Packet processing method and apparatus, and device

Abstract

Provided in the present application are a packet processing method and apparatus, and a device. The method comprises: acquiring a first data packet, wherein the first data packet comprises a segment routing tunnel header and a first inner packet, the segment routing tunnel header comprises a primary path, and the primary path comprises first device information of a first security device; acquiring a first network label corresponding to the first device information comprised in the primary path; on the basis of the first network label, sending to the first security device a second inner packet corresponding to the first inner packet, such that the first security device performs security inspection processing on the received second inner packet on the basis of the first network label; if a third inner packet returned by the last first security device of the primary path is received, encapsulating, on the basis of the third inner packet, the segment routing tunnel header from which the primary path has been removed, so as to obtain a second data packet; and sending the second data packet on the basis of a segment routing tunnel header of the second data packet. By means of the solution of the present application, security inspection processing can be performed on a data packet by means of a security device.

Description

A message processing method, device and equipment TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a message processing method, device and equipment. BACKGROUND

[0002] Segment routing is an extended source routing technology, and the segment routing strategy is a tunnel diversion technology based on the segment routing technology. After a head-end node receives a data message, the head-end node encapsulates a segment routing tunnel header for the data message, and the segment routing tunnel header includes a segment routing list, and the segment routing list includes IPv6 addresses of nodes on a specific path. The nodes on the specific path forward the data message based on the segment routing tunnel header, so as to guide the data message to forward according to the specific path through the segment routing list, and implement traffic engineering.

[0003] However, after receiving the data message, each node can only forward the data message to a next node on the specific path based on the segment routing tunnel header. For a security device that does not support segment routing, each node cannot send the data message to the security device, such as a security device supporting DDoS (Distributed Denial of Service) protection, WAF (Web Application Firewall), firewall and intrusion prevention system functions, thereby causing that the data message cannot be subjected to security detection processing, and that the unsafe data message can be transmitted in the network.

[0004] SUMMARY

[0005] The present application provides a message processing method applied to a network device, and the method comprises:

[0006] Obtaining a first data message, the first data message comprising a segment routing tunnel header and a first inner layer message, the segment routing tunnel header comprising a main path, and the main path comprising first device information of a first security device corresponding to security detection required by the first data message;

[0007] Obtaining a first network label corresponding to the first device information included in the main path;

[0008] Based on the first network label, sending a second inner layer message corresponding to the first inner layer message to the first security device, so that the first security device performs security detection processing on the received second inner layer message based on the first network label;

[0009] If a third inner layer message returned by a last first security device of the main path is received, a second data message is obtained by encapsulating a segment routing tunnel header of the main path from the third inner layer message; and the second data message is sent based on a segment routing tunnel header of the second data message.

[0010] The application provides a message processing device applied to a network device, and the device comprises:

[0011] The application provides a message processing device applied to a network device, and the device comprises:

[0012] The application provides a message processing device applied to a network device, and the device comprises:

[0013] The application provides a message processing device applied to a network device, and the device comprises:

[0014] The application provides a message processing device applied to a network device, and the device comprises:

[0015] The application provides a message processing device applied to a network device, and the device comprises:

[0016] From the above technical solutions, in the embodiments of the present application, the main path is carried in the segment routing tunnel header of the data packet, and the main path includes the device information of the security device. The network label is obtained through the device information, and then the network label is added to the inner layer packet. The modified inner layer packet is sent to the security device, so as to combine the segment routing and the network label to send the data packet to the security device, so that the security device performs security detection and processing on the data packet, thereby providing security service for the data packet, and transmitting the data packet subjected to security detection and processing in the network, thereby avoiding security risks to the network. The segment routing and the network label are combined to realize dynamic and efficient path control of multiple security devices, and unified path control and management. The path order of the security device can be flexibly configured and adjusted according to different network security requirements. Redundant data packet conversion and forwarding can be avoided, and network transmission efficiency and processing capacity can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0017] FIG. 1 is a flow diagram of a packet processing method according to an embodiment of the present application;

[0018] FIG. 2A is a schematic diagram of an application scenario of a segment routing strategy according to an embodiment of the present application;

[0019] FIG. 2B is a schematic diagram of an application scenario of a segment routing strategy according to an embodiment of the present application;

[0020] FIG. 2C is a schematic diagram of an application scenario of a segment routing strategy according to an embodiment of the present application;

[0021] FIG. 3 is a flow diagram of a packet processing method according to an embodiment of the present application;

[0022] FIG. 4 is a schematic diagram of a segment routing tunnel header according to an embodiment of the present application;

[0023] FIG. 5 is a schematic diagram of a packet processing device according to an embodiment of the present application;

[0024] FIG. 6 is a hardware structure diagram of a network device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] A packet processing method is provided in the embodiments of the present application, which can be applied to a network device. The network device can act as a head node, the network device can act as an intermediate node, or the network device can act as a tail node. Referring to FIG. 1, a flow diagram of the packet processing method is shown. The method can include:

[0026] Step 101, obtaining a first data packet, the first data packet comprising a segment routing tunnel header and a first inner layer packet, the segment routing tunnel header comprising a main path, the main path comprising first device information of a first security device corresponding to security detection required by the first data packet.

[0027] Step 102, obtaining a first network label corresponding to the first device information comprised in the main path.

[0028] For example, the first network label corresponding to the first device information can be obtained by querying a configured label mapping table by using the first device information, the label mapping table comprising a correspondence between device information and network labels.

[0029] Step 103, sending a second inner layer packet corresponding to the first inner layer packet to the first security device based on the first network label, so that the first security device performs security detection processing on the received second inner layer packet based on the first network label. For example, when the first security device receives the second inner layer packet, if the first network label in the second inner layer packet is consistent with the network label of the first security device, the first security device performs security detection processing on the second inner layer packet. Otherwise, if the first network label in the second inner layer packet is inconsistent with the network label of the first security device, the first security device does not perform security detection processing on the second inner layer packet.

[0030] Step 104, if a third inner layer packet returned by a last first security device of the main path is received, encapsulating a segment routing tunnel header removed from the main path based on the third inner layer packet to obtain a second data packet.

[0031] For example, the third inner layer packet can comprise a network label, the network label in the third inner layer packet can be removed, and the segment routing tunnel header removed from the main path can be encapsulated based on the inner layer packet (which is the same as the first inner layer packet) after the network label is removed. Alternatively, the segment routing tunnel header removed from the main path can be encapsulated based on the third inner layer packet.

[0032] Step 105, sending the second data packet based on the segment routing tunnel header of the second data packet.

[0033] In one example, if the main path includes first device information of multiple first security devices, sending the second inner layer message corresponding to the first inner layer message to the first security device based on the first network tag can include: obtaining a first information mapping table corresponding to the main path, the first information mapping table including first network tags corresponding to the first device information of multiple first security devices; sequentially traversing each first network tag in the first information mapping table; for the current network tag encountered during traversal, adding the current network tag to the first inner layer message to obtain the second inner layer message, and sending the second inner layer message to the first security device; if a third inner layer message is received from the first security device, determining whether the network tag in the third inner layer message is the last first network tag in the first information mapping table; if not, traversing from the first information mapping table to the next first network tag in the third inner layer message as the current network tag, and returning to execute the operation of adding the current network tag to the first inner layer message to obtain the second inner layer message. If yes, it indicates that the third inner layer message returned by the last first security device in the main path has been received, and step 104 is executed.

[0034] In one example, the order of multiple first network tags in the first information mapping table matches the order of multiple first device information included in the main path, that is, the order of the two is consistent.

[0035] In one example, before obtaining the first network label corresponding to the first device information included in the main path, the route type field can be parsed from the segmented route tunnel header; if the route type field is the first value, the first device information included in the main path can be obtained from the segmented route tunnel header; where the first value can represent the route type that combines segmented routing and network label.

[0036] In one example, after removing the segmented routing tunnel header of the main path based on the third inner packet encapsulation, the route type field in the segmented routing tunnel header can be modified from the first value to the second value, where the second value can represent the route type of the segmented route.

[0037] In one example, the segmented routing tunnel header also includes a backup path, which includes second device information of the second security device corresponding to the security checks required for the first data packet. Based on this, if the primary path is determined to be available, the first network tag corresponding to the first device information included in the primary path is obtained.

