WO2011026344A1

WO2011026344A1 - Method and device for reassembling ip fragment datagrams

Info

Publication number: WO2011026344A1
Application number: PCT/CN2010/072814
Authority: WO
Inventors: 赵丰收; 姚俊; 郭树波; 汪勇; 单丽杰
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-09-03
Filing date: 2010-05-14
Publication date: 2011-03-10
Also published as: CN101645851B; CN101645851A

Abstract

A method and device for complementing the prior IP reassembling process are provided by the present invention, which enable IP fragment datagrams of different virtual private networks (VPNs) to be not influenced by each other when reassembled by adding judgment of which VPN the datagram belongs to for the prior reassembling module. Application of the present invention can avoid the possibility that IP fragment datagrams of different VPNs influence each other when reassembled, supplements the RFC protocol description relating to the IP reassembling process, complements the prior IP reassembling process, and can improve the stability of network equipment and the quality of IP network transmission. The present invention applies to IPv4 and IPv6 reassembling, and is independent to the way how a VPN implements.

Description

Method and device for reorganizing IP fragmented message

The present invention relates to a message reassembly technology, and in particular, to a method and apparatus for reassembling an IP (Internet Protocol) fragmented message. Background technique

IP is the core protocol in the TCP (Transmission Control Protocol) / IP protocol family. All TCP, UDP (User Datagram Protocol), ICMP (Internet Control Message Protocol), and IGMP (Internet Group Management Protocol) data are transmitted in IP datagram format. Data units encapsulated by IP protocol are called IP packets. The lower layer protocol of the IP protocol is the link layer protocol. For most link layer protocols, the length of the data frame that can be transmitted has an upper limit. For example, the maximum length of the Ethernet and 802.3 pairs can be transmitted. And 1492 bytes, this feature of the link layer is called MTU, which is the maximum transmission unit.

If the IP layer has a data packet to be transmitted, and the length of the data is larger than the MTU of the link, the IP layer needs to fragment the IP packet so that the length of each packet is not greater than the link layer. MTU, then can send a message on the link.

At the receiving end, in order to restore the original message sent by the sender, each IP fragment that belongs to the same original "3⁄4 text" must be reassembled and reassembled into a complete "3⁄4 text" and then processed by the upper layer protocol. . The reorganization is usually done by the destination host. However, for the special case, for example, the NAT (Network Address Translation) process needs to recalculate the checksum of the entire packet, and the intermediate nodes such as the router also need to reassemble the fragmented packets.

RFC 791 describes the process of fragmenting and reorganizing ΙΡ·3⁄4 texts. The protocol indicates that the four fields of the IP_ID, the source IP address, the destination IP address, and the protocol number in the IP header are used to identify each fragment belonging to the same original IP packet. If these fields are the same, they are considered to be the same original Multiple packets that are fragmented into the original message need to be reassembled into a single message.

Figure 1 is the basic structure of the reorganization table. In the system initialization phase, the reassembly module first allocates two pieces of memory in the memory, one of which is used to reorganize the table, and the other is used to reorganize the conflict table corresponding to the table. The reassembly table is used to store the necessary information for each fragmented message in the subsequent reorganization process. The information to be saved includes the IP_ID, protocol number, source IP address, and destination IP address. Such a data structure is called a reorganization table. In addition to being able to save the above information, each reorganization table entry needs to store two pointers, respectively pointing to the conflict table entries of the reorganization table, and a "segmented message list". data structure. When the reassembly module searches for the reassembly entry corresponding to each fragmented packet, it performs hash calculation on the four values of IP_ID, protocol number, source IP address, and destination IP address, and hashes the different packets. When they are the same, you need to use conflicting entries (conflicting reorganization entries). The conflict table entries are stored in the same memory as the reorganization table entries. The structure of the conflict table entries is the same as that of the reorganization table entries. In some system implementations, the reorganization table entries and conflict table entries are not distinguished. In the description, the conflict table entry may be directly described as a reorganization table entry. The so-called "segmented message link list" refers to a series of IP fragmented packets of the same characteristics received by the network device. The so-called identical features refer to the four fields of IP_ID, protocol number, source IP address, and destination IP address. the same. In fact, when an IP fragment message is received into a network device, it is already stored in the memory of the network device. The reassembly module only uses the fragmented message link table to divide multiple fragments belonging to the same original IP packet. The essays are linked to complete the reorganization of the essay. Figure 1 shows the reorganization entries, conflicting entries, and fragmented message chain tables mentioned above. In this reorganization table, the reorganization entry 2 and the entry η are used, and each entry is followed by a conflicting entry, and each entry has a pointer to the fragmented message list.

