Message processing method and apparatus, and computing device

Abstract

Provided in the present application are a message processing method and apparatus, and a system. The method comprises: acquiring a first message from a client, wherein the first message comprises a message header and a data payload, and an SA field in the message header of the first message is an IP address of the client; on the basis of the first message, generating a second message, wherein the second message comprises a target IPv6 message header, an IPv6 extension header and the data payload, a DA field in the target IPv6 message header is an IP address of a server, and the IPv6 extension header comprises the IP address of the client; and sending the second message to the server. By means of the technical solution provided in the present application, a server can acquire the real IP address of a client in a fullNAT mode without affecting the existing network architecture.

Description

Method, apparatus and computing device for processing packet

[0001] The present application claims priority to the Chinese patent application No. 202410677397.1, filed on May 28, 2024, entitled “Method, apparatus and computing device for sending packet”, the Chinese patent application No. 202411040994.X, filed on July 31, 2024, entitled “Method, apparatus and computing device for processing packet”, the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of network communication, and more particularly, to a method, apparatus and computing device for processing packet. BACKGROUND

[0003] Full network address translation (full NAT) is a network address translation technology that allows source and destination addresses to be translated at the network layer. In the full NAT mode, the proxy component receives a packet from the client, translates the source and destination addresses in the packet, and sends the packet to the server. The server will not be aware of the client's source IP address. In some business scenarios with high security requirements, the server needs to perform access control based on the client's real IP address. In the above full NAT mode, the server cannot obtain the client's real IP address, which causes the access control policy to fail.

[0004] In a related technical solution, the client's real IP address is carried in the data unit of the upper layer protocol. For example, the upper layer protocol is the transmission control protocol (TCP), and the client's real IP address can be carried in the TCP packet header of the request packet. In this related technical solution, not only the ability to add the client's real IP address in the packet header is required, but also the ability to unpack the client's real IP address carried in the packet header is required. Therefore, the related prior art has a great impact on the existing network architecture.

[0005] Therefore, without affecting the existing network architecture, the server obtains the client's real IP address in the full NAT mode. SUMMARY

[0006] The application provides a message processing method, device and system, which can make a server obtain a real IP address of a client in a full NAT mode without affecting an existing network architecture.

[0007] In a first aspect, a message processing method is provided, which includes: obtaining a first message from a client, the first message including a message header and a data payload, wherein a source address (SA) field in the message header of the first message is an IP address of the client; generating a second message according to the first message, the second message including a target Internet Protocol version 6 (IPv6) message header, an IPv6 extension header and the data payload, wherein a DA field in the target IPv6 message header is an IP address of a server, and the IPv6 extension header includes the IP address of the client; and sending the second message to the server.

[0008] In the above technical solution, the extension header of the IPv6 message header can be used to normalize the real IP address of the client, and the server can obtain the real IP address of the client by decapsulating the extension header of the IPv6 message header. Therefore, the method of carrying the real IP address of the client does not affect the existing network architecture.

[0009] In combination with the first aspect, in a possible implementation manner of the first aspect, the IPv6 extension header includes an options field, and the options field is filled with the IP address of the client.

[0010] In the above technical solution, the options field reserved in the IPv6 extension header can be directly used to carry the IP address of the client, without the need of adding other fields in the IPv6 extension header to carry the IP address of the client, and the implementation is relatively simple.

[0011] In combination with the first aspect, in a possible implementation manner of the first aspect, the first message is an Internet Protocol version 4 (IPv4) message, and the message header of the first message is an IPv4 message header. The generating of the second message according to the first message includes: decapsulating the IPv4 message header to obtain the IP address of the client included in the IPv4 message header; encapsulating the target IPv6 message header before the data payload; and encapsulating the IPv6 extension header after the target IPv6 message header according to the IP address of the client, to obtain the second message.

[0012] In the technical solution, for the case that the first message is an IPv4 message, the header of the IPv4 message can be first unpacked, and the target IPv6 message header and the IPv6 extension header are re-packed, so that the second message is obtained, and the method provided by the embodiment of the application can also be applied to the scenario in which the IPv4 network is used between the proxy component and the client.

[0013] With reference to the first aspect, in a possible implementation manner of the first aspect, the first message is an IPv6 message, the first message comprises an IPv6 message header and the data payload, and generating the second message according to the first message comprises: obtaining the target IPv6 message header according to the IPv6 message header of the first message; and packing the IPv6 extension header after the target IPv6 message header according to the IP address of the client, to obtain the second message.

[0014] In the technical solution, the IPv6 extension header carrying the IP address of the client can be packed by the proxy component, so that the implementation is relatively simple.

[0015] With reference to the first aspect, in a possible implementation manner of the first aspect, the first message is an IPv6 message, the first message comprises an IPv6 message header, the IPv6 extension header and the data payload, and generating the second message according to the first message comprises: replacing the IPv6 message header in the first message with the target IPv6 message header, to obtain the second message.

[0016] In the technical solution, the IPv6 extension header carrying the IP address of the client can also be packed by the client, that is, the first message sent by the client to the proxy component can directly comprise the IP address of the client, so that the flexibility is relatively strong, the deployment and implementation are relatively easy, and the applicable scenarios are relatively wide.

[0017] With reference to the first aspect, in a possible implementation manner of the first aspect, the first message further comprises a first tunnel message header, and the first tunnel message header is located before the message header of the first message, and the method further comprises: unpacking the first tunnel message header.

[0018] In the technical solution, the client encrypts the message header of the first message by packing a tunnel message header in the first message, so that the IP address of the client carried in the first message is prevented from being tampered with in the process from the client to the proxy component, and the security is improved.

[0019] With reference to the first aspect, in a possible implementation manner of the first aspect, the second packet further comprises a second tunnel packet header, and the second tunnel packet header is located before the target IPv6 packet header; and the method further comprises: encapsulating the second tunnel packet header before the target IPv6 packet header of the second packet.

[0020] In the technical solution, the second packet is encrypted by encapsulating a tunnel packet header in the second packet, so that the IP address of the client carried in the second packet is prevented from being tampered with in the process of being sent from the proxy component to the server, and the security is improved.

[0021] The second aspect provides a packet processing method, which comprises: a server receiving a second packet, the second packet comprising a target Internet Protocol version 6 (IPv6) packet header, an IPv6 extension header and a data payload, wherein a DA field of the target IPv6 packet header is an IP address of the server, and the IPv6 extension header comprises an IP address of a client; and the server decapsulating the IPv6 extension header to obtain the IP address of the client.

[0022] In the technical solution, the server can decapsulate the IPv6 extension header in the obtained second packet to obtain the real IP address of the client by using the capability of the server to decapsulate the IPv6 extension header, so that the server can perform access control according to the real IP address of the client subsequently.

[0023] With reference to the second aspect, in a possible implementation manner of the second aspect, the IPv6 extension header comprises an options field, and the options field is filled with the IP address of the client.

[0024] With reference to the second aspect, in a possible implementation manner of the second aspect, the second packet further comprises a second tunnel packet header, and the second tunnel packet header is located before the target IPv6 packet header; and the method further comprises: the server decapsulating the second tunnel packet header.

[0025] In the technical solution, the second packet is encrypted by encapsulating a tunnel packet header in the second packet, so that the IP address of the client carried in the second packet is prevented from being tampered with in the process of being sent to the server, and the security is improved. The server can decapsulate the tunnel packet header to obtain the IPv6 extension header.

[0026] With reference to the second aspect, in a possible implementation manner of the second aspect, the method further comprises: the server verifying an access right of the client according to an access policy and the IP address of the client.

[0027] In the technical solution, after obtaining the real IP address of the client, the access right of the client is checked based on the access policy and the real IP address of the client, so that the client without the access right can be prevented from accessing the service deployed on the service end.

[0028] With reference to the second aspect, in a possible implementation manner of the second aspect, the access policy comprises an access white list, and the access white list comprises a plurality of IP addresses allowed to access the service end. If the IP address of the client is included in the plurality of IP addresses of the access white list, the service end allows the client to access the service deployed on the service end; or if the IP address of the client is not included in the plurality of IP addresses of the access white list, the service end refuses the client to access the service deployed on the service end.

[0029] In the technical solution, if the real IP address of the client obtained by the service end from the second message is included in the access white list, the client can be allowed to access the service deployed on the service end, otherwise the service end refuses the client to access the service deployed on the service end.

[0030] With reference to the second aspect, in a possible implementation manner of the second aspect, the second message is obtained by the proxy component according to the first message sent by the client.

[0031] With reference to the second aspect, in a possible implementation manner of the second aspect, the first message is an Internet Protocol version 4 (IPv4) message, and the first message comprises an IPv4 message header and the data payload.

[0032] With reference to the second aspect, in a possible implementation manner of the second aspect, the first message is an IPv6 message, and the first message comprises an IPv6 message header and the data payload.

[0033] With reference to the second aspect, in a possible implementation manner of the second aspect, the first message is an IPv6 message, and the first message comprises an IPv6 message header, the IPv6 extension header and the data payload.

[0034] With reference to the second aspect, in a possible implementation manner of the second aspect, the first message further comprises a first tunnel message header, and the first tunnel message header is located before the message header of the first message.

[0035] In a third aspect, a device for processing a packet is provided. The device is applied to a proxy component, and includes an obtaining module, a processing module, and a sending module. The obtaining module is configured to obtain a first packet from a client, the first packet including a packet header and a data payload, wherein a source address (SA) field in the packet header of the first packet is an IP address of the client. The processing module is configured to generate a second packet according to the first packet, the second packet including a target Internet Protocol version 6 (IPv6) packet header, an IPv6 extension header, and the data payload, wherein a destination address (DA) field in the target IPv6 packet header is an IP address of a server, and the IPv6 extension header includes the IP address of the client. The sending module is configured to send the second packet to the server.