[0038] If the primary path is unavailable and the backup path is available, a second network label corresponding to second device information included in the backup path can be acquired; and a fourth inner-layer message corresponding to the first inner-layer message can be sent to a second security device based on the second network label, so that the second security device performs security detection processing on the received fourth inner-layer message based on the second network label. For example, if the second network label in the fourth inner-layer message is consistent with the network label of the second security device, the second security device performs security detection processing on the fourth inner-layer message.

[0039] If the fifth inner-layer message returned by the last second security device of the backup path is received, a segment routing tunnel header of the primary path and the backup path can be removed based on the fifth inner-layer message, to obtain a second data message.

[0040] In one example, determining that the primary path is available can include: determining that the primary path is available when the availability status of each first security device in the primary path meets a set condition; and wherein, for each first security device, the determination that the availability status of the first security device meets the set condition is based on:

[0041] The link status of the first security device is acquired; if the link status is reachable, it can be determined that the availability status of the first security device meets the set condition; if the link status is unreachable, it is determined that the availability status of the first security device does not meet the set condition. Alternatively, the routing type identifier of the first security device is acquired; if the routing type identifier is a first value, it can be determined that the availability status of the first security device meets the set condition; if the routing type identifier is a second value, it is determined that the availability status of the first security device does not meet the set condition; wherein the first value represents a routing type combining segment routing and network label, and the second value represents a routing type of segment routing. Alternatively, the link status and the routing type identifier of the first security device are acquired; if the link status is reachable and the routing type identifier is the first value, it can be determined that the availability status of the first security device meets the set condition; if the link status is unreachable and / or the routing type identifier is the second value, it is determined that the availability status of the first security device does not meet the set condition.

[0042] In one example, the segment routing tunnel header can include a segment routing list, and the segment routing list includes segment routing addresses of each intermediate node between the head node and the tail node; wherein the segment routing list further includes the primary path and the backup path, and the primary path and the backup path are located in front of each segment routing address.

[0043] In one example, if the network device serves as the head-end node, a third data packet can also be obtained, the third data packet comprising a segment routing tunnel header and a first inner-layer packet; a target routing type corresponding to IP address information of the first inner-layer packet is determined, if the target routing type is a routing type combining segment routing and network label, a primary path and a backup path corresponding to the IP address information are obtained; the primary path and the backup path are added in the segment routing tunnel header of the third data packet, and a routing type field in the segment routing tunnel header is modified to the first value, to obtain a first data packet, and the first data packet is sent to the intermediate node.

[0044] As can be seen from the above technical solutions, in the embodiments of the present application, the primary path is carried in the segment routing tunnel header of the data packet, and the primary path comprises device information of the security device, the network label is obtained through the device information, and then the network label is added for the inner-layer packet, and the modified inner-layer packet is sent to the security device, so that the data packet is sent to the security device by combining segment routing and network label, so that the security device performs security detection and processing on the data packet, thereby providing security service for the data packet, and transmitting the data packet that has undergone security detection and processing in the network, thereby avoiding security risks to the network. By combining segment routing and network label, dynamic and efficient path control of multiple security devices is achieved, and unified path control and management is achieved. The path order of the security devices can be flexibly configured and adjusted according to different network security requirements. Redundant data packet conversion and forwarding can be avoided, and network transmission efficiency and processing capacity can be improved.

[0045] The above technical solutions of the embodiments of the present application will be described below in combination with specific application scenarios.

[0046] Based on the segment routing strategy, the head-end node encapsulates a segment routing tunnel header for the data packet after receiving the data packet, and the segment routing tunnel header comprises a segment routing list, and the segment routing list comprises IPv6 addresses of nodes on a specific path, and the nodes on the specific path forward the data packet based on the segment routing tunnel header. Referring to FIG. 2A, an application scenario diagram of the segment routing strategy is shown, a source node C1 (such as a terminal device) can send a data packet to a destination node S1 (such as a server), P1 serves as a head-end node (such as a router, a switch or the like), P8 serves as a tail-end node (such as a router, a switch or the like), P2, P4 and P6 can serve as intermediate nodes (such as routers, switches or the like) on one forwarding path, and P3, P5 and P7 can serve as intermediate nodes on another forwarding path.

[0047] However, after receiving the data packet, each intermediate node can only forward the data packet to the next node on the specific path based on the segment routing tunnel header, and for a security device that does not support segment routing, each intermediate node cannot send the data packet to the security device.

[0048] For example, after receiving a data packet, intermediate node P2 can only forward the data packet to intermediate node P4 based on the segmented routing tunnel head. After receiving a data packet, intermediate node P4 can only forward the data packet to intermediate node P6 based on the segmented routing tunnel head. After receiving a data packet, intermediate node P6 can only forward the data packet to the tail node P8 based on the segmented routing tunnel head.

[0049] In response to the above findings, this embodiment combines segmented routing and network tagging to send data packets to security devices, enabling the security devices to perform security checks on the data packets. See Figure 2B, which illustrates an application scenario of the segmented routing strategy. Intermediate node P2 connects to multiple security devices via a switch. These security devices can include those supporting DDoS protection, those supporting WAF, those supporting firewalls, and those supporting intrusion prevention systems; there are no restrictions on the specific devices.

[0050] Since the processing flow of intermediate nodes is the same, to simplify the application scenario of the segmented routing strategy, multiple intermediate nodes can be simplified into a single intermediate node. See Figure 2C, which illustrates the application scenario of the segmented routing strategy. The source node C1 (such as a terminal device) can send data packets to the destination node S1 (such as a server). P1 acts as the headend node (such as a router, switch, or other network device), P8 acts as the tailend node (such as a router, switch, or other network device), and P2 can act as an intermediate node (such as a router, switch, or other network device). Furthermore, the intermediate node P2 connects to multiple security devices through a switch.

[0051] In the above application scenarios, this application proposes a message processing method that can realize access control of data messages. See Figure 3, which is a flowchart of the message processing method.

[0052] Step 301: Header node P1 receives the inner message, which is a data packet sent by source node C1 to destination node S1. For example, the source IP address of the inner message is the IP address of source node C1, the destination IP address is the IP address of destination node S1, the source MAC (Media Access Control) address is the MAC address of source node C1, and the destination MAC address is the MAC address of destination node S1 or any MAC address.

[0053] Step 302: Header node P1 encapsulates the segmented routing tunnel header into an inner packet to obtain a data packet. For ease of distinction, this data packet is referred to as the third data packet. The third data packet may include the segmented routing tunnel header and the inner packet.

[0054] In one example, after obtaining the inner packet, the head node P1 can encapsulate a segment routing tunnel head (SRH) for the inner packet, as shown in FIG. 4, which is a schematic diagram of the segment routing tunnel head. The segment routing tunnel head can include the following contents in sequence:

[0055] Next Header: used to indicate the type of the packet header immediately following the segment routing tunnel head, such as IPv4 encapsulation, IPv6 encapsulation, IPv6-Route, ICMPv6, etc.

[0056] Hdr Ext Len: used to indicate the length of the segment routing tunnel head. Hdr Ext Len can indicate the length of the segment routing tunnel head excluding the first 8 bytes (the first 8 bytes are of fixed length).

[0057] Routing Type: used to indicate the type of the routing header.

[0058] Segments Left: used to indicate the number of intermediate nodes that should be visited before reaching the destination node, i.e., the number of intermediate nodes between the current node and the tail end node.

[0059] Last Entry: used to indicate the index of the last element in the segment routing list.

[0060] Flags: used to indicate some identification of the data packet. Flags can include 8 bits.

[0061] Tag: used to identify the same group of data packets.

[0062] Segment List[0]~Segment List[n-1]: the segment routing list (also referred to as segment list) can include Segment List[0]~Segment List[n-1]. The segment routing list is encoded from the last segment of the path. Segment List[0] is the last but one segment of the path (indicating the identification information of the last but one node, such as IPv6 address), Segment List[1] is the last but two segment of the path (the identification information of the last but two node), Segment List[n-2] is the second segment of the path (the identification information of the second node), and Segment List[n-1] is the first segment of the path (the identification information of the first node).

[0063] Optional Type Length Value objects (TLVs), which are optional.