After the IP network has been running for many years, VPN (Virtual Private Network) has emerged. The emergence of VPN has changed the fact that the Internet has changed from the original planar structure to the three-dimensional structure. Since VPNs are isolated from each other, hosts in different VPNs can have The same IP address.

Since the IPv4 (Internet Protocol Version 4) packet does not carry VPN information in the IP header, Moreover, the emergence of IPv4 is much earlier than VPN. Therefore, the reorganization process of IPv4 packets does not take into account the VPN factor. As a result, the reorganization process of IPv4 packets is no longer complete. If the source IP address, the destination IP address, the IP_ID, and the protocol number of the IP fragments sent by the host A1 and the host A2 of the VPN1 and the VPN2 are the same, after the packet arrives at the router R, the reassembly module of the router R does not distinguish. VPN information. Therefore, when the router R reassembles, it will consider that the fragmented packets from host A1 and host A2 belong to the same original IP packet, and the fragmented packets from host A1 and host A2 may be reassembled together. Obviously, this reorganization is a wrong message. Although the IPv6 (Internet Protocol Version 6) protocol appears later than the IPv4 protocol, the reorganization process of IPv6 packets still considers only the contents of the IP header itself, and does not consider VPN. Therefore, the reorganization process of IPv6 packets also has The same problem with the IPv4 reorganization process. Summary of the invention

The object of the present invention is to improve the IP reassembly process in response to the current status of the IP reassembly method, so that IP packets that need to be reassembled in different VPNs are not affected by each other.

In order to solve the above technical problem, the present invention proposes a method for recombining IP fragmented packets, which specifically includes:

Obtain the VPN identifier of the fragmented packet, and combine the IP header information obtained from the fragmented packet to calculate a hash index to determine the reassembly entry corresponding to the fragmented packet, according to the reassembly entry, the VPN identifier, and The IP header information completes the comparison and reorganization of the fragmented packets.

Further, when it is determined that the reassembly entry corresponding to the shard is not used, the method further includes: saving the VPN identifier and the IP header information into the reorganization table entry, and adding the fragment packet In the fragmented packet list of the current reorganization entry, the fragmented message linkage table is used to save the fragment in the same original packet.

Further, when it is determined that the reassembly entry corresponding to the shard is used, the comparison is to receive the VPN identifier and the IP header information and the VPN identifier and the IP header saved in the used reassembly entry. Information is compared. Further, when the comparison result is all matching, the method further includes: adding the fragment packet to the fragment packet list of the corresponding reorganization entry.

Further, the recombining specifically includes: when all the fragments of the same original message are added to the fragmented message list of the corresponding reorganization entry, all the points in the fragmented message list of the current reorganization entry are The pieces of the message are assembled in order to complete the reorganization of the original message.

Further, when the comparison result does not match, the method further includes: determining whether the current reorganization entry has a conflicting entry.

Further, when there is no conflicting entry, the method further includes: newly assigning a conflicting entry, connecting the conflicting table necklace to the back of the currently checked and reorganized entry, and setting a VPN identifier and an IP header of the current fragmented packet. The information is saved to the conflicting table entry.

Further, when there is a conflicting entry, the method further includes: comparing the VPN identifier and the IP header information of the text with the VPN identifier and the IP header information saved in the conflicting entry, and if yes, the current fragment is reported. The file is saved in the fragmented message list of the matched conflicting entry; no, it is newly assigned a conflicting entry, and the VPN identifier and the IP header information are saved to the newly allocated conflicting entry.

Further, the VPN identifier is a VPN_ID, and the IP header information is an IP_ID, a source IP address, a destination IP address, and a protocol number.

The present invention also provides an apparatus for reassembling an IP fragment packet, comprising: an obtaining unit, a calculating determining unit, and a comparing and recombining unit; wherein, the acquiring unit is configured to obtain a VPN identifier and an IP header information of the fragmented packet; a unit, configured to calculate a hash index according to the VPN identifier and the IP header information obtained by the obtaining unit, to determine a recombination entry corresponding to the fragmented packet, and a comparison reorganization unit, configured to: The VPN ID and IP header information are used to compare and assemble the fragmented packets to complete the reorganization of the original packets.

