Traffic processing method and apparatus, storage medium, and electronic device

Abstract

The application discloses a traffic processing method and device, a storage medium and an electronic device. The method comprises the following steps: receiving an MPLS message through a first device, and performing dismounting processing on an MPLS label header of the MPLS message to obtain a first IP message, and storing label information of the MPLS label header in a memory; performing detection processing on the first IP message, and if a detection result represents that a risk degree of the first IP message is lower than a preset risk degree, judging whether a target session exists in multiple sessions according to message content of the first IP message; if a judgment result represents that the target session exists, determining a target synchronization strategy according to a service requirement; processing the first IP message according to the label information of the MPLS label header and the target synchronization strategy, and forwarding target traffic to a second device. The application solves the technical problem in the prior art that the label information of the MPLS message is stored in the memory, and the label information cannot be synchronized to a peer device.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and more specifically, to a traffic processing method, apparatus, storage medium, and electronic device. Background Technology

[0002] Multi-Protocol Label Switching (MPLS) is a label-based forwarding technology. Labels are attached as MPLS headers to IP packets, forming MPLS packets. When a device receives an MPLS packet, it needs to remove the MPLS header and treat the packet as an Ethernet IP packet. A session is established through a new process to enable subsequent packet identification and detection.

[0003] In the existing technology, the main method for forwarding MPLS packets is to associate the MPLS packet label information with the session. That is, after the device removes the MPLS label header of the MPLS packet, it records the removed MPLS label information in the newly created session and achieves synchronization through the session. However, a packet may contain multiple layers of MPLS labels, and the space for storing label information is uncontrollable. This method will lead to a large increase in the memory space occupied by the session. Under high concurrency, the memory occupied by the session will increase significantly, resulting in a large consumption of memory resources.

[0004] Therefore, to avoid increasing the burden on the device when removing the MPLS label header, the MPLS label header can be removed and stored in the device's memory. When the packet with the label removed is processed and needs to be forwarded, the stored label can be used to re-encapsulate the packet and forward it.

[0005] However, when devices are deployed in a dual-master configuration, such as setting a firewall high-availability (HA) cluster system in peer-mode, asymmetric traffic is generated. When a device needs to inspect packets, it requires that traffic from the same session be processed on the same device. Therefore, traffic from the backup session creation device (i.e., the non-first packet forwarding device) needs to be forwarded as traffic traffic through the HA interface to the master session creation device (i.e., the first packet receiving device) for processing, ensuring that traffic from the same session is processed on the same device.

[0006] In the above scenario, because the MPLS label is removed after the backup-session creation device receives the MPLS traffic, it will not be synchronized to the master-session creation device. As a result, after the traffic is forwarded to the master-session creation device and processed, the master-session creation device does not have the MPLS label information that was removed by the backup-session creation device. The processed traffic cannot be re-encapsulated with MPLS labels on the master-session creation device, so the traffic cannot be forwarded according to the encapsulation of the original packet.

[0007] There is currently no effective solution to the above problems. Summary of the Invention

[0008] This invention provides a traffic processing method, apparatus, storage medium, and electronic device to at least solve the technical problem in the prior art where storing the tag information of MPLS packets in memory results in the inability to synchronize the tag information to the peer device.

[0009] According to one aspect of the present invention, a traffic processing method is provided, comprising: receiving MPLS packets sent by a target terminal through a first device, removing the MPLS label header of the MPLS packets to obtain a first IP packet, and storing the label information of the MPLS label header in memory; performing detection processing on the first IP packet to obtain a detection result; if the detection result indicates that the risk level of the first IP packet is lower than a preset risk level, determining whether a target session exists among multiple sessions based on the packet content of the first IP packet, and obtaining a judgment result, wherein the packet content in the target session is the same as the packet content of the first IP packet; if the judgment result indicates that a target session exists, determining a target synchronization strategy according to business requirements, wherein the target synchronization strategy is one of the following: a first synchronization strategy, a second synchronization strategy, wherein the fields processed by the first synchronization strategy and the second synchronization strategy are different; processing the first IP packet according to the label information of the MPLS label header and the target synchronization strategy to obtain target traffic, and forwarding the target traffic to a second device, wherein the target traffic contains the label information of the MPLS label header, and the second device and the first device are peer devices.

[0010] Further, based on the content of the first IP packet, it is determined whether the target session exists in multiple sessions, and the determination result is obtained. This includes: obtaining the packet content in multiple sessions respectively, and comparing the packet content in multiple sessions with the packet content of the first IP packet to obtain the comparison result; if the comparison result indicates that there is packet content in the packet content of multiple sessions that is the same as the packet content of the first IP packet, then the determination result is that the target session exists.

[0011] Furthermore, when the target synchronization strategy is the first synchronization strategy, the first IP packet is processed according to the label information in the MPLS label header and the target synchronization strategy to obtain the target traffic, including: filling the target option field of the IP header of the first IP packet with information according to the label information in the MPLS label header to obtain the second IP packet; and encapsulating the second IP packet to obtain the target traffic.

[0012] Furthermore, when the target synchronization strategy is the second synchronization strategy, the first IP packet is processed according to the label information in the MPLS label header and the target synchronization strategy to obtain the target traffic, including: encapsulating the first IP packet, and during the encapsulation process, filling the target encapsulation field with information according to the label information in the MPLS label header to obtain the target traffic.

[0013] Furthermore, before receiving the MPLS message sent by the target terminal through the first device, the method also includes: custom configuring the option field of the IP header of the IP message to obtain the target option field.

[0014] Furthermore, the options field of the IP header of the IP packet is customized, including at least one of the following: the first storage space of the options field is configured to store protocol type information; the second storage space of the options field is configured to store field length information; the third storage space of the options field is configured to store label type information of the MPLS label; the fourth storage space of the options field is configured to store label number information of the MPLS label; and the fifth storage space of the options field is configured to store label feature information of the MPLS label, wherein the label feature information of the MPLS label is used to characterize the label features of the MPLS label.

