Packet forwarding method and apparatus

Abstract

The application provides a message forwarding method and device. In the embodiment, a head node respectively issues an SRv6TE Policy source path route and a source path control probe message to other nodes on a current path, so as to trigger the other nodes on the current path to generate a source path control table. The source path control table contains routing and forwarding information that nodes on a path of an existing SRv6TE Policy do not care about before, so as to inhibit a risk vulnerability caused by the fact that the nodes on the path of the existing SRv6TE Policy do not care about the routing and forwarding information, and improve the security of an SRv6 network.

Description

TECHNICAL FIELD

[0001] The present application relates to network communication Internet of Things, in particular to a message forwarding method and device. BACKGROUND

[0002] In an IPv6 segment routing (SRv6: Segment Routing IPv6) network, a SRv6 traffic engineering policy (TEPolicy: Segment Routing Traffic Engineering Policy) provides a flexible forwarding path selection method, which can meet different forwarding requirements of users. Reasonably using the SRv6 TEPolicy to select a forwarding path can not only facilitate administrators to manage and plan the network, but also effectively reduce the forwarding pressure of network devices.

[0003] However, in specific applications, the security of the SRv6 network is often challenged. For example, for a service in the SRv6 network, each node on the transmission path included in the SRv6 TEPolicy of the service, except the head node, only cares about the destination address of the received message and the Segment List in the SRv6 message header (SRH: Segment Routing Header) carried by the message, to guide the forwarding behavior of the message based on the Segment List. The above-mentioned each node, except the head node, does not care about the routing forwarding information such as the interface (referred to as the message entry interface) on which the message is received, the source address carried by the message, and whether the Segment List carried in the SRH header is correct, which is equivalent to a risk vulnerability. Once a network attacker seizes the risk vulnerability to attack, for example, the network attacker can attack any interface of a node after knowing the SID configuration of the node, which will cause the attack message to enter the SRv6 network, affecting the security of the SRv6 network. SUMMARY

[0004] The embodiments of the present application provide a message forwarding method and device to improve the security of the SRv6 network and effectively prevent attack messages from entering the SRv6 network.

[0005] The embodiments of the present application provide a message forwarding method, which is applied to a network node, and the method comprises:

[0006] The network node, as a head node of an SRv6 traffic engineering policy (TE Policy), sends an SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy, the SRv6 TE Policy source path route carrying first routing information for forwarding a packet on the current path, so that any node on the current path except the head node records the first routing information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route;

[0007] The network node, as the head node, sends a source path control probe packet for probing the current path to other nodes on the current path; the source path control probe packet carries second routing information for forwarding a packet on the current path, so that any node on the current path except the head node generates a source path control table with the first routing information matching when the second routing information carried by the source path control probe packet matches the recorded first routing information; and any node on the current path except the head node controls forwarding of a received service packet based on the generated source path control table.

[0008] Embodiments of the present application provide a packet forwarding method, which is applied to a network node, and the method comprises:

[0009] If the network node is any node on the current path except the head node of the SRv6 TE Policy, then:

[0010] The head node receiving an SRv6 TE Policy source path route sent by the network node for a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carrying first routing information for forwarding a packet on the current path;

[0011] Identifying whether the node is on the current path, and if yes, recording the first routing information carried by the SRv6 TE Policy source path route;

[0012] Receiving a source path control probe packet sent by the head node; the source path control probe packet carrying second routing information for forwarding a packet on the current path; and if it is identified that the second routing information carried by the source path control probe packet matches the recorded first routing information, generating a source path control table with the first routing information matching;

[0013] Controlling forwarding of a received service packet based on the source path control table.

[0014] The embodiment of the present application provides a message forwarding device, which is applied to a network node, the network node serving as a head node of an SRv6 traffic engineering policy (TE Policy), and the device comprises the following:

[0015] a first sending unit configured to send an SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy, the SRv6 TE Policy source path route carrying first routing information used for forwarding a message of the current path, so that any node on the current path except the head node records the first routing information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route;

[0016] a second sending unit configured to send a source path control probe message used for probing the current path to the other nodes on the current path, the source path control probe message carrying second routing information used for forwarding a message of the current path, so that any node on the current path except the head node generates a source path control table with the first routing information matched when the second routing information carried by the source path control probe message matches the recorded first routing information, and the any node on the current path except the head node is configured to perform forwarding control on a received service message based on the generated source path control table.

[0017] The embodiment of the present application provides a message forwarding device, which is applied to a network node, the network node serving as a head node of an SRv6 traffic engineering policy (TE Policy), and the device comprises the following:

[0018] a receiving unit configured to receive an SRv6 TE Policy source path route sent by a head node of an SRv6 TE Policy to a current path included in the SRv6 TE Policy, the SRv6 TE Policy source path route carrying first routing information used for forwarding a message of the current path;

[0019] a routing unit configured to identify whether the node is on the current path, and if yes, record the first routing information carried by the SRv6 TE Policy source path route;

[0020] the receiving unit is further configured to receive a source path control probe message sent by the head node, the source path control probe message carrying second routing information used for forwarding a message of the current path;

[0021] a processing unit, configured to generate a source path control table in which the first route information matches, if it is identified that the second route information carried by the source path control probe packet matches the recorded first route information;

[0022] a service control unit, configured to perform forwarding control on a service packet received by the node based on the source path control table, so as to suppress network attacks.

[0023] Embodiments of the present application also provide an electronic device. The electronic device comprises a processor and a machine readable storage medium;

[0024] The machine readable storage medium stores machine executable instructions capable of being executed by the processor;

[0025] The processor is configured to execute the machine executable instructions to implement the steps of the method disclosed above.

