Fragmented packet processing methods, devices, firewalls, and dual-active firewall clusters

Abstract

This application relates to the field of firewall disaster recovery technology, providing a method, apparatus, firewall, and active-active firewall cluster for fragmented packet processing. The method includes: upon receiving the first fragmented packet, determining the type of the first fragmented packet; the type of the first fragmented packet characterizes its position within the corresponding Internet Protocol (IP) packet; based on the type of the first fragmented packet, determining a target entry corresponding to the first fragmented packet; the target entry identifies the first fragmented packet; and synchronizing the target entry to the peer firewall to instruct both the peer firewall and the local firewall to identify other fragmented packets belonging to the same IP packet as the first fragmented packet. The embodiments of this application can effectively process fragmented packets, ensuring the integrity of IP packets. Simultaneously, it avoids the waste of hardware and system resources by the backup firewall in primary / backup mode, improving the resource utilization efficiency and reliability of the active-active firewall cluster.

Description

Technical Field

[0001] This application relates to the field of firewall disaster recovery technology, specifically to a fragmented packet processing method, apparatus, firewall, and dual-active firewall cluster. Background Technology

[0002] Currently, during network transmission, IP (Internet Protocol) packets are often fragmented due to the Maximum Transmission Unit (MTU) limitation supported by devices along the transmission path. These fragments are then forwarded by upstream and downstream devices to different firewalls. In general network architectures, firewalls are typically placed at the interface between internal and external networks, and between private and public networks, to protect the internal network from unauthorized access. Firewalls monitor, restrict, and modify data flows crossing the firewall to shield the internal network's information, structure, and operational status from external view as much as possible. Figure 1 As shown, firewalls are typically configured in pairs for redundant networking to ensure the robustness of the network system. Since only the first fragment of a segmented packet contains a transport layer protocol header, only the firewall receiving the first fragment can create a complete session entry based on the protocol header and match the forwarding policy. Firewalls receiving subsequent fragments cannot create session entries, leading to abnormal processing of these fragments and ultimately incomplete IP packets transmitted over the network.

[0003] In existing technologies, paired firewalls are typically configured in Active-Standby Mode, with both firewalls having fragmentation caching enabled. By directing all service traffic to the primary firewall, it ensures that all fragmented IP packets can be sent to the primary firewall. However, in Active-Standby Mode, the backup firewall is idle most of the time, resulting in significant resource waste. Therefore, how to effectively handle fragmented packets is a pressing issue that needs to be addressed. Summary of the Invention

[0004] This application provides a method, apparatus, firewall, and dual-active firewall cluster for processing fragmented packets, in order to solve the technical problem of how to effectively process fragmented packets in the prior art.

[0005] In a first aspect, embodiments of this application provide a fragmented packet processing method applied to a local firewall, wherein the local firewall is any firewall in a dual-active firewall cluster, and the method includes:

[0006] Upon receiving the first fragmented packet, the type of the first fragmented packet is determined; the type of the first fragmented packet is used to characterize the position of the first fragmented packet within its corresponding Internet Protocol (IP) packet.

[0007] Based on the type of the first fragmented packet, a target entry corresponding to the first fragmented packet is determined; the target entry is used to identify the first fragmented packet.

[0008] The target entry is synchronized to the peer firewall to instruct the peer firewall and the local firewall to identify other fragmented packets that have the same IP address as the first fragmented packet.

[0009] In one embodiment, according to the fragmented packet processing method provided in this application, the target entry includes a packet identification entry, or an association between a packet identification entry and a session entry;

[0010] The step of determining the target entry corresponding to the first fragment packet based on the type of the first fragment packet includes:

[0011] When the type of the first fragmented packet is a first fragmented packet, the session entry and the packet identifier entry corresponding to the first fragmented packet are determined respectively, and the association relationship between the session entry and the packet identifier entry is determined; the packet identifier entry is used to identify the IP packet to which the first fragmented packet belongs; the session entry is used to identify the session to which the IP packet belongs;

[0012] If the type of the first fragment message is not the first fragment message, determine the message identifier entry corresponding to the first fragment message.

[0013] In one embodiment, the fragmented packet processing method provided by the present application, when the type of the first fragmented packet is a first fragmented packet, the method further includes:

[0014] When the firewall forwarding mode is synchronous forwarding mode, other non-first fragment packets sent by the peer firewall are received, and a first confirmation message is sent to the peer firewall; the first confirmation message is used to instruct the peer firewall to delete the other non-first fragment packets; upon receiving the deletion confirmation message sent by the peer firewall, forwarding policy matching is performed on the other non-first fragment packets based on the target entry.

[0015] When the firewall forwarding mode is fast forwarding mode, the forwarding policy is matched for other subsequent fragmented packets cached by the local firewall based on the target entry, and the target entry is also used to instruct the peer firewall to match the forwarding policy for other non-first fragmented packets based on the target entry; the other non-first fragmented packets are cached by the peer firewall based on the target entry.

[0016] In one embodiment, when the type of the first fragmented packet is a non-first fragmented packet, the method further includes:

[0017] Upon receiving the first fragment packet, determine the session entry corresponding to the first fragment packet, and determine the association between the session entry and the packet identifier entry; synchronize the association to the peer firewall;

[0018] When the firewall forwarding mode is synchronous forwarding mode, other non-first fragment packets sent by the peer firewall are received, and a second confirmation message is sent to the peer firewall; upon receiving the deletion confirmation message sent by the peer firewall, forwarding policy matching is performed on the other non-first fragment packets; the second confirmation message is used to instruct the peer firewall to delete the other non-first fragment packets.

[0019] When the firewall forwarding mode is fast forwarding mode, the forwarding policy is matched for other subsequent fragmented packets cached by the local firewall based on the association relationship; the association relationship is also used to instruct the peer firewall to match the forwarding policy for other non-first fragmented packets based on the association relationship; the other non-first fragmented packets are cached by the peer firewall based on the target entry or the association relationship.