[0015] Furthermore, before receiving the MPLS message sent by the target terminal through the first device, the method further includes: adding a target encapsulation field to the traffic encapsulation field, and configuring the sixth storage space of the target encapsulation field to store the label type information of the MPLS label; configuring the seventh storage space of the target encapsulation field to store the label quantity information of the MPLS label; and configuring the eighth storage space of the target encapsulation field to store the label information of the MPLS label.

[0016] According to another aspect of the present invention, a traffic processing apparatus is also provided, comprising: a first receiving module, configured to receive MPLS packets sent by a target terminal through a first device, and remove the MPLS tag header of the MPLS packets to obtain a first IP packet, and store the tag information of the MPLS tag header in memory; and a first processing module, configured to perform detection processing on the first IP packet to obtain a detection result, and if the detection result indicates that the risk level of the first IP packet is lower than a preset risk level, then, based on the packet content of the first IP packet, determine whether a target session exists among multiple sessions, and obtain a determination result, wherein the target... The message content in the session is the same as the message content of the first IP packet; the first determining module is used to determine the target synchronization strategy according to business requirements if the determination result indicates that the target session exists, wherein the target synchronization strategy is one of the following: the first synchronization strategy and the second synchronization strategy, wherein the fields processed by the first synchronization strategy and the second synchronization strategy are different; the second processing module is used to process the first IP packet according to the label information of the MPLS label header and the target synchronization strategy to obtain the target traffic, and forward the target traffic to the second device, wherein the target traffic contains the label information of the MPLS label header, and the second device and the first device are peer devices.

[0017] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer program, and the computer program is configured to execute the above-described traffic processing method at runtime.

[0018] According to another aspect of the present invention, an electronic device is also provided, the electronic device including one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are configured to run the programs, wherein the programs are configured to execute the above-described traffic processing method during runtime.

[0019] In this embodiment of the invention, a first device receives MPLS packets sent by a target terminal and removes the MPLS header from the MPLS packets to obtain a first IP packet. The label information of the MPLS header is stored in memory. Then, the first IP packet is detected to obtain a detection result. If the detection result indicates that the risk level of the first IP packet is lower than a preset risk level, the existence of a target session among multiple sessions is determined based on the packet content of the first IP packet, and a judgment result is obtained. If the judgment result indicates that a target session exists, a target synchronization strategy is determined according to business requirements. Then, the first IP packet is processed according to the label information of the MPLS header and the target synchronization strategy to obtain target traffic, and the target traffic is forwarded to a second device. The packet content in the target session is the same as the packet content of the first IP packet. The target synchronization strategy is one of the following: a first synchronization strategy or a second synchronization strategy. The fields processed by the first and second synchronization strategies are different. The target traffic contains the label information of the MPLS header. The second device and the first device are peer devices.

[0020] The above process provides two methods for processing fields to synchronize MPLS label information from the MPLS packet receiving device to the peer device. One method is to define a custom options field in the IP packet header and fill it with MPLS label information (i.e., the packet carries MPLS label information), which is then synchronized to the peer device during traffic forwarding. The other method is to add an encapsulation field to the traffic encapsulation field to store MPLS label information (i.e., the encapsulation information carries MPLS label information), which is also synchronized to the peer device during traffic forwarding. These methods effectively reduce memory resource consumption and improve the efficiency and convenience of transmitting MPLS label information between devices.

[0021] Therefore, the technical solution of this invention achieves the goal of better transmitting MPLS tag information between devices, thereby reducing memory resource consumption and solving the technical problem in the prior art where storing MPLS packet tag information in memory results in the inability to synchronize tag information to the peer device. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0023] Figure 1 This is a flowchart of an optional traffic processing method according to an embodiment of the present invention;

[0024] Figure 2This is a schematic diagram of a forwarding process that optionally uses a custom option field to synchronize tag information according to an embodiment of the present invention.

[0025] Figure 3 This is a schematic diagram of a forwarding process that uses a newly defined HA traffic information encapsulation to achieve tag information synchronization according to an embodiment of the present invention.

[0026] Figure 4 This is a schematic diagram of an optional custom option field according to an embodiment of the present invention;

[0027] Figure 5 This is a schematic diagram of an optional new definition of HA traffic information encapsulation according to an embodiment of the present invention;

[0028] Figure 6 This is a schematic diagram of an optional flow processing device according to an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] It should be noted that all relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this invention are information and data authorized by the user or fully authorized by all parties. For example, this system has an interface with the relevant user or organization. Before obtaining relevant information, it needs to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving consent from the aforementioned user or organization.

[0032] Example 1

[0033] According to an embodiment of the present invention, an embodiment of a traffic processing method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0034] Figure 1 This is a flowchart of an optional traffic processing method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0035] Step S101: The first device receives the MPLS packet sent by the target terminal, removes the MPLS label header of the MPLS packet to obtain the first IP packet, and stores the label information of the MPLS label header in memory.

[0036] Optionally, the first device can be a backup-session creation device in a firewall HA, the target terminal can be a personal computer, and the first IP packet represents the original IP packet. For example, in a peer-mode scenario of firewall HA, when asymmetric MPLS traffic needs to be forwarded and subjected to attack detection by intrusion prevention systems (IPS), antivirus (AV), etc., the backup-session creation device can remove the MPLS header of the MPLS packet after receiving it to obtain the original IP packet, and store the label information of the MPLS header in memory.

[0037] Step S102: Detect and process the first IP packet to obtain a detection result. If the detection result indicates that the risk level of the first IP packet is lower than the preset risk level, then determine whether there is a target session among multiple sessions based on the packet content of the first IP packet, and obtain a judgment result. In this case, the packet content in the target session is the same as the packet content of the first IP packet.

