A traffic traction configuration method and device, electronic equipment and storage medium

Abstract

The application discloses a flow traction configuration method and device, electronic equipment and storage medium. The method comprises the following steps: determining a flow path of a data packet according to a preset flow mode; setting a data packet mark for the data packet according to the flow path; according to the data packet mark and a preset routing rule, the data packet is tracted to a traction target for processing; and according to the data packet mark and the preset routing rule, the processed data packet is tracted to a target address. Through setting a data packet mark for the data packet according to the flow path, and according to the data packet mark and the preset routing rule, the data packet is tracted to the traction target and the target address in sequence, a plurality of flow traction modes are supported, the flow can be tracted without a large number of connection records and corresponding network configurations, the system memory and computing power are reduced, and the maintenance cost of technicians is reduced.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a configuration method, apparatus, electronic device, and storage medium for flow traction. Background Technology

[0002] With the rise of cloud computing, cloud platforms need to protect network traffic by using Internet Protocol (IP), physical machines, virtual hosts, and other resources. This includes protecting not only north-south traffic but also east-west traffic.

[0003] Existing traffic redirection methods require a large number of connection records and corresponding network configurations to achieve traffic redirection, which increases the maintenance costs for technicians, consumes a lot of system memory and computing power, and reduces network throughput. Summary of the Invention

[0004] This invention provides a traffic redirection configuration to set data packet tags according to the redirection path, and to redirect data packets to the redirection target and target address sequentially according to the data packet tags and preset routing rules. It can support multiple traffic redirection modes, and does not require a large number of connection records and corresponding network configurations to achieve traffic redirection. It can reduce the occupation of system memory and computing power, and reduce the maintenance costs for technicians.

[0005] According to one aspect of the present invention, a method for configuring flow traction is provided, the method comprising:

[0006] The data packet routing path is determined according to the preset routing mode;

[0007] Set data packet tags according to the traffic redirection path;

[0008] Data packets are guided to their target for processing based on packet tags and preset routing rules;

[0009] The processed data packets are directed to the target address based on packet tags and preset routing rules.

[0010] According to another aspect of the present invention, a flow traction configuration device is provided, the device comprising:

[0011] The path determination module is used to determine the traffic path of data packets according to a preset traffic redirection mode;

[0012] The tag setting module is used to set data packet tags according to the traffic redirection path;

[0013] The first routing module is used to guide data packets to the target for processing based on data packet markings and preset routing rules.

[0014] The second routing module is used to guide the processed data packets to the target address according to the data packet marking and preset routing rules.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the flow-driving configuration method according to any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the flow-driving configuration method according to any embodiment of the present invention.

[0020] The technical solution of this invention determines the traffic redirection path of data packets according to a preset traffic redirection mode, sets data packet tags according to the traffic redirection path, guides the data packets to the redirection target for processing according to the data packet tags and preset routing rules, and guides the processed data packets to the target address according to the data packet tags and preset routing rules. This invention supports multiple traffic redirection modes by setting data packet tags according to the traffic redirection path and guiding data packets to the redirection target and target address sequentially according to the data packet tags and preset routing rules. It does not require a large number of connection records and corresponding network configurations to achieve traffic redirection, reducing system memory and computing power consumption and lowering maintenance costs for technical personnel.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a flow traction configuration method provided according to Embodiment 1 of the present invention;

[0024] Figure 2 This is a flowchart of a flow traction configuration method according to Embodiment 2 of the present invention;

[0025] Figure 3 This is an example diagram of a traffic-driven network model provided in Embodiment 3 of the present invention;

[0026] Figure 4 This is an example diagram of another traffic-driven network model provided in Embodiment 3 of the present invention;

[0027] Figure 5a and Figure 5b This is a flowchart of a flow traction configuration method according to Embodiment 4 of the present invention;

[0028] Figure 6a and Figure 6b This is a flowchart of a flow traction configuration method according to Embodiment 5 of the present invention;

[0029] Figure 7 This is a schematic diagram of the configuration device for flow traction according to Embodiment Six of the present invention;

[0030] Figure 8 This is a schematic diagram of the structure of an electronic device that implements the flow traction configuration method of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] Example 1

[0034] Figure 1 This is a flowchart illustrating a traffic redirection configuration method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where traffic redirection is configured for data packets. The method can be executed by a traffic redirection configuration device, which can be implemented in hardware and / or software. Figure 1 As shown in the figure, the configuration method for traffic traction provided in this embodiment includes the following steps:

[0035] S110. Determine the data packet routing path according to the preset routing mode.

[0036] The preset traffic redirection mode can be a pre-configured method for redirecting data packets. Preset traffic redirection modes can include east-west and north-south traffic redirection modes, etc. The east-west traffic redirection mode refers to the data packet redirection mode for communication between hosts within their respective intranets. East-west data packets can include data packets transmitted between different hosts within the same Virtual Private Cloud (VPC), or data packets transmitted between different hosts located in different VPCs. The north-south traffic redirection mode refers to the data packet redirection mode for communication between a host and the external network (Internet). It should be understood that the host mentioned in this embodiment can be understood as a device used to run services. This host can be a cloud host, i.e., a virtual machine (VM) on a cloud platform, or the physical machine where the VM resides, or other devices running services. This embodiment does not impose any limitations on this. The traffic redirection path can be understood as the data transmission path of data packets during the traffic redirection process.

[0037] In this embodiment of the invention, a preset traffic redirection mode can be configured according to the business requirements of the data packet and the needs of the cloud platform or user. The preset traffic redirection mode may include an east-west traffic redirection mode and a north-south traffic redirection mode, etc. Then, the source address and destination address corresponding to the data packet can be obtained from the preset routing configuration file or the data packet encapsulation, and the traffic redirection path corresponding to the data packet can be set according to the source address and destination address. In some embodiments, multiple preset traffic redirection modes can be pre-configured according to business requirements, and then the data packet is parsed to extract the corresponding source address and destination address. The various network devices through which the data packet passes, such as network cards, traffic redirection modules, and redirection targets, are determined according to the source address and destination address, and then the traffic redirection path corresponding to the data packet is configured.

[0038] S120. Set data packet tags according to the traffic path.

[0039] Among them, packet tagging can be understood as tagging information used to characterize the packet redirection status. For example, packet tagging can identify whether the packet has been processed by the redirection target, whether it has been redirected, and whether it has undergone network address translation, etc.

[0040] In this embodiment of the invention, the packet marking tools built into the Linux system kernel, such as the Linux system kernel's built-in Traffic Control (TC) module and / or IPv4 packet management module (iptables), can be used to set corresponding packet markings for packets according to the diversion path. For example, different flag bits of the packet marking can be configured with corresponding diversion information. That is, packet marking can be used to identify whether the packet has been processed by the diversion target, whether it has been diverted, and whether it has undergone network address translation, etc.

[0041] S130. Guide data packets to the target for processing according to data packet marking and preset routing rules.

[0042] The preset routing rules can be understood as pre-configured rules for controlling data packet routing. These rules may include information such as routing object identifiers and routing policies. Using these rules, data packets can be directed to their corresponding destination and final address. The routing object identifier can be a number corresponding to the destination; data packets can be directed to the corresponding destination based on the identifier. The destination can refer to a security device used for security protection of data packets. Destination targets may include various security instances (cloud hosts with security engine software installed) or other physical security devices, such as physical firewalls. This embodiment of the invention does not impose any limitations on this.

[0043] In this embodiment of the invention, routing configuration information matching the data packet tag can be found within pre-configured routing rules on the electronic device based on the data packet tag. The data matching method may not be limited to fuzzy matching or string matching. The destination address of the data packet is then modified using the routing configuration information, thereby correctly redirecting the data packet to the corresponding redirection target for security protection processing. The data packet security processing may include, but is not limited to, abnormal traffic monitoring, traffic filtering, and traffic cleaning. Furthermore, if there are multiple redirection targets, corresponding routing configurations can be made for each data packet and each redirection target, thereby distributing the data packet to different redirection targets for processing to achieve load balancing.

[0044] S140. Guide the processed data packets to the destination address according to the data packet label and preset routing rules.

[0045] The destination address can refer to the Internet Protocol (IP) address and Media Access Control Address (MAC) of the device receiving the data packet.