[0064] In step 303, if the IP address information of the inner-layer message corresponds to a routing type of segment routing combined with network label, the head-end node P1 acquires a primary path and a backup path corresponding to the IP address information, adds the primary path and the backup path in a segment routing tunnel header of the third data message, modifies a routing type field in the segment routing tunnel header to the first value, and obtains a first data message. Alternatively, if the IP address information of the inner-layer message corresponds to a routing type of segment routing, the third data message is taken as the first data message.

[0065] In an example, after receiving the inner-layer message, the head-end node P1 can also determine a routing type corresponding to IP address information (such as a destination IP address and / or a source IP address) of the inner-layer message. For example, a mapping relationship between an IP address (such as an IP network segment) and a routing type can be pre-configured in the head-end node P1, based on which, after receiving the inner-layer message, the head-end node P1 can acquire a destination IP address of the inner-layer message, query the mapping relationship based on the destination IP address, and obtain a routing type corresponding to the destination IP address.

[0066] The routing type can be a routing type of segment routing, such as a routing type of SRv6 (Segment Routing over IPv6). When the IP address information of the inner-layer message corresponds to the routing type of segment routing, it indicates that the data message is processed by segment routing, based on which, the head-end node P1 takes the third data message as the first data message, and subsequently processes the first data message by segment routing.

[0067] The routing type can be a routing type of segment routing combined with a network label, such as a routing type of SRv6 combined with a VLAN (Virtual Local Area Network) network label, or a routing type of SRv6 combined with a VXLAN (Virtual Extensible Local Area Network) network label. When the IP address information of the inner-layer message corresponds to the routing type of segment routing combined with a network label, it indicates that the data message is processed by segment routing combined with a network label. Based on this, the head-end node P1 can obtain the primary path and the backup path corresponding to the IP address information, add the primary path and the backup path in the segment routing tunnel header of the third data message, modify the routing type field in the segment routing tunnel header to the first value, obtain the first data message, and subsequently process the first data message by segment routing combined with a network label. For details of the processing process, refer to subsequent embodiments.

[0068] In an example, if a certain IP address information (a plurality of IP address information) corresponds to the routing type of segment routing combined with a network label, the head-end node P1 can be pre-configured with the primary path and the backup path corresponding to the IP address information. Based on this, after receiving the inner-layer message, the head-end node P1 can also obtain the IP address information of the inner-layer message, and obtain the primary path and the backup path corresponding to the IP address information.

[0069] The primary path can include device information of at least one security device corresponding to security detection required by the first data message. For convenience of distinction, the security device corresponding to the primary path is referred to as a first security device, and the device information of the first security device is referred to as first device information. Based on this, the primary path can include first device information of at least one first security device (such as a plurality of first security devices).

[0070] The first device information can be a unique identifier of the first security device, or other device information such as an IP address, a MAC address, etc. of the first security device, which is not limited.

[0071] When the head-end node P1 is pre-configured with the primary path corresponding to the IP address information, the order of the plurality of first security devices corresponding to the primary path can also be planned, which is not limited and can be configured according to experience.

[0072] For example, the order of the plurality of first security devices is first security device a1, first security device a2, and first security device a3 in turn, and the primary path includes first device information of the first security device a1, first device information of the first security device a2, and first device information of the first security device a3 in turn.

[0073] For example, the order of the multiple first security devices is first security device a3, first security device a1 and first security device a2 in sequence, and the main path comprises the first device information of the first security device a3, the first device information of the first security device a1 and the first device information of the first security device a2 in sequence.

[0074] The backup path can comprise the device information of at least one security device corresponding to the security detection required by the first data message. For convenience of distinction, the security device corresponding to the backup path is referred to as a second security device, and the device information of the second security device is referred to as second device information. Based on this, the backup path can comprise the second device information of at least one second security device (such as multiple second security devices).

[0075] The second device information can be a unique identifier of the second security device, or other device information such as an IP address and a MAC address of the second security device, which is not limited.

[0076] When the head node P1 pre-configures the backup path corresponding to the IP address information, the order of the multiple second security devices corresponding to the backup path can also be planned, which is not limited and can be configured according to experience.

[0077] For example, the order of the multiple second security devices is second security device b1, second security device b2 and second security device b3 in sequence, and the backup path comprises the second device information of the second security device b1, the second device information of the second security device b2 and the second device information of the second security device b3 in sequence.

[0078] For example, the order of the multiple second security devices is second security device b3, second security device b1 and second security device b2 in sequence, and the backup path comprises the second device information of the second security device b3, the second device information of the second security device b1 and the second device information of the second security device b2 in sequence.

[0079] In one example, after the head node P1 obtains the main path and the backup path corresponding to the IP address information of the inner-layer message, the head node P1 can also add the main path and the backup path in the segment routing tunnel header of the third data message.

[0080] For example, the segment routing tunnel header comprises a segment routing list, and the segment routing list comprises the segment routing addresses of the intermediate nodes between the head node and the tail node. On this basis, the head node P1 can add the main path and the backup path in the segment routing list of the segment routing tunnel header. Of course, the head node P1 can also add the main path and the backup path in other positions of the segment routing tunnel header, which is not limited.

[0081] When the primary path and the backup path are added in the segment routing list of the segment routing tunnel header, the segment routing list further includes the primary path and the backup path. The primary path can be located in front of all the segment routing addresses, the primary path can also be located behind all the segment routing addresses, or the primary path can be located between two adjacent segment routing addresses, and the location of the primary path is not limited. Taking the primary path located in front of all the segment routing addresses as an example.

[0082] Similarly, the backup path can be located in front of all the segment routing addresses, the backup path can also be located behind all the segment routing addresses, or the backup path can be located between two adjacent segment routing addresses, and the location of the backup path is not limited. Taking the backup path located in front of all the segment routing addresses as an example.

[0083] When the segment routing list includes the primary path and the backup path, the primary path can be located in front of the backup path, or the primary path can be located behind the backup path, and subsequent examples take the primary path located in front of the backup path as an example.

[0084] In step 302, when the head node P1 encapsulates the segment routing tunnel header for the inner-layer message, the routing type field (such as Routing Type) in the segment routing tunnel header is a second value, and the second value represents the routing type of the segment routing. In step 303, if the IP address information of the inner-layer message corresponds to the routing type of the combination of the segment routing and the network label, the head node P1 can further modify the routing type field (such as Routing Type) in the segment routing tunnel header to a first value, and the first value represents the routing type of the combination of the segment routing and the network label. For example, the first value can be 253, or other values, and the first value is not limited, and 253 represents the routing type of the combination of the segment routing and the network label.

[0085] In one example, the primary path field (used to carry the primary path), the backup path field (used to carry the backup path), and the routing type field can be referred to as ESRH (Extensible Segment Routing Head) fields, that is, the ESRH field includes the primary path field, the backup path field, and the routing type field. Based on this, if the IP address information of the inner-layer message corresponds to the routing type of the combination of the segment routing and the network label, the head node P1 can add the ESRH field in the segment routing tunnel header.

[0086] For example, the ESRH field of the segment routing tunnel header can include but is not limited to the following information:

[0087] Routing Type: defines a routing extension header private implementation 253, represents SRv6 vlan / vxlan label forwarding, that is, a first value, and the first value represents the routing type of the combination of the segment routing and the network label.

[0088] Main path: define the main path processing sequence of the security device, ensure that the data packet is checked according to the predetermined path, use the first 128 bytes of segment-list defined in RFC. For example, the first 128 bytes of the segment route list are used as the main path field, and the main path is carried through the main path field.

[0089] Backup path: define the backup path processing sequence of the security device, ensure that the data packet is checked according to the predetermined path, use the second 128 bytes of segment-list defined in RFC. For example, the second 128 bytes of the segment route list are used as the backup path field, and the backup path is carried through the backup path field.

[0090] For example, the main path includes the first device information 0x01 of the Firewall security device 1, the first device information 0x02 of the DDoS security device 1, the first device information 0x03 of the IPS security device 1, and the first device information 0x04 of the WAF security device 1 in turn. The backup path includes the second device information 0x05 of the Firewall security device 2, the second device information 0x06 of the DDoS security device 2, the second device information 0x07 of the IPS security device 2, and the second device information 0x08 of the WAF security device 2 in turn. As can be seen from the above, the main path can include 0x01 0x02 0x03 0x04, and the backup path can include 0x05 0x06 0x07 0x08.