[0036] With reference to the third aspect, in a possible implementation manner of the third aspect, the IPv6 extension header includes an options field, and the options field is filled with the IP address of the client.

[0037] With reference to the third aspect, in a possible implementation manner of the third aspect, the first packet is an Internet Protocol version 4 (IPv4) packet, and the packet header of the first packet is an IPv4 packet header. The processing module is specifically configured to: unpack the IPv4 packet header to obtain the IP address of the client included in the IPv4 packet header; pack the target IPv6 packet header before the data payload; and pack the IPv6 extension header after the target IPv6 packet header according to the IP address of the client, to obtain the second packet.

[0038] With reference to the third aspect, in a possible implementation manner of the third aspect, the first packet is an IPv6 packet, and the first packet includes an IPv6 packet header and the data payload. The processing module is specifically configured to: obtain the target IPv6 packet header according to the IPv6 packet header of the first packet; and pack the IPv6 extension header after the target IPv6 packet header according to the IP address of the client, to obtain the second packet.

[0039] With reference to the third aspect, in a possible implementation manner of the third aspect, the first packet is an IPv6 packet, and the first packet includes an IPv6 packet header, the IPv6 extension header, and the data payload. The processing module is specifically configured to: replace the IPv6 packet header in the first packet with the target IPv6 packet header, to obtain the second packet.

[0040] With reference to the third aspect, in a possible implementation manner of the third aspect, the first packet further includes a first tunnel packet header, and the first tunnel packet header is located before the packet header of the first packet. The processing module is further configured to unpack the first tunnel packet header. With reference to the third aspect, in a possible implementation manner of the third aspect, the first packet further includes a first tunnel packet header, and the first tunnel packet header is located before the packet header of the first packet. The processing module is further configured to unpack the first tunnel packet header. With reference to the third aspect, in a possible implementation manner of the third aspect, the first packet further includes a first tunnel packet header, and the first tunnel packet header is located before the packet header of the first packet. The processing module is further configured to unpack the first tunnel packet header.

[0041] With reference to the third aspect, in a possible implementation manner of the third aspect, the second packet further includes a second tunnel packet header, the second tunnel packet header is located before the target IPv6 packet header, and the processing module is further configured to encapsulate the second tunnel packet header before the target IPv6 packet header of the second packet.

[0042] The beneficial effects of the third aspect and any one of the possible implementation manners of the third aspect are corresponding to those of the first aspect and any one of the possible implementation manners of the first aspect, and thus are not described herein.

[0043] In the fourth aspect, a packet processing apparatus is provided, which is applied to a server end, and includes a receiving module and a processing module. The receiving module is configured to receive a second packet, the second packet including a target Internet Protocol version 6 (IPv6) packet header, an IPv6 extension header, and a data payload. The DA field of the target IPv6 packet header is an IP address of the server end, and the IPv6 extension header includes an IP address of a client. The processing module is configured to decapsulate the IPv6 extension header to obtain the IP address of the client.

[0044] With reference to the fourth aspect, in a possible implementation manner of the fourth aspect, the IPv6 extension header includes an options field, and the options field is filled with the IP address of the client.

[0045] With reference to the fourth aspect, in a possible implementation manner of the fourth aspect, the second packet further includes a second tunnel packet header, the second tunnel packet header is located before the target IPv6 packet header, and the processing module is further configured to decapsulate the second tunnel packet header.

[0046] With reference to the fourth aspect, in a possible implementation manner of the fourth aspect, the apparatus further includes a verification module configured to verify access rights of the client according to an access policy and the IP address of the client.

[0047] With reference to the fourth aspect, in a possible implementation manner of the fourth aspect, the access policy includes an access white list, the access white list including a plurality of IP addresses allowed to access the server end, and the verification module is specifically configured to: if the IP address of the client is included in the plurality of IP addresses of the access white list, the server end allows the client to access services deployed on the server end; or if the IP address of the client is not included in the plurality of IP addresses of the access white list, the server end refuses the client to access the services deployed on the server end.

[0048] With reference to the fourth aspect, in a possible implementation form of the fourth aspect, the second packet is obtained by the proxy component according to the first packet sent by the client.

[0049] With reference to the fourth aspect, in a possible implementation form of the fourth aspect, the first packet is an Internet Protocol version 4 (IPv4) packet, and the first packet comprises an IPv4 packet header and the data payload.

[0050] With reference to the fourth aspect, in a possible implementation form of the fourth aspect, the first packet is an IPv6 packet, and the first packet comprises an IPv6 packet header and the data payload.

[0051] With reference to the fourth aspect, in a possible implementation form of the fourth aspect, the first packet is an IPv6 packet, and the first packet comprises an IPv6 packet header, the IPv6 extension header and the data payload.

[0052] With reference to the fourth aspect, in a possible implementation form of the fourth aspect, the first packet further comprises a first tunnel packet header, and the first tunnel packet header is located before a packet header of the first packet.

[0053] The beneficial effects of the fourth aspect and any one of the possible implementation forms of the fourth aspect are corresponding to those of the second aspect and any one of the possible implementation forms of the second aspect, and will not be repeated here.

[0054] In the fifth aspect, a computing device is provided, comprising a processor and a memory, and optionally further comprising an input / output interface. The processor is configured to control the input / output interface to receive and send information, and the memory is configured to store a computer program. The processor is configured to call and run the computer program from the memory, so as to execute the method in the first aspect or any one of the possible implementation forms of the first aspect.

[0055] Optionally, the processor can be a general-purpose processor, which can be implemented by hardware or software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading software codes stored in the memory. The memory can be integrated in the processor or exist independently outside the processor.

[0056] In the sixth aspect, a computing device is provided, comprising a processor and a memory, and optionally further comprising an input / output interface. The processor is configured to control the input / output interface to receive and send information, and the memory is configured to store a computer program. The processor is configured to call and run the computer program from the memory, so as to execute the method in the second aspect or any one of the possible implementation forms of the second aspect.

[0057] Optionally, the processor can be a general processor, can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general processor, and the implementation is realized by reading software codes stored in a memory. The memory can be integrated in the processor or can exist independently outside the processor.

[0058] In a seventh aspect, a computing device cluster is provided, including at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method in the first aspect or any possible implementation manner of the first aspect.

[0059] In an eighth aspect, a computing device cluster is provided, including at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method in the second aspect or any possible implementation manner of the second aspect.

[0060] In a ninth aspect, a chip is provided, which acquires instructions and executes the instructions to implement the method in the first aspect and any implementation manner of the first aspect.

[0061] Optionally, as an implementation manner, the chip includes a processor and a data interface, the processor reads instructions stored in a memory through the data interface, and executes the method in the first aspect and any implementation manner of the first aspect.

[0062] Optionally, as an implementation manner, the chip can further include a memory, the memory stores instructions, and the processor is configured to execute the instructions stored in the memory, and when the instructions are executed, the processor is configured to execute the method in the first aspect and any implementation manner of the first aspect.

[0063] In a tenth aspect, a chip is provided, which acquires instructions and executes the instructions to implement the method in the second aspect and any implementation manner of the second aspect.

[0064] Optionally, as an implementation manner, the chip includes a processor and a data interface, the processor reads instructions stored in a memory through the data interface, and executes the method in the second aspect and any implementation manner of the second aspect.

[0065] Optionally, as an implementation form, the chip further comprises a memory, and the memory stores instructions, and the processor is configured to execute the instructions stored in the memory, and the processor is configured to execute the method in the second aspect and any implementation form of the second aspect when the instructions are executed.

[0066] In an eleventh aspect, a computer program product comprising instructions, which when executed by a computing device, cause the computing device to perform the method in the first aspect and any implementation form of the first aspect.

[0067] In a twelfth aspect, a computer program product comprising instructions, which when executed by a computing device, cause the computing device to perform the method in the second aspect and any implementation form of the second aspect.

[0068] In a thirteenth aspect, a computer program product comprising instructions, which when executed by a computing device cluster, cause the computing device cluster to perform the method in the first aspect and any implementation form of the first aspect.

[0069] In a fourteenth aspect, a computer program product comprising instructions, which when executed by a computing device cluster, cause the computing device cluster to perform the method in the second aspect and any implementation form of the second aspect.

[0070] In a fifteenth aspect, a computer-readable storage medium comprising computer program instructions, which when executed by a computing device, cause the computing device to perform the method in the first aspect and any implementation form of the first aspect.

[0071] As an example, the computer-readable storage includes, but is not limited to, one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), Flash memory, electrically EPROM (EEPROM), and hard drive.

[0072] Optionally, as an implementation form, the storage medium can be a non-volatile storage medium.

[0073] In a sixteenth aspect, a computer-readable storage medium comprising computer program instructions, which when executed by a computing device, cause the computing device to perform the method in the second aspect and any implementation form of the second aspect.

[0074] As examples, these computer-readable storage devices include, but are not limited to, one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), flash memory, electrically EPROM (EEPROM), and hard drive.

[0075] Alternatively, as one implementation method, the aforementioned storage medium can specifically be a non-volatile storage medium.

[0076] In a seventeenth aspect, a computer-readable storage medium is provided, including computer program instructions that, when executed by a cluster of computing devices, perform the method as described in the first aspect and any implementation thereof.

[0077] As examples, these computer-readable storage devices include, but are not limited to, one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), flash memory, electrically EPROM (EEPROM), and hard drive.

