Traffic control method, electronic device, and storage medium

Abstract

The application discloses a flow control method, an electronic device and a storage medium. The flow control method is applied to a physical network card, the physical network card comprises a flow receiving module and at least one filter, and the method comprises the following steps: the flow receiving module, when receiving flow sent by a virtual network card, if the value of a flow filtering mark corresponding to the flow is an initial value, sends the flow to a target filter on the physical network card which meets a preset condition; the target filter, detecting whether the target filter has filtered the flow, if yes, sends the flow to other filters, so that the other filters filter the flow when it is determined that the other filters have not filtered the flow; if not, filters the flow, and sends the filtered flow to other filters, so that the flow only skips the filter which has performed the filtering operation, avoids that the flow is missed and filtered by other filters and subsequent processing, and further improves the service processing effect of the flow.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a flow control method, electronic device, and storage medium. Background Technology

[0002] Virtual networks based on Linux bridges combined with OpenvSwitch (OVS) have a traffic control mechanism based on the Linux Traffic Control (TC) mechanism.

[0003] Linux TC flow control is divided into ingress and egress traffic based on data flow direction. Linux TC flow control also has ingress and egress traffic policies. Both ingress and egress traffic support rate-limiting and shaping policies based on overall statistics of a single network interface (without categorized queues). However, categorized queues, which provide finer control based on packet content, are only used for egress traffic, i.e., when sending packets. This results in traffic being directly forwarded by the egress-oriented filter to the corresponding Intermediate Functional Block (IFB) interface after flow control is applied, skipping other filters. Consequently, this leads to limited flow control methods and poor service processing performance. Summary of the Invention

[0004] This application provides at least one flow control method, an electronic device, and a storage medium.

[0005] The first aspect of this application provides a flow control method applied to a physical network interface card (NIC). The physical NIC includes a flow receiving module and at least one filter. The method includes: the flow receiving module, upon receiving flow sent by a virtual NIC, if the flow filtering flag corresponding to the flow is set to an initial value, then sending the flow to a target filter on the physical NIC that meets preset conditions; the target filter, detecting whether it has already filtered the flow, and if so, sending the flow to other filters so that the other filters filter the flow when they determine that they have not filtered the flow; otherwise, filtering the flow and sending the filtered flow to other filters.

[0006] In one embodiment, sending the traffic to a target filter on a physical network card that meets preset conditions includes: the traffic receiving module acquiring priority information for each filter; selecting a target filter that meets preset conditions from each filter based on the priority information for each filter; and sending the traffic to the target filter that meets the preset conditions.

[0007] In one embodiment, detecting whether the target filter has filtered the traffic includes: obtaining a filter flag corresponding to the target filter, the filter flag being used to characterize the filtering status of the target filter and the traffic; and detecting whether the target filter has filtered the traffic based on the filter flag.

[0008] In one embodiment, the filtering flag is a string containing multiple flag bits; the step of detecting whether the target filter has filtered the traffic based on the filtering flag includes: the target filter obtaining the flag bit corresponding to the target filter in the string; extracting the flag value corresponding to the flag bit, detecting whether the flag value is a preset value; if yes, then the target filter has filtered the traffic; if no, then the target filter has not filtered the traffic.

[0009] In one embodiment, selecting a target filter from candidate filters includes: filtering the traffic and sending the filtered traffic to other filters, which includes: the target filter obtaining the filtering rules corresponding to the target filter; filtering the traffic based on the filtering rules; and sending the filtered traffic to other filters.

[0010] A second aspect of this application also provides a traffic control method applied to a virtual network interface card (NIC). The method includes: in response to received traffic from a physical NIC, performing service processing on the traffic; maintaining the value of a traffic filtering flag corresponding to the traffic unchanged, and sending the processed traffic and the traffic filtering flag to the physical NIC, so that the physical NIC executes the method described in any of the above-mentioned embodiments.

[0011] In one embodiment, the method further includes: obtaining a filtering flag of a target filter corresponding to the virtual network interface card, the filtering flag being used to characterize the filtering status of the target filter and the traffic; modifying the filtering flag based on the target filter; and sending the modified filtering flag to the physical network interface card.

