A method of processing and a routing device for controlling a session

Abstract

The specification provides a processing method and a routing device for controlling a session, the method comprising: an NPU receiving a first control packet, converting a first source address in the first control packet into a second source address according to a network address translation (NAT) rule, the NPU uploading the first control packet and the second source address to a CPU kernel state, the NPU receiving a second control packet sent by the CPU kernel state, converting a first destination address in the second control packet into a second destination address according to the NAT rule, the NPU uploading the second control packet and the second destination address to the CPU kernel state, and the NPU receiving a takeover notification sent by the CPU kernel state and a control packet converted by a user state to process a session. By the method, the technical problem that the processing logic is limited by the NPU hardware and that the IP can be converted only once in each flow processing and the twice NAT conversion in the NAT hairpin scene cannot be implemented is avoided.

Description

Technical Field

[0001] This specification relates to the field of communication technology, and in particular to a method for processing control sessions and a routing device. Background Technology

[0002] NPU: Network Processing Unit;

[0003] NAT: Network Address Translation;

[0004] ALG: Application Level Gateway;

[0005] NAT hairpin: The NAT hairpin function is used to meet the needs of users on the internal network to access each other or between users on the internal network and the server through NAT addresses.

[0006] The Application Level Gateway (ALG) primarily processes application-layer packets. Normally, NAT only translates the IP address and port information in the packet header, without analyzing the fields in the application-layer payload. However, some special protocols may contain IP addresses or port information in their packet payloads, which cannot be effectively translated by NAT, potentially causing problems. For example, FTP applications consist of both data and control sessions, and the establishment of the data session is dynamically determined by the payload fields in the control session. This necessitates the ALG to translate the payload fields to ensure the correct establishment of subsequent data sessions.

[0007] NAT hairpin functionality is used to meet the need for users on the internal network to access each other or between users on the internal network and servers via NAT addresses. When NAT hairpin is enabled, the internal network interface will simultaneously translate the source and destination addresses of packets. It supports two networking modes:

[0008] P2P: Users on the internal network communicate with each other through dynamically assigned NAT addresses. Each host on the internal network first registers its external network address information with the external network server. This address information is the NAT address for outbound address translation on the external network side. Then, the internal network hosts communicate with each other using the external network addresses they registered with the external network server.

[0009] C / S: Users on the internal network side use NAT addresses to access the internal network server. NAT simultaneously translates the source and destination IP addresses of packets accessing the internal network server on the internal network interface. Destination IP address translation is accomplished by matching the configuration of the internal server on a certain external network interface, while source address translation is accomplished by matching the outbound dynamic address translation or outbound static address translation on the interface where the internal server is located.

[0010] The commonly used ALG NAT hairpin processing method is relatively simple. During the device hardware forwarding process, after the destination IP address of the packet matches the NAT Server address pool route configured on the device interface, the packet is directly sent to the CPU user space for processing. The user space translates the IP addresses (including source IP and destination IP) that may be contained in the packet's Layer 3 header and data payload, and generates a control session table entry. Then the packet is sent down to the hardware, and the device forwards it out according to its corresponding next-hop exit.

[0011] Currently, all data and control session packets in NAT ALG hairpin are typically processed by the CPU. Due to CPU performance limitations, the actual NAT ALG service forwarding capability is limited and cannot meet user needs. Processing sessions in the NPU is limited by the NPU hardware's processing logic, and each process can only perform one IP address translation, which cannot properly handle the two NAT translations involved in the NAT hairpin scenario. Summary of the Invention

[0012] To overcome the problems existing in related technologies, this specification provides a method for handling control sessions and a routing device.

[0013] According to a first aspect of the embodiments of this specification, a method for processing a control session is provided, the method comprising:

[0014] The Network Processing Unit (NPU) receives a first control message and converts the first source address in the first control message into a second source address according to the Network Address Translation (NAT) rules.

[0015] The NPU sends the first control message and the second source address to the CPU kernel mode.

