Data interaction method and device, NAT gateway and storage medium
By querying the target address and port in the DNAT configuration lookup table and performing RSS verification and address translation, the problem of inconsistent reverse traffic queues in virtual machine data interaction of the NAT gateway is solved, and forwarding performance is improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA UNITED NETWORK COMM GRP CO LTD
- Filing Date
- 2023-09-26
- Publication Date
- 2026-06-02
AI Technical Summary
When a NAT gateway interacts with virtual machines, RSS verification cannot guarantee that reverse traffic will enter the same queue, resulting in excessive processor computing power and memory usage, and reduced forwarding performance.
By querying the target address and port corresponding to the initial destination IP address and port in the DNAT configuration lookup table, and performing RSS verification and network address translation based on the receive queue, target, and initial address and port, intermediate packets are generated to ensure that reverse traffic enters the same queue.
This reduces the processor's computational load and memory usage, and improves the data forwarding performance of the NAT gateway.
Smart Images
Figure CN117240820B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communication technology, and in particular to a data interaction method, apparatus, NAT gateway, and storage medium. Background Technology
[0002] A Network Address Translation (NAT) gateway is a gateway that translates internal IP addresses and public IP addresses within a Virtual Private Cloud (VPC). It's a way to enable cloud resources within a VPC that lack a public IP address to access the internet. NAT gateways operate at the boundary between the internet and the VPC, are suitable for use within a private network, and allow some resources to share a public internet connection, thus saving bandwidth and traffic resources.
[0003] When a NAT gateway establishes a new Source Network Address Translation (SNAT) session, it performs Receive Side Scaling (RSS) verification when allocating the public Internet Protocol (IP) and port. The purpose of RSS verification is to ensure that bidirectional traffic of the session enters the same queue of the network card and is thus processed by the same thread.
[0004] However, in scenarios where two virtual machines interact, the quadruple used for RSS verification is different from the quadruple used for the reverse traffic. This means that the processing thread for the incoming traffic to the network card queue cannot be guaranteed to be consistent with the processing thread for the outgoing traffic queue, resulting in a significant consumption of processor computing power and memory, and reduced forwarding performance. Summary of the Invention
[0005] This application provides a data interaction method, apparatus, NAT gateway, and storage medium to solve the technical problem of poor forwarding performance of NAT gateways.
[0006] Firstly, this application provides a data interaction method, including:
[0007] The message sent by the sender is received through the receive queue. The message includes the initial source IP address, the initial source port, the initial destination IP address, and the initial destination port.
[0008] Query the DNAT configuration query table to find the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port;
[0009] If the DNAT configuration query table includes the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port, then based on the receiving queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port, the packet is subjected to RSS verification and network source address translation to obtain an intermediate packet. The intermediate packet includes the target source IP address corresponding to the initial source IP address, the target source port corresponding to the initial source port, the initial destination IP address, and the initial destination port.
[0010] The intermediate message is processed by network destination address translation to obtain the target message, and the target message is sent to the receiving end according to the target destination IP address and target destination port, so that the NAT gateway can receive the message returned by the receiving end through the receiving queue.
[0011] Optionally, the step of performing RSS check and network source address translation on the packet based on the receiving queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port to obtain the intermediate packet includes:
[0012] During the network source address translation process of the packet, the target source port is adjusted by performing RSS verification based on the receiving queue, the target destination IP address, the target source IP address, and the target destination port to obtain the intermediate packet, so that the NAT gateway can receive the packet returned by the receiving end through the receiving queue.
[0013] Optionally, the above method further includes: if the DNAT configuration query table includes the target destination IP address corresponding to the initial destination IP address but does not include the target destination port corresponding to the initial destination port, then an intermediate packet is obtained by performing RSS verification and network source address translation on the packet based on the receiving queue, the target destination IP address, the initial destination port, the initial source IP address, and the initial source port.
[0014] Optionally, the above method further includes: if the DNAT configuration query table does not include the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port, then an intermediate packet is obtained by performing RSS verification and network source address translation on the packet based on the receiving queue, the initial source IP address, the initial source port, the initial destination IP address, and the initial destination port.
[0015] Optionally, as described above, obtaining the DNAT configuration lookup table and querying the target destination IP address and target destination port corresponding to the initial destination IP address and initial destination port in the DNAT configuration lookup table includes:
[0016] In response to the activation of the DNAT configuration query function, the DNAT configuration query table is obtained, and the target destination IP address and target destination port corresponding to the initial destination IP address and initial destination port are queried in the DNAT configuration query table.
