A unified driver product for packet filtering

Abstract

The present invention discloses a unified driver product for packet filtering, which relates to the field of unified drivers and includes: switching at least one scenario, setting a receiving direction hierarchy, performing receiving direction process processing, setting a sending direction hierarchy, performing sending direction process processing, setting a unified driver hierarchy, setting a unified driver filter table process, and setting filter entry rules. In the present invention, the unified driver filter is very simple and easy to use. Although others may be much more complex, for example, BPF / eBPF filtering code is not simple, but it needs to be compiled using a compiler for network packet acquisition and then sent to the kernel through the SO_ATTACH_filter option. If your filtering code passes the kernel check, it immediately starts filtering data on the socket; the filter is very flexible, and the rules of each filter entry can be a combination of any filled frames.

Description

Technical Field

[0001] The present invention relates to the field of unified drivers, in particular to a unified driver product for data packet filtering. Background Art

[0002] Packet filtering is a fundamental technology in network devices such as routers and firewalls. Numerous models or algorithms exist for packet filtering, including CSPF (CMU / Stanford Packet Filter), BPF (Berkeley Packet Filter), eBPF, and Linux Socket Filtering (LSF). For Linux developers, LSF (based on BPF and eBPF) is a well-known and widely used technology that can be applied to tcpdump, network packet capture, or user-defined filtering. However, this model is not always effective in certain situations, such as when the client frame is non-standard Ethernet or when the client kernel module requires intervention to process the frame. Now, a new packet filtering technology called a unified driver can be applied to Ethernet products to parse and filter different Ethernet frames. It provides a flexible, high-performance method for identifying and filtering any frame with certain characteristics, and is applicable not only to standard Ethernet frames but also to non-standard ones. Furthermore, it provides a general method for processing frames from different protocols using user-defined Linux kernel modules.

[0003] BPF / eBPF is an outstanding technology in packet filtering, and many Linux tools and applications are based on it, such as bpfilter, tcpdump, wireshark, and network packet capture. While BPF / eBPF is undoubtedly powerful and high-performance for packet filtering, while it has its advantages, it is not always the best choice for every situation. For example, eBPF allows users to register a hook with the kernel to modify frames, but this hook has many limitations, including looping and a limited size. Therefore, in many cases, users must write custom kernel modules to process frames freely. Furthermore, performance degrades dramatically as the number of filters increases. The unified packet filtering driver now provides a new, universal method for filtering and processing any custom frame. It can also be customized to meet individual needs, for example, for specific and complex filters, non-standard Ethernet frames, or specialized processes within Linux kernel modules.

[0004] All filters are managed in a global filter table configured on each network device.

[0005] When a frame arrives at the Ethernet interface to which the unified driver is connected, the filter table is iterated and the filter entries are compared with each frame. Once the characteristics of the frame match the filter entries, it is forwarded to the corresponding network device. The relevant customer Linux kernel module driver will be responsible for further processing of the frame before sending it to the IP stack or application.

[0006] It aims to provide a unified driver for packet filtering and processing, as current technologies cannot adapt to all our requirements.

[0007] The unified driver architecture of the present invention is applicable to various network systems. The examples here are mentioned only as suitable examples. In other words, the universal distributed architecture of the present invention is suitable and optimized for but not limited to Ethernet switch products and can be easily applied to other products. Summary of the Invention

[0008] In order to solve the above technical problems, a unified driver product for data packet filtering is provided. This technical solution solves the problems raised in the above background technology.

