IPv4 public and private network hybrid message forwarding method and device

Abstract

The invention provides an IPv4 public and private network hybrid message forwarding method and device, applied to a destination node, and the method comprises the following steps: receiving a message transmitted by a source node through a pre-established segment identifier SID tunnel; whether the message is an IPv4 message or not is judged, if yes, the IPv4 message is processed, and an upper-layer message header of the processed IPv4 message is extracted; judging whether a source IP address in the upper-layer message header is within a private network IP address range recorded locally or not, and if yes, forwarding the IPv4 message to an interface connected with NAT (Network Address Translation) equipment; and otherwise, forwarding the IPv4 message by using a local IPv4 routing table. According to the method, automatic separation processing of the public network IPv4 flow and the private network IPv4 flow after passing through the SRv6 tunnel is realized through the SRV6 SID; therefore, the service processing flow is simplified, and the forwarding efficiency of the IPv4 public and private network mixed message is improved.

Description

Technical Field

[0001] This application relates to the field of communication network technology, and in particular to a method and apparatus for forwarding mixed public and private IPv4 packets. Background Technology

[0002] In SRv6 (Segment Routing over IPv6), network paths are defined by a series of SIDs (Segment Identifiers), each of which is an IPv6 address corresponding to a specific function or location within the network.

[0003] Currently, SID can only be bound to the target IP address of the packet to be forwarded, and it is not possible to apply different processing logic to packets from different source IP addresses.

[0004] For IPv4 packets that mix public and private networks, they can only be processed using End.DT4 and End.DX4. Processing them using a single End.DT4 or End.DX4 would be complex and time-consuming. Summary of the Invention

[0005] In view of this, this application provides a method and apparatus for forwarding IPv4 public and private network mixed packets to solve the above-mentioned technical problems.

[0006] In a first aspect, embodiments of this application provide a method for forwarding IPv4 public-private network hybrid packets, applied to a destination node, including: Receive messages transmitted by the source node through a pre-established SID tunnel; Determine whether the packet is an IPv4 packet. If it is, process the IPv4 packet and extract the upper-layer packet header of the processed IPv4 packet. Determine whether the source IP address in the upper-layer packet header is within the range of private network IP addresses recorded locally. If yes, forward the IPv4 packet to the interface connected to the NAT device; otherwise, forward the IPv4 packet using the local IPv4 routing table.

[0007] In one possible implementation, the method further includes: Publish a segment identifier (SID), the format of which is: Locator: Function: Arguments The locator is assigned by the administrator of the destination node.

[0008] In one possible implementation, the method further includes: Configure segment identifiers (SIDs) locally for both non-VPN and VPN scenarios.

[0009] In one possible implementation, processing the IPv4 packet includes: Remove the external IPv6 header and all its extended headers from the IPv4 packet.

[0010] In one possible implementation, the method further includes: configuring a range of private network IP addresses locally, including: a first private network segment: 10.0.0.0-10.0.0.8; a second private network segment: 172.16.0.0-172.16.0.12; a third private network segment: 192.168.0.0-192.168.0.16; and a fourth private network segment: 100.64.0.0-100.64.0.10.

[0011] In one possible implementation, determining whether the source IP address in the upper-layer packet header is within the range of private network IP addresses recorded locally includes: Get source IP address: ABCD; Determine if the logical AND of ABCD and 255.0.0.0 equals 10.0.0.0. If yes, the source IP address is in the first private network segment; otherwise, Determine if the logical AND operation between ABCD and 255.240.0.0 equals 172.16.0.0. If yes, the source IP address is in the second private network segment; otherwise, Determine if the logical AND operation between ABCD and 255.255.0.0 equals 192.168.0.0. If yes, the source IP address is located in the third private network segment; otherwise, Determine if the logical AND of ABCD and 255.192.0.0 equals 100.64.0.0. If yes, determine that the source IP address is in the fourth private network segment.

[0012] In one possible implementation, the method further includes: Alternatively, the opcode for the segment identifier (SID) can be set to an opcode within the range of 0x8000-0x87FF, or the opcode for the segment identifier (SID) can be assigned by the Internet Number Assigned Authority (IANA).

[0013] Secondly, embodiments of this application provide an IPv4 public-private network hybrid packet forwarding device, applied to a destination node, comprising: The receiving unit is used to receive messages transmitted by the source node through a pre-established SID tunnel; The processing unit is used to determine whether the packet is an IPv4 packet. If it is, the IPv4 packet is processed and the upper-layer packet header of the processed IPv4 packet is extracted. The forwarding unit is used to determine whether the source IP address in the upper-layer packet header is within the range of private network IP addresses recorded locally. If so, the IPv4 packet is forwarded to the interface connected to the NAT device; otherwise, the IPv4 packet is forwarded using the local IPv4 routing table.