[0017] Optionally, the above method further includes: if the DNAT configuration query function is in a closed state, then performing RSS verification and network source address translation on the packet based on the receiving queue, initial source IP address, initial source port, initial destination IP address, and initial destination port to obtain an intermediate packet.
[0018] Optionally, as described above, the step of performing network destination address translation on the intermediate message to obtain the target message includes:
[0019] The initial destination IP address and initial destination port in the intermediate message are converted to network destination address to obtain the target destination IP address and target destination port. The target message includes the target destination IP address, the target destination port, the target source IP address, and the target source port.
[0020] Secondly, this application provides a data interaction device, comprising:
[0021] The message receiving module is used to receive messages sent by the sending end through a receiving queue. The message includes an initial source IP address, an initial source port, an initial destination IP address, and an initial destination port.
[0022] The data query module is used to query the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port in the DNAT configuration query table;
[0023] The address translation module is used to respond to the DNAT configuration query table, which includes the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port. Based on the receiving queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port, the module performs RSS verification and network source address translation on the packet to obtain an intermediate packet. The intermediate packet includes the target source IP address corresponding to the initial source IP address, the target source port corresponding to the initial source port, the initial destination IP address, and the initial destination port.
[0024] The data interaction module is used to perform network destination address translation on the intermediate message to obtain the target message, and send the target message to the receiving end according to the target destination IP address and target destination port, so that the NAT gateway can receive the message returned by the receiving end through the receiving queue.
[0025] Thirdly, this application provides a NAT gateway, comprising:
[0026] A processor, and a memory and a communication interface communicatively connected to the processor;
[0027] The processor transmits messages through the communication interface;
[0028] The memory stores computer-executed instructions;
[0029] The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 7.
[0030] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any of the first aspects.
[0031] The data interaction method provided in this application queries the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port in the DNAT configuration lookup table. Based on the receive queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port, the intermediate packet is obtained by performing RSS verification and network source address translation on the packet. The intermediate packet includes the target source IP address corresponding to the initial source IP address, the target source port corresponding to the initial source port, the initial destination IP address, and the initial destination port. The target packet is obtained by performing network destination address translation on the intermediate packet. The target packet is then sent to the receiving end according to the target destination IP address and the target destination port. This allows the NAT gateway to receive the packets returned by the receiving end through the receive queue, reducing the processor's computational load and memory usage, and improving the forwarding performance of the NAT network card. Attached Figure Description
[0032] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0033] Figure 1 This is a schematic diagram illustrating two types of traffic in related technologies;
[0034] Figure 2 This is a schematic diagram of the second type of traffic in related technologies;
[0035] Figure 3 This is a flowchart of a data interaction method in an example implementation of this application;
[0036] Figure 4 This is a flowchart of another data interaction method in the example implementation of this application;
[0037] Figure 5 This is a schematic diagram illustrating the composition of the DNAT configuration apparatus in an exemplary embodiment of this application;
[0038] Figure 6 This is a schematic diagram of a NAT gateway that can be applied to embodiments of this application.
[0039] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0040] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0041] A Network Address Translation (NAT) gateway is a gateway that translates internal IP addresses and public IP addresses within a Virtual Private Cloud (VPC). It's a way to enable cloud resources within a VPC that lack a public IP address to access the internet. NAT gateways operate at the boundary between the internet and the VPC, are suitable for use within a private network, and allow some resources to share a public internet connection, thus saving bandwidth and traffic resources.
[0042] In a multi-core CPU (Central Processing Unit / Processor) server with a multi-queue network interface card (NIC) architecture, the NAT gateway has multiple worker threads, each running on a separate CPU core and exclusively occupying one receive queue (or transmit queue) on the NIC. The main purpose of this architecture is to increase system throughput, enhance scalability, achieve high efficiency in non-associative session forwarding, and ensure resource independence.
[0043] The purpose of a NAT gateway is to enable hosts within a VPC to share one or more public IP addresses to access the external network (i.e., perform Source Network Address Translation (SNAT)), or for the external network to access hosts within the VPC through the NAT gateway (i.e., perform Destination Network Address Translation (DNAT)). In a single-arm NAT gateway, the network interface card (NIC) queues, CPU cores, and worker threads are in a one-to-one correspondence. In a dual-arm NAT gateway, the worker threads correspond to specific CPU cores, and each core handles a different receive queue from NIC 1 and NIC 2, respectively. Taking a single-arm NAT gateway as an example, during SNAT, there is a one-to-one correspondence between internal and external sessions.