[0026] As can be seen from the above technical solutions, in the embodiments, the head node respectively issues SRv6 TE Policy source path route and source path control probe packet to other nodes on the current path, so as to trigger other nodes on the current path to generate a source path control table, and the source path control table contains route forwarding information that nodes on the path of the existing SRv6 TE Policy do not care about before, so as to suppress the risk vulnerability caused by the fact that the nodes on the path of the existing SRv6 TE Policy do not care about the route forwarding information, and improve the security of the SRv6 network. BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, further serve to explain the principles of the present disclosure.

[0028] Figure 1 A method flowchart provided for embodiments of the present application;

[0029] Figure 2 Another method flowchart provided for embodiments of the present application;

[0030] Figures 3 to 8 A schematic diagram provided for embodiments of the present application;

[0031] Figure 9 An apparatus structure diagram provided for embodiments of the present application;

[0032] Figure 10 Another apparatus structure diagram provided for embodiments of the present application;

[0033] Figure 11 An electronic device structure diagram provided for embodiments of the present application. DETAILED DESCRIPTION

[0034] In order to better understand the technical solutions provided by the embodiments of the present application, and to make the above-mentioned purposes, features and advantages of the embodiments of the present application more apparent and easy to understand, the technical solutions in the embodiments of the present application will be further described in detail below with reference to the drawings.

[0035] The method provided by the embodiments of the present application will be described below taking a head node (Headend) applied to an SRv6 TE Policy as an example.

[0036] Referring to Figure 1 , Figure 1 The method flowchart provided by the embodiments of the present application. The method is applied to a network node in an SRv6 network.

[0037] As shown in Figure 1 , the flowchart can include the following steps:

[0038] Step 101, the network node, as a head node of an SRv6 TE Policy, sends an SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy.

[0039] In a specific application, one SRv6 TE Policy can include multiple paths with different priorities. As an embodiment, the current path here can be a usable path in the SRv6 TE Policy determined based on service requirements (also referred to as the primary path of the service).

[0040] In the present embodiment, the SRv6 TE Policy source path route carries first routing information used for forwarding a message of the current path. Optionally, the first routing information here can include a Router ID of the head node, a source IPv6 address used by the head node for SRv6 encapsulation, and a Segment List of the current path. Here, the Segment List of the current path contains the SID of each node on the current path except the head node.

[0041] When the head node sends the SRv6 TE Policy source path route to other nodes on the above-mentioned current path, any node on the current path except the above-mentioned head node will record the first routing information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route, as shown in the flowchart below. Figure 2

[0042] ​At step 102, the network node as the head node sends a source path control probe packet for probing the current path to other nodes on the current path; the source path control probe packet carries second routing information for forwarding packets on the current path, so that any node on the current path except the head node generates a source path control table with the first routing information matching when the second routing information carried by the source path control probe packet matches the recorded first routing information, and controls forwarding of received service packets based on the generated source path control table.

[0043] If the first routing information includes the RouterID of the head node, the source IPv6 address of the head node for SRv6 encapsulation, and the Segment List of the current path (containing the SID of each node on the current path except the head node), as an embodiment, the second routing information can also include the RouterID of the head node, the source IPv6 address of the head node for SRv6 encapsulation, and the Segment List of the current path, which contains the SID of each node on the current path except the head node.

[0044] As an embodiment, to ensure that the source path control probe packet carries the second routing information described above, in this embodiment, the source path control probe packet can encapsulate an IPv6 basic header, an SRv6 packet header (SRH: Segment Routing Header) and a RouterID header.

[0045] The IPv6 basic header at least contains a source address field, which carries the source IPv6 address of the head node for SRv6 encapsulation.

[0046] The SRH at least includes a Routing Type field, a Next Header field and a Segment List field. The Routing Type field carries a first value such as 254, which is used to indicate that the packet is a source path control probe packet. The Next Header field carries a second value such as 254, which is used to indicate that the next packet header of the SRH carries the RouterID of the head node. The Segment List field carries the Segment List of the current path, which includes the SID of each node on the current path except the head node.

[0047] The RouterID header carries the RouterID of the head node.

[0048] Based on this, it can be seen that the second routing information includes the RouterID of the head node carried by the RouterID header, the Segment List carried by the Segment List field, and the source IPv6 address carried by the source address field.

[0049] As for any node on the current path except the head node, how to identify that the second routing information carried by the source path control probe packet matches the recorded first routing information will be described below by way of example, and will not be described here in detail. If any node on the current path except the head node identifies that the second routing information carried by the source path control probe packet matches the recorded first routing information, a source path control table in which the first routing information matches will be generated.

[0050] As an embodiment, the source path control table here may, for example, include routing forwarding information that nodes on the path of the existing SRv6 TE Policy did not care about before, such as whether the source IPv6 address of the head node is correct, whether the Segment List is correct, and the like. According to this embodiment, by recording the routing forwarding information that nodes on the path of the existing SRv6 TE Policy did not care about before in the source path control table, the source path control table can be used to control the forwarding of received service packets, so as to suppress the risk vulnerability caused by the fact that nodes on the path of the existing SRv6 TE Policy do not care about the above routing forwarding information, effectively prevent message impersonation into the SRv6 network, suppress network attacks, and improve the security of the SRv6 network. This will be described below by way of example, and will not be described here in detail.

[0051] At this point, the process shown in Figure 1 is completed.

[0052] The method provided by the embodiments of the present application will be described below from the perspective of any node on the current path except the head node included in the SRv6 TE Policy:

[0053] Referring to Figure 2 , Figure 2 is another method flowchart provided by the embodiments of the present application. The method is applied to any node on the current path except the head node.