[0038] Optionally, the original IP packets can be inspected (e.g., for attack detection) to obtain detection results. If the detection results indicate that the risk level of the original IP packets is lower than the preset risk level, the content of the original IP packets can be used to determine whether a target session exists in multiple sessions and obtain a judgment result. For example, it can be determined whether there is a session in multiple existing sessions that has the same content as the original IP packets, where the target session is a session synchronized from the peer and has the same content as the original IP packets.

[0039] Optionally, if the detection result indicates that the risk level of the original IP packet is higher than the preset risk level, an alarm IP packet is generated, and an MPLS label header is encapsulated to obtain an alarm MPLS packet, which is then sent to the target terminal.

[0040] Step S103: If the judgment result indicates that a target session exists, then the target synchronization strategy is determined according to the business requirements. The target synchronization strategy is one of the following: a first synchronization strategy or a second synchronization strategy. The first synchronization strategy and the second synchronization strategy process different fields.

[0041] Optionally, the first synchronization strategy represents the strategy of adding IP option definitions to the original IP packet, and the second synchronization strategy represents the strategy of adding encapsulation fields to traffic traffic. If the judgment result indicates that a target session exists, the target synchronization strategy can be determined according to business requirements.

[0042] Step S104: Process the first IP packet according to the label information in the MPLS label header and the target synchronization policy to obtain the target traffic, and forward the target traffic to the second device. The target traffic contains the label information in the MPLS label header. The second device and the first device are peer devices.

[0043] Optionally, after determining the target synchronization strategy, the original IP packets can be processed according to the label information in the MPLS label header and the target synchronization strategy to obtain the target traffic (e.g., traffic consisting of multiple IP packets with MPLS label information), and the target traffic can be forwarded to the second device, i.e., the peer device of the first device, such as the master-session creation device in the firewall HA.

[0044] Based on the scheme defined in steps S101 to S104 above, it can be understood that in this embodiment of the invention, the first device receives MPLS packets sent by the target terminal, removes the MPLS header of the MPLS packets to obtain a first IP packet, stores the label information of the MPLS header in memory, and then performs detection processing on the first IP packet to obtain a detection result. If the detection result indicates that the risk level of the first IP packet is lower than the preset risk level, then based on the packet content of the first IP packet, it is determined whether a target session exists among multiple sessions, and a judgment result is obtained. If the judgment result indicates that a target session exists, then a target synchronization strategy is determined according to business requirements. Then, the first IP packet is processed according to the label information of the MPLS header and the target synchronization strategy to obtain target traffic, and the target traffic is forwarded to the second device. The packet content in the target session is the same as the packet content of the first IP packet. The target synchronization strategy is one of the following: a first synchronization strategy or a second synchronization strategy. The fields processed by the first synchronization strategy and the second synchronization strategy are different. The target traffic contains the label information of the MPLS header. The second device and the first device are peer devices.

[0045] In some examples, different business requirements correspond to different synchronization strategies.

[0046] In some examples, service requirements may include a first service requirement and a second service requirement. For instance, the first service requirement indicates that the MPLS packet traffic is below a traffic threshold, while the second service requirement indicates that the MPLS packet traffic is above a traffic threshold. When the service requirement is the first service requirement, the target synchronization policy is the first synchronization policy; when the service requirement is the second service requirement, the target synchronization policy is the second synchronization policy. The traffic threshold here can be flexibly adjusted according to actual needs.

[0047] In some examples, the first synchronization policy processes the IP options field, while the second synchronization policy processes the encapsulation field.

[0048] It's worth noting that the above process provides two methods for processing fields to synchronize MPLS label information from the MPLS packet receiving device to the peer device. One method is to define a custom options field in the IP packet header and fill it with MPLS label information (i.e., the packet carries MPLS label information), which is then synchronized to the peer device during traffic forwarding. The other method is to add an encapsulation field to the traffic encapsulation field to store MPLS label information (i.e., the encapsulation information carries MPLS label information), which is also synchronized to the peer device during traffic forwarding. These methods effectively reduce memory resource consumption and improve the efficiency and convenience of transmitting MPLS label information between devices.

[0049] Therefore, the technical solution of this invention achieves the goal of better transmitting MPLS tag information between devices, thereby reducing memory resource consumption and solving the technical problem in the prior art where storing MPLS packet tag information in memory results in the inability to synchronize tag information to the peer device.

[0050] In one optional embodiment, after a packet carrying an MPLS label arrives at the device, the device removes the MPLS label header from the packet and records the MPLS label information in the device's memory. The original IP packet without the MPLS label is then inspected. If the device already has a session with the same content as the packet, and the session was synchronously generated by the HA peer device, when the packet needs to be forwarded to the HA peer device via traffic, the MPLS label information stored in memory is extracted. A custom option field is filled in with the MPLS label information. Before the backup-session creation device forwards traffic, the filled option field is added to the original IP packet, and the new IP packet is forwarded to the master-session creation device according to the HA traffic encapsulation format.

[0051] In one optional embodiment, the target traffic sent by the first device is received by the second device, and the target traffic is processed according to the target synchronization strategy. When the target synchronization strategy is the first synchronization strategy, the target traffic is parsed to obtain a second IP packet. The MPLS label information of the MPLS header is obtained from the target options field of the IP header of the second IP packet and stored in memory. The target options field of the IP header of the second IP packet is deleted to obtain a first IP packet. The first IP packet is then detected to obtain a detection result. If the detection result indicates that the risk level of the first IP packet is lower than the preset risk level, the MPLS label information of the MPLS header is obtained from memory, and an MPLS label is added to the first IP packet according to the MPLS label information to obtain an MPLS packet. The MPLS packet is then forwarded to the first terminal. If the detection result indicates that the risk level of the first IP packet is higher than the preset risk level, a third IP packet is generated. The MPLS label information of the MPLS header is obtained from memory, and an MPLS label is added to the third IP packet according to the MPLS label information to obtain a first MPLS packet. The first MPLS packet is then forwarded to the first terminal.