[0012] In one embodiment, the filter flag is a string containing multiple flag bits; modifying the filter flag based on the target filter includes: obtaining the flag bit corresponding to the target filter in the string; modifying the original value in the flag bit to a preset value to obtain the modified string.

[0013] A third aspect of this application provides an electronic device, including a memory and a processor, wherein the processor is configured to execute program instructions stored in the memory to implement the above-described flow control method.

[0014] A fourth aspect of this application provides a computer-readable storage medium having program instructions stored thereon, which, when executed by a processor, implement the above-described flow control method.

[0015] In the above scheme, when the traffic receiving module receives traffic sent by the virtual network card, if the traffic filtering flag corresponding to the traffic is set to an initial value, the traffic is sent to the target filter on the physical network card that meets the preset conditions. Then, the target filter checks whether the traffic has been filtered. If so, the traffic is sent to other filters so that other filters can filter the traffic if they determine that other filters have not filtered the traffic. If not, the traffic is filtered and the filtered traffic is sent to other filters so that the traffic only skips the filters that have performed the filtering operation, avoiding the traffic from being missed by other filters and subsequent processing, thereby improving the traffic service processing effect.

[0016] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this application. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the specification, serve to explain the technical solutions of this application.

[0018] Figure 1 This is a flowchart of an exemplary embodiment of the flow control method of this application;

[0019] Figure 2 This is a flowchart of a flow control method in related technologies;

[0020] Figure 3 This is a flowchart of another exemplary embodiment of the flow control method of this application;

[0021] Figure 4 This is a flowchart of another exemplary embodiment of the flow control method of this application;

[0022] Figure 5 This is a flowchart of another exemplary embodiment of the flow control method of this application;

[0023] Figure 6 This is a flowchart of another exemplary embodiment of the flow control method of this application;

[0024] Figure 7 This is a schematic diagram of the structure of an embodiment of the electronic device of this application;

[0025] Figure 8 This is a schematic diagram of the structure of an embodiment of the computer-readable storage medium of this application. Detailed Implementation

[0026] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0027] In the following description, specific details such as particular system architectures, interfaces, and technologies are presented for illustrative purposes rather than for limiting purposes, in order to provide a thorough understanding of this application.

[0028] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " generally indicates that the preceding and following related objects have an "or" relationship. Furthermore, "many" in this document means two or more. Moreover, the term "at least one" in this document means any combination of at least two of any one or more of a plurality of objects. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0029] The following is an introduction and explanation of several terms and background technology involved in this application:

[0030] An operating system (OS) is a computer program that manages computer hardware and software resources. The operating system handles fundamental tasks such as managing and allocating memory, determining the priority of system resource allocation, controlling input and output devices, operating networks, and managing file systems. For example, popular server and PC operating systems include Linux, Windows, and UNIX, while mobile operating systems include Android, iOS, and Windows Phone.

[0031] Linux operating system: A multi-user, multi-tasking operating system that supports multi-threading and multiple central processing units (CPUs) based on the Portable Operating System Interface (POSIX).

[0032] Traffic Control (TC): This is the traffic controller in the Linux operating system, used for traffic control within the Linux kernel.

[0033] Extended Berkeley Packet Filter (eBPF): eBPF is a highly flexible and efficient virtual machine-like component in the Linux kernel that can safely execute bytecode at many kernel hook points.

[0034] Please see Figure 1 , Figure 1 This is a flowchart illustrating a flow control method in an exemplary embodiment of this application. The flow control method can be applied to a Linux operating system, specifically to a physical network interface card (NIC). The following embodiment uses a Linux operating system physical NIC as an example to illustrate the flow control method provided in this application. It should be understood that this method can also be applied to other systems and executed by devices in other systems; this embodiment does not impose any limitations on this.

[0035] like Figure 1 As shown, in an exemplary embodiment, the physical network interface card (NIC) includes a traffic receiving module and at least one filter. The traffic control method includes at least steps S110 to S120, which are detailed below:

[0036] Step S110: When the traffic receiving module receives traffic sent by the virtual network card, if the traffic filtering flag corresponding to the traffic is set to the initial value, the traffic is sent to the target filter on the physical network card that meets the preset conditions.