[0014] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method of embodiments of this application.

[0015] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the methods of embodiments of this application.

[0016] Fifthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the method of embodiments of this application.

[0017] This application enables the automatic separation and processing of public and private IPv4 traffic after passing through an SRv6 tunnel using an SRV6 SID; thereby simplifying the business processing flow and improving the forwarding efficiency of mixed public and private IPv4 packets. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating the IPv4 public-private network hybrid packet forwarding method provided in this application embodiment; Figure 2 A schematic diagram illustrating the application scenarios provided in the embodiments of this application; Figure 3 Functional structure diagram of the IPv4 public-private network hybrid packet forwarding device provided in the embodiments of this application; Figure 4 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0022] First, a brief introduction to the design concept of the embodiments of this application will be given.

[0023] Existing technologies follow standards such as RFC 8986. The destination node uses SIDs such as End.DT4 and End.DX4 to instruct the source node to encapsulate the packet, encapsulate the IPv4 packet into the SRv6 tunnel for carrying, and then decapsulates it and queries the IPv4 routing table to forward it (End.DT4) or decapsulates it and forwards it directly through the specified IPv4 adjacency (End.DX4).

[0024] The meaning of End.DT4: End indicates that this is an "Endpoint" type SID, typically executed on an SRv6 endpoint. DT stands for Decapsulation and IPv4 Table lookup. 4 indicates that the decapsulated packet is an IPv4 packet. Therefore, End.DT4 means that when an SRv6-encapsulated packet arrives at the node corresponding to this SID, the node will: remove the outer IPv6 header (SRv6 encapsulation), perform a normal IPv4 routing table lookup on the exposed IPv4 packet, and forward the IPv4 packet to the next hop.

[0025] The meaning of End.DX4: End indicates that this is an endpoint action (the node handles the termination or conversion of SRv6 encapsulation). In DX4, D stands for Decapsulation, and X4 represents IPv4. Therefore, End.DX4 means that after receiving an SRv6 encapsulated packet, the node decapsulates the outer IPv6+SRH layer, exposing the inner IPv4 packet. Then, this IPv4 packet is forwarded to the target IPv4 address according to the IPv4 routing table.

[0026] Public IPv4 traffic can be processed normally using either End.DT4 or End.DX4. Private IPv4 traffic generally requires NAT (Network Address Translation). Therefore, at the destination node, End.DX4 can be used to send the traffic to the NAT device connected to that node for translation, converting it to a public IP address before forwarding it to the public network. For mixed public and private IPv4 traffic, to ensure normal forwarding of public IPv4 traffic, private IPv4 traffic should first be sent to a NAT before forwarding.

[0027] The following two methods can be adopted: Method 1: The destination node publishes two SIDs: End.DT4 and End.DX4. The source node uses strategies such as complex flow classification to redirect traffic with a source IP of private network IPv4 to the End.DX4 tunnel and traffic with a source IP of public network IPv4 to the End.DT4 tunnel.

[0028] Method 2: The destination node only publishes one End.DT4 SID. The source node does not need to be specially processed. After decapsulation, the destination node applies strategies such as complex flow classification to redirect traffic with a source IP of private IPv4 to the NAT device, and directly queries the IPv4 routing table to forward traffic with a source IP of public IPv4.

[0029] After introducing the application scenarios and design concepts of the embodiments of this application, the technical solutions provided by the embodiments of this application will be described below.

[0030] like Figure 1 As shown in the figure, this application provides a method for forwarding IPv4 public and private network hybrid packets, applied to the destination node, including: Step 101: Receive the message sent by the source node through the pre-established SID tunnel; Step 102: Determine whether the packet is an IPv4 packet. If it is, process the IPv4 packet and extract the upper-layer packet header of the processed IPv4 packet. For example, determining whether a message is an IPv4 message specifically involves checking whether the upper-layer header type of the message is 4. If it is, then the message is an IPv4 message.

[0031] Step 103: Determine whether the source IP address in the upper-layer packet header is within the range of private network IP addresses recorded locally. If yes, proceed to step 104; otherwise, proceed to step 105. Step 104: Forward the IPv4 packet to the interface connected to the NAT device; Step 105: Forward IPv4 packets using the local IPv4 routing table.

