Network data packet processing method, system and device based on XDP and DPDK cooperation mechanism and storage medium

Abstract

The invention discloses a network data packet processing method, system and device based on an XDP and DPDK collaboration mechanism and a storage medium, and the method comprises the steps: carrying out the filtering of network traffic through an XDP program in a network card drive layer of a kernel mode, and redirecting to a DPDK program of a user mode; and performing related operations, such as forwarding, encryption and decryption, NAT and the like, on the redirected data packet through a DPDK program in a user mode according to the heat preservation processing logic of the DPDK configuration file or the set processing logic. According to the method, different XDP programs can be loaded for different network ports, and the method has good function extensibility; and irrelevant or malicious messages are discarded in a kernel mode, so that the occupancy rate of a memory and a CPU (Central Processing Unit) is greatly reduced, and then the data traffic forwarding rate is improved through the DPDK.

Description

TECHNICAL FIELD

[0001] The application relates to a network data processing method and system, in particular to a network data packet processing method and device based on an XDP and DPDK cooperative mechanism. BACKGROUND

[0002] With the rapid development of the Internet, the popularity of 10Gbps / 40Gbps high-speed network cards, and the continuous increase in the traffic scale of network applications, the existing message shunting method based on the Linux kernel protocol stack cannot meet the real-time processing requirements of large-scale high-speed traffic in the scenario of high load and large-scale data processing, because the method will cause actions such as interrupt processing, data copying and context switching, resulting in increased processing message delay and decreased throughput.

[0003] Under such circumstances, Intel has invented the DPDK technology, which bypasses the Linux kernel network protocol stack, directly takes over the network card through UIO, uses the memory large page technology to improve the cache hit rate, and uses the polling technology to reduce the interrupt processing overhead. However, once the kernel protocol stack is bypassed, the security mechanism and application isolation related to the message in the kernel are all invalid. The DPDK itself is only a function library and driver set for fast data packets, not a complete kernel protocol stack, and the developer needs to implement the IP network protocol stack and the corresponding network processing tool. SUMMARY

[0004] The purpose of the present application is to provide a network data packet processing method based on an XDP and DPDK cooperative mechanism, which has high functional extensibility, low memory and CPU occupation, and can improve the forwarding efficiency of data traffic. Another purpose of the present application is to provide a network data packet processing system, device and storage medium based on an XDP and DPDK cooperative mechanism.

[0005] Technical scheme: the network data packet processing method based on the XDP and DPDK cooperative mechanism comprises:

[0006] Different XDP programs are loaded on different network interfaces based on a network interface use strategy, the XDP program performs filtering processing on the received data packet at the kernel-mode network card driver layer, and redirects the data traffic to the user-mode DPDK program; the network interface use strategy comprises: performing DDoS defense on the network interface responsible for receiving data; and setting the network interface receiving control messages to only receive specific messages, wherein the information of the specific messages is used to modify the DPDK configuration file.

[0007] The redirected data packet is received by the DPDK program, the message header information thereof is parsed, and operation is performed according to message processing logic of a DPDK configuration file or set processing logic.

[0008] The application establishes an efficient data channel between DPDK and XDP, fully utilizes the characteristics of zero-copy and lock-free design, resolves the contradiction between efficiency and safety, improves the data throughput, and can use tools such as bpftool and perf to obtain data flow, thereby solving the technical problems that the existing kernel protocol stack processes messages inefficiently, and using DPDK can only obtain the data packet flow through a self-defined network tool.

[0009] Optionally, the making of the XDP program comprises:

[0010] The XDP program is generated, including defining xsks_map and constructing XDP program logic;

[0011] The XDP program is loaded into the network card;

[0012] The definition of the xsks_map is realized by defining a descriptor named xsks_map of a BPF_MAP_TYPE_XSKMAP type, and the map is accessed by the user state and the kernel state BPF program;

[0013] The XDP program logic comprises an xdp_load_balance function.

