A message sending method and device

Abstract

The embodiment of the application provides a message sending method and device, relates to the field of communication technology, the method is applied to the first hardware chip of the first service card, the first service card further includes a first CPU; the method comprises the following steps: receiving a first message; if the first message matches a flow diversion session table item, sending a second message to a second service card indicated by the flow diversion session table item, the second message encapsulates the first message, so that the second service card forwards the first message; wherein the second service card includes a second CPU, the flow diversion session table item is a session table item generated and sent to the first CPU by the second CPU after the second CPU processes a received third message and determines that the first message will be received by the first service card; the flow diversion session table item is issued to the first hardware chip by the first CPU. By adopting the scheme, CPU resources can be saved, and the performance of equipment is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a message transmission method and apparatus. Background Technology

[0002] Session flow-redirect technology provides a distributed device-level traffic redirection solution that ensures that the same service flow is processed and transmitted by the same service card of the distributed device while performing Network Address Translation (NAT) on the service packets.

[0003] Currently, the CPU of the service card (e.g., service card 1) that receives the service packet performs NAT translation on the source IP address and source port number of the service packet. Based on the traffic characteristics such as the translated source IP address and source port number, it infers the service card (e.g., service card 3) to which the return traffic is sent. Then, CPU 1 generates a referral session entry for the return traffic and sends the service packet and the referral session entry to service card 3, which then forwards the service packet. After receiving the return packet, the CPU of service card 3 can transparently pass the return packet to service card 1 based on the referral session entry, and then the CPU of service card 1 forwards the return packet.

[0004] However, all return packets in the above process require two CPU processing steps, which consumes a lot of CPU resources and affects device performance. Summary of the Invention

[0005] The purpose of this application is to provide a message sending method and apparatus to save CPU resources and improve device performance. The specific technical solution is as follows:

[0006] In a first aspect, embodiments of this application provide a message transmission method, the method being applied to a first hardware chip of a first service card, the first service card further comprising a first CPU; the method includes:

[0007] Receive the first message;

[0008] If the first message matches the referral session entry, then a second message is sent to the second service card indicated by the referral session entry. The second message contains the first message, so that the second service card forwards the first message.

[0009] The second service card includes a second CPU, and the referral session entry is: after the second CPU processes the received third message and determines that the first message will be received by the first service card, it generates and sends the session entry to the first CPU; the referral session entry is sent by the first CPU to the first hardware chip.

[0010] In one possible implementation, the header of the second message carries a first action identifier, which indicates whether the first message is sent to the second CPU; the redirection session entry includes the first action identifier.

[0011] In one possible implementation, the method further includes:

[0012] When the traffic redirection session entry reaches its aging time, a first aging request message is sent to the first CPU, so that the first CPU forwards the first aging request message to the second service card.

[0013] If the first aging deletion message sent by the first CPU according to the first aging request message is received, then the referral session entry is deleted.

[0014] In one possible implementation, the method further includes:

[0015] If a second aging-out deletion message is received from the first CPU before the aging-out time of the referral session entry, then the referral session entry is deleted.

[0016] In one possible implementation, the first hardware chip stores a forwarding session entry issued by the first CPU, and the first message includes a second action identifier and a fourth message; after receiving the first message, the method further includes:

[0017] If the second action identifier indicates that the fourth message does not need to be sent to the first CPU, and if the fourth message matches the forwarding session entry, then the fourth message is forwarded based on the forwarding session entry.

[0018] In one possible implementation, the method further includes:

[0019] When the forwarding session entry reaches its aging time, a second aging request message is sent to the first CPU.

[0020] If a third aging deletion message is received from the first CPU, the forwarding session entry is deleted. The third aging deletion message is sent by the first CPU when it determines that the referral session entry associated with the forwarding session entry has been deleted.

[0021] Secondly, embodiments of this application provide a message sending apparatus, the apparatus being applied to a first hardware chip of a first service card, the first service card further comprising a first CPU; the apparatus includes:

[0022] The receiving module is used to receive the first message;

[0023] The sending module is configured to send a second message to the second service card indicated by the referral session entry if the first message matches the referral session entry, wherein the second message encapsulates the first message so that the second service card forwards the first message;

[0024] The second service card includes a second CPU, and the referral session entry is: after the second CPU processes the received third message and determines that the first message will be received by the first service card, it generates and sends the session entry to the first CPU; the referral session entry is sent by the first CPU to the first hardware chip.