[0044] Figure 1 A diagram illustrating the traffic types for a NAT gateway, such as... Figure 1 As shown, the main traffic types of the NAT gateway include Type A and Type B. Type A traffic is between the internal virtual machine and the public network, where the destination IP address is the external public IP address. For example, a virtual machine packet in the private network VRF1001 is sent from the virtual machine to the virtual gateway VRF1001 (bond link aggregation). The packet is then sent to the 1001 interface of the virtual gateway VRF1001 via SNAT to modify the source IP (or source port). After routing lookup, it is sent from pipe (physical layer interface) 1000.1 to the public network VRF1000. Finally, through public network routing lookup, it is sent out from the bond.1000 sub-interface, and the return packet is processed in reverse.
[0045] The second type of traffic is traffic between internal virtual machines, which communicates through the elastic network bound to the virtual machines. In this case, the destination IP address is the internal elastic public IP address. For example, a virtual machine packet in the private network VRF1001 is sent from the virtual machine to the bond (link aggregation) interface of the virtual gateway VRF1001; after modifying the source IP address (or source port) through SNAT, it is sent from pipe (physical layer interface) 1000.1 to the public network VRF1000; through route lookup, the destination public IP address is determined to be sent from pipe 1002.0, entering VRF1002, where DNAT operation is performed; the destination IP address is modified to the internal IP address (or port) corresponding to this elastic public IP address, and the route is found to be sent out from bond.1002, and the return packet performs the reverse operation.
[0046] For another example, Figure 2 This is another data flow diagram for the second type of traffic, such as... Figure 2As shown, virtual machines VM 2 and VM 3 are the backend services of the load balancer (LB). VM 1 expects to access the services of VM 2 and VM 3. Since VM 1 accesses the services via a URL (without configuring internal DNS resolution), the DNS resolution only returns the public IP address bound to the load balancer (LB). The traffic of VM 1 will go through VRF1001 for SNAT, then enter VRF1000, and then enter VRF1001 for DNAT to reach the backend services of the load balancer (LB).
[0047] RSS (Receive Side Scaling) is a network interface card (NIC) driver technology that enables efficient allocation of network packet receiving capabilities across multiple processors in a multi-core system. Because processors with the same core share the same execution engine via hyper-threading, this effect differs from processors with multiple physical cores. Therefore, RSS cannot be used with hyper-threaded processors. RSS is a packet splitting mechanism provided by the NIC, used to distribute packets to different receive queues to improve packet receiving performance.
[0048] RSS, also known as multi-queue receive, distributes network receive processing across multiple hardware-based receive queues, allowing multiple CPUs to handle inbound network traffic. RSS can be used to alleviate receive interrupt handling bottlenecks caused by single CPU overload and reduce network latency.
[0049] It's important to note that network interface card (NIC) RSS verification allows packets with the same four-tuple (source IP address, source port, destination IP address, and destination port) to be received by the same NIC receive queue. This allows worker threads running on the same CPU core to forward these packets, improving the forwarding efficiency of the worker threads. RSS is divided into symmetric hash algorithms and asymmetric hash algorithms. Symmetric hash algorithms guarantee that packets in both directions of a session will be received by the same receive queue. Asymmetric hash algorithms cannot guarantee that packets in both directions of a session will be received by the same receive queue.
[0050] The aforementioned message includes a message header and data packets. The message header includes a message quadruple, which will be referred to as the message quadruple below.
[0051] After receiving a packet from the sender, the NAT gateway will first establish an SNAT session to perform network source address translation on the packet. When allocating public IP addresses and ports, it will perform RSS verification (RSS verification mainly includes the packet quadruple, specifically including source IP address, source port, destination IP address, and destination port).
[0052] The purpose of RSS verification is to ensure that bidirectional traffic of a session enters the same queue on the network interface card (NIC) and is processed by the same thread, thereby improving the forwarding performance of the NAT gateway. If packets from an SNAT session enter NIC queue A and are processed by worker thread A, and packets returned by the receiving end enter NIC queue B and are processed by worker thread B, since worker thread B does not have this SNAT session information, it needs to send the packets to worker thread A for processing, which will consume a lot of processor computing power and memory, reducing forwarding performance.
[0053] RSS verification can optimize the first type of traffic scenario, namely SNAT, but it is ineffective for the second type of traffic scenario. This is because the four-tuple used by RSS verification is the elastic public IP address after SNAT (the destination IP address received from the sender), the port assigned by SNAT (the destination port received from the sender), the destination public IP address accessed by the virtual machine (the source IP address received from the sender), and the destination public port accessed by the virtual machine (the source port received from the sender). Figure 1 Taking the second type of traffic as an example, in this scenario, after the SNAT operation in VRF1001, the second type of traffic enters VRF1002 for DNAT operation. The message is as follows:
[0054] Step 1: The packet quadruple received from the receive queue includes sip (source IP address) 1, sport (source port) 1, dip (destination IP address) 1, and dport (destination port) 1. That is, the session quadruple in the packet received by the NAT network management from the bond.1001 interface includes sip (source IP address) 1, sport (source port) 1, dip (destination IP address) 1, and dport (destination port) 1.
