Method and device for transmitting deep packet fragmentation

Abstract

The invention provides a deep message fragmentation transmission method and device, and relates to the technical field of data processing, and the method comprises the steps: carrying out the fragmentation of an original message received by a front gateway, and obtaining a first piece of message and a non-first piece of message; then, extracting a source and target port number of a transport layer protocol header from the original message, and filling the source and target port number into an option field of an IP header of a non-first message; and after fragmentation is finished, the front gateway sends all fragmented messages to the firewall, and the source port number and the destination port number in each fragmented message are used for the firewall to carry out IP quintuple matching on each fragmented message. According to the method, the four-byte identification is added to the selectable field of the IP header, matching of four layers of source and target port numbers is achieved through the identification, precise ACL matching of four layers of fragmented messages is achieved, the problem that a firewall in an existing network cannot conduct precise matching and filtering on the fragmented messages is solved, and the efficiency and performance of four-layer fragmented traffic matching ACL are improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and device for transmitting deep message fragments. Background Art

[0002] In the TCP / IP protocol, the IP protocol provides unreliable, connectionless datagram transmission services and is responsible for data encapsulation, addressing, and routing. Since the maximum length of an IP data packet is limited by the MTU value (Maximum Transmission Unit), data packets exceeding this length need to be fragmented and reassembled at the destination. However, the fragmentation process brings new problems, especially for IP data packets containing TCP or UDP headers. Fragmentation may cause the transport layer protocol header to be cut, so that non-first fragments do not contain the protocol header, affecting the precise matching of the firewall or gateway ACL.

[0003] At present, the following methods are mainly used to solve the above problems. One method is that the firewall only matches the ACL for the first fragment, and allows subsequent fragments to pass if it succeeds, but this method reduces security because subsequent fragments may not be fully checked. Another method is to re-add TCP or UDP headers to the fragmented message, but this method increases device overhead and may lead to inefficiency and secondary fragmentation problems. Summary of the invention

[0004] The present application provides a method and device for transmitting deep message fragments to solve the above-mentioned problems.

[0005] In a first aspect, an embodiment of the present application proposes a method for transmitting deep message fragments, which is applied to a front-end gateway. The method includes: Segmenting the original message received by the front-end gateway to obtain a first-segment message and a non-first-segment message, wherein the first-segment message includes a complete transport layer header, and the transport layer header includes a source and destination port number; Extracting the source and destination port numbers of the transport layer protocol header from the original message, and filling the source and destination port numbers into the option field of the IP header of the non-first fragment message; The front gateway sends all fragmented messages to the firewall, and the source and destination port numbers in each fragmented message are used by the firewall to perform IP quintuple matching on each fragmented message.

[0006] Optionally, the method further includes: Determine the DO value of each of the first fragment message and the non-first fragment message, when the DO value is the first value, it indicates that the fragment offset of the fragment message is accurate, and when the DO value is the second value, it indicates that the fragment offset of the fragment message is the Offset value rounded up; Fill all DO values ​​into the first reserved field of the Flags field of each corresponding fragment message.

[0007] Optionally, determining the DO values ​​of the first-slice message and the non-first-slice message respectively includes: Calculating the fragment offset of the original message; When the fragment offset of the original message is an integer, the DO values ​​of the first fragment message and the non-first fragment message are determined to be the first value.

[0008] Optionally, determining the DO values ​​of the first-slice message and the non-first-slice message respectively includes: Calculating the fragment offset of the original message; When the fragment offset of the original message is a non-integer, determining the DO value of the first fragment message to be a first value; Calculating the fragment offset of the non-first fragment message; When the fragment offset of the non-first fragment message is a non-integer, determining the DO value of the non-first fragment message to be a second value; When the fragment offset of the non-first fragment message is an integer, the DO value of the non-first fragment message is determined to be a first value.

[0009] Optionally, the method further includes: Determine whether the length of the original message is greater than the MTU value configured by the interface of the front gateway; When the length of the original message is greater than the MTU value configured by the interface of the front gateway, determining whether the protocol stack type of the IP header of the original message is TCP or UDP; When the protocol stack type of the IP header of the original message is TCP or UDP, it is determined whether the fragment offset of the original message is an integer.

[0010] In a second aspect, an embodiment of the present application proposes a method for transmitting deep message fragments, which is applied to a firewall. The method includes: Receive messages sent by the front-end gateway; When the message is not the first fragment message, obtaining the source and destination port numbers from the option field of the IP header of the message; Based on the source and destination port numbers, the quintuple of the non-first fragment message is matched.

[0011] Optionally, the method comprises: When the message is a first-fragment message, obtaining source and destination port numbers from a transport layer header of the message; Based on the source and destination port numbers, the firewall matches the quintuple of the first packet.

[0012] Optionally, the method comprises: Determine whether the protocol stack type in the IP header of the message is TCP or UDP; When the protocol stack type in the IP header of the message is TCP or UDP, determining whether the message is a fragmented message; In the case that the message is a fragmented message, it is determined whether the message is a first fragment message.

[0013] In a third aspect, an embodiment of the present application proposes a transmission device for deep message fragmentation, which is applied to a front-end gateway, and the device includes: A fragmentation module, used for fragmenting the original message received by the front gateway to obtain a first fragment message and a non-first fragment message, wherein the first fragment message contains a complete transport layer header, and the transport layer header contains a source and destination port number; A first filling module is used to extract the source and destination port numbers of the transport layer protocol header from the original message, and fill the source and destination port numbers into the option field of the IP header of the non-first fragment message; The transmission module is used for the front gateway to send all fragmented messages to the firewall, and the source and destination port numbers in each fragmented message are used by the firewall to perform IP quintuple matching on each fragmented message.

