Ebpf-based packet processing method, electronic device, and computer program product

Abstract

The application discloses an eBPF-based data packet processing method, an electronic device and a computer program product, and belongs to the field of communication. The eBPF-based data packet processing method comprises the following steps: an eBPF program is used by a sending device to obtain M target data packets to be sent; in the case that a target communication connection has been established between the sending device and a receiving device, the sending device sends the M target data packets through the target communication connection; wherein label coding information of a target label of the sending device is added in the packet header of a first target data packet in the M target data packets, and the label coding information is not added in other target data packets except the first target data packet in the M target data packets.

Description

Technical Field

[0001] This application belongs to the field of communications, specifically relating to a packet processing method, electronic device, and computer program product based on eBPF. Background Technology

[0002] Currently, to ensure network security, network firewalls are commonly used to filter data packets. Network firewalls primarily filter data packets based on static information such as Internet Protocol (IP) addresses, port numbers, and protocol types.

[0003] In real-time computing power scheduling scenarios, application IP addresses may change frequently. Furthermore, in some situations, attackers often spoof IP addresses to conceal their true identities in an attempt to bypass firewalls and launch network attacks.

[0004] Therefore, the current method of filtering packets based on IP addresses is ineffective, and a packet processing method that can handle changes in IP addresses is needed. Summary of the Invention

[0005] This application provides a packet processing method, electronic device, and computer program product based on the Extended Berkeley Packet Filter (eBPF), which can further improve the filtering effect of packets by responding to changes in IP addresses in packets, and solves the problem that the current method of packet filtering based on IP addresses is not effective.

[0006] In a first aspect, embodiments of this application provide a packet processing method based on eBPF, the method comprising:

[0007] The transmitting device acquires M target data packets to be sent based on the eBPF program;

[0008] If a target communication connection has been established between the sending device and the receiving device, the sending device sends the M target data packets through the target communication connection;

[0009] The header of the first target data packet among the M target data packets contains the tag encoding information of the target tag of the sending device, while the tag encoding information is not added to the other target data packets among the M target data packets except for the first target data packet.

[0010] Secondly, embodiments of this application provide another packet processing method based on eBPF, the method comprising:

[0011] The firewall device receives M target data packets after eBPF processing. The header of the first target data packet contains the tag encoding information of the sending device's target tag. The other target data packets in the M target data packets do not contain the tag encoding information.

[0012] If there is no session entry matching the target data packet on the firewall device, the firewall device obtains the tag encoding information from the header of the target data packet;

[0013] The firewall device queries the target filtering rules for the target data packet in the label security policy table based on the label encoding information.

[0014] If the target data packet matches the target filtering rule, the firewall device forwards the target data packet;

[0015] If the target data packet does not conform to the target filtering rule, the firewall device discards the target data packet.

[0016] Thirdly, embodiments of this application provide an electronic device, which includes a processor and a memory, wherein the memory stores a program or instructions that can run on the processor, and the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0017] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0018] Fifthly, embodiments of this application provide a computer program product, the computer program product including a computer program, which, when executed by the processor, implements the steps of the method described in the first aspect.

[0019] In this embodiment, the sending device obtains M target data packets to be sent based on an eBPF program. If a target communication connection has been established between the sending device and the receiving device, the sending device sends the M target data packets through the target communication connection. The header of the first target data packet contains the tag encoding information of the sending device's target tag, while the other target data packets do not contain this tag encoding information. Thus, by adding the tag encoding information of the sending device's target tag to the first of the M target data packets to be sent, the firewall device can respond to changes in IP addresses within the data packets. The added tag encoding information further improves the filtering effect of the data packets, solving the problem of ineffectiveness in current IP address-based data packet filtering methods. Simultaneously, since the tag encoding information of the sending device's target tag is added only to the header of the first target data packet among the M data packets, and the other data packets do not contain tag encoding information, the network quality degradation problem caused by the increased header length due to adding tag encoding information to all data packets is avoided. Attached Figure Description

[0020] Figure 1-1 This is an overall architecture diagram of a packet processing method based on eBPF provided in an embodiment of this application;

[0021] Figure 1-2 This is a schematic diagram of the tag management plane involved in a packet processing method based on eBPF provided in an embodiment of this application;

[0022] Figure 1-3 This is a schematic diagram of the structure of an IP data packet provided in an embodiment of this application;

[0023] Figure 2 This is a flowchart of a packet processing method based on eBPF provided in an embodiment of this application;

[0024] Figure 3 This is a flowchart of another packet processing method based on eBPF provided in an embodiment of this application;

[0025] Figure 4 This is a flowchart of another packet processing method based on eBPF provided in an embodiment of this application;

[0026] Figure 5 This is a flowchart of another packet processing method based on eBPF provided in an embodiment of this application;

[0027] Figure 6This is a flowchart of another packet processing method based on eBPF provided in an embodiment of this application;

[0028] Figure 7 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0029] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0030] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0031] Network firewalls primarily filter data packets based on static information such as IP address, port number, and protocol type. However, in real-time computing power scheduling scenarios, application IP addresses can change at any time, making static policy configurations ineffective in adapting to these real-time IP address changes.

