Message processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a message processing method and device, electronic equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: when the firewall equipment is about to send a target message, processing the target message through a first operation or a second operation: when the target message is a message generated by recombining a plurality of fragmented messages, the first operation is used for sending the target message to the firewall equipment; taking the size of the network layer data packet of the maximum fragmented message in the plurality of fragmented messages as a first threshold value to judge whether the target message is fragmented and then sent; and the second operation is used for judging whether the target message is fragmented and then sent by taking the minimum MTU values of all communication equipment in a network where the firewall port for sending the target message is located as a second threshold value when the target message is a message generated by recombining a plurality of fragmented messages or the target message is a message of a target type. According to the invention, normal forwarding of traffic can be ensured.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message processing method, device, electronic device and storage medium. Background Art

[0002] When transmitting over a cloud network, in order to ensure that servers and clients of various MTUs (maximum transmission unit values) can interact normally, and to ensure maximum network transmission efficiency, the MTU of the network layer transmission device needs to be adjusted to the maximum adaptable level so that the message is not fragmented as much as possible. When a firewall device (Firewall, also referred to as FW) is connected to such a network, in order to maximize the adaptation range and optimize efficiency, the MTU of the firewall device also needs to be adjusted to the maximum supported value. However, when processing services such as application layer security checks, the firewall device will reassemble multiple related messages, and when sending the reassembled messages, the firewall device will use its own MTU as a limit on the size of the data packet to be sent. As a result, the firewall device will send messages larger than the MTU of the client to the client, and the client will be unable to receive such messages, resulting in traffic interruption. Summary of the invention

[0003] The present application provides a message processing method, device, electronic device and storage medium.

[0004] According to one aspect of an embodiment of the present application, a message processing method is provided, including: when a firewall device is about to send a target message, processing the target message through a first operation or a second operation: the first operation is used to, when the target message is a message generated by reassembling a plurality of fragmented messages, use the size of the network layer data packet of the largest fragmented message among the plurality of fragmented messages as a first threshold, and judge whether to fragment and send the target message according to the first threshold; the second operation is used to, when the target message is a message generated by reassembling a plurality of fragmented messages, or the target message is a message of a target type, use the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located as a second threshold, and judge whether to fragment and send the target message according to the second threshold, wherein the firewall device changes the size of the network layer data packet of the target type of message when processing the target type of message.

[0005] Optionally, the first operation is used to use the size of the network layer data packet of the largest fragmented message among the multiple fragmented messages as the first threshold when the target message is a message reassembled from multiple fragmented messages, and determine whether to fragment the target message and send it according to the first threshold, including: when the size of the network layer data packet of the target message is greater than the first threshold, split the target message into X sub-messages according to the first threshold, wherein X is an integer greater than 1, the size of the network layer data packet of X-1 sub-messages out of the X sub-messages is equal to the first threshold, and the size of the network layer data packet of the remaining sub-message is less than or equal to the first threshold; when it is detected that the size of the network layer data packet of the target message is less than or equal to the first threshold, the target message is sent from the firewall device to a downstream device of the firewall device without splitting the target message.

[0006] Optionally, the first operation further includes: when the target message is not a message reassembled from multiple fragmented messages, judging whether to fragment the target message before sending it according to the MTU value of the port used by the firewall device when sending the target message.

[0007] Optionally, the second operation is used to use the minimum MTU value of all communication devices in the networking where the firewall port used to send the target message is located as the second threshold when the target message is a message generated by reassembling multiple fragmented messages, or the target message is a message of the target type, and determine whether to send the target message after fragmentation according to the second threshold, including: detecting whether the size of the network layer data packet of the target message is greater than the second threshold; if the size of the network layer data packet of the target message is greater than the second threshold, splitting the target message into Y sub-messages, wherein Y is an integer greater than 1, the size of the network layer data packet of Y-1 sub-messages out of the Y sub-messages is equal to the second threshold, and the size of the network layer data packet of the remaining sub-message is less than or equal to the second threshold.

[0008] Optionally, after detecting whether the message size of the target message is greater than a second threshold, the message processing method also includes: when it is detected that the size of the network layer data packet of the target message is less than or equal to the second threshold, sending the target message from the firewall device to a downstream device of the firewall device without splitting the target message.

[0009] Optionally, the second operation further includes: when the target message is not a message of the target type and the target message is not a message reassembled from multiple fragmented messages, sending the target message from the firewall device to a downstream device of the firewall device without splitting the target message.

[0010] Optionally, the message processing method also includes: after splitting the target message according to the first threshold, sending the sub-messages obtained by the split from the firewall device to the downstream device of the firewall device, or, after splitting the target message according to the second threshold, sending the sub-messages obtained by the split from the firewall device to the downstream device of the firewall device.