[0014] In a fourth aspect, an embodiment of the present application provides a deep message fragmentation transmission device, which is applied to a firewall, and the device includes: A receiving module, used for receiving messages sent by the front-end gateway; A first acquisition module, used for acquiring source and destination port numbers from an option field of an IP header of the message when the message is not a first fragment message; The first matching module is used to match the quintuple of the non-first fragment message based on the source and destination port numbers.

[0015] The present application includes the following advantages: the present application proposes a transmission method and device for deep message fragmentation, firstly, the original message received by the front-end gateway is fragmented to obtain the first fragment message and the non-first fragment message, wherein the first fragment message contains a complete transport layer header, and the transport layer header contains the source and destination port number; then, the source and destination port number of the transport layer protocol header is extracted from the original message, and the source and destination port number is filled into the option field of the IP header of the non-first fragment message; after the fragmentation is completed, the front-end gateway sends all the fragmented messages to the firewall, and the source and destination port number in each fragmented message is used by the firewall to perform IP five-tuple matching on each fragmented message. The method adds a 4-byte identifier to the optional field of the IP header, and realizes the matching of the four-layer source and destination port numbers through these identifiers, realizes the precise ACL matching of the four-layer fragmented messages, solves the problem that the firewall in the existing network cannot accurately match and filter the fragmented messages, and improves the efficiency and performance of the four-layer fragmented traffic matching ACL. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0017] Figure 1 It is a schematic diagram of the encapsulation structure of a UDP message header proposed in the prior art; Figure 2 It is a schematic diagram of the encapsulation structure of a TCP message header proposed in the prior art; Figure 3 It is a schematic diagram of IP message fragmentation proposed in the prior art; Figure 4 It is a structural diagram of an original IP message header proposed in the prior art; Figure 5 It is a schematic diagram of the encapsulation structure of a fragmented message after a UDP message is fragmented, as proposed in the prior art; Figure 6 It is a schematic diagram of Internet business networking proposed by the prior art; Figure 7 It is a schematic diagram of a fragmentation structure of replicating a four-layer UDP header proposed in the prior art; Figure 8 It is a schematic flow chart of the steps of a transmission method of deep message fragmentation applied to a front-end gateway proposed in an embodiment of the present application; Fig. 9 It is a schematic diagram of an IP message header structure of a deep fragmentation message proposed in an embodiment of the present application; Fig.10 It is a schematic diagram of an IP message fragmentation structure of a deep fragmented message proposed in an embodiment of the present application; Fig.11 It is a flow chart of a transmission method of deep message fragmentation applied to a front-end gateway proposed in an embodiment of the present application; Fig.12 It is a schematic diagram of the steps of a method for transmitting deep message fragments applied to a firewall proposed in an embodiment of the present application; Fig.13 It is a flow chart of a method for transmitting deep message fragmentation applied to a firewall proposed in an embodiment of the present application; Fig.14 It is a module schematic diagram of a transmission device for deep message fragmentation applied to a front-end gateway proposed in an embodiment of the present application; Fig.15 It is a module schematic diagram of a deep message fragmentation transmission device applied to a firewall proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0019] In the TCP / IP protocol, the IP protocol (Internet Protocol, Internet communication protocol, is the network layer protocol in the TCP / IP system) provides unreliable connectionless datagram transmission services for data encapsulation, unpacking, addressing and routing. IP data packets vary in length, with a maximum length of 65535 bytes. The size of IP data packets encapsulated and forwarded by the physical network is limited. In order to better forward IP packets, it is necessary to fragment the IP data packets and reassemble and restore them at the destination. IP fragmentation and reassembly solve the problem of message transmission, but it also brings many new problems. The fragmentation of transport layer messages is an important issue. The fragmentation of IP messages is to fragment the payload of IP messages. When there is TCP (Transmission Control Protocol, a connection-oriented, reliable, byte stream-based transport layer communication protocol) or UDP protocol (User Datagram Protocol, a connectionless transport layer protocol in the OSI (Open System Interconnection) reference model, providing simple, unreliable transaction-oriented information transmission services) in the IP payload, the fragmentation of the IP payload will cause the transport layer protocol header to be cut apart, or only the first fragment has the transport layer protocol header, and the subsequent fragments only have pure data parts. Ethernet data is encapsulated layer by layer, of which the fourth layer is the transport layer. The transport layer mainly consists of two protocols: TCP and UDP. The UDP message header is 8 bytes long, and the encapsulation structure is as follows. Figure 1 As shown ( Figure 1 is a schematic diagram of the encapsulation structure of a UDP message header proposed in the prior art). The TCP message header is 20 bytes long, and the encapsulation structure is as follows Figure 2 As shown ( Figure 2 It is a schematic diagram of the encapsulation structure of a TCP message header proposed in the prior art). The maximum length of an IP message sent in a device is determined by the MTU value (Maximum Transmission Unit, which is used to notify the other party of the maximum size of the data service unit that can be accepted, indicating the effective load size that the sender can accept) of the device interface. The maximum length of an IP message cannot exceed the MTU value. If a message with a length greater than the MTU value of the device interface is received, the IP message payload (IP data packet part) will be fragmented, such as Figure 3 As shown ( Figure 3 is a fragmentation diagram of an IP message proposed in the prior art). That is to say, the calculation of the maximum transmission unit is the sum of the IP header and the IP data packet, and fragmentation is just fragmenting the IP data packet. When the IP data packet containing the transport layer protocol is fragmented, the second fragment after fragmentation will be formed, and the third fragment does not contain the transport layer protocol header.

