Message processing method, system, device and storage medium

Abstract

Embodiments of the present application provide a message processing method, system, device and storage medium. The method comprises the following steps: obtaining a to-be-forwarded message; the to-be-forwarded message contains a destination IP address; in a non-kernel environment, querying a first matching table to obtain a plurality of backend container group IP addresses matched with the destination IP address; in the non-kernel environment, selecting a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded message; and forwarding the to-be-forwarded message after replacement. The forwarding scheme provided by the embodiments of the present application transfers the function realized by the kernel in the prior art to the non-kernel environment, so that the burden of the kernel can be reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a message processing method, system, device and storage medium. BACKGROUND

[0002] With the rapid development of cloud native, container service applications based on Kubernetes are also becoming more and more widespread. As the cornerstone of cloud native, container networking is an essential basic component of cloud native platform and one of the biggest challenges in building a cloud native container platform.

[0003] In the current container networking solution, the data forwarding capability of the data plane depends on the core component (kube-proxy) provided by the container cluster management system.

[0004] However, the core component uses the functions of iptables or IPVS in the kernel, which makes the existing container networking solution unsuitable for large-scale traffic scenarios. SUMMARY

[0005] In view of the above problems, the present application is proposed to provide a message processing method, system, device and storage medium for solving the above problems or at least partially solving the above problems.

[0006] Therefore, in an embodiment of the present application, a message processing method is provided, comprising:

[0007] obtaining a to-be-forwarded message; the to-be-forwarded message contains a destination IP address;

[0008] In a non-kernel environment, a first matching table is queried to obtain a plurality of backend container group IP addresses matched with the destination IP address;

[0009] In a non-kernel environment, a target backend container group IP address is selected from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded message;

[0010] The to-be-forwarded message after replacement is forwarded.

[0011] In another embodiment of the present application, a message processing system is provided, wherein the system comprises a plurality of nodes; at least one container group is arranged on each node;

[0012] The node is configured to:

[0013] obtain a to-be-forwarded message; the to-be-forwarded message contains a destination IP address;

[0014] In the non-kernel environment, a first matching table is queried to obtain a plurality of backend container group IP addresses matched with the destination IP address;

[0015] In the non-kernel environment, a target backend container group IP address is selected from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet;

[0016] The replaced to-be-forwarded packet is forwarded.

[0017] In another embodiment of the present application, a packet processing device is provided. The packet processing device comprises a memory and a processor, wherein,

[0018] The memory is configured to store a program;

[0019] The processor is coupled to the memory and configured to execute the program stored in the memory to implement the packet processing method of any of the above.

[0020] In another embodiment of the present application, a computer readable storage medium storing a computer program is provided, and the computer program is executable by a computer to implement the packet processing method of any of the above.

[0021] In the technical solution provided by the embodiments of the present application, in the non-kernel environment, a plurality of backend container group IP addresses matched with the destination IP address in the to-be-forwarded packet are found, and a target backend container group IP address is selected to replace the destination IP address in the to-be-forwarded packet. That is, the load balancing function realized by the kernel in the prior art is transferred to the non-kernel environment, so that the burden of the kernel can be reduced. In the large-scale traffic scenario, the packet forwarding performance can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0023] Figure 1 The structural block diagram of the packet processing system provided by an embodiment of the present application is shown in the figure;

[0024] Figure 2 The flowchart of the packet processing method provided by an embodiment of the present application is shown in the figure;

[0025] Figure 3 The structural block diagram of the packet processing system provided by an embodiment of the present application is shown in the figure;

[0026] Figure 4 An example diagram of a packet forwarding pipeline is provided for an embodiment of the present application.

[0027] Figure 5 An example diagram of packet processing is provided for an embodiment of the present application Figure 1 ;

[0028] Figure 6 An example diagram of packet processing is provided for an embodiment of the present application Figure 2 ;

[0029] Figure 7 A structural block diagram of a packet processing device is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the personnel in the technical field better understand the scheme of the present application, the technical scheme in the embodiments of the present application will be described clearly and completely according to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by the person skilled in the art without creative labor are within the scope of protection of the present application.

[0031] In addition, in some of the processes described in the specification, claims, and accompanying drawings of the present application, a plurality of operations appearing in a specific order are included, which can be executed in the order appearing in the text or in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes can include more or fewer operations, and the operations can be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in the text are used to distinguish different messages, devices, modules, etc., and do not represent the order of precedence. Also, "first" and "second" are not of different types.

[0032] Before introducing the packet processing method provided by the embodiments of the present application, the system architecture involved in the packet processing method provided by the embodiments of the present application is introduced. As shown in Figure 1 The packet processing system includes a plurality of nodes 10; at least one container group 101 is provided on the node 10;

[0033] The node 10 is configured to:

[0034] Obtain a to-be-forwarded packet; the to-be-forwarded packet contains a destination IP address;

[0035] In a non-kernel environment, a first matching table is queried to obtain a plurality of backend container group IP addresses matched with the destination IP address;

[0036] selecting a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet in a non-kernel environment;

[0037] forwarding the to-be-forwarded packet after the replacement.

[0038] In the technical scheme provided by the embodiments of the present application, in a non-kernel environment, a plurality of backend container group IP addresses matched with the destination IP address in the to-be-forwarded packet are found, and one backend container group IP address is selected to replace the destination IP address in the to-be-forwarded packet. That is, the function realized by the kernel in the prior art is transferred to the non-kernel environment, so that the burden of the kernel can be reduced. In a large-scale traffic scenario, the packet forwarding performance can be improved.

[0039] In a specific example, the node 10 is further provided with a programmable logic device 102; each container group in the at least one container group 101 is in communication connection with the programmable logic device 102; and the non-kernel environment is located in the programmable logic device 102. The programmable logic device 102 can include but is not limited to an FPGA (Field Programmable Gate Array, programmable array logic), a CPLD (Complex Programmable Logic Device, complex programmable logic device).