[0025] In one possible implementation, the header of the second message carries a first action identifier, which indicates whether the first message is sent to the second CPU; the redirection session entry includes the first action identifier.

[0026] In one possible implementation, the device further includes: a deletion module;

[0027] The sending module is further configured to send a first aging request message to the first CPU when the traffic diversion session entry reaches the aging time, so that the first CPU forwards the first aging request message to the second service card.

[0028] The deletion module is used to delete the traffic redirection session entry if it receives a first aging deletion message sent by the first CPU according to the first aging request message.

[0029] In one possible implementation, the device further includes:

[0030] The deletion module is used to delete the traffic referral session entry if it receives a second aging-out deletion message sent by the first CPU before the aging-out time of the traffic referral session entry.

[0031] In one possible implementation, the first hardware chip stores a forwarding session entry issued by the first CPU, and the first message includes a second action identifier and a fourth message; the device further includes:

[0032] The forwarding module is configured to forward the fourth message based on the forwarding session table entry if the second action identifier indicates that the fourth message does not need to be sent to the first CPU, and if the fourth message matches the forwarding session table entry.

[0033] In one possible implementation, the device further includes: a deletion module;

[0034] The sending module is further configured to send a second aging request message to the first CPU when the forwarding session entry reaches its aging time.

[0035] The deletion module is used to delete the forwarding session entry if it receives a third aging deletion message sent by the first CPU. The third aging deletion message is sent by the first CPU when it determines that the referral session entry associated with the forwarding session entry has been deleted.

[0036] Thirdly, embodiments of this application also provide a service card, including a first hardware chip and a first CPU, wherein the first hardware chip stores a traffic redirection session entry issued by the first CPU; the first hardware chip is used to implement the method described in the first aspect.

[0037] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the method described in the first aspect.

[0038] Fifthly, embodiments of this application also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in the first aspect above.

[0039] Using the above technical solution, after the second CPU of the second service card processes the received third message and determines that the first message will be received by the first service card, it generates and redirects a session entry to the first CPU. The first CPU then sends this redirected session entry to the first hardware chip of the first service card. In other words, the first hardware chip stores the redirected session entry sent by the first CPU. Thus, when the first hardware chip receives the first message and determines that it matches the redirected session entry, it can forward the first message to the second service card, whereby the second CPU of the second service card processes the first message. Since the first hardware chip does not send the first message to the first CPU, the first CPU does not need to process the first message. Therefore, the first message only needs to be processed by the CPU of the second service card, reducing CPU resource consumption and improving the performance of the firewall device.

[0040] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0042] Figure 1 This is a network topology diagram of a carrier network;

[0043] Figure 2 A schematic diagram of the session referral process in related technologies;

[0044] Figure 3 A flowchart illustrating a message sending method provided in an embodiment of this application;

[0045] Figure 4 A schematic diagram of a referral session entry provided in an embodiment of this application;

[0046] Figure 5 A schematic diagram of another traffic redirection session entry provided in an embodiment of this application;

[0047] Figure 6 An exemplary schematic diagram of a message sending method provided in an embodiment of this application;

[0048] Figure 7 An exemplary schematic diagram of a table entry aging deletion method provided in an embodiment of this application;

[0049] Figure 8 An exemplary schematic diagram of another message sending method provided in an embodiment of this application;

[0050] Figure 9 An exemplary schematic diagram of another aging deletion method provided in an embodiment of this application;

[0051] Figure 10 A schematic diagram of the structure of a message sending device provided in an embodiment of this application;

[0052] Figure 11 This is a schematic diagram of the structure of a service card provided in an embodiment of this application. Detailed Implementation

[0053] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0054] With the advent of the Internet of Things and the cloud era, the capabilities of network security devices are also improving, and the demand for distributed and scalable solutions is increasing. To meet the needs of private cloud network deployment and construction, operators need to deploy cloud-based service networks, and the NAT devices on the tenant branch side of these cloud-based service networks can be firewall devices.

[0055] like Figure 1 As shown, Figure 1 This is a network topology diagram of a carrier network. As an example, the network includes Router 1, Router 2, two firewall devices, and four Software Defined Network (SDN) gateways with Point of Delivery (PODs).

[0056] The two firewall devices are in a primary / backup relationship, and each firewall device has four virtual firewalls, for example... Figure 1 The four primary virtual firewalls belong to one firewall device, and the four backup virtual firewalls belong to another firewall device. Each virtual firewall is connected to Router 1 and Router 2 via an external VPN.