[0054] As shown in Figure 2 , the flowchart may include the following steps:

[0055] Step 201, the head node receiving the SRv6 TE Policy sends the SRv6 TE Policy source path route for the current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries the first routing information for forwarding the message of the current path.

[0056] This step 201 corresponds to the above step 101.

[0057] Step 202, identify whether the current node is in the current path, if yes, record the first routing information carried by the SRv6 TE Policy source path route.

[0058] As an embodiment, the first routing information at least includes: Segment List. Segment List contains the SID of each node on the current path except the head node. Based on this, in this step 202, identifying whether the current node is in the current path includes: identifying whether the SID of the current node is in the Segment List, if yes, determining that the current node is in the current path, otherwise, determining that the current node is not in the current path.

[0059] Optionally, if the current node is not in the current path, the received SRv6 TE Policy source path route can be ignored.

[0060] Step 203, receiving the source path control probe message sent by the above head node; the source path control probe message carries the second routing information for forwarding the message of the current path, if it is identified that the second routing information carried by the source path control probe message matches the first routing information recorded, generating the source path control table matched with the first routing information.

[0061] This step 203 corresponds to the above step 102.

[0062] Specifically, in this step 203, receiving the source path control probe message sent by the head node for detecting the current path includes: receiving the message sent by the head node; if the message type carried by the message is the first value, the first value is used to indicate the source path control probe message, it is determined that the source path control probe message sent by the head node is received.

[0063] As an embodiment, the received source path control probe message here encapsulates the IPv6 basic header, SRv6 message header SRH, and RouterID header.

[0064] Among them, the IPv6 basic header at least contains the source address field. The source address field carries the source IPv6 address used by the head node for SRv6 encapsulation.

[0065] The SRH at least includes a Routing Type field, a Next Header field, and a Segment List field.

[0066] As an embodiment, the Routing Type field carries a first value, and the first value is used to indicate the source path control probe packet. Based on this, when it is identified that the Routing Type field carries the first value, it is determined that the packet is the source path control probe packet. The Next Header field carries a second value such as 254. The second value such as 254 is used to indicate that the next packet header of the SRH carries the RouterID of the head node. The Segment List field carries the Segment List of the current path, and the Segment List includes the SIDs of each node on the current path except the head node.

[0067] The RouterID header carries the RouterID of the head node.

[0068] Based on the above description of the source path control probe packet, in this embodiment, the second routing information at least includes the RouterID of the head node carried by the RouterID header, the Segment List carried by the Segment List field, and the source IPv6 address carried by the source address field.

[0069] Based on this, in the above step 203, identifying whether the second routing information carried by the source path control probe packet and the recorded first routing information match can include:

[0070] determining whether the RouterID carried by the source path control probe packet and the RouterID in the recorded first routing information meet a first set matching requirement, whether the source IPv6 address carried by the source path control probe packet and the source IPv6 address in the recorded first routing information meet a second set matching requirement, and whether the Segment List carried by the source path control probe packet and the Segment List in the recorded first routing information meet a third set matching requirement, and if all of them meet, determining that the second routing information carried by the source path control probe packet and the recorded first routing information match, otherwise, determining that the second routing information carried by the source path control probe packet and the recorded first routing information do not match.

[0071] Optionally, the first set matching requirement, the second set matching requirement, and the third set matching requirement can be the same, such as equal, or the degree of approximation meets a set requirement, and this embodiment does not specifically limit.

[0072] In the embodiment, the IPv6 basic header further includes a destination address field; and the SRH further includes an SL field carrying an SL. Here, the SL indicates the number of remaining SIDs in the Segment List, where the remaining SIDs refer to the SIDs corresponding to the segments of the nodes that the source path control probe packet has not yet passed through.

[0073] Based on this, as an embodiment, the source path control table matched by the first routing information at least includes: an interface receiving the source path control probe packet, a source IPv6 address carried by the source address field, a destination address carried by the destination address field, a Segment List carried by the source path control probe packet, and the SL.

[0074] It should be noted that, in the flow shown in Figure 2 In the flow shown in FIG. 6, for any node on the current path except the head node, if it is found that the node is not the last node on the current path (for example, if the SL is not 0, it is determined that the node is not the last node on the current path), the source path control probe packet is modified and continues to be forwarded as follows: the destination address field in the source path control probe packet is modified to the node identifier of the next node after the current node on the current path, and the number in the SL field is updated, and the updated number is 1 less than the number before the update.

[0075] In step 204, the service packet received by the node is controlled based on the source path control table.

[0076] Based on the source path control table, in step 204, the service packet received by the node is controlled based on the source path control table. The control can include: checking whether the interface receiving the service packet, the source IPv6 address encapsulated by the service packet, the destination address, the Segment List encapsulated by the service packet, and the SL match the incoming interface, the source IPv6 address, the destination address, the Segment List, and the SL in the source path control table respectively, if yes, continue to forward the service packet, if no, discard the service packet.

[0077] According to the forwarding process of the existing SRv6 TE Policy, the network nodes on the path included in the SRv6 TE Policy do not pay attention to whether the message entry interface is correct, whether the message source address is correct, whether the Segment List carried in the SRH header is correct and other routing forwarding information when receiving the service message, but directly perform forwarding based on the Segment List in the service message. However, in the embodiment, when receiving the service message, the Segment List and the SL in the service message are not directly used for forwarding, but the message entry interface is first paid attention to, whether the message source address is correct, whether the destination address is correct, and whether the Segment List carried in the SRH header is correct, which avoids the risk vulnerability caused by not paying attention to these information in the prior art, and ensures the security of the SRv6 network.