[0020] In one embodiment, when the type of the first fragmented packet is a non-first fragmented packet, the method further includes:

[0021] If the first fragment packet is not received, receive the association relationship corresponding to the first fragment packet synchronized by the peer firewall;

[0022] Cache other non-first fragment packets based on the target entry or the association relationship;

[0023] When the firewall forwarding mode is synchronous forwarding mode, synchronize the other non-first fragment packets to the peer firewall; upon receiving the third confirmation information, delete the other non-first fragment packets in the cache space and send deletion confirmation information to the peer firewall;

[0024] When the firewall forwarding mode is fast forwarding mode, the forwarding policy is matched for the other non-first fragment packets based on the association relationship.

[0025] In one embodiment, according to the fragmented packet processing method provided in this application, the step of determining the session entry and packet identifier entry corresponding to the first fragmented packet, and determining the association relationship between the session entry and the packet identifier entry, includes:

[0026] The first field information in the IP header of the first fragmented packet is hashed to determine the hash value of the packet identifier entry corresponding to the first fragmented packet; the first field information includes an identifier, a source IP address, and a destination IP address.

[0027] Based on the hash value of the message identifier entry and the type of the first fragment message, the message identifier entry corresponding to the first fragment message is determined;

[0028] The second field information of the protocol header in the first fragmented packet, as well as the source IP address, destination IP address, and protocol number in the IP header, are hashed to determine the session table entry hash value; based on the session table entry hash value, the session table entry of the first fragmented packet is determined; the second field information includes the source port number and the destination port number;

[0029] Based on the hash value of the message identifier entry and the hash value of the session entry in the session entry, the association relationship between the session entry and the message identifier entry is determined.

[0030] In one embodiment, according to the fragmented packet processing method provided in this application, synchronizing the target entry to the peer firewall includes:

[0031] The target entry is synchronized to the peer firewall via a heartbeat cable or a synchronization cable.

[0032] Secondly, embodiments of this application provide a fragmented packet processing device applied to a local firewall, wherein the local firewall is any firewall in a dual-active firewall cluster, and the device includes:

[0033] The first determining module is used to determine the type of the first fragmented packet upon receiving the first fragmented packet; the type of the first fragmented packet is used to characterize the position of the first fragmented packet in the Internet Protocol (IP) packet of its parent organization;

[0034] The second determining module is used to determine the target entry corresponding to the first fragmented packet based on the type of the first fragmented packet; the target entry is used to identify the first fragmented packet.

[0035] The synchronization module is used to synchronize the target entry to the peer firewall, so as to instruct the peer firewall and the local firewall to identify other fragmented packets that are the same as the IP packet to which the first fragmented packet belongs.

[0036] Thirdly, embodiments of this application provide a firewall, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the fragmented packet processing method as described in any of the preceding claims.

[0037] Fourthly, embodiments of this application provide a dual-active firewall cluster, including two firewalls configured in a dual-active deployment mode, the two firewalls being connected via a heartbeat cable or a synchronization cable, and either of the two firewalls being used to execute the fragmented packet processing method described in any of the above claims.

[0038] Fifthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the fragmented message processing method as described above.

[0039] Sixthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements any of the fragmented message processing methods described above.

[0040] The fragmented packet processing method, apparatus, firewall, and active-active firewall cluster provided in this application, for any firewall in the active-active firewall cluster, upon receiving the first fragmented packet, determines the type of the first fragmented packet based on its position within its corresponding IP packet, and determines the target entry corresponding to the first fragmented packet based on its type. This target entry is then synchronized to the peer firewall. In the active-active firewall cluster, both the peer firewall and the local firewall can identify other fragmented packets with the same IP packet as the first fragmented packet based on the target entry, achieving effective processing of fragmented packets and ensuring IP packet integrity. Simultaneously, it avoids the waste of hardware and system resources by the backup firewall in primary / backup mode, improving the resource utilization efficiency and reliability of the active-active firewall cluster. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1This is a schematic diagram of a firewall deployment model provided by existing technology.

[0043] Figure 2 This is a flowchart illustrating the fragmented message processing method provided in the embodiments of this application.

[0044] Figure 3 This is a schematic diagram of IP packet fragmentation provided in the embodiments of this application.

[0045] Figure 4 This is one of the schematic diagrams of the processing flow for the sequential arrival of fragmented packets provided in the embodiments of this application.

[0046] Figure 5 This is the second schematic diagram of the processing flow for the sequential arrival of fragmented packets provided in the embodiments of this application.

[0047] Figure 6 This is one of the schematic diagrams of the processing flow for out-of-order arrival of fragmented packets provided in the embodiments of this application.

[0048] Figure 7 This is the second schematic diagram of the processing flow for out-of-order arrival of fragmented packets provided in the embodiments of this application.

[0049] Figure 8 This is a schematic diagram of the structure of the fragmented message processing device provided in the embodiments of this application.

[0050] Figure 9 This is a schematic diagram of the firewall structure provided in the embodiments of this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the embodiments of this application.

[0052] To address the problem of effectively handling fragmented packets in existing technologies, this application provides a fragmented packet processing method applied to a local firewall, where the local firewall is any firewall in a dual-active firewall cluster. Figure 2 This is a flowchart illustrating the fragmented message processing method provided in the embodiments of this application, as shown below. Figure 2 As shown, the method includes steps 110 to 130.

[0053] Step 110: Upon receiving the first fragmented packet, determine the type of the first fragmented packet; the type of the first fragmented packet is used to characterize the position of the first fragmented packet in its corresponding Internet Protocol (IP) packet.