[0091] Step 304, the head node P1 sends the first data packet to the intermediate node P2.

[0092] Step 305, the intermediate node P2 obtains the first data packet, which is the packet sent by the head node P1 to the tail node P8. The first data packet includes a segment routing tunnel header and an inner packet. For convenience, the inner packet is recorded as the first inner packet.

[0093] Step 306, the intermediate node P2 parses the route type field from the segment routing tunnel header. If the route type field is the second value, the intermediate node P2 sends the first data packet to the tail node P8 based on the segment routing tunnel header. The second value represents the route type of the segment routing, and the process will not be described again.

[0094] Alternatively, if the routing type field is a first value (e.g., 253), the intermediate node P2 obtains a primary path and a backup path from the segment routing tunnel header, and the first value represents a segment routing combined with network label routing type. The primary path can include first device information of the first security device, such as first device information of a plurality of first security devices. In addition, the backup path can include second device information of the second security device, such as second device information of a plurality of second security devices.

[0095] When the routing type field is the first value, the head node P1 can add the primary path and the backup path in the segment routing tunnel header, and the intermediate node P2 obtains the primary path and the backup path from the segment routing tunnel header.

[0096] In step 307, the intermediate node P2 queries the label mapping table through the first device information of the first security device to obtain the first network label of the first security device, and generates a first information mapping table corresponding to the primary path, and the first information mapping table includes a plurality of first network labels of the first security device.

[0097] The intermediate node P2 queries the label mapping table through the second device information of the second security device to obtain the second network label of the second security device, and generates a second information mapping table corresponding to the backup path, and the second information mapping table includes a plurality of second network labels of the second security device.

[0098] In one example, the label mapping table can be pre-configured in the intermediate node P2, and the label mapping table includes the correspondence between the device information and the network label. Referring to Table 1, an example of the label mapping table is shown.

[0099] Table 1

[0100] When configuring the label mapping table, for a plurality of first security devices corresponding to the primary path, different first security devices need to correspond to different network labels, that is, different first security devices will not correspond to the same network label, and by corresponding to different network labels, data packets can be sent to different first security devices of the primary path. For a plurality of second security devices corresponding to the backup path, different second security devices need to correspond to different network labels, that is, different second security devices will not correspond to the same network label, and by corresponding to different network labels, data packets can be sent to different second security devices of the backup path. In addition, the network label corresponding to the first security device and the network label corresponding to the second security device can be the same or different.

[0101] Given the first device information 0x01 of the Firewall security device 1 and the network label 10, the correspondence between 0x01 and the network label 10 can be configured in the label mapping table. Given the first device information 0x02 of the DDoS security device 1 and the network label 20, the correspondence between 0x02 and the network label 20 can be configured in the label mapping table. The configuration process of the label mapping table is not limited in this way.

[0102] In one example, the primary path can include 0x01 0x02 0x03 0x04. The intermediate node P2 queries the label mapping table by the first device information 0x01 to obtain the first network label 10 (for the sake of distinction, the network label corresponding to the first device information is referred to as the first network label). The intermediate node P2 queries the label mapping table by the first device information 0x02 to obtain the first network label 20. The intermediate node P2 queries the label mapping table by the first device information 0x03 to obtain the first network label 30. The intermediate node P2 queries the label mapping table by the first device information 0x04 to obtain the first network label 40.

[0103] On this basis, the intermediate node P2 can further generate a first information mapping table, and the first information mapping table includes the first network labels. The order of the multiple first network labels in the first information mapping table matches the order of the multiple first device information included in the primary path, that is, the order of the two is consistent. For example, since the primary path includes the first device information 0x01, the first device information 0x02, the first device information 0x03, and the first device information 0x04 in turn, the first information mapping table includes the first network label 10 corresponding to the first device information 0x01, the first network label 20 corresponding to the first device information 0x02, the first network label 30 corresponding to the first device information 0x03, and the first network label 40 corresponding to the first device information 0x04 in turn.

[0104] In one example, the backup path can include 0x05 0x06 0x07 0x08. The intermediate node P2 queries the label mapping table by the second device information 0x05 to obtain the second network label 50 (for the sake of distinction, the network label corresponding to the second device information is referred to as the second network label). The intermediate node P2 queries the label mapping table by the second device information 0x06 to obtain the second network label 20. The intermediate node P2 queries the label mapping table by the second device information 0x07 to obtain the second network label 30. The intermediate node P2 queries the label mapping table by the second device information 0x08 to obtain the second network label 40.

[0105] On this basis, the intermediate node P2 can further generate a second information mapping table, and the second information mapping table includes the second network labels. The order of the second network labels in the second information mapping table matches the order of the second device information included in the backup path, that is, the order of both is consistent. For example, since the backup path includes the second device information 0x05, the second device information 0x06, the second device information 0x07, and the second device information 0x08 in sequence, the second information mapping table includes the second network label 50 corresponding to the second device information 0x05, the second network label 20 corresponding to the second device information 0x06, the second network label 30 corresponding to the second device information 0x07, and the second network label 40 corresponding to the second device information 0x08 in sequence.

[0106] In an example, when the intermediate node P2 generates the first information mapping table, the first information mapping table further includes IP address information of the first inner message, for example, the first information mapping table includes the correspondence between the IP address information and the first network label 10, the first network label 20, the first network label 30, and the first network label 40, and the first information mapping table can be an ACL (Access Control List).

[0107] In step 308, the intermediate node P2 determines to send the second inner message corresponding to the first inner message to the plurality of first security devices corresponding to the main path, or to send the fourth inner message corresponding to the first inner message to the plurality of second security devices corresponding to the backup path. If the second inner message is sent to the plurality of first security devices corresponding to the main path, step 309 can be performed, or if the fourth inner message is sent to the plurality of second security devices corresponding to the backup path, step 310 can be performed.

[0108] In an example, if the main path is available, it is determined to send the second inner message to the plurality of first security devices corresponding to the main path. Or, if the main path is unavailable and the backup path is available, it is determined to send the fourth inner message to the plurality of second security devices corresponding to the backup path. Or, if the main path is unavailable and the backup path is unavailable, the intermediate node P2 sends the first data message to the tail node P8 based on the segment routing tunnel header, and the intermediate node P2 outputs an alarm information indicating that the main path and the backup path are both unavailable. In this way, after the user learns the alarm information, the main path and the backup path can also be repaired.

[0109] In one example, when the intermediate node P2 configures the label mapping table, the label mapping table can further include the correspondence between the device information and the link state, and the label mapping table can further include the correspondence between the device information and the routing type. Referring to Table 2, an example of the label mapping table is shown. Of course, Table 2 is only an example, and in addition to the network label, the link state, and the routing type, the label mapping table can further include other contents, such as the encapsulation type (IPv4 encapsulation or IPv6 encapsulation), and the label mapping table is not limited in this regard.

[0110] Table 2

[0111] For the link state of the label mapping table, the intermediate node P2 can periodically probe the link state of the first security device and update the link state of the first security device in the label mapping table. The intermediate node P2 can periodically probe the link state of the second security device and update the link state of the second security device in the label mapping table. For example, in each probe period, the intermediate node P2 can send a BFD (Bidirectional Forwarding Detection) probe packet to the security device (such as the first security device or the second security device), and if a BFD response packet returned by the security device is received, it is determined that the link state of the security device is reachable, and the link state of the security device in the label mapping table is updated to be reachable (such as 1). If the BFD response packet returned by the security device is not received, it is determined that the link state of the security device is unreachable, and the link state of the security device in the label mapping table is updated to be unreachable (such as 0).

[0112] For the routing type of the label mapping table, if the first security device supports the routing type of segment routing combined with network label, the routing type of segment routing combined with network label, such as SRv6-VLAN or SRv6-VXLAN, is configured in the label mapping table. Alternatively, if the first security device does not support the routing type of segment routing combined with network label, the routing type of segment routing, such as SRv6, is configured in the label mapping table. If the second security device supports the routing type of segment routing combined with network label, the routing type of segment routing combined with network label, such as SRv6-VLAN or SRv6-VXLAN, is configured in the label mapping table. Alternatively, if the second security device does not support the routing type of segment routing combined with network label, the routing type of segment routing, such as SRv6, is configured in the label mapping table.

