CN114900458B

CN114900458B - Message forwarding method, device, medium and product

Info

Publication number: CN114900458B
Application number: CN202210289344.3A
Authority: CN
Inventors: 彭小新; 薛蹦蹦; 康达祥; 李嘉; 于兴兴
Original assignee: Alibaba Cloud Computing Ltd
Current assignee: Alibaba Cloud Computing Ltd
Priority date: 2022-03-22
Filing date: 2022-03-22
Publication date: 2024-01-09
Anticipated expiration: 2042-03-22
Also published as: CN114900458A

Abstract

The embodiment of the disclosure discloses a message forwarding method, a device, a medium and a product, wherein the method comprises the following steps: receiving a data message from a first user terminal interface, and decapsulating the data message to obtain a service requirement of the data message, wherein the service requirement is used for indicating network services and service sequences which need to be provided for the data message; arranging a service path according to service requirements to obtain service chain information, wherein the service chain information comprises an external interface address of a service node to be experienced by a data message; encapsulating the service link information in a data message; and sending the data message packaged with the service link information to the first service node according to the external interface address of the first service node in the service link information. The technical scheme can save a large amount of resources, and each service node is provided with an external interface, so that the addresses of the external interfaces are uniformly managed, and the service path is more conveniently arranged for the message.

Description

Message forwarding method, device, medium and product

Technical Field

The embodiment of the disclosure relates to the technical field of communication, in particular to a message forwarding method, message forwarding equipment, a message forwarding medium and a message forwarding product.

Background

In the related art, when a data packet is transmitted in a network, the data packet needs to pass through various service nodes (service nodes) to ensure that the network can provide safe, rapid and stable network services for users according to design requirements. These service nodes are typically firewalls, load balancing, intrusion detection, etc. The network traffic is passed through these service nodes in the order defined by the service logic, the so-called service chain. The existing service chain implementation mode is that a global arrangement layer is arranged in a service node, and is responsible for distribution management of SIDs (Segment IDs), route release, traffic passing among cross-VPCs and the like, the control plane scheme is complex, and the service node is connected in series by XNI (cross network interface) when crossing the VPCs, and the arrangement is complex.

Disclosure of Invention

The embodiment of the disclosure provides a message forwarding method, device, medium and product.

In a first aspect, an embodiment of the present disclosure provides a method for forwarding a packet.

Specifically, the message forwarding method is applied to an orchestration node, and comprises the following steps:

receiving a data message from a first user terminal interface, and decapsulating the data message to obtain a service requirement of the data message, wherein the service requirement is used for indicating network service and service sequence which need to be provided for the data message;

Arranging a service path according to the service requirement to obtain service chain information, wherein the service chain information comprises an external interface address of a service node to be experienced by the data message;

encapsulating the service link information in the data message;

and sending the data message packaged with the service link information to the first service node according to the external interface address of the first service node in the service link information.

With reference to the first aspect, in a first implementation manner of the first aspect, the method further includes:

unpacking the data message to obtain tenant information of the data message;

and when the service link information is packaged, the tenant information is packaged in the data message.

In a second aspect, an embodiment of the present disclosure provides a method for forwarding a packet,

specifically, the message forwarding method is applied to the service node and comprises the following steps:

receiving a data message from an external interface, and decapsulating the data message to obtain service chain information, wherein the service chain information comprises an external interface address of a service node to be experienced by the data message;

judging whether the service node is a tail service node or not based on the service chain information;

And responding to the service node serving as a tail service node, and forwarding the data message to a user terminal from a second user terminal interface corresponding to the tail service node.

With reference to the second aspect, in a first implementation manner of the second aspect, the method further includes:

judging whether the service node is provided with a mounting service node or not according to the fact that the service node is not a tail service node;

in response to the fact that the mounting service node does not exist in the service node, after the data message is processed based on the service provided by the service node, the service chain information is packaged in the processed data message;

and sending the data message packaged with the service chain information to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information.

With reference to the second aspect and the first implementation manner, in a second implementation manner of the second aspect, the method further includes:

responding to the existence of the mounting service node of the service node, caching the service chain information in the service node, and forwarding the data message to the mounting service node;

Receiving the message processed by the mounting service node, and encapsulating the service chain information in the message processed by the mounting service node;

and sending the message packaged with the service chain information to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information.

With reference to the second aspect and the foregoing various implementations, in a third implementation of the second aspect, the method further includes: and when the service link information is packaged, the tenant information of the data message is packaged in the data message.

With reference to the second aspect and the foregoing various implementation manners, in a fourth implementation manner of the second aspect, the sending, according to an external interface address of a next-hop service node of the service node in the service chain information, a message with the message header encapsulated to the next-hop service node includes:

determining whether the next hop service node and the service node are located in the same physical node;

when the next-hop service node and the service node are located in the same physical node, sending the message with the message header packaged to the next-hop service node in the same physical node according to the external interface address of the next-hop service node of the service node in the service chain information;

And when the next-hop service node and the service node are positioned in different physical nodes, sending the message with the message header packaged to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information among different physical nodes.

In a third aspect, an embodiment of the present disclosure provides a method for forwarding a packet.

Specifically, the message forwarding method includes:

the orchestration node performs the steps of the method according to the first aspect;

the service node performs the steps of the method according to the second aspect.