[0054] Specifically, after the local firewall receives a packet, the packet may be a fragmented packet or an unfragmented IP packet. If the packet is fragmented, it may be the first fragment or a non-first fragment. Therefore, upon receiving the first fragmented packet, the local firewall first determines the type of the first fragmented packet through the fragmentation flag and fragment offset in the IP (Internet Protocol) header, that is, it determines the position of the first fragmented packet within its parent IP packet. It should be noted that if the MF (More Fragment) flag in the fragmentation flag is 1, it indicates that the IP packet to which the first fragmented packet belongs has been fragmented, and there are other fragmented packets following the first fragmented packet. If the MF flag in the fragmentation flag is 0, it indicates that the IP packet to which the first fragmented packet belongs has been fragmented, and the first fragmented packet is the last fragmented packet in its parent IP packet. The fragment offset represents the offset of the first fragmented packet from the header within its parent IP packet. After determining the fragmentation flag and fragment offset, if the MF in the fragmentation flag is 0 and the fragment offset is 0, it indicates that the packet received by the local firewall is an unfragmented packet. The local firewall can then create a complete session entry based on the protocol header and perform forwarding policy matching on the unfragmented packet. If the MF in the fragmentation flag is 1 and the fragment offset is 0, it indicates that the packet received by the local firewall is a fragmented packet, and the first fragmented packet is the first fragmented packet in its IP packet, meaning it is at the beginning of the IP packet. If the MF in the fragmentation flag is 0 or 1, and the fragment offset is greater than 0, it indicates that the packet received by the local firewall is a fragmented packet, and the first fragmented packet is not the first fragmented packet in its IP packet, meaning it is located after the first fragmented packet in the IP packet. Where: if the MF in the fragmentation flag is 0 and the fragment offset is greater than 0, it indicates that the fragmented packet is the last fragmented packet in the IP packet of its kind; if the MF in the fragmentation flag is 1 and the fragment offset is greater than 0, it indicates that the fragmented packet is a non-first fragmented packet between the first and last fragmented packets in the IP packet of its kind.

[0055] It should be noted that, Figure 3 This is a schematic diagram of IP packet fragmentation provided in the embodiments of this application, such as... Figure 3 As shown, an unfragmented IP packet includes an IP header, a protocol header, and a data portion. After the IP packet is divided into three fragmented packets, each fragmented packet includes an IP header and a data portion, and the data portion of each fragmented packet is different, but only the first fragmented packet contains a protocol header.

[0056] Step 120: Based on the type of the first fragmented packet, determine the target entry corresponding to the first fragmented packet; the target entry is used to identify the first fragmented packet.

[0057] Specifically, after determining the type of the first fragmented packet, and before processing the first fragmented packet, it is necessary to determine the target entry of the first fragmented packet based on whether it is the first fragmented packet or not. This target entry is used to identify the first fragmented packet, so as to facilitate the subsequent identification of other fragmented packets in the IP packet based on the target entry, and avoid abnormal operations on other fragmented packets.

[0058] It should be noted that the target entry includes a message identification entry, or the association between a message identification entry and a session entry. The message identification entry is constructed based on the IP header, while the session entry is constructed based on both the protocol header and the IP header.

[0059] Further, determining the target entry corresponding to the first fragmented packet based on its type includes:

[0060] When the type of the first fragmented packet is a first fragmented packet, the session entry and the packet identifier entry corresponding to the first fragmented packet are determined respectively, and the association relationship between the session entry and the packet identifier entry is determined; the packet identifier entry is used to identify the IP packet to which the first fragmented packet belongs; the session entry is used to identify the session to which the IP packet belongs;

[0061] If the type of the first fragment message is not the first fragment message, determine the message identifier entry corresponding to the first fragment message.

[0062] Specifically, after determining the type of the first fragmented packet, if it is the first fragmented packet, then based on the protocol header and IP header in the first fragmented packet, the corresponding session entry and packet identification entry are determined. The packet identification entry is used to identify the IP packet to which the first fragmented packet belongs; that is, other fragmented packets in this IP packet can be identified based on the packet identification entry. The session entry is used to identify the session to which the IP packet belongs, and this session includes at least one IP packet. Then, the session entry and the packet identification entry are associated to determine their relationship, achieving dual protection for the identification of other fragmented packets and ensuring the accuracy of subsequent identification and processing of other packet fragments.

[0063] Further, determining the session entry and message identifier entry corresponding to the first fragmented message, and determining the association between the session entry and the message identifier entry, includes:

[0064] The first field information in the IP header of the first fragmented packet is hashed to determine the hash value of the packet identifier entry corresponding to the first fragmented packet; the first field information includes an identifier, a source IP address, and a destination IP address.

[0065] Based on the hash value of the message identifier entry and the type of the first fragment message, the message identifier entry corresponding to the first fragment message is determined;

[0066] The second field information of the protocol header in the first fragmented packet, as well as the source IP address, destination IP address, and protocol number in the IP header, are hashed to determine the session table entry hash value; based on the session table entry hash value, the session table entry of the first fragmented packet is determined; the second field information includes the source port number and the destination port number;

[0067] Based on the hash value of the message identifier entry and the hash value of the session entry in the session entry, the association relationship between the session entry and the message identifier entry is determined.

[0068] Specifically, after determining that the first fragmented packet is the first fragmented packet, the fields shown in Table 1 are extracted from the IP header of the first fragmented packet. The first field in Table 1 is then hashed, specifically the identifier, source IP address, and destination IP address, to determine the hash value of the packet identifier entry corresponding to the first fragmented packet. This hash value is then queried in the local firewall's cache. This hash value serves as the unique identifier of the IP packet to which the first fragmented packet belongs; therefore, different IP packets will result in different hash values ​​for the corresponding fragmented packets. Since this first fragmented packet is the first fragmented packet received by the local firewall, the query for its hash value returns an empty value, meaning that no other fragmented packets to which the first fragmented packet belongs are found in the local firewall. At this point, the message identifier entry for the first fragment message can be constructed based on the hash value of the message identifier entry, the type of the first fragment message, and the message ID (IdentityDocument).