[0037] The traffic receiving module is used to receive traffic received by the physical network card interface. The physical network card interface refers to the interface between the physical network card and the network. The physical network card is a piece of computer hardware designed to allow computers to communicate on a computer network.

[0038] Traffic refers to the message data transmitted in a communication network. A message is a data unit that is exchanged and transmitted in the network, that is, a data block that a station sends at one time. A message contains complete data information to be sent, and its length varies greatly, with no limit and variable length.

[0039] After detecting traffic received by the network interface card, the traffic filtering flag corresponding to that traffic is retrieved. This traffic filtering flag can be stored in the socket kernel buffer (skb), which is a buffer used by the Linux kernel network stack to process traffic. The traffic filtering flag can be extracted from the skb. For example, the traffic filtering flag might be the field `skb->tc_skip_classify` in the skb. If the value of `skb->tc_skip_classify` is 0, it indicates that the traffic filtering flag for that traffic is at its initial value; if the value of `skb->tc_skip_classify` is 1, it indicates that the traffic filtering flag for that traffic is not at its initial value.

[0040] If the traffic filtering flag corresponding to the traffic is set to an initial value, it indicates that the traffic has not been filtered by the filter, and the traffic will be sent to the target filter on the physical network card that meets the preset conditions.

[0041] The target filter that meets the preset conditions can be determined based on the priority information of each filter, or based on the traffic filtering status of each filter, or based on the traffic information (such as the communication protocol used, traffic size, etc.). This application does not limit this.

[0042] Step S120: Target filter: Detect whether the target filter has filtered the traffic. If yes, send the traffic to other filters so that the other filters can filter the traffic when they determine that the other filters have not filtered the traffic. If no, filter the traffic and send the filtered traffic to other filters.

[0043] A filter is a tool used to classify traffic. A target filter identifies traffic that matches the target filter from the traffic received by the traffic receiving module, and processes the traffic that matches the target filter based on the execution method corresponding to the target filter.

[0044] In related technologies, when forwarding traffic through filters, some special filters may directly terminate the filtering process after filtering the traffic, potentially causing the traffic to miss matching with other filters and subsequent processing. For example, please refer to... Figure 2 , Figure 2 This is a diagram illustrating Quality of Service (QoS) management in a Linux system, as described in related technologies. Figure 2As shown, the `skb->tc_skip_classify` field determines whether traffic rectification is needed. If `skb->tc_skip_classify` is set to 0, the outbound (egress) TC filter is matched, and the successfully matched traffic is forwarded to the egress TC filter of the `ifb` interface. After rectification by the `qdisc` queuing rule of the `ifb` interface for traffic scheduling, the traffic is forwarded back to the network interface card (NIC) interface, and then `skb->tc_skip_classify` is set to 1. When the physical NIC interface detects that `skb->tc_skip_classify` is set to 1, it directly sends the traffic to the network protocol stack. Therefore, after rectification, the traffic skips other TC filters, failing to meet the requirement of passing through the outbound `ifb` interface for rectification before entering other filters on the physical NIC interface, thus reducing the efficiency of traffic processing.

[0045] Therefore, in this application, after determining the target filter, it is necessary to detect whether the target filter has already filtered the traffic. If the target filter has already filtered the traffic, the traffic is sent to other filters so that the other filters can filter the traffic when they determine that the other filters have not filtered the traffic. If the target filter has not filtered the traffic, the traffic is filtered and the filtered traffic is sent to other filters.

[0046] The target filter identifies the traffic that matches the target filter from the traffic received by the traffic receiving module. Then, it processes the traffic that matches the target filter based on the execution method corresponding to the target filter. For example, it sends the successfully matched traffic to the ifb.

[0047] The ifb driver simulates a virtual network interface card (NIC), which does not change the direction of traffic. That is, outgoing traffic is redirected to the ifb, and after the ifb's business processing, it is still sent out through the NIC before the redirection. For example, traffic received by a physical NIC is redirected to the ifb, and after the ifb's business processing, it is still received and processed by the physical NIC before the redirection.