[0113] In an example, the main path can include 0x010x020x030x04, the intermediate node P2 queries the label mapping table by the first device information 0x01 to obtain the link state and the routing type of the first security device, if the link state is reachable (e.g., the link state is 1) and the routing type is the routing type of the combination of the segment routing and the network label (e.g., the routing type is SRv6-VLAN), it is determined that the available state of the first security device is available. If the link state is unreachable (e.g., the link state is 0) and / or the routing type is the routing type of the segment routing (e.g., the routing type is SRv6), it is determined that the available state of the first security device is unavailable. Similarly, the intermediate node P2 queries the label mapping table by the first device information 0x02, the first device information 0x03 and the first device information 0x04 to obtain the link state and the routing type. Based on the above processing, the available state of each first security device can be obtained, and the available state is available or unavailable.

[0114] Based on this, if the available state of all the first security devices is available, it is determined that the main path is available, and if the available state of any first security device is unavailable, it is determined that the main path is unavailable.

[0115] The backup path can include 0x050x060x070x08, the intermediate node P2 queries the label mapping table by the second device information 0x05 to obtain the link state and the routing type of the second security device, if the link state is reachable and the routing type is the routing type of the combination of the segment routing and the network label, it is determined that the available state of the second security device is available. If the link state is unreachable and / or the routing type is the routing type of the segment routing, it is determined that the available state of the second security device is unavailable. Similarly, the intermediate node P2 queries the label mapping table by the second device information 0x06, the second device information 0x07 and the second device information 0x08 to obtain the link state and the routing type. Based on the above processing, the available state of each second security device can be obtained, and the available state of each second security device is available or unavailable.

[0116] Based on this, if the available state of all the second security devices is available, it is determined that the backup path is available, and if the available state of any second security device is unavailable, it is determined that the backup path is unavailable.

[0117] In step 309, the intermediate node P2 adds the first network label to the first inner layer message to obtain a second inner layer message, and sends the second inner layer message to the first security device, so that when the second inner layer message is received by the first security device, if the first network label in the second inner layer message is consistent with the network label of the first security device, the second inner layer message is subjected to security detection processing.

[0118] In an example, step 309 can be implemented by the following steps:

[0119] In step S11, the intermediate node P2 traverses each first network tag in the first information mapping table in sequence. For the current network tag traversed, the current network tag is added to the first inner-layer message to obtain a second inner-layer message.

[0120] In one example, the first information mapping table includes a correspondence relationship between IP address information (such as a destination IP address and / or a source IP address) of an inner-layer message and the first network tag 10, the first network tag 20, the first network tag 30, and the first network tag 40. The intermediate node P2 traverses the first network tag 10 as the current network tag from the first information mapping table. After obtaining the first data message, the intermediate node P2 can remove the segment routing tunnel header of the first data message (the segment routing tunnel header needs to be buffered to be added to the inner-layer message subsequently), to obtain the inner-layer message 1 (i.e., the first inner-layer message) in the first data message. On this basis, the intermediate node P2 adds the first network tag 10 to the inner-layer message 1 to obtain the modified inner-layer message 2 (i.e., the second inner-layer message).

[0121] The source IP address of the inner-layer message 1 is the IP address of the source node C1, the destination IP address of the inner-layer message 1 is the IP address of the destination node S1, the source MAC address of the inner-layer message 1 is the MAC address of the source node C1, and the destination MAC address of the inner-layer message 1 is the MAC address of the destination node S1 or an arbitrary MAC address. Based on this, after obtaining the inner-layer message 2, the intermediate node P2 can also modify the source MAC address of the inner-layer message 2 to the MAC address of the intermediate node P2, and modify the destination MAC address of the inner-layer message 2 to the MAC address of the Firewall security device 1 corresponding to the first network tag 10.

[0122] For example, the intermediate node P2 can be pre-configured with a static route, which can include a correspondence relationship between the first network tag 10 and the MAC address of the Firewall security device 1. Based on this, the MAC address of the Firewall security device 1 can be obtained by querying the static route through the first network tag 10.

[0123] In step S12, the intermediate node P2 sends the second inner-layer message to the first security device corresponding to the current network tag. For example, since the destination MAC address of the inner-layer message 2 is the MAC address of the Firewall security device 1, the inner-layer message 2 can be sent to the Firewall security device 1.

[0124] As can be seen from the above, the intermediate node P2 acts as a gateway function, can parse and process the ESRH field, and can add a network tag (such as a VLAN tag) to the inner-layer message and forward it to the security device.

[0125] Step S13, when the Firewall security device 1 receives the second inner-layer packet, if the first network label 10 in the second inner-layer packet is consistent with the network label of the Firewall security device 1, the Firewall security device 1 performs security detection processing on the second inner-layer packet. Or, if the first network label 10 in the second inner-layer packet is inconsistent with the network label of the Firewall security device 1, the Firewall security device 1 discards the second inner-layer packet.

[0126] For example, the Firewall security device 1 can obtain the first network label 10 carried in the inner-layer packet 2. Since the network label of the Firewall security device 1 is the network label 10, the first network label 10 is consistent with the network label of the Firewall security device 1, and the Firewall security device 1 performs security detection processing on the inner-layer packet 2. For other security devices such as the DDoS security device 1, since the first network label 10 is inconsistent with the network label of the DDoS security device 1, the inner-layer packet 2 is discarded.

[0127] For example, when the Firewall security device 1 is configured, the network label 10 can bind the VPN (Virtual Private Network) of the Firewall security device 1. Based on this, after the Firewall security device 1 obtains the first network label 10 carried in the inner-layer packet 2, since the first network label 10 corresponds to the VPN of the Firewall security device 1, the first network label 10 is consistent with the network label of the Firewall security device 1, and the Firewall security device 1 performs security detection processing on the inner-layer packet 2.

[0128] For example, when the Firewall security device 1 performs security detection processing on the inner-layer packet 2, a predefined policy can be used to perform security detection processing on the inner-layer packet 2, and the security detection processing manner is not limited.

[0129] Step S14, if the security detection processing result of the second inner-layer packet is safe, the Firewall security device 1 sends a third inner-layer packet to the intermediate node P2, the source MAC address of the third inner-layer packet is the MAC address of the Firewall security device 1, and the destination MAC address of the third inner-layer packet is the MAC address of the intermediate node P2. Or, if the security detection processing result of the second inner-layer packet is unsafe, the Firewall security device 1 discards the second inner-layer packet.

[0130] Step S15, if the intermediate node P2 does not receive the inner message returned by the Firewall security device 1, the message transmission process is ended. Or, if the intermediate node P2 receives the third inner message returned by the Firewall security device 1, the IP address information and the first network label 10 in the third inner message are obtained.

[0131] Step S16, the intermediate node P2 queries the first information mapping table corresponding to the IP address information, and determines the first network label 10 in the third inner message as the current network label. The intermediate node P2 judges whether the current network label is the last first network label in the first information mapping table.

[0132] If not, the next first network label of the current network label in the first information mapping table is traversed as the current network label, and the step S11 is returned. The current network label is added to the inner message to obtain the modified inner message. If yes, the step 309 is ended.

[0133] For example, since the current network label 10 is not the last first network label in the first information mapping table, the intermediate node P2 traverses the next first network label 20 of the current network label 10 in the first information mapping table as the current network label. The intermediate node P2 modifies the first network label 10 in the inner message 3 (referred to as the third inner message returned by the security device) to the first network label 20 to obtain the modified inner message 4 (referred to as the second inner message sent to the security device), modifies the source MAC address of the inner message 4 to the MAC address of the intermediate node P2, and modifies the destination MAC address of the inner message 4 to the MAC address of the DDoS security device 1 corresponding to the first network label 20.

[0134] The intermediate node P2 sends the inner message 4 to the DDoS security device 1. If the intermediate node P2 receives the inner message 5 (i.e. the third inner message) returned by the DDoS security device 1, the intermediate node P2 traverses the next first network label 30 of the current network label 20 in the first information mapping table as the current network label, modifies the first network label 20 in the inner message 5 to the first network label 30 to obtain the modified inner message 6 (i.e. the second inner message), and modifies the destination MAC address of the inner message 6 to the MAC address of the IPS security device 1 corresponding to the first network label 30.