[0011] According to another aspect of the present application, a message processing device is also provided, which includes: an operation execution unit, which is used to process the target message through a first operation or a second operation when the firewall device is about to send the target message: wherein the operation execution unit includes a first operation execution sub-unit, which is used to execute the first operation, wherein the first operation is used to, when the target message is a message generated by reassembling a plurality of fragmented messages, use the size of the network layer data packet of the largest fragmented message among the plurality of fragmented messages as a first threshold, and judge whether to fragment and send the target message according to the first threshold; the operation execution unit also includes a second operation execution sub-unit, which is used to execute the second operation, wherein the second operation is used to, when the target message is a message generated by reassembling a plurality of fragmented messages, or the target message is a message of a target type, use the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located as a second threshold, and judge whether to fragment and send the target message according to the second threshold, wherein the firewall device changes the size of the network layer data packet of the target type message when processing the target type message.

[0012] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program runs, the device where the computer-readable storage medium is located executes the above-mentioned message processing method.

[0013] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors execute the above-mentioned message processing method.

[0014] As can be seen from the above content, the present application provides two methods for determining whether to split the reassembled target message. Method one is that when the target message is a message generated by reassembling multiple fragmented messages, the size of the network layer data packet of the largest fragmented message among the multiple fragmented messages is used as the first threshold, and whether to fragment and send the target message is determined according to the first threshold. In this way, the firewall device uses the size of the network layer data packet of the largest fragmented message as the basis for message fragmentation processing, and the traffic can be forwarded normally to the downstream device of the firewall device without causing traffic interruption failure and reducing the forwarding efficiency of the fragmented messages. Moreover, for the forwarding of non-fragmented messages, the MTU value set by the firewall device itself (the firewall device can adjust the MTU value to the maximum adaptable value) can still be used as the basis for message fragmentation processing, thereby directly realizing the forwarding of such non-fragmented messages and maintaining the efficient message forwarding performance of the firewall device and other network devices.

[0015] In addition, in scheme 2, when the target message is a message generated by reassembling multiple fragmented messages, or the target message is a message of the target type, the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located is used as the second threshold, and whether to send the target message after fragmentation is determined according to the second threshold, wherein the MTU value of the firewall device port is set to the minimum MTU value of the communication device in the network where the port is located (for example, the MTU of the firewall device is set to 1500), and the reassembled target message can determine whether to split according to the minimum MTU value, and can also ensure that the traffic can be forwarded normally to the downstream device of the firewall device, without causing traffic interruption failure, and will not reduce the forwarding efficiency of the fragmented messages. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 It is a schematic diagram of a message processing method;

[0018] Figure 2 is a flowchart of an optional message processing method according to an embodiment of the present application;

[0019] Figure 3 It is a schematic diagram of message processing based on the maximum transmission unit value of the firewall device;

[0020] Figure 4 It is a schematic diagram of message processing according to the target maximum transmission unit value corresponding to the target port;

[0021] Figure 5It is a schematic diagram of an optional message processing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0025] According to an embodiment of the present application, an embodiment of a message processing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0026] Figure 1 is a schematic diagram of a message processing method, such as Figure 1 As shown in the figure, there is a one-to-one correspondence between Client (including Client1, Client2, Client3, Client4) and Server (including Server1, Server2, Server3, Server4). For example, when Client1 (MTU is 1500) sends multiple fragmented messages to Server1 (MTU is 1500) through FW (MTU is 9000), the application layer security check of FW will reassemble the fragmented messages into a large data packet for processing and then forward it; when forwarding, FW will send fragments based on its own MTU (9000). At this time, Server1 (MTU is 1500) cannot process the reassembled messages larger than 1500 forwarded by FW, and the traffic will be interrupted, resulting in network failure.

[0027] In addition, if the MTU of the FW is changed to 1500, although the situation of traffic interruption can be avoided, it will increase the resource consumption of the FW and reduce the network transmission efficiency of the message. For example, assuming that the size of a non-fragmented message is 8500 bytes, if the FW forwards the message according to the MTU of 9000, it can directly forward the 8500-byte message at one time. However, after the MTU of the FW is changed to 1500, it will be processed according to the MTU value of 1500. The FW needs to divide the 8500-byte message into 6 messages for forwarding, and other related devices in the network need to process 6 messages. It can be seen that in the scenario of MTU of 9000, only one message needs to be processed to complete data transmission, but in the scenario of MTU of 1500, 5 more messages need to be processed to complete data transmission. This undoubtedly greatly increases the consumption of device resources and reduces the efficiency and performance of network forwarding.

[0028] In view of this, an embodiment of the present application provides a message processing method to solve the problem that when a firewall device reassembles and forwards fragmented messages, it forwards a message larger than the MTU value of a next-hop device to the next-hop device, which causes a network failure in which traffic is interrupted, and after reducing its MTU to a lower value, it greatly increases the consumption of device resources and reduces the forwarding efficiency and performance of the network device.

[0029] Figure 2 is a flowchart of an optional message processing method according to an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0030] Step S201: When the firewall device is ready to send a target message, the target message is processed through a first operation or a second operation.

[0031] Step S202, the first operation, is used to use the size of the network layer data packet of the largest fragment message among the multiple fragment messages as the first threshold when the target message is a message reassembled from multiple fragment messages, and determine whether to fragment the target message and send it according to the first threshold.