[0046] In this embodiment of the invention, since the target address of the data packet changes during the process of being redirected to the redirection target, it is necessary to first determine the target address of the data packet, and then search for routing configuration information that matches the data packet tag within the preset routing rules pre-configured on the electronic device according to the data packet tag. The routing configuration information is then used to correctly redirect the data packet to the target address. When the processed data packet is returned to the target address, a non-redirection flag can be set on the data packet tag to prevent the data packet from undergoing redirection again, thus preventing a loop. Furthermore, after the business logic is executed at the receiving end of the data packet, it can return along the original redirection path, that is, the response data packet is first redirected to the redirection target, and then the securely processed data packet is sent back to the original data packet sender.

[0047] The technical solution of this invention determines the traffic redirection path of data packets according to a preset traffic redirection mode, sets data packet tags according to the traffic redirection path, guides the data packets to the redirection target for processing according to the data packet tags and preset routing rules, and guides the processed data packets to the target address according to the data packet tags and preset routing rules. This invention supports multiple traffic redirection modes by setting data packet tags according to the traffic redirection path and guiding data packets to the redirection target and target address sequentially according to the data packet tags and preset routing rules. It does not require a large number of connection records and corresponding network configurations to achieve traffic redirection, reducing system memory and computing power consumption and lowering maintenance costs for technical personnel.

[0048] Example 2

[0049] Figure 2 This is a flowchart of a traffic-driving configuration method provided in Embodiment 2 of the present invention. It is further optimized and extended based on the above embodiments and can be combined with various optional technical solutions in the above embodiments. For example... Figure 2 As shown in the figure, the flow traction configuration method provided in this embodiment includes the following steps:

[0050] S210. Query the source and destination addresses of data packets in the preset routing configuration file according to the preset traffic redirection mode.

[0051] In this embodiment of the invention, the preset routing configuration file can be a pre-configured file for configuring data packet routing. The preset routing configuration file may include information such as the source address, destination address, and routing configuration of the data packets.

[0052] Specifically, one or more preset routing configuration files can be pre-configured on the electronic device. Based on the set preset routing patterns, the source and destination addresses corresponding to the data packets requiring routing can be queried from the preset routing configuration files. The preset routing patterns can include at least east-west and north-south routing patterns. In some embodiments, a data matching operation can be performed between the preset routing pattern of the data packet and the routing pattern in the preset routing configuration file. The data matching method can be, but is not limited to, fuzzy matching or string matching, to find the source and destination addresses corresponding to the data packets requiring routing.

[0053] S220. Set the redirection path according to the source address and the destination address.

[0054] In this embodiment of the invention, a corresponding diversion path can be set according to the source address and destination address of the data packet that needs to be diverted. For example, for the data packet that needs to be diverted, it can first be diverted to the diversion target for security protection processing, and then the processed data packet can be transmitted to the final destination address.

[0055] S230, Obtain the business requirements for the corresponding data packet.

[0056] Among them, business requirements can refer to the traffic redirection requirements of data packets, which may include information such as data packet redirection, network address translation, and traffic redirection targets.

[0057] In this embodiment of the invention, business requirements corresponding to data packets can be found by pre-storing documents containing business requirements on a local or cloud server. Based on these business requirements, information such as whether the data packet needs to be redirected, whether network address translation is required, and the selection of the redirection target can be understood.

[0058] S240. Set the data packet tags according to the traffic redirection path and business requirements.

[0059] In this embodiment of the invention, the packet marking tools built into the Linux system kernel can be used, such as including but not limited to: the flow control module (TC) and / or the IPv4 packet management module (iptables) built into the Linux system kernel, to set corresponding packet markings for packets according to the diversion path and business requirements. Different diversion information can be configured for different flag bits of the packet marking. That is, packet marking can be used to identify whether the packet has been processed by the diversion target, whether it has been diverted, and whether it has undergone network address translation, etc.

[0060] Furthermore, based on the above embodiments of the invention, the setting of the data packet marker includes at least one of the following:

[0061] When the first flag bit is set, it indicates that the data packet has been processed by the towing target;

[0062] When the second flag is set, it indicates that the data packet is not redirected;

[0063] When the third flag is set, it indicates that the data packet is undergoing source address translation;

[0064] When the fourth flag bit is set, it indicates that the data packet is undergoing destination address translation;

[0065] When the fifth flag is set, it indicates that the data packet is being diverted, and this applies only to north-south diversion mode.

[0066] If the sixth and seventh flag bits are set, it indicates that the bits are reserved.

[0067] When the eighth flag is set, it indicates a routing object;

[0068] When the ninth to sixteenth identifier bits are set, it indicates the number of the towing target.

[0069] S250. Determine the network namespace associated with the traction target.

[0070] The network namespace (Linux network namespace, netns) can be understood as a virtualization technology used to isolate network devices and protocol stacks. In this embodiment of the invention, data packets can be first directed to the network namespace to avoid data packets that may pose an abnormal risk being sent directly to the application on the business host.

[0071] In this embodiment of the invention, the network namespace associated with the towing target can be found in the configuration file or data table pre-configured on the electronic device. A network namespace can be associated with one or more towing targets. That is, data packets passing through the network namespace can be towed to the associated towing target for security protection according to the routing configuration.

[0072] S260. Redirect the data packet to the first network interface card (NIC) in the network namespace according to the data packet tag, and then send the data packet to the second NIC in the network namespace through the first NIC.

[0073] Redirection can be understood as interrupting the original transmission path of a data packet, thereby directly transmitting the data packet to the specified target device. The first network interface card (NIC) and the second NIC can be a pair of Virtual Ethernet Interface (VETH) type network devices. The first NIC and the second NIC can be located outside and inside the network namespace, respectively, and the first NIC and the second NIC have the following characteristics: data packets entering the first NIC will necessarily flow out through the second NIC, and data packets entering the second NIC will necessarily flow out through the first NIC.

[0074] In this embodiment of the invention, a pair of VETH type virtual network interfaces can be configured for the network namespace first. Then, the packet redirection tools such as the flow control module (TC) and / or IPv4 packet management module (iptables) built into the Linux system kernel can be used to redirect the packets to the first network interface in the network namespace according to the packet tags. Then, taking advantage of the fact that the first and second network interfaces are a pair of VETH type virtual network interfaces, the packets passing through the first network interface are sent to the second network interface in the network namespace.

[0075] S270. Search for the route object identifier that matches the packet tag within the preset routing rules.

[0076] In this embodiment of the invention, a routing object identifier matching the data packet marker can be found within a pre-configured routing rule on the electronic device. The data matching method is not limited to fuzzy matching or string matching. Using the pre-configured routing rule and the routing object identifier, the data packet can be correctly directed to the corresponding routing target and the final destination address. It should be understood that if there are multiple routing targets, each target can be numerically numbered first, then an offset can be calculated using a hash function. Furthermore, the pre-configured routing rule can be used to distribute the data packet to the routing target with the numerical number corresponding to the offset for processing, thereby achieving load balancing.

[0077] S280. Modify the destination address of the data packet at the second network card according to the routing object identifier.

[0078] In this context, the destination address of the data packet at the second network card can refer to the IP address and MAC address corresponding to the target being towed.

[0079] In this embodiment of the invention, packet redirection tools such as the flow control module (TC) and / or IPv4 packet management module (iptables) built into the Linux system kernel can be used to modify the destination address of the packet at the second network card according to the routing object identifier, so that the packet is correctly redirected to the redirection target for security protection processing.

[0080] S290. Transmit the data packet to the traction target based on the modified target address.

[0081] S2100, Determine the destination address of the processed data packet.

[0082] Here, the destination address of the processed data packet can be understood as the destination address of the original receiving data packet's service host (i.e., the service side).

[0083] In this embodiment of the invention, the methods for determining the destination address of the processed data packet may include, but are not limited to, the following: the destination address of the original data packet can be found in the preset routing configuration file in S210; or the destination address of the data packet before network address translation can be found in the preset routing rules. This embodiment of the invention does not limit this.

[0084] S2110. Redirect the data packet to the second network interface card (NIC) in the network namespace according to the data packet tag, and then send the data packet to the first NIC through the second NIC.

[0085] In this embodiment of the invention, the flow control module (TC) and / or IPv4 packet management module (iptables) built into the Linux system kernel can be used to redirect the processed data packets to the second network interface card in the network namespace according to the data packet tags. Then, taking advantage of the fact that the first network interface card and the second network interface card are a pair of VETH type virtual network interfaces, the data packets passing through the second network interface card are sent to the first network interface card.