The invention has the following beneficial effects: avoiding the possibility of error and mutual influence of IP fragmentation messages in different VPNs during reassembly, supplementing the description of the RFC protocol reassembly process of IP fragmentation, and perfecting the existing IP reorganization Process, which can improve the stability of network devices and improve the transmission of IP networks. The quality of the transmission. DRAWINGS

Figure 1 is a basic structural diagram of a reorganization table;

2 is a schematic diagram of forwarding processing of fragmented packets in different VPNs on a router after being improved by using the present invention;

3 is a flow chart of an algorithm for implementing the present invention in an embodiment;

4 is a structural diagram of a reassembly module implementing the method. DETAILED DESCRIPTION OF THE INVENTION The present invention will be further described in detail below in conjunction with the drawings and specific embodiments.

Figure 2 shows the situation in which the router device processes fragmented packets in different VPNs after using the IP reassembly procedure of the present invention. As can be seen from the diagram, the reassembly module is also the same as VRF (VPN routing/forwarding). There is a reorganization module in each VPN logically. In fact, there is only one reassembly module in the entire router device, just the original reorganization. The module has undergone a slight change. When judging whether the fragmented packet belongs to the same original packet, in addition to comparing the four fields of IP_ID, source IP address, destination IP address, and protocol number in the IP header, the comparison is also reported. The VPN_ID of the text can only be reassembled if the packets in the same VPN are from the same original message.

For each fragmented packet, before sending it to the reassembly module, the router must obtain the VPN to which the packet belongs, that is, determine the VPN_ID of the packet, and then bring the VPN_ID to the reassembly module. When reassembling the message, the reassembly module first calculates the index of the message in the reassembly table by using the IP_ID, source IP address, destination IP address, and protocol number field in the VPNJD and the IP header of the reassembly module. Locate the corresponding reorganization entry based on the index. Then, the VPN_ID, IP_ID, source IP address, destination IP address, and protocol number of the text are compared with the corresponding five values cached in the reorganization entry, and only when all five values are the same, In order to find the reorganization entry that I belong to. After finding the reorganization entry to which it belongs, the actual reorganization of the message content such as sorting and copying the fragmented message is the same as the previous reorganization process.

The VPNJD is the key to the present invention. Compared with the previous reorganization process, the VPN_ID is added in the present invention to ensure that the fragmented packets under different VPNs do not affect each other.

Specific embodiments of the present invention will be described below by way of an embodiment.

Fig. 3 is a flow chart of the algorithm of the present embodiment, and each step in the algorithm will be described in detail below.

In step 410, the reassembly module receives an IP fragmentation message.

In step 411, the router obtains the VPN to which the packet belongs, that is, the VPN_ID of the packet, and obtains the IP_ID, source IP address, and destination of the packet from the IP header of the current fragmented packet. IP address and protocol number. And use these five values to calculate a hash index to determine the reorganization table entry corresponding to the shard.

In step 412, the hash index calculated in step 411 is used to locate the corresponding entry of the reorganization table, and it is determined whether the entry is still in an unused state. If the reassembly entry has not been used, the current packet is the first fragment of the same original packet, and the process proceeds to step 420; otherwise, the fragment of the same original packet arrives, and the packet is transferred. Step 430.

In step 420, the five values of the VPN_ID, the IP_ID, the source IP address, the destination IP address, and the protocol number of the current packet are saved in the reassembly entry, and the current packet is added to the fragment packet of the current reassembly entry. In the linked list, the reassembly module ends the processing of the current fragmented packet. The fragmented message link table of the reassembly entry is used to save the fragment that has been received in the same original message.

In step 430, the VPN_ID, the IP_ID, the source IP address, the destination IP address, and the protocol number of the packet are respectively compared with the five values saved in the reorganization entry, and then the process proceeds to step 431.

In step 431, the comparison result of step 430 is judged. If the comparison result is all matching, it indicates that the reorganization entry to which the current packet belongs has been found, and the process proceeds to step 440; otherwise, the hash index and the current report of the packet are indicated. The hash index of the text is the same, and the reorganization entry conflicts. Go to step 460. Find conflicting table entries.

In step 440, the current message is added to the fragmented message list of the current reorganization entry, and then proceeds to step 441.

In step 441, it is determined whether all the fragments of the same original message are all aligned. If not all are aligned, the processing procedure of the current packet by the reassembly module ends; otherwise, the process proceeds to step 450.

In step 450, all the fragmented packets in the fragmented packet list of the current reorganization entry are assembled in order, and the reorganization process of the original packet to which the current packet belongs is completed, and the reassembly module processes the current packet. End.