[0032] Step S203, the second operation, is used to use the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located as the second threshold when the target message is a message reassembled from multiple fragmented messages, or the target message is a message of the target type, and determine whether to fragment the target message and send it according to the second threshold.

[0033] Wherein, the firewall device will change the size of the network layer data packet of the target type of message when processing the target type of message.

[0034] Optionally, fragmentation refers to the process of dividing the original data packet into multiple smaller data packets for transmission in network communication when the data packet to be transmitted exceeds the maximum transmission unit (MTU) of the network in order to ensure that the data can be transmitted correctly. These smaller data packets are called fragmented packets.

[0035] Optionally, regarding the process of generating a fragment message, the following steps may be referred to:

[0036] First, determine the maximum transmission unit (MTU): In the network, each type of network has a different maximum transmission unit. For example, the maximum transmission unit of Ethernet is usually 1500 bytes. When the data packet to be transmitted exceeds this limit, fragmentation is required.

[0037] Secondly, calculate the number of fragments: calculate how many smaller packets the data in the original packet needs to be divided into so that these packets are all less than or equal to the MTU.

[0038] Then split the original packet: Next, split the original packet into multiple smaller packets, each containing a portion of the original data. These smaller packets are called fragmented messages.

[0039] In addition, in order to reassemble these fragmented messages at the receiving end, some additional information needs to be added to each fragmented message, such as the identifier of the original data packet, the fragment sequence number, and more flags. After the receiving end receives the fragmented message, it can reassemble the fragmented message into the original data packet in sequence based on the additional fragment information. The process of fragmenting messages helps ensure that data can be transmitted correctly and efficiently when large data packets are transmitted in the network.

[0040] It can be seen from the above content that when a firewall device receives multiple fragmented messages to be reassembled, it can reassemble the multiple fragmented messages into a target message.

[0041] Optionally, the maximum transmission unit value is also referred to as an MTU value, where MTU refers to the maximum size allowed when data is transmitted in the form of frames or packets in a computer network. The size of MTU can affect the efficiency and performance of network transmission.

[0042] In the first operation, after receiving multiple fragmented messages, the firewall device first calculates the size of each fragmented message, then selects the size of the network data packet of the largest fragmented message as the first threshold, and then determines whether to fragment the target message and send it according to the first threshold.

[0043] In addition, in the second operation, when the firewall target message is a message reassembled from multiple fragmented messages, or the target message is a message of a target type, the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located is used as the second threshold, and a determination is made based on the second threshold whether to fragment the target message and send it, wherein the firewall device changes the size of the network layer data packet of the target type of message when processing the target type of message.

[0044] Optionally, the present application supports two methods for determining whether the reassembled target message needs to be split.

[0045] The first method: When the firewall reassembles multiple fragmented messages, it records the size of the network layer data packet of the largest fragmented message; when the reassembled target message is processed and forwarded by the firewall, the size of the network layer data packet of the largest fragmented message recorded by the firewall is used as the first threshold to determine whether to send the target message in fragments, so as to ensure that the downstream device of the firewall device can receive the message. After the non-fragmented message reaches the firewall, since it is not a fragmented message, the MTU value of the interface used by the firewall device to send the target message is used as the basis for determining whether to fragment the target message.

[0046] The second method: the second threshold of each port of the firewall is set to the minimum MTU value of the communication device in the network where the port is located. After the firewall receives multiple fragmented messages and reassembles the multiple fragmented messages into a target message, the firewall needs to determine the size relationship between the target message and the second threshold. If the size of the network layer data packet of the target message is greater than the second threshold, the target message is fragmented and sent. If the size of the network layer data packet of the target message is less than or equal to the second threshold, the target message does not need to be fragmented, and the target message can be directly sent to the downstream device of the firewall device. In addition, if the target message that the firewall device is going to send is not a message reassembled from fragmented messages, but belongs to the target type of message, it is also necessary to determine whether to fragment the target message and send it according to the second threshold. If the target message that the firewall device is going to send is not a message generated by reassembling multiple fragmented messages, nor is it a message of the target type, the target message can be directly sent to the downstream device of the firewall device without determining the MTU of the port of the firewall device.

[0047] As can be seen from the above content, the present application provides two methods for determining whether to split the reassembled target message. Method one is that when the target message is a message generated by reassembling multiple fragmented messages, the size of the network layer data packet of the largest fragmented message among the multiple fragmented messages is used as the first threshold, and whether to fragment and send the target message is determined according to the first threshold. In this way, the firewall device uses the size of the network layer data packet of the largest fragmented message as the basis for message fragmentation processing, and the traffic can be forwarded normally to the downstream device of the firewall device without causing traffic interruption failure and reducing the forwarding efficiency of the fragmented messages. Moreover, for the forwarding of non-fragmented messages, the MTU value set by the firewall device itself (the firewall device can adjust the MTU value to the maximum adaptable value) can still be used as the basis for message fragmentation processing, thereby directly realizing the forwarding of such non-fragmented messages and maintaining the efficient message forwarding performance of the firewall device and other network devices.