[0078] The method provided by the embodiments of the application is described above, and the application is described below through a specific embodiment:

[0079] Applied to Figure 3 As shown in the SRv6 network, taking the current path of the SRv6 TE Policy as the following path (denoted as path 1) for example: A node -> B node -> D node, the A node is taken as a head node, and the SRv6 TE Policy source path routing is published.

[0080] Optionally, in the embodiment, the SRv6 TE Policy source path routing can be published by extending the BGP to define the SRv6 TE Policy source path routing address family (Source Path Address Family). Taking the SRv6 TE Policy source path routing address family defined by extending the BGP as an example, the A node, the B node, the C node and the D node in the SRv6 network shown in the figure will establish a BGP neighbor with the BGP route reflector (not shown), the A node will publish the SRv6 TE Policy source path routing to the BGP route reflector, and the BGP route reflector will publish the SRv6 TE Policy source path routing to all other BGP neighbors. Figure 3 Figure 3 The A node, the B node, the C node and the D node in the SRv6 network shown in the figure will establish a BGP neighbor with the BGP route reflector (not shown), the A node will publish the SRv6 TE Policy source path routing to the BGP route reflector, and the BGP route reflector will publish the SRv6 TE Policy source path routing to all other BGP neighbors.

[0081] As an embodiment, the SRv6 TE Policy source path routing published by the A node includes the following first routing information: the RouterID of the A node, the source IPv6 address of the A node used for SRv6 encapsulation, and the Segment list of the path 1 in the SRv6 TE Policy configured by the A node (here, the Segment list is specifically: <21::1, 41::1). Figure 3 ​SRv6 TE Policy source-path route is also exemplified.

[0082] After any node in the SRv6 network receives the SRv6 TE Policy source-path route, it judges whether the Segment list carried by the SRv6 TE Policy source-path route contains the SID of the node. If yes, it generates a local source-path routing table. The local source-path routing table records the first routing information carried by the SRv6 TE Policy source-path route: the RouterID of the head node, the source IPv6 address of the head node for SRv6 encapsulation, and the Segment list of path 1 in the SRv6 TE Policy configured by the head node (<21::1, 41::1). As shown in the B node and the D node, after receiving the SRv6 TE Policy source-path route, they find that the Segment list carried by the SRv6 TE Policy source-path route contains the SID of the node, and then generate a local source-path routing table. Figure 4

[0083] Of course, after any node in the SRv6 network receives the SRv6 TE Policy source-path route, if it judges that the Segment list carried by the SRv6 TE Policy source-path route does not contain the SID of the node, it does not process the SRv6 TE Policy source-path route. As shown in the C node, it judges that the Segment list carried by the SRv6 TE Policy source-path route does not contain the SID of the node, and then does not process the SRv6 TE Policy source-path route. Figure 4

[0084] As the head node, the A node confirms that the SRv6 TE Policy source-path route it publishes has reached all other nodes on path 1, and then sends a source-path control probe packet to all other nodes on path 1. As shown in the figure, in this embodiment, the A node can confirm that the SRv6 TE Policy source-path route it publishes has reached all other nodes on path 1 through time. For example, according to experience, a set time length is determined, and the A node determines that the SRv6 TE Policy source-path route it publishes has reached all other nodes on path 1 after the set time length from publishing the SRv6 TE Policy source-path route. Figure 5

[0085] In this embodiment, the source-path control probe packet encapsulates an IPv6 basic header, an SRv6 packet header SRH, and a RouterID header.

[0086] ​​​The IPv6 basic header at least includes a source address field and a destination address field. The source address field carries a source IPv6 address used by the head node for SRv6 encapsulation. The destination address field is a SID of a node B which is the next node after the head node on the path 1.

[0087] The SRH at least includes a Routing Type field, a Next Header field, a Segment List field, and a SL field. The Routing Type field carries a first value such as 254, and the first value is used to indicate that the source path control probe packet is a source path control probe packet. The Next Header field carries a second value such as 254, and the second value such as 254 is used to indicate that a next packet header of the SRH carries a RouterID of the head node. The Segment List field carries a Segment List of the current path, and the Segment List includes SIDs of nodes on the current path except the head node. The SL field carries a SL of 1. The RouterID header carries a RouterID of the head node.

[0088] As shown in Figure 6 , the B node on the path 1 receives the source path control probe packet, checks the Routing Type field in the SRH, and finds that the Routing Type field carries the first value of 254 (decimal), and thus confirms that it is a source path control probe packet. The B node parses the source path control probe packet and obtains the following second routing information: a source IPv6 address, a segment list, and a RouterID. The B node finds that the source IPv6 address, the segment list, and the RouterID in the second routing information respectively match the source IPv6 address, the segment list, and the RouterID in the above-mentioned first routing information, and thus generates a source path strict control table matched with the first routing information.

[0089] As shown in Figure 6 , the source path control table matched with the first routing information at least includes an ingress interface on which the source path control probe packet is received, a source IPv6 address carried by the source address field, a destination address carried by the destination address field, a segment list carried by the source path control probe packet, and the above-mentioned SL.

[0090] The B node is not a tail node of the path 1, and thus forwards the source path control probe packet based on an SRv6 TE Policy forwarding process. Specifically, the B node makes the following modifications to the source path control probe packet and continues to forward the source path control probe packet: modifies the destination address field in the source path control probe packet to a node identifier of a next node after the current node on the current path, and updates a number in the SL field, and the updated number is 1 less than the number before the update. At this time, as shown in Figure 6As shown, the destination address carried by the destination address field of the source path control probe packet is the SID of the D node, and SL is 0.