[0032] This embodiment uses an SRV6 SID to automatically separate public IPv4 traffic and private IPv4 traffic after they pass through an SRv6 tunnel. The separated private IPv4 traffic is automatically sent to the NAT device for address translation, while public traffic is directly ejected from the tunnel and forwarded according to the routing table. This simplifies the business processing flow and improves the forwarding efficiency of mixed public and private IPv4 packets.

[0033] In some embodiments, the method further includes: Publish a segment identifier (SID). The format of the segment identifier (SID) is: Locator: Function: Arguments The locator is assigned by the administrator of the destination node.

[0034] like Figure 2 As shown, this embodiment proposes a new SID named End.DT4X, which enables the simultaneous processing of mixed public and private IPv4 traffic through a single SRv6 for destination nodes with NAT devices attached.

[0035] For example, if the Locator is 2001:0db8:bbbb:0003; the Function is 0x8600; and the Arguments are 0x0000, then the Segment ID (SID) is: 2001:0db8:bbbb:0003::8600:0000 In some embodiments, the method further includes: Configure segment identifiers (SIDs) locally for both non-VPN and VPN scenarios.

[0036] For example: Non-VPN scenario: opcode::xxxx end-dt4x interface xxxx nexthop xxxx private-ip xxxx / x yyyy / y VPN scenario: opcode ::xxxx end-dt4x vpn-instance VPN1 interface xxxxnexthop xxxx private-ip xxxx / x yyyy / y In some embodiments, processing IPv4 packets includes: Remove the external IPv6 header and all its extension headers from the IPv4 packet.

[0037] In some embodiments, the method further includes: configuring a range of private network IP addresses locally, including: a first private network segment: 10.0.0.0-10.0.0.8; a second private network segment: 172.16.0.0-172.16.0.12; a third private network segment: 192.168.0.0-192.168.0.16 and a fourth private network segment: 100.64.0.0-100.64.0.10.

[0038] In some embodiments, determining whether the source IP address in the upper-layer packet header is within the range of private network IP addresses recorded locally includes: Get source IP address: ABCD; Determine if the logical AND of ABCD and 255.0.0.0 equals 10.0.0.0. If yes, the source IP address is in the first private network segment; otherwise, Determine if the logical AND operation between ABCD and 255.240.0.0 equals 172.16.0.0. If yes, the source IP address is in the second private network segment; otherwise, Determine if the logical AND operation between ABCD and 255.255.0.0 equals 192.168.0.0. If yes, the source IP address is located in the third private network segment; otherwise, Determine if the logical AND of ABCD and 255.192.0.0 equals 100.64.0.0. If yes, determine that the source IP address is in the fourth private network segment.

[0039] In some embodiments, the method further includes: Alternatively, the opcode for the segment identifier (SID) can be set to an opcode within the range of 0x8000-0x87FF, or the opcode for the segment identifier (SID) can be assigned by the Internet Number Assigned Authority (IANA).

[0040] Based on the same inventive concept, this application provides an IPv4 public-private network hybrid packet forwarding device, see reference. Figure 3 As shown, the IPv4 public-private network hybrid packet forwarding device 200 provided in this application embodiment includes at least: The receiving unit 201 is used to receive messages transmitted by the source node through a pre-established SID tunnel; The processing unit 202 is used to determine whether the packet is an IPv4 packet. If it is, it processes the IPv4 packet and extracts the upper-layer packet header of the processed IPv4 packet. Forwarding unit 203 is used to determine whether the source IP address in the upper layer packet header is within the range of private network IP addresses recorded locally. If yes, the IPv4 packet is forwarded to the interface connected to the NAT device; otherwise, the IPv4 packet is forwarded using the local IPv4 routing table.

[0041] It should be noted that the principle of the IPv4 public-private network hybrid packet forwarding device 200 provided in this application embodiment to solve the technical problem is similar to the method provided in this application embodiment. Therefore, the implementation of the IPv4 public-private network hybrid packet forwarding device 200 provided in this application embodiment can refer to the implementation of the method provided in this application embodiment, and the repeated parts will not be described again.

[0042] Based on the same inventive concept, embodiments of this application also provide an electronic device, such as... Figure 4 As shown, it includes: a memory and a processor. The memory stores an executable program, and the processor executes the executable program to implement the steps of the IPv4 public-private network hybrid packet forwarding method provided in the above embodiments.