[0048] In addition, in scheme 2, when the target message is a message generated by reassembling multiple fragmented messages, or the target message is a message of the target type, the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located is used as the second threshold, and whether to send the target message after fragmentation is determined according to the second threshold, wherein the MTU value of the firewall device port is set to the minimum MTU value of the communication device in the network where the port is located (for example, the MTU of the firewall device is set to 1500), and the reassembled target message can determine whether to split according to the minimum MTU value, and can also ensure that the traffic can be forwarded normally to the downstream device of the firewall device, without causing traffic interruption failure, and will not reduce the forwarding efficiency of the fragmented messages.

[0049] It can be seen that the technical solution of the present application solves the problem that when the firewall device reassembles and forwards fragmented messages, it forwards messages larger than the MTU value of the next-hop device to the next-hop device, which causes network failure of traffic interruption, and after reducing its MTU to a lower value, it greatly increases the consumption of device resources and reduces the forwarding efficiency and performance of the network device.

[0050] In an optional embodiment, a first operation is used to use the size of the network layer data packet of the largest fragmented message among the multiple fragmented messages as a first threshold when the target message is a message reassembled from multiple fragmented messages, and determine whether to fragment the target message and send it according to the first threshold, including: when the size of the network layer data packet of the target message is greater than the first threshold, split the target message into X sub-messages according to the first threshold, wherein X is an integer greater than 1, the sizes of the network layer data packets of X-1 sub-messages among the X sub-messages are equal to the first threshold, and the size of the network layer data packet of the remaining sub-message is less than or equal to the first threshold; when it is detected that the size of the network layer data packet of the target message is less than or equal to the first threshold, the target message is sent from the firewall device to a downstream device of the firewall device without splitting the target message.

[0051] Optionally, Figure 3 This is a schematic diagram of message processing based on the maximum transmission unit value of the firewall device, such as Figure 3 As shown in the figure, Client1 (MTU 1500, IP network segment 10.1.1.2 / 24, eth0), Client2 (MTU 4500, IP network segment 10.1.1.3 / 24, eth0), and Client3 (MTU 9000, IP network segment 10.1.1.4 / 24, eth0) are connected to the interface eth1 (IP network segment 10.1.1.1 / 24, MTU 9000) of the Firewall (FW for short) through Switch 1 (MTU 9000); Server1 (MTU 1500, IP network segment 11.1.1.2 / 24, eth0), Server2 (MTU 4500, IP network segment 11.1.1.3 / 24, eth0), and Server3 (MTU 9000, IP network segment 11.1.1.4 / 24, eth0) are connected to the interface eth1 (IP network segment 10.1.1.1 / 24, MTU 9000) of the Firewall (FW for short) through Switch 2 (MTU 9000). 9000) is connected to the firewall's interface eth2 (IP segment 11.1.1.1 / 24MTU 9000). The firewall is configured with a bidirectional policy from 10.1.1.0 / 24 to 11.1.1.0 / 24, so that Client1, Client2, and Client3 can communicate with Server1, Server2, and Server3 through the firewall.

[0052] Alternatively, if Figure 3 As shown in the figure, when Client1 communicates with Servic1 through Firewall (MTU is 9000), Client1 sends 3 IP fragment messages to Firewall, and the network layer data packet sizes of the 3 IP fragment messages are 1500 bytes, 1500 bytes, and 300 bytes respectively. When they are sent to Firewall for application layer security check, Firewall will reassemble the 3 IP fragment messages into a target message with a network layer data packet size of 3260 bytes, and record the network layer data packet size of the largest fragment message as 1500 bytes; after application layer security check, when sending the target message, it is detected that the recorded network layer data packet size of the largest fragment message is 1500 bytes, then 1500 bytes is used as the MTU value when sending the packet, and the fragments are sent to ensure that the subsequent network equipment (such as service1) can receive and process the sub-messages obtained by splitting the target message, avoiding network failures such as interruptions.

[0053] Alternatively, if Figure 3 As shown in the figure, when Client2 communicates with Servic2 through Firewall (MTU is 9000), Client2 sends 3 IP fragment messages to Firewall, and the network layer data packet sizes of the 3 IP fragment messages are 4500 bytes, 4500 bytes, and 3000 bytes respectively. When they are sent to Firewall for application layer security check, Firewall will reassemble the fragment messages into a target message with a network layer data packet size of 11960 bytes, and record the size of the network layer data packet of the largest fragment message as 4500 bytes; after application layer security check, when sending the target message, it is detected that the size of the network layer data packet of the largest fragment message is 4500 bytes, then 4500 bytes is used as the MTU value when sending the packet, and the fragments are sent to ensure that the subsequent network equipment (such as service2) can receive and process the sub-messages obtained by splitting the target message, avoiding network failures such as interruptions.