[0020] The length of the original IP header is fixed at 20 bytes, and the structure after 20 bytes is the option field. Among them, the 7th byte is the Flags and Fragmented Offset fields. Flags has 3 bits, the first bit is a reserved field, and the second bit is the DF bit (Don't Fragment), which indicates whether the message is allowed to be fragmented. If the DF bit is 1, it means that the message does not allow fragmentation, and if it is set to 0, it means that it can be fragmented. The third bit is the MF bit (More Fragments), which is used to indicate whether there are more fragments after the fragmentation. If MF is set to 1, this fragment is not the last fragment and there are more fragments to follow. If it is set to 0, it means that this fragment is the last fragment. The Fragmented Offset field is a fragment offset field with a length of 13 bits. It indicates the deviation distance of this fragment from the first fragment in bytes. The entire original IP message header structure is as follows Figure 4 As shown ( Figure 4 It is a structural diagram of an original IP message header proposed in the prior art).

[0021] Take the fragmentation of UDP packets as an example. Figure 5 As shown ( Figure 5 1 is a schematic diagram of the encapsulation structure of a fragmented message after a UDP message is fragmented, as proposed in the prior art. In the IP header of the first fragmented message, MF=1, DF=0, and fragment offset=0, and the IP data packet contains a UDP header. The IP data packets of the second and third fragmented messages do not contain a UDP header.

[0022] When these four-layer fragmented messages pass through the firewall or gateway ACL (Access Control Lists, which can filter data packets on the interface according to the set conditions, allowing them to pass or discard them. Access control lists are widely used in routers and three-layer switches. With the help of access control lists, user access to the network can be effectively controlled, thereby maximizing network security), they cannot accurately match the IP five-tuple, resulting in the fragmented messages cannot be accurately matched. Figure 6 As shown ( Figure 6It is a schematic diagram of Internet business networking proposed by the prior art. Users access various services provided by the enterprise intranet server through the Internet, and at the same time need to pass through the routing of the front-end gateway and the filtering of the traffic by the firewall. When the four-layer fragmented message from the Internet to the enterprise intranet reaches the firewall, it is impossible to match the IP five-tuple for the non-first fragment message, because the subsequent fragmented message does not carry the TCP or UDP header, and the source port number and destination port number cannot be obtained. Among them, the IP five-tuple is the five key parameters used to identify a specific network session in network communication, which together uniquely determine a network connection. These five parameters include: Source IP address (Source IP): IP address of the device initiating the connection; Source port number (Source Port): port number used by the application on the device initiating the connection; Destination IP address (Destination IP): IP address of the device receiving the connection; Destination port number (Destination Port): port number used by the application on the device receiving the connection; Transport layer protocol (Protocol): protocol type used to transmit data, the most common of which are TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).

[0023] At present, the above problems are mainly solved by the following methods: (1) The firewall only performs ACL matching on the first fragment of the message. If the first fragment matches successfully, the subsequent fragments are allowed to pass. (2) The fragmented TCP or UDP message is re-encapsulated with the four-layer header to the non-first fragment, and the transport layer header is added to the IP payload. Taking the UDP protocol as an example, the fragment structure is as follows: Figure 7 As shown ( Figure 7 Schematic diagram of a fragmentation structure for duplicating a four-layer UDP header proposed in the prior art).

[0024] The above method has the following problems: (1) If only the first fragment is filtered, and the subsequent fragments are released after the first fragment passes, the security of the firewall will be greatly reduced. Traditional firewalls only perform ACL matching on the first fragment, and if the first fragment matches successfully, subsequent fragments are allowed to pass. It can only guarantee the compliance and security of the first fragment, and is vulnerable to attacks by maliciously constructed non-first fragments. Common fragment flood attacks are attacks on defects, which greatly reduces the security of the firewall.

[0025] (2) Adding TCP or UDP headers to fragmented messages will increase device overhead and increase the length of fragmented messages. Adding TCP or UDP headers to fragmented messages requires re-encapsulation of fragmented messages, which has high CPU overhead and reduces the forwarding efficiency of the device. At the same time, adding a four-layer header will further increase the message length, especially since the TCP header has 20 bytes, which can easily lead to secondary fragmentation after re-encapsulation, making the problem more complicated.

[0026] (3) The method of adding TCP or UDP headers to fragmented messages is essentially a four-layer analysis, which is inefficient. The method of adding TCP or UDP headers to fragmented messages adds a four-layer header to the IP payload of the fragmented message. When performing five-tuple matching, when querying the four-layer source and destination port numbers, it is still necessary to perform analysis above the IP layer, which has low forwarding efficiency and high requirements on the equipment.

[0027] Based on this, this application proposes a method for transmitting deep message fragmentation, which mainly adds 4 bytes of identifiers through the application of optional fields in the IP header, and realizes the matching of the four-layer source and destination port numbers through these identifiers. At the same time, the Decimal Offset field is defined by the transformation and application of the reserved fields in the IP header, which optimizes the current situation that the fragment offset cannot be rounded due to the change of the IP header length and the value of the MTU configuration.