[0078] Alternatively, as one implementation method, the aforementioned storage medium can specifically be a non-volatile storage medium.

[0079] Eighteenthly, a computer-readable storage medium is provided, including computer program instructions that, when executed by a cluster of computing devices, perform the method as described in the second aspect above and any implementation thereof.

[0080] As examples, these computer-readable storage devices include, but are not limited to, one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), flash memory, electrically EPROM (EEPROM), and hard drive.

[0081] Optionally, as an implementation manner, the storage medium can be a nonvolatile storage medium.

[0082] In a nineteenth aspect, a system for packet processing is provided. The system includes a client, a proxy component, and a server. The client is configured to send a first packet to the proxy component. The first packet includes a packet header and a data payload. A source address (SA) field in the packet header of the first packet is an IP address of the client. A destination address (DA) field in the packet header of the first packet is an IP address of the proxy component. The proxy component is configured to generate a second packet based on the first packet. The second packet includes a target Internet Protocol version 6 (IPv6) packet header, an IPv6 extension header, and the data payload. An SA field in the target IPv6 packet header is the IP address of the proxy component. A DA field in the target IPv6 packet header is an IP address of the server. The IPv6 extension header includes the IP address of the client. The proxy component is further configured to send the second packet to the server. The server is configured to receive the second packet, and decapsulate the IPv6 extension header in the second packet to obtain the IP address of the client. BRIEF DESCRIPTION OF DRAWINGS

[0083] FIG. 1 is a schematic block diagram of an application scenario of a full NAT mode.

[0084] FIG. 2 is a schematic block diagram of a cloud scenario suitable for embodiments of the present application.

[0085] FIG. 3 is a schematic flowchart of a method for packet processing according to an embodiment of the present application.

[0086] FIG. 4 is a schematic diagram of a format of a second packet according to an embodiment of the present application.

[0087] FIG. 5 is a schematic diagram of a scenario of a full NAT mode according to an embodiment of the present application.

[0088] FIG. 6 is a schematic diagram of another scenario of a full NAT mode according to an embodiment of the present application.

[0089] FIG. 7 is a schematic diagram of another scenario of a full NAT mode according to an embodiment of the present application.

[0090] FIG. 8 is a schematic diagram of another scenario of a full NAT mode according to an embodiment of the present application.

[0091] FIG. 9 is a schematic diagram of another scenario of a full NAT mode according to an embodiment of the present application.

[0092] FIG. 10 is a schematic diagram of another scenario of a full NAT mode according to an embodiment of the present application.

[0093] FIG. 11 is a schematic diagram of another full NAT mode scenario according to an embodiment of the present application.

[0094] FIG. 12 is a schematic diagram of another full NAT mode scenario according to an embodiment of the present application.

[0095] FIG. 13 is a schematic diagram of another full NAT mode scenario according to an embodiment of the present application.

[0096] FIG. 14 is a schematic diagram of another full NAT mode scenario according to an embodiment of the present application.

[0097] FIG. 15 is a schematic diagram of another full NAT mode scenario according to an embodiment of the present application.

[0098] FIG. 16 is a schematic block diagram of a packet processing apparatus 1600 according to an embodiment of the present application.

[0099] FIG. 17 is a schematic block diagram of another packet processing apparatus 1700 according to an embodiment of the present application.

[0100] FIG. 18 is a schematic diagram of an architecture of a computing device 1500 according to an embodiment of the present application.

[0101] FIG. 19 is a schematic diagram of an architecture of a computing device cluster according to an embodiment of the present application.

[0102] FIG. 20 is a schematic diagram of a connection between computing devices 1500A and 1500B via a network according to an embodiment of the present application. DETAILED DESCRIPTION

[0103] The technical solutions in the present application will be described below with reference to the accompanying drawings.

[0104] The present application will present various aspects, embodiments or features around a system including a plurality of devices, components, modules, etc. It should be understood and appreciated that each system can include additional devices, components, modules, etc., and / or can not include all of the devices, components, modules, etc. discussed in connection with the accompanying drawings. Furthermore, combinations of these aspects can also be used.

[0105] In addition, in the embodiments of the present application, the words "example", "for example", etc. are used to mean serving as an example, instance, or illustration. Any embodiment or design presented as an example in the present application should not be interpreted as being more preferred or advantageous than other embodiments or design solutions. Rather, the word "example" is used to present concepts in a concrete manner.

[0106] In the embodiments of this application, "corresponding" and "relevant" can be used interchangeably at times. It should be noted that when the distinction between them is not emphasized, the meanings expressed by them are consistent.

[0107] The network architecture and service scenarios described in the embodiments of this application are used to more clearly illustrate the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art can know that, as network architectures evolve and new service scenarios appear, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0108] In this specification, the reference to "one embodiment" or "some embodiments" etc. means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. Therefore, the statements "in one embodiment", "in some embodiments", "in other some embodiments", "in yet some embodiments" etc. appearing in different places in the specification are not necessarily all referring to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized. The terms "comprise", "include", "have" and their variants mean "including but not limited to", unless otherwise specifically emphasized.

[0109] In this application, "at least one" means one or more, and "multiple" means two or more. The association relationship between the associated objects is described by "and / or", which means that there can be three kinds of relationships, for example, A and / or B can represent the following cases: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can represent a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.

[0110] Full network address translation (full NAT) is a network address translation technology that allows an organization to convert internal network addresses to public network addresses to protect the internal network from external threats. In a load balancing environment, the FullNAT mode is responsible for handling network traffic between the client and the backend server, and can evenly distribute request traffic from the Internet to the server cluster on the backend, improving the scalability of the system and the availability of services. Compared with traditional NAT technology, the FullNAT mode uses full NAT implementation to solve the performance bottleneck and scalability problem in the application scenario of frequent establishment and destruction of short connections.

[0111] For example, FIG. 1 is an application scenario of the fullNAT mode. As shown in FIG. 1, the scenario can include a client, a proxy component, and a server. When the client accesses the server, the client usually sends a message to the proxy component (for example, elastic load balance (ELB)), which is responsible for implementing source address translation and destination address translation at the network layer, and sending the message to the corresponding server in the server cluster according to the load balancing algorithm.

[0112] For example, the source address (SRC) of the request message sent by the client to the proxy component is the internet protocol (IP) address of the client, and the destination address (DST) is the virtual IP (VIP) address of the proxy component. The SRC of the request message sent by the proxy component to the server is the intranet IP address of the proxy component, and the DST is the intranet IP address of the corresponding server.

[0113] As can be seen from the above request message sent by the client to the proxy component and the request message sent by the proxy component to the server, the server will not be aware of the source IP address of the client. In some business scenarios with high security requirements, the server needs to implement access control policies based on the real IP address of the client. In the above fullNAT mode, the server cannot obtain the real IP address of the client, which causes the access control policy to fail.

[0114] Therefore, how to enable the server to obtain the real IP address of the client so that the server can implement access control based on the real IP address in some business scenarios with high security requirements has become a challenge in the industry.

[0115] In a related technical solution, the real IP address of the client is carried in a data unit of an upper layer protocol. For example, the upper layer protocol is the transmission control protocol (TCP), and the real IP address of the client can be carried in a TCP packet header of a request packet. In the related technical solution, not only does the proxy component need to have the capability of adding the real IP address of the client in the packet header, but also needs to have the capability of decapsulating the real IP address of the client carried in the packet header. Therefore, the related prior art has a greater impact on the architecture of the existing network.

[0116] Therefore, the embodiments of the present application provide a message processing method. The method can normalize the real IP address of the client by using the extension header of the IPv6 message header, and the server can obtain the real IP address of the client by decapsulating the extension header of the IPv6 message header. Therefore, the method of carrying the real IP address of the client does not affect the architecture of the existing network.

[0117] In a possible implementation manner, the method provided by the embodiments of the present application can be applied to a cloud service scenario, and the server can be a server of at least one cloud data center. For ease of description, the cloud service scenario is described in detail below in combination with FIG. 2.

[0118] FIG. 2 is a schematic block diagram of a cloud scenario suitable for the embodiments of the present application. As shown in FIG. 2, the cloud scenario can include infrastructure managed by a cloud management platform, the infrastructure including a plurality of cloud data centers, each cloud data center including a plurality of servers, and each server including cloud service resources, which provide corresponding cloud services for tenants.

[0119] The cloud management platform can be located in a cloud data center, which can provide an access interface (such as an interface or an application program interface (API)). A tenant can remotely access the access interface to register a cloud account and a password on the cloud management platform and log in to the cloud management platform. After the cloud management platform successfully authenticates the cloud account and the password, the tenant can further select and purchase a virtual machine of a specific specification (processor, memory, disk) on the cloud management platform by paying a fee. After the payment and purchase are successful, the cloud management platform provides a remote login account and password of the purchased virtual machine, and the tenant can remotely log in to the virtual machine, install and run the tenant's application in the virtual machine. Therefore, the tenant can create, manage, log in to, and operate the virtual machine in the cloud data center through the cloud management platform. The virtual machine can also be referred to as a cloud server (elastic compute service, ECS) or an elastic instance (different cloud service providers have different names).

[0120] It should be understood that the tenant of the cloud service can be an individual, an enterprise, a school, a hospital, an administrative organ, or the like.

[0121] The functions of the cloud management platform include but are not limited to a user console, a computing management service, a network management service, a storage management service, an authentication service, and an image management service. The user console provides an interface or an API to interact with the tenant, the computing management service is used to manage servers running virtual machines and containers and bare metal servers, the network management service is used to manage network services (such as gateways and firewalls), the storage management service is used to manage storage services (such as data bucket services), the authentication service is used to manage the account and password of the tenant, and the image management service is used to manage virtual machine images.