[0086] S2120, Set the non-redirect flag for data packets at the first network card.

[0087] Setting the non-traffic flag bit can mean setting the flag bit in the data packet marker that indicates whether traffic needs to be redirected to non-traffic. For example, the flag bit in the data packet marker that indicates whether traffic needs to be redirected can be set to 1, so that no further traffic redirection processing will be performed on the data packet.

[0088] In this embodiment of the invention, the flow control module (TC) and / or IPv4 packet management module (iptables) built into the Linux system kernel can be used to set a non-redirection flag for packets that have already undergone security protection at the first network card. This can prevent subsequent packets from undergoing redirection processing, thus avoiding loop situations caused by subsequent packets being redirected to the network namespace again.

[0089] S2130. Transmit the data packet with the non-traffic flag set to the target address according to the data packet tag.

[0090] In this embodiment of the invention, after setting a non-traffic flag for data packets at the first network interface card, the security-protected data packets can be sent to the target address according to the data packet marking. Furthermore, after the business logic is executed at the data packet receiving end, the original traffic redirection path can be followed, i.e., from the original data packet receiving end -> network namespace -> traffic target -> network namespace -> original data packet sending end.

[0091] The technical solution of this invention involves querying the source and destination addresses of data packets in a preset routing configuration file according to a preset diversion mode, setting a diversion path according to the source and destination addresses, obtaining the service requirements of the corresponding data packets, setting data packet tags according to the diversion path and service requirements, determining the network namespace associated with the diversion target, redirecting the data packets to the first network interface card (NIC) in the network namespace according to the data packet tags, and sending the data packets to the second NIC in the network namespace via the first NIC. The solution also involves searching for a routing object identifier matching the data packet tags within preset routing rules, modifying the destination address of the data packets at the second NIC according to the routing object identifier, transmitting the data packets to the diversion target based on the modified destination address, determining the destination address of the processed data packets, redirecting the data packets to the second NIC in the network namespace according to the data packet tags, sending the data packets to the first NIC via the second NIC, setting a non-diversion flag for the data packets at the first NIC, and transmitting the data packets with the non-diversion flag set to the destination address according to the data packet tags. This invention supports multiple traffic redirection modes. It does not require a large number of connection records and corresponding network configurations to achieve traffic redirection, thereby reducing the use of system memory and computing power and lowering the maintenance costs for technical personnel.

[0092] Example 3

[0093] Figure 3 This is an example diagram of a traffic-driven network model provided in Embodiment 3 of the present invention. Figure 3 As shown, the network model includes: physical machines, namely host1 and host2; cloud hosts VM1, VM2, VM3 and VM4; traffic traction modules tt1 and tt2; traction targets DST1 and DST2; user network; and traction target network.

[0094] In this embodiment of the invention, the user network can refer to the network through which cloud hosts communicate. For example, VM1 is in user network 1, VM2 is in user network 2, and VM3 and VM4 are all in user network 3. The user network can be a Layer 2 or Layer 3 network. A Layer 2 network means that they can communicate with each other within the same network, while a Layer 3 network means that they can communicate with each other between different networks. This embodiment of the invention does not impose any restrictions on this.

[0095] Traffic redirection modules tt1 and tt2 are functional modules with traffic redirection capabilities, i.e., network namespaces. A traffic redirection module can include one or more pairs of VETH-type virtual network interfaces. Using these VETH-type virtual network interfaces, data packets requiring redirection can be redirected to the traffic redirection module.

[0096] DST1 and DST2 can refer to the target machines for traffic redirection. The target machines can include various network protection devices, such as virtual machines or physical machines with security protection functions.

[0097] The target network can refer to a Layer 2 network that connects the traffic traction module and the target. The target network can include a physical network or a virtual network created using Software Defined Network (SDN) technology. There can be one or more target networks, and this embodiment of the invention does not limit this.

[0098] Figure 4 This is an example diagram of another traffic-driven network model provided in Embodiment 3 of the present invention. Figure 4 As shown, VM1 and VM2 represent the user's cloud hosts. Each of these cloud hosts is connected to the user's network, which could be a Layer 2 or Layer 3 network. It's important to understand that... Figure 4 The two cloud hosts VM1 and VM2 are set up on the same physical machine. In practical applications, the two cloud hosts VM1 and VM2 can be deployed on different physical machines. This embodiment of the invention does not impose any restrictions on this.

[0099] A bridge can refer to a communication medium between different cloud hosts (east-west direction) or between a cloud host and the external Internet (north-south direction). In practical applications, communication between two cloud hosts can be a network type such as Virtual Local Area Network (VLAN) or Virtual eXtensible Local Area Network (VxLAN). Virtual networks of the above network modes can be created using SDN technology.

[0100] The network interface card eth0 is used by cloud hosts VM1 and VM2 to communicate with the outside world. The network interface card name displayed on the physical machine may not be eth0. For example, it may be a virtual network device of type VETH, Tap, or Tun. This embodiment of the invention does not limit this. Figure 4 The network cards tap0 and tap1 in the diagram are the network cards used by cloud hosts VM1 and VM2 to communicate with the outside world.

[0101] A network namespace can be a network namespace instance.

[0102] The network interface card (if0, if0p) is a pair of VETH type virtual network interface cards. Its characteristic is that if a data packet is received at one end, it will always come out from the other end. Among them, the network interface card if0 is connected to the bridge, and the network interface card if0p is set in the network namespace.

[0103] A cloud firewall security instance represents a target that performs security protection processing on data packets.

[0104] The target network is a Layer 2 network connecting the cloud firewall security instance and the network namespace. It can be a virtual network using SDN or a physical network. The network interface card (NIC) if.x resides within the network namespace and is connected to the target network.

[0105] Before traffic redirection, the data packet (i.e., east-west) transmission path between cloud hosts VM1 and VM2 is: network interface VM1.eth0 <-> VM1.bridge <-> VM2.bridge <-> network interface VM2.eth0.

[0106] After the traffic redirection operation, the data packet (i.e., east-west) transmission path between cloud hosts VM1 and VM2 is: network interface VM1.eth0 -> network interface if0 -> network interface if0p -> network interface if.x -> target network -> cloud firewall security instance -> target network -> network interface if.x -> network interface if0p -> network interface if0 -> VM1.bridge -> VM2.bridge -> network interface VM2.eth0, and the return path is the same.

[0107] Before traffic redirection, the data packet (i.e., north-south) transmission path between the cloud host VM1 and the external Internet is: network card VM1.eth0 <-> VM1.bridge <-> external Internet.

[0108] After the traffic redirection operation, the data packet transmission path (i.e., north-south) between the cloud host VM1 and the external Internet is as follows: network interface vm1.eth0 -> network interface if0 -> network interface if0p -> network interface if.x -> target network -> cloud firewall security instance -> target network -> network interface if.x -> network interface if0p -> network interface if0 -> VM1.bridge -> external Internet. The return path is the same.

[0109] The two traffic-driving network models proposed in this invention support multiple traffic-driving modes. The traffic-driving module works independently, avoiding single points of failure and high availability issues. Furthermore, the traffic-driving module and the traffic-driving target are easily modularized, reducing maintenance costs.

[0110] Example 4

[0111] This invention can utilize the flow control module (TC), IPv4 packet management module (iptables), and routing policy management module (ip rule) built into the Linux system kernel for traffic redirection configuration. The flow control module (TC) is used for packet redirection, packet editing, and packet marking, the IPv4 packet management module (iptables) is used for packet marking and generating connection records, and the routing policy management module (ip rule) is used to configure routes based on packet markings and send them to the target device.

[0112] In this embodiment of the invention, the data packet marker can occupy 16 bits, and the bit settings of the data packet marker from left to right are as follows:

[0113] When the first flag bit is set, it indicates that the data packet has been processed by the towing target;

[0114] When the second flag is set, it indicates that the data packet is not redirected;

[0115] When the third flag is set, it indicates that the data packet is undergoing source address translation;

[0116] When the fourth flag bit is set, it indicates that the data packet is undergoing destination address translation;

[0117] When the fifth flag is set, it indicates that the data packet is being diverted, and this applies only to north-south diversion mode.

[0118] If the sixth and seventh flag bits are set, it indicates that the bits are reserved.

[0119] When the eighth flag is set, it indicates a routing object;

[0120] When the ninth to sixteenth identifier bits are set, it indicates the number of the towing target.