[0055] Step 2: After passing through SNAT in VRF1001, the above packet quadruple enters the packet in VRF1000 with the quadruple of sip2, sport2, dip1, and dport1. During this process, RSS verification will be performed, that is, the packet quadruple of RSS verification quadruple is sip2, sport2, dip1, and dport1.
[0056] Step 3: After the message enters the VRF1002 and is processed by DNAT, the final message quadruple obtained is sip2, sport2dip2, and dport2.
[0057] Step 4: When the NAT gateway receives packets from the receiving end, the packet quadruple received from the bond.1002 interface includes dip2, dport2, sip2, and sport2. This quadruple is then used as the RSS checksum quadruple. In this scenario, the packet quadruple used for the two RSS checks is different, which means that it cannot be guaranteed that the queue of packets received by the virtual machine from the sending end enters the network card and the queue of packets received from the receiving end is the same. This will result in a large consumption of processor computing power and memory, and a reduction in forwarding performance.
[0058] After careful consideration, the inventors realized that since RSS verification allows data packets with the same message quadruple (i.e., source IP, source port, destination IP, destination port) to be received by the same network card receive queue and thus processed by worker threads running on the same CPU core, in the second type of traffic scenario, as long as the forward traffic and reverse traffic have the same quadruple when performing RSS verification, it can be guaranteed that the queue of virtual machine inbound traffic entering the network card is consistent with the queue of outbound traffic. The aforementioned forward traffic is the traffic when the NAT gateway receives messages sent by the sender, and the reverse traffic is the traffic when the NAT gateway receives messages fed back by the receiver.
[0059] In view of this, the data interaction method provided in this application aims to solve the above-mentioned technical problems of the prior art.
[0060] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.
[0061] Figure 3 This is a flowchart of a data interaction method according to the present application, which may specifically include steps S310 to S340.
[0062] In step S310, the message sent by the sender is received through the receive queue. The message includes the initial source IP address, the initial source port, the initial destination IP address, and the initial destination port.
[0063] The NAT gateway in this application receives packets sent by the sender through a receiving queue. The sender can be a virtual machine or a terminal, such as a mobile phone or tablet computer. The specific form of the sender can also be customized according to user needs, and is not specifically limited in this example implementation.
[0064] In this example implementation, the aforementioned message may include a message header and data packets. The message header may include data such as the initial source IP address, initial source port, initial destination IP address, and initial destination port, i.e., a message four-tuple, and may also include relevant transport protocols. It should be understood that whether the message header includes other information is not limited. The data packets include data that needs to be forwarded, and the specific data type is not specifically limited in this example implementation.
[0065] It should be noted that a NAT gateway can be configured with multiple receive queues. When receiving packets from the sender, the selected queue can be random. For example, a NAT gateway can include queue 1, queue 2, and queue 3. The receive queue can be queue 1, queue 2, or queue 3; that is, a queue is randomly selected from these queues to receive the packets. Alternatively, the corresponding receive queue can be determined based on the packets. As mentioned above, there is a one-to-one correspondence between receive queues and worker threads. Therefore, the thread corresponding to the packet can be determined first, followed by the corresponding receive queue. The process of determining the thread from the packet can be found in relevant technologies and will not be elaborated here.
[0066] In step S320, the DNAT configuration lookup table is queried to see if it includes the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port.
[0067] A NAT gateway can be configured with a DNAT configuration lookup table, which includes multiple DNAT configuration rules. Based on these rules, the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port can be determined. In other words, the DNAT configuration lookup table includes multiple mapping relationships between initial destination IP addresses and target destination IP addresses, as well as multiple mapping relationships between initial destination ports and target destination ports.
[0068] The DNAT configuration lookup table mentioned above can also directly include the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port. The specific form of the DNAT configuration table is not specifically limited in this example implementation.
[0069] The following example is shown in Table 1.
[0070] Table 1
[0071] Initial destination IP address 1 Target IP address 1 Initial destination port 1 Target port 1 Initial destination IP address 2 Target IP address 2 Initial destination port 2 Target port 3
[0072] After receiving the message sent by the above sender, the NAT gateway can look up the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port in the DNAT configuration lookup table based on the initial destination IP address and the initial destination port in the message.
[0073] If the DNAT configuration lookup table includes the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port, then proceed to step S330.