[0016] The NPU receives a second control message sent by the CPU kernel mode and converts the first destination address in the second control message into a second destination address according to NAT rules. The second control message is a first control message with a second source address.

[0017] The NPU sends the second control message and the second destination address to the CPU kernel mode, and the CPU kernel mode sends the first control message and the second source address to the CPU user mode, so that the CPU user mode can establish a session table.

[0018] The NPU receives takeover notifications and user-mode transition control messages from the CPU kernel mode for session processing. The takeover notification is sent from the CPU user mode to the CPU kernel mode after the session table is established.

[0019] The method further includes, before converting the first source address in the first control message to a second source address according to Network Address Translation (NAT) rules:

[0020] Based on the NAT rules pre-issued by the user, determine whether address translation is required for the first control message. If so, execute the conversion of the first source address in the first control message to the second source address according to the Network Address Translation (NAT) rules.

[0021] The step of converting the first source address in the first control message to a second source address according to Network Address Translation (NAT) rules includes:

[0022] The NPU allocates address resources, establishes a first control session hardware table, translates the first source address into a second source address according to NAT rules, and sets the first identifier bit in the first control session hardware table. The first identifier bit is used to indicate that the first control session hardware table needs to perform two NAT address translations.

[0023] The NPU sends the first control message and the second source address to the CPU kernel mode, including:

[0024] The NPU encapsulates a first message and sends it to the CPU kernel mode. The first message carries a first control message, a second source address, and a first flag bit that is set. The first flag bit is used to indicate that the hardware table of the first control session needs to perform two NAT address translations.

[0025] Optionally, the method further includes:

[0026] After receiving the first control message and the second source address sent by the NPU, the CPU kernel mode establishes a session table, which includes a first kernel mode software table and a second kernel mode software table. The first kernel mode software table is used to store the first control message and the second source address, and the second kernel mode software table is used to store the second control message and the first source address.

[0027] The NPU receives a second control message sent from the CPU kernel mode, including:

[0028] The NPU establishes a second control session hardware table based on the second control message.

[0029] The NPU sends the second control message and the second destination address to the CPU kernel mode, including:

[0030] The NPU encapsulates a second message, which carries a second control message and a second destination address.

[0031] After the CPU kernel receives the second message, the method further includes:

[0032] The CPU kernel mode queries the second kernel mode software table according to the second message to obtain the first source address, and obtains the first control message according to the first source address and the second control message in the second message;

[0033] The CPU kernel mode sends the first control message and the second source address to the CPU user mode.

[0034] The CPU user mode acquires the first control message, translates the first destination address in the first control message according to the ingress interface to obtain the second destination address, translates the first source address in the first control message to obtain the second source address, and establishes a session table.

[0035] Optionally, after the NPU receives the takeover notification sent by the CPU kernel, the method further includes:

[0036] The NPU receives a third message sent by the CPU kernel mode, determines the target control session hardware table from the control session hardware table according to the third message, deletes the target control session hardware table, and sends a fourth message to the CPU kernel mode. The fourth message is used to indicate that the target control session hardware table has been deleted.

[0037] The CPU kernel mode sends a fifth message to the CPU user mode based on the fourth message, and the user instructs the CPU user mode to delete the session table corresponding to the fifth message;

[0038] The CPU user space deletes the corresponding session table according to the fifth message and sends a sixth message to the CPU kernel space to instruct the CPU kernel space to delete the session table corresponding to the sixth message.

[0039] Among them, the third, fourth, fifth and sixth messages have the same source address and destination address.

[0040] As can be seen from the above embodiments, session tables (user-mode software table, kernel-mode software table, and control session hardware table) are established in NPU, CPU kernel mode, and CPU user mode respectively. This enables the user side to observe a NAT session as a single session, which is consistent with the session display of the original pure CPU-implemented ALG NAT hairpin. At the same time, it solves the technical problem that the NPU hardware processing logic can only perform one IP translation process per process, making it impossible to achieve two NAT translations in the NAT hairpin scenario.