[0121] Furthermore, the requirement for source address translation (NAT) or destination address translation (DOT) in data packets can be configured according to actual needs. In this embodiment of the invention, when the preset traffic redirection mode is east-west, all cloud hosts are assumed to be in the same tenant network, meaning NAT is not required. When the preset traffic redirection mode is north-south, if both the source and destination addresses of the data packet belong to the tenant network, NAT is not required. If the source address of the data packet is the tenant network and the destination address is a non-tenant network, the source address translation flag in the data packet marker is set. If the source address of the data packet is a non-tenant network and the destination address is the tenant network, the destination address translation flag in the data packet marker is set. The purpose of this operation is to allow the cloud firewall security instance to record actual Internet session information, rather than private IP to Internet IP sessions. It should be understood that not performing NAT on data packets does not affect the implementation of this embodiment of the invention. NAT can be performed on data packets according to actual conditions, and this embodiment of the invention does not impose any restrictions on this.

[0122] Next, the embodiments of the present invention will be discussed. Figure 4 The configurations of network interface card if0, network namespace, and network interface card tap0 will be explained separately.

[0123] 1. Configuration of network card if0 for routing traffic (data packets entering the physical machine, i.e., the host machine)

[0124] 1-1. Set all IP protocol packets to "No redirection". By setting the packet flag to "No redirection", packets will not be redirected when sent to the network card tap0, thus preventing loops.

[0125] 1-2. Set the system to ignore and not process any data packets that match the "No Traffic Required" flag. It is important to understand that between the traffic redirection configurations in 1-1 and 1-2 above, you can set the flags for relevant data packets according to actual needs to achieve certain special scenarios or customized requirements.

[0126] 1-3. When setting the destination IP of a data packet to the resource IP of the application object being redirected, connection records (linuxconntrack) are not required. That is, when the business target replies to the virtual machine, no connection record needs to be generated for data packets flowing through network interface if0, because network interface tap0 has already generated connection records, so network interface if0 does not need to generate additional connection records.

[0127] 2. Network namespace traffic redirection configuration

[0128] 2-1. Create an ipset (IP set) to record tenant network information. The tenant network is known to the cloud platform.

[0129] 2-2. Configure Routing Rules. Data packets need to be routed to the target, i.e., the cloud firewall security instance. When there are multiple cloud firewall security instances, multiple routing rules need to be configured accordingly. The cloud firewall security instances can be numbered, and then an offset can be calculated using a hash function. The routing rules can then be configured to distribute data packets to the target numbered corresponding to the offset for processing, thus achieving load balancing. For example, if the offset calculated by the hash is 1, representing cloud firewall security instance number 1, then the corresponding data packet tag is 0x8100 + 1 = 0x8101. The routing rules will pre-configure the routing policy corresponding to the 0x8101 tag. This allows data packets to be distributed to different routes, i.e., different target instances (cloud firewall security instances), based on the hash calculation, thereby achieving load balancing.

[0130] 2-3. Configuration of if0p network card for routing traffic (data packets entering the network namespace)

[0131] A. Configure packet dropping rules. When network interface card (NIC) if0 is configured on a bridge, if0 often receives broadcast or multicast packets. NIC if0p will also receive these packets. These packets can be configured to be dropped without processing. The process can be: 1) Mark broadcast and multicast packets with a "do not redirect" flag; 2) Discard packets matching the "do not redirect" flag. Furthermore, cloud platforms or users can customize settings to prevent redirection for certain IPs, communication protocols, and ports.

[0132] B. Calculate / query the routing object identifier. The routing object identifier of the target can be obtained through hash calculation. When there are multiple target cloud firewall security instances, this method can achieve load balancing. Furthermore, you can choose to enable connection record generation (Linux conntrack) here as needed. This way, subsequent data packets can directly query the connection record to obtain the routing object identifier, eliminating the need for hash calculation for each data packet.

[0133] C. Set NAT tags for data packets. Customizable policies can be configured to determine whether data packets require source or destination address translation.

[0134] 2-4. Network interface card (if.x) redirection configuration (data packets leaving the network namespace)

[0135] A. Packet Editing. Addresses can be modified based on NAT flags in the packet tags. For example, if a source address translation flag is matched, the source address of the packet is modified; if a destination address translation flag is matched, the destination address of the packet is modified. The checksum is recalculated and modified after address modification.

[0136] 2-5. Network interface card (if.x) traffic redirection configuration (data packets entering the network namespace)

[0137] A. Packet Editing and Redirection. This section covers the following scenarios, which have priorities and are configured according to priority as follows:

[0138] Scenario 1: If the target address is the virtual machine IP, then modify the target MAC address to the MAC address of network card if0, and then redirect the data packet to network card if0p.

[0139] Scenario 2: If the target address is the virtual machine's NAT IP, then modify the target IP address to the virtual machine's IP address to restore the IP address before NAT. Next, modify the target MAC address to the MAC address of network interface if0, then recalculate and modify the checksum value, and finally redirect the data packet to network interface if0p.

[0140] Scenario 3: If the source address is the virtual machine IP, then modify the target MAC address to the MAC address of network card if0, and then redirect the data packet to network card if0p.

[0141] Scenario 4: If the source address is the virtual machine's NAT IP, then modify the source IP address to the virtual machine's IP address to restore the IP address before NAT. Next, modify the target MAC address to the MAC address of network interface if0, then recalculate and modify the checksum value, and finally redirect the data packet to network interface if0p.

[0142] 3. Traffic redirection configuration for network card tap0 (taking data packets entering the physical machine, i.e., the host machine, as an example)

[0143] 3-1. Determining the Traffic Diversion Mode. In this embodiment of the invention, three traffic diversion modes can be supported: "East-West Only," "North-South Only," and "All-Round Support." For the "East-West Only" traffic diversion mode, traffic diversion configuration can be based on the tenant network. For the cloud platform, the tenant network is managed by the cloud platform, so it is known. For the "North-South Only" traffic diversion mode, a rule marking "Traffic Diversion Required" can be set first, and all IP protocol traffic can be marked as needing diversion based on IP address and MAC address. Then, a rule marking "Traffic Diversion Not Required" can be set, and all IP protocol traffic can be set as not needing diversion based on the tenant network. Finally, a traffic diversion rule can be set to perform the diversion operation if the data packet is marked "Traffic Diversion Required." For the "All-Round Support" traffic diversion mode, traffic diversion configuration can be performed based on IP address and MAC address.

[0144] 3-2. Determining whether to redirect traffic. Based on actual needs, relevant tags can be customized to determine whether certain IPs, communication protocols, and ports require traffic redirection. Then, corresponding traffic redirection matching rules can be set, i.e., packets that do not require traffic redirection tags are ignored, and no traffic redirection operation is performed. In this embodiment of the invention, the following rules can be set to not require traffic redirection: first, broadcast and multicast packets are not required to be redirected; second, the cloud platform or user can customize the settings to allow certain IPs, communication protocols, and ports to not be redirected.

[0145] 3-3. Data Packet Editing. Modify the destination MAC address of this data packet to the MAC address of the network card if0p.

[0146] 3-4. Packet redirection. Send the data packet directly to network interface card if0.

[0147] Figure 5a and Figure 5bThis is a flowchart illustrating a traffic redirection configuration method provided in Embodiment 4 of the present invention. Based on the above embodiments, this embodiment provides an implementation of the traffic redirection configuration method, enabling traffic redirection configuration for east-west data packets in a Linux system. Taking accessing UDP port 1002 of cloud host VM1 to cloud host VM2 as an example, the relevant network configuration is as follows: The IP address of cloud host VM1 is 10.67.0.1, and its MAC address is 36:61:94:32:cd:55; the IP address of cloud host VM2 is 10.67.0.2, and its MAC address is 32:7e:5c:81:74:d3; the MAC address of network interface card if0 is 96:ec:fd:37:04:e9; the MAC address of network interface card if0p is 22:8c:36:85:77:26; the MAC address of network interface card if.x is 0e:12:df:51:3c:5e; the IP address of the target network is 100.64.1.2 / 30, and its MAC address is 66:f9:e3:1f:4f:60. Figure 5a and Figure 5b As shown, the configuration method for flow traction provided in Embodiment 4 of the present invention specifically includes the following steps:

[0148] The S410 network card VM1.eth0 sends data packets, and the host machine's network card tap0 receives the data packets.