[0069] Table 1 IP Header Field Information

[0070]

[0071] Furthermore, since this first fragmented packet is the first fragmented packet, it includes a protocol header. At this point, a hash operation can be performed based on the source and destination port numbers in the second field of the protocol header, and the source IP address, destination IP address, and protocol number in the IP header, to calculate the session entry hash value. Then, the session entry hash value is queried in the local firewall's cache area. Since this first fragmented packet is the first fragmented packet received by the local firewall, the query return value is empty. At this point, a session entry can be constructed based on the session entry hash value and the session ID. Then, based on the packet identifier entry hash value and the session entry hash value, the packet identifier entry and the session entry are associated to obtain the association relationship between them. For example, the association relationship between the packet identifier entry and the session entry is shown in Table 2. As shown in Table 2, the hash values ​​of session entries are different for different sessions, the hash values ​​of packet identifier entries are different for different IP packets in the same session, and the hash values ​​of packet identifier entries are the same for different fragments of the same IP packet.

[0072] Table 2. Relationship between message identifier entries and session entries

[0073]

[0074] If the first fragment is not the first fragment, since it only contains an IP header, a hash operation can be performed on the identifier, source IP address, and destination IP address in the IP header to determine the packet identification entry for the non-first fragment. The steps for determining the packet identification entry for a non-first fragment are the same as those for determining the packet identification entry for a first fragment, and will not be repeated here in this embodiment.

[0075] It should be noted that the message ID is automatically determined based on the received order of the IP packets to which the first fragmented message belongs. The maximum value of the message ID is the total number of IP packets included in the session to which the IP packet belongs. The session ID is automatically determined based on the order of the sessions to which the IP packet belongs.

[0076] It should be noted that this cache area is an independent area allocated within the local firewall. After receiving fragmented packets, the local firewall can store them in this cache area. This cache area can also store packet identification entries created by the local firewall or synchronized with the peer firewall, or the association between packet identification entries and session entries. Furthermore, this cache area also exists in the peer firewall.

[0077] Step 130: Synchronize the target entry to the peer firewall to instruct the peer firewall and the local firewall to identify other fragmented packets that have the same IP address as the first fragmented packet.

[0078] Specifically, after determining the target entry for the first fragmented packet, the target entry can be synchronized to the peer firewall. After receiving the target entry, if the peer firewall receives other fragmented packets, it can identify the other fragmented packets based on the target entry and determine whether the other fragmented packets belong to the same IP packet as the first fragmented packet received by the local firewall, thus avoiding abnormal processing of the other fragmented packets.

[0079] Furthermore, synchronizing the target entry to the peer firewall includes:

[0080] The target entry is synchronized to the peer firewall via a heartbeat cable or a synchronization cable.

[0081] Specifically, in existing technologies, paired firewalls are interconnected via heartbeat cables. These paired firewalls send heartbeat messages to each other to determine the status of the peer firewall and whether a failover is necessary. The heartbeat cable can also be used to synchronize configuration commands and status information between the two firewalls, as well as verify the consistency of critical configuration information such as security policies and NAT (Network Address Translation). In this embodiment, the functionality of the heartbeat cable is extended. After the local firewall determines the target entry, it sends the target entry to the peer firewall via the heartbeat cable, achieving synchronization of the target entry between the two firewalls. Furthermore, a synchronization cable can be added between the local and peer firewalls. This synchronization cable can be a dedicated data synchronization cable, configured in this embodiment to transmit target entries between the two firewalls.

[0082] Furthermore, if the type of the first fragmented message is a first fragmented message, the method further includes:

[0083] When the firewall forwarding mode is synchronous forwarding mode, other non-first fragment packets sent by the peer firewall are received, and a first confirmation message is sent to the peer firewall; the first confirmation message is used to instruct the peer firewall to delete the other non-first fragment packets; upon receiving the deletion confirmation message sent by the peer firewall, forwarding policy matching is performed on the other non-first fragment packets based on the target entry.

[0084] When the firewall forwarding mode is fast forwarding mode, the forwarding policy is matched for other subsequent fragmented packets cached by the local firewall based on the target entry, and the target entry is also used to instruct the peer firewall to match the forwarding policy for other non-first fragmented packets based on the target entry; the other non-first fragmented packets are cached by the peer firewall based on the target entry.

[0085] For example, Figure 4 This is one of the schematic diagrams of the processing flow for the sequential arrival of fragmented packets provided in the embodiments of this application, such as... Figure 4 As shown, taking the local firewall as an example... Figure 4 The firewall shown is 1, and the peer firewall is... Figure 4 Taking firewall 2 as an example, when the forwarding modes of firewalls 1 and 2 are both configured as synchronous forwarding modes, the processing of fragmented packets by firewalls 1 and 2 includes the following steps.

[0086] (1) When firewall 1 receives the first fragment of the IP packet corresponding to the IP packet in the session, it calculates the hash value of the packet identification table entry based on the IP header of the first fragment of the packet, and calculates the hash value of the session entry based on the IP header and the protocol header. It then queries the hash value of the packet identification table entry and the hash value of the session entry in the cache area of ​​firewall 1. If the returned value is empty, it creates the packet identification table entry and the session entry, associates the packet identification table entry and the session entry, determines the association relationship between the packet identification table entry and the session entry, synchronizes the association relationship to firewall 2, and caches the first fragment of the packet.

[0087] (2) After receiving the association relationship, Firewall 2 identifies and caches other non-first fragment packets belonging to the same session and the same IP packet according to the association relationship, and synchronizes other non-first fragment packets to Firewall 1.

[0088] (3) After receiving other non-first fragment packets synchronized by firewall 2, firewall 1 sends a first confirmation message to firewall 2 to indicate that the other non-first fragment packets synchronized have been received.

[0089] (4) After receiving the first confirmation message sent by Firewall 1, Firewall 2 deletes other non-first fragment packets in the cache area to release cache space and avoid duplicate non-first fragment packets occupying unnecessary storage resources. After deleting other non-first fragment packets, Firewall 2 sends a deletion confirmation message to Firewall 1 to inform Firewall 1 that other non-first fragment packets have been deleted.

[0090] (5) After receiving the deletion confirmation information, Firewall 1 can perform forwarding policy matching on other non-first fragment packets synchronized by Firewall 2 according to the association relationship. In addition, it can also perform forwarding policy matching on the first fragment packets and other fragment packets cached by Firewall 1 according to the association relationship.

