Packet processing method and apparatus
A packet processing method and apparatus are provided. The method includes: on a forwarding path of an IPv6 packet, a key node (for example, a firewall) signs a packet, and a downstream apparatus of the key node verifies the signature, to determine whether the packet passes through the key node in a forwarding process. According to this application, the key node performs checking, to effectively prevent a packet which packet header is modified by attackers from bypassing the key node.
1. A packet processing method, performed by a first communication apparatus, and the method comprising:
obtaining a first internet protocol version 6 (IPv6) packet, wherein a packet header of the first IPV6 packet comprises a first signature, and the first signature is for verifying whether the first IPv6 packet passes through a second communication apparatus in a forwarding process;
forwarding the first IPV6 packet;
wherein the first signature which is determined by fixed-length data in payloads of the first IPv6 packet uniquely identifies the first IPV6 packet, and is different from signatures of other IPv6 packets; and
wherein the first signature is obtained by performing hash calculation based on first content in the first IPV6 packet, and the first content comprises the fixed-length data in the payload and anti-replay attack check information.
2. The method according to claim 1 , wherein the first IPV 6 packet is a segment routing internet protocol version 6 (SRv6) packet.
3. The method according to claim 2 , wherein the first signature is comprised in a segment routing header (SRH).
4. The method according to claim 3 , wherein the SRH comprises an extended type length value (TLV) field, and the extended TLV field comprises the first signature.
5. The method according to claim 1 , wherein the packet header further comprises the anti-replay attack check information.
6. The method according to claim 1 , wherein the packet header further comprises first indication information, and the first indication information indicates at least one type of the anti-replay attack check information comprised in the first content.
7. The method according to claim 5 , wherein the anti-replay attack check information comprises one or more of the following:
a packet sequence number, a timestamp, and a random number.
8. The method according to claim 1 , wherein the packet header further comprises second indication information, and the second indication information indicates a type of the second communication apparatus.
9. The method according to claim 1 , wherein the first communication apparatus and the second communication apparatus are a same apparatus, and the obtaining the first IPv6 packet comprises:
generating the first signature based on a first private key of the second communication apparatus.
10. The method according to claim 1 , wherein the first communication apparatus is a downstream apparatus of the second communication apparatus on a forwarding path of the first IPV6 packet, and before the forwarding the first IPV6 packet, the method further comprises:
verifying the first signature based on a first public key of the second communication apparatus.
11. The method according to claim 10 , further comprising: receiving the first public key sent by a control management entity.
12. A packet processing method, performed by a first communication apparatus, and the method comprising:
receiving a first internet protocol version 6 (IPv6) packet, wherein the first IPv6 packet comprises a first signature, and the first signature is for verifying whether a forwarding path of the first IPV6 packet passes through a second communication apparatus;
verifying the first signature, and processing the first IPV6 packet based on a verification result;
wherein the first signature which is determined by fixed-length data in payloads of the first IPv6 packet uniquely identifies the first IPv6 packet and is different from signatures of other IPv6 packets; and
wherein the first signature is obtained by performing hash calculation based on first content in the first IPV6 packet, and the first content comprises the fixed-length data in the payload and anti-replay attack check information.
13. The method according to claim 12 , further comprising:
discarding the first IPV6 packet in response to a failure of the verification.
14. The method according to claim 12 , wherein the first IPV 6 packet is a segment routing internet protocol version 6 (SRv6) packet.
15. The method according to claim 14 , wherein the first signature is comprised in a segment routing header (SRH).
16. The method according to claim 15 , wherein the SRH comprises an extended type length value (TLV) field, and the extended TLV field comprises the first signature.
17. The method according to claim 12 , wherein the packet header further comprises the anti-replay attack check information.
18. The method according to claim 12 , wherein the packet header further comprises first indication information, and the first indication information indicates at least one type of the anti-replay attack check information comprised in the first content.
19. The method according to claim 17 , wherein the anti-replay attack check information comprises one or more of the following:
a packet sequence number, a timestamp, and a random number.
20. The method according to claim 12 , wherein the packet header further comprises second indication information, and the second indication information indicates a type of the second communication apparatus.