In a fourth aspect, in an embodiment of the present disclosure, a packet forwarding device is provided.

Specifically, the message forwarding device includes:

the first decapsulation module is configured to receive a data message from a first user terminal interface, decapsulate the data message, and obtain a service requirement of the data message, wherein the service requirement is used for indicating network services and service sequences which need to be provided for the data message;

the path arrangement module is configured to arrange a service path according to the service requirement to obtain service chain information, wherein the service chain information comprises an external interface address of a service node to be experienced by the data message;

The first encapsulation module is configured to encapsulate the service link information in the data message;

the first sending module is configured to send the data message packaged with the service link information to the first service node according to the external interface address of the first service node in the service link information.

With reference to the fourth aspect, in a first implementation manner of the fourth aspect, the apparatus further includes:

the first decapsulation module is further configured to decapsulate the data message to obtain tenant information of the data message;

the first encapsulation module is further configured to encapsulate the tenant information in the data packet when encapsulating the service link information.

With reference to the fourth aspect and the first implementation manner thereof, in a second implementation manner of the fourth aspect, the data packet encapsulated with the service link information includes a segment routing internet protocol version 6 Srv6 packet, and the service link information and the tenant information are encapsulated in a segment routing header SRH of the Srv6 packet.

In a fifth aspect, embodiments of the present disclosure provide a packet forwarding device,

specifically, the message forwarding device comprises:

The second decapsulation module is configured to receive the data message from the external interface, decapsulate the data message, and obtain service chain information, wherein the service chain information comprises an external interface address of a service node to be experienced by the data message;

the first judging module is configured to judge whether the service node is a tail service node or not based on the service chain information;

and the second sending module is configured to respond to the service node serving as a tail service node and forward the data message to a user terminal from a second user terminal interface corresponding to the tail service node.

With reference to the fifth aspect, in a first implementation manner of the fifth aspect, the apparatus further includes:

the second judging module is configured to respond to the fact that the service node is not the tail service node and judge whether the mounting service node exists in the service node or not;

the second encapsulation module is configured to encapsulate the service chain information in the processed data message after processing the data message based on the service provided by the service node in response to the fact that the mounting service node does not exist in the service node;

and the third sending module is configured to send the data message packaged with the service chain information to the next-hop service node according to the external interface address of the next-hop service node of the service chain information.

With reference to the fifth aspect and the first implementation manner, in a second implementation manner of the fifth aspect, the present disclosure further includes:

the fourth sending module is configured to respond to the existence of the mounting service node of the service node, buffer the service chain information in the service node and forward the data message to the mounting service node;

the receiving module is configured to receive the message processed by the mounting service node and package the service chain information in the message processed by the mounting service node;

and the fifth sending module is configured to send the message packaged with the service chain information to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information.

With reference to the fifth aspect and the foregoing various implementation manners, in a third implementation manner of the fifth aspect, the disclosure further includes a second encapsulation module configured to encapsulate tenant information of the data packet in the data packet when encapsulating the service link information.

With reference to the fifth aspect and the foregoing various implementations, in a fourth implementation of the fifth aspect, the third sending module is further configured to:

In a sixth aspect, a packet forwarding system is provided in an embodiment of the present disclosure.

Specifically, the message forwarding system includes: an orchestration node and a service node;

the orchestration node is configured to perform the steps in the method of the first aspect;

the service node is configured to perform the steps of the method of the second aspect.

In a seventh aspect, embodiments of the present disclosure provide an electronic device comprising a memory for storing one or more computer instructions for supporting the above apparatus to perform the above method, and a processor configured to execute the computer instructions stored in the memory.

In an eighth aspect, embodiments of the present disclosure provide a computer-readable storage medium having stored thereon computer instructions which, when executed by a processor, implement the method steps of any of the above aspects.

In a ninth aspect, embodiments of the present disclosure provide a computer program product comprising a computer program/instructions which, when executed by a processor, implement the method steps of any of the above aspects.

The technical scheme provided by the embodiment of the disclosure can comprise the following beneficial effects:

according to the technical scheme, the unique externally exposed external interface can be configured for each service node, an independent arrangement node is used, when the arrangement node receives the data message from the first user terminal interface, a service path can be arranged for the data message according to the service requirement in the data message, service chain information is obtained, the service chain information comprises the external interface address of the service node to be experienced by the data message, the service chain information is encapsulated in the data message and is sent to the first service node in the service path, so that the subsequent service node only needs to transmit according to the service chain information, an arrangement layer is not required to be arranged for transmitting control management of each server node, the control surface is weakened, SID management is omitted, logic such as complex SID management, distribution, route release and the like is avoided, and a large amount of resources are saved; each service node only exposes one external interface to the outside, and when the service path is arranged, the next hop is only required to arrange the corresponding external interface for which service node, and compared with the prior art that XNI serial connection is adopted between any two service nodes, the arrangement of the service path is more convenient.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of embodiments of the disclosure.