[0009] In order to achieve the above objects, the technical solution adopted by the present invention is:

[0010] A unified driver product for packet filtering, including:

[0011] At least one scene change;

[0012] Perform receiving direction hierarchy settings;

[0013] Perform receiving direction process processing;

[0014] Perform sending direction hierarchy settings;

[0015] Perform sending direction process processing;

[0016] Perform unified driver hierarchy setup;

[0017] Perform unified driver filter table process settings;

[0018] Set filter entry rules;

[0019] The receiving direction hierarchical structure setting includes the following steps: unifying the driver for processing different protocol frames on the filter and interface of the processor of the network device, and unifying the driver's hierarchical structure for representing the way of receiving and processing frames on the Ethernet interface;

[0020] The sending direction hierarchy setting includes the following steps:

[0021] The frame is sent to the sub-module class by the unified driver. The sub-module class removes the shortwave tag, adds the hardware tag, and adds the virtual local area network processing. After the frame is processed, it will be sent through the network device queue;

[0022] The hierarchical structure setting of the unified driver includes the following steps:

[0023] Set up filter driver, platform driver, subclass platform, Ethernet driver, operation and maintenance management function driver and platform driver objects;

[0024] The filter driver provides at least one method for filtering operations on the filter, the platform driver provides at least one method for processing frames, and the subclass platform provides some product-specific methods;

[0025] The Ethernet driver and the operation and maintenance management function driver process the element framework and operate the filter through the platform driver objects inside the Ethernet driver and the operation and maintenance management function driver.

[0026] Preferably, the switching of the at least one scene comprises the following steps:

[0027] At least one scenario, consisting of scenario 1, scenario 2, and scenario 3;

[0028] In scenario 1, the daughter card unit controls the FPGA to directly transmit frames to the main control unit. A unified driver is installed on the main control unit to process frames from the management tunnel.

[0029] In scenario 2, the unified driver is installed on both the main control unit and the daughter card unit. The daughter card unit is installed with an L2 switch, which controls the daughter card unit to send frames back to the same switch.

[0030] In scenario 3, the unified driver is installed on the main control unit and the daughter card unit. The daughter card unit is provided with two L2 switches, one of which is used for switching internal data frames, and the other is used for switching remote data frames.

[0031] Preferably, the sending direction process includes the following steps:

[0032] After the frame is sent to the protocol layer, the protocol layer driver is associated with the virtual interface, and the frame received by the virtual interface is processed in the protocol layer driver;

[0033] The protocol layer driver is responsible for pre-processing the frames and handing them over to the multiplexing layer. The multiplexing layer collects the frames separated from all protocol layer drivers, multiplexes the collected frames into a single data stream, and hands the data stream over to the platform layer.

[0034] After receiving the data stream transmitted by the multiplexing layer, the platform layer sends the data stream out of the network interface.

[0035] Preferably, the process of setting a unified driver filter table includes the following steps:

[0036] Set up a filter table, which contains filter entries;

[0037] A filter entry consists of at least one feature rule and at least one feature operation. The feature rule provides the type of features that the filter driver needs to check and the comparison processing rules for the features. The feature operation provides the matching processing method for the filter driver frame.

[0038] Preferably, the setting of filter entry rules comprises the following steps:

[0039] Set at least one characteristic rule of the frame at the filter entrance, and obtain the application scope and usage scenario description of the characteristic rule.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] (1) The unified driver filter is very simple to use. While others may be much more complex, for example, BPF / eBPF filtering code is not simple, but it needs to be compiled with a compiler that collects network packets and then sent to the kernel via the SO_ATTACH_filter option. If your filtering code passes the kernel check, it will immediately start filtering data on that socket.

[0042] (2) The filter is very flexible. The rule of each filter entry can be a combination of any filled frame, such as dest / src IP, dest / src MAC, VLAN, etherType, UDP port, byte comparison, some specific characteristics, etc. A rule can be combined with other rules in logical AND, OR, NOR, XOR operations.

[0043] (3) Pre-parsing each frame can speed up filtering.

[0044] (4) The framework's processes can be customized in the client's Linux kernel module.