[0122] Next, a method for sending a packet provided by an embodiment of the present application will be described in detail with reference to FIG. 3. It should be understood that the example of FIG. 3 is only used to help those skilled in the art understand the embodiments of the present application, and is not intended to limit the embodiments of the present application to the specific values or specific scenarios shown in FIG. 3. Those skilled in the art can obviously make various equivalent modifications or changes based on the examples given in FIG. 3, and such modifications and changes also fall within the scope of the embodiments of the present application.

[0123] FIG. 3 is a schematic flowchart of a method for processing a packet provided by an embodiment of the present application. As shown in FIG. 3, the method can include steps 310-330, which will be described in detail below.

[0124] Step 310: The proxy component receives a first packet sent by a client.

[0125] The embodiment of the present application does not make specific limitation to the proxy component, as long as it can have the address conversion function. For example, the proxy component is an elastic load balance (ELB).

[0126] For example, the proxy component and the client can be an IPv4 network or an IPv6 network, and the embodiment of the present application does not make specific limitation thereto.

[0127] The IPv4 network can be an IPv4 public network or an IPv4 private network, and the embodiment of the present application does not make specific limitation thereto.

[0128] The IPv6 network can be an IPv6 public network or an IPv6 private network, and the embodiment of the present application does not make specific limitation thereto.

[0129] For example, if the proxy component and the client are an IPv4 network, the first message sent by the client to the proxy component can be an IPv4 message.

[0130] The IPv4 message can include an IPv4 message header and a data payload.

[0131] For another example, if the proxy component and the client are an IPv6 network, the first message sent by the client to the proxy component can be an IPv6 message.

[0132] The IPv6 message can include an IPv6 message header and a data payload.

[0133] Optionally, the IPv6 message can further include an IPv6 extension header following the IPv6 message header, that is, the IPv6 message includes an IPv6 message header, an IPv6 extension header, and a data payload, and the IPv6 extension header carries the IP address of the client.

[0134] In step 320, the proxy component acquires a second message according to the first message, and the second message includes an IPv6 message header, an IPv6 extension header, and a data payload, and the IPv6 extension header carries the IP address of the client.

[0135] For example, the fields included in the IPv6 message header and the IPv6 extension header in the IPv6 message are described in detail below in combination with FIG. 4.

[0136] 1. IPv6 message header

[0137] The IPv6 message header can also be referred to as an IPv6 basic header, and is 40 bytes (320 bits) in total, and can include the following fields:

[0138] 1) version (Ver): 4 bits, used to identify the version of IP, the value of the version field of IPv6 is 6.

[0139] 2) traffic class (TC): 8 bits, used to distinguish the categories and priorities of different IPv6 packets.

[0140] 3) flow label: 20 bits, the "flow" can be understood as the packets from a specific source address to a specific destination address on the network, and the flow labels of the packets belonging to the same "flow" are the same.

[0141] 4) payload length: 16 bits, the length of the part other than the IPv6 basic header (for example, the IPv6 extension header and the data payload).

[0142] 5) next header (NH): 8 bits, which can be understood as the identification number of the IPv6 extension header following the IPv6 basic header (i.e., the type of IPv6 extension header). For example, the NH field is filled with the value of 0x13 if the IPv6 extension header following the IPv6 basic header carries the IPv6 address. For another example, the NH field is filled with the value of 0x14 if the IPv6 extension header following the IPv6 basic header carries the Ipv4 address.

[0143] 6) hop limit (HL): 8 bits, similar to the time to live (TTL) field of IPv4.

[0144] 7) source address (SA): 128 bits, used to fill in the address of the client sending the IPv6 packet. For example, the SA field is filled with the IPv4 address or IPv6 address of the client.

[0145] 8) destination address (DA): 128 bits, used to fill in the address of the client receiving the IPv6 packet. For example, the DA field is filled with the VIPv4 address or VIPv6 address of the proxy component.

[0146] 2, IPv6 extension header

[0147] The IPv6 extension header follows the IPv6 basic header and can include the following fields:

[0148] 1) next header (NH): used to indicate the identification number of another IPv6 extension header following the IPv6 extension header. For example, the IPv6 extension header following the IPv6 extension header carries an IPv6 address, and the NH field in the IPv6 extension header is filled with the value of 0x13. For another example, the IPv6 extension header following the IPv6 extension header carries an IPv4 address, and the NH field in the IPv6 extension header is filled with the value of 0x14.

[0149] 2) options field: used to carry the IP address of the client. The IP address of the client can be an IPv6 address of the client, or can also be an IPv4 address of the client, depending on whether the network between the client and the proxy component is an IPv4 network or an IPv6 network, which is not limited in the present application.

[0150] Optionally, the options field can also carry a destination port number.

[0151] 3) length of the extension header (Hdr Ext Len): used to indicate the size of the information carried in the options field.

[0152] For an example, if the options field carries a destination port number (2 bytes) and an IPv6 address of the client (16 bytes), the value of the Hdr Ext Len field is 20 bytes.

[0153] For another example, if the options field carries a destination port number (2 bytes) and an IPv4 address of the client (4 bytes), the value of the Hdr Ext Len field is 8 bytes.

[0154] In the embodiments of the present application, there are multiple ways for the proxy component to obtain the second packet according to the first packet, which will be described in detail as follows.

[0155] Implementation manner 1: assuming that the first packet sent by the client to the proxy component is an IPv4 packet, the IPv4 packet can include an IPv4 packet header and a data payload.

[0156] For an example, the proxy component needs to decapsulate the IPv4 packet header in the received IPv4 packet, re-capsulate an IPv6 packet header before the data payload, and add an IPv6 extension header carrying the IP address of the client after the IPv6 packet header, so as to obtain the second packet.

[0157] For example, the SA field in the IPv4 header of the first message sent by the client to the proxy component carries the client's IP address. The proxy component can obtain the client's IP address from the SA field in the IPv4 header and encapsulate the client's IP address in the IPv6 extension header.

[0158] Implementation method 2: Assume that the first message sent by the client to the proxy component is an IPv4 message, which may include a tunnel header, an IPv4 header, and a data payload.

[0159] It should be understood that in the above implementation method 2, in order to prevent the client's IP address carried in the SA field of the IPv4 packet header in the first message from being tampered with by hackers, the client can also encapsulate a tunnel packet header in front of the IPv4 packet header. That is, the first message sent by the client to the proxy component includes a tunnel packet header, an IPv4 packet header, and a data payload.

[0160] For example, taking IPSEC tunneling technology as an example, an IPSEC tunnel can be established between the client and the proxy component, and the tunnel header mentioned above can be an IPSEC header.

[0161] For example, the proxy component needs to decapsulate the tunnel header in the IPv4 packet to obtain the IPv4 packet header and data payload, decapsulate the IPv4 packet header, recapsulate an IPv6 packet header before the data payload, and add an IPv6 extension header carrying the client's IP address after the IPv6 packet header to obtain the aforementioned second packet.

[0162] For example, the proxy component can authenticate the client. After successful authentication, the proxy component will obtain the client's IP address from the SA field in the IPv4 header and encapsulate the client's IP address in the IPv6 extension header.

[0163] Implementation method 3: Assume that the first message sent by the client to the proxy component is an IPv6 message, which may include an IPv6 message header and a data payload.

[0164] For example, the proxy component needs to add an IPv6 extension header carrying the client's IP address to the end of the IPv6 header of the received IPv6 packet in order to obtain the aforementioned second packet.

[0165] For example, the SA field in the IPv6 header of the first message sent by the client to the proxy component carries the client's IP address. The proxy component can obtain the client's IP address from the SA field in the IPv6 header and encapsulate the client's IP address in the IPv6 extended header.

[0166] In implementation 4, the first packet sent by the client to the proxy component is an IPv6 packet, which can include a tunnel packet header, an IPv6 packet header, and a data payload.

[0167] It should be understood that in implementation 4, in order to avoid hacking of the IP address of the client carried in the SA field of the IPv6 packet header in the first packet, the client can also encapsulate a tunnel packet header in front of the IPv6 packet header, that is, the first packet sent by the client to the proxy component includes a tunnel packet header, an IPv6 packet header, and a data payload.

[0168] For example, the client and the proxy component can establish an IPSEC tunnel, and the tunnel packet header described above can be an IPSEC packet header.

[0169] For example, the proxy component can authenticate the client, and only after the authentication is passed, the proxy component obtains the IP address of the client from the SA field of the IPv6 packet header and encapsulates the IP address of the client in the IPv6 extension header.

[0170] For example, the proxy component can authenticate the client, and only after the authentication is passed, the proxy component obtains the IP address of the client from the SA field of the IPv6 packet header and encapsulates the IP address of the client in the IPv6 extension header.

[0171] In implementation 5, the first packet sent by the client to the proxy component is an IPv6 packet, which can include an IPv6 packet header, an IPv6 extension header carrying the IP address of the client, and a data payload.

[0172] For example, the proxy component can modify the SA field and the DA field of the IPv6 packet header in the first packet, and obtain the second packet described above.

[0173] In implementation 6, the first packet sent by the client to the proxy component is an IPv6 packet, which can include a tunnel packet header, an IPv6 packet header, an IPv6 extension header carrying the IP address of the client, and a data payload.

[0174] For example, the proxy component needs to decapsulate the tunnel packet header in the IPv6 packet to obtain the IPv6 packet header, the IPv6 extension header carrying the IP address of the client, and the data payload. Referring to implementation 5 described above, the SA field and the DA field of the IPv6 packet header in the first packet are modified, and the second packet described above is obtained.