[0135] The intermediate node P2 sends the inner-layer packet 6 to the IPS security device 1. If the intermediate node P2 receives the inner-layer packet 7 (i.e., the third inner-layer packet) returned by the IPS security device 1, the intermediate node P2 traverses the next first network label 40 of the current network label 30 as the current network label from the first information mapping table, modifies the first network label 30 in the inner-layer packet 7 to the first network label 40 to obtain a modified inner-layer packet 8 (i.e., the second inner-layer packet), and modifies the destination MAC address of the inner-layer packet 8 to the MAC address of the WAF security device 1 corresponding to the first network label 40.

[0136] The intermediate node P2 sends the inner-layer packet 8 to the WAF security device 1. If the intermediate node P2 receives the inner-layer packet 9 (i.e., the third inner-layer packet) returned by the WAF security device 1, the current network label 40 is the last first network label in the first information mapping table, and step 309 ends, and step 311 is performed.

[0137] In step 311, the inner-layer packet 9 (i.e., the third inner-layer packet) can be processed, or the source MAC address of the inner-layer packet 9 can be modified to the MAC address of the source node C1, the destination MAC address of the inner-layer packet 9 can be modified to the MAC address of the destination node S1, and the network label in the inner-layer packet 9 can be removed. The modified inner-layer packet is the same as the first inner-layer packet described above, and the first inner-layer packet is processed.

[0138] In step 310, the intermediate node P2 adds the second network label to the first inner-layer packet to obtain a fourth inner-layer packet, and sends the fourth inner-layer packet to the second security device, so that when the second security device receives the fourth inner-layer packet, if the second network label in the fourth inner-layer packet is consistent with the network label of the second security device, the fourth inner-layer packet is subjected to security detection processing.

[0139] In one example, step 310 can be implemented by the following steps:

[0140] In step S21, the intermediate node P2 traverses each second network label in the second information mapping table in sequence. For the current network label traversed, the first inner-layer packet is added with the current network label to obtain a fourth inner-layer packet.

[0141] The second information mapping table includes a corresponding relationship between the IP address information (such as the destination IP address and / or the source IP address) of the inner-layer packet and the second network label 50, the second network label 20, the second network label 30, and the second network label 40. The intermediate node P2 traverses the second network label 50 as the current network label from the second information mapping table, and adds the second network label 50 to the first inner-layer packet to obtain a fourth inner-layer packet.

[0142] Step S22, the intermediate node P2 sends the fourth inner-layer packet to the second security device corresponding to the current network label, for example, sends the fourth inner-layer packet to the Firewall security device 2.

[0143] Step S23, when receiving the fourth inner-layer packet, if the second network label 50 in the fourth inner-layer packet is consistent with the network label of the Firewall security device 2, the Firewall security device 2 performs security detection processing on the fourth inner-layer packet. Or, if the second network label 50 in the fourth inner-layer packet is inconsistent with the network label of the Firewall security device 2, the fourth inner-layer packet is discarded.

[0144] Step S24, if the security detection processing result of the fourth inner-layer packet is safe, the Firewall security device 2 sends the fifth inner-layer packet to the intermediate node P2. Or, if the security detection processing result of the fourth inner-layer packet is unsafe, the Firewall security device 1 discards the fourth inner-layer packet, that is, does not send the inner-layer packet to the intermediate node P2.

[0145] Step S25, if the intermediate node P2 does not receive the inner-layer packet returned by the Firewall security device 2, the message transmission process is ended. Or, if the intermediate node P2 receives the fifth inner-layer packet returned by the Firewall security device 2, the IP address information and the second network label 50 are obtained from the fifth inner-layer packet.

[0146] Step S26, the intermediate node P2 queries the second information mapping table corresponding to the IP address information, and determines the second network label 50 as the current network label. The intermediate node P2 judges whether the current network label is the last second network label in the second information mapping table. If not, the next second network label of the current network label in the second information mapping table is traversed as the current network label, and the step S21 is returned. The current network label is added to the inner-layer packet to obtain the fourth inner-layer packet. If yes, the step 310 is ended.

[0147] For example, the intermediate node P2 traverses the second network label 20 as the current network label from the second information mapping table, modifies the second network label 50 in the inner-layer message to the second network label 20, and sends the inner-layer message to the DDoS security device 2. If the intermediate node P2 receives the inner-layer message returned by the DDoS security device 2, the intermediate node P2 traverses the second network label 30 as the current network label from the second information mapping table, modifies the second network label 20 in the inner-layer message to the second network label 30, and sends the inner-layer message to the IPS security device 2. If the intermediate node P2 receives the inner-layer message returned by the IPS security device 2, the intermediate node P2 traverses the second network label 40 as the current network label from the second information mapping table, modifies the second network label 30 in the inner-layer message to the second network label 40, and sends the inner-layer message to the WAF security device 2. If the intermediate node P2 receives the inner-layer message returned by the WAF security device 2, the step 310 ends, and the step 311 is performed.

[0148] In the step 311, the intermediate node P2 encapsulates a segment routing tunnel header for the inner-layer message, removes the primary path and the backup path in the segment routing tunnel header, and modifies the routing type field in the segment routing tunnel header from the first value to a second value (the second value represents the routing type of the segment routing), to obtain a second data message.

[0149] In an example, after the intermediate node P2 receives the third inner-layer message returned by the last first security device of the primary path (or the fifth inner-layer message returned by the last second security device of the backup path), the intermediate node P2 encapsulates a segment routing tunnel header for the third inner-layer message, and the segment routing tunnel header is the cached segment routing tunnel header. Alternatively, the intermediate node P2 can remove the network label in the third inner-layer message to obtain a first inner-layer message, and encapsulate a segment routing tunnel header for the first inner-layer message.

[0150] Since the segment routing tunnel header includes the primary path and the backup path, the intermediate node P2 can also remove the primary path and the backup path in the segment routing tunnel header. Based on this, the segment routing list of the segment routing tunnel header does not include the primary path and the backup path, as shown in the segment routing tunnel header in FIG. 4.

[0151] Since the routing type field (Routing Type) of the segment routing tunnel header is the first value (e.g., 253), and the first value represents the routing type of the segment routing combined with the network label, the intermediate node P2 can also modify the routing type field in the segment routing tunnel header to the second value (e.g., 4).

[0152] In the step 312, the intermediate node P2 sends the second data message based on the segment routing tunnel header of the second data message. For example, the intermediate node P2 sends the second data message to the tail node P8.

[0153] The tail end node P8 can remove the segment routing tunnel header of the second data packet after receiving the second data packet, obtain the inner packet in the second data packet, and send the inner packet to the destination node S1. At this point, the data packet is successfully sent to the destination node S1, and the transmission process of the data packet is completed.

[0154] As can be seen from the above technical solutions, the network tag is obtained by querying the device information query tag mapping table, the network tag is added to the inner packet, and the modified inner packet is sent to the security device, so that the data packet is sent to the security device in combination with the segment routing and the network tag, so that the security device performs security detection and processing on the data packet, thereby providing security services for the data packet, and transmitting the data packet that has undergone security detection and processing in the network, thereby avoiding security risks to the network. In combination with the segment routing and the network tag, dynamic and efficient path control of multiple security devices is realized, and unified path control and management are realized. The path order of the security devices can be flexibly configured and adjusted according to different network security requirements. Redundant data packet conversion and forwarding can be avoided, and network transmission efficiency and processing capacity can be improved. In combination with the network tag (such as VLAN / VXLAN tag) and the enhanced segment routing header (ESRH) field of SRv6 routing, dynamic and efficient path control of multiple security devices is realized, and the SRv6 combination path control method based on the enhanced segment routing header is realized.

[0155] Based on the same application concept as the above method, an embodiment of the present application proposes a packet processing device applied to a network device, as shown in FIG. 5, which is a structural schematic diagram of the device. The device comprises:

[0156] The acquisition module 51 is configured to acquire a first data packet, wherein the first data packet comprises a segment routing tunnel header and a first inner packet, the segment routing tunnel header comprises a main path, the main path comprises first device information of a first security device corresponding to security detection required by the first data packet, and the first network tag corresponding to the first device information included in the main path is acquired.