[0032] Therefore, in computing network scenarios, traditional firewall packet filtering methods cannot adapt to scenarios with large business scale and complex data traffic interactions, resulting in low packet processing efficiency. Figure 1-1 This is an overall architecture diagram of a packet processing method based on eBPF provided in an embodiment of this application. Figure 1-1 As shown, the eBPF-based packet processing method provided in this application involves a label management plane and a traffic processing plane. Based on eBPF technology and the Transmission Control Protocol (TCP) / IP protocol, it implements application-layer-agnostic and highly efficient user label addition for specific data packets at the kernel protocol stack layer of the computing network node, effectively avoiding the problem of low packet processing efficiency. The computing network includes multiple computing nodes, and any computing node can act as a sending device to execute the eBPF-based packet processing method provided in this application.

[0033] The tag management plane mainly includes service discovery, tag distribution, configuration management database (hereinafter referred to as the database), tag encoding, and policy distribution. The tag management plane is primarily responsible for registering user computing nodes, managing and distributing user-defined tag codes, and managing and distributing tag-based network firewall policies.

[0034] The traffic processing plane mainly consists of a packet definition module and a firewall identification module running on the user's computing power nodes. The sending device (any computing power node) adds user-defined resource tags to the packets to be sent via the packet definition module. The firewall identification module is responsible for identifying the packet tags and filtering the packets according to the corresponding security policies.

[0035] Figure 1-2 This is a schematic diagram of the tag management plane involved in a packet processing method based on eBPF provided in an embodiment of this application. Figure 1-2 As shown, the tag management plane mainly consists of three parts: database, tag distribution, and policy distribution. Tag distribution is primarily implemented through three sub-processes:

[0036] 1. After deployment or restart, the data packet definition module sends node registration information, including IP address and hostname, to the service discovery module.

[0037] 2. After receiving the node registration information from the data packet definition module, the service discovery module reads the node registry in the database to find the node's node group and tag. If the service discovery module does not find the node's node group and tag, it assigns the node to the default tag and updates the node status in the node registry. The node registry, defined by the administrator, records the correspondence between nodes and their respective groups. Specifically, the ID is the unique identifier of the node in the computing network, the node IP is the node's current IP address, the node group name records the information of the current node's group, the tag is a user-defined identifier corresponding to the node, and the status records the node's online / offline information.

[0038] Third, the tag distribution module queries the tag binary encoding table to determine the binary encoding corresponding to the node tag based on the node tag, and sends the tag binary encoding to the data packet definition module for local caching.

[0039] Furthermore, the policy distribution process and the label distribution process do not interfere with each other. The policy distribution process monitors changes in the label security policy table and synchronously queries the label binary encoding table to convert the labels in the label security policy table into binary encoding, thereby achieving the purpose of distributing the security policy to specific firewall devices.

[0040] In execution such Figure 2Prior to the eBPF-based packet processing method shown, the packet definition module can execute an initialization process to initialize itself. Specifically, the packet definition module enters the initialization process after the computing node completes deployment or restarts:

[0041] Load the eBPF packet definition program into the kernel environment of the computing node host, and set the program execution start point to the end of the kernel IP protocol entry function.

[0042] Send confirmation information to the service discovery module of the tag management plane and query the tag management database to obtain the tag binary code and firewall session entry expiration time corresponding to the computing node.

[0043] Create a Map data structure (a type of data structure used to store data with mapping relationships) to store node tags, where the key is the node host IP and the value is the tag binary code value corresponding to the sending device.

[0044] Create a Map data structure to store the virtual connection state of the User Datagram Protocol (UDP) on the node host. The key is the calculated network quadruple hash value of the first packet of the UDP connection, and the value is an array that stores the expiration time of the obtained firewall session entry and the time when the first packet passed through the IP protocol stack.

[0045] Initialization complete, waiting for business data packets to enter the kernel.

[0046] Figure 2 This is a flowchart of a packet processing method based on eBPF provided in an embodiment of this application, such as... Figure 2 As shown in the embodiments of this application, the packet processing method based on eBPF includes:

[0047] Step 210: The sending device uses the extended Berkeley packet capture filter eBPF program to obtain the M target data packets to be sent;

[0048] It should be noted that the eBPF-based packet processing method provided in this application can be applied to computing power networks. Here, computing power networks refer to a new type of information infrastructure that, based on the continuous ubiquitous development of computing power, allocates and flexibly schedules computing and storage resources on demand among the cloud, edge, and terminal through network means according to business needs.

[0049] In step 210, the computing power network can be understood as a server cluster, the sending device can be a node in the computing power network, the node can be a server or a data center, and the data packet can be an IP data packet.

[0050] In step 210, obtaining the M target data packets to be sent can be achieved as follows: the sending device obtains its tag encoding information based on the eBPF program; the sending device adds the tag encoding information to the option field of the header of the first data packet among the M data packets to be sent, thus obtaining the first target data packet. The tag encoding information is a fixed-length binary code. The option field includes a variable-length field, the length of which is custom-defined as 4 bytes.

[0051] Figure 1-3 This is a schematic diagram of the structure of an IP data packet provided in an embodiment of this application. For example... Figure 1-3 As shown, an IP packet is the basic unit for transmitting data in network communication, typically consisting of a header and a data portion. The header contains metadata information, such as the source IP address, destination IP address, and protocol type. Figure 1-3 As shown, the options field is located at the end of the IP packet header and consists of a type field, a length field, a variable length field, and a padding field. The options field is used to add custom information to the IP packet, such as timestamps, routing information, or label encoding information.