Drawings

Other features, objects and advantages of the embodiments of the present disclosure will become more apparent from the following detailed description of non-limiting embodiments, taken in conjunction with the accompanying drawings. In the drawings:

FIG. 1 illustrates a flow chart of a message forwarding method applied to an orchestration node according to one embodiment of the present disclosure;

fig. 2 shows a flow chart of a message forwarding method applied to a service node according to an embodiment of the present disclosure;

FIG. 3 is a flow diagram illustrating an overall process of a message forwarding method according to one embodiment of the present disclosure;

FIG. 4 illustrates a system architecture scenario diagram of message forwarding according to one embodiment of the present disclosure;

fig. 5 shows a block diagram of a message forwarding apparatus applied to an orchestration node according to one embodiment of the present disclosure;

fig. 6 is a block diagram illustrating a message forwarding apparatus applied to a service node according to an embodiment of the present disclosure;

fig. 7 shows a block diagram of a message forwarding system according to an embodiment of the present disclosure;

FIG. 8 shows a block diagram of an electronic device according to an embodiment of the present disclosure;

Fig. 9 is a schematic diagram of a computer system suitable for use in implementing the method according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, exemplary implementations of the embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, portions irrelevant to description of the exemplary embodiments are omitted in the drawings.

In the presently disclosed embodiments, it is to be understood that the terms such as "comprises" or "comprising" and the like are intended to indicate the presence of features, numbers, steps, acts, components, portions, or combinations thereof disclosed in the present specification, and are not intended to exclude the possibility of one or more other features, numbers, steps, acts, components, portions, or combinations thereof being present or added.

In addition, it should be noted that, without conflict, the embodiments of the present disclosure and features of the embodiments may be combined with each other. Embodiments of the present disclosure will be described in detail below with reference to the attached drawings in conjunction with the embodiments.

In the related art, the data packets need to pass through various service nodes (service nodes) when they are transmitted in the network, so as to ensure that the network can provide safe, fast and stable network services to users according to the design requirements. These service nodes are typically firewalls, load balancing, intrusion detection, etc. The network traffic is passed through these service nodes in the order defined by the service logic, the so-called service chain. Currently, there is a service chain implementation manner that a global arrangement layer is set, which is responsible for SID allocation management, route distribution, traffic opening between VPCs, etc., and the control plane scheme is complex, service nodes are connected in series by XNI (cross network interface, internet interface) when crossing VPCs, and if there is a service node A, B, C, D, the service nodes are connected in series by XNI, when there is a service node XNI1, a service node a and a service node C are connected in series by XNI, a service node a and a service node D are connected in series by XNI, a service node B and a service node C are connected in series by XNI, a service node B and a service node D are connected in series by XNI, a service node C and a service node D are connected in series by XNI6, and 6 service nodes are connected in series by XNI.

In view of the above problems, the present disclosure proposes a message forwarding, where a unique external interface exposed to the outside may be configured for each service node, and an independent arrangement node is used, where when the arrangement node receives a data message from a first user terminal interface, a service path may be arranged for the data message according to a service requirement in the data message to obtain service chain information, where the service chain information includes an external interface address of a service node to be experienced by the data message, and the service chain information is encapsulated in the data message and sent to a first service node in the service path, so that a subsequent service node only needs to forward according to the service chain information, and no arrangement layer is required to perform control management for forwarding for each server node, where a control plane is weakened, no SID management is provided, complex logic such as SID management, allocation, route distribution is avoided, and a large number of resources are saved; each service node only exposes one external interface to the outside, if only the external interfaces A, B, C and D are configured for the service node A, B, C, D, when the service path is arranged, the next hop only needs to arrange the corresponding external interface for which service node, and compared with the prior art that XNI serial connection is adopted between two service nodes, the arrangement of the service path is more convenient.

Fig. 1 shows a flowchart of a message forwarding method applied to an orchestration node according to an embodiment of the present disclosure, as shown in fig. 1, the message forwarding method includes the following steps S101-S104:

in step S101, a data packet is received from a first user interface, the data packet is unpacked, and a service requirement of the data packet is obtained, where the service requirement is used to indicate a network service and a service sequence that need to be provided for the data packet;

in step S102, a service path is arranged according to the service requirement, so as to obtain service chain information, where the service chain information includes an external interface address of a service node to be experienced by the data packet;

in step S103, the service link information is encapsulated in the data packet;

in step S104, according to the external interface address of the first service node in the service link information, the data packet encapsulated with the service link information is sent to the first service node.

In an embodiment of the present disclosure, the method for forwarding a packet may be applicable to a cloud network, such as an NFV (Network Functions Virtualization, network function virtualization) network, and may be performed by an orchestration node in the cloud network, where the orchestration node belongs to an independent VPC (Virtual Private Cloud ) in the cloud network. It should be noted here that the node described in this disclosure may be a VPC.

In an embodiment of the present disclosure, the first client interface is UNI (user network interface ), which refers to a cross-VPC binding interface between a client VPC and a network VPC, for carrying user traffic, the client VPC refers to a client node, the network VPC refers to a node on the network side, the network VPC may be an orchestration node here, and the client node may send a data packet to the orchestration node through the first client interface.

In an embodiment of the present disclosure, when an orchestration node receives a data packet from a first user interface, the data packet may be unpacked to obtain a service requirement in the data packet, where the service requirement is used to indicate a network service and a service sequence that need to be provided for the data packet, and the orchestration node may orchestrate a service path for the data packet based on the service requirement, where the service path refers to a service node and a sequence that need to be passed by the data packet, and if the service requirement of the data packet is that the network service needs to be performed in sequence, the network service may be a load balancing service and a firewall service, the orchestration node may orchestrate a service path for the data packet to be a service node and a firewall service node that sequentially pass by the load balancing service.