[0091] For example, Figure 5 This is the second schematic diagram of the processing flow for the sequential arrival of fragmented packets provided in the embodiments of this application, as follows: Figure 5 As shown, taking the local firewall as an example... Figure 5 The firewall shown is 1, and the peer firewall is... Figure 5 Taking firewall 2 as an example, when both firewalls 1 and 2 are configured with fast forwarding mode, the difference between the processing steps of firewalls 1 and 2 for fragmented packets and those in synchronous forwarding mode is that after firewall 1 determines the association relationship, it performs forwarding policy matching on the first fragmented packet. Firewalls 1 and 2 can independently perform forwarding policy matching on other fragmented packets. That is, after firewall 1 synchronizes the association relationship with firewall 2, firewall 1 can perform forwarding policy matching on other subsequent fragmented packets belonging to the same IP address that it has identified and cached, based on the association relationship. Simultaneously, firewall 2 can also perform forwarding policy matching on other non-first fragmented packets belonging to the same IP address that it has identified and cached, based on the association relationship, without needing to synchronize other non-first fragmented packets with firewall 1, thus improving the processing efficiency of fragmented packets.

[0092] Furthermore, if the type of the first fragmented message is a non-first fragmented message, the method further includes:

[0093] Upon receiving the first fragment packet, determine the session entry corresponding to the first fragment packet, and determine the association between the session entry and the packet identifier entry; synchronize the association to the peer firewall;

[0094] When the firewall forwarding mode is synchronous forwarding mode, other non-first fragment packets sent by the peer firewall are received, and a second confirmation message is sent to the peer firewall; upon receiving the deletion confirmation message sent by the peer firewall, forwarding policy matching is performed on the other non-first fragment packets; the second confirmation message is used to instruct the peer firewall to delete the other non-first fragment packets.

[0095] When the firewall forwarding mode is fast forwarding mode, the forwarding policy is matched for other subsequent fragmented packets cached by the local firewall based on the association relationship; the association relationship is also used to instruct the peer firewall to match the forwarding policy for other non-first fragmented packets based on the association relationship; the other non-first fragmented packets are cached by the peer firewall based on the target entry or the association relationship.

[0096] For example, Figure 6 This is one of the schematic diagrams of the processing flow for out-of-order arrival of fragmented packets provided in the embodiments of this application, such as... Figure 6 As shown, taking the local firewall as an example... Figure 6 The firewall shown is 1, and the peer firewall is... Figure 6 Taking firewall 2 as an example, after firewall 1 receives the first fragmented packet, it receives the first fragmented packet of the corresponding IP packet again. If the forwarding mode of firewall 1 and firewall 2 is configured as synchronous forwarding mode, the processing of fragmented packets by firewall 1 and firewall 2 includes the following steps.

[0097] (1) When the firewall 1 receives the first fragment of the IP packet, it calculates the session entry hash value based on the IP header and protocol header of the first fragment of the packet, and determines the association between the session entry and the packet identification entry based on the session entry hash value and the packet identification entry hash value in the packet identification entry, and caches the first fragment of the packet in the cache area of ​​the firewall 1.

[0098] (2) Firewall 1 synchronizes the association to firewall 2.

[0099] (3) After receiving the association relationship, Firewall 2 identifies and caches other non-first fragment packets belonging to the same session and the same IP packet according to the association relationship, and synchronizes other non-first fragment packets to Firewall 1.

[0100] (4) After receiving other non-first fragment packets synchronized by firewall 2, firewall 1 sends a second confirmation message to firewall 2 to indicate that the other non-first fragment packets synchronized have been received.

[0101] (5) After receiving the second confirmation message sent by Firewall 1, Firewall 2 deletes other non-first fragment packets in the cache area to release cache space and avoid duplicate non-first fragment packets occupying unnecessary storage resources. After deleting other non-first fragment packets, Firewall 2 sends a deletion confirmation message to Firewall 1 to inform Firewall 1 that other non-first fragment packets have been deleted.

[0102] (6) After receiving the deletion confirmation information, Firewall 1 can perform forwarding policy matching on other non-first fragment packets synchronized by Firewall 2 according to the association relationship. In addition, it can also perform forwarding policy matching on the first fragment packets and other fragment packets cached by Firewall 1 according to the association relationship.

[0103] For example, Figure 7 This is the second schematic diagram of the processing flow for out-of-order arrival of fragmented packets provided in the embodiments of this application, such as... Figure 7 As shown, taking the local firewall as an example... Figure 7 The firewall shown is 1, and the peer firewall is... Figure 7 Taking firewall 2 as an example, after firewall 1 receives the first fragmented packet, it receives the first fragmented packet of the corresponding IP packet again. Both firewalls 1 and 2 are configured with fast forwarding mode. The difference between firewall 1 and firewall 2's handling of fragmented packets and the synchronous forwarding mode is that after firewall 1 synchronizes the association relationship with firewall 2, firewall 1 and firewall 2 can independently perform forwarding policy matching for other fragmented packets. That is, firewall 1 can perform forwarding policy matching for other subsequent fragmented packets belonging to the same IP packet cached by firewall 1 based on the association relationship. Simultaneously, firewall 2 can also perform forwarding policy matching for other non-first fragmented packets belonging to the same IP packet cached by firewall 2 based on the association relationship. There is no need to synchronize other non-first fragmented packets with firewall 1, thus improving the processing efficiency of fragmented packets.

[0104] Furthermore, if the type of the first fragmented message is a non-first fragmented message, the method further includes:

[0105] If the first fragment packet is not received, receive the association relationship corresponding to the first fragment packet synchronized by the peer firewall;

[0106] Cache other non-first fragment packets based on the target entry or the association relationship;

[0107] When the firewall forwarding mode is synchronous forwarding mode, synchronize the other non-first fragment packets to the peer firewall; upon receiving the third confirmation information, delete the other non-first fragment packets in the cache space and send deletion confirmation information to the peer firewall;

[0108] When the firewall forwarding mode is fast forwarding mode, the forwarding policy is matched for the other non-first fragment packets based on the association relationship.