[0014] Optionally, the filtering processing comprises but is not limited to any one of the following:

[0015] (1) the data and data_end two pointers in the struct xdp_md data structure are used to access network message data, first, it is verified whether the data packet is an Ethernet frame, then it is checked whether it is a complete IP data packet;

[0016] (2) the source IP address of the received IP data packet is compared with the IP address of the client, if they are the same, it is indicated that it is sent from the client, then a hash value is calculated through the IP header, according to the set load balancing algorithm, a network port is randomly selected from the device, the destination IP address and MAC address of the data packet are changed into the IP address and MAC address of the network port, and the IP header checksum is recalculated;

[0017] (3) invalid and malicious traffic is discarded through XDP_DROP;

[0018] (4) data packets related to control messages are sent into the service program of the upper layer of the kernel protocol stack for analysis through XDP_PASS;

[0019] (5) Redirecting the data flow related packet to the DPDK program through XDP_REDIRECT.

[0020] Optionally, the redirecting comprises:

[0021] Transferring the received data frame to the specified AF_XDP socket through bpf_redirect_map();

[0022] Accessing and modifying the packet content through the data pointer in the struct xdp_md data structure.

[0023] Optionally, the receiving the redirected packet through the DPDK program comprises:

[0024] Obtaining the program parameters and initializing the DPDK environment through rte_eal_init();

[0025] Specifying the user mode network interface driver associated with the network interface device as net_af_xdp, so that the receiving queue corresponds to the queue number specified in the redirection of the XDP program;

[0026] Receiving the redirected packet through rte_eth_rx_burst().

[0027] Optionally, the operation according to the packet processing logic of the DPDK configuration file or the set processing logic comprises:

[0028] According to the packet processing logic generated according to the dpdk.confg configuration file, performing subsequent actions on the received packet according to different packet types and IP address ranges, the subsequent actions including at least one of the following: forwarding, encryption and decryption, NAT;

[0029] And / or marking special packets in the data structure rte_mbuf->udata64 variable;

[0030] Then bind each CPU core to a ring queue rte_ring, and process the packet according to the packet processing logic or the set processing logic.

[0031] Optionally, the method further comprises: after the network interface that sends the control packet is specified, the other network interfaces are responsible for receiving data for the network interface that receives data, and the data packets received by the network interface are processed by the DPDK program for forwarding service or encryption and decryption service.

[0032] Further, the loading of different XDP program files is dynamically performed. For example, a firewall program is attached to eth0 by the command ip link set dev eth0 xdp obj firewall.o; a network interface that specially receives control packets can also be specified by the command, and the data packets received by the remaining network interfaces are processed and forwarded by the DPDK program for forwarding service or encryption and decryption service. At the same time, the XDP program of the network interface can be unloaded by the command ip link set dev nic xdp off, so as to realize dynamic loading of different XDP programs to different network interfaces.

[0033] Optionally, the method further comprises:

[0034] In the network load balancing scenario, the network traffic is modified by modifying the header or payload of the data packet in the XDP program, and the load balancing algorithm is used in the DPDK program in the user mode to distribute the data packet to multiple servers, so as to realize network load balancing.

[0035] Optionally, the method further comprises:

[0036] In the DDoS defense, traffic analysis and monitoring scenario, the data packet information is captured by the XDP program, the source IP traffic is counted, and the IP exceeding the threshold is added to the blacklist; by the XDP_DROP action, malicious traffic is discarded when it does not enter the kernel protocol stack.

[0037] The network data packet processing system based on the XDP and DPDK cooperative mechanism comprises:

[0038] The filtering processing module is configured to perform filtering processing on the received data packet at the network card driver layer in the kernel mode, and to redirect the data flow to the DPDK program in the user mode;

[0039] The logic execution module is configured to receive the redirected data packet, and to perform operations according to the message processing logic of the DPDK configuration file or the set processing logic.