In an embodiment of the present disclosure, each service node in the network may be configured with a unique external interface exposed to the outside, for example, may be a SYS (system) binding (binding) ENI (Elastic Network Interface, elastic network card) interface, where the ENI refers to an elastic network interface binding cloud service nodes in a cloud network. The address of each service node may be disposed on the external interface corresponding to the service node as an external interface address, and for example, the IPv6 (Internet Protocol Version, internet protocol version 6) address of each service node may be disposed on the SYS bonding ENI interface as an external interface address.

In an embodiment of the present disclosure, after the arranging node arranges the service path for the data packet, service chain information may be formed based on an external interface address of the service node on the service path, where the service chain information is used to indicate a next hop address for the service node.

In an embodiment of the present disclosure, after obtaining the service chain information, the orchestration node may send the service chain information to the first service node in the service path after encapsulating the service chain information in the data packet.

In an embodiment of the present disclosure, the data packets generally include a header and data to be transmitted, where decapsulating and encapsulating refer to decapsulating and encapsulating the header, and by way of example, the orchestration node receives the data packet from the first client interface as a VLAN (Virtual Local Area Network ) _uni header, at which time the orchestration node may decapsulate the VLAN-UNI header to obtain the service requirement. When the service link information is encapsulated, the message needs to be encapsulated into an Srv6 message, the service link information may be encapsulated in an Srv6 (Segment Routing IPv, segment routing IPv 6) header of the Srv6 message, the Srv6 header includes an IPv6 header and an SRH (Segment Routing Header, SR header), and the service link information may be encapsulated in the SRH.

In an embodiment of the present disclosure, after the service chain information is encapsulated, the orchestration node may send the data packet encapsulated with the service chain information to the first service node in the service path, so that the subsequent service node only needs to forward according to the service chain information in the next hop, and does not need to set an orchestration layer to perform control management of forwarding for each server node, so that the control plane is weakened, no SID management exists, complex logic such as SID management, allocation, route release, and the like is avoided, and a large amount of resources are saved; each service node only exposes one external interface to the outside, only the external interfaces A, B, C and D are required to be configured for the service node A, B, C, D, when the service path is arranged, the next hop is only required to arrange the corresponding external interface for which the service node is, and XNI serial connection is adopted between the two existing service nodes, so that the arrangement of the service path is more convenient. In addition, the embodiment configures an independent external interface for each service node, supports the service chain arrangement capability in a multi-cloud scene, carries service chain information in the forwarding process, and supports service chain information forwarding with a state.

In a possible implementation manner, the above message forwarding method may further include the following steps:

unpacking the data message to obtain tenant information of the data message;

In this embodiment, the data packet further carries tenant information, and when the orchestration node receives the data packet from the first user terminal interface and unpacks the data packet, the orchestration node also obtains the tenant information of the data packet, and when the orchestration node packages the service link information, the orchestration node can package the tenant information in the data packet, so as to realize multi-tenant requirements and support multi-tenant.

The data packet in which the service link information is encapsulated includes a Srv6 packet, the service link information and the tenant information are encapsulated in a segment routing packet header SRH of the Srv6 packet, which may be illustrated by encapsulating the tenant information in a last 64bit metadata (metadata) of the SRH in the Srv6 packet header, where the last 64bit metadata information of the SRH is tenant information.

Fig. 2 shows a flowchart of a message forwarding method applied to a service node according to an embodiment of the present disclosure, as shown in fig. 2, the message forwarding method includes the following steps S201 to S203:

In step S201, a data packet is received from an external interface, the data packet is unpacked, and the service chain information is obtained, where the service chain information includes an external interface address of a service node to be experienced by the data packet;

in step S202, it is determined whether the service node is a tail service node based on the service chain information;

in step S203, in response to the present service node being a tail service node, the data packet is forwarded to a user terminal from a second user terminal interface corresponding to the tail service node.

In an embodiment of the present disclosure, the packet forwarding method may be applicable to a cloud network, such as an NFV (Network Functions Virtualization, network function virtualization) network, and may be performed by a service node in the cloud network, where the service node belongs to a VPC that may provide various services for a data packet of a user, and in an NFV network, for example, the service node may be a service node such as an ALB (Application Load Balancer, application load balancing) VPC, an NLB (Network Load Balance, network load balancing) VPC, a GWLB (GateWay Load Balance, gateway load balancing) VPC, a NAT (Network Address Translation, network address conversion) VPC, a FW (Firewall) VPC, or the like.

In an embodiment of the present disclosure, the orchestration node may send the data packet with the service link information encapsulated to the first service node based on the external interface address of the first service node in the service chain information, and after the first service node serves the data packet, the orchestration node may continue to send the data packet with the service link information encapsulated to the next service node of the first service node according to the external interface address of the next service node in the service chain information, so that the data packet may be sequentially transmitted to each service node according to the order on the service chain information, and corresponding network services are used.