[0057] The SDN gateways for the four PODs are gateway 1 to gateway 4. Each gateway connects to a pair of virtual firewalls through 32 user VPNs, namely a primary virtual firewall and a backup virtual firewall that are mutually supportive.

[0058] Figure 1 The firewall in the system can be a distributed device, for example, such as... Figure 2 As shown, a firewall device may include two main control cards, four service cards, four network cards, and two input / output (I / O) cards. Figure 2 The number of cards shown is for illustrative purposes only, and the actual implementation is not limited to this.

[0059] The four service cards are service card 1 to service card 4. Service card 1 contains CPU1, service card 2 contains CPU2, service card 3 contains CPU3, and service card 4 contains CPU4.

[0060] The following combination Figure 2 The session referral feature is explained in the following steps:

[0061] (1) The first message is sent to CPU1 of service card 1.

[0062] (2) CPU1 of service card 1 performs NAT translation on the first packet, creates a new forwarding session table entry, and infers the service card to which the return traffic is sent based on the traffic characteristics such as the source IP address and source port number after NAT translation. Taking service card 3 as an example, the backhaul traffic redirection session table entry is then generated.

[0063] (3) CPU1 of service card 1 sends the first message after NAT translation and the redirection session entry to service card 3.

[0064] (4) CPU3 of service card 3 creates a referral session entry locally based on the received referral session entry.

[0065] (5) Service card 3 forwards the first packet after NAT translation.

[0066] (6) The I / O card sends the return message to the service card 3 according to the default hash (HASH) routing algorithm.

[0067] (7) CPU3 of service card 3 determines that the return message matches the redirection session table entry, determines that the session table entry of the return message is on service card 1 based on the redirection session table entry, and then determines to perform session redirection and pass-through on the return message based on the redirection session table entry.

[0068] (8) CPU3 of Service Card 3 transmits the return message to CPU1 of Service Card 1 based on the redirection session table entry.

[0069] (9) CPU1 of Service Card 1 determines the forwarding session table entry that matches the return message and determines that the return message needs to be forwarded quickly through the forwarding session table entry.

[0070] (10) CPU1 of Service Card 1 forwards return messages.

[0071] (11) The CPU1 of service card 1 receives the subsequent positive message, which belongs to the same session as the first message.

[0072] (12) CPU1 of service card 1 matches the forwarding message with the forwarding session table entry and determines that the forwarding message needs to be forwarded quickly through the forwarding session table entry.

[0073] (13) CPU1 of service card 1 forwards forward service messages.

[0074] In the above process, the return packets need to be processed by CPU3 and CPU respectively, which consumes a lot of CPU resources and reduces the throughput of the firewall device. Moreover, as the number of service cards increases, the performance of the firewall device cannot be linearly increased.

[0075] To address the aforementioned problems, this application provides a message transmission method. This method is applied to a first hardware chip of a first service card. Specifically, the first hardware chip can be a Field-Programmable Gate Array (FPGA) chip, and the first service card also includes a first CPU. For example... Figure 3 As shown, the method includes:

[0076] S301, Receive the first message.

[0077] S302. If the first message matches the referral session entry, then send a second message to the second service card indicated by the referral session entry. The second message contains the first message, so that the second service card forwards the first message.

[0078] The second service card includes a second CPU. The redirection session entry is generated and sent to the first CPU after the second CPU processes the received third message and determines that the first message will be received by the first service card. This redirection session entry is then sent from the first CPU to the first hardware chip.

[0079] The third message and the first message belong to the same session. The third message is the first message of the session, and the first message is the return message in the session. Specifically, it can be the return message corresponding to the first message, or it can be a subsequent return message in the session.

[0080] After receiving the third packet, the second CPU performs NAT translation on the source IP address and source port number of the third packet and generates a forwarding session entry. Then, it determines the service card (e.g., the first service card) to receive the return packet of the third packet, generates a referral session entry, and sends the referral session entry to the first CPU of the first service card.

[0081] The traffic redirection session entry includes flow characteristics and the location identifier of the service card to be redirected. For example, if the first message of the first hardware chip matches the flow characteristics of the traffic redirection session entry, the service card location identifier is obtained. For example, if the service card location identifier indicates the second service card, the first hardware chip can forward the first message to the second service card.