[0040] In practical applications, the container network can be implemented in two ways: a logical network (overlay network) and a physical network (underlay network). The underlay refers to a physical network, which is composed of physical devices and physical links. Common physical devices include switches, routers, firewalls, load balancing, intrusion detection, behavior management, and other devices. These devices are connected by specific links to form a traditional physical network, which is referred to as an underlay network. Overlay is a tunneling technology. VXLAN (Virtual Extensible Local Area Network), NVGRE (Network Virtualization using Generic Routing Encapsulation), and STT (Stateless Transport Tunneling) are typical tunneling technologies that implement a large Layer 2 network through tunneling technology. Native Layer 2 data frame packets are encapsulated and transmitted through tunnels. In summary, overlay technology can create one or more logical networks, i.e., virtual networks, on existing physical networks, effectively solving many problems in physical data centers, especially cloud data centers, and achieving automation and intelligentization of data centers.

[0041] In the container network, the node 10 is located in the underlay network, and the container group Pod is located in the overlay network. The container group Pod is the smallest scheduling unit in Kubernetes, and each Pod is a running instance of an application. Kubernetes does not directly manage containers, but manages them through Pods. A Pod contains the following contents: one or more containers, usually one, unless multiple containers are tightly coupled and share resources; shared storage resources (such as data volumes), containers in a Pod can share storage space; a shared IP address, containers in a Pod can access each other; and options that define how the container should run.

[0042] As Figure 1As shown, in the container network, the container group 101 is connected with the programmable logic device 102 through a virtual network card device. The virtual network card device is composed of two virtual network card interfaces and a connection line connecting the two virtual network card interfaces; one virtual network card interface 1031 in the virtual network card device is arranged on the container group 101, and the other virtual network card interface 1032 is arranged on the programmable logic device 102. The node 10 is also provided with a virtual gateway device 104 and a virtual tunnel device 105. Among them, the virtual gateway device 104 and the virtual tunnel device 105 are arranged on the programmable logic device 102. The node 10 is also provided with a physical network card 106.

[0043] The specific implementation of each unit in the above system and the interaction process between the units will be described in detail in the following embodiments.

[0044] Figure 2 A flowchart of a packet processing method provided by an embodiment of the application is shown. As shown, the packet processing method includes the following steps: Figure 2

[0045] 201, obtaining a to-be-forwarded packet.

[0046] The to-be-forwarded packet contains a destination IP address.

[0047] 202, in a non-kernel environment, querying a first matching table to obtain a plurality of backend container group IP addresses matched with the destination IP address.

[0048] 203, in the non-kernel environment, selecting a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet.

[0049] 204, forwarding the to-be-forwarded packet after replacement.

[0050] In the above 202, the non-kernel environment can be located in a programmable logic device.

[0051] Kubernetes provides a resource type-service (Service). The service aggregates multiple container group Pods providing the same service and provides a unified entry address, for example, a service IP address. By accessing the entry address of the service, the backend container group Pod service can be accessed. That is, there is a mapping relationship between the service IP address and the plurality of backend container group Pod IP addresses. According to this mapping relationship, the above first matching table can be constructed.

[0052] ​In an example, the first matching table can store at least one service IP address and a plurality of backend container group IP addresses corresponding to each service IP address. The first matching table is queried, that is, whether the destination IP address is stored in the first matching table. If the destination IP address is stored in the first matching table, it indicates that the destination IP address is a service IP address, and therefore, a plurality of backend container group IP addresses corresponding to the destination IP address, that is, a plurality of backend container group IP addresses matched with the destination IP address, need to be obtained from the first matching table.

[0053] In an example, the target backend container group IP address can be randomly selected from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet in 203.

[0054] In the technical scheme provided by the embodiments of the present application, in a non-kernel environment, a plurality of backend container group IP addresses matched with the destination IP address in the to-be-forwarded packet are found, and one backend container group IP address is selected from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet. That is, the function realized by the kernel in the prior art is transferred to the non-kernel environment, which can reduce the burden of the kernel. In a large-scale traffic scenario, the packet forwarding performance can be improved.

[0055] In an implementable scheme, the non-kernel environment is built-in with a packet processing pipeline. The method can further include:

[0056] 205. In the non-kernel environment, the packet processing pipeline is executed to implement 202 and 203.

[0057] In an implementable scheme, the packet processing pipeline can be written based on a protocol-independent packet processor language P4 (Programming Protocol-Independent Packet Processors). The P4 programming language can support both software implementation and hardware implementation. The software implementation refers to that the packet processing pipeline written based on P4 depends on the kernel. The hardware implementation refers to that the packet processing pipeline written based on P4 does not depend on the kernel, and the packet processing pipeline is loaded in a programmable logic device, and the programmable logic device provides a non-kernel environment for the execution of the packet processing pipeline.

[0058] It should be noted that when the above message processing pipeline is written based on P4, the above message processing pipeline can be implemented by software when the traffic scale is small, and the above message processing pipeline can be implemented by hardware when the traffic scale is large. That is, writing the message processing pipeline in P4 language makes it possible to flexibly switch between software and hardware in the container network scenario.

[0059] Generally, the P4 pipeline includes a parser, a match-action table component, and a deparser, wherein the match-action table component operates based on a match-action table.

[0060] When the message processing pipeline is written based on P4, the first match table includes a first match-action table. Correspondingly, the above 202 “in a non-kernel environment, querying the first match table to obtain a plurality of backend container group IP addresses matched with the destination IP address” includes:

[0061] 2021, in a non-kernel environment, querying the first match-action table to obtain a target action matched with the destination IP address.

[0062] 2022, in a non-kernel environment, executing the target action to obtain a plurality of backend container group IP addresses matched with the destination IP address.

[0063] In the above 2021, the first match-action table stores a first match item and a corresponding first processing action; the first match item includes a service IP address. The first match-action table can store a plurality of first match items, and different first match items include different service IP addresses.

[0064] In the first match-action table, query the first match item matched with the destination IP address; the first processing action corresponding to the first match item is taken as the target action.

[0065] In the above 2022, the target action is executed to obtain a plurality of backend container group IP addresses matched with the destination IP address. Note that the destination IP address is a service IP address.