[0041] According to a second aspect of the embodiments of this specification, a routing device is provided, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the following method:

[0042] The Network Processing Unit (NPU) receives a first control message and converts the first source address in the first control message into a second source address according to the Network Address Translation (NAT) rules.

[0043] The NPU sends the first control message and the second source address to the CPU kernel mode.

[0044] The NPU receives a second control message sent by the CPU kernel mode and converts the first destination address in the second control message into a second destination address according to NAT rules. The second control message is a first control message with a second source address.

[0045] The NPU sends the second control message and the second destination address to the CPU kernel mode, and the CPU kernel mode sends the first control message and the second source address to the CPU user mode, so that the CPU user mode can establish a session table.

[0046] The NPU receives takeover notifications and user-mode transition control messages from the CPU kernel mode for session processing. The takeover notification is sent from the CPU user mode to the CPU kernel mode after the session table is established.

[0047] According to a second aspect of the embodiments of this specification, a routing device is provided, the routing device comprising: an NPU and a CPU, the CPU comprising: a CPU kernel mode and a CPU user mode, the NPU comprising:

[0048] The receiving module is configured to receive a first control message and convert the first source address in the first control message into a second source address according to the Network Address Translation (NAT) rules.

[0049] The sending module is used to send the first control message and the second source address to the CPU kernel mode;

[0050] The receiving module is further configured to receive a second control message sent by the CPU kernel mode, and convert the first destination address in the second control message into a second destination address according to NAT rules, wherein the second control message is a first control message with a second source address;

[0051] The sending module is also used to send the second control message and the second destination address to the CPU kernel mode, and the CPU kernel mode sends the first control message and the second source address to the CPU user mode, so that the CPU user mode establishes a session table.

[0052] The receiving module is also used to receive a takeover notification sent by the CPU kernel mode for session processing, wherein the takeover notification is sent by the CPU user mode to the CPU kernel mode after the session table is established.

[0053] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0054] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this specification and, together with the description, serve to explain the principles of this specification.

[0055] Figure 1 This specification illustrates a method for processing a control session according to an exemplary embodiment. Detailed Implementation

[0056] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification as detailed in the appended claims.

[0057] The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of this specification. The singular forms “a,” “the,” and “the” as used in this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0058] It should be understood that although the terms first, second, third, etc., may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0059] Currently, all data and control session packets in NAT ALG hairpin are typically processed by the CPU. Due to CPU performance limitations, the actual NAT ALG service forwarding capability is limited and cannot meet user needs. Processing sessions in the NPU is limited by the NPU hardware's processing logic, and each process can only perform one IP translation, which cannot properly handle the two NAT translations involved in the NAT hairpin scenario.

[0060] To address the aforementioned technical problems, embodiments of this disclosure provide a method for processing control sessions, such as... Figure 1 As shown, the method includes:

[0061] S101 Network Processing Unit (NPU) receives a first control message and converts the first source address in the first control message into a second source address according to Network Address Translation (NAT) rules.

[0062] S102NPU sends the first control message and the second source address to the CPU kernel mode;

[0063] The S103NPU receives a second control message sent by the CPU kernel mode and converts the first destination address in the second control message into a second destination address according to NAT rules. The second control message is a first control message with a second source address.

[0064] The S104NPU sends the second control message and the second destination address to the CPU kernel mode, and the CPU kernel mode sends the first control message and the second source address to the CPU user mode, so that the CPU user mode can establish a session table.

[0065] The S105NPU receives takeover notifications and user-mode transition control messages from the CPU kernel mode for session processing. The takeover notification is sent from the CPU user mode to the CPU kernel mode after the session table is established.

[0066] In this embodiment, the user can pre-configure NAT rules and then distribute them.

[0067] In step 101, after receiving the first control message, the NPU can determine whether address translation of the first control message is required according to the NAT rules. If it is required, step S101 is executed; otherwise, the first control message is processed normally.