[0052] Optionally, the master-session creation device receives the target traffic sent by the backup-session creation device. If the target synchronization policy is the first synchronization policy, the target traffic is parsed to obtain the second IP packet (i.e., the new IP packet mentioned above). The MPLS label information can be obtained from the target options field of the IP header of the new IP packet. The MPLS label information is stored in the device's memory. Then, the target options field of the IP header of the new IP packet is deleted to obtain the original IP packet mentioned above. The original IP packet is then inspected accordingly to obtain the inspection result.

[0053] Optionally, if the detection result indicates that the risk level of the original IP packet is lower than the preset risk level, the label information of the MPLS label header is obtained from memory, and an MPLS label header is added to the original IP packet according to the label information of the MPLS label header to obtain an MPLS packet, which is then forwarded to the first terminal (such as another personal computer); if the detection result indicates that the risk level of the original IP packet is higher than the preset risk level, a third IP packet (e.g., an alarm IP packet) is generated, and the label information of the MPLS label header is obtained from memory, and an MPLS label header is added to the third IP packet according to the label information of the MPLS label header to obtain a first MPLS packet (e.g., an alarm MPLS packet), which is then forwarded to the first terminal.

[0054] In one optional embodiment, the master-session creation device processes traffic traffic, identifies and extracts option field information from IP packets, forms MPLS label information based on the content of the option field information, and stores it in the device's local memory. At the same time as the extraction is completed, the MPLS-related option fields in the IP packets are deleted. The device then performs normal processing procedures on the IP packets, such as attack detection. When the packet is processed by the device and needs to be forwarded again, the MPLS label information stored in memory can be encapsulated back into the original IP packet for forwarding.

[0055] Figure 2 This is a schematic diagram of a forwarding process that optionally uses a custom option field to synchronize tag information according to an embodiment of the present invention, such as... Figure 2As shown, the process includes the following steps: After receiving a packet, the device determines whether an MPLS label exists. If not, it processes the packet as a non-MPLS packet. If it exists, it removes the MPLS label header from the packet, records the MPLS label information in the device's memory, performs corresponding detection and processing on the original IP packet with the MPLS label removed, and then determines whether a synchronization session is matched, i.e., whether the device has a session consistent with the packet content. If no synchronization session is matched, the device receives and processes the MPLS packet locally. If a synchronization session is matched, i.e., the device already has a session consistent with the packet content, and the session was generated synchronously by the HA peer device, it determines whether HA traffic forwarding is required. If forwarding is not required, the device receives and processes the MPLS packet locally. If forwarding is required, the device performs HA traffic processing, extracts the MPLS label information stored in memory, fills the custom option field with the MPLS label information to generate option information, adds option information to the original IP packet before the backup-session creation device performs traffic forwarding, and forwards the new IP packet to the master-session creation device according to the HA traffic encapsulation format.

[0056] The master-session creates a device that receives packets, processes traffic, identifies and extracts the option field information from IP packets, generates MPLS labels based on the option field information, and stores them in the device's local memory. Simultaneously, the MPLS-related option fields in the IP packets are deleted. The device then proceeds with normal IP packet processing, such as attack detection. When a packet needs to be forwarded after processing, the stored MPLS label information is extracted and encapsulated back into the original IP packet for forwarding. This resolves the issue of locally stored MPLS labels not being synchronously encapsulated across HA servers when asymmetric MPLS traffic exists.

[0057] In one optional embodiment, after a packet carrying an MPLS label arrives at the device, the device removes the MPLS label header from the packet and records the MPLS label information in the device's memory. The original IP packet without the MPLS label is then inspected. If the device already has a session with the same content as the packet, and the session is synchronously generated by the HA peer device, when it is necessary to forward the packet to the HA peer device via traffic, the MPLS label information stored in memory is extracted, and the extracted MPLS label information is filled into the newly added MPLS information encapsulation in HA traffic for forwarding of HA traffic.

[0058] In one optional embodiment, the second device receives the target traffic sent by the first device and processes the target traffic according to a target synchronization strategy. When the target synchronization strategy is the second synchronization strategy, the MPLS header label information is obtained from the encapsulation information of the target traffic and stored in memory. The target traffic is parsed to obtain a first IP packet, and the first IP packet is detected to obtain a detection result. If the detection result indicates that the risk level of the first IP packet is lower than a preset risk level, the MPLS header label information is obtained from memory, and an MPLS header is added to the first IP packet according to the MPLS header label information to obtain an MPLS packet, which is then forwarded to the first terminal. If the detection result indicates that the risk level of the first IP packet is higher than a preset risk level, a fourth IP packet is generated, and the MPLS header label information is obtained from memory, and an MPLS header is added to the fourth IP packet according to the MPLS header label information to obtain a second MPLS packet, which is then forwarded to the first terminal.

[0059] Optionally, the master-session creation device receives the target traffic sent by the backup-session creation device. If the target synchronization strategy is the second synchronization strategy, the label information of the MPLS label header can be obtained from the encapsulation information of the target traffic, and the label information of the MPLS label header can be stored in memory. Then, the target traffic is parsed to obtain the original IP packets mentioned above, and the original IP packets are detected accordingly to obtain the detection results.

[0060] Optionally, if the detection result indicates that the risk level of the original IP packet is lower than the preset risk level, the label information of the MPLS label header is obtained from memory, and an MPLS label header is added to the original IP packet according to the label information of the MPLS label header to obtain an MPLS packet, which is then forwarded to the first terminal (such as another personal computer); if the detection result indicates that the risk level of the original IP packet is higher than the preset risk level, a fourth IP packet (e.g., an alarm IP packet) is generated, and the label information of the MPLS label header is obtained from memory, and an MPLS label header is added to the fourth IP packet according to the label information of the MPLS label header to obtain a second MPLS packet (e.g., an alarm MPLS packet), which is then forwarded to the first terminal.