[0048] The traffic control method of this application, when the traffic receiving module receives traffic sent by the virtual network card, if the traffic filtering flag corresponding to the traffic is set to an initial value, then the traffic is sent to the target filter on the physical network card that meets the preset conditions. Then, the target filter checks whether the traffic has been filtered. If so, the traffic is sent to other filters so that the other filters can filter the traffic if they determine that the traffic has not been filtered by other filters. If not, the traffic is filtered and the filtered traffic is sent to other filters so that the traffic only skips the filters that have performed the filtering operation, avoiding the traffic from missing the filtering operation and subsequent processing of other filters, thereby improving the service processing effect of the traffic.

[0049] In some implementations, sending traffic to a target filter on a physical network interface card that meets preset conditions includes: a traffic receiving module acquiring priority information for each filter; selecting a target filter that meets preset conditions from each filter based on the priority information for each filter; and sending traffic to the target filter that meets the preset conditions.

[0050] Priority information represents the traffic filtering priority of the filter. The priority information of the filter can be preset or calculated flexibly, such as calculating the priority of each filter based on the current traffic volume, IP address, routing path and other information. This application does not limit this.

[0051] Then, based on the priority information of each filter, a target filter is selected from each filter. For example, the filters are prioritized according to their priority information, and the filter with the highest priority in the priority ranking is selected as the target filter that meets the preset conditions, so that traffic is sent to the target filter that meets the preset conditions.

[0052] In some implementations, detecting whether a target filter has filtered the traffic includes: targeting the filter, obtaining a filter flag corresponding to the target filter, the filter flag being used to characterize the filtering status of the target filter and the traffic; and detecting whether the target filter has filtered the traffic based on the filter flag.

[0053] Add a filter label for each filter indicating whether it filters flow.

[0054] For example, the filter flags corresponding to the target filter may be stored in skb.

[0055] Add a filter flag to the skb to indicate the filtering status of traffic and filters. If the filter flag for traffic indicates that the traffic has not been filtered by the target filter, then the target filter filters the traffic. If the filter flag for traffic indicates that the traffic has been filtered by the target filter, then the target filter sends the traffic to other filters.

[0056] By adding filter flags, we can prevent traffic data from being missed during filtering operations and subsequent processing with other filters, thereby improving the processing efficiency of traffic data.

[0057] In some implementations, the filter flag is a string containing multiple flag bits; detecting whether the target filter has filtered traffic based on the filter flag includes: for the target filter, obtaining the flag bits corresponding to the target filter in the string; extracting the flag value corresponding to the flag bits, and detecting whether the flag value is a preset value. If yes, the target filter has filtered traffic; if no, the target filter has not filtered traffic.

[0058] The string contains multiple flags. Different flags can indicate the traffic filtering status of different filters, and the traffic filtering status can be represented by different flag values.

[0059] For example, the filter set contains target filter a, filter b, and filter c, with the filter flag "0x00010000". The flag bit corresponding to target filter a in the string is the 4th bit after string x. If the value of the 4th bit after x in "0x00010000" is detected as 1, where "1" indicates that filtering has been performed and "0" indicates that filtering has not been performed, it means that target filter a has already performed filtering operations on the traffic. In this case, target filter a skips filtering the traffic and instead sends the traffic to filter b or filter c.

[0060] In some implementations, filtering traffic and sending the filtered traffic to other filters includes: a target filter, obtaining the filtering rules corresponding to the target filter; filtering the traffic based on the filtering rules, and sending the filtered traffic to other filters.

[0061] The filtering rules corresponding to the filter are used to determine whether the traffic matches the filter. Different filtering rules can be configured in different filters. For example, the filtering rule can be to detect whether the traffic matches the destination Internet Protocol (IP) address, source IP address, destination port, source port, etc.

[0062] Filters are used to classify traffic. Target filters identify traffic from the received traffic that matches the filtering rules corresponding to the target filter, and then process the traffic based on the execution method corresponding to the target filter.

[0063] If the traffic matches the filtering rule corresponding to the target filter, it means that the traffic meets the filtering conditions specified by the filter, and a matching result of successful matching of the traffic and the filtering rule corresponding to the target filter is obtained; if the traffic does not match the filtering rule corresponding to the target filter, it means that the traffic does not meet the filtering conditions specified by the target filter, and a matching result of failed matching of the traffic and the filtering rule corresponding to the target filter is obtained.