[0175] In the embodiment of the present application, the SA field in the IPv6 packet header of the second packet can be a public network address of the proxy component (for example, global unicast addresses (GUA) of the proxy component), or can also be a private network address of the proxy component (for example, unique local addresses (ULA) of the proxy component).

[0176] In the embodiment of the present application, the DA field in the IPv6 packet header of the second packet can be a public network address of the server (for example, GUA of the server), or can also be a private network address of the server (for example, ULA of the server).

[0177] Optionally, in order to avoid the IP address of the client carried in the IPv6 packet extension header of the second packet being tampered with by hackers, an IPSEC tunnel can also be established between the proxy component and the server, and the proxy component can encapsulate an IPSEC packet header before the IPv6 packet header of the second packet. That is, in this implementation manner, the second packet includes an IPSEC packet header, an IPv6 packet header, an IPv6 extension header carrying the IP address of the client, and a data payload.

[0178] Step 330: The proxy component sends the second packet to the server.

[0179] In the embodiment of the present application, the proxy component can send the second packet to the server, and after the server receives the second packet, the server can decapsulate the IPv6 extension header in the second packet to obtain the IP address of the client carried in the IPv6 extension header, and use the IP address of the client to perform access control by using an access policy. For example, the access policy includes an access white list, and the access white list includes a plurality of IP addresses allowed to access the server. If the IP address of the client is included in the plurality of IP addresses of the access white list, the server allows the client to access the service deployed on the server; or if the IP address of the client is not included in the plurality of IP addresses of the access white list, the server refuses the client to access the service deployed on the server.

[0180] In one example, it is assumed that the second packet received by the server includes an IPSEC packet header, an IPv6 packet header, an IPv6 extension header carrying the IP address of the client, and a data payload. The proxy component needs to sequentially decapsulate the IPSEC packet header, the IPv6 packet header, and the IPv6 extension header to obtain the IP address of the client.

[0181] For another example, the second packet includes an IPv6 packet header, an IPv6 extension header carrying the IP address of the client, and a data payload. The proxy component needs to sequentially decapsulate the IPv6 packet header and the IPv6 extension header to obtain the IP address of the client.

[0182] In the technical solution, the IPv6 extension header in the original IPv6 packet is used to carry the IP address of the client, and the proxy component can obtain the IP address of the client by decapsulating the IPv6 extension header, so that the generality is higher, the application range is wider, the change of the existing network is smaller, and the implementation and deployment are easier.

[0183] The following takes the network between the client and the proxy component as an IPv4 network and the network between the proxy component and the server as an IPv6 network as an example, and illustrates the specific implementation of the method for sending a packet by combining FIG. 5-FIG. 9.

[0184] It should be understood that the examples of FIG. 5-FIG. 9 are only used to help those skilled in the art understand the embodiments of the present application, and are not intended to limit the embodiments of the present application to the specific values or specific scenarios shown in the examples of FIG. 5-FIG. 9. Those skilled in the art can obviously make various equivalent modifications or changes according to the examples given in FIG. 5-FIG. 9, and such modifications and changes also fall within the scope of the embodiments of the present application.

[0185] Example 1, as shown in FIG. 5, the network in a certain enterprise / government data center has been changed to an IPv6 network. The client network is an IPv4 external network, and the client initiates access by resolving the A record corresponding to the domain name of the server through a domain name server (DNS).

[0186] The client sends a first packet to the proxy component through the IPv4 external network, and the first packet is an IPv4 packet. The IPv4 packet includes an IPv4 packet header and a data payload. The SA field in the IPv4 packet header is filled with the public IPv4 address of the client, and the DA field is filled with the public IPv4 address of the proxy component.

[0187] After receiving the first packet sent by the client, the proxy component needs to decapsulate the IPv4 packet header in the received IPv4 packet to obtain the public IPv4 address of the client filled in the SA field of the IPv4 packet header. The proxy component can also encapsulate an IPv6 packet header and an IPv6 extension header before the data payload to generate a second packet, and send the second packet to the server through the IPv6 internal network.

[0188] That is, the second packet includes an IPv6 packet header, an IPv6 extension header, and a data payload, wherein the SA field in the IPv6 packet header is filled with the intranet IPv6 address of the proxy component, the DA field is filled with the intranet IPv6 address of the server, and the IPv6 extension header carries the public IPv4 address of the client obtained from the IPv4 packet header.

[0189] After the server receives the second packet sent by the proxy component through the IPv6 internal network, the server unpacks the IPv6 packet header and the IPv6 extension header, obtains the public IPv4 address of the client carried in the IPv6 extension header, and performs access control based on the public IPv4 address of the client.

[0190] In Example 2, as shown in FIG. 6, which is based on FIG. 5, in order to avoid the IP address of the client carried in the SA field of the IPv4 packet header in the first packet being tampered with by hackers, an IPSEC tunnel is established between the client and the proxy component, and the client can encapsulate an IPSEC packet header before the IPv4 packet header. That is, the first packet sent by the client to the proxy component includes an IPSEC packet header, an IPv4 packet header, and a data payload. After receiving the first packet, the proxy component unpacks the IPSEC packet header and the IPv4 packet header. The proxy component can also re-encapsulate an IPv6 packet header and an IPv6 extension header before the data payload to generate a second packet.

[0191] It should be understood that the second packet generated by the proxy component in Example 2 is the same as the second packet generated by the proxy component in Example 1, and the way in which the server unpacks the second packet to obtain the public IPv4 address of the client in Example 2 is also the same as in Example 1. For details, please refer to the description in Example 1, which will not be repeated here.

[0192] In Example 3, as shown in FIG. 7, which is based on FIG. 5, one more proxy component is added, that is, the proxy component 1 and the proxy component 2 are included in FIG. 7.

[0193] For example, the above proxy component 1 as a first level proxy component is responsible for generating the above second packet, and sending the second packet to the proxy component 2. Wherein, the second packet includes an IPv6 packet header, an IPv6 extension header and a data payload, wherein the SA field in the IPv6 packet header is filled with the intranet IPv6 address of the proxy component 1, the DA field is filled with the intranet IPv6 address of the proxy component 2, and the IPv6 extension header carries the public IPv4 address of the client. The proxy component 2 as a second level proxy component, after receiving the second packet sent by the proxy component 1, finds that the second packet already includes the IPv6 extension header carrying the public IPv4 address of the client, and therefore the proxy component 2 no longer inserts the IPv6 extension header, and only forwards the second packet to the server. Wherein, the second packet forwarded by the proxy component 2 to the server includes an IPv6 packet header, an IPv6 extension header and a data payload, wherein the SA field in the IPv6 packet header is filled with the intranet IPv6 address of the proxy component 2, the DA field is filled with the intranet IPv6 address of the server, and the IPv6 extension header carries the public IPv4 address of the client.

[0194] For example, the above proxy component 1 as a first level proxy component is responsible for generating the above second packet, and sending the second packet to the proxy component 2. Wherein, the second packet includes an IPv6 packet header, an IPv6 extension header and a data payload, wherein the SA field in the IPv6 packet header is filled with the intranet IPv6 address of the proxy component 1, the DA field is filled with the intranet IPv6 address of the proxy component 2, and the IPv6 extension header carries the public IPv4 address of the client. The proxy component 2 as a second level proxy component, after receiving the second packet sent by the proxy component 1, finds that the second packet already includes the IPv6 extension header carrying the public IPv4 address of the client, and therefore the proxy component 2 no longer inserts the IPv6 extension header, and only forwards the second packet to the server. Wherein, the second packet forwarded by the proxy component 2 to the server includes an IPv6 packet header, an IPv6 extension header and a data payload, wherein the SA field in the IPv6 packet header is filled with the intranet IPv6 address of the proxy component 2, the DA field is filled with the intranet IPv6 address of the server, and the IPv6 extension header carries the public IPv4 address of the client.

[0195] For example, the above proxy component 1 as a first level proxy component is responsible for generating the above second packet, and sending the second packet to the proxy component 2. Wherein, the second packet includes an IPv6 packet header, an IPv6 extension header and a data payload, wherein the SA field in the IPv6 packet header is filled with the intranet IPv6 address of the proxy component 1, the DA field is filled with the intranet IPv6 address of the proxy component 2, and the IPv6 extension header carries the public IPv4 address of the client. The proxy component 2 as a second level proxy component, after receiving the second packet sent by the proxy component 1, finds that the second packet already includes the IPv6 extension header carrying the public IPv4 address of the client, and therefore the proxy component 2 no longer inserts the IPv6 extension header, and only forwards the second packet to the server. Wherein, the second packet forwarded by the proxy component 2 to the server includes an IPv6 packet header, an IPv6 extension header and a data payload, wherein the SA field in the IPv6 packet header is filled with the intranet IPv6 address of the proxy component 2, the DA field is filled with the intranet IPv6 address of the server, and the IPv6 extension header carries the public IPv4 address of the client.

[0196] Example 5, as shown in Figure 9, involves a client located within an enterprise or data center's internal network, which can be an IPv4 network. The server is located on an external IPv6 network, and the client accesses the server on the external IPv6 network through a proxy component.

[0197] In the first message sent by the client to the proxy component via the internal IPv4 network, the SA field of the IPv4 header is filled with the client's internal IPv4 address, and the DA field is filled with the proxy component's internal IPv4 address. In the second message sent by the proxy component to the server via the external IPv6 network, the SA field of the IPv6 header is filled with the proxy component's external IPv6 address, and the DA field is filled with the server's external IPv6 address. The IPv6 extension header carries the client's internal IPv4 address obtained from the IPv4 header.