[0054] From the above content, it can be seen that the firewall device uses the size of the network layer data packet of the largest fragmented message as the basis for message fragmentation processing. The traffic can be forwarded normally to the downstream device of the firewall device without causing traffic interruption failure and reducing the forwarding efficiency of the fragmented messages.

[0055] In an optional embodiment, the first operation further includes: when the target message is not a message reassembled from multiple fragmented messages, determining whether to fragment the target message before sending it according to the MTU value of the port used by the firewall device when sending the target message.

[0056] Alternatively, if Figure 3 As shown in the figure, when Client3 and Servic3 communicate through Firewall (MTU is 9000), after sending a 8900-byte non-IP fragment message to the Firewall (MTU is 9000) device, there is no fragment reassembly behavior, so the network layer data packet size of the largest fragment message will not be recorded; after application layer security check and processing, when sending the non-IP fragment message, the network layer data packet size of the largest fragment message is not detected, so the MTU (9000) corresponding to the outgoing interface eth2 itself is used as the basis for judging whether to fragment the non-IP fragment message. Since the size of the non-IP fragment message is less than 9000, it can be directly forwarded to the downstream device of the firewall device.

[0057] In addition, it should be noted that the above eth1 and eth2 interfaces of the Client, Server, Switch, and Firewall and their corresponding IP address configuration, policy configuration, message sending and receiving conditions, MTU value, network topology, etc. are all examples. In actual deployment, other interfaces, IP addresses, and MTU values ​​can be used, and other devices and network topologies can also be used for deployment. Application security inspection is only one of the functions that require fragmentation and reassembly. There are other functions that will also cause fragmented messages to be reassembled and forwarded, and even change the message content and message size, etc., which are not listed here one by one.

[0058] From the above content, it can be seen that for the forwarding of non-fragmented messages, the technical solution of the present application can still use the MTU value set by the firewall device itself (the firewall device can adjust the MTU value to the maximum adaptable value) as the basis for message fragmentation processing, thereby directly realizing the forwarding of such non-fragmented messages and maintaining the efficient message forwarding performance of the firewall device and other network devices.

[0059] In an optional embodiment, the second operation is used to use the minimum MTU value of all communication devices in the networking where the firewall port used to send the target message is located as the second threshold when the target message is a message reassembled from multiple fragmented messages, or the target message is a message of the target type, and determine whether to send the target message after fragmentation according to the second threshold, including: detecting whether the size of the network layer data packet of the target message is greater than the second threshold; when the size of the network layer data packet of the target message is greater than the second threshold, splitting the target message into Y sub-messages, wherein Y is an integer greater than 1, the size of the network layer data packet of Y-1 sub-messages out of the Y sub-messages is equal to the second threshold, and the size of the network layer data packet of the remaining sub-message is less than or equal to the second threshold.

[0060] Optionally, Figure 4 This is a schematic diagram of message processing based on the target maximum transmission unit value corresponding to the target port, such as Figure 4 As shown in the figure, Client1 (MTU 1500, IP network segment 10.1.1.2 / 24, eth0) is connected to the firewall's interface Eth0 / 1 (IP network segment: 10.1.1.1 / 24, MTU: 1500); Client2 (MTU 4500, IP network segment 20.1.1.3 / 24, eth0) is connected to the firewall's interface Eth0 / 3 (IP network segment: 20.1.1.1 / 24, MTU: 1500); Client3 (MTU 9000, IP network segment 30.1.1.4 / 24, eth0) is connected to the firewall's interface Eth0 / 5 (IP network segment 30.1.1.1 / 24, MTU: 9000); Server1 (MTU 1500, IP network segment 11.1.1.2 / 24, eth0) is connected to the firewall's interface Eth0 / 2 (IP network segment: 11.1.1.1 / 24, MTU: 1500); Server2 (MTU 4500, IP network segment 21.1.1.3 / 24, eth0) is connected to the firewall's interface Eth0 / 4 (IP network segment: 21.1.1.1 / 24, MTU: 4500); Server3 (MTU 9000, IP network segment 31.1.1.4 / 24, eth0) is connected to the firewall's interface Eth0 / 6 (IP network segment 31.1.1.1 / 24, MTU: 9000). Configure a bidirectional policy from 10.1.1.0 / 24 to 11.1.1.0 / 24 on the firewall so that Client1 and Server1 can communicate through the firewall; configure a bidirectional policy from 20.1.1.0 / 24 to 21.1.1.0 / 24 so that Client2 and Server2 can communicate through the firewall; configure a bidirectional policy from 30.1.1.0 / 24 to 31.1.1.0 / 24 so that Client3 and Server3 can communicate through the firewall.