[0082] Using this method, after the second CPU of the second service card processes the received third packet and determines that the first packet will be received by the first service card, it generates and redirects a session entry to the first CPU. The first CPU then sends this redirected session entry to the first hardware chip of the first service card. In other words, the first hardware chip stores the redirected session entry sent by the first CPU. Thus, when the first hardware chip receives the first packet and determines that it matches the redirected session entry, it can forward the first packet to the second service card, whereby the second CPU of the second service card processes the first packet. Since the first hardware chip does not send the first packet to the first CPU, the first CPU does not need to process the first packet. Therefore, the first packet only needs to be processed by the CPU of the second service card, reducing CPU resource consumption and improving the performance of the firewall device.

[0083] In this embodiment, the header of the second message carries a first action identifier, which is used to identify whether the first message is sent to the second CPU. The forwarding session entry includes the first action identifier. Thus, after the second hardware chip of the second service card receives the second message, if it determines that the first action identifier indicates that the first message is to be sent to the second CPU, the second hardware chip will send the first message encapsulated in the second message to the second CPU so that the second CPU can process the first message; if it determines that the first action identifier indicates that the first message is to be sent to the second CPU, the second hardware chip will directly forward the first message using the forwarding session entry stored locally, without sending the first message to the second CPU of the second service card. The forwarding session entry stored locally by the second hardware chip is a forwarding session entry issued by the second CPU, which is a session entry generated by the first CPU after processing the received third message.

[0084] The redirection session entry can be an IPv4 entry or an IPv6 entry, which will be described below.

[0085] In an IPv4 scenario, the redirection session entry is as follows: Figure 4 As shown, it includes source IP address, destination IP address, protocol, type, source port, destination port, Virtual Private Network (VPN), ingress interface index, tunnel ID, virtual system ID, session tag, entry aging time, session ID, entry action FLAG, and service card location identifier.

[0086] The source IP address, destination IP address, ingress interface index, tunnel identifier, table entry aging time, table entry action FLAG, and service card location identifier each occupy 4 bytes; the protocol and type each occupy 1 byte; the session ID occupies 8 bytes; and the source port, destination port, VPN, and virtual system ID each occupy 2 bytes.

[0087] In an IPv6 scenario, the redirection session entry is as follows: Figure 5 As shown, it includes the source IPv6 address, destination IPv6 address, protocol, type, source port, destination port, VPN, ingress interface index, tunnel ID, virtual system ID, session tag, entry aging time, session ID, entry action FLAG, and service card location identifier.

[0088] The source IPv6 address and destination IPv6 address each occupy 16 bytes; the ingress interface index, tunnel identifier, table entry aging time, table entry action FLAG, and service card location identifier each occupy 4 bytes; the protocol and type each occupy 1 byte; the session ID occupies 8 bytes; and the source port, destination port, VPN, and virtual system ID each occupy 2 bytes.

[0089] exist Figure 4 and Figure 5 In this context, the first action is identified by the table entry action FLAG. Each service card of the firewall device pre-stores the processing action corresponding to each table entry action FLAG. For example, if the value of the table entry action FLAG is 0, it means that the packet does not need to be sent to the CPU; if the value of the table entry action FLAG is 1, it means that the packet needs to be sent to the CPU.

[0090] The service card location identifier is used to indicate the service card where the forwarding session entry associated with the referral session entry is located. If the received message matches the flow characteristics in the referral session entry, the message should be forwarded to the service card indicated by the service card location identifier.

[0091] The above embodiments are described below with specific examples, such as Figure 6 As shown, the distributed device includes two main control cards, four service cards, four network cards, and two I / O cards.

[0092] The four service cards are designated as Service Cards 1 to 4, and each service card includes one CPU and one FPGA, for example... Figure 6 CPU1 to 4 and FPGA1 to 4.

[0093] exist Figure 4 In the above embodiment, service card 3 is the first service card, FPGA 3 is the first hardware chip, CPU 3 is the first CPU, and service card 1 is the second service card.

[0094] The specific process includes the following steps:

[0095] (1) The first message is sent to CPU1 of service card 1.

[0096] The first message can be the Synchronize Sequence Numbers (SYN) message in the three-way handshake of the Transmission Control Protocol (TCP).

[0097] (2) CPU1 of service card 1 performs NAT translation on the first packet, creates a new forwarding session table entry, and infers the service card to which the return traffic is sent based on the traffic characteristics such as the source IP address and source port number after NAT translation. Taking service card 3 as an example, the backhaul traffic redirection session table entry is then generated.

[0098] (3) Send the first message after NAT translation and the redirection session entry to CPU3 of service card 3.

[0099] (4) CPU3 of service card 3 creates a referral session entry locally based on the received referral session entry.

[0100] (5) CPU3 will flush the session table entry to FPGA3.