[0198] The following example, using the network between the client and the proxy component as an IPv6 network and the network between the proxy component and the server as an IPv6 network, along with Figures 10-15, illustrates the specific implementation of the above message sending method.

[0199] It should be understood that the examples in Figures 10-15 are merely to help those skilled in the art understand the embodiments of this application, and are not intended to limit the embodiments of the application to the specific values ​​or specific scenarios illustrated in Figures 10-15. Those skilled in the art can obviously make various equivalent modifications or variations based on the examples given below in Figures 10-15, and such modifications and variations also fall within the scope of the embodiments of this application.

[0200] Example 6, as shown in Figure 10, illustrates a network within an enterprise / government data center that has been upgraded to an IPv6 network. The client network is an external IPv4 network. The client obtains the 4A record corresponding to the server's domain name through a domain name server (DNS) and initiates access.

[0201] The aforementioned client sends a first message to the proxy component via an external IPv6 network. This first message is an IPv6 message, which includes an IPv6 header and a data payload. The SA field in the IPv6 header is filled with the client's public IPv6 address (e.g., GUA address), and the DA field is filled with the proxy component's public IPv6 address (e.g., GUA address).

[0202] After the proxy component receives the first message sent by the client, the proxy component needs to unpack the IPv6 message header in the received IPv6 message to obtain the public IPv4 address of the client filled in the SA field in the IPv6 message header. The proxy component can also encapsulate an IPv6 extension header carrying the public IPv4 address of the client after the IPv6 message header to generate a second message, and send the second message to the server through the IPv6 internal network.

[0203] The second message includes an IPv6 message header, an IPv6 extension header, and a data payload, where the SA field in the IPv6 message header is filled with the internal IPv6 address (e.g., ULA address) of the proxy component, the DA field is filled with the internal IPv6 address (e.g., ULA address) of the server, and the IPv6 extension header carries the public IPv4 address of the client obtained from the IPv4 message header.

[0204] After the server receives the second message sent by the proxy component through the IPv6 internal network, the server unpacks the IPv6 message header and the IPv6 extension header to obtain the public IPv4 address of the client carried in the IPv6 extension header, and performs access control based on the public IPv4 address of the client.

[0205] Example 7, which is different from example 6, is that the client directly encapsulates the IPv6 extension header carrying the public IPv4 address of the client in the first message. For example, in the case where the proxy component cannot encapsulate the IPv6 extension header, the client can encapsulate the IPv6 extension header in the first message. In this way, it is not necessary to limit a certain entity to encapsulate the IPv6 extension header, and the flexibility is stronger, which is easier to deploy and implement, and is more widely applicable.

[0206] That is, as shown in FIG. 10, the client sends a first message to the proxy component through the IPv6 external network, where the first message is an IPv6 message including an IPv6 message header, an IPv6 extension header, and a data payload, where the SA field in the IPv6 message header is filled with the public IPv6 address (e.g., GUA address) of the client, and the DA field is filled with the public IPv6 address (e.g., GUA address) of the proxy component. The second message sent by the proxy component to the client includes an IPv6 message header, an IPv6 extension header, and a data payload, where the SA field in the IPv6 message header is filled with the internal IPv6 address (e.g., ULA address) of the proxy component, the DA field is filled with the internal IPv6 address (e.g., ULA address) of the server, and the IPv6 extension header carries the public IPv4 address of the client obtained from the IPv4 message header.

[0207] Example 8, as shown in FIG. 11, the difference between FIG. 11 and FIG. 10 is that the SA field in the IPv6 header in the second packet sent by the proxy component to the client is filled with the public IPv6 address (e.g., GUA address) of the proxy component, the DA field is filled with the public IPv6 address (e.g., GUA address) of the server, and the IPv6 extension header carries the public IPv4 address of the client obtained from the IPv4 header.

[0208] Example 9, as shown in FIG. 12, which is based on FIG. 10, in order to avoid the SA field in the IPv6 header in the first packet carrying the IP address of the client being tampered with by hackers, an IPSEC tunnel is established between the client and the proxy component, and the client can encapsulate an IPSEC header before the IPv6 header.

[0209] Example 10, as shown in FIG. 13, which is based on FIG. 10, an additional proxy component is added, that is, the proxy component 1 and the proxy component 2 are included in FIG. 13. The encapsulation of the IPv6 extension header can be completed by any one of the proxy component 1 and the proxy component 2, and details are described in Example 3, which will not be repeated here.

[0210] Similarly, an IPSEC tunnel can also be established between the proxy component 1 and the server, and the proxy component 1 can directly send the second packet to the server through the IPSEC tunnel, avoiding the public IPv4 address of the client carried in the IPv6 extension header being tampered with by the intermediate network between the proxy component 1 and the server. Details are described in Example 4, which will not be repeated here.

[0211] Example 11, as shown in FIG. 14, the difference between FIG. 14 and FIG. 10 is that the client is in the IPv6 internal network of an enterprise or a data center, the server is in the IPv6 external network, and the client accesses the server in the IPv6 external network through the proxy component.

[0212] The client sends a first packet to the proxy component through the IPv6 internal network, the first packet is an IPv6 packet, the IPv6 packet includes an IPv6 header and a data payload, the SA field in the IPv6 header is filled with the internal IPv6 address (e.g., ULA address) of the client, and the DA field is filled with the internal IPv6 address (e.g., ULA address) of the proxy component.

[0213] The second message sent by the proxy component to the server through the IPv6 external network includes an IPv6 message header, an IPv6 extension header, and a data payload. The SA field in the IPv6 message header is filled with the external IPv6 address (for example, GUA address) of the proxy component, and the DA field is filled with the external IPv6 address (for example, GUA address) of the server. The IPv6 extension header carries the public IPv4 address of the client obtained from the IPv4 message header.

[0214] Example 12, as shown in FIG. 15, which is based on FIG. 14, additionally includes a proxy component, that is, the proxy component 1 and the proxy component 2 in FIG. 15. The encapsulation of the IPv6 extension header can be completed by any one of the proxy component 1 and the proxy component 2. For details, refer to the description in Example 3, which will not be repeated here.

[0215] Similarly, an IPSEC tunnel can also be established between the proxy component 1 and the server. The proxy component 1 can directly send the second message to the server through the IPSEC tunnel, avoiding the tampering of the public IPv4 address of the client carried in the IPv6 extension header by the intermediate network between the proxy component 1 and the server. For details, refer to the description in Example 4, which will not be repeated here.

[0216] It should be understood that in various embodiments of the present application, the size of the sequence number of the above processes does not mean the order of execution, and the execution order of the processes should be determined according to their functions and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0217] The above describes the method provided by the embodiments of the present application in combination with FIGS. 1 to 15. The following will describe the embodiments of the device of the present application in combination with FIGS. 16 to 20. It should be understood that the description of the method embodiments corresponds to the description of the device embodiments, and therefore, the parts not described in detail can be referred to the foregoing method embodiments.

[0218] Fig. 16 is a schematic structural diagram of a device 1600 for processing a packet according to an embodiment of the present application. The device 1600 shown in Fig. 16 can perform the corresponding steps of the method of the above-mentioned embodiments. As shown in Fig. 16, the device 1600 includes an obtaining module 1610, a processing module 1620, and a sending module 1630. The obtaining module 1610 is configured to obtain a first packet from a client, the first packet including a packet header and a data payload, wherein a source address (SA) field in the packet header of the first packet is an IP address of the client; the processing module 1620 is configured to generate a second packet according to the first packet, the second packet including a target Internet Protocol version 6 (IPv6) packet header, an IPv6 extension header, and the data payload, wherein a destination address (DA) field in the target IPv6 packet header is an IP address of a server, and the IPv6 extension header includes the IP address of the client; and the sending module 1630 is configured to send the second packet to the server.

[0219] Optionally, the IPv6 extension header includes an options field, and the options field is filled with the IP address of the client.

[0220] Optionally, the first packet is an Internet Protocol version 4 (IPv4) packet, the packet header of the first packet is an IPv4 packet header, and the processing module 1620 is specifically configured to: decapsulate the IPv4 packet header to obtain the IP address of the client included in the IPv4 packet header; encapsulate the target IPv6 packet header before the data payload; and encapsulate the IPv6 extension header after the target IPv6 packet header according to the IP address of the client to obtain the second packet.

[0221] Optionally, the first packet is an IPv6 packet, the first packet includes an IPv6 packet header and the data payload, and the processing module 1620 is specifically configured to: obtain the target IPv6 packet header according to the IPv6 packet header of the first packet; and encapsulate the IPv6 extension header after the target IPv6 packet header according to the IP address of the client to obtain the second packet.

[0222] Optionally, the first packet is an IPv6 packet, the first packet includes an IPv6 packet header, the IPv6 extension header, and the data payload, and the processing module 1620 is specifically configured to: replace the IPv6 packet header in the first packet with the target IPv6 packet header to obtain the second packet.

[0223] Optionally, the first packet further includes a first tunnel packet header, and the first tunnel packet header is located before the packet header of the first packet, and the processing module 1620 is further configured to decapsulate the first tunnel packet header.

[0224] Optionally, the second packet further comprises a second tunnel packet header, the second tunnel packet header being located before the target IPv6 packet header, and the processing module 1620 is further configured to encapsulate the second tunnel packet header before the target IPv6 packet header of the second packet.