[0068] In this embodiment, when the first control message hits a NAT rule, the NPU allocates address resources (e.g., IP address resources), establishes a first control session hardware table (i.e., establishes a hardware session table), converts the first source address in the first control message to a second source address, and sets the first identifier bit in the first control session hardware table. This first identifier bit can be the Twice flag in the first control session hardware table. This first identifier bit is used to indicate that the first control session hardware table needs to perform two NAT address translations.

[0069] In step S102, the NPU encapsulates a first message and sends it to the CPU kernel mode. The first message carries a first control message, a second source address, and a first flag bit that is set. The first flag bit is used to indicate that the hardware table of the first control session needs to perform two NAT address translations.

[0070] In this embodiment, after receiving the first control message and the second source address sent by the NPU, the CPU kernel mode establishes a session table. The session table includes a first kernel mode software table and a second kernel mode software table. The first kernel mode software table is used to store the first control message and the second source address, and the second kernel mode software table is used to store the second control message and the first source address.

[0071] In step S103, the NPU obtains the second control message and converts the first destination address in the second control message into the second destination address according to the NAT rules. At the same time, the NPU establishes a session table (i.e., the second control session hardware table) based on the second control message and the second destination address.

[0072] In this embodiment, the NPU encapsulates a second message, which carries a second control message and a second destination address.

[0073] The CPU kernel mode queries the second kernel mode software table according to the second message to obtain the first source address, and obtains the first control message according to the first source address and the second control message in the second message;

[0074] The CPU kernel mode sends the first control message and the second source address to the CPU user mode.

[0075] The CPU user mode acquires the first control message, translates the first destination address in the first control message according to the ingress interface to obtain the second destination address, translates the first source address in the first control message to obtain the second source address, and establishes a session table.

[0076] For ease of explanation, the technology in this disclosure will be further described below:

[0077] ①: When a packet enters the device, the NPU matches the NAT rules previously issued by the user and finds that the packet needs to be translated for both the source IP and the destination IP. The NPU allocates IP resources, establishes control session hardware table A (i.e., the first control session hardware table), translates the source IP address of the packet, and sets the Twice flag in hardware table A (indicating that the session table entry needs to undergo two NAT follow-up processes).

[0078] ②: The NPU encapsulates the message and sends it to the CPU. The message carries the original packet from step ①, the translated source IP address, and the Twice flag. The CPU kernel establishes kernel-mode software table A and kernel-mode software table B. Kernel-mode software table A stores the original packet before NAT translation and the translated source IP address, with the Twice flag set. Kernel-mode software table B stores the packet after NAT translation and the source IP address of the original packet.

[0079] ③: After the CPU kernel establishes the software table, it converts the source IP address of the packet and updates the checksum field before resending it to the NPU. The NPU establishes the control session hardware table B and converts the destination IP address of the packet.

[0080] ④: The message encapsulation message is sent back to the CPU from the NPU. The message carries the source IP address that has been translated and the translated destination IP address.

[0081] ⑤: The CPU kernel mode queries the kernel mode software table B based on the sent message to obtain the source IP of the original message, replaces the source IP address of the message in the sent message with the source IP address of the original message, and then sends it to the CPU user mode (at this time, the sent message is actually the same as the original message in step ①).

[0082] ⑥: After receiving the original packet, the CPU user space first performs a translation of the destination IP of the packet according to the NAT server configuration of the device ingress interface; then it calls the kernel space interface, queries the kernel space software table A, obtains the source IP resource to be translated allocated by the NPU, performs translation processing on the source IP of the packet, generates the user space software table, and then forwards the packet from the CPU user space to the CPU kernel space.

[0083] ⑦: The message is sent from the CPU kernel mode to the NPU;

[0084] ⑧: After IP address translation, the NAT control session message is forwarded to the next hop interface of the device.