[0040] The electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor executes the program to realize part or all of the steps of the network data packet processing method based on the XDP and DPDK cooperative mechanism.

[0041] The computer readable storage medium has a computer program stored thereon, and the program is executed by the processor to realize part or all of the steps of the network data packet processing method based on the XDP and DPDK cooperative mechanism.

[0042] Advantages: Compared with the prior art, the present application has the following obvious advantages:

[0043] 1. Compared with directly using DPDK to forward data packets, the present invention uses the collaborative diversion of DPDK and XDP to pass control messages and other invalid or malicious traffic through XDP first when they first enter the network card driver. They will be checked against security rules in the kernel, which strengthens the security foundation. XDP can also filter out invalid data packets more quickly in the process. Then, XDP processes and diverts them to the kernel protocol stack or forms a firewall to directly discard them. This is more efficient and avoids DPDK resource waste, reducing CPU and memory overhead and improving overall resource utilization. XDP can redirect received data directly to DPDK and bypass the kernel protocol stack, avoiding performance bottlenecks and delay jitter. It is suitable for scenarios with extremely high performance requirements such as high-frequency trading and telecommunications.

[0044] 2. The present invention provides a functional division of labor architecture based on network port roles, including:

[0045] By loading function-specific XDP programs on network ports of different roles, complete physical and logical isolation is achieved. Even if the network port responsible for receiving data is depleted of resources due to a DDoS attack, resulting in service interruption, the network port receiving control messages can still remain unblocked. This achieves security and fault isolation between the control plane and the data plane, ensuring the resilience of the management channel and greatly improving the system's reliability and anti-attack capabilities.

[0046] At the same time, by introducing control traffic into the kernel protocol stack, the network card can be directly configured and managed using tools such as ip, ifconfig, and ethtool. When using DPDK alone, developers must independently develop network card management programs. Therefore, this invention solves the long-standing pain point of poor manageability in high-performance DPDK solutions and greatly reduces development costs.

[0047] In addition, by breaking down complex functions into multiple simple, independent, dedicated XDP programs, policy updates or function debugging can be performed on specific programs of specific network ports without affecting each other, avoiding the maintenance difficulties of "all-round" complex programs.

[0048] 3. The present invention has good kernel compatibility. If the traffic needs to be processed by a complete protocol stack, it can be directly sent to the kernel through XDP_PASS without the need to re-implement the DPDK organization program logic. It is also compatible with existing network tools such as tcpdump and iproute2. When obtaining the flow of control messages or messages passing through the kernel protocol stack, there is no need to customize and develop new network applications, thereby reducing development and maintenance costs.

[0049] 4、The application has good functional extensibility. By changing the kernel state XDP program of different network interfaces, the strategy of receiving data packets of different network interfaces can be flexibly changed. One network interface can be selected as a special network interface for receiving control messages, and other network interfaces receive data messages which are specially processed by DPDK to perform pure forwarding type services such as NAT, load balancing, or encryption and decryption services according to the set strategy. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 The method flowchart of the application is shown in the figure.

[0051] Figure 2 The flowchart of the application in application is shown in the figure.

[0052] Figure 3 The flowchart of the application for implementing network load balancing is shown in the figure.

[0053] Figure 4 The flowchart of the application for implementing DDos defense is shown in the figure. DETAILED DESCRIPTION

[0054] The technical solutions of the application will be further described below with reference to the accompanying drawings.

[0055] The application provides a network data packet processing method based on XDP and DPDK cooperative mechanism, which comprises: loading different XDP programs for different network interfaces based on network interface use strategy, filtering and processing received data packets at the kernel state network card driver layer through the XDP program, and redirecting data flow to the user state DPDK program, and after the DPDK program receives the redirected data packet, analyzing the message header information thereof and performing operation according to the message processing logic of the DPDK configuration file. The working principle of the method is that network traffic is filtered through the XDP program, and service traffic is forwarded or message modified under the user state DPDK program.