[0061] In one optional embodiment, HA traffic is forwarded to the master-session creation device. The master-session creation device processes the traffic, identifies and extracts the MPLS information from the HA traffic encapsulation, and stores the MPLS content in the information locally. When the packet is processed by the device and needs to be forwarded again, the MPLS label information stored in memory can be encapsulated back into the original IP packet for forwarding.

[0062] Figure 3 This is a schematic diagram of an optional forwarding process for tag information synchronization using a newly defined HA traffic information encapsulation according to an embodiment of the present invention, as shown below. Figure 3 As shown, the process includes the following steps: After receiving a packet, the device determines whether an MPLS label exists. If not, it processes the packet as a non-MPLS packet. If it exists, it removes the MPLS label header from the packet, records the MPLS label information in the device's memory, performs corresponding detection and processing on the original IP packet with the MPLS label removed, and then determines whether a synchronization session is matched, i.e., whether the device has a session consistent with the packet content. If no synchronization session is matched, the device receives and processes the MPLS packet locally. If a synchronization session is matched, i.e., the device already has a session consistent with the packet content, and the session was generated synchronously by the HA peer device, it determines whether HA traffic forwarding is required. If forwarding is not required, the device receives and processes the MPLS packet locally. If forwarding is required, the device performs HA traffic processing, extracts the MPLS label information stored in memory, performs HA traffic filling MPLS encapsulation based on the MPLS label information, and then forwards it to the master-session creation device.

[0063] The master-session creates a device that receives packets, extracts MPLS information from the encapsulation information, and stores it in the device's local memory. When a packet is processed by the device and needs to be forwarded again, the MPLS label information stored in memory can be extracted and encapsulated back into the original IP packet for forwarding. This solves the problem that locally stored MPLS labels cannot be synchronously encapsulated across HA servers when there is asymmetric MPLS traffic.

[0064] In one optional embodiment, determining whether a target session exists among multiple sessions based on the content of the first IP packet and obtaining a determination result includes: obtaining the packet content of each of the multiple sessions and comparing the packet content of the multiple sessions with the packet content of the first IP packet to obtain a comparison result; if the comparison result indicates that there is packet content in the packet content of the multiple sessions that is the same as the packet content of the first IP packet, then the determination result is that a target session exists.

[0065] Optionally, in the process of determining whether a target session exists among multiple sessions based on the content of the first IP packet and obtaining the determination result, the packet content of multiple sessions can be obtained separately, and the packet content of multiple sessions can be compared with the packet content of the original IP packet to obtain the comparison result. If the comparison result indicates that there is packet content in the packet content of multiple sessions that is the same as the packet content of the original IP packet, then the determination result is that a target session exists.

[0066] In one optional embodiment, when the target synchronization policy is the first synchronization policy, the first IP packet is processed according to the label information of the MPLS label header and the target synchronization policy to obtain the target traffic, including: filling the target option field of the IP header of the first IP packet with information according to the label information of the MPLS label header to obtain the second IP packet; and encapsulating the second IP packet to obtain the target traffic.

[0067] In one optional embodiment, before receiving the MPLS message sent by the target terminal through the first device, the option field of the IP header of the IP message is customized to obtain the target option field.

[0068] In one optional embodiment, the options field of the IP header of the IP packet is customized, including at least one of the following: configuring a first storage space for the options field to store protocol type information; configuring a second storage space for the options field to store field length information; configuring a third storage space for the options field to store label type information of the MPLS label; configuring a fourth storage space for the options field to store label quantity information of the MPLS label; configuring a fifth storage space for the options field to store label feature information of the MPLS label, wherein the label feature information of the MPLS label is used to characterize the label features of the MPLS label.

[0069] Optionally, when the target synchronization strategy is to add IP option definitions to the original IP packet, during the process of processing the original IP packet according to the label information of the MPLS label header and the target synchronization strategy to obtain the target traffic, the target option field of the IP header of the original IP packet can be filled with information according to the label information of the MPLS label header to obtain a second IP packet (i.e., the new IP packet mentioned above). After filling, the target option field of the new IP packet contains the label information of the MPLS label header. Then, the new IP packet is encapsulated to obtain the target traffic.

[0070] Before the backup-session device receives MPLS packets sent by the target terminal, the options field of the IP header of the IP packet is customized to obtain the target options field. During the customization of the options field of the IP header, the following configurations can be made: a first storage space (e.g., 1 byte) for storing protocol type information; a second storage space (e.g., 1 byte) for storing the field length information; a third storage space (e.g., 2 bytes) for storing the MPLS label type information; a fourth storage space (e.g., 1 byte) for storing the number of MPLS labels; and a fifth storage space (e.g., 20 bytes) for storing the label information of the MPLS labels. The label information of the MPLS labels includes at least the MPLS label value, MPLS extension, MPLS stack bottom identifier, and MPLS Time To Live (TTL) information.

[0071] It should be noted that the IP option field is a variable part of the IP datagram header (which consists of a header and data). The length of this field is variable, with a maximum length of 40 bytes. In this scheme, the option field of the IP header is customized to record locally stored MPLS information, including at least the MPLS label value, MPLS extensions, MPLS stack bottom identifier, and MPLS time-to-live (TTL) information.

[0072] Figure 4 This is a schematic diagram of an optional custom option field according to an embodiment of the present invention, such as... Figure 4 As shown, the specific definition of the option field is as follows: In the option field, the protocol type occupies 1 byte to store the newly added option type value; the length occupies 1 byte to store the length of the current option field; the MPLS label type occupies 2 bytes to store the l2-type value in the message containing MPLS; the number of MPLS labels occupies 1 byte to store the number of MPLS labels; and the MPLS information item occupies 20 bytes, filled with locally stored MPLS information.