[0085] As can be seen from the above embodiments, session tables (user-mode software table, kernel-mode software table, and control session hardware table) are established in NPU, CPU kernel mode, and CPU user mode respectively. This enables the user side to observe a NAT session as a single session, which is consistent with the session display of the original pure CPU-implemented ALG NAT hairpin. At the same time, it solves the technical problem that the NPU hardware processing logic can only perform one IP translation process per process, making it impossible to achieve two NAT translations in the NAT hairpin scenario.

[0086] In this embodiment, the NPU receives a third message sent by the CPU kernel mode, determines the target control session hardware table from the control session hardware table according to the third message, deletes the target control session hardware table, and sends a fourth message to the CPU kernel mode. The fourth message is used to indicate that the target control session hardware table has been deleted.

[0087] The CPU kernel mode sends a fifth message to the CPU user mode based on the fourth message, and the user instructs the CPU user mode to delete the session table corresponding to the fifth message;

[0088] The CPU user space deletes the corresponding session table according to the fifth message and sends a sixth message to the CPU kernel space to instruct the CPU kernel space to delete the session table corresponding to the sixth message.

[0089] Among them, the third, fourth, fifth and sixth messages have the same source address and destination address.

[0090] This disclosure also provides a state synchronization mechanism for the same control session among CPU user mode, kernel mode, and NPU to ensure the consistency of table entries while avoiding potential table entry residue problems during creation and deletion:

[0091] ①: When the CPU user mode notifies the table entry to be deleted for the first time, the kernel mode software table status is set to pending deletion, and the kernel mode software table pending deletion status timestamp is refreshed;

[0092] ②: The CPU kernel sends a message to the NPU to set the hardware table status to pending deletion;

[0093] ③: The NPU timer periodically polls the hardware table status. When the hardware table status is "to be deleted", the hardware table is deleted. After the hardware table is deleted, the NPU sends a message to notify the CPU that the hardware table has been deleted.

[0094] ④: The CPU kernel reports a user-mode message event, notifying the deletion of the user-mode software table. If the kernel-mode software table status is "pending takeover" at this time... Figure 1 If step ④ (handling exceptions) or forced deletion occurs, then a message is directly constructed to execute subsequent step ⑤;

[0095] ⑤: User-mode software table deletion, CPU user-mode second notification to delete table entry, delete kernel-mode software table, complete deletion process;

[0096] ⑥: Due to the reliability limitations of information transmission through hardware channels, message notifications may be lost or processing may fail in the aforementioned processes ① to ⑤. To avoid table entry residue and to synchronize user-mode and hardware table states in a timely manner, the CPU kernel-mode software timer periodically polls the kernel-mode software table state and performs the following processing:

[0097] a. The CPU kernel-mode software table has not received information about the CPU user-mode takeover session within the agreed time. Figure 1 In step ④), the kernel-mode software table status is set to pending deletion;

[0098] b. If the kernel-mode software table is in the state of pending deletion and the state continues for more than the agreed time period without being deleted, the kernel-mode software table status is set to being deleted, and step ④ in the deletion process is repeated to notify the user-mode to delete the software table.

[0099] c. Set the kernel-mode software table status flag to indicate that it is both pending deletion and being deleted (dual state, at this time it should be step ⑤ where the user-mode process cannot be correctly sent), and set the kernel-mode software table status to forced deletion;

[0100] ⑦: Due to limitations in the reliability of information transmission via hardware channels, the aforementioned Figure 1 In processes ② to ⑤, message notifications may be lost. To avoid table entry residue and synchronize user-mode and hardware table states, the CPU kernel-mode software timer periodically polls the kernel-mode software table state and performs the following processing: The NPU timer periodically polls the hardware table state and performs the following processing:

[0101] a. If the session hardware table has not received information from the CPU to take over the session after the fixed aging time has expired, the hardware table will be directly deleted according to the timed aging process, and then step ③ will be executed to notify the CPU.

[0102] As can be seen from the above embodiments, synchronizing the control session table states on the CPU user mode, kernel mode, and NPU enhances the protection of the three-party control sessions while ensuring NAT forwarding performance, improves the reliability of session table entries, and reduces the risks caused by the uncertainty of information transmitted through the hardware channel.