[0091] As shown in Figure 6 As shown, the D node on path 1 receives the source path control probe packet, checks the RoutingType field in the SRH, and finds that the first value is 254 (decimal), so it is confirmed to be a source path control probe packet. The D node parses the source path control probe packet and obtains the following second routing information: source IPv6 address, segment list, and RouterID. The D node finds that the source IPv6 address, segment list, and RouterID in the second routing information match the source IPv6 address, segment list, and RouterID in the above-mentioned first routing information, respectively, and then generates a source path strict control table matched with the first routing information.

[0092] As shown in Figure 6 As shown, the source path control table matched with the first routing information at least includes: the incoming interface on which the source path control probe packet is received, the source IPv6 address carried by the source address field, the destination address carried by the destination address field, the Segment List carried by the source path control probe packet, and the SL.

[0093] The D node is the tail node of path 1, so it does not forward the source path control probe packet any more.

[0094] Finally, each node on path 1 except the head node will generate the above-mentioned source path control probe packet matched with the first routing information. Thereafter, each node on path 1 except the head node will perform forwarding control on the received service packet based on the above-mentioned source path control probe packet matched with the first routing information. For example, Figure 8 As shown, the B node receives the service packet, checks whether the interface on which the service packet is received, the source IPv6 address, the destination address, and the Segment List and SL of the service packet encapsulated match the incoming interface, the source IPv6 address, the destination address, the Segment List, and the SL in the source path control table, respectively, and if so, continues to forward the service packet, and if not, discards the service packet.

[0095] In this embodiment, the SRv6 TE Policy source path route published by the head node further includes: an identification (ID) of the SRv6 TE Policy. Figure 7 This is shown schematically. Optionally, the value range of the SRv6 TE Policy ID here is, for example, 1-65535. Any SRv6 TE Policy ID is used to uniquely identify an SRv6 TE Policy.

[0096] Based on this, each node on path 1 except the head node will identify whether the route information associated with the SRv6 TE Policy ID has been recorded after receiving the SRv6 TE Policy source path route. If not, the first route information carried by the received SRv6 TE Policy source path route is associated with and recorded with the SRv6 TE Policy ID. If yes, the route information associated with the SRv6 TE Policy ID is deleted, and the source path control table matched with the route information is deleted. The SRv6 TE Policy ID is associated with and recorded with the first route information carried by the received SRv6 TE Policy source path route. This achieves timely updating of the route. Figure 8 The above is a schematic description.

[0097] The method provided by the embodiments of the present application is improved as above, and the device provided by the embodiments of the present application is described as follows:

[0098] Referring to Figure 9 , Figure 9 The device structure diagram provided by the embodiments of the present application is shown. The device corresponds to the process shown in Figure 1 The device is applied to a network node, and the network node serves as a head node of an SRv6 traffic engineering policy (TE Policy). The device comprises:

[0099] a first sending unit configured to send an SRv6 TE Policy source path route to each node on a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first route information used for forwarding a packet on the current path, so that any node on the current path except the head node records the first route information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route;

[0100] a second sending unit configured to send a source path control probe packet used for probing the current path to each node on the current path; the source path control probe packet carries second route information used for forwarding a packet on the current path, so that any node on the current path except the head node generates a source path control table matched with the first route information when the second route information carried by the source path control probe packet matches the recorded first route information; and any node on the current path except the head node is configured to perform forwarding control on a received service packet based on the generated source path control table, so as to suppress a network attack.

[0101] As an embodiment, the first routing information comprises: a Router ID of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a Segment List; the Segment List contains segment identifiers (SIDs) of nodes on the current path except the head node;

[0102] The second routing information comprises: a Router ID of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a Segment List of the current path, which contains SIDs of nodes on the current path except the head node.

[0103] As an embodiment, the source path control probe message encapsulates an IPv6 basic header, an SRv6 header (SRH), and a Router ID header;

[0104] The IPv6 basic header contains at least a source address field, which carries a source IPv6 address of the head node for SRv6 encapsulation.

[0105] The SRH contains at least: a Routing Type field, a Next Header field, and a Segment List field; the Routing Type field carries a first value, which is used to indicate the source path control probe message; the Next Header field carries a second value, which is used to indicate that a next message header of the SRH carries a Router ID of the head node; and the Segment List field carries a Segment List of the current path, which contains SIDs of nodes on the current path except the head node.

[0106] The Router ID header carries a Router ID of the head node.

[0107] The second routing information comprises: the Router ID of the head node carried by the Router ID header, the Segment List carried by the Segment List field, and the source IPv6 address carried by the source address field.

[0108] As an embodiment, the first sending unit further returns the step of sending the SRv6 TE Policy source path route to other nodes on the current path included in the SRv6 TE Policy, when the current path is abnormal, taking a backup path of the current path in the SRv6 TE Policy as the current path.

[0109] As an embodiment, the SRv6 TE Policy source path route further includes an identification ID of the SRv6 TE Policy.

[0110] The SRv6 TE Policy ID is configured to make any node on the current path except the head node, after receiving the SRv6 TE Policy source path route, if the SRv6 TE Policy ID is not recorded, associate and record the first routing information carried by the received SRv6 TE Policy source path route and the SRv6 TE Policy ID, if the SRv6 TE Policy ID is recorded, delete the routing information associated with the SRv6 TE Policy ID and the source path control table matched with the routing information, and associate and record the SRv6 TE Policy ID and the first routing information carried by the received SRv6 TE Policy source path route.