[0073] In one optional embodiment, when the target synchronization strategy is the second synchronization strategy, the first IP packet is processed according to the label information of the MPLS label header and the target synchronization strategy to obtain the target traffic, including: encapsulating the first IP packet, and during the encapsulation process, filling the target encapsulation field with information according to the label information of the MPLS label header to obtain the target traffic.

[0074] In an optional embodiment, before receiving the MPLS message sent by the target terminal through the first device, a target encapsulation field is added to the traffic encapsulation field, and the sixth storage space of the target encapsulation field is configured to store the label type information of the MPLS label; the seventh storage space of the target encapsulation field is configured to store the label quantity information of the MPLS label; and the eighth storage space of the target encapsulation field is configured to store the label information of the MPLS label.

[0075] Optionally, when the target synchronization strategy is to add an encapsulation field for traffic, during the process of processing the original IP packets according to the label information of the MPLS label header and the target synchronization strategy to obtain the target traffic, the original IP packets are encapsulated, and during the encapsulation process, the target encapsulation field is filled with information according to the label information of the MPLS label header to obtain the target traffic. After filling, the target encapsulation field contains the label information of the MPLS label header.

[0076] Before the device receives MPLS packets sent by the target terminal through backup-session, a target encapsulation field can be added to the traffic encapsulation field. The sixth storage space (e.g., 2 bytes) of the target encapsulation field can be configured to store the label type information of the MPLS label, the seventh storage space (e.g., 1 byte) of the target encapsulation field can be configured to store the label number information of the MPLS label, and the eighth storage space (e.g., 20 bytes) of the target encapsulation field can be configured to store the label information of the MPLS label.

[0077] It should be noted that the original traffic encapsulation included L2 frames (i.e., the header information of the Layer 2 data link layer), the original IP packets, and encapsulation related to HA traffic forwarding information. In this solution, an MPLS information field (i.e., the target encapsulation field) is added to the original HA traffic forwarding information encapsulation, and the encapsulated content is MPLS-related information.

[0078] Figure 5 This is a schematic diagram of an optional new definition of HA traffic information encapsulation according to an embodiment of the present invention. After adding MPLS information, the HA traffic part is encapsulated as follows: Figure 5 As shown, the specific field definitions are as follows: MPLS label type occupies 2 bytes, used to store the l2-type value in the message containing MPLS; MPLS label count occupies 1 byte, used to store the number of MPLS labels; MPLS information item occupies 20 bytes, the content is filled with locally stored MPLS information, including at least MPLS label value, MPLS extension, MPLS stack bottom identifier, MPLS time to life (TTL) information, etc.

[0079] It should be noted that, in this embodiment of the invention, two methods for handling MPLS-related information are provided for HA traffic processing: custom IP options and new HA traffic information encapsulation. When traffic needs to be forwarded via traffic and MPLS information is stored in local memory and HA synchronization is not possible, MPLS information can be carried to the peer device by recording MPLS information in the option field of IP packets and recording MPLS information in the form of HA traffic information encapsulation.

[0080] Therefore, the technical solution of this invention achieves the goal of better transmitting MPLS tag information between devices, thereby reducing memory resource consumption and solving the technical problem in the prior art where storing MPLS packet tag information in memory results in the inability to synchronize tag information to the peer device.

[0081] Example 2

[0082] According to an embodiment of the present invention, an embodiment of a flow processing device is provided, wherein, Figure 6 This is a schematic diagram of an optional flow processing device according to an embodiment of the present invention, such as... Figure 6 As shown, the device includes: a first receiving module 601, configured to receive MPLS packets sent by a target terminal through a first device, remove the MPLS tag header of the MPLS packets to obtain a first IP packet, and store the tag information of the MPLS tag header in memory; and a first processing module 602, configured to perform detection processing on the first IP packet to obtain a detection result. If the detection result indicates that the risk level of the first IP packet is lower than a preset risk level, then based on the packet content of the first IP packet, it is determined whether a target session exists among multiple sessions, and a judgment result is obtained. The packet content in the target session is consistent with the first IP packet. The IP packets have the same content; the first determining module 603 is used to determine the target synchronization strategy according to business requirements if the determination result indicates that a target session exists, wherein the target synchronization strategy is one of the following: a first synchronization strategy or a second synchronization strategy, wherein the fields processed by the first synchronization strategy and the second synchronization strategy are different; the second processing module 604 is used to process the first IP packet according to the label information of the MPLS label header and the target synchronization strategy to obtain the target traffic, and forward the target traffic to the second device, wherein the target traffic contains the label information of the MPLS label header, and the second device and the first device are peer devices.

[0083] It should be noted that the first receiving module 601, the first processing module 602, the first determining module 603 and the second processing module 604 mentioned above correspond to steps S101 to S104 in the above embodiments. The examples and application scenarios implemented by the four modules and the corresponding steps are the same, but are not limited to the content disclosed in the above embodiment 1.

[0084] Optionally, the first processing module includes: a first acquisition unit, configured to acquire the message content in multiple sessions respectively, and compare the message content in multiple sessions with the message content of the first IP packet to obtain a comparison result; and a first determination unit, configured to determine that a target session exists if the comparison result indicates that there is message content in the message content of multiple sessions that is the same as the message content of the first IP packet.

[0085] Optionally, in the process of determining whether a target session exists among multiple sessions based on the content of the first IP packet and obtaining the determination result, the packet content of multiple sessions can be obtained separately, and the packet content of multiple sessions can be compared with the packet content of the original IP packet to obtain the comparison result. If the comparison result indicates that there is packet content in the packet content of multiple sessions that is the same as the packet content of the original IP packet, then the determination result is that a target session exists.