[0103] This disclosure also provides a routing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the following method:

[0104] The Network Processing Unit (NPU) receives a first control message and converts the first source address in the first control message into a second source address according to the Network Address Translation (NAT) rules.

[0105] The NPU sends the first control message and the second source address to the CPU kernel mode.

[0106] The NPU receives a second control message sent by the CPU kernel mode and converts the first destination address in the second control message into a second destination address according to NAT rules. The second control message is a first control message with a second source address.

[0107] The NPU sends the second control message and the second destination address to the CPU kernel mode, and the CPU kernel mode sends the first control message and the second source address to the CPU user mode, so that the CPU user mode can establish a session table.

[0108] The NPU receives takeover notifications and user-mode transition control messages from the CPU kernel mode for session processing. The takeover notification is sent from the CPU user mode to the CPU kernel mode after establishing the session table, and the user-mode transition control message is a user-mode control message that has transitioned between SIP and DIP.

[0109] This disclosure also provides a routing device, which includes an NPU and a CPU. The CPU includes a CPU kernel mode and a CPU user mode. The NPU includes:

[0110] The receiving module is configured to receive a first control message and convert the first source address in the first control message into a second source address according to the Network Address Translation (NAT) rules.

[0111] The sending module is used to send the first control message and the second source address to the CPU kernel mode;

[0112] The receiving module is further configured to receive a second control message sent by the CPU kernel mode, and convert the first destination address in the second control message into a second destination address according to NAT rules, wherein the second control message is a first control message with a second source address;

[0113] The sending module is also used to send the second control message and the second destination address to the CPU kernel mode, and the CPU kernel mode sends the first control message and the second source address to the CPU user mode, so that the CPU user mode establishes a session table.

[0114] The receiving module is also used to receive a takeover notification sent by the CPU kernel mode for session processing, wherein the takeover notification is sent by the CPU user mode to the CPU kernel mode after the session table is established.

[0115] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the solution in this specification according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0116] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0117] Other embodiments of this specification will readily occur to those skilled in the art upon consideration of the specification and practice of the invention claimed herein. This specification is intended to cover any variations, uses, or adaptations that follow the general principles of this specification and include common knowledge or customary techniques in the art not claimed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this specification are indicated by the following claims.

[0118] It should be understood that this specification is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this specification is limited only by the appended claims.

[0119] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

Claims

1. A method for controlling a session, characterized in that, The method includes: The Network Processing Unit (NPU) receives a first control message and converts the first source address in the first control message into a second source address according to the Network Address Translation (NAT) rules. The NPU sends the first control message and the second source address to the CPU kernel mode. The NPU receives a second control message sent by the CPU kernel mode and converts the first destination address in the second control message into a second destination address according to NAT rules. The second control message is a first control message with a second source address. The NPU sends the second control message and the second destination address to the CPU kernel mode, and the CPU kernel mode sends the first control message and the second source address to the CPU user mode, so that the CPU user mode can establish a session table. The NPU receives takeover notifications and user-mode transition control messages from the CPU kernel mode for session processing. The takeover notification is sent from the CPU user mode to the CPU kernel mode after the session table is established.

2. The method according to claim 1, characterized in that, Before converting the first source address in the first control message to a second source address according to Network Address Translation (NAT) rules, the method further includes: Based on the NAT rules pre-issued by the user, determine whether address translation is required for the first control message. If so, translate the first source address in the first control message into the second source address according to the Network Address Translation (NAT) rules.

3. The method according to claim 1, characterized in that, The step of converting the first source address in the first control message to a second source address according to Network Address Translation (NAT) rules includes: The NPU allocates address resources, establishes a first control session hardware table, translates the first source address into a second source address according to NAT rules, and sets the first identifier bit in the first control session hardware table. The first identifier bit is used to indicate that the first control session hardware table needs to perform two NAT address translations.

