Data packet processing method and device, electronic equipment and storage medium

Abstract

The invention provides a data packet processing method and device, electronic equipment and a storage medium, and relates to the field of networks, and the method comprises the steps: moving an original data packet sent to a physical network card by an application program to a virtual network card; packaging an original data packet meeting a preset communication drainage configuration in the virtual network card into a tunnel data packet, and sending the tunnel data packet to a corresponding tunnel through the physical network card; and analyzing and restoring the tunnel reply packet sent to the physical network card by the tunnel into an original reply packet, and sending the original reply packet to the application program through the virtual network card. An original data packet sent to a physical network card by an application program can be moved to a virtual network card for drainage, an original data packet meeting a preset communication drainage configuration in the virtual network card can be packaged into a tunnel data packet, and a tunnel reply packet sent to the physical network card by a tunnel can be analyzed and restored into an original reply packet. According to the method and the device, the use of a routing table and an original socket for data packet drainage can be avoided, and the data packet drainage performance can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the network field, and in particular to a data packet processing method, device, electronic equipment and storage medium. Background Art

[0002] With the increasing awareness of network security, more and more companies choose to use VPN technology (Virtual Private Network) to meet network data transmission needs.

[0003] In the related technology, VPN traffic diversion is mainly achieved through routing tables and raw sockets, where routing tables are used to divert data packets to tunnels, while raw sockets are used to encapsulate, parse and guide data packets. However, routing tables have weak diversion capabilities and poor concealment, while raw sockets have poor working stability and occupy more system resources. These two factors lead to the poor performance of existing VPN technologies in diverting data packets.

[0004] Therefore, how to improve the performance of packet diversion is a key issue that technical personnel in this field are concerned about. Summary of the invention

[0005] The purpose of the present invention is to provide a data packet processing method, device, electronic device and storage medium, which can avoid using routing tables and raw sockets to divert data packets, thereby effectively improving the data packet diversion capability.

[0006] In order to solve the above technical problems, the present invention provides a data packet processing method, comprising:

[0007] Move the original data packets sent by the application to the physical network card to the virtual network card;

[0008] Encapsulating the original data packets in the virtual network card that meet the preset communication diversion configuration into tunnel data packets, and sending them to the corresponding tunnel through the physical network card;

[0009] The tunnel reply packet sent by the tunnel to the physical network card is parsed and restored to the original reply packet, and sent to the application through the virtual network card.

[0010] Optionally, the sending to the application through the virtual network card includes:

[0011] According to the communication information of the original reply packet, a matching target socket interface is searched in a plurality of socket interfaces; wherein the application sends the original data packet to the physical network card through the socket interface, and the socket interface records the communication information of the original data packet;

[0012] The original reply packet is sent to the target socket interface through the virtual network card.

[0013] Optionally, before parsing and restoring the tunnel reply packet sent by the tunnel to the physical network card into the original reply packet, the method further includes:

[0014] Encapsulate a message header for the original reply packet according to the message protocol of the virtual network card, and send the encapsulated original reply packet to the virtual network card.

[0015] Optionally, the sending to the corresponding tunnel through the physical network card includes:

[0016] Sending the tunnel data packet to the corresponding tunnel through the tunnel socket in the physical network card;

[0017] Before parsing and restoring the tunnel reply packet sent by the tunnel to the physical network card into the original reply packet, the method further includes:

[0018] The tunnel socket is listened to, and the tunnel reply packet is received from the tunnel socket.

[0019] Optionally, moving the original data packet sent by the application to the physical network card to the virtual network card includes:

[0020] The original data packet is moved from the exit of the physical network card to the virtual network card by using a data packet filter.

[0021] Optionally, after the original data packet sent by the application to the physical network card is moved to the virtual network card, the method further includes:

[0022] The original data packets in the virtual network card that do not meet the preset communication diversion configuration are encapsulated into link layer data packets through the packet filter device, and sent to the corresponding destination address through the physical network card.