[0043] The aforementioned processor can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0044] Since the electronic device described in this application embodiment is an electronic device equipped with a memory for implementing the IPv4 public-private network hybrid packet forwarding method disclosed in this application embodiment, those skilled in the art can understand the structure and variations of the electronic device described in this application embodiment based on the IPv4 public-private network hybrid packet forwarding method described in this application embodiment, and therefore will not be described again here.

[0045] This application also provides a computer-readable storage medium storing a computer program thereon. When the computer program is run by a processor, it implements the steps of the IPv4 public-private network hybrid packet forwarding method provided in the above embodiments.

[0046] The storage medium in this embodiment may be included in an electronic device; or it may exist independently and not be assembled into an electronic device. The storage medium carries one or more computer programs, which, when executed, implement the steps of the IPv4 public-private network hybrid packet forwarding method provided in the above embodiment.

[0047] It should be understood that the various solutions in this embodiment have the same technical effects as those in the above method embodiments, and will not be repeated here.

[0048] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. Optionally, specific examples in this embodiment can refer to the examples described in any embodiment of this application, which will not be repeated here. Obviously, those skilled in the art should understand that the various modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular hardware and software combination.

[0049] This application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the IPv4 public-private network hybrid packet forwarding method provided in the above embodiments.

[0050] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions targeted in the blocks may occur in a different order than those targeted in the drawings. For example, two consecutively represented blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0051] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. Multitasking and parallel processing may be advantageous in certain environments. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

Claims

1. A method for forwarding IPv4 packets across public and private networks, applied to a destination node, characterized in that, include: Receive messages transmitted by the source node through a pre-established segment identifier (SID) tunnel; Determine whether the packet is an IPv4 packet. If it is, process the IPv4 packet and extract the upper-layer packet header of the processed IPv4 packet. Determine whether the source IP address in the upper-layer packet header is within the range of private network IP addresses recorded locally. If yes, forward the IPv4 packet to the interface connected to the NAT device; otherwise, forward the IPv4 packet using the local IPv4 routing table.

2. The method according to claim 1, characterized in that, The method further includes: Publish a segment identifier (SID), the format of which is: Locator: Function: Arguments The locator is assigned by the administrator of the destination node.

3. The method according to claim 2, characterized in that, The method further includes: Configure segment identifiers (SIDs) locally for both non-VPN and VPN scenarios.

4. The method according to claim 1, characterized in that, Processing the IPv4 packets includes: Remove the external IPv6 header and all its extended headers from the IPv4 packet.

5. The method according to claim 1, characterized in that, The method further includes configuring a range of private network IP addresses locally, including: a first private network segment: 10.0.0.0-10.0.0.8; a second private network segment: 172.16.0.0-172.16.0.12; a third private network segment: 192.168.0.0-192.168.0.16; and a fourth private network segment: 100.64.0.0-100.64.0.

10.

6. The method according to claim 5, characterized in that, Determining whether the source IP address in the upper-layer packet header is within the range of private network IP addresses recorded locally includes: Get source IP address: ABCD; Determine if the logical AND of ABCD and 255.0.0.0 equals 10.0.0.

0. If yes, the source IP address is in the first private network segment; otherwise, Determine if the logical AND operation between ABCD and 255.240.0.0 equals 172.16.0.

0. If yes, the source IP address is in the second private network segment; otherwise, Determine if the logical AND operation between ABCD and 255.255.0.0 equals 192.168.0.

0. If yes, the source IP address is located in the third private network segment; otherwise, Determine if the logical AND of ABCD and 255.192.0.0 equals 100.64.0.

0. If yes, determine that the source IP address is in the fourth private network segment.

7. The method according to claim 1, characterized in that, The method further includes: Alternatively, the opcode for the segment identifier (SID) can be set to an opcode within the range of 0x8000-0x87FF, or the opcode for the segment identifier (SID) can be assigned by the Internet Number Assigned Authority (IANA).

8. An IPv4 public-private network hybrid packet forwarding device, applied to a destination node, characterized in that, include: The receiving unit is used to receive messages transmitted by the source node through a pre-established SID tunnel; The processing unit is used to determine whether the packet is an IPv4 packet. If it is, the IPv4 packet is processed and the upper-layer packet header of the processed IPv4 packet is extracted. The forwarding unit is used to determine whether the source IP address in the upper-layer packet header is within the range of private network IP addresses recorded locally. If so, the IPv4 packet is forwarded to the interface connected to the NAT device; otherwise, the IPv4 packet is forwarded using the local IPv4 routing table.

9. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as claimed in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the method as described in any one of claims 1-7.

Images