[0109] It should be noted that after the local firewall receives the first fragmented packet, the remote firewall receives the first fragmented packet of its corresponding IP packet, and both the local and remote firewalls are configured in synchronous forwarding mode. The processing steps for the fragmented packets by the local firewall are the same as those for the remote firewall. Figure 6 The processing steps of firewall 2 shown are the same, and the processing steps of the peer firewall for fragmented packets are also the same. Figure 6 The processing steps for the protective wall 1 shown are the same, and will not be repeated here in the embodiments of this application.

[0110] Furthermore, if both the local firewall and the peer firewall are configured with fast forwarding mode, the local firewall's processing steps for fragmented packets are the same as... Figure 7 The processing steps of firewall 2 shown are the same, and the processing steps of the peer firewall for fragmented packets are also the same. Figure 7 The processing steps for the protective wall 1 shown are the same, and will not be repeated here in the embodiments of this application.

[0111] The fragmented packet processing method provided in this application, for any firewall in a dual-active firewall cluster, upon receiving the first fragmented packet, determines the type of the first fragmented packet based on its position within its corresponding IP packet. Based on the type of the first fragmented packet, it determines the corresponding target entry and synchronizes this target entry to the peer firewall. In the dual-active firewall cluster, both the peer firewall and the local firewall can identify other fragmented packets with the same IP packet as the first fragmented packet based on the target entry, thus achieving effective processing of fragmented packets and ensuring IP packet integrity and processing efficiency. Simultaneously, it avoids wasting hardware and system resources on the backup firewall in primary / backup mode, improving the resource utilization efficiency of the dual-active firewall cluster.

[0112] Furthermore, in existing technologies, fragmented pass-through functionality can be enabled on two paired firewalls, with no restrictions on deployment mode. In this approach, only the first fragment of an IP packet is subject to policy matching; subsequent fragments are forwarded directly based on routing table lookups. This means the two firewalls do not perform in-depth detection and analysis of IP packet fragmentation, but instead directly forward subsequent fragments to the next network node. Traffic blocked by policies will also be allowed to pass subsequent fragments, significantly increasing network security risks. Simultaneously, fragmented pass-through functionality also impacts advanced features beyond firewall security policies; for example, firewalls with fragmented pass-through enabled cannot use NAT and content security features. Compared to existing fragmented pass-through schemes, this application's embodiment abandons fragmented packet pass-through processing, prioritizing network security for fragmented packet processing. Even if different fragments of the same IP packet are forwarded to the two firewalls, the fragments can still undergo forwarding policy matching and normal forwarding, reducing network security risks and improving the reliability and security of the dual-active firewall cluster.

[0113] The fragmented message processing apparatus provided in the embodiments of this application is described below. The fragmented message processing apparatus described below and the fragmented message processing method described above can be referred to in correspondence.

[0114] This application also provides a fragmented packet processing device applied to a local firewall, wherein the local firewall is any firewall in a dual-active firewall cluster. Figure 8 This is a schematic diagram of the structure of the fragmented message processing device provided in the embodiments of this application, as shown below. Figure 8As shown, the fragmented message processing device 800 includes: a first determination module 810, a second determination module 820, and a synchronization module 830.

[0115] The first determining module 810 is used to determine the type of the first fragmented message upon receiving the first fragmented message; the type of the first fragmented message is used to characterize the position of the first fragmented message in the Internet Protocol (IP) message to which it belongs.

[0116] The second determining module 820 is used to determine the target entry corresponding to the first fragmented packet based on the type of the first fragmented packet; the target entry is used to identify the first fragmented packet.

[0117] The synchronization module 830 is used to synchronize the target entry to the peer firewall, so as to instruct the peer firewall and the local firewall to identify other fragmented packets that are the same as the IP packet to which the first fragmented packet belongs.

[0118] The fragmented packet processing apparatus provided in this application, for any firewall in a dual-active firewall cluster, upon receiving the first fragmented packet, determines the type of the first fragmented packet based on its position within its corresponding IP packet, and determines the target entry corresponding to the first fragmented packet based on its type. This target entry is then synchronized to the peer firewall. In the dual-active firewall cluster, both the peer firewall and the local firewall can identify other fragmented packets with the same IP packet as the first fragmented packet based on the target entry, thus achieving effective processing of fragmented packets and ensuring the integrity of IP packets. Simultaneously, it avoids the waste of hardware and system resources by the backup firewall in primary / backup mode, improving the resource utilization efficiency and reliability of the dual-active firewall cluster.

[0119] Optionally, the target entry includes a message identifier entry, or an association between a message identifier entry and a session entry.

[0120] Optionally, the second determining module 820 is specifically configured to: when the type of the first fragmented packet is a first fragmented packet, determine the session entry and the packet identifier entry corresponding to the first fragmented packet, and determine the association relationship between the session entry and the packet identifier entry; the packet identifier entry is used to identify the IP packet to which the first fragmented packet belongs; the session entry is used to identify the session to which the IP packet belongs; when the type of the first fragmented packet is a non-first fragmented packet, determine the packet identifier entry corresponding to the first fragmented packet.

[0121] Optionally, the second determining module 820 is specifically configured to: perform a hash operation on the first field information of the IP header in the first fragmented packet to determine the hash value of the packet identifier entry corresponding to the first fragmented packet; the first field information includes an identifier, a source IP address, and a destination IP address; determine the packet identifier entry corresponding to the first fragmented packet based on the packet identifier entry hash value and the type of the first fragmented packet; perform a hash operation on the second field information of the protocol header in the first fragmented packet, as well as the source IP address, destination IP address, and protocol number in the IP header to determine the session entry hash value; determine the session entry of the first fragmented packet based on the session entry hash value; the second field information includes a source port number and a destination port number; and determine the association relationship between the session entry and the packet identifier entry based on the packet identifier entry hash value and the session entry hash value in the session entry.