In an embodiment of the disclosure, the service node may receive a data packet from an external interface exposed only to the outside of the service node, and decapsulate a header of the data packet, such as a Srv6 header, to obtain service chain information, where the service chain information includes an external interface address of the service node to be experienced by the data packet; the service node can judge whether the service node is a tail service node based on the service chain information, wherein the tail service node refers to the last service node in the service path. If the service node is not the tail service node, the service chain information is continuously packaged in the data message and forwarded to the next service node of the service node after the corresponding service can be provided for the data message. If the service node is a tail service node, the service node may find a second user interface between an external interface of the service node and the second user end, and then forward the data packet to the user end through the second user interface, where the second user interface is a UNI interface, the first user interface is a source user interface, the second user interface is a destination user interface, and the second user interface and the first user interface may be the same user interface or different user interfaces, which is not limited herein.

For example, in the Srv6 packet set by the service chain information, two key information are set in the Srv6 packet header, and firstly, segments List (Segment List) of an external interface address, such as an IPv6 address, are orderly arranged to form a service path of the service chain, and another key field is Segment Left (SL), where Segment Left is a pointer indicating the currently active Segment List. The minimum value of Segment Left is 0, the maximum value is the number of Segment lists minus 1, assuming that the service chain information includes IPv6 address 1, IPv6 address 2, and IPv6 address 3 in order, the number of Segment lists is 3, the maximum value of SL is 2, the minimum value is 0, and the Segment List includes Segment List [2]: IPv6 address 1; segment List [1]: IPv6 address 2; segment List [0]: IPv6 address 3; when the service node receives the data message and obtains sl=2, the service node indicates that the external interface address of the service node is Segment List [2]: after processing the data packet based on the service provided by the service node, the IPv6 address 1 may perform a 1 reduction operation on the SL, and offset the pointer to the next-hop address Segment List [1]: and the IPv6 address 2 can then forward the data message to the next node, namely the service node corresponding to the IPv6 address 2. Therefore, after the service node decapsulates the Srv6 header, the service node may determine whether the message is a tail service node based on the SL in the Srv6 header, if the SL is not 0, it indicates that the service node is not a tail service node, and if the SL is 0, it indicates that the service node is a tail service node.

In a possible implementation manner of the present disclosure, the foregoing method for forwarding a packet further includes:

In this embodiment, if the service node is not a tail service node, it needs to be determined whether the service node has a mount service node, where the mount service node refers to another service node that is accessed to the service node, and other services may be added to the service node.

In this embodiment, if the service node does not have a mounting service node, the service node may process the data packet based on the service provided by the service node, and encapsulate a corresponding SRv packet header for the processed packet, where the SRv packet header carries service chain information; and then, the message with the message header packaged is sent to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information.

In this embodiment, if the service node has an mount service node, the service node needs to cache the service chain information in the service node, process the data packet based on the service provided by the service node, forward the data packet to the mount service node for processing, and return the packet processed by the mount service node after the processing of the mount service node, where the service node may package the cached service chain information in the packet processed by the mount service node, and then send the packet packaged with the service chain information to the next hop service node according to the external interface address of the next hop service node in the service chain information.

For example, the message forwarding is performed between the present service node and the mounted service node through a network side interface, such as NNI (Network to Network Interface, network node interface), where the NNI interface is a cross-VPC Bonding ENI interface between network side VPCs, and the present service node is mounted on the mounted service node through NNI, for example, a GWLB service node may be mounted on a fire wall service node through NNI. When the service node forwards the data message to the mounting service node, the VLAN-UNI+IPv4+UDP (User Datagram Protocol ) +GENEVE (Generic Network Virtualization Encapsulation, network virtualization base protocol) message header can be encapsulated for the data message, then the service node can send the data message to the mounting service node through NNI interface between the service node and the mounting service node, the mounting service node processes the data message based on the service provided by the mounting service node and returns the processed data message to the service node, and the service node encapsulates the cached service chain information in Srv6 (Segment Routing IPv6 ) message header and sends the data message to the next hop service node of the service node.

The message forwarding method provided by the embodiment can realize transparent access of the third party network element or other mounting service nodes, for example, FW service nodes (which can be a firewall of a third party or a firewall of a local party) can be hung under NAT service nodes, firewall capacity is increased, the added firewall can be directly used by the data message sent by a user side after passing through the NAT service nodes, services can be additionally arranged under the non-sensing state of the user, seamless switching capacities such as product combination, upgrading, configuration reduction, change and the like are realized, and ecology improvement can be integrated with the third party service network element. In the case of multi-service orchestration, SR techniques may be used to orchestrate a service chain formed by multiple service nodes in series to provide the service. The routing drainage configuration is simplified, and only the arrangement node is needed to arrange different services according to the external interfaces of the service nodes, so that complex routing configuration is avoided. In addition, the service node in the present disclosure does not need to have routing decision capability, and can be a common service node or a traffic analysis service node, and only needs to forward according to the path arranged by the arranging node.

In a possible implementation manner of the present disclosure, the foregoing method for forwarding a packet further includes the following steps:

and when the service link information is packaged, the tenant information of the data message is packaged in the data message.

In this embodiment, the data packet further carries tenant information, and when the service node receives the data packet from the external interface and unpacks the data packet, the service node also obtains the tenant information of the data packet from the header.

The data packet in which the service link information is encapsulated includes a Srv6 packet, the service link information and the tenant information are encapsulated in a segment routing packet header SRH of the Srv6 packet, which may be illustrated by encapsulating the tenant information in a last 64bit metadata (metadata) of the SRH in the Srv6 packet header, where the last 64bit metadata information in the Srv6 packet header is tenant information.