[0149] Here, the packet capture results for network card tap0 are as follows:

[0150] 36:61:94:32:cd:55>32:7e:5c:81:74:d3,ethertype IPv4(0x0800),length58:10.67.0.1.38347>10.67.0.2.1002:UDP,length 16

[0151] It can be seen that cloud host VM1 uses port 38347 to access port 1002 of cloud host VM2.

[0152] The traffic redirection configuration for network card tap0 is as follows:

[0153] 1) Determine the traffic redirection mode; if the source MAC address and source IP address of VM1 are matched, traffic will be redirected.

[0154] 2) Decide whether to drive traffic. If no rule is found that prevents traffic from being driven, then traffic will be driven.

[0155] 3) Edit the data packet and change the destination MAC address of the data packet to the MAC address of the network card if0p;

[0156] 4) Packet redirection: Redirects packets directly to network interface card if0.

[0157] S420, network card if0 received a data packet.

[0158] In this embodiment of the invention, network interface card if0 has no traffic redirection configuration, therefore no data packets are processed. Here, the packet capture status of network interface card if0 is as follows:

[0159] 36:61:94:32:cd:55>22:8c:36:85:77:26,ethertype IPv4(0x0800),length58:10.67.0.1.38347>10.67.0.2.1002:UDP,length 16

[0160] The S430 network card if0p receives a data packet, and the data packet enters the network namespace.

[0161] In this embodiment of the invention, the network interface card if0p is configured to redirect traffic as follows:

[0162] 1) The packet dropping rules were matched, but no rule was found that prevents traffic redirection, so the traffic redirection process will continue.

[0163] 2) Calculate / query the packet routing identifier. In this embodiment of the invention, only one traction target is used as an example. Therefore, the routing object identifier obtained by calculation or query is 0x8101. The first packet will be calculated, and subsequent packets will be queried from the connection record to obtain the corresponding routing object identifier.

[0164] 3) Set the NAT tag for the data packet. In this embodiment of the invention, communication is between tenant networks, so the rule that requires setting the NAT tag will not be matched.

[0165] Here, the packet capture results for the network card if0p are as follows:

[0166] 36:61:94:32:cd:55>22:8c:36:85:77:26,ethertype IPv4(0x0800),length58:10.67.0.1.38347>10.67.0.2.1002:UDP,length 16

[0167] S440: According to the routing rules, find the route with the routing object identifier 0x8101 and send the data packet to the network card if.x.

[0168] When the S450 network card (if.x) receives a data packet, the data packet leaves the network namespace.

[0169] In this embodiment of the invention, no NAT marker was matched in the data packet, so no processing was performed. Here, the packet capture results for the network card's if.x are as follows:

[0170] 0e:12:df:51:3c:5e>66:f9:e3:1f:4f:60,ethertype IPv4(0x0800),length58:10.67.0.1.38347>10.67.0.2.1002:UDP,length 16

[0171] As can be seen, after routing, the source MAC address of the data packet becomes the MAC address of the network card if.x, and the destination MAC address becomes the MAC address of the cloud firewall security instance.

[0172] The S460 cloud firewall security instance receives data packets, performs security protection processing, and returns the data packets to the network interface card if.x along the original path, where the data packets enter the network namespace.

[0173] In this embodiment of the invention, the traffic redirection configuration of the network card if.x is as follows:

[0174] 1) The source IP address matched is 10.67.0.1;

[0175] 2) Modify the target MAC address to the MAC address of network card if0;

[0176] 3) Redirect data packets to the network card if0p.

[0177] Here, the packet capture results for the network card if.x are as follows:

[0178] 66:f9:e3:1f:4f:60>0e:12:df:51:3c:5e,ethertype IPv4(0x0800),length58:10.67.0.1.38347>10.67.0.2.1002:UDP,length 16

[0179] The S470 network card if0p receives a data packet, and the data packet leaves the network namespace.

[0180] In this embodiment of the invention, data packets at the network interface card (NIC) if0p leave the network namespace and are not currently configured for traffic redirection; therefore, no processing is performed on these data packets. The packet capture results at NIC if0p are as follows:

[0181] 66:f9:e3:1f:4f:60>96:ec:fd:37:04:e9,ethertype IPv4(0x0800),length58:10.67.0.1.38347>10.67.0.2.1002:UDP,length 16

[0182] When the S480 network card (if0) receives a data packet, the data packet enters the host machine, and a flag is set to prevent all IP protocol data packets from being routed.

[0183] Here, the packet capture results for network card if0 are as follows:

[0184] 66:f9:e3:1f:4f:60>96:ec:fd:37:04:e9,ethertype IPv4(0x0800),length58:10.67.0.1.38347>10.67.0.2.1002:UDP,length 16

[0185] S490, the data packet is forwarded by the bridge to the cloud host VM2. VM2 receives the data packet and responds. The response data packet is sent to the network card tap0 through the bridge.

[0186] In this embodiment of the invention, the traffic redirection configuration of network card tap0 is as follows:

[0187] 1) Determine the traffic redirection mode; if the target MAC address and target IP address of VM1 are matched, traffic will be redirected.

[0188] 2) Decide whether to drive traffic. If no rule is found that prevents traffic from being driven, then traffic will be driven.

[0189] 3) Edit the data packet and change the destination MAC address of the data packet to the MAC address of the network card if0p;

[0190] 4) Packet redirection: Redirects packets directly to network interface card if0.

[0191] Here, the packet capture results for network card if0 are as follows:

[0192] 32:7e:5c:81:74:d3>22:8c:36:85:77:26,ethertype IPv4(0x0800),length58:10.67.0.2.1002>10.67.0.1.38347:UDP,length 16

[0193] S4100 and network card if0 receive the data packet and send it to network card if0p. The data packet enters the network namespace.

[0194] In this embodiment of the invention, the network interface card if0p is configured to redirect traffic as follows:

[0195] 1) The packet dropping rules were matched, but no rule was found that prevents traffic redirection, so the traffic redirection process will continue.

[0196] 2) The packet routing tag is obtained by querying the connection record, and the routing object identifier is found to be 0x8101;

[0197] 3) No rule was found that required setting a NAT tag for the data packet.

[0198] Here, the packet capture results for the network card if0p are as follows:

[0199] 32:7e:5c:81:74:d3>22:8c:36:85:77:26,ethertype IPv4(0x0800),length58:10.67.0.2.1002>10.67.0.1.38347:UDP,length 16

[0200] S4110: According to the routing rules, find the route with the routing object identifier 0x8101 and send the data packet to the network card if.x.

[0201] The S4120 network card if.x receives a data packet, and the data packet leaves the network namespace.

[0202] In this embodiment of the invention, no NAT marker was found for the data packet, so no processing was performed. Here, the packet capture results for the network card's if.x are as follows:

[0203] 0e:12:df:51:3c:5e>66:f9:e3:1f:4f:60,ethertype IPv4(0x0800),length58:10.67.0.2.1002>10.67.0.1.38347:UDP,length 16

[0204] As can be seen, after routing, the source MAC address of the data packet becomes the MAC address of the network card if.x, and the destination MAC address becomes the MAC address of the cloud firewall security instance.

[0205] The S4130 cloud firewall security instance receives data packets, performs security protection processing, and returns the data packets to the network interface card if.x, where the data packets enter the network namespace.

[0206] In this embodiment of the invention, the traffic redirection configuration of the network card if.x is as follows:

[0207] 1) The matched destination IP address is 10.67.0.1;

[0208] 2) Modify the target MAC address to the MAC address of network card if0;

[0209] 3) Redirect data packets to the network card if0p.

[0210] Here, the packet capture results for the network card if.x are as follows:

[0211] 66:f9:e3:1f:4f:60>0e:12:df:51:3c:5e,ethertype IPv4(0x0800),length58:10.67.0.2.1002>10.67.0.1.38347:UDP,length 16

[0212] S4140 and network card if0p receive data packets, and the data packets leave the network namespace.

[0213] In this embodiment of the invention, data packets at the network interface card (NIC) if0p leave the network namespace and are not currently configured for traffic redirection; therefore, no processing is performed on these data packets. The packet capture results at NIC if0p are as follows:

[0214] 66:f9:e3:1f:4f:60>96:ec:fd:37:04:e9,ethertype IPv4(0x0800),length58:10.67.0.2.1002>10.67.0.1.38347:UDP,length 16

[0215] When the S4150 network card if0 receives a data packet, the data packet enters the host machine, and a non-redirect flag is set for all IP protocol data packets.