[0052] In this scheme, the options fields are defined as shown in Table 1 below:

[0053]

[0054] Furthermore, after obtaining the first target data packet using the above method, the remaining M-1 data packets out of the M data packets can be directly identified as target data packets. Specifically, after the sending device establishes a communication connection (TCP connection or UDP virtual connection) with the receiving device (the device receiving the data packets), the processing strategy for all data packets sent by the sending device in the communication connection can be determined by performing policy matching using the tag encoding information of the first data packet. Therefore, after the first target data packet sent in the communication connection carries tag encoding information, the other data packets among the M data packets excluding the first data packet can be directly identified as target data packets without adding additional tag encoding information.

[0055] In the implementation of step 210 above, the specific process by which the transmitting device obtains the tag encoding information of the transmitting device based on the eBPF program is as follows:

[0056] First, check whether the target tag of the transmitting device already exists in the tag encoding mapping table, which contains the mapping relationship between tags and binary codes.

[0057] The tag encoding mapping table stores tags and their corresponding binary codes. When the length of the variable-length field in the option field is customized to 4 bytes, the tag is converted into a fixed-length 32-bit unique binary code.

[0058] Second, if the target tag of the transmitting device already exists in the tag encoding mapping table, the binary code corresponding to the target tag is obtained from the tag encoding mapping table and used as the tag encoding information of the transmitting device.

[0059] The transmitting device adds tags to data packets through a data packet definition module, which includes an eBPF data packet definition program. If the data packet definition module in the transmitting device detects that the target tag of the transmitting device already exists in the tag encoding mapping table, it retrieves the binary code corresponding to the target tag from the tag encoding mapping table in the database, without needing to create an encoding mapping.

[0060] Third, if the target tag of the transmitting device does not exist in the tag encoding mapping table, check if the available encoding pool is empty; if the available encoding pool is not empty, take a binary code from the available encoding pool as the tag encoding information of the transmitting device, and remove the taken binary code from the available encoding pool; if the available encoding pool is empty, generate a binary code for the transmitting device, use the generated binary code as the tag encoding information of the transmitting device, and write the generated binary code and the target tag into the tag encoding mapping table.

[0061] The available encoding pool is a pre-created encoding pool used to store invalid or deleted binary codes. If the target tag of the transmitting device does not exist in the tag encoding mapping table, the binary code stored in the available encoding pool can be used as the tag encoding information of the transmitting device.

[0062] However, the available encoding pool may be empty (i.e., there is no binary encoding in the available encoding pool). In this case, a new binary encoding can be generated for the transmitting device using the following method: For the i-th tag (i≥0 and i≤2) 32 The unique binary code (code) of the i-th tag is calculated using a formula, where XOR represents a bitwise XOR operation. Simultaneously, an incrementing counter C is created, initially set to 0. The value of C increments by 1 for each generated code, ensuring that each tag has a unique binary code, suitable for situations where the number of tags changes dynamically. The binary code calculation formula is as follows:

[0063] code = C XOR i

[0064] Where code is the unique binary code of the i-th tag, C is the value of the counter, and i is the tag number.

[0065] Furthermore, after calculating the binary code corresponding to the target tag, the tag can be associated with its corresponding binary code to generate a mapping relationship, which is then written into the tag encoding conversion table. Similarly, when deleting a tag, the tag's corresponding binary code can be removed from the tag encoding mapping table, and the corresponding binary code can be written into the available encoding pool.

[0066] In the implementation of step 210 above, the specific process by which the sending device adds the tag encoding information to the option field of the header of the first data packet among the M data packets to be sent is as follows:

[0067] It should be noted that, in the embodiments of this application, the addition of the tag encoding information can be implemented by the data packet definition module, which includes the eBPF data packet definition program.

[0068] Before adding the tag encoding information to the options field of the packet header, the packet can be preprocessed. For example, after the packet's header is encapsulated in the IP protocol entry function, an eBPF packet definition program can be executed on the packet. The kernel SKB (sk_buff) pointer of the packet is obtained, where SKB is the data structure storing the packet. The transport layer protocol type of the packet is obtained through the SKB pointer, and tag encoding information is added to packets under different transport layer protocol types. The specific addition method is as follows:

[0069] In the first case, if the data packet is a TCP data packet, for each of the M TCP data packets to be sent, perform the following operations:

[0070] Obtain the value of the Synchronize Sequence Numbers (SYN) flag in the TCP packet header. For example, obtain the TCP header pointer and calculate the header field offset to obtain the TCP header SYN flag.

[0071] If the SYN flag is set to 1, the TCP packet is identified as the first TCP packet, and the aforementioned tag encoding information is added to the options field of the header of the first TCP packet to obtain the first target packet. If the SYN flag is not set to 1, then the TCO packet is not the first TCP packet, and in this case, the TCP packet can be sent directly to the IP protocol processing function without processing.

[0072] The process of adding tag encoding information is as follows: First, the Map data structure S inside the sending device, which is used to store node tags, is queried through the node IP. label First, obtain the tag binary code value corresponding to the tag of the sending device. Then, obtain the IP header pointer and calculate the header field offset to obtain the starting address of the IP header options field. Finally, write the 4-byte tag code into the memory corresponding to the options field, completing the addition of tag code information to the options field of the data packet.

[0073] In the second scenario, if the data packet is a UDP data packet, for each of the M UDP data packets to be sent, perform the following operations:

[0074] Calculate the hash value of the UDP packet. Specifically, obtain the UDP header pointer and IP header pointer, and calculate the offsets of the UDP and IP header fields respectively, thereby obtaining the UDP packet quadruple, namely the source IP (Src_IP), source port (Src_Port), destination IP (Dest_IP), and destination port (Dest_Port).