[0122] Optionally, the synchronization module 830 is specifically used to synchronize the target entry to the peer firewall based on a heartbeat cable or a synchronization cable.

[0123] Optionally, the fragmented packet processing device 800 further includes: a first forwarding module, wherein when the type of the first fragmented packet is a first fragmented packet, the first forwarding module is specifically configured to: when the firewall forwarding mode is synchronous forwarding mode, receive other non-first fragmented packets sent by the peer firewall, and send first confirmation information to the peer firewall; the first confirmation information is used to instruct the peer firewall to delete the other non-first fragmented packets; upon receiving the deletion confirmation information sent by the peer firewall, perform forwarding policy matching on the other non-first fragmented packets based on the target entry; when the firewall forwarding mode is fast forwarding mode, perform forwarding policy matching on other subsequent fragmented packets cached by the local firewall based on the target entry, and the target entry is also used to instruct the peer firewall to perform forwarding policy matching on other non-first fragmented packets based on the target entry; the other non-first fragmented packets are cached by the peer firewall based on the target entry.

[0124] Optionally, the fragmented packet processing device 800 further includes: a third determining module, wherein, when the type of the first fragmented packet is a non-first fragmented packet, the third determining module is specifically configured to: upon receiving the first fragmented packet, determine the session entry corresponding to the first fragmented packet, and determine the association relationship between the session entry and the packet identifier entry; synchronize the association relationship to the peer firewall; when the firewall forwarding mode is synchronous forwarding mode, receive other non-first fragmented packets sent by the peer firewall, and send a second acknowledgment information to the peer firewall; upon receiving the peer firewall's... In the event of a deletion confirmation message sent by the firewall, forwarding policy matching is performed on the other non-first fragment packets; the second confirmation message is used to instruct the peer firewall to delete the other non-first fragment packets; when the firewall forwarding mode is fast forwarding mode, forwarding policy matching is performed on the other subsequent fragment packets cached by the local firewall based on the association relationship; the association relationship is also used to instruct the peer firewall to match forwarding policy on the other non-first fragment packets based on the association relationship; the other non-first fragment packets are cached by the peer firewall based on the target entry or the association relationship.

[0125] Optionally, the fragmented packet processing device 800 further includes: a second forwarding module, wherein, when the type of the first fragmented packet is a non-first fragmented packet, the second forwarding module is specifically configured to: receive the association relationship corresponding to the first fragmented packet synchronized by the peer firewall when the first fragmented packet has not been received; cache other non-first fragmented packets based on the target entry or the association relationship; synchronize the other non-first fragmented packets to the peer firewall when the firewall forwarding mode is synchronous forwarding mode; delete the other non-first fragmented packets in the cache space when a third confirmation message is received, and send deletion confirmation message to the peer firewall; and perform forwarding policy matching on the other non-first fragmented packets based on the association relationship when the firewall forwarding mode is fast forwarding mode.

[0126] Figure 9 This is a schematic diagram of the firewall structure provided in the embodiments of this application, as shown below. Figure 9 As shown, the electronic device may include: a processor 910, a communications interface 920, a memory 930, and a communication bus 940, wherein the processor 910, the communications interface 920, and the memory 930 communicate with each other via the communication bus 940. The processor 910 can call logical instructions in the memory 930 to execute a fragmented message processing method, which includes:

[0127] Upon receiving the first fragmented packet, the type of the first fragmented packet is determined; the type of the first fragmented packet is used to characterize the position of the first fragmented packet within its corresponding Internet Protocol (IP) packet.

[0128] Based on the type of the first fragmented packet, a target entry corresponding to the first fragmented packet is determined; the target entry is used to identify the first fragmented packet.

[0129] The target entry is synchronized to the peer firewall to instruct the peer firewall and the local firewall to identify other fragmented packets that have the same IP address as the first fragmented packet.

[0130] Furthermore, the logical instructions in the aforementioned memory 930 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this application embodiment, essentially, or the parts that contribute to the prior art, or parts of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0131] On the other hand, embodiments of this application also provide a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the fragmented message processing method provided by the above methods, the method including:

[0132] Upon receiving the first fragmented packet, the type of the first fragmented packet is determined; the type of the first fragmented packet is used to characterize the position of the first fragmented packet within its corresponding Internet Protocol (IP) packet.

[0133] Based on the type of the first fragmented packet, a target entry corresponding to the first fragmented packet is determined; the target entry is used to identify the first fragmented packet.

[0134] The target entry is synchronized to the peer firewall to instruct the peer firewall and the local firewall to identify other fragmented packets that have the same IP address as the first fragmented packet.

[0135] In another aspect, embodiments of this application also provide a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program is implemented to perform the fragmented packet processing methods provided by the methods described above. The method includes:

[0136] Upon receiving the first fragmented packet, the type of the first fragmented packet is determined; the type of the first fragmented packet is used to characterize the position of the first fragmented packet within its corresponding Internet Protocol (IP) packet.

[0137] Based on the type of the first fragmented packet, a target entry corresponding to the first fragmented packet is determined; the target entry is used to identify the first fragmented packet.

[0138] The target entry is synchronized to the peer firewall to instruct the peer firewall and the local firewall to identify other fragmented packets that have the same IP address as the first fragmented packet.

[0139] This application embodiment also provides a dual-active firewall cluster, including two firewalls configured in dual-active deployment mode, the two firewalls being connected via a heartbeat cable or a synchronization cable, and either of the two firewalls being used to execute the fragmented packet processing method described in any of the above claims.

[0140] In this embodiment, by changing the two firewalls from primary / backup mode to dual-active deployment mode, the reliability of services can be guaranteed, the service processing capacity of the dual-active firewall cluster can be improved, and the load balancing of services can be fully utilized.