[0074] In step S330, an intermediate message is obtained by performing RSS check and network source address translation on the message based on the receiving queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port. The intermediate message includes the target source IP address corresponding to the initial source IP address, the target source port corresponding to the initial source port, the initial destination IP address, and the initial destination port.
[0075] In this example implementation, the above... Figure 1 Taking the second type of traffic as an example, the above steps are explained. The packet quadruple received by the NAT gateway includes sip1 (initial source IP address), sport1 (initial source port), dip1 (initial destination IP address), and dport1 (initial destination port). The target destination IP address dip2 corresponding to the initial destination IP address and the target destination port dport2 corresponding to the initial destination port are obtained from the DNAT configuration lookup table. At this time, the intermediate packet can be obtained by simultaneously performing RSS verification and network source address translation on the packet based on the receive queue, target destination IP address, target destination port, initial source IP address, and initial source port. The packet quadruple of the intermediate packet includes the target source IP address sip2 corresponding to the initial source IP address, the target source port sport2 corresponding to the initial source port, the initial destination IP address dip1, and the initial destination port dport1.
[0076] The quadruple used for RSS verification is the target source IP address sip2, the target source port sport2, the target destination IP address dip2, and the target destination port dport2. RSS verification is performed during the network source address translation process to obtain the target source port sport2, so that the calculated return receive queue is the same as the above receive queue.
[0077] If the aforementioned receive queue is queue 1, then the SNAT port translation process obtains the target source port sport2, so that the obtained sport2 ensures that the returned receive queue is also queue 1. The specific adjustment process, i.e., the specific verification process of RSS, can be found in relevant technologies and will not be elaborated here.
[0078] After completing the network source port conversion and RSS verification of the above message, an intermediate message is obtained. The intermediate message may include the target source IP address sip2, the target source port sport2, the initial destination IP address dip1, and the initial destination port dport1.
[0079] Step S340: Perform network destination address translation on the intermediate message to obtain the target message, and send the target message to the receiving end according to the target destination IP address and target destination port, so that the NAT gateway can receive the message returned by the receiving end through the receiving queue.
[0080] In this example implementation, the NAT gateway can perform network destination address translation (DNAT) on the intermediate packets. Specifically, DNAT is configured on the initial destination IP address dip1 and the initial destination port dport1 in the intermediate packets to obtain the target destination IP address dip2 and the target destination port dport2. That is, the target packets include the target source IP address sip2, the target source port sport2, the target destination IP address dip2, and the target destination port dport2.
[0081] Then, the target packet can be sent to the receiving end based on the destination IP address and destination port. The receiving end receives the target packet, and the returned four-tuple is the same as the four-tuple in the target packet, namely, the destination source IP address sip2, the destination source port sport2, the destination IP address dip2, and the destination port dport2. In other words, the four-tuple of the packet returned by the NAT gateway is the same as the four-tuple of the packet verified by RSS, which enables the NAT gateway to receive the packet returned by the receiving end through the aforementioned receive queue. This enhances the data forwarding capability of the NAT gateway.
[0082] The data interaction method in this application queries the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port in the DNAT configuration lookup table. Based on the receive queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port, the intermediate packet is obtained by performing RSS verification and network source address translation on the packet. The intermediate packet includes the target source IP address corresponding to the initial source IP address, the target source port corresponding to the initial source port, the initial destination IP address, and the initial destination port. The target packet is obtained by performing network destination address translation on the intermediate packet. The target packet is then sent to the receiving end according to the target destination IP address and the target destination port. This allows the NAT gateway to receive the packets returned by the receiving end through the receive queue, reducing the processor's computational load and memory usage, and improving the forwarding performance of the NAT network card.
[0083] In one example implementation, the NAT gateway described above may further include a DNAT configuration query function control switch. Figure 4 The flowchart below shows the data interaction method of this application. Figure 4 The data interaction scheme of this solution is described in detail.
[0084] In step S410, it is determined whether the DNAT configuration query function is enabled.
[0085] In this example implementation, the configuration query function control switch in the NAT gateway can include an on state and an off state. When the DNAT configuration query function is on, the NAT gateway can access the DNAT configuration query and obtain data from the DNAT configuration query table. If the DNAT configuration query function is off, the NAT gateway will not query the DNAT configuration query table and will directly execute step S440.
[0086] If the DNAT configuration query function is enabled, proceed to step S420. Otherwise, proceed to step S440, whereby the intermediate packet is obtained by performing RSS check and network source address translation on the packet based on the receive queue, initial source IP address sip1, initial source port sport1, initial destination IP address dip1, and initial destination port dport1.