[0064] Different processing is performed based on different matching results. For example, if the matching result shows that the traffic successfully matches the filtering parameters corresponding to the target filter, the traffic data is processed based on the execution method corresponding to the target filter. For example, the execution method corresponding to the target filter can be to allow the traffic to pass or send it to the specified ifb, etc. If the matching result shows that the traffic fails to match the filtering parameters corresponding to the target filter, the corresponding traffic data processing method can be to discard the traffic or refuse the traffic to pass, etc.

[0065] It is understood that the steps for other filters to perform flow filtering can be found in the steps for the target filter to perform flow filtering, and will not be repeated here.

[0066] In some implementations, the method further includes: if the filtering flag indicates that the traffic has matched all the filters in the physical network interface card, then the traffic is sent to the network protocol stack.

[0067] A protocol stack refers to the sum of all layers of protocols in a network. It vividly reflects the data transmission process in a network: from upper-layer protocols to lower-layer protocols, and then from lower-layer protocols to upper-layer protocols.

[0068] If the filtering flag indicates that the traffic has matched all the filters in the physical network interface card, then the traffic is sent to the network protocol stack for further transmission processing.

[0069] In some implementations, detecting whether the filtering flag indicates that the traffic has matched all the filters in the physical network interface card (NIC) can be done by detecting whether the filtering flag contains a filtered identifier corresponding to each filter in the physical NIC. For example, "1" indicates filtered and "0" indicates unfiltered. The default filtering flag corresponding to traffic that has not been matched by a filter is a preset string "0x00000000". The filters in the physical NIC include filter a and filter b. The flag position of filter a in the string is the 4th position after x, and the flag position of filter b in the string is the 5th position after x. If the filtering flag "0x00011000" is detected, it indicates that the traffic has matched all the filters in the physical NIC.

[0070] Please see Figure 3 , Figure 3This is a flowchart illustrating another exemplary embodiment of the flow control method of this application. This flow control method can be applied to a Linux operating system, specifically to a virtual network interface card (NIC). The following embodiments use a virtual NIC in a Linux operating system as an example to illustrate the flow control method provided in this application. It should be understood that this method can also be applied to other systems and executed by devices in other systems; this embodiment does not impose any limitations on this.

[0071] like Figure 3 As shown, in an exemplary embodiment, the flow control method includes at least steps S310 to S320, which are described in detail below:

[0072] Step S310: In response to the received traffic from the physical network card, perform service processing on the traffic.

[0073] The virtual network interface card is pre-configured with processing parameters for traffic. Based on these parameters, traffic is processed, such as delaying the traffic data by 500ms or compiling the traffic into bytecode.

[0074] Step S320: Keep the value of the traffic filtering flag corresponding to the traffic unchanged, and send the processed traffic and traffic filtering flag to the physical network card so that the physical network card can execute the method described in any of the above embodiments.

[0075] After the virtual network interface card (NIC) processes the received traffic, it maintains the value of the traffic filtering flag corresponding to the traffic unchanged, and sends the processed traffic and traffic filtering flag to the physical NIC, so that the physical NIC can continue the filtering process of the traffic.

[0076] In some implementations, the filtering flag of the filter corresponding to the virtual network interface card is modified after the virtual network interface card processes the received traffic.

[0077] For example, embodiments of this application employ Figure 4 The flowchart shown details how to modify the filter flags of the filter corresponding to the virtual network adapter, specifically including the following steps:

[0078] Step S410: Obtain the filtering flag of the target filter corresponding to the virtual network card. The filtering flag is used to characterize the filtering status of the target filter and the traffic.

[0079] Step S420: Modify the filter flags based on the target filter.

[0080] Step S430: Send the modified filter flag to the physical network card.

[0081] Understandably, different rules for setting filter flags will lead to different ways of modifying them.

[0082] For example, the filtered identifiers corresponding to each filter can be different. For instance, the filtered identifier for filter a is the name of filter a, and the filtered identifier for filter b is the name of filter b. By adding the name of the filter corresponding to the virtual network card to the filter flag, it is indicated that the filter has filtered the traffic.