[0023] Optionally, after the original data packet sent by the application to the physical network card is moved to the virtual network card, the method further includes:

[0024] Filtering the original data packets in the virtual network card to remove abnormal original data packets;

[0025] The preset communication diversion configuration is used to perform diversion processing on the remaining original data packets.

[0026] The present invention also provides a data packet processing device, comprising:

[0027] A data packet moving module, used for moving the original data packet sent by the application to the physical network card to the virtual network card;

[0028] A tunnel diversion module, used to encapsulate the original data packets in the virtual network card that meet the preset communication diversion configuration into tunnel data packets, and send them to the corresponding tunnel through the physical network card;

[0029] The tunnel reply processing module is used to parse and restore the tunnel reply packet sent by the tunnel to the physical network card into the original reply packet, and send it to the application through the virtual network card.

[0030] The present invention also provides an electronic device, comprising:

[0031] Memory for storing computer programs;

[0032] A processor is used to implement the steps of the data packet processing method as described above when executing the computer program.

[0033] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data packet processing method described above are implemented.

[0034] The present invention provides a data packet processing method, comprising: moving an original data packet sent by an application to a physical network card to a virtual network card; encapsulating an original data packet in the virtual network card that meets a preset communication diversion configuration into a tunnel data packet, and sending it to a corresponding tunnel through the physical network card; parsing and restoring a tunnel reply packet sent by the tunnel to the physical network card into an original reply packet, and sending it to the application through the virtual network card.

[0035] It can be seen that in the data packet processing method provided by the present invention, first, the original data packets sent by the application to the physical network card can be moved to the virtual network card, and the original data packets in the virtual network card that meet the preset communication diversion configuration can be encapsulated as tunnel data packets, and sent to the corresponding tunnel through the physical network card, so that the data packets can be diverted through the virtual network card instead of through the routing table; then, the tunnel reply packet sent from the tunnel to the physical network card can be parsed and restored to the original reply packet, and sent to the application through the virtual network card, so that the original reply packet can be directed to the physical network card using the original socket, and the original reply packet can be sent directly to the application through the virtual network card. In this way, the use of routing tables and original sockets can be avoided, thereby effectively improving the diversion capability of data packets. The present invention also provides a data packet processing device, an electronic device and a storage medium, which have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flow chart of a data packet processing method provided by an embodiment of the present invention;

[0038] Figure 2 A flow chart of sending a data packet provided by an embodiment of the present invention;

[0039] Figure 3 A flow chart of receiving a data packet provided by an embodiment of the present invention;

[0040] Figure 4 A structural block diagram of a data packet processing device provided by an embodiment of the present invention;

[0041] Figure 5 The present invention is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] With the enhancement of network security awareness, more and more enterprises choose to use VPN technology (Virtual Private Network) to meet the needs of network data transmission. In related technologies, VPN diversion is mainly achieved through routing tables and raw sockets. Among them, the routing table is used to divert data packets to the tunnel; the raw socket is used to encapsulate, parse and guide data packets. For example, the raw socket can be used to encapsulate the link layer of data packets that do not need to be sent through the tunnel, and guide them to the physical network card for normal transmission; for another example, the raw socket can be used to parse the tunnel return packet and guide it to the physical network card for data packet return. However, there are many defects in routing tables and raw sockets. For the routing table, first of all, it can only capture data packets for the address of the specified destination network segment, and the control ability is weak; in addition, the routing table is provided by the operating system, open to the user and cannot be hidden, and it is easy to be modified by the user, and the concealment is poor; in addition, when multiple VPN software work at the same time, the routing table is prone to cause routing conflicts; in addition, the routing table operation has high requirements for the compatibility of the operating system, and it is difficult to apply to lower versions of the operating system. The original socket is a simple mechanism for diverting data packets, which has the defects of poor working stability and poor security. In addition, the VPN software needs to apply for multiple original sockets from the operating system to meet the demand, which is easy to waste operating system resources.