[0075] Then, the hash value of the data packet is calculated using the following formula:

[0076] V UDP =Hach(Src-IP,Src_Port,Dest_IP,Dest_Port)

[0077] The hash value is used as the key to query the data table used to store the host UDP virtual connection state. Specifically, V... UDP The key query sends a Map data structure S stored internally by the device, which is used to store the UDP virtual connection state of the node host. UDP_F .

[0078] If the hash value does not exist in the data table, the UDP packet is identified as the first UDP packet.

[0079] Specifically, if S UDP_F There is no V in the middle. UDP If the same key is used, it is assumed that the UDP virtual connection does not exist, and the UDP packet can be considered the first packet of the UDP virtual connection. In this case, the tag encoding information is added to the options field of the header of the first UDP packet to obtain the first target packet.

[0080] In addition, the current system time T can be set. c Firewall session entry expiration time T e Write the value array in S UDP_F Add a new record for the virtual connection.

[0081] If S UDP_F If the same key exists, then retrieve the current system time T. n And calculate if T n -T c If T n -T c Less than or equal to T e Send the data packet to the IP protocol processing function, and use the current system time T. n Update S UDP_F The system time T corresponding to the key c If T n -T c Greater than T e Then, the data packet is sent to the IP protocol processing function and the S is deleted. UDP_F The key-value record in the database.

[0082] Step 220: If a target communication connection has been established between the sending device and the receiving device, the sending device sends the M target data packets through the target communication connection;

[0083] In this step, the header of the first target data packet among the M target data packets contains the tag encoding information of the target tag of the sending device, while the other target data packets among the M target data packets do not contain the tag encoding information.

[0084] In this embodiment, the sending device obtains M target data packets to be sent based on an eBPF program. If a target communication connection has been established between the sending device and the receiving device, the sending device sends the M target data packets through the target communication connection. The header of the first target data packet contains the tag encoding information of the sending device's target tag, while the other target data packets do not contain this tag encoding information. Thus, by adding the tag encoding information of the sending device's target tag to the first of the M target data packets to be sent, the firewall device can respond to changes in IP addresses within the data packets. The added tag encoding information further improves the filtering effect of the data packets, solving the problem of ineffectiveness in current IP address-based data packet filtering methods. Simultaneously, since the tag encoding information of the sending device's target tag is added only to the header of the first target data packet among the M data packets, and the other data packets do not contain tag encoding information, the network quality degradation problem caused by the increased header length due to adding tag encoding information to all data packets is avoided.

[0085] Figure 3 This is a flowchart of another packet processing method based on eBPF provided in an embodiment of this application, such as... Figure 3 As shown in the embodiments of this application, the packet processing method based on eBPF includes:

[0086] Step 310: Check whether the target tag of the transmitting device already exists in the tag encoding mapping table, which contains the mapping relationship between tags and binary codes;

[0087] In this step, the tag encoding mapping table is a table that stores tags and their corresponding binary codes. When the length of the variable-length field in the option field is customized to 4 bytes, the tag is converted into a fixed-length 32-bit unique binary code.

[0088] Step 320: If the target tag of the transmitting device already exists in the tag encoding mapping table, obtain the binary code corresponding to the target tag from the tag encoding mapping table as the tag encoding information of the transmitting device;

[0089] In this step, the transmitting device adds tags to the data packets through the data packet definition module, which includes the eBPF data packet definition program. If the data packet definition module in the transmitting device detects that the target tag of the transmitting device already exists in the tag encoding mapping table, it retrieves the binary code corresponding to the target tag from the tag encoding mapping table in the database, without needing to create an encoding mapping.

[0090] Step 330: If the target tag of the transmitting device does not exist in the tag encoding mapping table, check if the available encoding pool is empty;

[0091] In this step, the available encoding pool is a pre-created encoding pool used to store invalid or deleted binary codes. If the target tag of the transmitting device does not exist in the tag encoding mapping table, the binary code stored in the available encoding pool can be used as the tag encoding information for the transmitting device.

[0092] Step 340: If the available coding pool is not empty, take a binary code from the available coding pool as the tag coding information of the transmitting device, and remove the taken binary code from the available coding pool;

[0093] Step 350: If the available encoding pool is empty, generate a binary code for the transmitting device, use the generated binary code as the tag encoding information of the transmitting device, and write the generated binary code and the target tag into the tag encoding mapping table.

[0094] In this step, the available encoding pool may be empty (i.e., there is no binary encoding in the available encoding pool). In this case, a new binary encoding can be generated for the transmitting device using the following method: For the i-th tag (i≥0 and i≤2) 32 The unique binary code (code) of the i-th tag is calculated using a formula, where XOR represents a bitwise XOR operation. Simultaneously, an incrementing counter C is created, initially set to 0. The value of C increments by 1 for each generated code, ensuring that each tag has a unique binary code, suitable for situations where the number of tags changes dynamically. The binary code calculation formula is as follows:

[0095] code = C XOR i

[0096] Where code is the unique binary code of the i-th tag, C is the value of the counter, and i is the tag number.

[0097] Step 360: The sending device adds the tag encoding information to the option field of the header of the first data packet in the M data packets to be sent, to obtain the first target data packet; wherein, the tag encoding information is a binary code of fixed byte length.

[0098] It should be noted that, in the embodiments of this application, the addition of the tag encoding information can be implemented by the data packet definition module, which includes the eBPF data packet definition program.