4. The method according to claim 1, characterized in that, The NPU sends the first control message and the second source address to the CPU kernel mode, including: The NPU encapsulates a first message and sends it to the CPU kernel mode. The first message carries a first control message, a second source address, and a first flag bit that is set. The first flag bit is used to indicate that the hardware table of the first control session needs to perform two NAT address translations.

5. The method according to claim 1, characterized in that, The method further includes: After receiving the first control message and the second source address sent by the NPU, the CPU kernel mode establishes a session table, which includes a first kernel mode software table and a second kernel mode software table. The first kernel mode software table is used to store the first control message and the second source address, and the second kernel mode software table is used to store the second control message and the first source address.

6. The method according to claim 1, characterized in that, The NPU receives a second control message sent from the CPU kernel mode, including: The NPU establishes a second control session hardware table based on the second control message.

7. The method according to claim 1, characterized in that, The NPU sends the second control message and the second destination address to the CPU kernel mode, including: The NPU encapsulates a second message, which carries a second control message and a second destination address.

8. The method according to claim 7, characterized in that, After the CPU kernel receives the second message, the method further includes: The CPU kernel mode queries the second kernel mode software table according to the second message to obtain the first source address, and obtains the first control message according to the first source address and the second control message in the second message; The CPU kernel mode sends the first control message and the second source address to the CPU user mode. The CPU user mode acquires the first control message, translates the first destination address in the first control message to obtain the second destination address according to the configuration information of the ingress interface, translates the first source address in the first control message to obtain the second source address, and establishes a session table.

9. The method according to claim 1, characterized in that, After the NPU receives the takeover notification sent by the CPU kernel, the method further includes: The NPU receives a third message sent by the CPU kernel mode, determines the target control session hardware table from the control session hardware table according to the third message, deletes the target control session hardware table, and sends a fourth message to the CPU kernel mode. The fourth message is used to indicate that the target control session hardware table has been deleted. The CPU kernel mode sends a fifth message to the CPU user mode based on the fourth message, and the user instructs the CPU user mode to delete the session table corresponding to the fifth message; The CPU user space deletes the corresponding session table according to the fifth message and sends a sixth message to the CPU kernel space to instruct the CPU kernel space to delete the session table corresponding to the sixth message. Among them, the third, fourth, fifth and sixth messages have the same source address and destination address.

10. A routing device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the following method: The Network Processing Unit (NPU) receives a first control message and converts the first source address in the first control message into a second source address according to the Network Address Translation (NAT) rules. The NPU sends the first control message and the second source address to the CPU kernel mode. The NPU receives a second control message sent by the CPU kernel mode and converts the first destination address in the second control message into a second destination address according to NAT rules. The second control message is a first control message with a second source address. The NPU sends the second control message and the second destination address to the CPU kernel mode, and the CPU kernel mode sends the first control message and the second source address to the CPU user mode, so that the CPU user mode can establish a session table. The NPU receives takeover notifications and user-mode transition control messages from the CPU kernel mode for session processing. The takeover notification is sent from the CPU user mode to the CPU kernel mode after the session table is established.

11. A routing device, characterized in that, The routing device includes an NPU and a CPU. The CPU includes a CPU kernel mode and a CPU user mode. The NPU includes: The receiving module is used to receive a first control message and convert the first source address in the first control message into a second source address according to the Network Address Translation (NAT) rules. The sending module is used to send the first control message and the second source address to the CPU kernel mode; The receiving module is further configured to receive a second control message sent by the CPU kernel mode, and convert the first destination address in the second control message into a second destination address according to NAT rules, wherein the second control message is a first control message with a second source address; The sending module is also used to send the second control message and the second destination address to the CPU kernel mode, and the CPU kernel mode sends the first control message and the second source address to the CPU user mode, so that the CPU user mode establishes a session table. The receiving module is also used to receive a takeover notification sent by the CPU kernel mode for session processing, wherein the takeover notification is sent by the CPU user mode to the CPU kernel mode after the session table is established.

Images