[0087] In step S420, it is determined whether the DNAT configuration lookup table includes the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port.
[0088] The specific data in the DNAT lookup table has been described in detail above and will not be repeated here. The NAT gateway configures the DNAT lookup table index to index the initial destination IP address dip1 and the initial destination port dport1 to determine whether the DNAT lookup table includes the target destination IP address dip2 corresponding to the initial destination IP address dip1, and the target destination port dport2 corresponding to the initial destination port dport1. If yes, proceed to step S430; otherwise, proceed to step S460.
[0089] In step S430, an intermediate message is obtained by performing RSS check and network source address translation on the message based on the receiving queue, the target destination IP address, the target destination port dport2, the initial source IP address, and the initial source port.
[0090] The specific procedures described above have already been explained in detail, so they will not be repeated here.
[0091] Step S450 can be executed after step S430.
[0092] In step S440, an intermediate message is obtained by performing RSS check and network source address translation on the message based on the receive queue, initial source IP address, initial source port, initial destination IP address, and initial destination port.
[0093] In this example implementation, during the network source address translation process of the aforementioned packets, RSS verification is performed. Specifically, based on the receive queue, initial destination IP address dip1, initial source IP address sip1, and destination port dport2, the RSS verification is performed to adjust the destination source port to obtain the intermediate packet. That is, the four-tuple table for RSS verification includes the destination source IP address sip2, the destination source port, the initial destination IP address dip1, and the initial destination port. The specific RSS verification method can refer to relevant technologies and is not specifically limited in this example implementation.
[0094] After performing step S440, step S450 can be performed.
[0095] In step S450, the intermediate message is converted to a network destination address to obtain the target message, and the target message is sent to the receiving end according to the target destination IP address and the target destination port.
[0096] In this example implementation, the NAT gateway can perform network destination address translation (DNAT) on the intermediate packets. Specifically, DNAT is configured on the initial destination IP address dip1 and the initial destination port dport1 in the intermediate packets to obtain the target destination IP address dip2 and the target destination port dport2. That is, the target packets include the target source IP address sip2, the target source port sport2, the target destination IP address dip2, and the target destination port dport2.
[0097] In step S460, it is determined whether the DNAT lookup table includes the target destination IP address corresponding to the initial destination IP address.
[0098] When the NAT gateway detects that the DNAT lookup table does not simultaneously include the target destination IP address dip2 corresponding to the initial destination IP address dip1 and the target destination port dport2 corresponding to the initial destination port dport1, it can determine whether the DNAT lookup table includes the target destination IP address dip2 corresponding to the initial destination IP address dip1. If yes, proceed to step S470; otherwise, proceed to step S440.
[0099] In step S470, an intermediate message is obtained by performing RSS check and network source address translation on the message based on the receive queue, the target destination IP address, the initial destination port dport1, the initial source IP address, and the initial source port.
[0100] In this example implementation, during the network source address translation process of the aforementioned packet, RSS verification is performed. Specifically, based on the receive queue, the target destination IP address dip2, the initial source IP address sip1, and the target destination port dport2, RSS verification is performed and the target source port is adjusted to obtain the intermediate packet. First, the initial source IP address sip1 is translated to obtain the target source IP address sip2. Then, based on the receive queue, the target destination IP address dip2, the initial source IP address sip1, and the target source IP address sip2, the target source port is adjusted to obtain the intermediate packet. In other words, the four-tuple for RSS verification includes the target source port, the target source IP address sip2, the target destination IP address dip2, and the initial destination port dport1.
[0101] This application queries the DNAT configuration lookup table for the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port. Based on the receive queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port, it performs RSS verification and network source address translation on the packet quadruple to obtain an intermediate packet. The intermediate packet includes the target source IP address corresponding to the initial source IP address, the target source port corresponding to the initial source port, the initial destination IP address, and the initial destination port. The intermediate packet is then subjected to network destination address translation to obtain the target packet. The target packet is then sent to the receiving end according to the target destination IP address and the target destination port. Specifically, when the receiving end returns a packet to the NAT gateway, the packet will also include the packet quadruple from the target packet, namely, the target source IP address sip2, the target source port sport2, the target destination IP address dip2, and the target destination port dport2. That is, the four-tuple used in RSS verification is the same as the target source IP address sip2, the target source port sport2, the target destination IP address dip2, and the target destination port dport2. When the NAT gateway performs RSS verification according to step S430, the four-tuple of the message in the two RSS verifications is the same, which can ensure that the two received messages are received through the same receive queue, reducing the processor's computational load and memory usage, and improving the forwarding performance of the NAT network card.