[0066] Optionally, the above first match item can further include a port number and a protocol number corresponding to the corresponding service IP address. In practical applications, the destination port number and the target protocol number in the to-be-forwarded message can be determined; in the first match-action table, query the first match item matched with the destination IP address, the destination port number, and the target protocol number.

[0067] Correspondingly, the above 203 “in a non-kernel environment, selecting a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded message” can include:

[0068] 2031. performing the target action to select a target backend container group IP address from the plurality of backend container group IP addresses and replace the destination IP address in the packet to be forwarded with the target container group IP address in the non-kernel environment.

[0069] Specifically, the target action is performed to achieve the following steps: obtaining the plurality of backend container group IP addresses matching the destination IP address, selecting the target backend container group IP address from the plurality of backend container group IP addresses, replacing the destination IP address in the packet to be forwarded with the target container group IP address, and replacing the destination port number in the packet to be forwarded with the port number corresponding to the target container group IP address.

[0070] In actual application, the method can further include: after the step 203, the tuple information corresponding to the packet to be forwarded and the target container group IP address can be stored in a connection tracking table for subsequent use. The tuple information can be a five-tuple. The five-tuple includes the source IP address, the destination IP address, the source port number, the destination port number, and the protocol number of the packet to be forwarded. Each tuple information recorded in the connection tracking table is used to identify an established service connection.

[0071] In addition, after the step 203, the reverse tuple information corresponding to the packet to be forwarded and the destination IP address can also be stored in a reverse connection tracking table for subsequent use. The reverse tuple information corresponding to the packet to be forwarded refers to the tuple information of the reverse traffic of the packet to be forwarded. The reverse tuple information can be a reverse five-tuple, wherein the reverse five-tuple refers to the five-tuple of the reverse traffic of the packet to be forwarded. The source IP address in the reverse five-tuple is the target backend container group IP address. Each reverse tuple information recorded in the reverse connection tracking table is also used to identify an established service connection.

[0072] In an implementable scheme, before the step 202, the method can further include the following steps:

[0073] 206. determining the tuple information of the packet to be forwarded;

[0074] 207. in the non-kernel environment, querying a connection tracking table to determine whether the connection tracking table stores a target backend container group IP address matching the tuple information;

[0075] 208. when the connection tracking table does not store a target backend container group IP address matching the tuple information, triggering the step of querying the first matching table in the non-kernel environment to obtain the plurality of backend container group IP addresses matching the destination IP address.

[0076] Specifically, the connection tracking table is searched to determine whether the tuple information of the to-be-forwarded packet is stored in the connection tracking table; if yes, it indicates that the to-be-forwarded packet is a non-first packet, that is, the related service connection has been established before, and thus it is not necessary to perform the load balancing operation according to the first matching table to establish the service connection; if not, it is necessary to perform the load balancing operation according to the first matching table to establish the service connection, that is, the steps 202 and 203 need to be performed.

[0077] Optionally, the method further includes the following steps:

[0078] 209. When the connection tracking table stores the target backend container group IP address matching the tuple information, the destination IP address in the to-be-forwarded packet is replaced with the target backend container group IP address.

[0079] If the connection tracking table stores the tuple information of the to-be-forwarded packet, the backend container group IP address corresponding to the tuple information of the to-be-forwarded packet is obtained from the connection tracking table as the target backend container group IP address matching the tuple information of the to-be-forwarded packet; and the destination IP address in the to-be-forwarded packet is replaced with the target backend container group IP address.

[0080] In an example, the method further includes the following steps:

[0081] 210. According to the service IP table, it is determined whether the destination IP address is a service IP address.

[0082] 211. When the destination IP address is a service IP address, the step of searching the first matching table in the non-kernel environment to obtain a plurality of backend container group IP addresses matching the destination IP address is performed.

[0083] In 210, the service IP table stores at least one service IP address. The purpose of searching the service IP address is to determine whether the destination IP address belongs to the service IP address.

[0084] If the service IP table stores the destination IP address, it indicates that the destination IP address belongs to the service IP address; if the service IP table does not store the destination IP address, it indicates that the destination IP address does not belong to the service IP address.

[0085] In 211, when the service IP table stores the destination IP address, the steps 202 and 203 are performed.

[0086] When the service IP table does not store the destination IP address, it indicates that the destination IP address belongs to the container group IP address, and then the to-be-forwarded packet can be a response packet. Therefore, the method further includes the following steps:

[0087] 212、determining the source IP address in the packet to be forwarded when the destination IP address is not a service IP address.

[0088] 213、in a non-kernel environment, querying a reverse connection tracking table to obtain a target service IP address matching the tuple information of the packet to be forwarded; and replacing the source IP address in the packet to be forwarded with the target service IP address.

[0089] In 213, it is queried whether the tuple information of the packet to be forwarded is stored in the reverse connection tracking table; if the tuple information of the packet to be forwarded is stored in the reverse connection tracking table, it is indicated that the packet to be forwarded is a response packet; otherwise, it is indicated that the packet to be forwarded is not a response packet.

[0090] When the tuple information of the packet to be forwarded is stored in the reverse connection tracking table, a service IP address corresponding to the tuple information stored in the reverse connection tracking table is taken as a target service IP address matching the tuple information of the packet to be forwarded.

[0091] The source IP address in the packet to be forwarded is replaced with the target service IP address, so that the request end can normally identify the response packet when the request end receives the response packet. Generally, the destination IP address of the request end is a service IP address when the request end makes a request, and therefore the source IP address in the response packet must also be a service IP address, so that the request end considers that the response packet is returned by the request object.

[0092] In order to meet the user's demand for the diversity of the packet forwarding scheme, the above method can further include the following steps:

[0093] 214、determining a target processing environment from the kernel environment and the non-kernel environment according to user configuration information.

[0094] 215、when the target processing environment is the non-kernel environment, performing the steps 202 and 203.

[0095] 216、when the target processing environment is the kernel environment, in the kernel environment, querying a first matching table to obtain a plurality of backend container group IP addresses matching the destination IP address; and in the kernel environment, selecting a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the packet to be forwarded.

[0096] The operations of querying, obtaining, selecting and replacing in the kernel environment can refer to the specific implementation in the non-kernel environment, which will not be described in detail here.