[0028] See also Figure 8 , Figure 8 1 is a schematic diagram of a method for transmitting deep message fragmentation applied to a front-end gateway proposed in an embodiment of the present application, the method comprising the following steps: Step 801: fragment the original message received by the front-end gateway to obtain a first fragment message and a non-first fragment message, wherein the first fragment message includes a complete transport layer header, and the transport layer header includes a source and destination port number.

[0029] After the front-end gateway receives the original message sent from the Internet, it fragments the original message to obtain the first fragment message and the non-first fragment message. The original message may be an IP message.

[0030] It should be noted that the number of non-first fragment messages is determined according to the length of the specific original message and the MTU value of the front-end gateway interface, but there is at least one non-first fragment message.

[0031] Since only the data packets are fragmented when the message is fragmented, the first fragment of the message contains a complete transport layer header, and the transport layer header contains the source and destination port numbers. If the protocol stack type in the original message is UDP, then its transport layer header contains a UDP header. If the protocol stack type in the original message is TCP, then its transport layer header contains a TCP header, and the source and destination port numbers are included in the UDP header or the TCP header.

[0032] It should be noted that the source and destination port numbers in the embodiments of the present application are both source port numbers and destination port numbers.

[0033] Step 802: Extract the source and destination port numbers of the transport layer protocol header from the original message, and fill the source and destination port numbers into the option field of the IP header of the non-first fragment message.

[0034] When fragmenting a message, only the data packet is fragmented. After the transport layer header is given to the first fragment of the message, the non-first fragment of the message does not contain the transport layer header. When the firewall receives the non-first fragment of the message, it cannot match the IP five-tuple of the non-first fragment of the message.

[0035] Based on this, this method extracts the source and destination port numbers of the transport layer protocol header from the original message, and fills the source and destination port numbers into the option field of the IP header of the non-first fragment message, so that each non-first fragment message contains the source and destination port numbers for IP five-tuple matching. When fragmenting, only the data packets of the original message are cut. Whether the four-layer protocol header is cut off or the subsequent fragmented message does not contain the four-layer protocol header does not affect the identification of the source and destination port numbers, further realizing the firewall matching and filtering of all messages, and improving the security of message transmission.

[0036] For example, see Fig. 9 , Fig. 9 This is a schematic diagram of an IP header structure of a deep fragmentation message proposed in an embodiment of the present application. It can be seen that the header length of the original message is fixed at 20 bytes, and the structure after 20 bytes is the option field. 4 bytes are added to the Options (i.e., option field) in the IP header of the original message, of which the first 2 bytes represent the source port number (i.e., Source Port) of the four-layer protocol header, and the last 2 bytes represent the destination port number (i.e., Destination Port) of the four-layer protocol header.

[0037] Step 803: The front-end gateway sends all fragmented messages to the firewall, and the source and destination port numbers in each fragmented message are used by the firewall to perform IP quintuple matching on each fragmented message.

[0038] After the fragmentation is completed, the front-end gateway sends all the fragmented messages to the firewall. The source and destination port numbers in each fragmented message are used by the firewall to match the IP five-tuple of each fragmented message.

[0039] The present application proposes a transmission method for deep message fragmentation, which first obtains the first-fragment message and the non-first-fragment message by fragmenting the original message received by the front-end gateway, wherein the first-fragment message contains a complete transport layer header, and the transport layer header contains the source and destination port number; then, the source and destination port numbers of the transport layer protocol header are extracted from the original message, and the source and destination port numbers are filled into the option field of the IP header of the non-first-fragment message; after the fragmentation is completed, the front-end gateway sends all the fragmented messages to the firewall, and the source and destination port numbers in each fragmented message are used by the firewall to perform IP five-tuple matching on each fragmented message. This method adds a 4-byte identifier to the optional field of the IP header, and realizes the matching of the four-layer source and destination port numbers through these identifiers, realizes the precise ACL matching of the four-layer fragmented messages, solves the problem that the firewall in the existing network cannot accurately match and filter the fragmented messages, and improves the efficiency and performance of the four-layer fragmented traffic matching ACL.

[0040] Taking into account the length of the message header containing the option field and the configuration of the MTU value, the length of the original message header is fixed at 20 bytes. After the source and destination port numbers are added to the option field, the message header length becomes 24 bytes, which will cause the fragment offset of the fragment to not be an integer. The embodiment of the present application transforms and applies the reserved fields in the message header to optimize the current situation where the fragment offset cannot be rounded due to the change in the length of the original message header and the configured value of the MTU.

[0041] In an optional embodiment, the method further comprises the following steps: Step 804: Determine the DO values ​​of the first fragment message and the non-first fragment message respectively. When the DO value is a first value, it indicates that the fragment offset of the fragment message is accurate. When the DO value is a second value, it indicates that the fragment offset of the fragment message is the Offset value rounded up.

[0042] The above DO value is Decimal Offset, that is, decimal fragment offset, which is used to define whether the fragment offset of the message is an integer. For the first fragment message and the non-first fragment message, since their respective fragment offsets are different, the DO value corresponding to each fragment message may be different. Therefore, it is necessary to first determine the DO value of the first fragment message and the non-first fragment message. If the DO value is the first value, it indicates that the fragment offset of the fragment message is accurate. If the DO value is the second value, it indicates that the fragment offset of the fragment message is the Offset value rounded up. The Offset value is the value corresponding to the Fragmented Offset field (indicating the fragment offset field), with a length of 13 bits, which indicates the fragment deviation distance of this fragment from the first fragment. The unit is bytes, generally 8 bytes.