In one possible implementation manner of the present disclosure, the sending, according to the external interface address of the next hop service node of the present service node in the service chain information, the message with the message header encapsulated to the next hop service node includes:

In this embodiment, the physical node is a physical machine that operates independently and has its own computing, storing and network capabilities, the service node is a virtual node that operates on the physical node, each physical node may operate one or more service nodes, and if the next-hop service node and the present service node are located in the same physical node, the packet with the packet header may be sent to the next-hop service node in the same physical node according to the external interface address of the next-hop service node of the present service node in the service chain information; the method does not need to return to the physical node after being sent out from the physical node, saves the forwarding time and improves the forwarding efficiency. When the next-hop service node and the service node are located in different physical nodes, the message with the message header packaged is sent to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information after the physical node where the next-hop service node is located is sent from the service node.

Fig. 3 is a schematic overall flow diagram of a message forwarding method according to an embodiment of the present disclosure. The method is applied to a system configured with orchestration nodes and service nodes, as shown in fig. 3, and may comprise the steps of:

in step S301, an orchestration node receives a data packet from a first user terminal interface, unpacks the data packet to obtain a service requirement of the data packet, orchestrates a service path according to the service requirement to obtain service link information, and packages the service link information in the data packet; and sending the data message packaged with the service link information to the first service node according to the external interface address of the first service node in the service link information.

In step S302, a service node receives a data packet sent by the orchestration node or other service nodes from an external interface, and decapsulates the data packet to obtain service chain information, where the service chain information includes an external interface address of the service node to be experienced by the data packet; judging whether the service node is a tail service node or not based on the service chain information; the service node is a tail service node, the data message is forwarded to a user side from a second user side interface corresponding to the tail service node, and the service chain information is packaged in the processed data message after the data message is processed based on the service provided by the service node in response to the service node not being the tail service node; and sending the data message packaged with the service chain information to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information.

In an embodiment of the disclosure, the service requirement is used to indicate a network service and a service sequence that need to be provided for the data packet; the service chain information comprises an external interface address of a service node to be experienced by the data message.

In one possible implementation manner of the present disclosure, the foregoing packet forwarding method further includes the following steps:

In one possible embodiment of the disclosure, the method further comprises:

The message forwarding method in this embodiment corresponds to the foregoing message forwarding method, and specific details may be referred to the description of the foregoing message forwarding method, which is not repeated herein.

Fig. 4 is a schematic diagram illustrating a system architecture scenario of packet forwarding according to an embodiment of the present disclosure, as shown in fig. 4, where the forwarding system includes a source user node, an orchestration node, a service node 1, a service node 2, a mounted service node 3 suspended on the service node 2, a service node 4, and a destination user node, where the nodes are VPCs in the NFV network. Data forwarding is performed between the user node and each node on the network side, such as an orchestration node or a service node, through an interface 1, namely a UNI interface, each service node is configured with a unique external interface, namely a SYS bonding end interface, message forwarding is performed between the two service nodes through respective SYS bonding end interfaces, and message forwarding is performed between the service node and the service node connected with the service node through an interface 2 across VPC, namely an NNI interface.

As shown in fig. 4, a source user node sends a vlan_uni data packet to an orchestration node through a UNI interface, the orchestration node unpacks the vlan_uni packet header to obtain the service requirement and tenant information, the service requirement is used to indicate that a network service required to be provided for the data packet is a service provided by a service node 1 and a service provided by a service node 2 in turn, the orchestration node may orchestrate a service path for the data packet based on the service requirement into a service node 1→a service node 2→a service node 4, to obtain a SYS bonding end interface address IPv6 address 1 of the service node 1 and a SYS bonding end interface address IPv6 address 2 of the service node 2, and the orchestration node may encapsulate the service chain information in an SRH in the Srv6 packet header, where the encapsulated information is: sl=2, segment List [2]: IPv6 address 1, segment List [1]: IPv6 address 2, segment List [0]: IPv6 address 3, i.e., pointer sl=, 2 indicates that the SYS bonding entry interface address of the next hop is Segment List [2]: IPv6 address 1. The arranging node may send the Srv6 packet with the Srv6 packet header encapsulated to the service node 1 corresponding to the IPv6 address 1, after the service node 1 receives the Srv6 packet, decapsulate the Srv6 packet header to obtain SL as 2, which indicates that the service node 1 is not a tail service node, at this time, the service node 1 determines whether the service node has a mounted service node, and since the service node does not have a mounted service node, the service node 1 processes the data packet based on the service provided by the service node, after subtracting 1 from SL, encapsulates the SL and the Segment List as service chain information in the Srv6 packet header, and sends the service chain information to a pointer sl=1 to indicate that the SYS binding entry interface address of the next hop is Segment List [1]: after receiving the Srv6 message, the service node 2 decapsulates the Srv6 message header to obtain 1 SL, which indicates that the service node is not a tail service node, at this time, the service node 2 determines whether a mount service node exists in the service node, and since the mount service node 3 is attached to the service node, the service node 2 needs to buffer the information of the service chain information, i.e., the SRH message header, in the service node, after processing the data message based on the service provided by the service node, packages VLAN-uni+ipv4+udp+geneve message header for the data message, and forwards the data message to the mount service node 3 for processing through NNI interface, after processing by the mount service node 3, returns the message processed by the mount service node 3 through NNI interface, and after subtracting 1 SL from the mount service node 3, the service chain information, encapsulates the SL and the Segment as service chain information List in the Srv6 message header, and sends the Segment List to the Segment List as a skip List address=0:: after receiving the Srv6 message, the service node 4 decapsulates the Srv6 message header to obtain an SL of 4, which indicates that the service node 4 is a tail service node, and at this time, a UNI interface between the service node 4 and a destination user node may be searched, and then the data message is forwarded to the destination user node through the UNI interface.