[0097] In practical applications, the above method can further include:

[0098] 217. parsing the received packet to obtain a parsing result.

[0099] 218. determining a packet type of the packet according to the parsing result.

[0100] 219. determining a to-be-forwarded packet according to the packet type of the packet.

[0101] The steps 217, 218 and 219 can be executed in the non-kernel environment, and specifically, can be implemented by a packet forwarding pipeline running in the non-kernel environment.

[0102] The packet forwarding pipeline includes a parser, which is configured to parse the packet to obtain the parsing result. The packet carries a packet type, and the parsing result includes the packet type carried in the packet. The packet type can include an address resolution protocol (ARP) packet type, an IP packet type and a tunnel encapsulation packet type.

[0103] In an implementable solution, the step 219 of determining the to-be-forwarded packet according to the packet type of the packet can include one or more of the following steps:

[0104] S10. When the packet type of the packet is the ARP packet type, determining that there is no to-be-forwarded packet, and replying to the packet.

[0105] S11. When the packet type of the packet is the IP packet type, taking the packet as the to-be-forwarded packet.

[0106] S12. When the packet type of the packet is the tunnel encapsulation packet type, decapsulating the packet to obtain a decapsulated packet, and taking the decapsulated packet as the to-be-forwarded packet.

[0107] In the step S10, the ARP is a protocol for resolving an IP address into a Media Access Control Address (MAC) address (or physical address). Replying to the ARP packet can effectively distribute ARP packet processing pressure. The pipeline can randomly generate a random MAC address and return an ARP response packet. The specific implementation of the reply can refer to the prior art, which is not described in detail herein.

[0108] In the step S12, the tunnel table stores at least one remote node IP address.

[0109] When an external source IP address in the packet matches a remote node IP address in the tunnel table, it is determined that the packet type of the packet is the tunnel encapsulation packet type.

[0110] In an example, the tunnel table described above can also store at least one remote container group IP address for use when packet encapsulation. The specific use process can be referred to below.

[0111] The packet forwarding pipeline written based on P4 can be simply referred to as a P4 pipeline, and each table in the above is a matching action table. The embodiments of the present application will be introduced below by taking the packet forwarding implemented by using the P4 pipeline loaded on the programmable logic device as an example:

[0112] The programmable logic device can receive packets through the virtual network card interface, virtual gateway device and virtual tunnel device arranged on the programmable logic device, that is, the packets can enter the packet forwarding pipeline through the virtual network card interface, virtual gateway device and virtual tunnel device arranged on the programmable logic device. In addition, the packets processed by the programmable logic device are sent out through the virtual network card interface, virtual gateway device and virtual tunnel device arranged on the programmable logic device.

[0113] The packets sent by the local container group Pod through the virtual network card interface arranged thereon will enter the programmable logic device through the corresponding virtual network card interface arranged on the programmable logic device; the packets sent by the remote container group Pod or the packets sent by the physical network card interface on the remote node will enter the programmable logic device through the virtual tunnel device arranged on the programmable logic device; the packets sent by the local node (specifically, the physical network card interface on the local node) will enter the programmable logic device through the virtual gateway device arranged on the programmable logic device.

[0114] For example: Figure 3 Four packet forwarding paths (1), (2), (3) and (4) are shown, wherein path (1) illustrates the communication between the local container group and the local node; path (2) illustrates the communication between the local container group and the local container group; path (3) illustrates the communication between the remote node and the local container group; and path (4) illustrates the communication between the local container group and the remote container group. As shown in path (1): Figure 3 The packet sent by the first container group 111 passes through the first virtual network card interface 113, the second virtual network card interface 114, the first programmable logic device 117 and the first virtual gateway device 118 in sequence and reaches the first physical network card 110. As shown in path (2): Figure 3 The packet sent by the first container group 111 passes through the first virtual network card interface 111, the second virtual network card interface 114, the first programmable logic device 117, the fourth virtual network card interface 116 and the third virtual network card interface 115 in sequence and reaches the second container group 112. As shown in path (3): Figure 3The path (3) shown: the message sent by the second physical network card 120 passes through the second virtual gateway device 129, the second programmable logic device 127, the second virtual tunnel device 128, the first virtual tunnel device 119, the first programmable logic device 117, the fourth virtual network card interface 116, the third virtual network card interface 115, and reaches the second container group 112. As shown in the figure Figure 3 The path (4) shown: the message sent by the second container group 112 passes through the third virtual network card interface 115, the fourth virtual network card interface 116, the first programmable logic device 117, the first virtual tunnel device 119, the second virtual tunnel device 128, the sixth virtual network card interface 124, and the fifth virtual network card interface 123, and reaches the third container group 121.

[0115] The P4 pipeline involves a plurality of matching action tables, and the specific number can be set according to actual needs, which is not limited in the embodiments of the present application.

[0116] The service backend selection table (that is, the first matching table in the above) is used to store a plurality of first matching items. Different first matching items can include different service IP addresses, and different first matching items can correspond to different first processing actions.

[0117] In the embodiments of the present application, both the analysis of the message and the execution of the forwarding operation on the to-be-forwarded message are implemented by using the P4 pipeline.

[0118] The P4 pipeline described above runs in programmable logic hardware, that is, in a non-kernel environment, and is used to implement the following steps:

[0119] 400, obtaining a to-be-forwarded message.

[0120] The to-be-forwarded message contains a destination IP address.

[0121] 401, finding a target first matching item in the service backend selection table that matches the destination IP address.

[0122] 402, executing a first processing action corresponding to the target first matching item.

[0123] In the above 401, the destination IP address is matched with the first matching item in the service backend selection table. If the service IP address included in the first matching item is the destination IP address, the first matching item is taken as the target first matching item.

[0124] In the step 402, a first processing action corresponding to the target first matching item is performed, i.e., the target action in the above description, which is: obtaining a plurality of backend container group IP addresses corresponding to the destination IP address, and selecting a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet.

[0125] In actual applications, the first matching item can further include a service IP address corresponding port number and a target protocol number. Therefore, the step 401 includes: searching the service backend selection table for a target first matching item matching the destination IP address, the destination port number, and the target protocol number.