[0043] In an example, the first value may be 0. When the DO value is set to 0, it indicates that the slice offset of the slice is accurate and there is no need to round up the Offset value. The second value may be 1. When the DO value is set to 1, it indicates that the slice offset of the slice is equal to the Offset value plus 0.5 bytes, that is, the Offset value is rounded up.

[0044] It should be noted that, during the transmission of Deep IP Fragmentation (Deep IP Fragmentation), for packets without a Layer 4 protocol, this field is set to 0.

[0045] Step 805: Fill all DO values ​​into the first reserved field of the Flags field of each corresponding fragment message.

[0046] After determining the DO value of each fragment message, fill the DO value corresponding to each fragment message into the first reserved field of the Flags field of each fragment message. The specific filling position of the DO value is as follows: Fig. 9 As shown, it replaces the first reserved field (R) of the Flags field in the original message header, see Figure 4 .

[0047] In an optional implementation, the above step 804, determining the DO values ​​of the first fragment message and the non-first fragment message, further includes the following sub-steps: Step 8041: Calculate the fragment offset of the original message.

[0048] First, calculate the fragment offset of the original message. The calculation method is: subtract the message header length from the MTU value and convert it into the fragment offset value to obtain the fragment offset of the original message.

[0049] In an example, if the length of the original message is 4000 bytes, the length of the message header is 20 bytes, and the fragment offset field is 8 bytes, the fragment offset of the original message = (4000-20) / 8.

[0050] Step 8042: When the fragment offset of the original message is an integer, determine that the DO values ​​of the first fragment message and the non-first fragment message are the first value.

[0051] When the fragment offset of the original message is an integer, the DO value of the first fragment message and the non-first fragment message is determined to be the first value, indicating that in this case, the fragment offsets of all fragment messages are accurate and do not need to be rounded up, that is, rounded up by 0.5 bytes.

[0052] In an optional implementation, the above step 804, determining the DO values ​​of the first fragment message and the non-first fragment message, further includes the following sub-steps: Step 8043: Calculate the fragment offset of the original message.

[0053] The calculation of this step is the same as that of step 8041 and will not be repeated here.

[0054] Step 8044: When the fragment offset of the original message is a non-integer, determine that the DO value of the first fragment message is a first value.

[0055] When the fragment offset of the original message is a non-integer, for the first fragment message, its fragment offset is 0, so the DO value of the first fragment message is determined as the first value, indicating that the fragment offset of the first fragment message is accurate and does not need to be rounded up.

[0056] Step 8045: Calculate the fragment offset of the non-first fragment message.

[0057] When the fragment offset of the original message is non-integer, the fragment offset of the non-first fragment message may be an integer or a non-integer. Based on this, the fragment offset of each non-first fragment message is calculated. Since the option field is added to the message header of the non-first fragment message, that is, the message header length of the non-first fragment message is now 24 bytes, when calculating the fragment offset of the non-first fragment message, it is necessary to subtract 24 bytes from the MTU value and then convert it into the value after the fragment offset.

[0058] In an example, if the length of the original message is 4000 bytes, the MTU value is 1500 bytes, the fragment offset field is 8 bytes, the length of the first fragment message is 1500 bytes = 20 bytes + 1480 bytes, and the length of the second fragment message is 1500 bytes = 24 bytes + 1476 bytes, and its fragment offset = (1500-24) / 8.

[0059] Step 8046: When the fragment offset of the non-first fragment message is a non-integer, determine that the DO value of the non-first fragment message is a second value; When the fragment offset of the non-first fragment message is a non-integer, the DO value of the non-first fragment message is the second value, indicating that the fragment offset of the non-first fragment message needs to be rounded up.

[0060] In an example, if the length of the original message is 4000 bytes = 20 bytes + 3980 bytes, the MTU value is 1500 bytes, the fragment offset field is 8 bytes, the length of the first fragment message is 1500 bytes = 20 bytes + 1480 bytes, the length of the second fragment message is 1500 bytes = 24 bytes + 1476 bytes, its fragment offset = (1500-24) / 8 = 185, the length of the third fragment message is 1048 bytes = 24 bytes + 1024 bytes, its fragment offset = (1480+1476) / 8 = 369.5. The fragment offset of the third fragment message is a non-integer and needs to be rounded up, that is, 370.

[0061] Step 8047: When the fragment offset of the non-first fragment message is an integer, determine that the DO value of the non-first fragment message is a first value.

[0062] When the fragment offset of the non-first fragment message is an integer, the DO value of the non-first fragment message is the first value, indicating that the fragment offset of the non-first fragment message is accurate and does not need to be rounded up. Based on the above example, the fragment offset of the second fragment message is 185, which is an integer and does not need to be rounded up.

[0063] For example, after the gateway device turns on the DIF (Deep IP Fragmentation) function, when fragmenting the TCP or UDP packet sent, assuming that the length of the IP packet is 4000 bytes and the MTU value is 1500, the fragmentation calculation process is shown in Table 1. The length of data packet fragment 1 is 1500 bytes, DO=0, MF=1, DF=0, Offset=0. The length of the second fragment is 1500 bytes, DO=0, MF=1, DF=0, Offset=185. The length of the third fragment is 1048 bytes, DO=1, MF=0, DF=0, Offset=370.