[0157] The processing module 52 is configured to send a second inner packet corresponding to the first inner packet to the first security device based on the first network tag, so that the first security device performs security detection and processing on the received second inner packet based on the first network tag. If a third inner packet returned by the last first security device of the main path is received, a second data packet is obtained by encapsulating the segment routing tunnel header of the main path based on the third inner packet. The sending module 53 is configured to send the second data packet based on the segment routing tunnel header of the second data packet.

[0158] In one example, the first path includes first device information of the plurality of first security devices; the processing module 52 is specifically configured to:

[0159] obtain a first information mapping table corresponding to the first path, the first information mapping table including first device information of the plurality of first security devices corresponding to a first network label;

[0160] sequentially traverse each first network label in the first information mapping table;

[0161] for a current network label traversed, add the current network label to the first inner-layer message to obtain a second inner-layer message, and send the second inner-layer message to the first security device;

[0162] if the third inner-layer message returned by the first security device is received, determine whether a network label in the third inner-layer message is a last first network label in the first information mapping table;

[0163] if not, traverse a next first network label of the network label in the third inner-layer message as a current network label from the first information mapping table, and return to perform the operation of adding the current network label to the first inner-layer message to obtain a second inner-layer message.

[0164] In one example, the obtaining module 51 is further configured to parse a route type field from the segment routing tunnel header; if the route type field is a first value, obtain first device information included in the first path from the segment routing tunnel header; wherein the first value represents a route type of segment routing combined with a network label.

[0165] The processing module 52 is further configured to, after encapsulating the segment routing tunnel header without the first path based on the third inner-layer message, modify a route type field in the segment routing tunnel header from the first value to a second value, wherein the second value represents a route type of segment routing.

[0166] In one example, the segment routing tunnel header further includes a backup path, the backup path including second device information of a second security device corresponding to security detection required by the first data message; the processing module 52 is further configured to, before obtaining the first network label corresponding to the first device information included in the first path, determine that the first path is available.

[0167] The obtaining module 51 is further configured to, if the first path is unavailable and the backup path is available, obtain a second network label corresponding to the second device information included in the backup path.

[0168] The processing module 52 is further configured to send a fourth inner layer message corresponding to the first inner layer message to the second security device based on the second network label, so that the second security device performs security detection processing on the received fourth inner layer message based on the second network label; and if a fifth inner layer message returned by a last second security device of the backup path is received, encapsulating a segment routing tunnel header of the main path and the backup path is removed based on the fifth inner layer message to obtain a second data message.

[0169] In one example, the processing module 52 is configured to determine that the main path is available when the availability of each first security device in the main path meets a set condition, and for each first security device, the processing module is configured to determine that the availability of the first security device meets the set condition by:

[0170] obtaining a link state of the first security device; if the link state is reachable, determining that the availability of the first security device meets the set condition; and if the link state is unreachable, determining that the availability of the first security device does not meet the set condition.

[0171] Alternatively, obtaining a routing type identifier of the first security device; if the routing type identifier is a first value, determining that the availability of the first security device meets the set condition; and if the routing type identifier is a second value, determining that the availability of the first security device does not meet the set condition; wherein the first value represents a routing type combining segment routing and network label, and the second value represents a routing type of segment routing.

[0172] Alternatively, obtaining a link state and a routing type identifier of the first security device; if the link state is reachable and the routing type identifier is the first value, determining that the availability of the first security device meets the set condition; and if the link state is unreachable and / or the routing type identifier is the second value, determining that the availability of the first security device does not meet the set condition.

[0173] In one example, if the network device serves as a head node, the obtaining module 51 is further configured to obtain a third data message, wherein the third data message comprises a segment routing tunnel header and a first inner layer message.

[0174] The processing module 52 is further configured to determine a target routing type corresponding to IP address information of the first inner-layer packet, and if the target routing type is a routing type combining segment routing and network label, acquire the primary path and the backup path corresponding to the IP address information; add the primary path and the backup path in a segment routing tunnel header of the third data packet, modify a routing type field in the segment routing tunnel header to a first value, and obtain the first data packet.

[0175] The sending module 53 is further configured to send the first data packet to an intermediate node.

[0176] Based on the same application concept as the above method, the embodiment of the present application proposes a network device, as shown in FIG. 6, which comprises a processor 61 and a machine readable storage medium 62, the machine readable storage medium 62 stores machine executable instructions which can be executed by the processor 61; the processor 61 is configured to execute the machine executable instructions to implement the packet processing method disclosed in the above examples of the present application.

[0177] In one example, the processor 61 can include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 61 can be implemented in at least one of a hardware form of a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), and a PLA (Programmable Logic Array).

[0178] The processor 61 can also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a CPU (Central Processing Unit). The coprocessor is a low-power processor for processing data in a standby state.

[0179] In some embodiments, the processor 61 can be integrated with a GPU (Graphics Processing Unit) which is responsible for rendering and drawing the content required to be displayed on the display screen.

[0180] In one example, the network device can also optionally include a peripheral device interface 63 and at least one peripheral device. The processor 61 and the peripheral device interface 63 can be connected through a bus or a signal line. Each peripheral device can be connected to the peripheral device interface 63 through a bus, a signal line or a circuit board. For example, the peripheral device can include at least one of a radio frequency circuit 64 and a power supply 65.

[0181] The radio frequency circuit 64 is configured to receive and send RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 64 communicates with communication networks and other communication devices through electromagnetic signals. The radio frequency circuit 64 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals into electrical signals. Optionally, the radio frequency circuit 64 can include an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a user identity module card, and the like.

[0182] The radio frequency circuit 64 can communicate with user equipment through at least one wireless communication protocol. The wireless communication protocol includes but is not limited to the World Wide Web, a metropolitan area network, an intranet, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network, and / or a WiFi (Wireless Fidelity) network.

[0183] The power supply 65 is configured to supply power to various components in the electronic device. The power supply 65 can be an alternating current, a direct current, a disposable battery, or a rechargeable battery, and the type of the power supply 65 is not limited.

[0184] Based on the same application concept as the above method, the embodiments of the present application also provide a machine readable storage medium, wherein the machine readable storage medium stores a plurality of computer instructions, and the computer instructions are executed by a processor to implement the packet processing method disclosed in the above examples of the present application.

[0185] The machine readable storage medium can be any electronic, magnetic, optical, or other physical storage apparatus, and can contain or store information such as executable instructions, data, and the like. For example, the machine readable storage medium can be a RAM (Radom Access Memory), a volatile memory, a non-volatile memory, a flash memory, a storage drive (such as a hard disk drive), a solid state disk, any type of storage disk (such as an optical disk, a DVD, and the like), or similar storage medium, or a combination thereof.

[0186] Based on the same application concept as the above method, the embodiments of the present application also provide a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the above packet processing method.

[0187] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer-readable program code thereon for use by a computer or an instruction execution system. Program code embodied on a computer-usable storage medium can be transmitted using any

[0188] The above description is embodied only by the embodiments of the present application, and is not intended to limit the present application. Various modifications and changes can be made by those skilled in the art to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A method of processing a packet, the method comprising: The method is applied to a network device and comprises the following steps: Obtaining a first data packet, wherein the first data packet comprises a segment routing tunnel header and a first inner layer packet, the segment routing tunnel header comprises a main path, and the main path comprises first device information of a first security device corresponding to security detection required by the first data packet; Obtaining a first network label corresponding to the first device information comprised by the main path; Sending a second inner layer packet corresponding to the first inner layer packet to the first security device based on the first network label, so that the first security device performs security detection processing on the received second inner layer packet based on the first network label; If a third inner layer packet returned by a last first security device of the main path is received, then a segment routing tunnel header of the main path is removed from the third inner layer packet based on the third inner layer packet, and a second data packet is obtained; Sending the second data packet based on the segment routing tunnel header of the second data packet.

2. The method of claim 1, wherein, If the main path comprises first device information of a plurality of first security devices, then the step of sending the second inner layer packet corresponding to the first inner layer packet to the first security device based on the first network label comprises the following steps: Obtaining a first information mapping table corresponding to the main path, wherein the first information mapping table comprises first network labels corresponding to the first device information of the plurality of first security devices; Iterating each first network label in the first information mapping table in sequence; For a current network label iterated, adding the current network label to the first inner layer packet to obtain a second inner layer packet, and sending the second inner layer packet to the first security device; If a third inner layer packet returned by the first security device is received, then determining whether a network label in the third inner layer packet is a last first network label in the first information mapping table; If no, then taking a next first network label of the network label in the third inner layer packet in the first information mapping table as a current network label, and returning to perform the operation of adding the current network label to the first inner layer packet to obtain a second inner layer packet.