[0101] (6) FPGA3 creates a referral session entry locally based on the received referral session entry.

[0102] (7) CPU3 forwards the first packet after NAT translation.

[0103] (8) The I / O card sends the return message to FPGA3 according to the default hash (HASH) routing algorithm.

[0104] This return message can be the SYN-ACK message from the TCP three-way handshake.

[0105] (9) FPGA3 matches the return message with the redirection session entry, determines that the return message matches the redirection session entry, determines that the session entry of the return message is on service card 1 based on the redirection session entry, and then determines that the return message can be redirected and transparently transmitted based on the redirection session entry.

[0106] Optionally, if no matching redirection session entry exists in FPGA3, the return message is sent to CPU3. The following explanation will use the example of a matching redirection session entry existing in FPGA3 as an example.

[0107] (10) FPGA3 forwards the return message to CPU1.

[0108] (11) CPU1 of service card 1 determines the forwarding session table entry that matches the return message and determines that the return message needs to be forwarded quickly through the forwarding session table entry.

[0109] (12) CPU1 of Service Card 1 forwards the return message.

[0110] (13) The CPU1 of service card 1 receives the subsequent positive message, which belongs to the same session as the first message.

[0111] Optionally, the forward message can be an ACK message in the TCP three-way handshake, or it can be a data packet transmitted subsequently based on the session.

[0112] (14) CPU1 of Service Card 1 matches the forwarding message with the forwarding session table entry and determines that the forwarding message needs to be forwarded quickly through the forwarding session table entry.

[0113] (15) CPU1 of service card 1 forwards forward service messages.

[0114] It is evident that by employing this method, and Figure 2 Compared to the previous process, CPU3 does not need to process return packets, meaning only CPU1 needs to process return packets, reducing the consumption of CPU resources and thus improving the throughput of the firewall device.

[0115] In this embodiment, the first hardware chip also needs to manage the aging time of the traffic referral entry. When the traffic referral session entry reaches the aging time, it sends a first aging request message to the first CPU so that the first CPU forwards the first aging request message to the second service card. If the first CPU receives a first aging deletion message sent according to the first aging request message, the traffic referral session entry is deleted. The first aging deletion message is used to indicate the deletion of the traffic referral session entry.

[0116] Both the first aging request message and the first aging deletion message carry the session's hash key, which includes a 5-tuple, VPN, ingress interface index, tunnel ID, virtual system ID, and session ID.

[0117] After receiving the first aging request message, the second CPU of the second service card can quickly locate the forwarding session entry associated with the referral session entry based on the session's hash key, and determine whether the forwarding session entry associated with the referral session entry has timed out. If so, the second CPU determines that the referral session entry can be deleted, and then sends a first aging deletion message to the first CPU to instruct the first CPU to delete the referral session entry. The first CPU forwards the first aging deletion message to the first hardware chip, so that the first hardware chip can quickly locate the referral session entry to be deleted based on the hash key and delete it. Alternatively, the first CPU can also delete the referral session entry. If the forwarding session entry associated with the referral session entry has not yet timed out, the first CPU is notified to delete the referral session entry after the forwarding session entry has timed out.

[0118] In another scenario, if the first hardware chip receives a second aging-out message from the first CPU before the aging-out time of the leading session entry, it deletes the leading session entry. The second aging-out message indicates the deletion of the leading session entry. The second aging-out message carries the session's hash key.

[0119] Specifically, if the second CPU of the second service card determines that the forwarding session entry has reached its aging time and the referral session entry has not been deleted, it sends a second aging deletion message to the first CPU. Then, after the first CPU and the first hardware chip delete the referral session entry, the second CPU deletes the forwarding session entry.

[0120] The following will illustrate this with specific examples. Figure 6 Taking business card 1 and business card 3 as examples, Figure 7 As shown, CPU1 on service card 1 acts as the manager of session entries and can decide whether the traffic-driving session entries can be aged out and deleted.

[0121] After the session entry of FPGA3 times out, it sends an aging request to CPU3, which then sends an aging request to CPU1.

[0122] After receiving the aging request, CPU1 decides whether to allow the deletion of the referral session entry. If it determines that the forwarding session entry associated with the referral session entry has timed out, it can then determine that the deletion of the referral session entry is allowed and sends a deletion message to CPU3. CPU3 then sends a deletion message to FPGA3, instructing FPGA3 to delete the referral session entry. It should be noted that FPGA3 cannot actively delete the referral session entry if it has not received a deletion message.