[0126] Correspondingly, the first processing action corresponding to the target first matching item is performed, which is: obtaining a plurality of backend container group IP addresses corresponding to the destination IP address, selecting a target backend container group IP address from the plurality of backend container group IP addresses, replacing the destination IP address in the to-be-forwarded packet with the target backend container group IP address, and replacing the destination port number in the to-be-forwarded packet with a port number corresponding to the target backend container group IP address.

[0127] In actual applications, the at least one matching action table further includes a connection tracking table. The method can further include: after the step 402, adding a new second matching item and a second processing action corresponding thereto in the connection tracking table; the new second matching item includes tuple information of the to-be-forwarded packet, for example, a five-tuple; the five-tuple includes a source IP address, a destination IP address, a source port number, a destination port number, and a protocol number of the to-be-forwarded packet. The second processing action corresponding to the new second matching item includes modifying the destination IP address in the to-be-forwarded packet to the selected target backend container group IP address, specifically: the second processing action corresponding to the new second matching item includes modifying the destination IP address and the destination source IP address in the to-be-forwarded packet to the selected target backend container group IP address and a port number corresponding thereto.

[0128] In addition, after the step 402, a new fourth matching item and a third processing action corresponding thereto are added in a reverse connection tracking table; the new fourth matching item includes reverse tuple information corresponding to the to-be-forwarded packet, for example, a reverse five-tuple. The reverse five-tuple refers to a five-tuple of reverse traffic of the to-be-forwarded packet. The source IP address in the reverse five-tuple is the selected target backend container group IP address. The third processing action corresponding to the new fourth matching item includes modifying the source IP address in the to-be-forwarded packet to the destination IP address. Specifically, the third processing action corresponding to the new fourth matching item includes modifying the source IP address and the source port number in the to-be-forwarded packet to the destination IP address and a port number corresponding thereto.

[0129] In actual application, the connection tracking table is configured to store second matching items and corresponding second processing actions, the second matching items include tuple information of existing service connections, and the second processing actions include modifying the destination IP address in the to-be-forwarded packet to a backend container group IP address corresponding to the existing service connection. The number of the second matching items can be one or more, the tuple information included in different second matching items can be different, and the corresponding second processing actions can also be different. The second processing action can specifically include modifying the destination IP address and the destination port number in the to-be-forwarded packet to the backend container group IP address and the port number corresponding to the existing service connection. The P4 pipeline is further configured to implement:

[0130] 403. In the connection tracking table, a target second matching item matching the tuple information of the to-be-forwarded packet is searched.

[0131] 404. If the target second matching item is not found, the step 401 is performed.

[0132] In the step 403, the tuple information of the to-be-forwarded packet is matched with the second matching items in the connection tracking table.

[0133] In the step 404, if the target second matching item is not found, it indicates that the to-be-forwarded packet is a first packet, and therefore, a load balancing operation needs to be performed according to the service backend selection table to establish a corresponding service connection.

[0134] Optionally, the P4 pipeline is further configured to implement:

[0135] 405. If the target second matching item is found, a second processing action corresponding to the target second matching item is performed.

[0136] In the step 405, the second processing action corresponding to the target second matching item is performed, that is, the destination IP address in the to-be-forwarded packet is replaced with a backend container group IP address corresponding to the tuple information of the to-be-forwarded packet in the connection tracking table.

[0137] When the connection tracking table includes a target second matching item matching the tuple information of the to-be-forwarded packet, it indicates that the to-be-forwarded packet is a non-first packet, that is, a related service connection has been established before, and therefore, a load balancing operation according to the service backend selection table is not needed to establish a new service connection, and the destination IP address in the to-be-forwarded packet can be directly replaced with a backend container group IP address and a port number corresponding to the tuple information of the to-be-forwarded packet in the connection tracking table.

[0138] In actual application, in order to meet the needs of users for the diversity of the packet forwarding scheme, the P4 pipeline includes a first branch and a second branch; in the first branch, the kube-proxy component on the node is requested to perform a service backend selection operation on the to-be-forwarded packet; the second branch involves the service backend selection table; the at least one match-action table includes a branch switching table (corresponding to the service IP table in the foregoing); the branch switching table is used to store a third match item and a corresponding switching action; the third match item includes a service IP address; the switching action is one of a first switching action and a second switching action; the first switching action includes assigning the to-be-forwarded packet to the first branch; and the second switching action includes assigning the to-be-forwarded packet to the second branch. The branch switching table can include a plurality of third match items, and different third match items include different service IP addresses.

[0139] Optionally, the P4 pipeline is further used to implement:

[0140] 406. In the branch switching table, a matching operation of the destination IP address in the to-be-forwarded packet is performed.

[0141] 407. When there is a target third match item in the branch switching table that matches the destination IP address in the to-be-forwarded packet, a switching action corresponding to the target third match item is performed.

[0142] In 406, the destination IP address in the to-be-forwarded packet is matched with the third match item in the branch switching table.

[0143] In 407, when there is a target third match item in the branch switching table, it indicates that the to-be-forwarded packet is to access a service, and the switching action corresponding to the target third match item is performed. If the switching action is the first switching action, the to-be-forwarded packet is assigned to the first branch; if the switching action is the second switching action, the to-be-forwarded packet is assigned to the second branch.

[0144] After the first branch receives the to-be-forwarded packet, the to-be-forwarded packet is sent to the kube-proxy component on the first node, so that the kube-proxy component performs a service backend selection operation on the to-be-forwarded packet. After the kube-proxy component modifies the to-be-forwarded packet, the modified to-be-forwarded packet is sent to the programmable logic device through the virtual gateway device arranged on the programmable logic device, so as to re-enter the P4 pipeline in the programmable logic device.

[0145] After the second branch receives the to-be-forwarded packet, the related operations of the service backend selection table and the connection tracking table in the foregoing embodiments are performed, which will not be described herein.

[0146] The switching action in the branch switching table is configured by a user. In an implementable solution, the P4 pipeline is further configured to implement

[0147] 408、obtain user configuration information.

[0148] The user configuration message includes indication information indicating a target branch selected by the user from the first branch and the second branch.