[0225] Fig. 17 is a schematic structural diagram of a device 1700 for processing a packet according to an embodiment of the present application. The device 1700 is applied to a server. The device 1700 shown in Fig. 17 can perform the corresponding steps of the method according to the above-described embodiments. As shown in Fig. 17, the device 1700 comprises a receiving module 1710 and a processing module 1720. The receiving module 1710 is configured to receive a second packet, the second packet comprising a target Internet Protocol version 6 (IPv6) packet header, an IPv6 extension header and a data payload, wherein a DA field of the target IPv6 packet header is an IP address of a server, and the IPv6 extension header comprises an IP address of a client. The processing module 1720 is configured to decapsulate the IPv6 extension header to obtain the IP address of the client.

[0226] Optionally, the IPv6 extension header comprises an options field, and the options field is filled with the IP address of the client.

[0227] Optionally, the second packet further comprises a second tunnel packet header, the second tunnel packet header being located before the target IPv6 packet header, and the processing module 1720 is further configured to decapsulate the second tunnel packet header.

[0228] Optionally, the second packet is obtained by the proxy component according to a first packet sent by the client.

[0229] Optionally, the first packet is an IPv4 packet, and the first packet comprises an IPv4 packet header and the data payload.

[0230] Optionally, the first packet is an IPv6 packet, and the first packet comprises an IPv6 packet header and the data payload.

[0231] Optionally, the first packet is an IPv6 packet, and the first packet comprises an IPv6 packet header, the IPv6 extension header and the data payload.

[0232] Optionally, the first packet further comprises a first tunnel packet header, the first tunnel packet header being located before a packet header of the first packet.

[0233] Optionally, the device 1700 further comprises a verification module configured to verify access rights of the client according to an access policy and the IP address of the client.

[0234] Optionally, the access policy comprises an access white list including IP addresses allowed to access the service end, and the checking module is specifically configured to: if the IP address of the client is included in the IP addresses of the access white list, the service end allows the client to access the service deployed on the service end; or if the IP address of the client is not included in the IP addresses of the access white list, the service end refuses the client to access the service deployed on the service end.

[0235] The apparatus 1600, the apparatus 1700 herein can be embodied in the form of functional modules. The term "module" herein can be implemented in the form of software and / or hardware, which is not specifically limited.

[0236] For example, the "module" can be a software program, a hardware circuit or a combination of both, which realizes the above functions. For example, the implementation of the obtaining module 1610 is described below. Similarly, the implementation of other modules, such as the processing module 1620 and the sending module 1630, can refer to the implementation of the obtaining module 1610.

[0237] As an example of a software functional unit, the obtaining module 1610 can include code running on a computing instance. The computing instance can include at least one of a physical host (computing device), a virtual machine, and a container. Further, the computing instance can be one or more. For example, the obtaining module 1610 can include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code can be distributed in the same region, or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code can be distributed in the same availability zone (AZ), or in different AZs, each AZ including a data center or multiple data centers with similar geographical locations. Generally, one region can include multiple AZs.

[0238] Similarly, the multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC), or in multiple VPCs. Generally, one VPC is set in one region, and communication between two VPCs in the same region, or between VPCs in different regions, needs to set a communication gateway in each VPC to realize the interconnection between VPCs through the communication gateway.

[0239] As an example of a hardware functional unit, the obtaining module 1610 can include at least one computing device, such as a server or the like. Alternatively, the obtaining module 1610 can also be a device implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), and the like. The PLD can be implemented by a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0240] The multiple computing devices included in the obtaining module 1610 can be distributed in the same region or in different regions. The multiple computing devices included in the obtaining module 1610 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the obtaining module 1610 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0241] Therefore, the modules of the various examples described in the embodiments of the present application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0242] It should be noted that the apparatus provided by the above embodiments is only used for executing the above method, and the above division of the functional modules is used for example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the apparatus is divided into different functional modules to complete all or part of the above described functions. For example, the acquisition module 1610 can be used to execute any step in the above method, the processing module 1620 can be used to execute any step in the above method, and the sending module 1630 can be used to execute any step in the above method. The steps responsible for implementation of the acquisition module 1610, the processing module 1620 and the sending module 1630 can be specified as needed, and the above apparatus can realize all functions by realizing different steps in the above method through the acquisition module 1610, the processing module 1620 and the sending module 1630 respectively.

[0243] In addition, the apparatus and method embodiments provided by the above embodiments belong to the same concept, and the specific implementation process is described in the method embodiments above, which will not be repeated here.

[0244] Next, a computing device provided by an embodiment of the present application is described in detail in combination with FIG. 18.

[0245] FIG. 18 is an architecture schematic diagram of a computing device 1500 provided by an embodiment of the present application. The computing device 1500 can be a server or a computer or other device with computing capability. The computing device 1500 shown in FIG. 18 includes at least one processor 1510 and a memory 1520.

[0246] It should be understood that the number of processors and memories in the computing device 1500 is not limited by the present application.

[0247] The processor 1510 executes instructions in the memory 1520, so that the computing device 1500 implements the method provided by the present application. Alternatively, the processor 1510 executes instructions in the memory 1520, so that the computing device 1500 implements the functional modules provided by the present application, thereby implementing the method provided by the present application.

[0248] Optionally, the computing device 1500 further includes a communication interface 1530. The communication interface 1530 uses a transceiving module such as but not limited to a network interface card and a transceiver to realize communication between the computing device 1500 and other devices or communication networks.

[0249] Optionally, the computing device 1500 also includes a system bus 1540, wherein the processor 1510, the memory 1520 and the communication interface 1530 are connected with the system bus 1540 respectively. The processor 1510 can access the memory 1520 through the system bus 1540, for example, the processor 1510 can read and write data in the memory 1520 or execute code in the memory 1520 through the system bus 1540. The system bus 1540 is a peripheral component interconnect express (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus 1540 is divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is shown in FIG. 18, but it does not mean that there is only one bus or only one type of bus.

[0250] In one possible implementation, the function of the processor 1510 is mainly to interpret the instructions (or code) of the computer program and process the data in the computer software. Among them, the instructions of the computer program and the data in the computer software can be saved in the memory 1520 or the cache 1516.

[0251] Optionally, the processor 1510 can be an integrated circuit chip with a processing capability of signals. As an example but not limitation, the processor 1510 is a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. Among them, the general purpose processor is a microprocessor, etc. For example, the processor 1510 is a central processing unit (CPU).

[0252] Optionally, each processor 1510 includes at least one processing unit 1512 and a memory control unit 1514.

[0253] Optionally, processing units 1512, also termed cores or core complexes, are the most important components of a processor. Processing units 1512 are manufactured from single-crystal silicon using certain production processes, and all the computing, command receiving, command storing, and data processing of a processor are performed by cores. Processing units independently run program instructions, and use the ability of parallel computing to speed up program running. Various processing units have fixed logical structures, for example, a processing unit includes logical units such as a level one cache, a level two cache, an execution unit, an instruction stage unit, and a bus interface.

[0254] In one implementation, memory control units 1514 are configured to control data interaction between memories 1520 and processing units 1512. Specifically, memory control units 1514 receive memory access requests from processing units 1512, and control access to memories based on the memory access requests. By way of example and not limitation, a memory control unit is a memory management unit (MMU) or the like.

[0255] In one implementation, each memory control unit 1514 addresses memories 1520 through a system bus. An arbiter (not shown in FIG. 18) is configured in the system bus, and is responsible for processing and coordinating competing access of multiple processing units 1512.

[0256] In one implementation, processing units 1512 and memory control units 1514 are communicatively connected through internal connections of a chip, such as address lines, so as to realize communication between processing units 1512 and memory control units 1514.

[0257] Optionally, each processor 1510 further includes a cache 1516, which is a buffer for data exchange (referred to as a cache). When a processing unit 1512 needs to read data, the processing unit 1512 first searches for the required data in the cache, and directly executes if the data is found, and searches for the data in a memory if the data is not found. Since the cache runs much faster than the memory, the cache helps processing units 1512 run faster.

[0258] Memories 1520 can provide running space for processes in computing device 1500, for example, a computer program (specifically, code of the program) for generating a process is stored in memories 1520. After the computer program is run by a processor to generate a process, the processor allocates a corresponding storage space for the process in memories 1520. Further, the storage space further includes a text segment, an initialized data segment, a bit initialized data segment, a stack segment, a heap segment, and the like. Memories 1520 store data generated during running of a process, such as intermediate data, or process data, and the like, in the storage space corresponding to the process.

[0259] Optionally, memory, also called RAM, is used to temporarily store data for processing by processor 1510. Processor 1510 moves data to and from memory for processing. When the computer is turned off, processor 1510 can lose its contents, unless a type of memory, called non-volatile memory, is used.

[0260] By way of example, and not limitation, memory 1520 is volatile memory or nonvolatile memory, or can include both volatile and nonvolatile memory. By way of example, and not limitation, nonvolatile memory can be read only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically EPROM (EEPROM), or flash memory. Volatile memory is random access memory (RAM), which acts as external cache. By way of example and not limitation, many forms of RAM exist, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct rambus RAM (DR RAM). The system and method described herein can be used in connection with one or more types of memory or other disk based system for higher data storage densities, such as those based on phase-change, magneto-optical technologies, or Spin-Torque Transfer RAM.

[0261] The structure of the computing device 1500 listed above is only an example, and the application is not limited thereto. The computing device 1500 of the embodiments of the application includes various hardware in the prior art computer system, for example, the computing device 1500 also includes other memories in addition to the memory 1520, such as disk memories and the like. Those skilled in the art should understand that the computing device 1500 can also include other devices necessary for normal operation. Meanwhile, according to specific needs, those skilled in the art should understand that the above computing device 1500 can also include hardware devices for realizing other additional functions. In addition, those skilled in the art should understand that the above computing device 1500 can also only include devices necessary for the embodiments of the application, and does not have to include all the devices shown in FIG. 18.