[0099] Before adding the tag encoding information to the options field of the packet header, the packet can be preprocessed. For example, after the packet's header is encapsulated in the IP protocol entry function, an eBPF packet definition program can be executed on the packet. The kernel SKB (sk_buff) pointer of the packet is obtained, where SKB is the data structure storing the packet. The transport layer protocol type of the packet is obtained through the SKB pointer, and tag encoding information is added to packets under different transport layer protocol types. The specific addition method is as follows:

[0100] In the first case, if the data packet is a TCP data packet, for each of the M TCP data packets to be sent, perform the following operations:

[0101] Obtain the value of the SYN flag in the TCP packet header. For example, obtain the TCP header pointer and calculate the header field offset to obtain the TCP header SYN flag.

[0102] If the SYN flag is set to 1, the TCP packet is identified as the first TCP packet, and the aforementioned tag encoding information is added to the options field of the header of the first TCP packet to obtain the first target packet. If the SYN flag is not set to 1, then the TCO packet is not the first TCP packet, and in this case, the TCP packet can be sent directly to the IP protocol processing function without processing.

[0103] The process of adding tag encoding information is as follows: First, the Map data structure S inside the sending device, which is used to store node tags, is queried through the node IP. label First, obtain the tag binary code value corresponding to the tag of the sending device. Then, obtain the IP header pointer and calculate the header field offset to obtain the starting address of the IP header options field. Finally, write the 4-byte tag code into the memory corresponding to the options field, completing the addition of tag code information to the options field of the data packet.

[0104] In the second scenario, if the data packet is a UDP data packet, for each of the M UDP data packets to be sent, perform the following operations:

[0105] Calculate the hash value of the UDP packet. Specifically, obtain the UDP header pointer and IP header pointer, and calculate the offsets of the UDP and IP header fields respectively, thereby obtaining the UDP packet quadruple, namely the source IP (Src_IP), source port (Src_Port), destination IP (Dest_IP), and destination port (Dest_Port).

[0106] Then, the hash value of the data packet is calculated using the following formula:

[0107] V UDP =Hach(Src-IP,Src_Port,Dest_IP,Dest_Port)

[0108] The hash value is used as the key to query the data table used to store the host UDP virtual connection state. Specifically, V... UDP The key query sends a Map data structure S stored internally by the device, which is used to store the UDP virtual connection state of the node host. UDP_F .

[0109] If the hash value does not exist in the data table, the UDP packet is identified as the first UDP packet.

[0110] Specifically, if S UDP_F There is no V in the middle. UDPIf the key is the same, it is assumed that the UDP virtual connection does not exist, and the UDP packet can be considered the first packet of the UDP virtual connection. In this case, the tag encoding information is added to the options field of the header of the first UDP packet to obtain the first target packet. Additionally, the current system time T can also be used. c Firewall session entry expiration time T e Write the value array in S UDP_F Add a new record for the virtual connection.

[0111] If S UDP_F If the same key exists, then retrieve the current system time T. n And calculate if T n -T c If T n -T c Less than or equal to T e Send the data packet to the IP protocol processing function, and use the current system time T. n Update S UDP_F The system time T corresponding to the key c If T n -T c Greater than T e Then, the data packet is sent to the IP protocol processing function and the S is deleted. UDP_F The key-value record in the database.

[0112] Step 370: If a target communication connection has been established between the transmitting device and the receiving device, the transmitting device transmits the M target data packets through the target communication connection.

[0113] In this embodiment, by adding the target tag encoding information of the sending device to the first data packet of the M target data packets to be sent, the firewall device can cope with changes in the IP address of the data packets. The added tag encoding information further improves the filtering effect of the data packets, solving the problem of ineffective data packet filtering based on IP address. Simultaneously, since the target tag encoding information of the sending device is added only to the header of the first target data packet of the M data packets, and no tag encoding information is added to the other M data packets, the network quality degradation problem caused by the increased header length due to adding tag encoding information to all data packets is avoided. Furthermore, the sending device determines its tag encoding information based on three methods: a tag encoding mapping table, an available encoding pool, and generated binary encoding. This ensures that the sending device can obtain the target tag's tag encoding information in various situations, preventing the firewall device's data packet filtering effect from being affected by the sending device's inability to obtain the tag encoding information.

[0114] Figure 4 This is a flowchart of another packet processing method based on eBPF provided in an embodiment of this application, such as... Figure 4 As shown in the embodiments of this application, the packet processing method based on eBPF includes:

[0115] Step 401: Check whether the target tag of the transmitting device already exists in the tag encoding mapping table, which contains the mapping relationship between tags and binary codes;

[0116] Step 402: If the target tag of the transmitting device already exists in the tag encoding mapping table, obtain the binary code corresponding to the target tag from the tag encoding mapping table as the tag encoding information of the transmitting device;

[0117] Step 403: If the target tag of the transmitting device does not exist in the tag encoding mapping table, check if the available encoding pool is empty;

[0118] Step 404: If the available coding pool is not empty, take a binary code from the available coding pool as the tag coding information of the transmitting device, and remove the taken binary code from the available coding pool;

[0119] Step 405: If the available encoding pool is empty, generate a binary code for the transmitting device, use the generated binary code as the tag encoding information of the transmitting device, and write the generated binary code and the target tag into the tag encoding mapping table.

[0120] For a detailed explanation of steps 401 to 405, please refer to the following: Figure 3 Description of the corresponding steps.