[0061] When Client1 communicates with Servic1 through the Firewall, Client1 sends three FTP fragmented messages to the Firewall. The network layer data packet sizes of the three FTP fragmented messages are 1500 bytes, 1500 bytes, and 300 bytes respectively. When they are sent to the Firewall for processing, because the FTP message is a seven-layer message, the Firewall needs to perform an application layer security check, so it will reassemble the three FTP fragmented messages into a target message with a network layer data packet size of 3260 bytes, and record the seven-layer processing behavior and fragment reassembly behavior of the target message. After the application layer security check, when the Firewall sends the target message, it detects that the target message has been processed and reassembled at the seven-layer, so it sends the fragments according to the target MTU value of 1500 corresponding to the interface Eth0 / 2, ensuring that the subsequent network devices (such as service1) can receive and process the fragmented messages obtained by splitting the target message, avoiding network failures such as interruptions.

[0062] It should be noted that the seven-layer message usually refers to the OSI (Open Systems Interconnection) model, which is a seven-layer structure used to describe the computer network communication process. The OSI model is a standard developed by the International Organization for Standardization (ISO) to regulate the communication between different computer systems. The seven layers are:

[0063] 1. Physical Layer: This layer is responsible for transmitting the raw bit stream on the physical medium, such as cables, optical fibers, etc. It handles the transmission, encoding, and decoding of signals.

[0064] 2. Data Link Layer: This layer is responsible for transmitting data frames between adjacent network nodes. It ensures data integrity, error detection and correction, and flow control.

[0065] 3. Network Layer: This layer is responsible for transmitting data packets between different networks. It handles the routing, addressing, and network topology of data packets.

[0066] 4. Transport Layer: This layer is responsible for establishing, maintaining, and terminating connections between hosts. It ensures end-to-end transmission of data, including error detection, flow control, and data segmentation.

[0067] 5. Session Layer: This layer is responsible for establishing, managing and terminating sessions. It controls sessions, establishes checkpoints and recovery plans.

[0068] 6. Presentation Layer: This layer is responsible for data presentation, security, and compression. It ensures that data can be correctly interpreted and displayed between different systems.

[0069] 7. Application Layer: This layer is the interface between the user and the network and is responsible for processing application requirements. It includes functions such as file transfer, email, and network management.

[0070] Alternatively, if Figure 4 As shown in the figure, when Client3 and Servic3 communicate through Firewall (MTU is 9000), Client3 sends 8900-byte FTP non-fragmented messages to Firewall. Although it is a non-fragmented message and no fragmentation and reassembly behavior has occurred, since FTP non-fragmented messages belong to layer 7 messages, Firewall needs to perform application layer security checks and record that the FTP non-fragmented messages have undergone layer 7 processing. Therefore, after the application layer security check, when sending the FTP fragmented message, Firewall needs to use the MTU of port eth0 / 6 as the fragmentation processing basis for the FTP non-fragmented message. Since 8900 is less than 9000, the FTP non-fragmented message can be directly forwarded to Server3.

[0071] It should also be noted that the seven-layer message belongs to a type of message of the above-mentioned target type. Since the firewall device will change the size of the network layer data packet of the seven-layer message when processing the seven-layer message, when the firewall device receives the seven-layer message, it is necessary to use the minimum MTU value of all communication devices in the network where the port used to send the seven-layer message in the firewall device is located as the basis for fragmentation processing of the seven-layer message.

[0072] In an optional embodiment, after detecting whether the message size of the target message is greater than a second threshold, when it is detected that the size of the network layer data packet of the target message is less than or equal to the second threshold, the target message is sent from the firewall device to a downstream device of the firewall device without splitting the target message.

[0073] From the above content, it can be seen that in the second operation, when the target message is a message generated by reassembling multiple fragmented messages, or the target message is a message of the target type, the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located is used as the second threshold. When the size of the network layer data packet of the target message is less than or equal to the second threshold, there is no need to split the target message again, and the firewall device can directly forward the target message, thereby improving the forwarding efficiency of the target message.

[0074] In an optional embodiment, in the second operation, when the target message is not a message of the target type and the target message is not a message generated by reassembling multiple fragmented messages, the target message is sent from the firewall device to a downstream device of the firewall device without splitting the target message.

[0075] like Figure 4 As shown in the figure, when Client2 communicates with Servic2 through the Firewall, Client2 sends three ping fragments to the Firewall. The network layer data packet sizes of the three ping fragments are 4500 bytes, 4500 bytes, and 3000 bytes respectively. Since the ping message does not belong to the seven-layer message, the Firewall will not reassemble the three ping messages into a large packet with a network layer data packet size of 11960 bytes, nor will it record the seven-layer processing and fragment reassembly behavior of the ping message. On this basis, when the Firewall sends these ping fragments, since it does not detect that the ping message has been fragmented and reassembled, nor does it detect that the ping message has been processed at the seven-layer, it does not need to determine the relationship between the target MTU value of the interface eth0 / 4 and the size of each ping message, and directly sends these unreassembled ping fragments to Service2.

[0076] It should be noted that the above interfaces of Client, Server, Switch, and Firewall and their corresponding IP address configuration, MTU configuration, policy configuration, message sending and receiving, network topology, etc. are all examples. In actual deployment, other interfaces, IP addresses, and MTU values ​​can be used, and other devices and network topologies can also be used for deployment. Application security inspection is only one of the functions that requires fragmentation and reassembly. There are other functions that will also cause fragmented messages to be reassembled and forwarded, and even change the message content and message size, etc., which are not listed here one by one.