[0064] Table 1 Example of calculating the fragment offset of an IP packet with the DIF function enabled

[0065] Data message fragment 1 is fragmented normally. In the IP header of data message fragment 1, MF=1, DF=0, Offset=0, and the transport layer header is included in the IP data packet. The IP header of data message fragment 2 becomes 24 bytes, and a 4-byte Option field is added. This Option field extracts the source and destination port numbers of the transport layer protocol header from the original message, and fills the source and destination port numbers into the end of the IP header. In data message fragment 2, MF=1, DF=0, and Offset (fragment offset) is calculated by MTU, and the DO position is set to 1 based on whether Offset is a decimal. Subsequent fragments are consistent with data message fragment 2. The IP header contains the source and destination port numbers of the four-layer protocol, and the DO value is set to 1 according to the MTU value. For example, taking the UDP message of data message fragment 3, as shown Fig.10 As shown ( Fig.10 It is a schematic diagram of the IP message fragmentation structure of a deep fragmented message proposed in an embodiment of the present application), the IP message fragmentation structure after the device turns on the DIF function, only the data message fragment 1 has a complete UDP header, the UDP source and destination port numbers of subsequent fragments are mapped to the Option field of the IP header, and the DO bit is assigned according to the actual situation.

[0066] Based on the above embodiment, the method further includes the following steps: Step 806: Determine whether the length of the original message is greater than the MTU value configured for the interface of the front-end gateway.

[0067] When the front-end gateway receives the original message, it first determines whether the length of the original message is greater than the MTU value based on the MTU value configured on the interface of the front-end gateway. If the length of the original message is less than the MTU value, no fragmentation is required and it is directly forwarded to the next normal node.

[0068] Step 807: When the length of the original message is greater than the MTU value configured for the interface of the front-end gateway, determine whether the protocol stack type of the IP header of the original message is TCP or UDP.

[0069] When the length of the original message is greater than the MTU value configured on the interface of the front-end gateway, the protocol stack type of the IP header of the original message is determined. If the protocol stack type of the IP header of the original message is not TCP or UDP, the original message is fragmented normally without adding the source and destination port numbers after the message header.

[0070] Step 808: When the protocol stack type of the IP header of the original message is TCP or UDP, determine whether the fragment offset of the original message is an integer.

[0071] When the protocol stack type of the IP header of the original message is TCP or UDP, it is calculated whether the fragment offset of the original message is an integer, and the original message is processed differently based on this.

[0072] See also Fig.11 , Fig.11 This is a flow chart of a transmission method for deep message fragmentation applied to a front-end gateway proposed in an embodiment of the present application. After the front-end gateway device protocol stack receives an IP message, it first checks whether the length of the IP message is greater than the MTU value of the gateway interface. If not, it is forwarded normally to the next node. If it is greater than the MTU value, continue to judge. Check whether the protocol stack type in the IP header is TCP or UDP. If not, the fragmentation process is performed normally. If it is a TCP or UDP message, continue to judge. The value converted to the fragment offset after subtracting the IP header length from the MTU value. Determine whether the value is an integer. If not, the IP data packet is fragmented, the first fragment is fragmented normally and the DO value is set to 0. The other fragments transform the IP header, extract the source and destination port numbers of the four-layer protocol in the original message, and add them to the last 4 bytes of the IP header as the Option field. At the same time, the fragment offset is calculated. If it is a non-integer, the DO value is set to 1, and the Offset value is rounded down and up. The rest of the fragmentation process is consistent with the original fragmentation process. If it is an integer, the IP data packet is fragmented. The first fragment is fragmented normally and the DO value is set to 0. The other fragments modify the IP header, extract the source and destination port numbers of the four-layer protocol in the original message, and add them to the last 4 bytes of the IP header as the Option field. The rest of the fragmentation process is consistent with the original fragmentation process, and the DO value is set to 0. After the fragmentation process is completed, it is forwarded to the next node.

[0073] The method proposed in this application solves the problem that it is difficult to match IP quintuples in layer-4 fragmented messages, while not increasing CPU overhead and improving the efficiency and performance of matching ACLs.

[0074] See also Fig.12 , Fig.12 The present invention is a flowchart of a method for transmitting deep message fragments applied to a firewall, which is proposed in an embodiment of the present invention. The method comprises the following steps: Step 1201: Receive a message sent by a front-end gateway.

[0075] After the front gateway deeply fragments all the original messages, it transmits them to the next normal node, receives all the messages sent by the front gateway, and parses the messages to match and filter them.

[0076] Step 1202: When the message is not the first fragment message, the source and destination port numbers are obtained from the option field of the IP header of the message.

[0077] When the message is not the first fragment message, it indicates that the source and destination port numbers of the message need to be obtained from the option field of the IP header of the message.

[0078] Step 1203: Match the quintuple of the non-first fragment message based on the source and destination port numbers.

[0079] Based on the source and destination port numbers obtained from the option field of the IP header of the message, the five-tuple of the non-first fragment message is matched to achieve matching and filtering of the message.

[0080] In an optional embodiment, the method further comprises the following steps: Step 1204: When the message is the first fragment message, obtain the source and destination port numbers from the transport layer header of the message.

[0081] When the message is the first fragment message, it indicates that the source and destination port numbers of the message need to be obtained from the transport layer header of the message.

[0082] Step 1205: Based on the source and destination port numbers, the firewall matches the quintuple of the first packet.

[0083] Based on the source and destination port numbers obtained from the transport layer header of the message, the firewall matches the five-tuple of the first message to achieve matching and filtering of the message.

