存储介质中存储有报文处理装置，当所述报文处理装置被所述处理器运行时执行以下处理：
    接收并发送报文；
    若未查找到报文对应的快速转发表项，则生成报文的快速转发表项，对报文进行业务处理、生成对应的会话表项，建立所述快速转发表项和所述会话表项的关联，并根据普通转发表项对报文进行转发处理； 若查找到报文对应的快速转发表项，则根据查找到的快速转发表项关联的会话表项，对报文进行业务处理，并根据查找到的快速转发表项对报文进行转发处理。
  8. 根据权利要求7所述的设备，其特征在于，当被所述处理器执行时，所述报文处理装置进一步用于：
    生成会话表项索引，指示会话表项在内存中的位置信息；
    将会话表项索引添加到快速转发表项。
  9. 根据权利要求8所述的设备，其特征在于，当被所述处理器执行时，所述报文处理装置进一步用于：
    当接收到的所述报文为单播报文时，
    根据报文的正向五元组生成报文的正向快速转发表项，根据报文的反向五元组生成报文的反向快速转发表项；
    将会话表项索引分别添加到报文的正向快速转发表项和反向快速转发表项。
  10. 根据权利要求8所述的设备，其特征在于，当被所述处理器执行时，所述报文处理装置进一步用于：
    当接收到的所述报文为组播报文时，
    根据报文的正向五元组生成报文的正向快速转发表项；
    将会话表项索引添加到报文的正向快速转发表项。
  11. 根据权利要求9或10所述的设备，其特征在于，所述正向五元组包括所述报文的源IP地址、源端口、目的IP地址、目的端口和协议类型；反向五元组包括的源IP地址、源端口为所述报文的目的IP地址、目的端口，包括的目的IP地址、目的端口为所述报文的源IP地址、源端口，包括的协议类型为所述报文的协议类型。
  12. 根据权利要求8所述的设备，其特征在于，当被所述处理器执 行时，所述报文处理装置进一步用于：
    将报文的快速转发表项保存到报文的管理结构中；
    将所述会话表项索引保存到报文的管理结构中；
    在所述报文的管理结构中，将所述会话表项索引添加到所述报文的快速转发表项中，将包含会话表项索引的快速转发表项存入全局快速转发表。
PCT/CN2016/087615 2015-06-30 2016-06-29 报文处理 WO2017000878A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510384762.0A CN106330715A (zh) 2015-06-30 2015-06-30 报文处理方法及装置
CN201510384762.0 2015-06-30

Publications (1)

Publication Number Publication Date
WO2017000878A1 true WO2017000878A1 (zh) 2017-01-05

Family

ID=57609291

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/087615 WO2017000878A1 (zh) 2015-06-30 2016-06-29 报文处理

Country Status (2)

Country Link
CN (1) CN106330715A (zh)
WO (1) WO2017000878A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109474525A (zh) * 2018-12-17 2019-03-15 杭州迪普科技股份有限公司 报文的处理方法、装置、设备及可读存储介质
CN113132273A (zh) * 2019-12-30 2021-07-16 华为技术有限公司 一种数据转发方法及装置
CN114710565A (zh) * 2022-03-31 2022-07-05 绿盟科技集团股份有限公司 网络报文的压缩与解压方法、装置、设备及可读存储介质

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107948072B (zh) * 2017-10-31 2021-04-27 新华三技术有限公司 报文转发方法和装置
CN107948076B (zh) * 2017-12-29 2021-08-24 杭州迪普科技股份有限公司 一种转发报文的方法及装置
CN113824642B (zh) * 2018-03-09 2023-02-03 华为技术有限公司 发送报文的方法、网络设备及计算机可读存储介质
CN108777662B (zh) * 2018-06-20 2021-05-18 迈普通信技术股份有限公司 表项管理方法及装置
CN110768930B (zh) * 2018-07-25 2022-03-29 成都鼎桥通信技术有限公司 服务器的数据转发方法和装置
CN110392034B (zh) * 2018-09-28 2020-10-13 新华三信息安全技术有限公司 一种报文处理方法及装置
CN109286570B (zh) * 2018-11-15 2020-02-11 北京华三通信技术有限公司 一种邻接表项的查找方法及装置
CN110311866B (zh) * 2019-06-28 2021-11-02 杭州迪普科技股份有限公司 一种快速转发报文的方法及装置
CN110380968B (zh) * 2019-07-08 2021-08-27 新华三信息安全技术有限公司 一种报文处理的方法及装置
CN110677340B (zh) * 2019-10-16 2022-01-25 杭州迪普科技股份有限公司 一种报文转发方法及装置
CN111224812A (zh) * 2019-11-06 2020-06-02 杭州迪普科技股份有限公司 网络流量转发方法、装置、电子设备及机器可读存储介质
CN110932979B (zh) * 2019-11-26 2022-07-19 锐捷网络股份有限公司 一种快速转发报文的方法和装置
CN111049910A (zh) * 2019-12-16 2020-04-21 瑞斯康达科技发展股份有限公司 一种处理报文的方法、装置、设备及介质
CN111130816B (zh) * 2019-12-27 2022-06-24 北京东土军悦科技有限公司 一种报文转发处理设备、方法、装置和存储介质
CN111147598B (zh) * 2019-12-30 2023-04-25 杭州迪普科技股份有限公司 Http报文处理方法及装置
CN111107007A (zh) * 2019-12-31 2020-05-05 奇安信科技集团股份有限公司 报文转发方法、装置、电子设备和介质
CN112104576B (zh) * 2020-08-14 2022-02-22 中国科学院声学研究所 一种sdn交换机的常驻流表存储与校准方法
CN112788116A (zh) * 2020-12-30 2021-05-11 杭州迪普科技股份有限公司 一种报文转发的方法及装置
CN113645188B (zh) * 2021-07-07 2023-05-09 中国电子科技集团公司第三十研究所 一种基于安全关联的数据包快速转发方法
CN116137606A (zh) * 2021-11-17 2023-05-19 华为技术有限公司 转发报文的方法以及相关设备
CN115277605B (zh) * 2022-07-26 2023-10-17 深圳云豹智能有限公司 虚拟交换机的报文处理方法和装置、芯片及电子设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101938415A (zh) * 2010-08-30 2011-01-05 北京傲天动联技术有限公司 网络转发设备的快速转发方法
CN103067281A (zh) * 2012-12-28 2013-04-24 深圳市磊科实业有限公司 一种路由器快速转发方法及实施该方法的系统
CN103647716A (zh) * 2013-11-22 2014-03-19 上海斐讯数据通信技术有限公司 一种数据包快速转发方法及装置
CN103763194A (zh) * 2013-12-31 2014-04-30 杭州华三通信技术有限公司 一种报文转发方法及装置
CN104092612A (zh) * 2014-06-05 2014-10-08 汉柏科技有限公司 更新快速转发表匹配顺序的方法及装置
WO2015013657A2 (en) * 2013-07-25 2015-01-29 Kbiobox Inc. Method and system for rapid searching of genomic data and uses thereof