[0077] Optionally, after the target message is split according to the first threshold, the sub-messages obtained by the split are sent from the firewall device to a downstream device of the firewall device, or, after the target message is split according to the second threshold, the sub-messages obtained by the split are sent from the firewall device to a downstream device of the firewall device.

[0078] As can be seen from the above content, the present application provides two methods for determining whether to split the reassembled target message. Method one is that when the target message is a message generated by reassembling multiple fragmented messages, the size of the network layer data packet of the largest fragmented message among the multiple fragmented messages is used as the first threshold, and whether to fragment and send the target message is determined according to the first threshold. In this way, the firewall device uses the size of the network layer data packet of the largest fragmented message as the basis for message fragmentation processing, and the traffic can be forwarded normally to the downstream device of the firewall device without causing traffic interruption failure and reducing the forwarding efficiency of the fragmented messages. Moreover, for the forwarding of non-fragmented messages, the MTU value set by the firewall device itself (the firewall device can adjust the MTU value to the maximum adaptable value) can still be used as the basis for message fragmentation processing, thereby directly realizing the forwarding of such non-fragmented messages and maintaining the efficient message forwarding performance of the firewall device and other network devices.

[0079] In addition, in scheme 2, when the target message is a message generated by reassembling multiple fragmented messages, or the target message is a message of the target type, the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located is used as the second threshold, and whether to send the target message after fragmentation is determined according to the second threshold, wherein the MTU value of the firewall device port is set to the minimum MTU value of the communication device in the network where the port is located (for example, the MTU of the firewall device is set to 1500), and the reassembled target message can determine whether to split according to the minimum MTU value, and can also ensure that the traffic can be forwarded normally to the downstream device of the firewall device, without causing traffic interruption failure, and will not reduce the forwarding efficiency of the fragmented messages.

[0080] It can be seen that the technical solution of the present application solves the problem that when the firewall device reassembles and forwards fragmented messages, it forwards messages larger than the MTU value of the next-hop device to the next-hop device, which causes network failure of traffic interruption, and after reducing its MTU to a lower value, it greatly increases the consumption of device resources and reduces the forwarding efficiency and performance of the network device.

[0081] According to another aspect of the present application, a message processing device is also provided, wherein: Figure 5 is a schematic diagram of an optional message processing device according to an embodiment of the present application, such as Figure 5 As shown, the message processing apparatus includes: an operation execution unit 50, which is used to process the target message through the first operation or the second operation when the firewall device is about to send the target message.

[0082] In addition, the operation executing unit 50 further includes: a first operation executing sub-unit 501 and a second operation executing sub-unit 502 .

[0083] Among them, the first operation execution subunit 501 is used to execute the first operation, wherein the first operation is used to use the size of the network layer data packet of the largest fragment message among the multiple fragment messages as the first threshold when the target message is a message reassembled from multiple fragment messages, and judge whether to fragment and send the target message according to the first threshold; the second operation execution subunit 502 is used to execute the second operation, wherein the second operation is used to use the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located as the second threshold when the target message is a message reassembled from multiple fragment messages, or the target message is a message of the target type, and judge whether to fragment and send the target message according to the second threshold, wherein the firewall device will change the size of the network layer data packet of the target type of message when processing the target type of message.

[0084] Optionally, the first operation execution subunit 501 includes: a first processing module and a second processing module. The first processing module is used to split the target message into X sub-messages according to the first threshold value when the size of the network layer data packet of the target message is greater than the first threshold value, wherein X is an integer greater than 1, the size of the network layer data packet of X-1 sub-messages among the X sub-messages is equal to the first threshold value, and the size of the network layer data packet of the remaining sub-message is less than or equal to the first threshold value; the second processing module is used to send the target message from the firewall device to the downstream device of the firewall device without splitting the target message when it is detected that the size of the network layer data packet of the target message is less than or equal to the first threshold value.

[0085] Optionally, the first operation execution subunit 501 includes: a third processing module, which is used to determine whether to fragment the target message and then send it according to the MTU value of the port used by the firewall device when sending the target message when the target message is not a message reassembled from multiple fragmented messages.

[0086] Optionally, the second operation execution subunit 502 includes: a detection module and a fourth processing module. The detection module is used to detect whether the size of the network layer data packet of the target message is greater than the second threshold; the fourth processing module is used to split the target message into Y sub-messages when the size of the network layer data packet of the target message is greater than the second threshold, wherein Y is an integer greater than 1, the size of the network layer data packet of Y-1 sub-messages among the Y sub-messages is equal to the second threshold, and the size of the network layer data packet of the remaining sub-message is less than or equal to the second threshold.

[0087] Optionally, the second operation execution subunit 502 includes: a fifth processing module, used to send the target message from the firewall device to a downstream device of the firewall device without splitting the target message when it is detected that the size of the network layer data packet of the target message is less than or equal to the second threshold.