[0083] For example, the filtered identifiers for each filter can be the same, but the way the filtered identifiers are added to the filter flags for different filters is different.

[0084] For example, the filter flag is a string containing multiple flag bits; modifying the filter flag based on the target filter includes: obtaining the flag bits corresponding to the target filter in the string; modifying the original values ​​in the flag bits to preset values ​​to obtain the modified string.

[0085] The filter corresponding to the virtual network card in the physical network card is used as the target filter. The flag bit corresponding to the target filter in the string is obtained, and the original value in the flag bit is modified to the preset value to obtain the modified string. The modified string is then sent to the physical network card.

[0086] For example, "1" is used to indicate that filtering has been performed, and "0" is used to indicate that filtering has not been performed. The filter flag is the preset string "0x00000000", and the filter corresponding to the virtual network card is the target filter a. The flag position of the target filter a in the preset string is the 4th position after x. If the original character "0" at this flag position is changed to "1", the modified filter flag will be "0x00010000".

[0087] In this application, filter flags can be added to the existing skb structure, or the mark or priority on the skb can be used as filter flags. This application does not limit this.

[0088] Next, taking a physical network interface card (NIC) containing a traffic scheduling filter and a traffic processing filter as an example, the traffic control method of this application will be explained:

[0089] For example, please refer to the specific steps. Figure 5Traffic is received by the traffic receiving module of the physical network card. When it first enters the physical network card interface, skb->tc_skip_classify is 0. According to the traffic receiving process in the Linux kernel source code, if skb->tc_skip_classify is 0, then it enters the TC filter matching stage. The highest priority filter is the traffic scheduling filter, so the traffic scheduling filter is used as the target filter.

[0090] The corresponding code snippet is:

[0091]

[0092] The traffic receiving module sends traffic to the traffic scheduling filter. If the traffic scheduling filter detects that the traffic has not been filtered, it enters the traffic filtering process and forwards the filtered traffic to the qdisc rectifier queue in the egress direction of the virtual network card ifb0. The pre-configured rectifier qdisc queue rectifies the traffic for traffic scheduling.

[0093] Then, after the traffic scheduling is completed, ifb0 redirects the traffic back to the physical network interface card. At this time, the skb->tc_skip_classify value of the traffic is not modified, that is, this value is still the initial value of 0 after the traffic scheduling rectification process. Instead, the filtering flag on the skb corresponding to the traffic is modified.

[0094] Taking the use of marks on skb as filtering flags as an example, the corresponding code snippet is as follows:

[0095] while((skb=__skb_dequeue(&txp->tq))!=NULL){

[0096] skb->redirected = 0;

[0097] skb->mark|=0x00010000;

[0098] u64_stats_update_begin(&txp->tsync);txp->tx_packets++;

[0099] txp->tx_bytes += skb->len;

[0100] u64_stats_update_end(&txp->tsync);

[0101] ...}

[0102] As shown in the code above, "1" indicates a match and "0" indicates no match. The filter flag is the preset string "0x00000000". The flag position corresponding to the traffic scheduling filter in the preset string is the 4th position after x. If the original character "0" at this flag position is changed to "1", the modified filter flag will be "0x00010000". By adding "skb->mark|=0x00010000", "0x00010000" indicates that the traffic scheduling filter has completed filtering with the traffic.

[0103] When traffic is forwarded back to the physical network interface card, since the skb->tc_skip_classify value corresponding to the traffic is still 0, the traffic continues to execute the TC filter matching process and sends the traffic to the highest priority traffic scheduling filter. The traffic scheduling filter determines that the filtering flag on the skb indicates that the traffic has been filtered, so the traffic scheduling filter will skip the filtering step and send the traffic to other filters, that is, to the traffic processing filter. In this way, the traffic can still be sent to other filters for traffic filtering after being rectified in the egress direction of the ifb0 interface.