[0123] After CPU3 confirms that FPGA3 has been successfully deleted, it notifies CPU1, and then CPU1 deletes the forwarding session entry.

[0124] In addition, if CPU1 determines that there is an abnormality in the forwarding session table entry or that the forwarding session table entry has been actively deleted, that is, the forwarding session table entry is no longer available, it will forcibly notify CPU3 to delete the redirecting session table entry, and then CPU3 will notify FPGA3 to delete the redirecting session table entry.

[0125] This ensures that the referral session entry is correctly aged out and deleted, and the forwarding session entry is deleted only after the referral session entry is deleted, thus guaranteeing that the packets are correctly referred and forwarded.

[0126] In some embodiments of this application, the first hardware chip further stores a forwarding session entry issued by the first CPU, and the first message includes a second action identifier and a fourth message. Based on this, after receiving the first message, if the first hardware chip determines that the second action identifier indicates that the fourth message does not need to be sent to the first CPU, and the fourth message matches the forwarding session entry, then it forwards the fourth message based on the forwarding session entry.

[0127] In this way, for return packets, the first hardware chip does not need to send the return packets to the first CPU, but can directly forward the return packets based on the forwarding session table entry, which can further save CPU resources and improve device performance.

[0128] It should be noted that in this scenario, the first CPU has already created a forwarding session entry based on the first packet of a session, and has already distributed the forwarding session entry to the first hardware chip, and has also sent the corresponding referral session entry to other service cards. The first packet can be the return packet corresponding to the first packet, or the return packet corresponding to a subsequently forwarded packet.

[0129] The following will illustrate this with specific examples, such as... Figure 8 As shown, Figure 8 The equipment structure and Figure 6 The process is the same. Taking FPGA1 as the first hardware chip as an example, the specific process includes the following steps:

[0130] (1) The first message is sent to CPU1 of service card 1.

[0131] This first message can be the SYN message in the TCP three-way handshake.

[0132] (2) CPU1 of service card 1 performs NAT translation on the first packet, creates a new forwarding session table entry, and infers the service card to which the return traffic is sent based on the traffic characteristics such as the source IP address and source port number after NAT translation. Taking service card 3 as an example, the backhaul traffic redirection session table entry is then generated.

[0133] (3) CPU1 will refresh the forwarding session table entry to FPGA1.

[0134] (4) FPGA1 creates a forwarding session table entry.

[0135] (5) CPU1 sends the first message after NAT translation and the redirection session entry to service card 3.

[0136] (6) CPU3 of service card 3 creates a referral session entry locally based on the received referral session entry.

[0137] (7) CPU3 will flush the session table entry to FPGA3.

[0138] (8) FPGA3 creates a referral session entry locally based on the received referral session entry.

[0139] (9) CPU3 forwards the first packet after NAT translation.

[0140] (10) The I / O card sends the return message to FPGA3 according to the default hash (HASH) routing algorithm.

[0141] This return message can be the SYN-ACK message from the TCP three-way handshake.

[0142] (11) FPGA3 matches the return message with the redirection session entry, determines that the return message matches the redirection session entry, determines that the session entry of the return message is on the service card 1 based on the redirection session entry, and then determines that the return message can be redirected and transparently transmitted based on the redirection session entry.

[0143] Optionally, if no matching redirection session entry exists in FPGA3, the return message is sent to CPU3. The following explanation assumes that a matching redirection session entry exists in FPGA3.

[0144] (12) FPGA3 forwards the return message to FPGA1, carrying the action FLAG in the redirection session table.

[0145] (13) If FPGA1 determines that the action of the table entry does not need to be sent to the CPU, it will match the return message with the forwarding session table entry. If it is determined that there is a forwarding session table entry that matches the return message, it will determine that the return message needs to be forwarded quickly through the forwarding session table entry.

[0146] (14) FPGA1 forwards the return message.

[0147] (15) FPGA1 receives the subsequent positive message, which belongs to the same session as the first message.

[0148] Optionally, the forward message can be an ACK message in the TCP three-way handshake, or it can be a data packet transmitted subsequently based on the session.

[0149] (16) FPGA1 matches the forwarding message with the forwarding session entry to determine that the forwarding message needs to be forwarded quickly through the forwarding session entry.

[0150] (17) FPGA1 forwards forward service messages.

[0151] This method enables load balancing, solving the performance bottleneck of distributed firewall devices. Furthermore, it accelerates load balancing through the collaboration of CPU and FPGA chips, reducing CPU pressure and improving device performance. Moreover, as the number of service cards increases, device performance can increase linearly.