[0045] (5) Unified driver technology can be applied to typical situations where a network device processor needs to process many different protocol frames across a large number of filters or interfaces. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is a schematic diagram of the unified driver product process for data packet filtering of the present invention;

[0047] Figure 2 A schematic diagram of a switching process for at least one scenario of the present invention;

[0048] Figure 3 This is a schematic diagram of the receiving direction processing flow of the present invention;

[0049] Figure 4 This is a schematic diagram of the sending direction process of the present invention;

[0050] Figure 5 A schematic diagram of the process of setting up a hierarchical structure of a unified driver according to the present invention;

[0051] Figure 6 This is a schematic diagram of the process flow for setting a unified driver filter table according to the present invention. DETAILED DESCRIPTION

[0052] The following description is intended to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are merely examples, and those skilled in the art may conceive of other obvious variations.

[0053] Reference Figure 1 A unified driver product for packet filtering includes:

[0054] At least one scene change;

[0055] Perform receiving direction hierarchy settings;

[0056] Perform receiving direction process processing;

[0057] Perform sending direction hierarchy settings;

[0058] Perform sending direction process processing;

[0059] Perform unified driver hierarchy setup;

[0060] Perform unified driver filter table process settings;

[0061] Set filter entry rules;

[0062] The receiving direction hierarchical structure setting includes the following steps: unifying the driver for processing different protocol frames on the filter and interface of the processor of the network device, and unifying the driver's hierarchical structure for representing the way of receiving and processing frames on the Ethernet interface;

[0063] The sending direction hierarchy setting includes the following steps:

[0064] The frame is sent to the sub-module class by the unified driver. The sub-module class removes the shortwave tag, adds the hardware tag, and adds the virtual local area network processing. After the frame is processed, it will be sent through the network device queue;

[0065] The hierarchical structure setting of the unified driver includes the following steps:

[0066] Set up filter driver, platform driver, subclass platform, Ethernet driver, operation and maintenance management function driver and platform driver objects;

[0067] The filter driver provides at least one method for filtering operations on the filter, the platform driver provides at least one method for processing frames, and the subclass platform provides some product-specific methods;

[0068] The Ethernet driver and the operation and maintenance management function driver process the element framework and operate the filter through the platform driver objects inside the Ethernet driver and the operation and maintenance management function driver.

[0069] The switching of the at least one scene comprises the following steps:

[0070] At least one scenario, consisting of scenario 1, scenario 2, and scenario 3;

[0071] In scenario 1, the daughter card unit controls the FPGA to directly transmit frames to the main control unit. A unified driver is installed on the main control unit to process frames from the management tunnel.

[0072] In scenario 2, the unified driver is installed on both the main control unit and the daughter card unit. The daughter card unit is installed with an L2 switch, which controls the daughter card unit to send frames back to the same switch.

[0073] In scenario 3, the unified driver is installed on the main control unit and the daughter card unit. The daughter card unit is provided with two L2 switches, one of which is used for switching internal data frames, and the other is used for switching remote data frames.

[0074] The sending direction process includes the following steps:

[0075] After the frame is sent to the protocol layer, the protocol layer driver is associated with the virtual interface, and the frame received by the virtual interface is processed in the protocol layer driver;

[0076] The protocol layer driver is responsible for pre-processing the frames and handing them over to the multiplexing layer. The multiplexing layer collects the frames separated from all protocol layer drivers, multiplexes the collected frames into a single data stream, and hands the data stream over to the platform layer.

[0077] After receiving the data stream transmitted by the multiplexing layer, the platform layer sends the data stream out of the network interface.

[0078] The process of setting up a unified driver filter table includes the following steps:

[0079] Set up a filter table, which contains filter entries;

[0080] A filter entry consists of at least one feature rule and at least one feature operation. The feature rule provides the type of features that the filter driver needs to check and the comparison processing rules for the features. The feature operation provides the matching processing method for the filter driver frame.

[0081] Setting the filter entry rules includes the following steps:

[0082] Set at least one characteristic rule of the frame at the filter entrance, and obtain the application scope and usage scenario description of the characteristic rule.