[0056] As shown in the figure, the method mainly comprises a kernel state XDP program, a DPDK configuration file making and a user state DPDK program. Figure 1

[0057] (1) Making of the kernel state XDP program xdp_map.c, which specifically comprises the following steps:

[0058] (11) Defining a descriptor named xsks_map of BPF_MAP_TYPE_XSKMAP type, so that the user state and kernel state BPF programs can access the map together, and the received data frame is transmitted to the specified AF_XDP socket through bpf_redirect_map().

[0059] (12) As shown in the figure, the method mainly comprises the following steps:​Figure 2 As shown, the filtering processing logic of the XDP program includes: based on the network port usage strategy, different XDP programs (such as XDP program 1, XDP program 2, XDP program 3) are loaded for different network ports (such as network card 1, network card 2, network card 3), and each XDP program performs different actions (such as XDP_PASS, XDP_DROP, XDP_REDIRECT), which specifically includes:

[0060] For the network port receiving the data, after the XDP program receives the attack traffic and the data packet in the black list IP, it is directly discarded through XDP_DROP; the data flow related message is sent to the AF_XDP socket function bound by the DPDK program in the user mode through XDP_REDIRECT, or the data content of the message can be accessed and modified through the data pointer in the struct xdp_md data structure.

[0061] For the network port receiving the control message, the XDP program sends the control message related data packet to the service program on the upper layer of the kernel protocol stack through XDP_PASS for analysis. The control message is a specific message, and its information is used to modify the DPDK configuration file.

[0062] In one embodiment, as shown in Figure 3 The core logic of the XDP program is in the xdp_load_balance function. This function is the entry point of the XDP program, which will analyze the received data packet and strictly divide it. In this custom function, the network message data is accessed through the data and data_end two pointers in the struct xdp_md data structure, and the message header information is parsed.

[0063] First, verify whether the data packet is an Ethernet frame, then check whether it is a complete IP data packet, if not, directly return XDP_DROP to indicate discarding the data packet and recording the error behavior;

[0064] Subsequently, the source IP address of the received IP data packet is compared with the IP address of the client, if the same, it indicates that it is sent from the client, then the hash value is calculated through the IP header, according to the set load balancing algorithm, a network port is randomly selected from the device, the destination IP address and MAC address of the data packet are changed to the IP address and MAC address of the network port, and the IP header checksum is recalculated, then the IP data packet is sent to the DPDK program through XDP_REDIRECT.

[0065] In another embodiment, as shown in Figure 4As shown, when constructing the XDP program logic, three functions of traffic statistics, blacklist management and threshold detection are set. The source IP address of the network packet is obtained through the offset value of the data pointer in the struct xdp_md data structure, if the IP address is in the blacklist, it is determined as an abnormal IP, and XDP_DROP is returned to discard the data packet.

[0066] The XDP program performs traffic statistics on the data packet of each source IP, and performs threshold detection on the five-tuple of the data packet. If the number of packets received from a certain IP within 1 second is greater than the set threshold, it is determined as an attack packet, and the source IP packet is added to the blacklist and discarded through XDP_DROP.

[0067] (13) Compile the kernel XDP program using the clang compiler clang -O2 -target bpf -c xdp_map.c -o xdp_map.o, and load it onto the network card through the ip command ip link set dev eth0 xdp obj xdp_map.o.

[0068] (2) The making of the DPDK configuration file dpdk.config includes: for each rule in the specific message, set the following contents, including but not limited to: rule number, rule description, IP source address, IP destination address, protocol type and subsequent action.