[0141] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0142] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0143] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of this application, and are not intended to limit them; although the embodiments of this application have been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for processing fragmented messages, characterized in that, Applied to the local firewall, where the local firewall is any firewall in a dual-active firewall cluster, the method includes: Upon receiving the first fragmented packet, the type of the first fragmented packet is determined; the type of the first fragmented packet is used to characterize the position of the first fragmented packet within its corresponding Internet Protocol (IP) packet. Based on the type of the first fragmented packet, a target entry corresponding to the first fragmented packet is determined; the target entry is used to identify the first fragmented packet. The target entry is synchronized to the peer firewall to instruct the peer firewall and the local firewall to identify other fragmented packets that have the same IP address as the first fragmented packet. The target entry includes a message identifier entry, or an association between a message identifier entry and a session entry; The step of determining the target entry corresponding to the first fragment packet based on the type of the first fragment packet includes: When the type of the first fragmented packet is a first fragmented packet, the session entry and the packet identifier entry corresponding to the first fragmented packet are determined respectively, and the association relationship between the session entry and the packet identifier entry is determined; the packet identifier entry is used to identify the IP packet to which the first fragmented packet belongs; the session entry is used to identify the session to which the IP packet belongs; If the type of the first fragmented message is not the first fragmented message, determine the message identifier entry corresponding to the first fragmented message; When the type of the first fragmented message is a first fragmented message, the method further includes: When the firewall forwarding mode is synchronous forwarding mode, other non-first fragment packets sent by the peer firewall are received, and a first confirmation message is sent to the peer firewall; the first confirmation message is used to instruct the peer firewall to delete the other non-first fragment packets; upon receiving the deletion confirmation message sent by the peer firewall, forwarding policy matching is performed on the other non-first fragment packets based on the target entry. When the firewall forwarding mode is fast forwarding mode, the forwarding policy is matched for other subsequent fragmented packets cached by the local firewall based on the target entry, and the target entry is also used to instruct the peer firewall to match the forwarding policy for other non-first fragmented packets based on the target entry; the other non-first fragmented packets are cached by the peer firewall based on the target entry.

2. The fragmented message processing method according to claim 1, characterized in that, If the type of the first fragmented message is not the first fragmented message, the method further includes: Upon receiving the first fragment packet, determine the session entry corresponding to the first fragment packet, and determine the association between the session entry and the packet identifier entry; synchronize the association to the peer firewall; When the firewall forwarding mode is synchronous forwarding mode, other non-first fragment packets sent by the peer firewall are received, and a second confirmation message is sent to the peer firewall; upon receiving the deletion confirmation message sent by the peer firewall, forwarding policy matching is performed on the other non-first fragment packets; the second confirmation message is used to instruct the peer firewall to delete the other non-first fragment packets. When the firewall forwarding mode is fast forwarding mode, the forwarding policy is matched for other subsequent fragmented packets cached by the local firewall based on the association relationship; the association relationship is also used to instruct the peer firewall to match the forwarding policy for other non-first fragmented packets based on the association relationship; the other non-first fragmented packets are cached by the peer firewall based on the target entry or the association relationship.

3. The fragmented message processing method according to claim 1, characterized in that, If the type of the first fragmented message is not the first fragmented message, the method further includes: If the first fragment packet is not received, receive the association relationship corresponding to the first fragment packet synchronized by the peer firewall; Cache other non-first fragment packets based on the target entry or the association relationship; When the firewall forwarding mode is synchronous forwarding mode, synchronize the other non-first fragment packets to the peer firewall; upon receiving the third confirmation information, delete the other non-first fragment packets in the cache space and send deletion confirmation information to the peer firewall; When the firewall forwarding mode is fast forwarding mode, the forwarding policy is matched for the other non-first fragment packets based on the association relationship.

4. The fragmented message processing method according to any one of claims 1-3, characterized in that, The step of determining the session entry and the packet identifier entry corresponding to the first fragmented packet, and determining the association relationship between the session entry and the packet identifier entry, includes: The first field information in the IP header of the first fragmented packet is hashed to determine the hash value of the packet identifier entry corresponding to the first fragmented packet; the first field information includes an identifier, a source IP address, and a destination IP address. Based on the hash value of the message identifier entry and the type of the first fragment message, the message identifier entry corresponding to the first fragment message is determined; The second field information of the protocol header in the first fragmented packet, as well as the source IP address, destination IP address, and protocol number in the IP header, are hashed to determine the session table entry hash value; based on the session table entry hash value, the session table entry of the first fragmented packet is determined; the second field information includes the source port number and the destination port number; Based on the hash value of the message identifier entry and the hash value of the session entry in the session entry, the association relationship between the session entry and the message identifier entry is determined.

5. The fragmented message processing method according to any one of claims 1-3, characterized in that, The step of synchronizing the target entry to the peer firewall includes: The target entry is synchronized to the peer firewall via a heartbeat cable or a synchronization cable.

6. An apparatus for implementing the fragmented message processing method as described in any one of claims 1-5, characterized in that, Applied to a local firewall, wherein the local firewall is any firewall in a dual-active firewall cluster, the device includes: The first determining module is used to determine the type of the first fragmented packet upon receiving the first fragmented packet; the type of the first fragmented packet is used to characterize the position of the first fragmented packet in the Internet Protocol (IP) packet of its parent organization; The second determining module is used to determine the target entry corresponding to the first fragmented packet based on the type of the first fragmented packet; the target entry is used to identify the first fragmented packet. The synchronization module is used to synchronize the target entry to the peer firewall. The target entry is used to instruct the peer firewall and the local firewall to identify other fragmented packets that have the same IP address as the first fragmented packet.

7. A firewall, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the fragmented message processing method as described in any one of claims 1 to 5.

8. A dual-active firewall cluster, characterized in that, The system includes two firewalls configured in a dual-active deployment mode, the two firewalls being connected via a heartbeat cable or a synchronization cable, and either of the two firewalls being used to execute the fragmented packet processing method as described in any one of claims 1 to 5.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the fragmented message processing method as described in any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the fragmented message processing method as described in any one of claims 1 to 5.

Images