[0044] In view of this, the present invention can provide a data packet processing method, which can move all original data packets sent by the application to the physical network card to the virtual network card for unified diversion, and can encapsulate the original data packets in the virtual network card that meet the preset communication diversion configuration as tunnel data packets; in addition, the tunnel reply packet returned from the tunnel to the physical network card can be parsed and restored to the original reply packet, and sent to the application through the virtual network card, which can avoid the use of routing tables and original sockets for data packet diversion, thereby effectively improving the data packet diversion capability.

[0045] It should be noted that the embodiments of the present invention do not limit the execution device of the present method, which can be set according to actual application requirements, for example, it can be a personal computer, a mobile device, a server, etc.

[0046] For easier understanding, please refer to Figure 1 , Figure 1 A flowchart of a data packet processing method provided by an embodiment of the present invention, the method may include:

[0047] S101. Move an original data packet sent by an application to a physical network card to a virtual network card.

[0048] In this embodiment, the original data packet refers to a network data packet sent by the application and not repackaged. Unlike the related art, this embodiment does not use the routing table to divert the original data packet sent by the application, but can intercept the full amount of original data packets at the exit of the physical network card, and move these original data packets to the virtual network card for unified diversion. Since more complex filtering, diversion, and control strategies can be set in the virtual network card, and these strategies are not open to users, the data packet diversion performance can be improved, and the concealment and security of data packet diversion can be improved. At the same time, since this embodiment can intercept the original data packet at the exit of the physical network card without changing the communication mechanism between the application and the physical network card, the application can send the original data packet according to the original logic, and the physical network card can process the original data packet according to the original logic, so that this embodiment can effectively be compatible with the existing communication mechanism between the application and the physical network card (such as routing table communication, socket proxy).

[0049] Specifically, this embodiment can improve the firewall of the operating system to achieve the effect of intercepting all the data packets and moving all of them to the virtual network card by using the improved firewall. For example, a packet filter (PF) can be set in the firewall, and a diversion rule can be set in the packet filter to move the original data packet from the exit of the physical network card to the virtual network card through the packet filter.

[0050] Based on this, the original data packets sent by the application to the physical network card are moved to the virtual network card, which may include:

[0051] Step 11: Use the packet filter to move the original data packet from the physical network card's exit to the virtual network card.

[0052] S102: Encapsulate the original data packet that meets the preset communication diversion configuration in the virtual network card into a tunnel data packet, and send it to the corresponding tunnel through the physical network card.

[0053] As described above, all original data packets can be diverted and controlled in the virtual network card. Specifically, the above-mentioned preset communication diversion configuration can be set in the virtual network card, and the preset communication diversion configuration is used to match the communication information in the original data packet, and then the original data packet that meets the preset communication diversion configuration (i.e., the match is successful) can be guided to the corresponding tunnel for transmission, and the original data packet that does not meet the preset communication diversion configuration (i.e., the match fails) can be sent normally to the link layer for transmission.

[0054] It should be noted that the present embodiment does not limit the specific preset communication diversion configuration, which can be set according to actual application requirements, for example, it can be an IP range rule, a port rule, etc.

[0055] Furthermore, for the data packets to be directed to the tunnel, the virtual network card can encapsulate the original data packets into tunnel data packets according to the tunnel communication protocol, and send them to the corresponding tunnel through the physical network card. To facilitate the sending of tunnel data packets, this embodiment can set a tunnel socket corresponding to the tunnel in the physical network card, and the virtual network card can send the tunnel data packet to the tunnel socket in the physical network card, so as to send the tunnel data packet to the corresponding tunnel through the tunnel socket.

[0056] Based on this, the data sent to the corresponding tunnel through the physical network card may include:

[0057] Step 21: Send the tunnel data packet to the corresponding tunnel through the tunnel socket in the physical network card.