[0104] The code snippet for skipping the traffic scheduling filter is as follows:

[0105]

[0106] The traffic processing filter can be an ingress eBPF filter, which sends traffic to the virtual network interface card (ifb1) corresponding to the ingress eBPF filter, allowing ifb1 to process the traffic as bytes. Therefore, this implementation method can avoid missing important filters such as the ingress eBPF filter while rectifying traffic. It can achieve the goal of skipping only filtered filters, rather than all filters, by simply adding a filter flag and keeping the value of the traffic filter flag unchanged.

[0107] In some implementations, please refer to Figure 6 , Figure 6 A schematic diagram of flow control is shown for another exemplary embodiment of this application, such as... Figure 6As shown, the physical network interface card (NIC) includes a traffic receiving module and multiple filters. The traffic receiving module receives traffic. If it determines that the traffic filtering flag corresponding to the traffic is at its initial value, it sends the traffic to the target filter (filter0). If the target filter (filter0) has not filtered the traffic, it filters the traffic and sends the successfully filtered traffic to the virtual NIC (ifb0). After processing the traffic, ifb0 sends the processed traffic back to the physical NIC, and at this time, ifb0 maintains the value of the traffic filtering flag corresponding to the traffic unchanged. After the traffic receiving module of the physical NIC receives the traffic sent by the virtual NIC, it detects that the value of the traffic filtering flag corresponding to the traffic is still at its initial value, and sends the traffic back to the target filter (filter0). If the target filter (filter0) detects that the traffic has already been filtered, it skips the target filter (filter0) and sends the traffic to other filters, such as filter1. Filter1 then checks whether the traffic has been filtered. If the traffic has not been filtered, filter1 filters the traffic. If the traffic has been filtered, filter1 is skipped again, and the traffic is sent to the next filter, until all filters indicate that the traffic has been filtered, ending the filtering process.

[0108] The traffic control method provided in this application, when the traffic receiving module receives traffic sent by the virtual network card, if the traffic filtering flag corresponding to the traffic is set to an initial value, sends the traffic to the target filter on the physical network card that meets the preset conditions. Then, the target filter checks whether the traffic has been filtered. If so, the traffic is sent to other filters so that other filters can filter the traffic if they determine that other filters have not filtered the traffic. If not, the traffic is filtered and the filtered traffic is sent to other filters so that the traffic only skips the filters that have performed the filtering operation, avoiding the traffic from missing filtering and subsequent processing by other filters, thereby improving the traffic service processing effect.

[0109] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of an embodiment of the electronic device of this application. The electronic device 700 includes a memory 701 and a processor 702. The processor 702 is used to execute program instructions stored in the memory 701 to implement the steps in any of the above-described flow control method embodiments. In a specific implementation scenario, the electronic device 700 may include, but is not limited to, a microcomputer or a server. In addition, the electronic device 700 may also include mobile devices such as laptops and tablets, which are not limited here.

[0110] Specifically, processor 702 controls itself and memory 701 to implement the steps in any of the above-described flow control method embodiments. Processor 702 can also be referred to as a CPU (Central Processing Unit). Processor 702 may be an integrated circuit chip with signal processing capabilities. Processor 702 can also be a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor can be a microprocessor or any conventional processor. Furthermore, processor 702 can be implemented using integrated circuit chips.

[0111] In the above scheme, when the traffic receiving module receives traffic sent by the virtual network card, if the traffic filtering flag corresponding to the traffic is set to an initial value, the traffic is sent to the target filter on the physical network card that meets the preset conditions. Then, the target filter checks whether the traffic has been filtered. If so, the traffic is sent to other filters so that other filters can filter the traffic if they determine that other filters have not filtered the traffic. If not, the traffic is filtered and the filtered traffic is sent to other filters so that the traffic only skips the filters that have performed the filtering operation, avoiding the traffic from being missed by other filters and subsequent processing, thereby improving the traffic service processing effect.

[0112] Please see Figure 8 , Figure 8 This is a schematic diagram of a computer-readable storage medium according to an embodiment of the present application. The computer-readable storage medium 800 stores program instructions 810 that can be executed by a processor. The program instructions 810 are used to implement the steps in any of the above-described flow control method embodiments.