[0216] Here, the packet capture results for network card if0 are as follows:

[0217] 66:f9:e3:1f:4f:60>96:ec:fd:37:04:e9,ethertype IPv4(0x0800),length58:10.67.0.2.1002>10.67.0.1.38347:UDP,length 16

[0218] S4160, the data packet is forwarded by the bridge to the cloud host VM1. The network interface tap0 receives the data packet, the data packet leaves the host machine and is sent to the network interface eth0 of the cloud host VM1. That is, the cloud host VM1 has received the reply from the cloud host VM2.

[0219] In this embodiment of the invention, the traffic redirection configuration of network card tap0 is as follows:

[0220] 1) Determine the traffic redirection mode; if the target MAC address and target IP address of VM1 are matched, traffic will be redirected.

[0221] 2) Decide whether to redirect traffic. No rule for not redirecting traffic was matched, but the "no traffic redirection" flag (set in S4150) was matched, so no traffic redirection will be performed.

[0222] The technical solution of this invention has the following advantages: 1) It supports traffic redirection of east-west data packets; 2) The distributed design allows the traffic redirection module to work independently, avoiding single points of failure and high availability issues; 3) The "NAT IP" design can support scenarios with network conflicts between business host IPs; 4) Traffic redirection rules can be used as additional configurations for the host network, and the switching on and off operations of traffic redirection will not affect the existing network, and the traffic redirection path can be customized; 5) The switching on and off operations of the traffic redirection module have no impact on the connectivity of the network link, resulting in a smooth operation; 6) The switching operation of the redirection target has no impact on the connectivity of the network link, resulting in a smooth operation; 7) It does not require a large number of connection records and corresponding network configurations to achieve traffic redirection, which can reduce the occupation of system memory and computing power, and reduce the maintenance costs for technical personnel.

[0223] Example 5

[0224] Figure 6a and Figure 6b This is a flowchart illustrating a traffic redirection configuration method provided in Embodiment 5 of the present invention. Based on the above embodiments, this embodiment provides an implementation of a traffic redirection configuration method, enabling traffic redirection configuration for north-south data packets in a Linux system. Taking accessing UDP port 1001 of cloud host VM1 from the external IP address 10.67.1.2 as an example, the relevant network configuration is as follows: the IP address of cloud host VM1 is 10.67.0.1, the MAC address is 36:61:94:32:cd:55, and the NAT... The IP address is 10.67.1.1; the external IP address is 10.67.1.2, and the MAC address of the external gateway is 52:54:5c:81:74:d3; the MAC address of network card if0 is 96:ec:fd:37:04:e9; the MAC address of network card if0p is 22:8c:36:85:77:26; the MAC address of network card if.x is 7a:b3:b3:3b:f8:5a; the IP address of the target device is 100.64.1.2 / 30, and the MAC address is 42:83:bb:bd:21:c4. For example... Figure 6a and Figure 6b As shown in Embodiment 5 of the present invention, a configuration method for flow traction specifically includes the following steps:

[0225] The S510 external network gateway sends data packets to the bridge of the cloud host VM1, and the bridge sends the data packets to the network card tap0 of the cloud host.

[0226] Here, the packet capture results for network card tap0 are as follows:

[0227] 52:54:5c:81:74:d3>36:61:94:32:cd:55,ethertype IPv4(0x0800),length55:10.67.1.2.49619>10.67.0.1.1001:UDP,length 13

[0228] The traffic redirection configuration for network card tap0 is as follows:

[0229] 1) Determine the traffic redirection mode. If the target IP address and target MAC address are matched to the IP and MAC address of cloud host VM1, continue the traffic redirection.

[0230] 2) Decide whether to drive traffic. If no rule for not driving traffic is found, continue driving traffic.

[0231] 3) Edit the data packet and change the destination MAC address of the data packet to the MAC address of the network card if0p;

[0232] 4) Packet redirection: Redirects packets directly to network interface card if0.

[0233] The S520 network card if0 received a data packet.

[0234] In this embodiment of the invention, network interface card if0 has no traffic redirection configuration, therefore no data packets are processed. Here, the packet capture status of network interface card if0 is as follows:

[0235] 52:54:5c:81:74:d3>22:8c:36:85:77:26,ethertype IPv4(0x0800),length56:10.67.1.2.49619>10.67.0.1.1001:UDP,length 14

[0236] When the S530 network card if0p receives a data packet, the data packet enters the network namespace.

[0237] In this embodiment of the invention, the network interface card if0p is configured to redirect traffic as follows:

[0238] 1) The packet dropping rules were matched, but no rule was found that prevents traffic redirection, so the traffic redirection process will continue.

[0239] 2) Calculate / query the packet routing identifier. In this embodiment of the invention, only one traction target is used as an example. Therefore, the routing object identifier obtained by calculation or query is 0x8101. The first packet will be calculated, and subsequent packets will be queried from the connection record to obtain the corresponding routing object identifier.

[0240] 3) Set the NAT tag for the data packet. If the target IP 10.67.0.1 is a tenant network and the source IP is a non-tenant network, NAT is required. Set the data packet tag to the target address NAT.

[0241] It's worth noting that the packet tag here is "Destination Address NAT Tag | Routing Object Identifier", which is an OR operation between the two tag values: 0x9000 | 0x8101 = 0x9101. However, the packet tag in the connection record is set when the routing object identifier is obtained in step 2), so the packet tag value in the connection record is 0x8101.

[0242] Here, the packet capture results for the network card if0p are as follows:

[0243] 52:54:5c:81:74:d3>22:8c:36:85:77:26,ethertype IPv4(0x0800),length56:10.67.1.2.49619>10.67.0.1.1001:UDP,length 14

[0244] S540: According to the routing rules, find the route with the routing object identifier 0x8101 and send the data packet to the network card if.x.

[0245] It is worth noting that the routing rule is "from all fwmark 0x8101 / 0x81ff lookup 33025", which means that the current packet marker 0x9101 is first ANDed with the mask 0x81ff, and the result is equal to 0x8101, which matches the marker 0x8101. Then, the route with the route object identifier 0x8101 is searched according to the routing rule.

[0246] When the S550 network card (if.x) receives a data packet, the data packet leaves the network namespace.

[0247] In this embodiment of the invention, the target address NAT flag of the data packet is matched, and the target address is modified to the NAT IP, i.e., 10.67.1.1.

[0248] It is worth noting that in the packet matching rule "mark 0x9000 0x9000", the first 0x9000 is the matching value, and the second 0x9000 is the mask value. This means that the current packet marker 0x9101 is first ANDed with the mask 0x9000, and if the result is equal to the matching value 0x9000, then the match is successful.

[0249] Here, the packet capture results for the network card if.x are as follows:

[0250] 7a:b3:b3:3b:f8:5a>42:83:bb:bd:21:c4,ethertype IPv4(0x0800),length56:10.67.1.2.49619>10.67.1.1.1001:UDP,length 14

[0251] As can be seen, after routing, the source MAC address of the data packet becomes the MAC address of the network card if.x, and the destination MAC address becomes the MAC address of the cloud firewall security instance.

[0252] The S560 cloud firewall security instance receives data packets, performs security protection processing, and returns the data packets to the network interface card (if.x) along the original path, where the data packets enter the network namespace.

[0253] In this embodiment of the invention, the data packet here matches scenario 2 in the previous traffic redirection configuration, and the specific traffic redirection configuration of the network card if.x is as follows:

[0254] 1) The target IP address matched is a NAT IP, namely 10.67.1.1;

[0255] 2) Change the target IP address to 10.67.0.1 to restore the original IP address; change the target MAC address to the MAC address of network card if0; recalculate and modify the checksum value;

[0256] 3) Redirect data packets to the network card if0p.

[0257] Here, the packet capture results for the network card if.x are as follows:

[0258] 42:83:bb:bd:21:c4>7a:b3:b3:3b:f8:5a,ethertype IPv4(0x0800),length56:10.67.1.2.49619>10.67.1.1.1001:UDP,length 14

[0259] The S570 network card if0p receives a data packet, and the data packet leaves the network namespace.