The following are device embodiments of the present disclosure that may be used to perform method embodiments of the present disclosure.

Fig. 5 shows a block diagram of a message forwarding apparatus applied to an orchestration node according to one embodiment of the present disclosure, which may be implemented as part or all of an electronic device through software, hardware, or a combination of both. As shown in fig. 5, the packet forwarding device includes:

a first decapsulation module 501 configured to receive a data packet from a first user interface, decapsulate the data packet, and obtain a service requirement of the data packet, where the service requirement is used to indicate a network service and a service sequence that need to be provided for the data packet;

the path arranging module 502 is configured to arrange a service path according to the service requirement, so as to obtain service chain information, where the service chain information includes an external interface address of a service node to be experienced by the data packet;

a first encapsulation module 503 configured to encapsulate the service link information in the data packet;

the first sending module 504 is configured to send the data packet with the service link information encapsulated to the first service node according to the external interface address of the first service node in the service link information.

In a possible implementation manner, the first decapsulating module 501 is further configured to decapsulate the data packet, so as to obtain tenant information of the data packet;

the first encapsulation module 503 is further configured to encapsulate the tenant information in the data packet when encapsulating the service link information.

In a possible implementation manner, the data packet encapsulated with the service link information includes a segment routing internet protocol version 6 Srv6 packet, and the service link information and the tenant information are encapsulated in a segment routing header SRH of the Srv6 packet.

Fig. 6 shows a block diagram of a message forwarding apparatus applied to a service node according to an embodiment of the present disclosure, which may be implemented as part or all of an electronic device by software, hardware, or a combination of both. As shown in fig. 6, the message forwarding apparatus includes:

a second decapsulation module 601, configured to receive a data packet from an external interface, and decapsulate the data packet to obtain service chain information, where the service chain information includes an external interface address of a service node to be experienced by the data packet;

a first judging module 602 configured to judge whether the service node is a tail service node based on the service chain information;

And the second sending module 603 is configured to forward the data packet to a user terminal from a second user terminal interface corresponding to the tail service node in response to the present service node being the tail service node.

In one possible embodiment, the apparatus further comprises:

In a possible implementation manner, the second encapsulation module is further configured to encapsulate tenant information of the data packet in the data packet when encapsulating the service link information.

In a possible implementation manner, the third sending module is further configured to:

The message forwarding device in this embodiment corresponds to the message forwarding method, and specific details can be found in the description of the message forwarding method, which is not repeated here.

Fig. 7 shows a block diagram of a message forwarding system according to an embodiment of the present disclosure, which may be implemented as part or all of an electronic device by software, hardware, or a combination of both. As shown in fig. 7, the packet forwarding system 700 includes: orchestration node 701 and service node 702;

an orchestration node 701 configured to: receiving a data message from a first user terminal interface, and decapsulating the data message to obtain a service requirement of the data message, wherein the service requirement is used for indicating network service and service sequence which need to be provided for the data message; arranging a service path according to the service requirement to obtain service chain information, wherein the service chain information comprises an external interface address of a service node to be experienced by the data message; encapsulating the service link information in the data message; and sending the data message packaged with the service link information to the first service node according to the external interface address of the first service node in the service link information.

Service node 702 configured to: receiving a data message sent by an arranging node or other service nodes from an external interface, and decapsulating the data message to obtain service chain information, wherein the service chain information comprises an external interface address of the service node to be experienced by the data message; judging whether the service node is a tail service node or not based on the service chain information; and responding to the service node serving as a tail service node, and forwarding the data message to a user terminal from a second user terminal interface corresponding to the tail service node.

In one possible implementation, the service node 702 may be further configured to: judging whether the service node is provided with a mounting service node or not according to the fact that the service node is not a tail service node; in response to the fact that the mounting service node does not exist in the service node, after the data message is processed based on the service provided by the service node, the service chain information is packaged in the processed data message; and sending the data message packaged with the service chain information to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information.

In one possible implementation, the service node 702 may be further configured to: responding to the existence of the mounting service node of the service node, caching the service chain information in the service node, and forwarding the data message to the mounting service node; receiving the message processed by the mounting service node, and encapsulating the service chain information in the message processed by the mounting service node; and sending the message packaged with the service chain information to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information.

In one possible implementation, the service node 702 may be further configured to: and when the service link information is packaged, the tenant information of the data message is packaged in the data message.

In a possible implementation manner, the portion of the service node 702 that sends the packet with the packet header to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information is configured to:

The present disclosure also discloses an electronic device, fig. 8 shows a block diagram of the electronic device according to an embodiment of the present disclosure, and as shown in fig. 8, the electronic device 800 includes a memory 801 and a processor 802; wherein,

the memory 801 is used to store one or more computer instructions that are executed by the processor 802 to implement the method steps described above.