[0069] (3) The making of the user-mode DPDK program, specifically including the following steps:

[0070] (31) Get the program parameters through rte_eal_init and initialize the DPDK environment, specify the user layer network interface driver of the network interface device as net_af_xdp, and specify that the receive queue in the network card corresponds to the queue number specified in the kernel XDP program;

[0071] (32) Set the network card device through rte_eth_dev_configure(), start the Ethernet device through rte_eth_dev_start(), and then receive the data packet sent into AF_XDP through XDP redirection through rte_eth_rx_burst(), the address of the data packet read by DPDK is pre-allocated by AF_XDP, which is shared with the XDP kernel;

[0072] (33) According to the dpdk.confg configuration file, the message processing logic is generated, and according to different message types and IP address ranges, such as encryption, decryption, forwarding and the like, special messages can also be marked in the mbuf->udata64 variable, each CPU core is bound to a ring queue (rte_ring), and the processing logic set in the configuration file is used to process specific types of messages.

[0073] (34) After compiling, execute. / dpdk_app --vdev=net_af_xdp,iface=eth0,start_queue=1, specify that the corresponding network port uses net_af_xdp as a user-mode network port driver.

[0074] (4) Application scenario of the application

[0075] Scenario 1: Network load balancing

[0076] The DPDK reads the configuration file dpdk.config to build the message processing logic of the program, and the DPDK program runs a thread on each logical core to perform data receiving and transmitting processing. The rte_eth_rx_burst() function receives the XDP redirected AF_XDP message, reads the destination IP address of the data packet, and then gives the business program to process after the IP address range in the configuration file is matched.

[0077] Therefore, the application can be applied to network load balancing: by modifying the header or payload of the data packet in the XDP program, the network traffic modification is realized, and then using the load balancing related algorithm in the user-mode DPDK program, the data packet can be distributed to multiple servers, realizing the network load balancing function.

[0078] Scenario 2: DDos defense, traffic analysis and monitoring

[0079] The DPDK reads the configuration file dpdk.config to build the running logic of the program, and the DPDK program runs a thread on each logical core to perform data receiving and transmitting processing. The rte_eth_rx_burst() function receives the XDP redirected AF_XDP message, completes the reception of normal traffic, and also performs traffic statistics on normal data packets.

[0080] This embodiment can be used for DDos defense or traffic analysis and monitoring: by capturing the information of the data packet in the XDP program, such as the number of data packets, traffic protocol and the like, and by using the XDP_DROP action, malicious traffic can be discarded before entering the kernel protocol stack, reducing bandwidth and CPU consumption, realizing the DDos defense and firewall function.

[0081] The application further provides a network data packet processing system based on an XDP and DPDK cooperative mechanism, comprising:

[0082] a filtering processing module, configured to perform filtering processing on the received data packet at the kernel-mode network card driver layer and to redirect data flow to the user-mode DPDK program;

[0083] a logic execution module, configured to receive the redirected data packet and perform operations according to message processing logic of a DPDK configuration file or set processing logic.

[0084] To implement the foregoing network data packet processing method based on the XDP and DPDK cooperative mechanism, the application provides an electronic device and a computer readable storage medium.

[0085] The electronic device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor implements part or all of the steps of the network data packet processing method based on the XDP and DPDK cooperative mechanism when executing the program.

[0086] The computer readable storage medium has a computer program stored thereon, and the program, when executed by the processor, implements part or all of the steps of the network data packet processing method based on the XDP and DPDK cooperative mechanism.

Claims

1. A network data packet processing method based on the XDP and DPDK collaborative mechanism, characterized in that: The following steps are involved: Based on the network port usage policy, different XDP programs are loaded for different network ports. The XDP program filters the received data packets at the kernel-state network card driver layer and redirects the data traffic to the user-state DPDK program. The network port usage policy includes: DDoS defense for the network port responsible for receiving data; setting the network port that receives control messages to only receive specific messages, and the information of the specific messages is used to modify the DPDK configuration file; The redirected data packet is received through the DPDK program, its message header information is parsed, and operations are performed according to the message processing logic of the DPDK configuration file; wherein the message header information includes the message protocol number and IP address.