[0149] 409、according to the configuration message, fill in the switching action corresponding to the target branch in the branch switching table.

[0150] In a specific example, the switching action corresponding to each third match item in the branch switching table can be configured as the switching action corresponding to the target branch. The first branch corresponds to the first switching action, and the second branch corresponds to the second switching action.

[0151] In another specific example, the configuration message includes a service IP address and indication information indicating that the user selects the target branch from the first branch and the second branch for the service IP address. The service IP address in the configuration information and the switching action corresponding to the target branch are filled in the branch switching table. The number of service IP addresses in the above configuration information can be one or more, and each service IP address corresponds to corresponding indication information. In this embodiment, the user can select the corresponding branch for each service IP address, which is more flexible and convenient.

[0152] Optionally, the P4 pipeline is further configured to implement:

[0153] 410、when the target third match item does not exist in the branch switching table, searching for a target fourth match item matching the tuple information of the to-be-forwarded packet in a reverse connection tracking table.

[0154] The reverse connection tracking table is configured to store fourth match items and third processing actions corresponding thereto. The fourth match item includes reverse tuple information corresponding to an existing service connection. The third processing action includes modifying the source IP address in the to-be-forwarded packet to the service IP address corresponding to the existing service connection.

[0155] 411、when the target fourth match item is found, performing the third processing action corresponding to the target fourth match item to replace the source IP address in the to-be-forwarded packet with the service IP address corresponding to the tuple information of the to-be-forwarded packet in the reverse connection tracking table.

[0156] In 410, when the target third matching item is not found, it indicates that the to-be-forwarded packet is not sent to the service. The tuple information corresponding to the to-be-forwarded packet is matched with the fourth matching item in the reverse connection tracking table.

[0157] In 411, when the target fourth matching item is found, it indicates that the to-be-forwarded packet is reverse traffic of an existing service connection, and the source IP address in the to-be-forwarded packet needs to be modified to the service IP address corresponding to the existing service connection. Specifically, the source IP address and the source port number in the to-be-forwarded packet can be modified to the service IP address and the port number corresponding to the existing service connection. In this way, it can be ensured that the source IP address and the source port number of the packet seen by the access side are consistent with the destination IP address and the destination port number requested by the access side.

[0158] Optionally, the P4 pipeline is further configured to implement:

[0159] 412, parsing the packet to obtain a parsing result.

[0160] 413, determining a packet type of the packet according to the parsing result.

[0161] 414, determining a to-be-forwarded packet according to the packet type of the packet.

[0162] The specific implementation of steps 412, 413, and 414 can be referred to the above embodiments, which will not be described in detail here.

[0163] After the destination IP address is replaced, the source IP address is replaced, or a target fourth matching item matching the tuple information of the to-be-forwarded packet is not found in the reverse connection tracking table, the P4 pipeline is further configured to implement:

[0164] 415, finding a target seventh matching item matching the destination IP address in the current packet in a first container group table.

[0165] The current packet refers to the to-be-forwarded packet at the current moment, which can be the to-be-forwarded packet after the destination IP address is replaced or the source IP address is replaced, or the to-be-forwarded packet without replacement. The first container group table is included in the at least one matching action table. The first container group table includes a seventh matching item and a corresponding sixth processing action. The seventh matching item includes a container group IP address located on the node, and the sixth processing action includes updating the value of a time to live TTL (Time To Live) in the current packet and recording the interface identifier of the device-side virtual network card interface corresponding to the container group IP address. The device-side virtual network card interface refers to a virtual network card interface arranged on a programmable logic device.

[0166] 416、When a target seventh match item matching the destination IP address in the current packet exists in the first container group table, a corresponding sixth processing action is executed to update the TTL in the current packet and record the interface identifier of the device-side virtual network card interface corresponding to the destination IP address in the current packet.

[0167] Optionally, the P4 pipeline is further configured to implement:

[0168] 417、In the virtual network interface table, a target eighth match item matching the interface identifier of the device-side virtual network card interface corresponding to the destination IP address in the current packet is found.

[0169] In addition, the virtual network interface table is further included in the at least one match action table, the virtual network interface table includes an eighth match item and a corresponding seventh processing action, the eighth match item includes: the interface identifier of the device-side virtual network interface; and the seventh processing action includes: modifying the destination MAC address in the current packet to the MAC address of the container group-side virtual network card interface opposite to the device-side virtual network card interface, wherein the container group-side virtual network card interface is arranged on the container group required to be accessed by the current packet.

[0170] 418、When a target eighth match item matching the interface identifier of the device-side virtual network card interface corresponding to the destination IP address in the current packet exists in the virtual network interface table, a corresponding seventh processing action of the target eighth match item is executed to modify the destination MAC address in the current packet to the MAC address of the container group-side virtual network card interface opposite to the device-side virtual network card interface.

[0171] 419、The packet obtained through step 418 is subjected to a reverse analysis process to obtain a reverse analysis processed packet, and the reverse analysis processed packet is sent through the virtual network card interface identified by the interface identifier recorded above.

[0172] 420、When a target seventh match item matching the destination IP address in the current packet does not exist in the first container group table, a target ninth match item matching the destination IP address in the current packet is found in the second container group table.

[0173] The second container group table includes: a ninth match item and a corresponding eighth processing action. The ninth match item includes: a container group IP address located on a remote node. The eighth processing action includes: updating the value of the time to live TTL in the current packet and recording the device identifier of the virtual tunnel device located on the local node.

[0174] 421、When a target ninth match item matching the destination IP address in the current packet exists in the second container group table, a corresponding eighth processing action of the target ninth match item is executed

[0175] 422、In the tunnel table, a target sixth matching item matching the destination IP address in the current packet is searched.

[0176] 423、When the target sixth matching item matching the destination IP address in the current packet exists in the tunnel table, a fifth processing action corresponding to the target sixth matching item is executed to perform tunnel encapsulation on the current packet.

[0177] The operation of tunnel encapsulation can be performed by the tunnel device identified by the device identifier recorded above.