[0121] Before adding the tag encoding information to the options field in the packet header, the packet can be preprocessed. For example, after the packet's header encapsulation is completed in the IP protocol entry function, an eBPF packet definition program can be executed on the packet. The kernel SKB (sk_buff) pointer of the packet is obtained, where SKB is the data structure storing the packet. The transport layer protocol type of the packet is obtained through the SKB pointer, and tag encoding information is added to packets under different transport layer protocol types.

[0122] Step 406: If the data packet is a TCP data packet, for each of the M TCP data packets to be sent, perform the following operation: obtain the value of the SYN flag bit in the header of the TCP data packet;

[0123] In this step, the TCP header pointer can be obtained and the header field offset can be calculated, thereby obtaining the TCP header SYN.

[0124] Step 407: If the SYN flag is set to 1, then this TCP packet is identified as the first TCP packet.

[0125] In this step, if the value of the SYN flag is not 1, then the TCO data packet is not the first TCP data packet. In this case, the TCP data packet can be sent directly to the IP protocol processing function without processing.

[0126] Step 408: Add the tag encoding information to the options field of the header of the first TCP packet to obtain the first target packet;

[0127] In this step, the process of adding tag encoding information is as follows: First, the Map data structure S inside the sending device, which is used to store node tags, is queried through the node IP. label First, obtain the tag binary code value corresponding to the tag of the sending device. Then, obtain the IP header pointer and calculate the header field offset to obtain the starting address of the IP header options field. Finally, write the 4-byte tag code into the memory corresponding to the options field, completing the addition of tag code information to the options field of the data packet.

[0128] Step 409: If the data packet is a UDP data packet, for each of the M UDP data packets to be sent, perform the following operation: calculate the hash value of the UDP data packet;

[0129] In this step, the sending device obtains the UDP header pointer and IP header pointer and calculates the offsets of the UDP and IP header fields respectively, thereby obtaining the UDP packet quadruple, namely the source IP (Src_IP), source port (Src_Port), destination IP (Dest_IP), and destination port (Dest_Port).

[0130] Then, the hash value of the data packet is calculated using the following formula:

[0131] V UDP =Hach(Src-IP,Src_Port,Dest_IP,Dest_Port)

[0132] Step 410: Query the data table used to store the host UDP virtual connection status using the hash value as the key;

[0133] In this step, V can be used. UDP Using the key, query the Map data structure S stored internally by the sending device, which is used to store the UDP virtual connection status of the node host.UDP_F .

[0134] Step 411: If the hash value does not exist in the data table, the UDP packet is identified as the first UDP packet;

[0135] In this step, if S UDP_F There is no V in the middle. UDP If the same key is used, it is assumed that the UDP virtual connection does not exist, and the UDP packet can be considered as the first packet of the UDP virtual connection.

[0136] If S UDP_F If the same key exists, then retrieve the current system time T. n And calculate if T n -T c If T n -T c Less than or equal to T e Send the data packet to the IP protocol processing function, and use the current system time T. n Update S UDP_F The system time T corresponding to the key c If T n -T c Greater than T e Then, the data packet is sent to the IP protocol processing function and the S is deleted. UDP_F The key-value record in the database.

[0137] Step 412: Add the tag encoding information to the options field of the header of the first UDP packet to obtain the first target packet; wherein, the tag encoding information is a fixed-length binary code.

[0138] In this step, the current system time T can also be set. c Firewall session entry expiration time T e Write the value array in S UDP_F Add a new record for the virtual connection.

[0139] Step 413: If a target communication connection has been established between the transmitting device and the receiving device, the transmitting device transmits the M target data packets through the target communication connection.

[0140] In this embodiment, by adding the target tag encoding information of the sending device to the first data packet of the M target data packets to be sent, the firewall device can respond to changes in IP addresses in the data packets. The added tag encoding information further improves the filtering effect of the data packets, solving the problem of ineffectiveness in current IP address-based data packet filtering methods. Simultaneously, since the target tag encoding information of the sending device is added only to the header of the first target data packet of the M data packets, and no tag encoding information is added to the other M data packets, the network quality degradation problem caused by the increased header length due to adding tag encoding information to all data packets is avoided. Furthermore, the sending device provides targeted methods for adding tag encoding information to TCP and UDP data packets respectively, enabling the addition of encoding information to various data packets and preventing the firewall device's filtering effect from being affected by the failure to add tag encoding information to data packets.

[0141] Figure 5 This is a flowchart of another packet processing method based on eBPF provided in an embodiment of this application, such as... Figure 5 As shown in the embodiments of this application, the packet processing method based on eBPF includes:

[0142] Step 510: The firewall device receives M target data packets after processing by the extended Berkeley packet capture filter eBPF. The header of the first target data packet contains the tag encoding information of the sending device's target tag. The other target data packets in the M target data packets do not contain the tag encoding information.

[0143] In this step, the firewall device can be a hardware firewall or any device that hosts a software firewall.

[0144] After receiving M target data packets processed by eBPF, the firewall device parses the data packets to obtain 5-tuple information. The 5-tuple information consists of the source IP, source port, destination IP, destination port, and protocol information.

[0145] At this point, the firewall device checks its internally stored session table information to determine if a session table entry matches the target data packet. If so, the firewall device can directly forward the data packet. The method for matching session table entries can be implemented by matching source and destination port information, or by matching 5-tuple information.

[0146] Step 520: If there is no session entry matching the target data packet on the firewall device, the firewall device obtains the tag encoding information from the header of the target data packet.

[0147] In this step, the firewall device obtains the destination IP information and the tag encoding information in the IP header options field from the target data packet.