[0088] Optionally, the second operation execution subunit 502 includes: a sixth processing module, used to send the target message from the firewall device to a downstream device of the firewall device without splitting the target message when the target message is not a message of the target type and the target message is not a message generated by reassembling multiple fragmented messages.

[0089] Optionally, the message processing device also includes: a sub-message processing unit, which is used to send the sub-messages obtained by splitting the target message according to the first threshold from the firewall device to the downstream device of the firewall device, or, after splitting the target message according to the second threshold, send the sub-messages obtained by splitting from the firewall device to the downstream device of the firewall device.

[0090] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors execute the above-mentioned message processing method.

[0091] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program runs, the device where the computer-readable storage medium is located executes the above-mentioned message processing method.

[0092] The above-mentioned embodiments or examples disclosed in the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection disclosed in the present application. In the absence of contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0093] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0094] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0096] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0097] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0098] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0099] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A message processing method, characterized in that: include: When the firewall device is ready to send a target message, the target message is processed by the first operation or the second operation: The first operation is used to, when the target message is a message generated by reassembling multiple fragment messages, use the size of the network layer data packet of the largest fragment message among the multiple fragment messages as a first threshold, and determine whether to send the target message after fragmentation according to the first threshold; The second operation is used to use the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located as the second threshold when the target message is a message reassembled from multiple fragmented messages, or the target message is a message of the target type, and determine whether to fragment the target message and send it according to the second threshold, wherein the firewall device will change the size of the network layer data packet of the target type of message when processing the target type of message.

2. The message processing method according to claim 1, characterized in that: The first operation is used to, when the target message is a message generated by reassembling multiple fragment messages, use the size of the network layer data packet of the largest fragment message among the multiple fragment messages as a first threshold, and determine whether to send the target message after fragmentation according to the first threshold, including: When the size of the network layer data packet of the target message is greater than the first threshold, split the target message into X sub-messages according to the first threshold, where X is an integer greater than 1, the sizes of the network layer data packets of X-1 sub-messages of the X sub-messages are equal to the first threshold, and the size of the network layer data packet of the remaining sub-message is less than or equal to the first threshold; When it is detected that the size of the network layer data packet of the target message is less than or equal to the first threshold, the target message is sent from the firewall device to a downstream device of the firewall device without splitting the target message.

3. The message processing method according to claim 1, characterized in that: The first operation further includes: When the target message is not a message generated by reassembling a plurality of fragment messages, it is determined whether to fragment the target message before sending it according to the MTU value of the port used by the firewall device when sending the target message.

4. The message processing method according to claim 1, characterized in that: The second operation is used to, when the target message is a message reassembled from multiple fragment messages, or the target message is a message of a target type, use the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located as a second threshold, and determine whether to send the target message after fragmentation according to the second threshold, including: Detecting whether the size of the network layer data packet of the target message is greater than the second threshold; When the size of the network layer data packet of the target message is greater than the second threshold, the target message is split into Y sub-messages, where Y is an integer greater than 1, the sizes of the network layer data packets of Y-1 sub-messages among the Y sub-messages are equal to the second threshold, and the size of the network layer data packet of the remaining sub-message is less than or equal to the second threshold.

5. The message processing method according to claim 4, characterized in that: After detecting whether the message size of the target message is greater than the second threshold, the message processing method further includes: When it is detected that the size of the network layer data packet of the target message is less than or equal to the second threshold, the target message is sent from the firewall device to a downstream device of the firewall device without splitting the target message.

6. The message processing method according to claim 1, characterized in that: The second operation further includes: When the target message is not a message of the target type and the target message is not a message reassembled from multiple fragment messages, the target message is sent from the firewall device to a downstream device of the firewall device without splitting the target message.

7. The message processing method according to claim 1, characterized in that: The message processing method further includes: After the target message is split according to the first threshold, the sub-messages obtained by the split are sent from the firewall device to the downstream device of the firewall device, or, after the target message is split according to the second threshold, the sub-messages obtained by the split are sent from the firewall device to the downstream device of the firewall device.

8. A message processing device, characterized in that: include: An operation execution unit, configured to process the target message through a first operation or a second operation when the firewall device is about to send the target message: The operation execution unit includes a first operation execution subunit, which is used to execute the first operation, wherein the first operation is used to, when the target message is a message generated by reassembling a plurality of fragment messages, use the size of the network layer data packet of the largest fragment message among the plurality of fragment messages as a first threshold, and determine whether to send the target message after fragmentation according to the first threshold; The operation execution unit also includes a second operation execution sub-unit, which is used to execute the second operation, wherein the second operation is used to use the minimum MTU value of all communication devices in the network where the firewall port used to send the target message is located as a second threshold when the target message is a message generated by reassembling multiple fragmented messages, or the target message is a message of a target type, and determine whether to fragment the target message and send it according to the second threshold, wherein the firewall device will change the size of the network layer data packet of the target type of message when processing the target type of message.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the message processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: The electronic device includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors execute the message processing method described in any one of claims 1 to 7.

Images