[0086] Optionally, when the target synchronization strategy is the first synchronization strategy, the second processing module includes: a first processing unit, used to fill the target option field of the IP header of the first IP packet with information based on the label information of the MPLS label header to obtain a second IP packet; and a second processing unit, used to encapsulate the second IP packet to obtain the target traffic.

[0087] Optionally, when the target synchronization strategy is the second synchronization strategy, the second processing module includes: a third processing unit, used to encapsulate the first IP packet, and during the encapsulation process, to fill the target encapsulation field with information based on the label information of the MPLS label header to obtain the target traffic.

[0088] Optionally, the traffic processing device further includes a third processing module, used to customize the option field of the IP header of the IP packet to obtain the target option field before receiving the MPLS packet sent by the target terminal through the first device.

[0089] Optionally, the third processing module includes at least one of the following: a first configuration unit for configuring a first storage space for the option field to store protocol type information; a second configuration unit for configuring a second storage space for the option field to store field length information; a third configuration unit for configuring a third storage space for the option field to store label type information of the MPLS label; a fourth configuration unit for configuring a fourth storage space for the option field to store label quantity information of the MPLS label; and a fifth configuration unit for configuring a fifth storage space for the option field to store label feature information of the MPLS label, wherein the label feature information of the MPLS label is used to characterize the label features of the MPLS label.

[0090] Optionally, the traffic processing device further includes: a fourth processing module, configured to add a target encapsulation field to the traffic encapsulation field before receiving the MPLS message sent by the target terminal through the first device, and configure the sixth storage space of the target encapsulation field to store the label type information of the MPLS label; a fifth processing module, configured to configure the seventh storage space of the target encapsulation field to store the label quantity information of the MPLS label; and a sixth processing module, configured to configure the eighth storage space of the target encapsulation field to store the label information of the MPLS label.

[0091] Optionally, when the target synchronization strategy is to add IP option definitions to the original IP packet, during the process of processing the original IP packet according to the label information of the MPLS label header and the target synchronization strategy to obtain the target traffic, the target option field of the IP header of the original IP packet can be filled with information according to the label information of the MPLS label header to obtain a second IP packet (i.e., a new IP packet). After filling, the target option field of the new IP packet contains the label information of the MPLS label header. Then, the new IP packet is encapsulated to obtain the target traffic.

[0092] Before the backup-session device receives MPLS packets sent by the target terminal, the options field of the IP header of the IP packet is customized to obtain the target options field. During the customization of the options field of the IP header, the following configurations can be made: a first storage space (e.g., 1 byte) for storing protocol type information; a second storage space (e.g., 1 byte) for storing field length information; a third storage space (e.g., 2 bytes) for storing MPLS label type information; a fourth storage space (e.g., 1 byte) for storing the number of MPLS labels; and a fifth storage space (e.g., 20 bytes) for storing MPLS label information. The MPLS label information includes at least the MPLS label value, MPLS extension, MPLS stack bottom identifier, and MPLS Time-to-Live (TTL) information.

[0093] It should be noted that the IP option field is a variable part of the IP datagram header (which consists of a header and data). The length of this field is variable, with a maximum length of 40 bytes. In this scheme, the option field of the IP header is customized to record locally stored MPLS information, including at least the MPLS label value, MPLS extensions, MPLS stack bottom identifier, and MPLS time-to-live (TTL) information.

[0094] The specific definitions of the option field are as follows: In the option field, the protocol type occupies 1 byte and is used to store the newly added option type value; the length occupies 1 byte and is used to store the length of the current option field; the MPLS label type occupies 2 bytes and is used to store the l2-type value in the message containing MPLS; the number of MPLS labels occupies 1 byte and is used to store the number of MPLS labels; the MPLS information item occupies 20 bytes and is filled with locally stored MPLS information.

[0095] Optionally, when the target synchronization strategy is to add an encapsulation field for traffic, during the process of processing the original IP packets according to the label information of the MPLS label header and the target synchronization strategy to obtain the target traffic, the original IP packets are encapsulated, and during the encapsulation process, the target encapsulation field is filled with information according to the label information of the MPLS label header to obtain the target traffic. After filling, the target encapsulation field contains the label information of the MPLS label header.

[0096] Before the device receives MPLS packets sent by the target terminal through backup-session, a target encapsulation field can be added to the traffic encapsulation field. The sixth storage space (e.g., 2 bytes) of the target encapsulation field can be configured to store the label type information of the MPLS label, the seventh storage space (e.g., 1 byte) of the target encapsulation field can be configured to store the label number information of the MPLS label, and the eighth storage space (e.g., 20 bytes) of the target encapsulation field can be configured to store the label information of the MPLS label.

[0097] It should be noted that the original traffic encapsulation included L2 frames (i.e., Layer 2 data link layer header information), the original IP packet, and HA traffic forwarding information related encapsulation. In this scheme, an MPLS information field (i.e., the target encapsulation field) is added to the original HA traffic forwarding information related encapsulation. The encapsulated content is MPLS-related information. The specific field definitions are as follows: MPLS label type occupies 2 bytes, used to store the l2-type value in the packet containing MPLS; MPLS label count occupies 1 byte, used to store the number of MPLS labels; MPLS information item occupies 20 bytes, filled with locally stored MPLS information, including at least the MPLS label value, MPLS extension, MPLS stack bottom identifier, and MPLS time-to-live (TTL) information.

[0098] Example 3

[0099] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer-readable storage medium, and the computer program is configured to execute the above-described traffic processing method at runtime.

[0100] Example 4

[0101] According to another aspect of the present invention, an electronic device is also provided, the electronic device including one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are configured to run the programs, wherein the programs are configured to execute the above-described traffic processing method during runtime.