[0152] In this scenario, when a forwarding session entry reaches its aging time, the first hardware chip sends a second aging request message to the first CPU. If a third aging deletion message is received from the first CPU, the forwarding session entry is deleted. The third aging deletion message indicates the deletion of the forwarding session entry and is sent by the first CPU after determining that the referral session entry associated with the forwarding session entry has been deleted. Both the second aging request message and the third aging deletion message carry the session's hash key.

[0153] The following explanation uses specific examples, such as business card 1 and business card 3 in example 8. Figure 9 As shown, CPU1 on service card 1 acts as the manager of session entries and can decide whether the traffic-driving session entries can be aged out and deleted.

[0154] After the forwarding session entry of FPGA1 times out, it sends an aging request to CPU1.

[0155] After the session entry of FPGA3 times out, it sends an aging request to CPU3, which then sends an aging request to CPU1.

[0156] After receiving the aging request from CPU3, CPU1 decides whether to allow the deletion of the referral session entry. If it determines that the forwarding session entry associated with the referral session entry has timed out, it can then determine that the deletion of the referral session entry is allowed and sends a deletion message to CPU3. CPU3 then sends a deletion message to FPGA3, instructing FPGA3 to delete the referral session entry. It should be noted that FPGA3 cannot actively delete the referral session entry if it has not received a deletion message.

[0157] After CPU3 confirms that FPGA3 has been successfully deleted, it notifies CPU1. CPU1 then sends a deletion message to FPGA1, notifying FPGA1 to delete the forwarding session table entry. After FPGA1 deletes the forwarding session table entry, CPU1 deletes the forwarding session table entry locally.

[0158] In addition, if CPU1 determines that there is an abnormality in the forwarding session table entry or that the forwarding session table entry has been actively deleted, that is, the forwarding session table entry is no longer available, it will forcibly notify CPU3 to delete the redirecting session table entry. In turn, CPU3 will notify FPGA3 to delete the redirecting session table entry and forcibly notify FPGA1 to delete the forwarding session table entry. In turn, FPGA1 will delete the forwarding session table entry.

[0159] This ensures that the referral session entry is correctly aged out and deleted, and the forwarding session entry is deleted only after the referral session entry is deleted, thus guaranteeing that the packets are correctly referred and forwarded.

[0160] Corresponding to the above method embodiments, this application embodiment also provides a message sending device, which is applied to a first hardware chip of a first service card, the first service card further including a first CPU; as Figure 10 As shown, the device includes:

[0161] Receiver module 1001 is used to receive the first message;

[0162] The sending module 1002 is used to send a second message to the second service card indicated by the referral session entry if the first message matches the referral session entry. The second message contains the first message so that the second service card can forward the first message.

[0163] The second service card includes a second CPU. The redirection session entry is generated and sent to the first CPU after the second CPU processes the received third message and determines that the first message will be received by the first service card. The redirection session entry is sent to the first hardware chip by the first CPU.

[0164] Optionally, the header of the second message carries a first action identifier, which is used to indicate whether the first message is sent to the second CPU; the redirection session entry includes the first action identifier.

[0165] Optionally, the device further includes: a deletion module;

[0166] The sending module 1002 is also used to send a first aging request message to the first CPU when the traffic diversion session entry reaches the aging time, so that the first CPU forwards the first aging request message to the second service card.

[0167] The deletion module is used to delete the lead session table entry if it receives a first aging deletion message sent by the first CPU according to the first aging request message.

[0168] Optionally, the device further includes:

[0169] The deletion module is used to delete the traffic redirection session entry if a second aging deletion message sent by the first CPU is received before the aging time of the traffic redirection session entry.

[0170] Optionally, the first hardware chip stores a forwarding session entry issued by the first CPU, and the first message includes a second action identifier and a fourth message; the device further includes:

[0171] The forwarding module is used to forward the fourth message based on the forwarding session table entry if the second action identifier indicates that there is no need to send the fourth message to the first CPU, and the fourth message matches the forwarding session table entry.

[0172] Optionally, the device further includes: a deletion module;

[0173] The sending module 1002 is also used to send a second aging request message to the first CPU when the forwarding session entry reaches the aging time;

[0174] The deletion module is used to delete the forwarding session entry if it receives a third aging deletion message sent by the first CPU. The third aging deletion message is sent by the first CPU when it determines that the referral session entry associated with the forwarding session entry has been deleted.

[0175] This application also provides a service card, such as... Figure 11 As shown, it includes a first hardware chip 1101 and a first CPU 1102.