As shown in fig. 9, the computer system 900 includes a processing unit 901 which can execute various processes in the above-described embodiments in accordance with a program stored in a Read Only Memory (ROM) 902 or a program loaded from a storage portion 908 into a Random Access Memory (RAM) 903. In the RAM903, various programs and data necessary for the operation of the system 900 are also stored. The processing unit 901, the ROM902, and the RAM903 are connected to each other by a bus 904. An input/output (I/O) interface 905 is also connected to the bus 904.

The following components are connected to the I/O interface 905: an input section 906 including a keyboard, a mouse, and the like; an output portion 907 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and a speaker; a storage portion 908 including a hard disk or the like; and a communication section 909 including a network interface card such as a LAN card, a modem, or the like. The communication section 909 performs communication processing via a network such as the internet. The drive 910 is also connected to the I/O interface 905 as needed. A removable medium 911 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is installed as needed on the drive 910 so that a computer program read out therefrom is installed into the storage section 908 as needed. The processing unit 901 may be implemented as a processing unit such as CPU, GPU, TPU, FPGA, NPU.

In particular, according to embodiments of the present disclosure, the methods described above may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a medium readable thereby, the computer program comprising program code for performing the method described above. In such an embodiment, the computer program may be downloaded and installed from the network through the communication section 909, and/or installed from the removable medium 911.

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units or modules described in the embodiments of the present disclosure may be implemented by software, or may be implemented by hardware. The units or modules described may also be provided in a processor, the names of which in some cases do not constitute a limitation of the unit or module itself.

As another aspect, the embodiments of the present disclosure also provide a computer-readable storage medium, which may be a computer-readable storage medium included in the apparatus described in the above-described embodiment; or may be a computer-readable storage medium, alone, that is not assembled into a device. The computer-readable storage medium stores one or more programs for use by one or more processors in performing the methods described in the embodiments of the present disclosure.

The foregoing description is only of the preferred embodiments of the present disclosure and description of the principles of the technology being employed. It will be appreciated by those skilled in the art that the scope of the invention in the embodiments of the present disclosure is not limited to the specific combination of the above technical features, but encompasses other technical features formed by any combination of the above technical features or their equivalents without departing from the inventive concept. Such as the technical solution formed by mutually replacing the above-mentioned features and the technical features with similar functions (but not limited to) disclosed in the embodiments of the present disclosure.

Claims

1. A message forwarding method, which is applied to an orchestration node, includes:

encapsulating the service link information in the data message;

2. The method of claim 1, wherein the method further comprises:

unpacking the data message to obtain tenant information of the data message;

3. A message forwarding method, which is applied to a service node, includes:

responding to the service node as a tail service node, and forwarding the data message to a user side from a second user side interface corresponding to the tail service node;

responding to the service node not being the tail service node, processing the data message based on the service provided by the service node, and packaging the service chain information in the processed data message; and sending the data message packaged with the service chain information to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information.

4. The method of claim 3, wherein the encapsulating the service chain information in the processed data message after processing the data message based on the service provided by the service node in response to the service node not being a tail service node comprises:

and in response to the fact that the mounting service node does not exist in the service node, after the data message is processed based on the service provided by the service node, the service chain information is packaged in the processed data message.

5. The method of claim 4, wherein the method further comprises:

6. The method of any one of claims 3 to 5, wherein the method further comprises:

7. The method according to claim 4 or 5, wherein the sending the packet with the packet header encapsulated to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information includes:

8. A method for forwarding a message, wherein an application comprises a system of orchestration nodes and service nodes, comprising:

the method comprises the steps that an arranging node receives a data message from a first user terminal interface, and decapsulates the data message to obtain a service requirement of the data message, wherein the service requirement is used for indicating network service and service sequence which need to be provided for the data message; arranging a service path according to the service requirement to obtain service chain information, wherein the service chain information comprises an external interface address of a service node to be experienced by the data message; encapsulating the service link information in the data message; according to the external interface address of the first service node in the service chain information, sending the data message packaged with the service chain information to the first service node;

The service node receives the data message sent by the arranging node or other service nodes from an external interface, and decapsulates the data message to obtain service chain information, wherein the service chain information comprises an external interface address of the service node to be experienced by the data message; judging whether the service node is a tail service node or not based on the service chain information; the service node is a tail service node, the data message is forwarded to a user side from a second user side interface corresponding to the tail service node, and the service chain information is packaged in the processed data message after the data message is processed based on the service provided by the service node in response to the service node not being the tail service node; and sending the data message packaged with the service chain information to the next-hop service node according to the external interface address of the next-hop service node of the service node in the service chain information.

9. The method of claim 8, wherein the method further comprises:

when the arrangement node or the service node encapsulates the service link information, the tenant information is encapsulated in the data message;

the data message in which the service link information is encapsulated includes a segment routing internet protocol version 6 Srv6 message, and the service link information and the tenant information are encapsulated in a segment routing message header SRH of the Srv6 message.

10. An electronic device comprising a memory and at least one processor; wherein the memory is for storing one or more computer instructions, wherein the one or more computer instructions are executed by the at least one processor to implement the method steps of any of claims 1-9.

11. A computer readable storage medium having stored thereon computer instructions which, when executed by a processor, implement the method steps of any of claims 1-9.