[0084] Based on the above embodiment, the method comprises the following steps: Step 1206: Determine whether the protocol stack type in the IP header of the message is TCP or UDP.

[0085] Before obtaining the source and destination port numbers, the firewall first determines whether the protocol stack type in the IP header of the message is TCP or UDP. If it is not TCP or UDP, the source and destination port numbers are obtained from the transport layer header of the message to enable the firewall to match and filter the message.

[0086] Step 1207: When the protocol stack type in the IP header of the message is TCP or UDP, determine whether the message is a fragmented message.

[0087] When the protocol stack type in the IP header of the message is TCP or UDP, determine whether the message is a fragmented message by parsing the MF and Offset of the message. When MF=1 and Offset is not empty, the message is considered to be a fragmented message. If the message is not a fragmented message, obtain the source and destination port numbers from the transport layer header of the message to enable the firewall to match and filter the message.

[0088] Step 1208: When the message is a fragmented message, determine whether the message is a first fragment message.

[0089] When the message is a fragmented message, whether the message is the first fragment message can be determined by parsing the MF and Offset of the message. When MF=1 and Offset=0, the message is considered to be the first fragment message.

[0090] See also Fig.13 , Fig.13 It is a flow chart of a transmission method for deep message fragmentation applied to a firewall proposed in an embodiment of the present application. After the firewall receives the IP message sent by the front gateway, it checks whether the protocol stack type in the IP header is TCP or UDP. If not, when filtering the message, it is matched and filtered normally based on the IP five-tuple. The source and destination port number of the four-layer protocol is obtained from the four-layer message header. If it is a TCP or UDP message, continue to judge. Determine whether the IP message is a fragmented message (MF=1 and Offset is not empty). If not, when filtering the message, it is matched and filtered normally based on the IP five-tuple. The source and destination port number of the four-layer protocol is obtained from the four-layer message header. If it is a fragmented message, continue to judge. Determine whether the message is the first fragment in the fragmented message (MF=1, Offset=0). If it is the first fragmented message, when filtering the message, it is matched and filtered normally based on the IP five-tuple. The source and destination port number of the four-layer protocol is obtained from the four-layer message header. If it is not the first fragment message, when filtering the message, it is matched and filtered normally based on the IP five-tuple. The source and destination port numbers of the four-layer protocol are obtained by parsing the Option field in the IP header. After filtering through the firewall, the message is forwarded normally to the next node.

[0091] See also Fig.14 , Fig.14 1 is a schematic diagram of a module of a transmission device for deep message fragmentation applied to a front-end gateway proposed in an embodiment of the present application, the device comprising: The fragmentation module 1401 is used to fragment the original message received by the front gateway to obtain the first fragment message and the non-first fragment message, wherein the first fragment message contains a complete transport layer header, and the transport layer header contains the source and destination port numbers; The first filling module 1402 is used to extract the source and destination port numbers of the transport layer protocol header from the original message, and fill the source and destination port numbers into the option field of the IP header of the non-first fragment message; The transmission module 1403 is used for the front gateway to send all the fragmented messages to the firewall, and the source and destination port numbers in each fragmented message are used by the firewall to perform IP quintuple matching on each fragmented message.

[0092] Wherein, the device further comprises: A first determination module is used to determine the DO value of each of the first fragment message and the non-first fragment message, where the DO value is a first value, indicating that the fragment offset of the fragment message is accurate; and the DO value is a second value, indicating that the fragment offset of the fragment message is an Offset value rounded up; The second filling module is used to fill all DO values ​​into the first reserved field of the Flags field of each corresponding fragment message.

[0093] Wherein, the determination module includes: A first calculation submodule, used to calculate the fragment offset of the original message; The first determining submodule is used to determine that the DO values ​​of the first fragment message and the non-first fragment message are first values ​​when the fragment offset of the original message is an integer.

[0094] Wherein, the determination module further includes: A second calculation submodule, used to calculate the fragment offset of the original message; A second determining submodule, configured to determine, when the fragment offset of the original message is a non-integer, that the DO value of the first fragment message is a first value; A third calculation submodule, used to calculate the fragment offset of the non-first fragment message; A third determining submodule, configured to determine, when the slice offset of the non-first slice message is a non-integer, that the DO value of the non-first slice message is a second value; The fourth determining submodule is used to determine that the DO value of the non-first fragment message is a first value when the fragment offset of the non-first fragment message is an integer.

[0095] Wherein, the device further comprises: A second determination module is used to determine whether the length of the original message is greater than the MTU value configured by the interface of the front gateway; A third determination module is used to determine whether the protocol stack type of the IP header of the original message is TCP or UDP when the length of the original message is greater than the MTU value configured by the interface of the front gateway; The fourth determination module is used to determine whether the fragment offset of the original message is an integer when the protocol stack type of the IP header of the original message is TCP or UDP.

[0096] See also Fig.15 , Fig.15 1 is a schematic diagram of a module of a deep message fragmentation transmission device applied to a firewall proposed in an embodiment of the present application, the device comprising: The receiving module 1501 is used to receive the message sent by the front-end gateway; The first acquisition module 1502 is used to acquire the source and destination port numbers from the option field of the IP header of the message when the message is not the first fragment message; The first matching module 1503 is used to match the quintuple of the non-first fragment message based on the source and destination port numbers.