[0178] 424、The encapsulated packet obtained through the step 423 is subjected to reverse analysis processing, and the encapsulated packet is sent through the tunnel device identified by the device identifier recorded above.

[0179] Figure 4 A schematic diagram of a packet forwarding pipeline provided by an embodiment of the application is shown. As shown in the figure, the packet forwarding pipeline includes: Figure 4

[0180] 300、The packet enters.

[0181] 301、The parser parses the packet to determine the packet type of the packet.

[0182] 302、When the packet type of the packet is an ARP packet type, ARP reply is performed.

[0183] The design of the pipeline does not need to use the second layer MAC for forwarding, so the ARP request is blocked in the physical machine by replying to all ARP packets sent by the virtual network card interface.

[0184] 303、When the packet type of the packet is a tunnel encapsulation packet type, matching is performed in the tunnel table.

[0185] 304、If the tunnel table is matched, decapsulation is performed to obtain a to-be-forwarded packet.

[0186] Note: When the packet type of the packet is an IP packet type, the packet is directly taken as the to-be-forwarded packet.

[0187] 305、Matching is performed in the branch switching table.

[0188] 306、If the first branch is matched, the to-be-forwarded packet is sent to the Kube-proxy component for processing by the Kube-proxy component, and then the packet is input into the pipeline.

[0189] 307、If the second branch is matched, matching is performed in the connection tracking table.

[0190] ​308、If the connection tracking table is matched, the destination address of the packet to be forwarded is converted according to the existing service connection.

[0191] 309、If the connection tracking table is not matched, the service backend selection table is matched.

[0192] 310、If the service backend selection table is matched, the destination address of the packet to be forwarded is converted according to the matched information, and connection tracking is performed.

[0193] 311、If the branch switching table is not matched, the reverse connection tracking table is matched.

[0194] 312、If the reverse connection tracking table is matched, the source address of the packet to be forwarded is converted according to the existing service connection.

[0195] If the reverse connection tracking table is not matched or after the step 312 is completed, the following step 313 is performed.

[0196] 313、The first container group table is matched.

[0197] 314、If the first container group table is matched, the TTL is updated and the interface identifier of the target virtual network card interface is recorded

[0198] 315、The virtual network card interface table is matched.

[0199] 316、If the virtual network card interface table is matched, the destination MAC address in the current packet is rewritten according to the matched information.

[0200] 317、If the first container group table is matched, the second container group table is matched.

[0201] 318、If the second container group table is matched, the TTL is updated and the device identifier of the tunnel device is recorded.

[0202] 319、The tunnel table is matched.

[0203] 320、If the tunnel table is matched, the current packet is tunnel encapsulated.

[0204] The correct node IP address and node MAC address can be filled in the outer layer by the tunnel device.

[0205] 321、The current packet is de-parsed by the de-parser.

[0206] After the packet is shuttled in the match action stage, the fields in the packet header may be changed and important intermediate metadata may be added according to the design of the table processing action. The de-parser reassembles the packet header after the forwarding logic of the packet is processed by the pipeline.

[0207] 322, packet sending.

[0208] In the embodiment, the pipeline uses the IP address for three-layer forwarding. The pipeline can be divided into ingress and egress according to different P4 architectures, and is adapted according to the selected P4 model in implementation.

[0209] The P4 model includes but is not limited to PSA (Portable Switch Architecture) and PNA (Portable NIC Architecture). The specific implementation of each step in the embodiment can refer to the corresponding content in the above embodiments, which will not be repeated here.

[0210] The technical solutions provided by the embodiments of the present application will be introduced below taking the search scenario as an example:

[0211] As shown in Figure 5 , the first container group 111 provides a search service, and the second container group 112 provides a database service. When a user needs to search information, the user can send a search request through the client 40. After the search request reaches the first container group 111, the first container group 111 generates a database query packet according to the search request, and sends the database query packet to the second virtual network card interface 114 through the first virtual network card interface 113, and then enters the packet forwarding pipeline loaded in the first programmable logic device. Since the packet forwarding pipeline can provide service backend selection function, the database query packet does not need to be sent to the Kube-proxy component. The packet forwarding pipeline processes the database query packet and sends it to the third virtual network card interface through the fourth virtual network card interface, and then enters the second container group 112. After receiving the database query packet, the second container group 112 performs a database query operation to obtain a query result, and returns the query result to the first container group 111. After receiving the query result, the first container group 111 returns the search result to the client 40.

[0212] If the prior art is used, as shown in Figure 6 , the above-mentioned database query packet needs to first enter the pipeline, then come out of the pipeline and enter the Kube-proxy component, and then be put into the pipeline by the Kube-proxy component for service backend selection operation, and then be forwarded to the second container group 112 by the pipeline. Figure 5 It can be seen that the forwarding path of the packet is long and the delay is long.

[0213] In summary, the technical solution provided in this application uses P4 to describe the pipeline of data paths in Kubernetes cloud-native container networks, involving basic network scenarios such as overlay network-to-overlay network interconnection, overlay-to-underlay network interconnection, and service access. Leveraging P4's capabilities, the data plane is given programmability, enabling software-programmable control; it provides the possibility for flexible hardware offloading and hardware-software integration in container network scenarios, improving packet forwarding performance; it gives container networks multi-backend capabilities, allowing switching between hardware and software as needed; and it reduces development costs and time. Furthermore, it can flexibly utilize the Kube-proxy component, providing two pipeline branches: one integrated with Kube-proxy and one independent of Kube-proxy, allowing for flexible selection based on requirements. In actual business scenarios, the components managing the pipeline may depend on the services using the pipeline, forming a circular dependency, making Kube-proxy integration necessary. However, Kube-proxy has poor performance and cannot be uniformly managed; therefore, supporting both methods simultaneously improves the versatility of the solution.

[0214] Figure 7 A schematic diagram of the structure of a message forwarding device according to an embodiment of this application is shown. Figure 7 As shown, the message forwarding device includes a memory 1101 and a processor 1102. The memory 1101 can be configured to store various other data to support operation on the message forwarding device. Examples of this data include instructions for any application or method used to operate on the message forwarding device. The memory 1101 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0215] The memory 1101 is used to store programs;

[0216] The processor 1102 is coupled to the memory 1101 and is used to execute the program stored in the memory 1101 to implement the data processing method provided in the above-described method embodiments.