[0058] It should be noted that this embodiment does not limit how to encapsulate the original data packet into the tunnel data packet according to the tunnel communication protocol, and the specific tunnel communication protocol can be set according to actual application requirements. For example, the tunnel communication protocol can be the SSL protocol (Secure Socket Layer).

[0059] Furthermore, for the original data packets that do not need to be directed to the tunnel, this embodiment needs to perform link layer encapsulation on them to obtain link layer data packets, and send them to the target address normally through the physical network card. It is worth pointing out that in the related art, original sockets are usually used to perform link layer encapsulation on the original data packets that do not need to be sent to the tunnel, which has the defects of unstable encapsulation, insecurity, and large system resource occupation. Therefore, this embodiment can especially use a packet filter device (such as a BPF device, Berkeley Packet Filter) to perform link layer encapsulation on this part of the original data packets. By using a packet filter device, this embodiment can improve the stability and security of link layer encapsulation.

[0060] Based on this, after the original data packet sent by the application to the physical network card is moved to the virtual network card, the following steps may also be included:

[0061] Step 31: Encapsulate the original data packets in the virtual network card that do not meet the preset communication diversion configuration into link layer data packets through the packet filter device, and send them to the corresponding destination address through the physical network card.

[0062] Furthermore, before diverting the original data packets, the virtual network card may filter the original data packets to filter out abnormal original data packets that are missing data, incomplete, or have other abnormalities.

[0063] Based on this, after the original data packet sent by the application to the physical network card is moved to the virtual network card, the following steps may also be included:

[0064] Step 41: Filter the original data packets in the virtual network card to remove abnormal original data packets;

[0065] Step 42: Use the preset communication diversion configuration to divert the remaining original data packets.

[0066] S103: Parse and restore the tunnel reply packet sent from the tunnel to the physical network card into the original reply packet, and send it to the application through the virtual network card.

[0067] In this embodiment, the tunnel reply packet refers to the network data packet returned from the tunnel to the physical network card, and the original reply packet refers to the network data packet obtained by parsing the tunnel reply packet according to the tunnel communication protocol. Different from the related art, when receiving the tunnel reply packet returned from the tunnel to the physical network card, this embodiment does not send the original reply packet obtained by parsing the tunnel reply packet to the original socket, use the original socket to guide the original reply packet to the physical network card, and then send the original reply packet to the application through the physical network card, but directly sends the original reply packet obtained by parsing the tunnel reply packet to the virtual network card, and returns it to the application through the virtual network card. It can be seen that this embodiment can first avoid the use of original sockets, thereby avoiding the problems of poor stability, security and large system resource occupation caused by original sockets. In addition, this embodiment can shorten the communication link for sending the original reply packet to the application through the virtual network card, thereby also improving the transmission efficiency of the original reply packet. In summary, it can be seen that the virtual network card in this embodiment can not only divert the outbound original data packet, but also guide the tunnel reply packet to the application, thereby effectively enhancing the performance of the virtual network card.

[0068] Furthermore, as described above, a tunnel socket corresponding to the tunnel may be set in the physical network card for sending and receiving tunnel data packets. Therefore, the virtual network card may monitor the tunnel socket and receive a tunnel reply packet from the tunnel socket.

[0069] Based on this, before parsing and restoring the tunnel reply packet sent by the tunnel to the physical network card to the original reply packet, the following may also be included:

[0070] Step 51: Listen to the tunnel socket and receive the tunnel reply packet from the tunnel socket.

[0071] Furthermore, it is worth noting that the original data packet is sent from the application to the physical network card, and the original reply packet is returned to the application by the virtual network card, that is, the receiving network card of the original data packet is not the same as the returning network card of the original reply packet. To ensure that the virtual network card can correctly pass the original reply packet to the application, this embodiment can also record the communication information of the original data packet in the socket interface used by the application to send the original data packet. In this way, the virtual network card can query the matching target socket interface in multiple socket interfaces based on the communication information of the original reply packet, and send the original reply packet to the target socket interface.