[0102] The devices mentioned in this article can be servers, PCs, tablets, mobile phones, etc.

[0103] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0104] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0105] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0106] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0107] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0108] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0109] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A flow processing method, characterized in that, include: The first device receives MPLS packets sent by the target terminal, removes the MPLS tag header of the MPLS packets to obtain the first IP packet, and stores the tag information of the MPLS tag header in memory. The first IP packet is detected and processed to obtain a detection result. If the detection result indicates that the risk level of the first IP packet is lower than the preset risk level, then based on the packet content of the first IP packet, it is determined whether there is a target session among multiple sessions to obtain a judgment result. The packet content in the target session is the same as the packet content of the first IP packet. If the judgment result indicates that the target session exists, then a target synchronization strategy is determined according to business requirements. The target synchronization strategy is one of the following: a first synchronization strategy or a second synchronization strategy. The fields processed by the first synchronization strategy and the second synchronization strategy are different. The field processed by the first synchronization strategy is the IP option field, and the field processed by the second synchronization strategy is the encapsulation field. The first IP packet is processed according to the label information in the MPLS label header and the target synchronization policy to obtain the target traffic, and the target traffic is forwarded to the second device. The target traffic contains the label information in the MPLS label header, and the second device and the first device are peer devices. When the target synchronization policy is the first synchronization policy, the first IP packet is processed according to the label information of the MPLS label header and the target synchronization policy to obtain the target traffic, including: filling the target option field of the IP header of the first IP packet with information according to the label information of the MPLS label header to obtain the second IP packet; and encapsulating the second IP packet to obtain the target traffic. Before receiving the MPLS packet sent by the target terminal through the first device, the method further includes: custom configuring the option field of the IP header of the IP packet to obtain the target option field; The options field of the IP header of the IP packet can be customized, including at least one of the following: configuring a first storage space for the options field to store protocol type information; configuring a second storage space for the options field to store field length information; configuring a third storage space for the options field to store label type information of the MPLS label; configuring a fourth storage space for the options field to store label quantity information of the MPLS label; configuring a fifth storage space for the options field to store label feature information of the MPLS label, wherein the label feature information of the MPLS label is used to characterize the label features of the MPLS label.

2. The method according to claim 1, characterized in that, Based on the content of the first IP packet, determine whether the target session exists among multiple sessions, and obtain the determination result, including: The message content in each of the multiple sessions is obtained, and the message content in the multiple sessions is compared with the message content of the first IP packet to obtain the comparison result; If the comparison result indicates that there is a message in the message content of the plurality of sessions that is identical to the message content of the first IP message, then the judgment result is determined to indicate that the target session exists.

3. The method according to claim 1, characterized in that, When the target synchronization policy is the second synchronization policy, the first IP packet is processed according to the label information in the MPLS label header and the target synchronization policy to obtain the target traffic, including: The first IP packet is encapsulated, and during the encapsulation process, the target encapsulation field is filled with information based on the label information of the MPLS label header to obtain the target traffic.

4. The method according to claim 1, 2 or 3, characterized in that, Before receiving MPLS packets sent by the target terminal through the first device, the method further includes: Add a target encapsulation field to the traffic encapsulation field, and configure the sixth storage space of the target encapsulation field to store the tag type information of MPLS tags; The seventh storage space of the target encapsulation field is configured to store the tag quantity information of the MPLS tags; The eighth storage space of the target encapsulation field is configured to store the tag information of the MPLS tag.

5. A flow processing device, characterized in that, include: The first receiving module is used to receive MPLS packets sent by the target terminal through the first device, remove the MPLS tag header of the MPLS packets to obtain the first IP packets, and store the tag information of the MPLS tag header in memory. The first processing module is used to detect and process the first IP packet to obtain a detection result. If the detection result indicates that the risk level of the first IP packet is lower than the preset risk level, then based on the packet content of the first IP packet, it is determined whether there is a target session among multiple sessions to obtain a judgment result. The packet content in the target session is the same as the packet content of the first IP packet. The first determining module is used to determine a target synchronization strategy based on business requirements if the determination result indicates that the target session exists. The target synchronization strategy is one of the following: a first synchronization strategy and a second synchronization strategy. The fields processed by the first synchronization strategy and the second synchronization strategy are different. The field processed by the first synchronization strategy is the IP option field, and the field processed by the second synchronization strategy is the encapsulation field. The second processing module is used to process the first IP packet according to the label information of the MPLS label header and the target synchronization policy to obtain the target traffic, and forward the target traffic to the second device. The target traffic contains the label information of the MPLS label header, and the second device and the first device are peer devices. Wherein, when the target synchronization strategy is the first synchronization strategy, the second processing module includes: a first processing unit, used to fill the target option field of the IP header of the first IP packet with information based on the label information of the MPLS label header to obtain a second IP packet; and a second processing unit, used to encapsulate the second IP packet to obtain the target traffic. The device further includes: a third processing module, configured to customize the option field of the IP header of the IP packet to obtain the target option field before receiving the MPLS packet sent by the target terminal through the first device; The third processing module includes at least one of the following: a first configuration unit for configuring a first storage space for the option field to store protocol type information; a second configuration unit for configuring a second storage space for the option field to store field length information; a third configuration unit for configuring a third storage space for the option field to store tag type information of the MPLS tag; a fourth configuration unit for configuring a fourth storage space for the option field to store tag quantity information of the MPLS tag; and a fifth configuration unit for configuring a fifth storage space for the option field to store tag feature information of the MPLS tag, wherein the tag feature information of the MPLS tag is used to characterize the tag features of the MPLS tag.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the traffic processing method according to any one of claims 1 to 4 when it is run.

7. An electronic device, characterized in that, The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to be configured to run the programs, wherein the programs are configured to execute the traffic processing method of any one of claims 1 to 4 at runtime.

Images