[0083] In summary, the advantages of the present invention are: the unified driver filter is very simple and easy to use. While others may be much more complex, for example, BPF / eBPF filtering code is not simple. It needs to be compiled using a compiler that collects network packets and then sent to the kernel via the SO_ATTACH_filter option. If your filtering code passes the kernel check, it immediately begins filtering data on that socket. The filter is very flexible, and the rules for each filter entry can be a combination of any populated frame, such as dest / srcIP, dest / srcMAC, VLAN, etherType, UDP port, byte comparison, and some specific characteristics. A rule can be combined with other rules using logical AND, OR, NOR, and XOR operations; pre-parsing each frame can accelerate filtering; the framework process can be customized in the customer's Linux kernel module; and the unified driver technology can be applied to typical situations where network device processors need to process many different protocol frames across a large number of filters or interfaces.

[0084] The above shows and describes the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions merely illustrate the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. A unified driver product for packet filtering, characterized in that: include: At least one scene change; Perform receiving direction hierarchy settings; Perform receiving direction process processing; Perform sending direction hierarchy settings; Perform sending direction process processing; Perform unified driver hierarchy setup; Perform unified driver filter table process settings; Set filter entry rules; The receiving direction hierarchical structure setting includes the following steps: unifying the driver for processing different protocol frames on the filter and interface of the processor of the network device, and unifying the driver's hierarchical structure for representing the way of receiving and processing frames on the Ethernet interface; The sending direction hierarchy setting includes the following steps: The frame is sent to the sub-module class by the unified driver. The sub-module class removes the shortwave tag, adds the hardware tag, and adds the virtual local area network processing. After the frame is processed, it will be sent through the network device queue. The hierarchical structure setting of the unified driver includes the following steps: Set up filter driver, platform driver, subclass platform, Ethernet driver, operation and maintenance management function driver and platform driver objects; The filter driver provides at least one method for filtering operations on the filter, the platform driver provides at least one method for processing frames, and the subclass platform provides some product-specific methods; The Ethernet driver and the operation and maintenance management function driver process the element framework and operate the filter through the platform driver objects inside the Ethernet driver and the operation and maintenance management function driver.

2. A unified driver product for packet filtering according to claim 1, characterized in that: The switching of the at least one scene comprises the following steps: At least one scenario, consisting of scenario 1, scenario 2, and scenario 3; In scenario 1, the daughter card unit controls the FPGA to directly transmit frames to the main control unit. A unified driver is installed on the main control unit to process frames from the management tunnel. In scenario 2, the unified driver is installed on both the main control unit and the daughter card unit. The daughter card unit is installed with an L2 switch, which controls the daughter card unit to send frames back to the same switch. In scenario 3, the unified driver is installed on the main control unit and the daughter card unit. The daughter card unit is provided with two L2 switches, one of which is used for switching internal data frames, and the other is used for switching remote data frames.

3. A unified driver product for packet filtering according to claim 1, characterized in that: The sending direction process includes the following steps: After the frame is sent to the protocol layer, the protocol layer driver is associated with the virtual interface, and the frame received by the virtual interface is processed in the protocol layer driver; The protocol layer driver is responsible for pre-processing the frames and handing them over to the multiplexing layer. The multiplexing layer collects the frames separated from all protocol layer drivers, multiplexes the collected frames into a single data stream, and hands the data stream over to the platform layer. After receiving the data stream transmitted by the multiplexing layer, the platform layer sends the data stream out of the network interface.

4. A unified driver product for packet filtering according to claim 3, characterized in that: The process of setting up a unified driver filter table includes the following steps: Set up a filter table, which contains filter entries; A filter entry consists of at least one feature rule and at least one feature operation. The feature rule provides the type of features that the filter driver needs to check and the comparison processing rules for the features. The feature operation provides the matching processing method for the filter driver frame.

5. A unified driver product for packet filtering according to claim 4, characterized in that: Setting the filter entry rules includes the following steps: Set at least one characteristic rule of the frame at the filter entrance, and obtain the application scope and usage scenario description of the characteristic rule.

Images