[0148] Step 530: The firewall device queries the target filtering rules for the target data packet in the label security policy table based on the label encoding information;

[0149] In this step, the firewall device enters the firewall policy matching process. The firewall device can load locally cached label security policy tables and label binary encoding tables, or it can load label security policy tables and label binary encoding tables stored in the label management plane's database. Then, the firewall device can query the label security policy table for filtering rules on target data packets based on the packet labels.

[0150] The tag security policy table, defined by the administrator, records the firewall's tag-based packet filtering rules. These rules include source tag, destination IP, port, protocol, and action. The ID is the unique identifier for the firewall security rule, the source tag is the user-defined tag of the sending device, and the action is the operation the firewall should take after matching the rule (including allow, deny, drop, etc.). The status indicates the usage of the tag security policy, including enabled and disabled. The format of the tag security policy table is shown in Table 2.

[0151] ID Source tag Source port Destination IP Destination port protocol Behavior state

[0152] Step 540: If the target data packet matches the target filtering rule, the firewall device forwards the target data packet;

[0153] In this step, a new session entry corresponding to the target data packet can be created and added to the session table stored in the firewall device.

[0154] Step 550: If the target data packet does not conform to the target filtering rule, the firewall device discards the target data packet.

[0155] In this embodiment, a firewall device receives M target data packets processed by eBPF. The header of the first target data packet contains tag encoding information of the sending device's target tag. The other target data packets do not contain this tag encoding information. If no session entry matches the target data packet on the firewall device, the firewall device retrieves the tag encoding information from the header of the target data packet. Based on the tag encoding information, the firewall device queries the tag security policy table for target filtering rules for the target data packet. If the target data packet matches the target filtering rules, the firewall device forwards the target data packet. If the target data packet does not match the target filtering rules, the firewall device discards the target data packet. Thus, through session entries, tag encoding information, and the tag security policy table, the firewall device can quickly determine the processing strategy for the target data packet, improving the filtering effect of the firewall device.

[0156] Figure 6 This is a flowchart of another packet processing method based on eBPF provided in an embodiment of this application, such as... Figure 6 As shown in the embodiments of this application, the packet processing method based on eBPF includes:

[0157] Step 610: The firewall device receives M target data packets after processing by the extended Berkeley packet capture filter eBPF. The header of the first target data packet contains the tag encoding information of the sending device's target tag. The other target data packets in the M target data packets do not contain the tag encoding information.

[0158] Step 620: The firewall device determines whether there is a session table entry in the session table that matches the target data packet;

[0159] Step 630: If a target session entry matching the target data packet exists on the firewall device, the firewall device directly forwards the target data packet; wherein, the target session entry includes a fixed source port and destination port.

[0160] Step 640: If there is no session entry matching the target data packet on the firewall device, the firewall device obtains the tag encoding information from the header of the target data packet;

[0161] Step 650: The firewall device queries the target filtering rules for the target data packet in the label security policy table based on the label encoding information;

[0162] Step 660: If the target data packet matches the target filtering rule, the firewall device forwards the target data packet;

[0163] Step 670: The firewall device creates a new session entry in the session table corresponding to the target data packet. The newly created session entry includes a fixed source port and destination port.

[0164] Step 680: If the target data packet does not conform to the target filtering rule, the firewall device discards the target data packet.

[0165] In this embodiment, a firewall device receives M target data packets processed by eBPF. The header of the first target data packet contains tag encoding information of the sending device's target tag. The other target data packets do not contain this tag encoding information. If no session entry matches the target data packet on the firewall device, the firewall device retrieves the tag encoding information from the header of the target data packet. Based on the tag encoding information, the firewall device queries the tag security policy table for target filtering rules for the target data packet. If the target data packet matches the target filtering rules, the firewall device forwards the target data packet. If the target data packet does not match the target filtering rules, the firewall device discards the target data packet. Thus, through session entries, tag encoding information, and the tag security policy table, the firewall device can quickly determine the processing strategy for the target data packet, improving the filtering effect of the firewall device.

[0166] like Figure 7 As shown in the illustration, this application provides an electronic device 700, which includes a processor 710 and a memory 720. The memory 720 stores a program, which, when executed by the processor 710, implements the steps of any of the methods described above. For example, when the program is executed by the processor 710, it implements the following process: a transmitting device obtains M target data packets to be sent based on an eBPF program; if a target communication connection has been established between the transmitting device and the receiving device, the transmitting device sends the M target data packets through the target communication connection; wherein, the header of the first target data packet among the M target data packets contains tag encoding information of the target tag of the transmitting device, and the other target data packets among the M target data packets, except for the first target data packet, do not contain the tag encoding information.

[0167] In the electronic device provided in this application embodiment, by adding tag encoding information of the sending device's target tag to the first data packet of M target data packets to be sent, the firewall device can cope with changes in IP addresses in the data packets. The tag encoding information added to the data packets further improves the filtering effect of the data packets, solving the problem of ineffectiveness in current IP address-based data packet filtering methods. Simultaneously, since the tag encoding information of the sending device's target tag is added only to the header of the first target data packet of the M data packets, and no tag encoding information is added to the other data packets of the M data packets, the network quality degradation problem caused by the increased header length due to adding tag encoding information to all data packets is avoided.

[0168] This application also provides a computer-readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described eBPF-based packet processing method embodiments and achieve the same technical effects. To avoid repetition, these will not be described again here.