In step 460, it is determined whether the conflict table entry pointer of the current reorganization entry is empty. If the pointer is empty, the current packet is the first fragment of the same original packet that arrives at the reassembly module, and the process proceeds to step 470; otherwise, the fragment of the same original packet arrives, and the process proceeds to step 480. .

In step 470, a conflict entry is newly allocated, and the conflict entry is connected to the reorganization entry checked in step 460, and the process proceeds to step 471.

In step 471, the five values of the VPN_ID, the IP_ID, the source IP address, the destination IP address, and the protocol number of the current packet are saved in the conflicting entry allocated in step 470, and the processing procedure of the current packet is ended by the reassembly module.

In step 480, according to the conflicting entry of the reorganization entry checked in step 460, the next conflicting entry is located, and then proceeds to step 430 to start a new round of comparison operation between the current packet and the content of the conflicting entry. .

The above is the implementation algorithm description of the embodiment, and the algorithm is applicable to both IPv4 packets and IPv6 packets.

Figure 4 is a block diagram of a reconstitution apparatus embodying the method. As shown in FIG. 4, the reorganization device includes: an obtaining unit, configured to acquire a VPN identifier and an IP header information of the fragmented packet;

a calculation determining unit, configured to calculate a hash index according to the VPN identifier and the IP header information acquired by the obtaining unit, to determine a reorganization entry corresponding to the fragmented packet; The comparison and reorganization unit is configured to compare and assemble the fragmented message according to the VPN entry and the IP header information determined by the calculation determining unit, and complete the original message reorganization.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. Within the scope.

Claims

Claim

A method for recombining IP fragmented packets, which is characterized in that: obtaining a VPN identifier of a fragmented packet, and combining the IP header information obtained from the fragmented packet, and calculating a hash index to determine the fragmentation According to the reorganization entry, the VPN identifier and the IP header information, the reorganization entries corresponding to the essays are compared and reorganized.

2. The method according to claim 1, wherein when determining that the reorganization entry corresponding to the fragmentation message is not used, the method further comprises: saving the VPN identifier and the IP header information to the reorganization table. In the item, the fragment packet is added to the fragment packet list of the current reassembly entry, where the fragment packet list is used to save the fragment in the same original packet.

3. The method according to claim 1, wherein when it is determined that the reorganization entry corresponding to the fragmentation message has been used, the comparing is to use the received VPN identifier and IP header information and used. The VPN ID and IP header information saved in the reassembly entry are compared.

The method of claim 3, wherein when the comparison result is all matching, the method further comprises: adding the fragmented message to the fragmented message list of the corresponding recombination entry.

The method according to claim 4, wherein the recombining comprises: when all the fragments of the same original message are added to the fragmented message list of the corresponding reorganization entry, the current reorganization is performed. All the fragmented messages in the fragmented message list of the entry are assembled in order to complete the reorganization of the original text.

The method according to claim 3, wherein when the comparison result does not match, the method further comprises: determining whether the current reorganization entry has a conflicting entry.

The method according to claim 6, wherein when there is no conflicting entry, the method further comprises: newly assigning a conflicting entry, and connecting the conflicting table necklace to the back of the currently checked and reorganized entry, The VPN identifier and the IP header information of the current fragmented packet are saved in the conflicting entry.

The method of claim 6, wherein when the conflicting entry is already present, the method further comprises: re-resetting the VPN identifier and the IP header information of the packet with the VPN label saved in the conflicting entry. If the matching is performed, the current fragmented packet is saved in the fragmented packet list of the matched conflicting entry; otherwise, a conflicting entry is newly allocated, and the VPN identifier and the IP header are saved. Information into the newly assigned conflicting entry.

The method according to any one of claims 1 to 8, wherein the VPN identifier is a VPN_ID, and the IP header information is an IP_ID, a source IP address, a destination IP address, and a protocol number.

10. An apparatus for reassembling an IP fragmented packet, comprising: an obtaining unit, a calculating determining unit, and a comparing and recombining unit; wherein

An obtaining unit, configured to obtain a VPN identifier and an IP header information of the fragmented packet;

a calculation determining unit, configured to calculate a hash index according to the VPN identifier and the IP header information acquired by the obtaining unit, to determine a reorganization entry corresponding to the fragmented packet;

The comparison and reorganization unit is configured to compare and assemble the fragmentation message according to the VPN identifier and the IP header information determined by the calculation determining unit, and complete the original message reorganization.