[0217] Furthermore, such as Figure 7 As shown, the message forwarding device also includes other components such as a communication component 1103, a display 1104, a power supply component 1105, and an audio component 1106. Figure 7 The diagram only shows some components and does not mean that the message forwarding device only includes...Figure 7 the illustrated components.

[0218] The message forwarding device can be an electronic device. Accordingly, the embodiments of the present application also provide a computer readable storage medium storing a computer program, which, when executed by a computer, can implement the steps or functions of the data processing method provided by the above-mentioned method embodiments.

[0219] The device embodiments described above are merely illustrative, wherein the units illustrated as separate components can or can not be physically separated, and the components illustrated as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiments according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0220] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary universal hardware platform, and of course, can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of software products, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and include a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0221] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of processing a packet, the method comprising: The method comprises the following steps: acquiring a to-be-forwarded packet; the to-be-forwarded packet contains a destination IP address; determining a target processing environment from a kernel environment and a non-kernel environment, the kernel environment and the non-kernel environment being internally provided with a same packet processing pipeline, the packet processing pipeline being written based on a programming language capable of supporting software implementation and hardware implementation, and the non-kernel environment being located in a programmable logic device; when the target processing environment is the non-kernel environment, executing the packet processing pipeline in the non-kernel environment to achieve the following steps: querying a first matching table to obtain a plurality of backend container group IP addresses matched with the destination IP address; selecting a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet; when the target processing environment is the kernel environment, executing the packet processing pipeline in the kernel environment; forwarding the to-be-forwarded packet after replacement.

2. The method of claim 1, wherein, The non-kernel environment is internally provided with a packet processing pipeline; the method comprises the following steps: in the non-kernel environment, executing the packet processing pipeline to achieve the following steps: the step of querying the first matching table to obtain the plurality of backend container group IP addresses matched with the destination IP address and the step of selecting the target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet.

3. The method of claim 2, wherein, The packet forwarding pipeline is written based on a protocol-independent packet processor language P4.

4. The method of claim 3, wherein, The first matching table comprises a first matching action table; in the non-kernel environment, querying the first matching table to obtain the plurality of backend container group IP addresses matched with the destination IP address comprises the following steps: in the non-kernel environment, querying the first matching action table to obtain a target action matched with the destination IP address; in the non-kernel environment, executing the target action to obtain the plurality of backend container group IP addresses matched with the destination IP address.

5. The method according to any one of claims 1 to 4, characterized in that, The non-kernel environment is located in a programmable logic device.

6. The method according to any one of claims 1 to 4, characterized in that, Before the step of querying the first matching table in the non-kernel environment to obtain the plurality of backend container group IP addresses matched with the destination IP address, the method further comprises the following steps: determining tuple information of the to-be-forwarded packet; in the non-kernel environment, querying a connection tracking table to determine whether the connection tracking table stores a target backend container group IP address matched with the tuple information; when the connection tracking table does not store the target backend container group IP address matched with the tuple information, triggering the step of querying the first matching table in the non-kernel environment to obtain the plurality of backend container group IP addresses matched with the destination IP address.

7. The method of claim 6, wherein, The method further comprises the following steps: when the connection tracking table stores the target backend container group IP address matched with the tuple information, replacing the destination IP address in the to-be-forwarded packet with the target backend container group IP address.

8. The method according to any one of claims 1 to 4, characterized in that, The method further comprises the following steps: determining whether the destination IP address is a service IP address according to a service IP table; When the destination IP address is a service IP address, the step of querying, in the non-kernel environment, the first matching table to obtain a plurality of backend container group IP addresses matched with the destination IP address is performed.

9. The method of claim 8, wherein, Further comprising: When the destination IP address is not a service IP address, determining a source IP address in the to-be-forwarded packet; In the non-kernel environment, querying a reverse connection tracking table to obtain a target service IP address matched with tuple information of the to-be-forwarded packet; and replacing the source IP address in the to-be-forwarded packet with the target service IP address.

10. The method according to any one of claims 1 to 4, characterized in that, Further comprising: According to user configuration information, determining a target processing environment from the kernel environment and the non-kernel environment; When the target processing environment is the non-kernel environment, the step of querying, in the non-kernel environment, the first matching table to obtain a plurality of backend container group IP addresses matched with the destination IP address and the step of selecting, in the non-kernel environment, a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet are performed.

11. The method of claim 10, wherein, Further comprising: When the target processing environment is the kernel environment, querying, in the kernel environment, the first matching table to obtain a plurality of backend container group IP addresses matched with the destination IP address; and selecting, in the kernel environment, a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet.

12. A packet processing system, characterized by The system comprises: a plurality of nodes; at least one container group is arranged on the nodes; The nodes are used to: Obtain a to-be-forwarded packet; the to-be-forwarded packet contains a destination IP address; Determine a target processing environment from a kernel environment and a non-kernel environment, the kernel environment and the non-kernel environment are internally provided with a same packet processing pipeline, the packet processing pipeline is written based on a programming language capable of supporting software implementation and hardware implementation, and the non-kernel environment is located in a programmable logic device; When the target processing environment is the non-kernel environment, the packet processing pipeline is executed in the non-kernel environment to realize: querying a first matching table to obtain a plurality of backend container group IP addresses matched with the destination IP address; and selecting a target backend container group IP address from the plurality of backend container group IP addresses to replace the destination IP address in the to-be-forwarded packet; When the target processing environment is the kernel environment, the packet processing pipeline is executed in the kernel environment; Forward the replaced to-be-forwarded packet.

13. A packet processing device, characterized by Comprise: A memory and a processor, wherein, The memory is used to store a program; The processor, coupled with the memory, is used to execute the program stored in the memory to realize the packet processing method in any one of claims 1 to 11.

14. A computer readable storage medium storing a computer program, characterized in that, The computer program can realize the packet processing method in any one of claims 1 to 11 when executed by a computer. The computer program can realize the packet processing method in any one of claims 1 to 11 when executed by a computer.

Images