2. The network data packet processing method based on the XDP and DPDK collaborative mechanism according to claim 1 is characterized in that: The production of the XDP program includes: Generate XDP program, including defining xsks_map and building XDP program logic; Load the XDP program to the network card; The definition of xsks_map is implemented by defining a descriptor named xsks_map of type BPF_MAP_TYPE_XSKMAP, which supports both user-mode and kernel-mode BPF programs to access the map. The XDP program logic includes an xdp_load_balance function.

3. The network data packet processing method based on the XDP and DPDK collaborative mechanism according to claim 1 is characterized in that: The filtering process includes at least one of the following: (1) Access the network packet data through the data and data_end pointers in the struct xdp_md data structure. First, verify whether the data packet is an Ethernet frame, and then check whether it is a complete IP data packet. (2) Compare the source IP address of the received IP data packet with the IP address of the client. If they are the same, it indicates that the packet was sent from the client. Then calculate the hash value through the IP header. According to the set load balancing algorithm, randomly select a network port from the device, change the destination IP address and MAC address of the data packet to the IP address and MAC address of the network port, and recalculate the IP header checksum; (3) Drop invalid and malicious traffic via XDP_DROP; (4) Send the data packets related to the control message to the business program on the upper layer of the kernel protocol stack for analysis through XDP_PASS; (5) Redirect data traffic related messages to the DPDK program through XDP_REDIRECT.

4. The network data packet processing method based on the XDP and DPDK collaborative mechanism according to claim 1 is characterized in that: Receiving the redirection data packet through the DPDK program includes: Get program parameters through rte_eal_init() and initialize the DPDK environment; Specify the user-mode network port driver associated with the network port device as net_af_xdp, so that the receive queue corresponds to the queue number specified by the redirection in the XDP program; Redirected packets are received via rte_eth_rx_burst().

5. The network data packet processing method based on the XDP and DPDK collaborative mechanism according to claim 1 is characterized in that: The execution of operations according to the message processing logic of the DPDK configuration file or the set processing logic includes: Perform subsequent actions on received messages based on different message types and IP address ranges according to the message processing logic generated by the dpdk.confg configuration file. The subsequent actions include at least one of the following: forwarding, encryption / decryption, NAT, or marking special messages in the data structure rte_mbuf->udata64 variable; Each CPU core is then bound to a ring queue rte_ring to process packets according to the packet processing logic or the set processing logic.

6. The network data packet processing method based on the XDP and DPDK collaborative mechanism according to claim 1 is characterized in that: The method further includes: after the network port for receiving the control message is designated, the other network ports are used as the network ports responsible for receiving data, and the received data messages are processed by the DPDK program for forwarding services or encryption and decryption services.

7. The network data packet processing method based on the XDP and DPDK collaborative mechanism according to claim 1 is characterized in that: The method further includes at least one of the following: In the network load balancing scenario, the network traffic is modified by modifying the header or payload of the data packet in the XDP program, and the load balancing algorithm is used in the user-mode DPDK program to distribute the data packets to multiple servers to achieve network load balancing. In DDoS defense, traffic analysis, and monitoring scenarios, the XDP program is used to capture packet information, count source IP traffic, and blacklist IPs that exceed the threshold. The XDP_DROP action is used to discard malicious traffic before it enters the kernel protocol stack.

8. A network data packet processing system based on the collaborative mechanism of XDP and DPDK, characterized in that: include: The filtering processing module is used to filter the received data packets at the kernel-mode network card driver layer and redirect the data traffic to the DPDK program in the user mode; The logic execution module is used to receive the redirected data packet and perform operations according to the message processing logic of the DPDK configuration file or the set processing logic.

9. An electronic device, characterized in that: The invention comprises a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the network data packet processing method based on the XDP and DPDK collaborative mechanism according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the network data packet processing method based on the XDP and DPDK collaboration mechanism described in any one of claims 1 to 7 is implemented.

Images