[0097] Wherein, the device further comprises: A second acquisition module is used to acquire the source and destination port numbers from the transport layer header of the message when the message is the first fragment message; The second matching module is used for the firewall to match the five-tuple of the first packet based on the source and destination port numbers.

[0098] Wherein, the device further comprises: A fifth determination module, used to determine whether the protocol stack type in the IP header of the message is TCP or UDP; A sixth determination module, configured to determine whether the message is a fragmented message when the protocol stack type in the IP header of the message is TCP or UDP; The seventh determination module is used to determine whether the message is a first-fragment message when the message is a fragment message.

[0099] Based on the same application concept, an embodiment of the present application also discloses an electronic device, which includes: a memory and a processor. The memory of the electronic device is not less than 12G, the main frequency of the processor is not less than 2.4GHz, the memory and the processor are connected through a bus communication, and a computer program is stored in the memory. The computer program can be run on the processor to implement a deep message fragmentation transmission method disclosed in an embodiment of the present application.

[0100] Based on the same application concept, an embodiment of the present application further discloses a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, a deep message fragmentation transmission method disclosed in an embodiment of the present application is implemented.

[0101] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0102] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices, electronic devices, and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0103] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0104] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0105] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0106] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0107] The above is a detailed introduction to the transmission method and device of deep message fragmentation provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for transmitting deep message fragments, characterized in that: Applied to a front-end gateway, the method includes: Segmenting the original message received by the front-end gateway to obtain a first-segment message and a non-first-segment message, wherein the first-segment message includes a complete transport layer header, and the transport layer header includes a source and destination port number; Extracting the source and destination port numbers of the transport layer protocol header from the original message, and filling the source and destination port numbers into the option field of the IP header of the non-first fragment message; The front gateway sends all fragmented messages to the firewall, and the source and destination port numbers in each fragmented message are used by the firewall to perform IP quintuple matching on each fragmented message.

2. The method for transmitting deep message fragments according to claim 1, characterized in that: The method further comprises: Determine the DO value of each of the first fragment message and the non-first fragment message, when the DO value is the first value, it indicates that the fragment offset of the fragment message is accurate, and when the DO value is the second value, it indicates that the fragment offset of the fragment message is the Offset value rounded up; Fill all DO values ​​into the first reserved field of the Flags field of each corresponding fragment message.

3. The method for transmitting deep message fragments according to claim 2, characterized in that: Determining the DO values ​​of the first-piece message and the non-first-piece message respectively includes: Calculating the fragment offset of the original message; When the fragment offset of the original message is an integer, the DO values ​​of the first fragment message and the non-first fragment message are determined to be the first value.

4. The method for transmitting deep message fragments according to claim 2, characterized in that: Determining the DO values ​​of the first-piece message and the non-first-piece message respectively includes: Calculating the fragment offset of the original message; When the fragment offset of the original message is a non-integer, determining the DO value of the first fragment message to be a first value; Calculating the fragment offset of the non-first fragment message; When the fragment offset of the non-first fragment message is a non-integer, determining the DO value of the non-first fragment message to be a second value; When the fragment offset of the non-first fragment message is an integer, the DO value of the non-first fragment message is determined to be a first value.

5. The method for transmitting deep message fragments according to claim 3 or 4, characterized in that: The method further comprises: Determine whether the length of the original message is greater than the MTU value configured by the interface of the front gateway; When the length of the original message is greater than the MTU value configured by the interface of the front gateway, determining whether the protocol stack type of the IP header of the original message is TCP or UDP; When the protocol stack type of the IP header of the original message is TCP or UDP, it is determined whether the fragment offset of the original message is an integer.

6. A method for transmitting deep message fragments, characterized in that: Applied to a firewall, the method comprises: Receive messages sent by the front-end gateway; When the message is not the first fragment message, obtaining the source and destination port numbers from the option field of the IP header of the message; Based on the source and destination port numbers, the quintuple of the non-first fragment message is matched.

7. The method for transmitting deep message fragments according to claim 6, characterized in that: The method comprises: When the message is a first-fragment message, obtaining source and destination port numbers from a transport layer header of the message; Based on the source and destination port numbers, the firewall matches the quintuple of the first packet.

8. The method for transmitting deep message fragments according to claim 6 or 7, characterized in that: The method comprises: Determine whether the protocol stack type in the IP header of the message is TCP or UDP; When the protocol stack type in the IP header of the message is TCP or UDP, determining whether the message is a fragmented message; In the case that the message is a fragmented message, it is determined whether the message is a first fragment message.

9. A transmission device for deep message fragmentation, characterized in that: Applied to a front-end gateway, the device comprises: A fragmentation module, used for fragmenting the original message received by the front gateway to obtain a first fragment message and a non-first fragment message, wherein the first fragment message contains a complete transport layer header, and the transport layer header contains a source and destination port number; A first filling module is used to extract the source and destination port numbers of the transport layer protocol header from the original message, and fill the source and destination port numbers into the option field of the IP header of the non-first fragment message; The transmission module is used for the front gateway to send all fragmented messages to the firewall, and the source and destination port numbers in each fragmented message are used by the firewall to perform IP quintuple matching on each fragmented message.

10. A transmission device for deep message fragmentation, characterized in that: Applied to a firewall, the device comprises: A receiving module, used for receiving messages sent by the front-end gateway; A first acquisition module, used for acquiring source and destination port numbers from an option field of an IP header of the message when the message is not a first fragment message; The first matching module is used to match the quintuple of the non-first fragment message based on the source and destination port numbers.

Images