[0111] The embodiment of the present application further provides another device structure diagram. Referring to Figure 10 , Figure 10 The embodiment of the present application further provides another device structure diagram. The device corresponds to the process shown in Figure 2 The device is applied to a network node, and the network node is any node except a head node of an SRv6 traffic engineering policy TE Policy, and the device includes:

[0112] A receiving unit is configured to receive an SRv6 TE Policy source path route sent by a head node of an SRv6 TE Policy for a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information used for forwarding a packet on the current path.

[0113] A routing unit is configured to identify whether the node is on the current path, and if yes, record the first routing information carried by the SRv6 TE Policy source path route.

[0114] The receiving unit is further configured to receive a source path control probe message sent by the head node; the source path control probe message carries second routing information for the current path forwarding message;

[0115] The processing unit is configured to generate a source path control table with the first routing information matched if it is identified that the second routing information carried by the source path control probe message matches the recorded first routing information;

[0116] The service control unit is configured to perform forwarding control on service messages received by the node based on the source path control table, so as to suppress network attacks.

[0117] As an embodiment, the first routing information at least includes a segment list (Segment List); the Segment List contains segment identifiers (SIDs) of nodes on the current path except the head node;

[0118] The identification of whether the node is on the current path includes: identification of whether the segment identifier (SID) of the node is in the Segment List; if yes, it is determined that the node is on the current path; otherwise, it is determined that the node is not on the current path.

[0119] As an embodiment, the first routing information includes a router identifier (RouterID) of the head node, a source IPv6 address used for SRv6 encapsulation of the head node, and a segment list (Segment List); the Segment List contains segment identifiers (SIDs) of nodes on the current path except the head node;

[0120] The second routing information includes a router identifier (RouterID) of the head node, a source IPv6 address used for SRv6 encapsulation of the head node, and a segment list (Segment List) of the current path; the Segment List contains segment identifiers (SIDs) of nodes on the current path except the head node;

[0121] The identifying that the second routing information carried by the source path control probe packet matches the recorded first routing information comprises: if the RouterID carried by the source path control probe packet and the RouterID in the recorded first routing information meet a first set matching requirement, the source IPv6 address carried by the source path control probe packet and the source IPv6 address in the recorded first routing information meet a second set matching requirement, and the Segment List carried by the source path control probe packet and the Segment List in the recorded first routing information meet a third set matching requirement, it is determined that the second routing information carried by the source path control probe packet matches the recorded first routing information.

[0122] As an embodiment, the receiving the source path control probe packet sent by the head node for probing the current path comprises:

[0123] receiving a packet sent by the head node;

[0124] If the packet type carried by the packet is a first value, the first value is used to indicate a source path control probe packet, it is determined that the source path control probe packet sent by the head node is received.

[0125] As an embodiment, the source path control probe packet encapsulates an IPv6 basic header, an SRv6 packet header SRH, and a RouterID header;

[0126] The IPv6 basic header at least contains a source address field, and the source address field carries a source IPv6 address used by the head node for SRv6 encapsulation.

[0127] The SRH at least includes a Routing Type field, a Next Header field, and a Segment List field. The Routing Type field carries a first value, the first value is used to indicate a source path control probe packet; the Next Header field carries a second value, the second value is used to indicate that the next packet header of the SRH carries a routing identifier RouterID of the head node; and the Segment List field carries a Segment List of the current path, and the Segment List includes segment identifiers SIDs of nodes on the current path except the head node.

[0128] The RouterID header carries a routing identifier RouterID of the head node.

[0129] The second routing information at least includes: a Router ID of the head node carried by the Router ID header, a Segment List carried by the Segment List field, and a source IPv6 address carried by the source address field.

[0130] As an embodiment, the IPv6 basic header further includes a destination address field; and the SRH further includes an SL field carrying an SL, the SL indicating a number of remaining segment identifiers SID in the Segment List, the remaining segment identifiers SID referring to segment identifiers SID corresponding to nodes that the source path control probe message has not passed through.

[0131] The first routing information matched by the source path control table at least includes: an interface receiving the source path control probe message, a source IPv6 address carried by the source address field, a destination address carried by the destination address field, a Segment List carried by the source path control probe message, and the SL.

[0132] The forwarding control of the service message received by the network node based on the source path control table includes: checking whether an interface receiving the service message, a source IPv6 address, a destination address, a Segment List, and an SL of the service message are respectively matched with an ingress interface, a source IPv6 address, a destination address, a Segment List, and an SL in the source path control table, if yes, continuing to forward the service message, and if no, discarding the service message.

[0133] As an embodiment, the processing unit is further configured to, when the network node is not the last node of the current path, modify the source path control probe message and continue to forward the source path control probe message by: modifying a destination address field in the source path control probe message to a node identifier of a next node after the network node on the current path, and updating a number in the SL field, the updated number being less than the number before the update by 1.

[0134] As an embodiment, the SRv6 TE Policy source path routing further includes: an identification ID of the SRv6 TE Policy.

[0135] The recording the first route information carried by the SRv6 TE Policy source path route includes: identifying whether the route information associated with the SRv6 TE Policy ID has been recorded currently, if not, associating and recording the first route information carried by the SRv6 TE Policy source path route currently received and the SRv6 TE Policy ID; if yes, deleting the route information associated with the SRv6 TE Policy ID and the source path control table matched with the route information, and associating and recording the SRv6 TE Policy ID and the first route information carried by the SRv6 TE Policy source path route currently received.