[0262] The embodiments of the application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server. In some embodiments, the computing device can also be a desktop computer, a notebook computer, or a terminal device such as a smart phone.

[0263] As shown in FIG. 19, the computing device cluster includes at least one computing device 1500. The memory 1520 in one or more computing devices 1500 in the computing device cluster can store the same instructions for executing the above method.

[0264] In some possible implementation manners, the memory 1520 in one or more computing devices 1500 in the computing device cluster can also respectively store partial instructions for executing the above method. In other words, the combination of one or more computing devices 1500 can collectively execute the instructions of the above method.

[0265] It should be noted that the memories 1520 in different computing devices 1500 in the computing device cluster can store different instructions, respectively used for executing partial functions of the above apparatus. That is, the instructions stored in the memories 1520 in different computing devices 1500 can realize the functions of one or more modules in the above apparatus.

[0266] In some possible implementation manners, one or more computing devices in the computing device cluster can be connected through a network. The network can be a wide area network or a local area network, etc. FIG. 20 shows a possible implementation manner. As shown in FIG. 20, two computing devices 1500A and 1500B are connected through a network. Specifically, the communication interface in each computing device is connected with the network.

[0267] It should be understood that the functions of the computing device 1500A shown in Figure 20 can also be accomplished by multiple computing devices 1500. Similarly, the functions of the computing device 1500B can also be accomplished by multiple computing devices 1500.

[0268] In this embodiment, a computer program product containing instructions is also provided. The computer program product can be a software or program product containing instructions, which can be run on a computing device or stored in any available medium. When it is run on a computing device, it causes the computing device to perform the method provided above, or causes the computing device to realize the functions of the apparatus provided above.

[0269] In this embodiment, a computer readable storage medium is also provided. The computer readable storage medium can be any available medium that a computing device can store or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk), etc. The computer readable storage medium contains instructions, which, when executed on a computing device, cause the computing device to perform the method provided above.

[0270] It should be understood that the size of the sequence number of each process described above in various embodiments of the present application does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0271] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0272] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0273] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. The division of the units is merely logical function division. There can be other division manners in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0274] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0275] In addition, each functional unit in the various embodiments of the present application can be integrated into a processing unit, or each unit can be a physically separate unit, or two or more units can be integrated into one unit.

[0276] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0277] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A message processing method, characterized in that, The method includes: Obtain a first message from the client. The first message includes a message header and a data payload. The source address SA field in the message header of the first message is the IP address of the client. A second message is generated based on the first message. The second message includes a target Internet Protocol version 6 (IPv6) header, an IPv6 extension header, and the data payload. The DA field of the target IPv6 header is the IP address of the server, and the IPv6 extension header includes the IP address of the client. Send the second message to the server.

2. The method according to claim 1, characterized in that, The IPv6 extension header includes an options field, which is filled with the client's IP address.

3. The method according to claim 1 or 2, characterized in that, The first message is an Internet Protocol version 4 (IPv4) message, and the header of the first message is an IPv4 header. The step of generating a second message based on the first message includes: Decapsulate the IPv4 packet header to obtain the client's IP address included in the IPv4 packet header; Encapsulate the target IPv6 packet header before the data payload; Based on the client's IP address, the IPv6 extension header is encapsulated after the target IPv6 packet header to obtain the second packet.

4. The method according to claim 1 or 2, characterized in that, The first message is an IPv6 message, which includes an IPv6 header and the data payload. The step of generating a second message based on the first message includes: The target IPv6 header is obtained based on the IPv6 header of the first message; Based on the client's IP address, the IPv6 extension header is encapsulated after the target IPv6 packet header to obtain the second packet.

5. The method according to claim 1 or 2, characterized in that, The first message is an IPv6 message, which includes an IPv6 header, an IPv6 extension header, and a data payload. The step of generating a second message based on the first message includes: The IPv6 header in the first message is replaced with the target IPv6 header to obtain the second message.

6. The method according to any one of claims 3 to 5, characterized in that, The first message also includes a first tunnel message header, which is located before the message header of the first message. The method further includes: The header of the first tunnel message is decapsulated.

7. The method according to any one of claims 3 to 6, characterized in that, The second message also includes a second tunnel header, which precedes the target IPv6 message header. The method further includes: The second tunnel header is encapsulated before the target IPv6 header of the second message.

8. A message processing method, characterized in that, The method includes: The server receives a second message, which includes a target Internet Protocol version 6 (IPv6) header, an IPv6 extension header, and a data payload. The DA field of the target IPv6 header is the server's IP address, and the IPv6 extension header includes the client's IP address. The server decapsulates the IPv6 extension header to obtain the client's IP address.

9. The method according to claim 8, characterized in that, The IPv6 extension header includes an options field, which is filled with the client's IP address.

10. The method according to claim 8 or 9, characterized in that, The second message also includes a second tunnel header, which precedes the target IPv6 message header. The method further includes: The server decapsulates the second tunnel message header.

11. The method according to any one of claims 8 to 10, characterized in that, The method further includes: The server verifies the client's access permissions based on the access policy and the client's IP address.

12. The method according to claim 11, characterized in that, The access policy includes an access whitelist, which contains multiple IP addresses that are allowed to access the server. The server verifies the client's access permissions based on the access policy and the client's IP address, including: If the client's IP address is included among the multiple IP addresses in the access whitelist, the server allows the client to access the services deployed on the server; or If the client's IP address is not included in the multiple IP addresses in the access whitelist, the server will refuse the client access to the services deployed on the server.

13. A message processing apparatus, characterized in that, The device includes: The acquisition module is used to acquire a first message from the client. The first message includes a message header and a data payload, wherein the source address SA field in the message header of the first message is the IP address of the client. The processing module is configured to generate a second message based on the first message. The second message includes a target Internet Protocol version 6 (IPv6) header, an IPv6 extension header, and the data payload. The DA field of the target IPv6 header is the IP address of the server, and the IPv6 extension header includes the IP address of the client. The sending module is used to send the second message to the server.

14. The apparatus according to claim 13, characterized in that, The IPv6 extension header includes an options field, which is filled with the client's IP address.

15. The apparatus according to claim 13 or 14, characterized in that, The first message is an Internet Protocol version 4 (IPv4) message, and the header of the first message is an IPv4 header. The processing module is specifically used for: Decapsulate the IPv4 packet header to obtain the client's IP address included in the IPv4 packet header; Encapsulate the target IPv6 packet header before the data payload; The second packet is obtained by encapsulating the IPv6 extension header after the target IPv6 packet header based on the client's IP address.

16. The apparatus according to claim 13 or 14, characterized in that, The first message is an IPv6 message, which includes an IPv6 header and the data payload. The processing module is specifically used for: The target IPv6 header is obtained based on the IPv6 header of the first message; Based on the client's IP address, the IPv6 extension header is encapsulated after the target IPv6 packet header to obtain the second packet.

17. The apparatus according to claim 13 or 14, characterized in that, The first message is an IPv6 message, which includes an IPv6 header, an IPv6 extension header, and a data payload. The processing module is specifically used for: The second message is obtained by replacing the IPv6 header in the first message with the target IPv6 header.

18. The apparatus according to any one of claims 15 to 17, characterized in that, The first message also includes a first tunnel message header, which is located before the message header of the first message. The processing module is also used to decapsulate the header of the first tunnel message.

19. The apparatus according to any one of claims 15 to 18, characterized in that, The second message also includes a second tunnel header, which precedes the target IPv6 message header. The processing module is further configured to encapsulate the second tunnel header before the target IPv6 header of the second message.

20. A message processing apparatus, characterized in that, The device is used on a server side, and the device includes: The receiving module is used to receive a second message, which includes a target Internet Protocol version 6 (IPv6) header, an IPv6 extension header, and a data payload. The DA field of the target IPv6 header is the IP address of the server, and the IPv6 extension header includes the IP address of the client. The processing module is used to decapsulate the IPv6 extension header to obtain the IP address of the client.

21. The apparatus according to claim 20, characterized in that, The IPv6 extension header includes an options field, which is filled with the client's IP address.

22. The apparatus according to claim 20 or 21, characterized in that, The second message also includes a second tunnel header, which precedes the target IPv6 message header. The processing module is also used to decapsulate the second tunnel message header.

23. The apparatus according to any one of claims 20 to 22, characterized in that, The device further includes: The verification module is used to verify the access permissions of the client based on the access policy and the client's IP address.

24. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method as described in any one of claims 1 to 7 and / or the method as described in any one of claims 8 to 12.

25. A computer program product containing instructions, characterized in that, When the instruction is executed by the computing device cluster, the computing device cluster causes the computing device cluster to perform the method as described in any one of claims 1 to 7 and / or the method as described in any one of claims 8 to 12.

26. A computer-readable storage medium, characterized in that, Includes computer program instructions, which, when executed by a cluster of computing devices, perform the method as described in any one of claims 1 to 7 and / or the method as described in any one of claims 8 to 12.

27. A message processing system, characterized in that, The system includes a client, a proxy component, and a server, wherein... The client is configured to send a first message to the proxy component. The first message includes a message header and a data payload. In the message header, the source address SA field is the IP address of the client, and the destination address DA field is the IP address of the proxy component. The proxy component is configured to generate a second message based on the first message. The second message includes a target Internet Protocol version 6 (IPv6) header, an IPv6 extension header, and the data payload. The SA field of the target IPv6 header is the IP address of the proxy component, the DA field of the target IPv6 header is the IP address of the server, and the IPv6 extension header includes the IP address of the client. The proxy component is also used to send the second message to the server; The server is used to decapsulate the IPv6 extension header in the second message to obtain the client's IP address.

Images