3. The method of claim 2, wherein, The order of the plurality of first network labels in the first information mapping table matches the order of the plurality of first device information comprised by the main path.

4. The method of claim 1, wherein, Before the step of obtaining the first network label corresponding to the first device information comprised by the main path, the method further comprises the following steps: Parsing a route type field in the segment routing tunnel header; if the route type field is a first value, then obtaining the first device information comprised by the main path from the segment routing tunnel header; wherein the first value represents a route type of segment routing combined with a network label; After the step of encapsulating the segment routing tunnel header of the main path from the third inner layer packet, the method further comprises the following step: modifying the route type field in the segment routing tunnel header from the first value to a second value, wherein the second value represents a route type of segment routing.

5. The method according to any one of claims 1 to 4, characterized in that, The segment routing tunnel header further comprises a backup path, and the backup path comprises second device information of a second security device corresponding to security detection required by the first data packet. Before acquiring a first network label corresponding to first device information included in the main path, the method further comprises: determining that the main path is available; The method further comprises: if the main path is unavailable and the backup path is available, acquiring a second network label corresponding to second device information included in the backup path; Based on the second network label, a fourth inner layer message corresponding to the first inner layer message is sent to the second security device, so that the second security device performs security detection processing on the received fourth inner layer message based on the second network label; If a fifth inner layer message returned by a last second security device of the backup path is received, a second data message is obtained by encapsulating the segment routing tunnel header from which the main path and the backup path are removed based on the fifth inner layer message.

6. The method of claim 5, wherein, Determining that the main path is available comprises: When the availability state of each first security device in the main path meets a set condition, it is determined that the main path is available; wherein for each first security device, the determination method that the availability state of the first security device meets the set condition is: Acquiring a link state of the first security device; if the link state is reachable, it is determined that the availability state of the first security device meets the set condition; if the link state is unreachable, it is determined that the availability state of the first security device does not meet the set condition; Or, acquiring a routing type identifier of the first security device; if the routing type identifier is a first value, it is determined that the availability state of the first security device meets the set condition; if the routing type identifier is a second value, it is determined that the availability state of the first security device does not meet the set condition; wherein the first value represents a routing type combined with segment routing and network label, and the second value represents a routing type of segment routing; Or, acquiring a link state and a routing type identifier of the first security device; if the link state is reachable and the routing type identifier is the first value, it is determined that the availability state of the first security device meets the set condition; if the link state is unreachable and / or the routing type identifier is the second value, it is determined that the availability state of the first security device does not meet the set condition.

7. The method of claim 5, wherein, The segment routing tunnel header includes a segment routing list, and the segment routing list includes segment routing addresses of each intermediate node between a head node and a tail node; wherein the segment routing list further includes the main path and the backup path, and the main path and the backup path are located in front of each segment routing address.

8. The method of claim 5, wherein, if the network device serves as the head node, the method further comprises: Acquiring a third data message, the third data message including a segment routing tunnel header and a first inner layer message; Determining a target routing type corresponding to IP address information of the first inner layer message, and if the target routing type is a routing type combined with segment routing and network label, acquiring the main path and the backup path corresponding to the IP address information. ​ Add the primary path and the backup path in the segment routing tunnel header of the third data packet, and modify a route type field in the segment routing tunnel header to a first value to obtain the first data packet, and send the first data packet to an intermediate node.

9. A packet processing device, characterized by The application is applied to a network device, and the device comprises: An acquisition module is configured to acquire a first data packet, wherein the first data packet comprises a segment routing tunnel header and a first inner-layer packet, the segment routing tunnel header comprises a primary path, the primary path comprises first device information of a first security device corresponding to security detection required by the first data packet, and the primary path comprises a first network label corresponding to the first device information; A processing module is configured to send a second inner-layer packet corresponding to the first inner-layer packet to the first security device based on the first network label, to perform security detection processing on the received second inner-layer packet by the first security device based on the first network label, and to obtain a second data packet by encapsulating the segment routing tunnel header of the primary path based on a third inner-layer packet returned by a last first security device of the primary path; A sending module is configured to send the second data packet based on a segment routing tunnel header of the second data packet.

10. The apparatus of claim 9, wherein, If the primary path comprises first device information of a plurality of first security devices, the processing module is specifically configured to: acquire a first information mapping table corresponding to the primary path, wherein the first information mapping table comprises first network labels corresponding to the first device information of the plurality of first security devices; sequentially traverse each first network label in the first information mapping table; add a current network label to the first inner-layer packet to obtain a second inner-layer packet, and send the second inner-layer packet to the first security device for the current network label; if a third inner-layer packet returned by the first security device is received, determine whether a network label in the third inner-layer packet is a last first network label in the first information mapping table; if not, traverse a next first network label of the network label in the third inner-layer packet from the first information mapping table as the current network label, and return to perform the operation of adding the current network label to the first inner-layer packet to obtain the second inner-layer packet.

11. The apparatus of claim 9, wherein, The acquisition module is further configured to parse a route type field from the segment routing tunnel header, and acquire first device information included in the primary path from the segment routing tunnel header if the route type field is a first value; wherein the first value represents a route type of segment routing combined with a network label; The processing module is further configured to modify the route type field in the segment routing tunnel header from the first value to a second value after encapsulating the segment routing tunnel header of the primary path based on the third inner-layer packet, wherein the second value represents a route type of segment routing.

12. The device of any one of claims 9-11, wherein, The segment routing tunnel header further includes a backup path, and the backup path includes second device information of a second security device corresponding to security detection required by the first data packet; the processing module is further configured to determine that the main path is available before obtaining a first network label corresponding to first device information included in the main path; The obtaining module is further configured to obtain a second network label corresponding to second device information included in the backup path if the main path is unavailable and the backup path is available; The processing module is further configured to send a fourth inner layer packet corresponding to the first inner layer packet to the second security device based on the second network label, so that the second security device performs security detection processing on the received fourth inner layer packet based on the second network label; If a fifth inner layer packet returned by a last second security device of the backup path is received, a segment routing tunnel header of the main path and the backup path is removed based on the fifth inner layer packet to obtain a second data packet.

13. The apparatus of claim 12, wherein, When the processing module determines that the main path is available, the processing module is specifically configured to determine that the main path is available when an available state of each first security device in the main path meets a set condition; for each first security device, the processing module is specifically configured to: obtain a link state of the first security device; if the link state is reachable, it is determined that the available state of the first security device meets the set condition; if the link state is unreachable, it is determined that the available state of the first security device does not meet the set condition; or, obtain a routing type identifier of the first security device; if the routing type identifier is a first value, it is determined that the available state of the first security device meets the set condition; if the routing type identifier is a second value, it is determined that the available state of the first security device does not meet the set condition; wherein the first value represents a routing type combined with segment routing and network label, and the second value represents a routing type of segment routing; or, obtain a link state and a routing type identifier of the first security device; if the link state is reachable and the routing type identifier is a first value, it is determined that the available state of the first security device meets the set condition; if the link state is unreachable and / or the routing type identifier is a second value, it is determined that the available state of the first security device does not meet the set condition.

14. The apparatus of claim 12, wherein, If the network device is a head-end node, the obtaining module is further configured to obtain a third data packet, and the third data packet includes a segment routing tunnel header and a first inner layer packet; The processing module is further configured to determine a target routing type corresponding to IP address information of the first inner layer packet, and if the target routing type is a routing type combined with segment routing and network label, obtain the main path and the backup path corresponding to the IP address information, and add the primary path and the backup path in a segment routing tunnel header of the third data packet, modify a route type field in the segment routing tunnel header to a first value, and obtain the first data packet; The sending module is further configured to send the first data packet to an intermediate node.

15. A network device, comprising: Comprise: a processor and a machine readable storage medium storing machine executable instructions executable by the processor; The processor is configured to execute the machine executable instructions to implement the method in any one of claims 1-8.

Images