[0136] The embodiments of the present application also provide Figure 9 or Figure 10 The hardware structure of the device shown in the above embodiments. Referring to Figure 11 , Figure 11 The hardware structure of the device shown in the above embodiments. Referring to Figure 11 The hardware structure can include: a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions capable of being executed by the processor; the processor is used to execute the machine executable instructions to implement the method disclosed in the above examples of the present application.

[0137] Based on the same application concept as the above method, the embodiments of the present application also provide a machine readable storage medium, the machine readable storage medium stores a plurality of computer instructions, the computer instructions are executed by a processor to implement the method disclosed in the above examples of the present application.

[0138] For example, the machine readable storage medium can be: RAM (Radom Access Memory, random access memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state disk, any type of storage disk (such as optical disk, dvd, etc.), or similar storage medium, or combination thereof.

[0139] The above only describes the embodiments of the present application and does not limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A packet forwarding method, characterized by, The method is applied to a network node, and the method comprises: The network node, as a head node of an SRv6 traffic engineering policy (TE Policy), sends an SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy, the SRv6 TE Policy source path route carrying first routing information for a current path forwarding packet, so that any node on the current path except the head node records the first routing information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route; The network node, as the head node, sends a source path control probe packet for probing the current path to other nodes on the current path; the source path control probe packet carries second routing information for the current path forwarding packet, so that any node on the current path except the head node generates a source path control table with the first routing information matching when the second routing information carried by the source path control probe packet and the recorded first routing information are matched; any node on the current path except the head node is configured to perform forwarding control on a received service packet based on the generated source path control table. The forwarding control on the received service packet can comprise: checking an interface of the received service packet, a source IPv6 address, a destination address, and a Segment List (SL) of the service packet encapsulated, whether the interface, the source IPv6 address, the destination address, and the Segment List (SL) of the service packet encapsulated are matched with an ingress interface, a source IPv6 address, a destination address, a Segment List (SL), and an SL in the source path control table respectively, if yes, continuing to forward the service packet, if no, discarding the service packet.

2. The method of claim 1, wherein, The first routing information comprises a router identifier (RouterID) of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a segment list (Segment List); the Segment List contains segment identifiers (SIDs) of nodes on the current path except the head node; The second routing information comprises a router identifier (RouterID) of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a segment list (Segment List) of the current path, the Segment List containing segment identifiers (SIDs) of nodes on the current path except the head node.

3. The method according to claim 1 or 2, characterized in that, The source path control probe packet encapsulates an IPv6 basic header, an SRv6 packet header (SRH), and a RouterID header; The IPv6 basic header at least contains a source address field, and the source address field carries the source IPv6 address of the head node for SRv6 encapsulation. The SRH at least includes: a Routing Type field, a Next Header field, and a Segment List field; the Routing Type field carries a first value, the first value is used to indicate a source path control probe packet; the Next Header field carries a second value, the second value is used to indicate that a next packet header of the SRH carries a Router ID of the head node; and the Segment List field carries a Segment List of the current path, the Segment List including segment identifiers SID of each node on the current path except the head node. The Router ID header carries a Router ID of the head node. The second routing information includes: the Router ID carried by the Router ID header, the Segment List carried by the Segment List field, and a source IPv6 address carried by the source address field.

4. The method of claim 1, wherein, The method further includes: The network node, as the head node, returns to each node on a current path to send an SRv6 TE Policy source path route when the current path is abnormal.

5. The method according to claim 1 or 4, characterized in that, The SRv6 TE Policy source path route further includes: an identification ID of the SRv6 TE Policy. The SRv6 TE Policy ID is used to enable any node on the current path except the head node to, after currently receiving the SRv6 TE Policy source path route, associate and record the first routing information carried by the currently received SRv6 TE Policy source path route and the SRv6 TE Policy ID if the SRv6 TE Policy ID is not recorded, or delete the routing information associated with the SRv6 TE Policy ID and a source path control table matched with the routing information if the SRv6 TE Policy ID is already recorded, and associate and record the SRv6 TE Policy ID and the first routing information carried by the currently received SRv6 TE Policy source path route.

6. A message forwarding method characterized by, The method is applied to a network node, and the method includes: The network node, as any node on a current path except a head node of an SRv6 traffic engineering policy TE Policy, then: The head node receiving the SRv6 TE Policy sends an SRv6 TE Policy source path route for a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information for forwarding a packet of the current path; identifying whether the current node is in the current path, and if yes, recording the first routing information carried by the SRv6 TE Policy source path route; receiving a source path control probe packet sent by the head node; the source path control probe packet carries second routing information for forwarding a packet of the current path; if it is identified that the second routing information carried by the source path control probe packet matches the recorded first routing information, generating a source path control table of first routing information matching; based on the source path control table, performing forwarding control on a service packet received by the current node; wherein the forwarding control on the received service packet can include: checking whether an interface receiving the service packet, a source IPv6 address encapsulated by the service packet, a destination address, and a Segment List and SL encapsulated by the service packet respectively match an ingress interface, a source IPv6 address, a destination address, a Segment List, and a SL in the source path control table, and if yes, continuing to forward the service packet, and if no, discarding the service packet.

7. The method of claim 6, wherein, The first routing information at least includes a Segment List; the Segment List contains segment identifiers (SIDs) of nodes on the current path except the head node; The identifying whether the current node is in the current path includes: identifying whether a segment identifier (SID) of the current node is in the Segment List, and if yes, determining that the current node is in the current path, and if no, determining that the current node is not in the current path.