[0260] In this embodiment of the invention, data packets at the network interface card (NIC) if0p leave the network namespace and are not currently configured for traffic redirection; therefore, no processing is performed on these data packets. The packet capture results at NIC if0p are as follows:

[0261] 42:83:bb:bd:21:c4>96:ec:fd:37:04:e9,ethertype IPv4(0x0800),length56:10.67.1.2.49619>10.67.0.1.1001:UDP,length 14

[0262] When the S580 network card if0 receives a data packet, the data packet enters the host machine, and a non-redirect flag is set for all IP protocol data packets.

[0263] Here, the packet capture results for network card if0 are as follows:

[0264] 42:83:bb:bd:21:c4>96:ec:fd:37:04:e9,ethertype IPv4(0x0800),length56:10.67.1.2.49619>10.67.0.1.1001:UDP,length 14

[0265] S590, the data packet is forwarded by the bridge to the network interface tap0 of the cloud host VM2, and the data packet leaves the host machine.

[0266] In this embodiment of the invention, the traffic redirection configuration of network card tap0 is as follows:

[0267] 1) Determine the traffic redirection mode; if the target MAC address and target IP address of VM1 are matched, traffic will be redirected.

[0268] 2) Decide whether to redirect traffic. No rule for not redirecting traffic was matched, but the "no traffic redirection" flag (set in S580) was matched, so no traffic redirection will be performed.

[0269] Here, the packet capture results for network card tap0 are as follows:

[0270] 52:54:5c:81:74:d3>36:61:94:32:cd:55,ethertype IPv4(0x0800),length56:10.67.1.2.49619>10.67.0.1.1001:UDP,length 14

[0271] When the S5100 and the cloud host VM1 receive a data packet via its network interface eth0, it processes the packet, responds, and sends the response packet to the network interface tap0. The data packet then enters the host machine.

[0272] In this embodiment of the invention, the traffic redirection configuration of network card tap0 is as follows:

[0273] 1) Determine the traffic redirection mode; if the source MAC address and source IP address of VM1 are matched, traffic will be redirected.

[0274] 2) Decide whether to drive traffic. If no rule is found that prevents traffic from being driven, then traffic will be driven.

[0275] 3) Edit the data packet and change the destination MAC address of the data packet to the MAC address of the network card if0p;

[0276] 4) Packet redirection: Redirects packets directly to network interface card if0.

[0277] S5110 and network card if0 receive the data packet and send it to network card if0p. The data packet enters the network namespace.

[0278] In this embodiment of the invention, the network interface card if0p is configured to redirect traffic as follows:

[0279] 1) The packet dropping rules were matched, but no rule was found that prevents traffic redirection, so the traffic redirection process will continue.

[0280] 2) The packet routing tag is obtained by querying the connection record, and the routing object identifier is found to be 0x8101;

[0281] 3) Set the NAT tag for the data packet. If the source address is a tenant network and the destination address is a non-tenant network, set the data packet tag to the source address NAT tag. It is worth noting that the data packet tag here is "source address NAT tag | route tag", that is, the two tag values ​​are ORed: 0xa000|0x8101=0xa101.

[0282] Here, the packet capture results for the network card if0p are as follows:

[0283] 36:61:94:32:cd:55>22:8c:36:85:77:26,ethertype IPv4(0x0800),length56:10.67.0.1.1001>10.67.1.2.49619:UDP,length 14

[0284] S5120: According to the routing rules, find the route with the routing object identifier 0x8101 and send the data packet to the network card if.x.

[0285] When the S5130 network card (if.x) receives a data packet, the data packet leaves the network namespace.

[0286] In this embodiment of the invention, the source address NAT flag of the matched data packet is modified to the NAT IP, i.e., 10.67.1.1. Here, the packet capture results of the network card if.x are as follows:

[0287] 7a:b3:b3:3b:f8:5a>42:83:bb:bd:21:c4,ethertype IPv4(0x0800),length56:10.67.1.1.1001>10.67.1.2.49619:UDP,length 14

[0288] As can be seen, after routing, the source MAC address of the data packet becomes the MAC address of the network card if.x, and the destination MAC address becomes the MAC address of the cloud firewall security instance.

[0289] The S5140 cloud firewall security instance receives data packets, performs security protection processing, and returns the data packets to the network interface card if.x along the original path, where the data packets enter the network namespace.

[0290] In this embodiment of the invention, the traffic redirection configuration of the network card if.x is as follows:

[0291] 1) The source IP address matched is 10.67.1.1;

[0292] 2) Change the source IP address to 10.67.0.1 to restore the original IP address; change the target MAC address to the MAC address of network card if0; recalculate and modify the checksum value;

[0293] 3) Redirect data packets to the network card if0p.

[0294] Here, the packet capture results for the network card if.x are as follows:

[0295] 42:83:bb:bd:21:c4>7a:b3:b3:3b:f8:5a,ethertype IPv4(0x0800),length56:10.67.1.1.1001>10.67.1.2.49619:UDP,length 14

[0296] The S5150 network card if0p receives a data packet, and the data packet leaves the network namespace.

[0297] In this embodiment of the invention, data packets at the network interface card (NIC) if0p leave the network namespace and are not currently configured for traffic redirection; therefore, no processing is performed on these data packets. The packet capture results at NIC if0p are as follows:

[0298] 42:83:bb:bd:21:c4>96:ec:fd:37:04:e9,ethertype IPv4(0x0800),length56:10.67.0.1.1001>10.67.1.2.49619:UDP,length 14

[0299] When the S5160 network card if0 receives a data packet, the data packet enters the host machine, and a non-redirect flag is set for all IP protocol data packets.

[0300] Here, the packet capture results for network card if0 are as follows:

[0301] 42:83:bb:bd:21:c4>96:ec:fd:37:04:e9,ethertype IPv4(0x0800),length56:10.67.0.1.1001>10.67.1.2.49619:UDP,length 14

[0302] The S5170 and bridge send data packets to the internal network gateway, which then forwards the data packets to the external Internet, meaning the external Internet receives a response from the cloud host VM1.

[0303] The technical solution of this invention has the following advantages: 1) It supports traffic redirection for north-south data packets; 2) The distributed design allows the traffic redirection module to work independently, avoiding single points of failure and high availability issues; 3) The "NAT IP" design can support scenarios with network conflicts between business host IPs; 4) Traffic redirection rules can be used as additional configurations for the host network, and the switching on and off operations of traffic redirection will not affect the existing network, and the traffic redirection path can be customized; 5) The switching on and off operations of the traffic redirection module have no impact on the connectivity of the network link, resulting in a smooth operation; 6) The switching operation of the redirection target has no impact on the connectivity of the network link, resulting in a smooth operation; 7) It does not require a large number of connection records and corresponding network configurations to achieve traffic redirection, which can reduce the occupation of system memory and computing power, and reduce the maintenance costs for technical personnel.

[0304] Example 6

[0305] Figure 7 This is a schematic diagram of a flow traction configuration device provided in Embodiment Six of the present invention. Figure 7 As shown, the device includes:

[0306] The path determination module 61 is used to determine the traffic path of data packets according to a preset traffic redirection mode.

[0307] The tag setting module 62 is used to set data packet tags for data packets according to the traffic path.

[0308] The first routing module 63 is used to guide data packets to the target for processing according to the data packet marking and preset routing rules.

[0309] The second routing module 64 is used to guide the processed data packets to the target address according to the data packet marking and preset routing rules.

[0310] The technical solution of this invention involves a path determination module determining the traffic routing path for data packets according to a preset traffic routing mode, a tag setting module setting data packet tags according to the traffic routing path, a first traffic routing module guiding the data packets to the traffic routing target for processing according to the data packet tags and preset routing rules, and a second traffic routing module guiding the processed data packets to the target address according to the data packet tags and preset routing rules. This invention supports multiple traffic routing modes by setting data packet tags according to the traffic routing path and guiding data packets sequentially to the traffic routing target and target address according to the data packet tags and preset routing rules. It eliminates the need for a large number of connection records and corresponding network configurations to achieve traffic routing, reducing system memory and computing power consumption and lowering maintenance costs for technical personnel.

[0311] Furthermore, based on the above embodiments of the invention, the preset traffic diversion mode includes at least an east-west traffic diversion mode and a north-south traffic diversion mode, and the path determination module 61 includes:

[0312] The address lookup unit is used to query the source and destination addresses of data packets in a preset routing configuration file according to a preset traffic redirection mode.

[0313] The redirection path setting unit is used to set the redirection path according to the source address and the destination address.