[0176] The first hardware chip 1101 stores the traffic redirection session entries issued by the first CPU 1102; the first hardware chip 1101 is used to implement the method in the above method embodiment.

[0177] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the above-described message sending methods.

[0178] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the message sending methods described above.

[0179] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0180] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0181] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0182] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A message sending method, characterized in that, The method is applied to a first hardware chip of a first service card, the first service card further comprising a first CPU; the method includes: Receive the first message; If the first message matches the referral session entry, then a second message is sent to the second service card indicated by the referral session entry. The second message contains the first message, so that the second service card forwards the first message. The second service card includes a second CPU, and the referral session entry is generated and sent to the first CPU after the second CPU processes the received third message and determines that the first message will be received by the first service card; the referral session entry is sent from the first CPU to the first hardware chip. The third message belongs to the same session as the first message. The third message is the first message of the session, and the first message is the return message in the session.

2. The method according to claim 1, characterized in that, The header of the second message carries a first action identifier, which indicates whether the first message is sent to the second CPU; the redirection session entry includes the first action identifier.

3. The method according to claim 1 or 2, characterized in that, The method further includes: When the traffic redirection session entry reaches its aging time, a first aging request message is sent to the first CPU, so that the first CPU forwards the first aging request message to the second service card. If the first aging deletion message is received from the first CPU based on the first aging request message, then the referral session entry is deleted.

4. The method according to claim 1 or 2, characterized in that, The method further includes: If a second aging-out deletion message is received from the first CPU before the aging-out time of the referral session entry, then the referral session entry is deleted.

5. The method according to claim 1, characterized in that, The first hardware chip stores a forwarding session entry issued by the first CPU, and the first message includes a second action identifier and a fourth message; after receiving the first message, the method further includes: If the second action identifier indicates that the fourth message does not need to be sent to the first CPU, and the fourth message matches the forwarding session entry, then the fourth message is forwarded based on the forwarding session entry.

6. The method according to claim 5, characterized in that, The method further includes: When the forwarding session entry reaches its aging time, a second aging request message is sent to the first CPU. If a third aging deletion message is received from the first CPU, the forwarding session entry is deleted. The third aging deletion message is sent by the first CPU when it determines that the referral session entry associated with the forwarding session entry has been deleted.

7. A message sending device, characterized in that, The device is applied to a first hardware chip of a first service card, the first service card further comprising a first CPU; the device includes: The receiving module is used to receive the first message; The sending module is configured to send a second message to the second service card indicated by the referral session entry if the first message matches the referral session entry, wherein the second message encapsulates the first message so that the second service card forwards the first message; The second service card includes a second CPU, and the referral session entry is generated and sent to the first CPU after the second CPU processes the received third message and determines that the first message will be received by the first service card; the referral session entry is sent from the first CPU to the first hardware chip. The third message belongs to the same session as the first message. The third message is the first message of the session, and the first message is the return message in the session.

8. The apparatus according to claim 7, characterized in that, The header of the second message carries a first action identifier, which indicates whether the first message is sent to the second CPU; the redirection session entry includes the first action identifier.

9. The apparatus according to claim 7 or 8, characterized in that, The device further includes: a deletion module; The sending module is further configured to send a first aging request message to the first CPU when the traffic diversion session entry reaches the aging time, so that the first CPU forwards the first aging request message to the second service card. The deletion module is used to delete the traffic redirection session entry if it receives a first aging deletion message sent by the first CPU according to the first aging request message.

10. The apparatus according to claim 7 or 8, characterized in that, The device further includes: The deletion module is used to delete the traffic referral session entry if it receives a second aging-out deletion message sent by the first CPU before the aging-out time of the traffic referral session entry.

11. The apparatus according to claim 7, characterized in that, The first hardware chip stores a forwarding session table entry issued by the first CPU, and the first message includes a second action identifier and a fourth message; the device further includes: The forwarding module is configured to forward the fourth message based on the forwarding session table entry if the second action identifier indicates that the fourth message does not need to be sent to the first CPU, and the fourth message matches the forwarding session table entry.

12. The apparatus according to claim 11, characterized in that, The device further includes: a deletion module; The sending module is further configured to send a second aging request message to the first CPU when the forwarding session entry reaches its aging time. The deletion module is used to delete the forwarding session entry if it receives a third aging deletion message sent by the first CPU. The third aging deletion message is sent by the first CPU when it determines that the referral session entry associated with the forwarding session entry has been deleted.

Images