8. The method of claim 6, wherein, The first routing information includes a Router ID of the head node, a source IPv6 address for SRv6 encapsulation of the head node, and a Segment List; the Segment List contains SIDs of nodes on the current path except the head node; The second routing information includes a Router ID of the head node, a source IPv6 address for SRv6 encapsulation of the head node, and a Segment List of the current path; the Segment List contains SIDs of nodes on the current path except the head node. The matching of the second routing information carried by the source path control probe packet and the recorded first routing information comprises: if the RouterID carried by the source path control probe packet and the RouterID in the recorded first routing information meet a first set matching requirement, the source IPv6 address carried by the source path control probe packet and the source IPv6 address in the recorded first routing information meet a second set matching requirement, and the Segment List carried by the source path control probe packet and the Segment List in the recorded first routing information meet a third set matching requirement, it is determined that the second routing information carried by the source path control probe packet and the recorded first routing information match.

9. The method of claim 6, wherein, The receiving of the source path control probe packet sent by the head node for probing the current path comprises: receiving a packet sent by the head node; if the packet type carried by the packet is a first value, the first value is used to indicate a source path control probe packet, it is determined that the source path control probe packet sent by the head node is received.

10. The method of claim 9, wherein, The source path control probe packet encapsulates an IPv6 basic header, an SRv6 packet header SRH, and a RouterID header; The IPv6 basic header at least contains a source address field, and the source address field carries a source IPv6 address used by the head node for SRv6 encapsulation. The SRH at least includes a Routing Type field, a Next Header field, and a Segment List field; the Routing Type field carries a first value, the first value is used to indicate a source path control probe packet; the Next Header field carries a second value, the second value is used to indicate that the next packet header of the SRH carries a RouterID of the head node; and the Segment List field carries a Segment List of the current path, the Segment List including segment identifiers SIDs of nodes on the current path except the head node. The RouterID header carries a RouterID of the head node. The second routing information at least includes the RouterID of the head node carried by the RouterID header, the Segment List carried by the Segment List field, and a source IPv6 address carried by the source address field.

11. The method of claim 10, wherein, The IPv6 basic header further includes a destination address field; and the SRH further includes an SL field, the SL field carrying an SL, the SL indicating a number of remaining segment identifiers SIDs in the Segment List, the remaining segment identifiers SIDs being segment identifiers SIDs of nodes that have not been passed through by the source path control probe packet. The first route information matching source path control table at least includes: an interface receiving the source path control probe packet, a source IPv6 address carried by the source address field, a destination address carried by the destination address field, a Segment List carried by the source path control probe packet, and the SL.

12. The method of claim 11, wherein, The method further includes: When the network node is not the last node of the current path, the network node performs the following modification on the source path control probe packet and continues forwarding: modifying the destination address field in the source path control probe packet to the node identifier of the next node after the current node on the current path, and updating the number in the SL field, the updated number being 1 less than the number before the update.

13. The method of claim 6, wherein, The SRv6 TE Policy source path route further includes: an identification ID of the SRv6 TE Policy; The network node records the first route information carried by the SRv6 TE Policy source path route includes: identifying whether the route information associated with the SRv6 TE Policy ID has been recorded currently, if not, associating and recording the first route information carried by the currently received SRv6 TE Policy source path route with the SRv6 TE Policy ID; if yes, deleting the route information associated with the SRv6 TE Policy ID and the source path control table matching the route information, and associating and recording the SRv6 TE Policy ID with the first route information carried by the currently received SRv6 TE Policy source path route.

14. A packet forwarding device, comprising: The device is applied to a network node serving as a head node of an SRv6 traffic engineering policy TE Policy, and includes: A first sending unit configured to send an SRv6 TE Policy source path route to other nodes on a current path included by the SRv6 TE Policy; the SRv6 TE Policy source path route carries first route information for a current path forwarding packet, so that any node on the current path except the head node records the first route information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route; A second sending unit configured to send a source path control probe packet for probing the current path to other nodes on the current path; the source path control probe packet carries second route information for the current path forwarding packet, so that any node on the current path except the head node generates a source path control table matching the first route information when the second route information carried by the source path control probe packet and the recorded first route information match; and any node on the current path except the head node is configured to perform forwarding control on a received service packet based on the generated source path control table. The forwarding control on the received service packet can include: checking whether the interface of the received service packet, the source IPv6 address of the encapsulated service packet, the destination address, and the Segment List and SL of the encapsulated service packet respectively match the ingress interface, the source IPv6 address, the destination address, the Segment List, and the SL in the source path control table, if yes, continuing to forward the service packet, and if no, discarding the service packet.

15. A packet forwarding device, comprising: The device is applied to a network node, and the network node is any node except a head node of an SRv6 traffic engineering policy (TE Policy), and the device comprises: a receiving unit configured to receive an SRv6 TE Policy source path route sent by a head node of an SRv6 TE Policy for a current path included in the SRv6 TE Policy, wherein the SRv6 TE Policy source path route carries first routing information for forwarding a packet of the current path; a routing unit configured to identify whether the current node is on the current path, and if yes, record the first routing information carried by the SRv6 TE Policy source path route; the receiving unit is further configured to receive a source path control probe packet sent by the head node, wherein the source path control probe packet carries second routing information for forwarding a packet of the current path; a processing unit configured to generate a source path control table in which the first routing information matches if it is identified that the second routing information carried by the source path control probe packet matches the recorded first routing information; a service control unit configured to perform forwarding control on a service packet received by the current node based on the source path control table; the forwarding control on the received service packet can include: checking whether the interface of the received service packet, the source IPv6 address of the encapsulated service packet, the destination address, and the Segment List and SL of the encapsulated service packet respectively match the ingress interface, the source IPv6 address, the destination address, the Segment List, and the SL in the source path control table, if yes, continuing to forward the service packet, and if no, discarding the service packet.

Images