[0169] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0170] In the readable storage medium provided in this application embodiment, by adding the target tag encoding information of the sending device to the first data packet of the M target data packets to be sent, the firewall device can cope with changes in the IP address of the data packets. The added tag encoding information further improves the filtering effect of the data packets, solving the problem of poor performance of the current method of filtering data packets based on IP address. At the same time, since the target tag encoding information of the sending device is added to the header of only the first target data packet of the M data packets, and the other data packets of the M data packets do not have tag encoding information added, the network quality degradation problem caused by the increase in header length due to adding tag encoding information to all data packets is avoided.

[0171] This application also provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0172] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0173] In the computer program product provided in this application embodiment, by adding the target tag encoding information of the sending device to the first data packet of M target data packets to be sent, the firewall device can cope with changes in IP addresses in the data packets. The added tag encoding information further improves the filtering effect of the data packets, solving the problem of ineffectiveness in current IP address-based data packet filtering methods. Simultaneously, since the target tag encoding information of the sending device is added only to the header of the first target data packet of the M data packets, and the other data packets in the M data packets do not have tag encoding information added, the network quality degradation problem caused by the increased header length due to adding tag encoding information to all data packets is avoided.

[0174] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0175] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0176] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A packet processing method based on eBPF, characterized in that, include: The sending device uses the extended Berkeley packet capture filter eBPF program to acquire M target data packets to be sent; When a target communication connection has been established between the sending device and the firewall device, the sending device sends the M target data packets through the target communication connection. If there is no session entry on the firewall device that matches the target data packet, the firewall device obtains the tag encoding information from the header of the target data packet. Based on the tag encoding information, the firewall device queries the tag security policy table for the target filtering rules of the target data packet. If the target data packet matches the target filtering rules, the firewall device forwards the target data packet. If the target data packet does not conform to the target filtering rule, the firewall device discards the target data packet; The header of the first target data packet among the M target data packets contains the tag encoding information of the target tag of the sending device, while the tag encoding information is not added to the other target data packets among the M target data packets except for the first target data packet.

2. The method according to claim 1, characterized in that, The transmitting device obtains M target data packets to be sent based on the eBPF program, including: The transmitting device obtains its tag encoding information based on the eBPF program; The transmitting device adds the tag encoding information to the option field of the header of the first data packet among the M data packets to be transmitted, thereby obtaining the first target data packet; The tag encoding information is a binary code of fixed byte length.

3. The method according to claim 2, characterized in that, The transmitting device obtains its tag encoding information based on the eBPF program, including: Check whether the target tag of the transmitting device already exists in the tag encoding mapping table, which contains the mapping relationship between tags and binary codes; If the target tag of the transmitting device already exists in the tag encoding mapping table, the binary code corresponding to the target tag is obtained from the tag encoding mapping table and used as the tag encoding information of the transmitting device; If the target tag of the transmitting device does not exist in the tag encoding mapping table, check if the available encoding pool is empty; if the available encoding pool is not empty, retrieve a binary code from the available encoding pool as the tag encoding information of the transmitting device, and remove the retrieved binary code from the available encoding pool; if the available encoding pool is empty, generate a binary code for the transmitting device, use the generated binary code as the tag encoding information of the transmitting device, and write the generated binary code and the target tag into the tag encoding mapping table.

4. The method according to claim 2, characterized in that, The transmitting device adds the tag encoding information to the option field of the header of the first data packet among the M data packets to be transmitted, including: If the data packet is a Transmission Control Protocol (TCP) data packet, for each of the M TCP data packets to be sent, perform the following operations: obtain the value of the SYN flag in the header of the TCP data packet; if the value of the SYN flag is 1, determine the TCP data packet as the first TCP data packet; add the tag encoding information to the options field in the header of the first TCP data packet; If the data packet is a User Datagram Protocol (UDP) data packet, for each of the M UDP data packets to be sent, perform the following operations: calculate the hash value of the UDP data packet; query the data table used to store the host UDP virtual connection status using the hash value as the key; if the hash value does not exist in the data table, determine the UDP data packet as the first UDP data packet; add the tag encoding information to the option field in the header of the first UDP data packet.

5. A packet processing method based on eBPF, characterized in that, include: The firewall device receives M target data packets after processing by the extended Berkeley packet capture filter eBPF. The header of the first target data packet contains the tag encoding information of the sending device's target tag. The other target data packets in the M target data packets do not contain the tag encoding information. If there is no session entry matching the target data packet on the firewall device, the firewall device obtains the tag encoding information from the header of the target data packet; The firewall device queries the target filtering rules for the target data packet in the label security policy table based on the label encoding information. If the target data packet matches the target filtering rule, the firewall device forwards the target data packet; If the target data packet does not conform to the target filtering rule, the firewall device discards the target data packet.

6. The method according to claim 5, characterized in that, After the firewall device receives the M target data packets obtained after eBPF processing, the method further includes: The firewall device determines whether there is a session table entry in the session table that matches the target data packet; If a target session entry matching the target data packet exists on the firewall device, the firewall device directly forwards the target data packet; wherein, the target session entry includes a fixed source port and destination port; After the firewall device forwards the target data packet, the method further includes: The firewall device creates a new session table entry corresponding to the target data packet in the session table. The newly created session table entry includes a fixed source port and destination port.

7. The method according to claim 5 or 6, characterized in that, The tag encoding information is a fixed-length binary code and is located in the option field of the header of the target data packet.

8. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that run on the processor, the program or instructions which, when executed by the processor, implement the steps of the method as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The medium stores a program or instructions that, when executed, implement the steps of the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

Images