[0102] Figure 5 This application provides a data interaction device 500, which includes a message receiving module 510, a data query module 520, an address translation module 530, and a data interaction module 540, wherein...
[0103] The message receiving module 510 can be used to receive messages sent by the sender through a receiving queue. The message includes the initial source IP address, the initial source port, the initial destination IP address, and the initial destination port.
[0104] The data query module 520 can be used to query the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port in the DNAT configuration query table.
[0105] Address translation module 530 can be used to respond to the DNAT configuration query table, which includes the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port. Based on the receive queue, target destination IP address, target destination port, initial source IP address, and initial source port, the intermediate message is obtained by performing RSS verification and network source address translation on the message. The intermediate message includes the target source IP address corresponding to the initial source IP address, the target source port corresponding to the initial source port, the initial destination IP address, and the initial destination port.
[0106] The data interaction module 540 can be used to perform network destination address translation on intermediate messages to obtain target messages, and send the target messages to the receiving end according to the target destination IP address and target destination port, so that the NAT gateway can receive the messages returned by the receiving end through the receiving queue.
[0107] In one example implementation, the address translation module 530 can perform RSS verification and adjust the target source port to obtain an intermediate message during the network source address translation of the message, based on the receiving queue, the target destination IP address, the target source IP address, and the target destination port, so that the NAT gateway can receive the message returned by the receiving end through the receiving queue.
[0108] Optionally, the address translation module 530 can also be used to perform RSS verification and network source address translation on the packet to obtain an intermediate packet when the DNAT configuration query table includes the target destination IP address corresponding to the initial destination IP address but does not include the target destination port corresponding to the initial destination port.
[0109] Optionally, the address translation module 530 can also be used to perform RSS verification and network source address translation on the packet based on the receive queue, initial source IP address, initial source port, initial destination IP address, and initial destination port when the DNAT configuration query table does not include the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port.
[0110] Optionally, the NAT gateway includes a DNAT configuration query function control switch. The data query module 520 can obtain the DNAT configuration query table in response to the DNAT configuration query function being enabled, and query the target IP address and target port corresponding to the initial destination IP address and the initial destination port in the DNAT configuration query table.
[0111] The aforementioned data interaction module can also be used to respond to the DNAT configuration query function being in a closed state, and to perform RSS verification and network source address translation on the message based on the receiving queue, initial source IP address, initial source port, initial destination IP address, and initial destination port to obtain an intermediate message.
[0112] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.
[0113] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.
[0114] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.
[0115] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.
[0116] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.
[0117] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.
[0118] Figure 6 This is a schematic diagram of the structure of a NAT gateway 600 provided in this application. Figure 6 As shown, the electronic device 600 may include at least one processor 610, a memory 620, and a communication interface 630.
[0119] The memory 620 is used to store programs. Specifically, the program may include program code, which includes computer operation instructions.
[0120] The memory 620 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.
[0121] The processor 610 is used to execute computer execution instructions stored in the memory 620 to implement the monitoring method described in the foregoing method embodiments. The processor 610 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.
[0122] The NAT gateway 600 may also include a communication interface 630, through which it can communicate and interact with external devices. In a specific implementation, if the communication interface 630, memory 620, and processor 610 are implemented independently, they can be interconnected via a bus to complete communication. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc., but this does not imply that there is only one bus or one type of bus.
[0123] Optionally, in a specific implementation, if the communication interface 630, memory 620 and processor 610 are integrated on a single chip, then the communication interface 630, memory 620 and processor 610 can communicate through an internal interface.
[0124] This application also provides a computer-readable storage medium, which may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory, a random access memory, a disk, or an optical disk. Specifically, the computer-readable storage medium stores program instructions, which are used in the monitoring method described in the above embodiments.
[0125] This application also provides a program product including execution instructions stored in a readable storage medium. At least one processor of the banking system can read the execution instructions from the readable storage medium, and the execution of the execution instructions by the at least one processor enables the banking system to implement the monitoring methods provided in the various embodiments described above.
[0126] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.
[0127] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.
[0128] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as these combinations of technical features do not contradict each other, they should be considered within the scope of this specification.
[0129] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.