[0314] Furthermore, based on the above embodiments of the invention, the marker setting module 62 includes:

[0315] The business requirement acquisition unit is used to acquire the business requirements of the corresponding data packet.

[0316] The packet tag setting unit is used to set the packet tags of the data packets according to the traffic path and business requirements.

[0317] Furthermore, based on the above embodiments of the invention, the setting of the data packet marker includes at least one of the following:

[0318] When the first flag bit is set, it indicates that the data packet has been processed by the towing target;

[0319] When the second flag is set, it indicates that the data packet is not redirected;

[0320] When the third flag is set, it indicates that the data packet is undergoing source address translation;

[0321] When the fourth flag bit is set, it indicates that the data packet is undergoing destination address translation;

[0322] When the fifth flag is set, it indicates that the data packet is being diverted, and this applies only to north-south diversion mode.

[0323] If the sixth and seventh flag bits are set, it indicates that the bits are reserved.

[0324] When the eighth flag is set, it indicates a routing object;

[0325] When the ninth to sixteenth identifier bits are set, it indicates the number of the towing target.

[0326] Furthermore, based on the above embodiments of the invention, the first drainage module 63 includes:

[0327] The namespace determination unit is used to determine the network namespace associated with the traction target.

[0328] The first redirection unit is used to redirect data packets to the first network interface card (NIC) in the network namespace according to the data packet tag, and then send the data packets to the second NIC in the network namespace through the first NIC.

[0329] The route object identifier lookup unit is used to find the route object identifier that matches the packet tag within the preset routing rules.

[0330] The destination address modification unit is used to modify the destination address of data packets at the second network interface card according to the routing object identifier.

[0331] The first data packet transmission unit is used to transmit data packets to the traction target based on the modified target address.

[0332] Furthermore, based on the above embodiments of the invention, the second drainage module 64 includes:

[0333] The destination address determination unit is used to determine the destination address of the processed data packet.

[0334] The second redirection unit is used to redirect data packets to the second network interface card (NIC) in the network namespace according to the data packet tag, and then send the data packets to the first NIC through the second NIC.

[0335] The non-traffic flag setting unit is used to set the non-traffic flag for data packets at the first network interface card.

[0336] The second data packet transmission unit is used to transmit data packets with the non-traffic flag set to the target address according to the data packet tag.

[0337] Furthermore, based on the above embodiments of the invention, the first network card and the second network card belong to a pair of network devices of the virtual Ethernet interface type.

[0338] The flow-driving configuration device provided in the embodiments of the present invention can execute the flow-driving configuration method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0339] Example 7

[0340] Figure 8 A schematic diagram of an electronic device 70 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0341] like Figure 8 As shown, the electronic device 70 includes at least one processor 71 and a memory, such as a read-only memory (ROM) 72 and a random access memory (RAM) 73, communicatively connected to the at least one processor 71. The memory stores computer programs executable by the at least one processor. The processor 71 can perform various appropriate actions and processes based on the computer program stored in the ROM 72 or loaded from storage unit 78 into the RAM 73. The RAM 73 can also store various programs and data required for the operation of the electronic device 70. The processor 71, ROM 72, and RAM 73 are interconnected via a bus 74. An input / output (I / O) interface 75 is also connected to the bus 74.

[0342] Multiple components in electronic device 70 are connected to I / O interface 75, including: input unit 76, such as keyboard, mouse, etc.; output unit 77, such as various types of monitors, speakers, etc.; storage unit 78, such as disk, optical disk, etc.; and communication unit 79, such as network card, modem, wireless transceiver, etc. Communication unit 79 allows electronic device 70 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0343] Processor 71 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 71 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 71 performs the various methods and processes described above, such as the configuration method for flow pulling.

[0344] In some embodiments, the traffic-driving configuration method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 78. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 70 via ROM 72 and / or communication unit 79. When the computer program is loaded into RAM 73 and executed by processor 71, one or more steps of the traffic-driving configuration method described above may be performed. Alternatively, in other embodiments, processor 71 may be configured to perform the traffic-driving configuration method by any other suitable means (e.g., by means of firmware).

[0345] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0346] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0347] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0348] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0349] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0350] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0351] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and no limitation is imposed herein.

[0352] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for configuring flow traction, characterized in that, The method includes: The data packet routing path is determined according to the preset routing mode; Set data packet tags for the data packets according to the described traffic redirection path; The data packet is guided to the target for processing according to the data packet label and preset routing rules; The processed data packet is guided to the target address according to the data packet tag and the preset routing rules; The process of guiding the data packet to the target based on the data packet label and preset routing rules includes: Determine the network namespace associated with the traction target; The data packet is redirected to the first network interface card (NIC) in the network namespace according to the data packet tag, and then sent to the second NIC in the network namespace via the first NIC. The first NIC and the second NIC are a pair of network devices of type Virtual Ethernet Interface (VETH). Search for the route object identifier that matches the packet marker within the preset routing rules; Modify the destination address of the data packet at the second network interface card according to the routing object identifier, wherein the destination address of the data packet at the second network interface card refers to the IP address and MAC address corresponding to the towing target; The data packet is transmitted to the traction target based on the modified target address; Guide the processed data packet to the target address according to the data packet tag and the preset routing rules, including: Determine the destination address of the processed data packet; The data packet is redirected to the second network interface card (NIC) within the network namespace according to the data packet tag, and then sent to the first NIC via the second NIC; Set a non-traffic flag for the data packets at the first network interface card; The data packet with the non-traffic flag set according to the data packet tag will be transmitted to the target address.

2. The method according to claim 1, characterized in that, The preset traffic diversion mode includes at least an east-west traffic diversion mode and a north-south traffic diversion mode. Determining the traffic diversion path of data packets according to the preset traffic diversion mode includes: According to the preset traffic redirection mode, query the source address and destination address of the data packet in the preset routing configuration file; Set the referral path according to the source address and the target address.

3. The method according to claim 1, characterized in that, The step of setting data packet tags according to the traffic redirection path includes: Obtain the business requirements corresponding to the data packet; Set the data packet tag according to the traffic redirection path and the business requirements.

4. The method according to claim 3, characterized in that, The setting of the data packet marker includes at least one of the following: When the first flag bit is set, it indicates that the data packet has been processed by the traction target; When the second flag bit is set, it indicates that the data packet is not redirected; When the third flag bit is set, it indicates that the data packet is undergoing source address translation; When the fourth flag bit is set, it indicates that the data packet is undergoing destination address translation; When the fifth flag bit is set, it indicates that the data packet is being diverted, and this applies only to north-south diversion mode. If the sixth and seventh flag bits are set, it indicates that the bits are reserved. When the eighth flag is set, it indicates a routing object; When the ninth to sixteenth identifier bits are set, the number of the traction target is indicated.

5. A flow traction configuration device, characterized in that, The device includes: The path determination module is used to determine the traffic path of data packets according to a preset traffic redirection mode; A tag setting module is used to set data packet tags for the data packets according to the traffic redirection path; The first routing module is used to guide the data packet to the target for processing according to the data packet label and preset routing rules; The second routing module is used to guide the processed data packet to the target address according to the data packet tag and the preset routing rules; The first diversion module includes: The namespace determination unit is used to determine the network namespace associated with the traction target; The first redirection unit is used to redirect the data packet to the first network interface card (NIC) in the network namespace according to the data packet tag, and send the data packet to the second NIC in the network namespace through the first NIC, wherein the first NIC and the second NIC are a pair of network devices of type Virtual Ethernet Interface (VETH). The routing object identifier lookup unit is used to find the routing object identifier that matches the packet marker within the preset routing rules; The destination address modification unit is used to modify the destination address of the data packet at the second network interface card according to the routing object identifier, wherein the destination address of the data packet at the second network interface card refers to the IP address and MAC address corresponding to the towing target; The first data packet transmission unit is used to transmit the data packet to the traction target based on the modified target address; The second diversion module includes: A target address determination unit is used to determine the target address of the processed data packet; The second redirection unit is used to redirect the data packet to the second network interface card (NIC) in the network namespace according to the data packet tag, and send the data packet to the first NIC through the second NIC; A non-traffic flag setting unit is used to set a non-traffic flag for the data packets at the first network interface card; The second data packet transmission unit is used to transmit the data packet with the non-traffic flag set to the target address according to the data packet tag.

6. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the flow traction configuration method according to any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the configuration method for flow traction according to any one of claims 1-4.

Images