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101247353B (zh) * 2008-03-25 2010-08-25 杭州华三通信技术有限公司 流老化方法及网络设备
CN101577676B (zh) * 2009-06-10 2011-12-07 杭州华三通信技术有限公司 一种实现粘性访问的方法和装置
CN101877728B (zh) * 2010-06-25 2014-12-31 中兴通讯股份有限公司 网络地址转换转发方法及装置
CN104283817B (zh) * 2013-07-03 2017-10-27 新华三技术有限公司 用于实现交换线卡与逻辑线卡互通的方法及报文转发设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101938415A (zh) * 2010-08-30 2011-01-05 北京傲天动联技术有限公司 网络转发设备的快速转发方法
CN103067281A (zh) * 2012-12-28 2013-04-24 深圳市磊科实业有限公司 一种路由器快速转发方法及实施该方法的系统
WO2015013657A2 (en) * 2013-07-25 2015-01-29 Kbiobox Inc. Method and system for rapid searching of genomic data and uses thereof
CN103647716A (zh) * 2013-11-22 2014-03-19 上海斐讯数据通信技术有限公司 一种数据包快速转发方法及装置
CN103763194A (zh) * 2013-12-31 2014-04-30 杭州华三通信技术有限公司 一种报文转发方法及装置
CN104092612A (zh) * 2014-06-05 2014-10-08 汉柏科技有限公司 更新快速转发表匹配顺序的方法及装置

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109474525A (zh) * 2018-12-17 2019-03-15 杭州迪普科技股份有限公司 报文的处理方法、装置、设备及可读存储介质
CN109474525B (zh) * 2018-12-17 2021-05-25 杭州迪普科技股份有限公司 报文的处理方法、装置、设备及可读存储介质
CN113132273A (zh) * 2019-12-30 2021-07-16 华为技术有限公司 一种数据转发方法及装置
CN113132273B (zh) * 2019-12-30 2024-04-12 华为技术有限公司 一种数据转发方法及装置
CN114710565A (zh) * 2022-03-31 2022-07-05 绿盟科技集团股份有限公司 网络报文的压缩与解压方法、装置、设备及可读存储介质
CN114710565B (zh) * 2022-03-31 2023-11-03 绿盟科技集团股份有限公司 网络报文的压缩与解压方法、装置、设备及可读存储介质

Also Published As

Publication number Publication date
CN106330715A (zh) 2017-01-11

Similar Documents

Publication Publication Date Title
WO2017000878A1 (zh) 报文处理
US20210036953A1 (en) Flow modification including shared context
US10129137B2 (en) Transferring data in a gateway
JP5648926B2 (ja) ネットワークシステム、コントローラ、ネットワーク制御方法
CN107948076B (zh) 一种转发报文的方法及装置
JP6367371B2 (ja) ネットワークパケットカプセル化およびルーティング
US10375193B2 (en) Source IP address transparency systems and methods
US20150326524A1 (en) Address resolution in software-defined networks
US9313171B2 (en) Path selection in a multi-service and multi-tenant secure cloud environment
US10237130B2 (en) Method for processing VxLAN data units
US20030018914A1 (en) Stateful packet forwarding in a firewall cluster
US9712649B2 (en) CCN fragmentation gateway
WO2012167559A1 (zh) 一种快速转发数据包的方法及三层设备
EP3026872B1 (en) Packet forwarding method, apparatus, and system
CN107770072B (zh) 一种发送和接收报文的方法和设备
WO2012151904A1 (zh) 一种数据报文转发方法及装置
WO2009052668A1 (fr) Dispositif nat-pt et procédé de répartition de charge pour un dispositif nat-pt
WO2014139481A1 (zh) 报文处理方法及设备
WO2014023003A1 (zh) 控制数据传输的方法、装置和系统
WO2017209944A1 (en) Session continuity in the presence of network address translation
US11178230B1 (en) Dynamically managing keepalive status for client-server connections
US20160127241A1 (en) Apparatus and method for flow control
US8934489B2 (en) Routing device and method for processing network packet thereof
US9749262B2 (en) Packet processing method and forwarding element
US11496438B1 (en) Methods for improved network security using asymmetric traffic delivery and devices thereof

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16817242

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16817242

Country of ref document: EP

Kind code of ref document: A1