[0113] In the above scheme, when the traffic receiving module receives traffic sent by the virtual network card, if the traffic filtering flag corresponding to the traffic is set to an initial value, the traffic is sent to the target filter on the physical network card that meets the preset conditions. Then, the target filter checks whether the traffic has been filtered. If so, the traffic is sent to other filters so that other filters can filter the traffic if they determine that other filters have not filtered the traffic. If not, the traffic is filtered and the filtered traffic is sent to other filters so that the traffic only skips the filters that have performed the filtering operation, avoiding the traffic from being missed by other filters and subsequent processing, thereby improving the traffic service processing effect.

[0114] In some embodiments, the functions or modules of the apparatus provided in this disclosure can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0115] The description of the various embodiments above tends to emphasize the differences between the various embodiments. The similarities or similarities between them can be referred to, and for the sake of brevity, they will not be repeated here.

[0116] In the several embodiments provided in this application, it should be understood that the disclosed methods and apparatus can be implemented in other ways. For example, the apparatus implementations described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0117] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A flow control method, characterized in that, The method is applied to a physical network interface card (NIC), which includes a traffic receiving module and at least one filter. The method includes: When the traffic receiving module receives traffic sent by the virtual network card, if the traffic filtering flag corresponding to the traffic is set to an initial value, the traffic is sent to the target filter on the physical network card that meets the preset conditions. The target filter detects whether it has already filtered the traffic. If so, it sends the traffic to other filters so that the other filters can filter the traffic if they determine that they have not filtered it. If not, it filters the traffic and sends the filtered traffic to the virtual network interface card (NIC). The virtual NIC processes the traffic and then sends the processed traffic back to the physical NIC, maintaining the value of the traffic filtering flag corresponding to the traffic unchanged. The physical NIC then sends the traffic to other filters. The filtering process ends when all filters indicate that they have filtered the traffic.

2. The method according to claim 1, characterized in that, Sending the traffic to a target filter on the physical network card that meets preset conditions includes: The traffic receiving module acquires priority information for each filter; based on the priority information of each filter, selects a target filter that meets preset conditions from each filter; and sends the traffic to the target filter that meets the preset conditions.

3. The method according to claim 1, characterized in that, The step of detecting whether the target filter has filtered the traffic includes: The target filter acquires a filter flag corresponding to the target filter, the filter flag being used to characterize the filtering status of the target filter and the flow; based on the filter flag, it is detected whether the target filter has filtered the flow.

4. The method according to claim 3, characterized in that, The filtering flag is a string containing multiple flag bits; the step of detecting whether the target filter has filtered the traffic based on the filtering flag includes: The target filter obtains the flag bit corresponding to the target filter in the string; extracts the flag value corresponding to the flag bit, and detects whether the flag value is a preset value. If yes, the target filter has filtered the traffic; if no, the target filter has not filtered the traffic.

5. The method according to claim 1, characterized in that, The filtering of the traffic includes: The target filter is configured to obtain the corresponding filtering rules; the traffic is then filtered based on the filtering rules.

6. A flow control method, characterized in that, The method is applied to a virtual network interface card (NIC), and the method includes: In response to the traffic received from the physical network interface card, the traffic is processed for services. The value of the traffic filtering flag corresponding to the traffic is kept unchanged, and the processed traffic and the traffic filtering flag are sent to the physical network card so that the physical network card performs the method of any one of claims 1 to 5.

7. The method according to claim 6, characterized in that, The method further includes: Obtain the filtering flag of the target filter corresponding to the virtual network interface card, the filtering flag being used to characterize the filtering status of the target filter and the traffic; Modify the filter flag based on the target filter; The modified filter flag is sent to the physical network card.

8. The method according to claim 7, characterized in that, The filter flag is a string containing multiple flag bits; the modification of the filter flag based on the target filter includes: Obtain the flag bit corresponding to the target filter in the string; The original value in the flag bit is modified to a preset value to obtain the modified string.

9. An electronic device, characterized in that, It includes a memory and a processor, the processor being configured to execute program instructions stored in the memory to implement the method of any one of claims 1 to 8.

10. A computer-readable storage medium having program instructions stored thereon, characterized in that, When the program instructions are executed by the processor, they implement the method described in any one of claims 1 to 8.

Images