[0130] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. A data interaction method, characterized in that, This method is applied to a NAT gateway, where the traffic type of the NAT gateway is traffic between internal virtual machines. The method is used for communication between internal virtual machines via elastic public IP addresses, where both the sending and receiving ends are located within a private network, and packets need to undergo SNAT via the NAT gateway before entering the public VRF network, and then be forwarded to the receiving end via DNAT. The method includes: The message sent by the sender is received through the receive queue. The message includes the initial source IP address, the initial source port, the initial destination IP address, and the initial destination port. Query the DNAT configuration lookup table for the target destination IP address corresponding to the initial destination IP address, and the target destination port corresponding to the initial destination port; If the DNAT configuration query table includes the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port, then based on the receiving queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port, the packet is subjected to RSS verification and network source address translation to obtain an intermediate packet. The intermediate packet includes the target source IP address corresponding to the initial source IP address, the target source port corresponding to the initial source port, the initial destination IP address, and the initial destination port. The intermediate message is converted to a network destination address to obtain a target message, and the target message is sent to the receiving end according to the target destination IP address and target destination port, so that the NAT gateway can receive the message returned by the receiving end through the receiving queue; so that the message quadruple of the message returned by the receiving end received by the NAT gateway is the same as the message quadruple of the RSS verification. The process of obtaining intermediate packets by performing RSS checks and network source address translation on the packets based on the receiving queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port includes: During the network source address translation process of the packet, the target source port is adjusted by performing RSS verification based on the receiving queue, the target destination IP address, the target source IP address, and the target destination port to obtain the intermediate packet, so that the NAT gateway can receive the packet returned by the receiving end through the receiving queue.
2. The method according to claim 1, characterized in that, The method further includes: If the DNAT configuration query table includes the target destination IP address corresponding to the initial destination IP address but does not include the target destination port corresponding to the initial destination port, then an intermediate packet is obtained by performing RSS verification and network source address translation on the packet based on the receiving queue, the target destination IP address, the initial destination port, the initial source IP address, and the initial source port.
3. The method according to claim 1, characterized in that, The method further includes: If the DNAT configuration lookup table does not include the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port, then an intermediate packet is obtained by performing RSS verification and network source address translation on the packet based on the receiving queue, initial source IP address, initial source port, initial destination IP address, and initial destination port.
4. The method according to claim 1, characterized in that, The NAT gateway includes a DNAT configuration query function control switch. The step of querying the DNAT configuration query table for the initial destination IP address and the target destination IP address and target destination port corresponding to the initial destination port includes: If the DNAT configuration query function is enabled, the DNAT configuration query table is obtained, and the target destination IP address and target destination port corresponding to the initial destination IP address and initial destination port are queried in the DNAT configuration query table.
5. The method according to claim 4, characterized in that, The method further includes: If the DNAT configuration query function is in the off state, then the intermediate message is obtained by performing RSS verification and network source address translation on the message based on the receiving queue, initial source IP address, initial source port, initial destination IP address, and initial destination port.
6. The method according to any one of claims 1 to 5, characterized in that, The step of performing network destination address translation on the intermediate message to obtain the target message includes: The initial destination IP address and initial destination port in the intermediate message are converted to network destination address to obtain the target destination IP address and target destination port. The target message includes the target destination IP address, the target destination port, the target source IP address, and the target source port.
7. A data interaction device, characterized in that, This device is applied to a NAT gateway, where the traffic type of the NAT gateway is traffic between internal virtual machines. The device is used for communication between internal virtual machines via elastic public IP addresses, wherein both the sending and receiving ends are located within a private network, and packets need to undergo SNAT via the NAT gateway before entering the public network VRF, and then be forwarded to the receiving end via DNAT; the device includes: The message receiving module is used to receive messages sent by the sending end through a receiving queue. The message includes an initial source IP address, an initial source port, an initial destination IP address, and an initial destination port. The data query module is used to query the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port in the DNAT configuration query table; The address translation module is used to respond to the DNAT configuration query table including the target destination IP address corresponding to the initial destination IP address and the target destination port corresponding to the initial destination port, and then perform RSS verification and network source address translation on the packet based on the receiving queue, the target destination IP address, the target destination port, the initial source IP address, and the initial source port to obtain an intermediate packet; The intermediate message includes the target source IP address corresponding to the initial source IP address, the target source port corresponding to the initial source port, the initial destination IP address, and the initial destination port; The data interaction module is used to perform network destination address translation on the intermediate message to obtain the target message, and send the target message to the receiving end according to the target destination IP address and target destination port, so that the NAT gateway can receive the message returned by the receiving end through the receiving queue; so that the message quadruple of the message returned by the receiving end received by the NAT gateway is the same as the message quadruple of the RSS verification. The address translation module is used to perform RSS verification and adjust the target source port based on the receiving queue, the target destination IP address, the target source IP address, and the target destination port during the network source address translation process of the packet to obtain the intermediate packet, so that the NAT gateway can receive the packet returned by the receiving end through the receiving queue.
8. A NAT gateway, characterized in that, include: A processor, and a memory and a communication interface communicatively connected to the processor; The processor transmits messages through the communication interface; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 6.