[0072] Based on this, the following information can be sent to the application through the virtual network card:

[0073] Step 61: According to the communication information of the original reply packet, a matching target socket interface is searched in multiple socket interfaces; wherein the application sends the original data packet to the physical network card through the socket interface, and the socket interface records the communication information of the original data packet;

[0074] Step 62: Send the original reply packet to the target socket interface through the virtual network card.

[0075] It should be noted that this embodiment does not limit the specific content of the above communication information, for example, it may include a source IP address, a destination IP address, a source MAC address, a destination MAC address, a port number, etc.

[0076] Furthermore, for the Utun virtual network card (User Tunnel), it has an additional message protocol, and the original reply packet needs to be encapsulated with an additional message header before the original reply packet can be returned to the virtual network card.

[0077] Based on this, before parsing and restoring the tunnel reply packet sent by the tunnel to the physical network card to the original reply packet, it may also include:

[0078] Step 71: encapsulate a message header for the original reply packet according to the message protocol of the virtual network card, and send the encapsulated original reply packet to the virtual network card.

[0079] Based on the above embodiments, the present invention can first move all the original data packets sent by the application to the physical network card to the virtual network card, and can encapsulate the original data packets in the virtual network card that meet the preset communication diversion configuration into tunnel data packets, and send them to the corresponding tunnel through the physical network card, so that data packets can be diverted through the virtual network card instead of through the routing table; then, the tunnel reply packet sent from the tunnel to the physical network card can be parsed and restored to the original reply packet, and sent to the application through the virtual network card, so that the original reply packet can be directed to the physical network card using the original socket, and the original reply packet can be sent directly to the application through the virtual network card. In this way, the use of routing tables and original sockets can be avoided, thereby effectively improving the diversion capability of data packets.

[0080] Based on the above embodiments, the above data packet processing method is fully introduced below based on specific examples. The present invention includes a data packet sending process and a data packet receiving process. Please refer to Figure 2 , Figure 2 A flow chart of a data packet sending provided by an embodiment of the present invention. The sending process provided by the present invention includes:

[0081] 1. The relevant application sends packets to the physical network card. At this time, the application generally sends data packets related to this application to the server according to the socket programming interface provided by the system.

[0082] 2. PF intercepts all data packets at the network exit of the physical network card, and sends them back to the virtual network card Utun provided in this embodiment according to the traffic diversion rules of PF.

[0083] 3. The background process reads the data packets in the virtual network card, discards the abnormal data packets, and takes out the normal data packets for data packet analysis.

[0084] 4. After getting the parsed data packet, determine whether the data packet complies with the rules based on some existing configurations, including IP range rules and port rules.

[0085] 5. For the data packets that need to be diverted, encapsulate the corresponding tunnel protocol header and send the data packets out of the tunnel through the physical network card.

[0086] 6. For data packets that do not need to be diverted, the bpf device is used to encapsulate the link layer data packet header and send it to the physical network card, and it is also sent to the specified destination address.

[0087] Please refer to Figure 3 , Figure 3 A flow chart of a data packet receiving process provided by an embodiment of the present invention. The packet receiving process provided by the present invention includes:

[0088] 1. The physical network card receives relevant data packets, including tunnel diversion data packets and non-tunnel data packets.

[0089] 2. If it is a tunnel-directed data packet, capture it and perform data packet parsing and restoration.

[0090] 3. After the tunnel is restored, the data packet is re-encapsulated with the utun link layer 2 header and forwarded to the relevant application through the utun virtual network card.

[0091] 4. If the physical network card receives a non-drainage data packet, it will not be captured and will be directly returned to the relevant application.

[0092] The following is an introduction to the data packet processing device, electronic device, computer program product and computer-readable storage medium provided in the embodiments of the present invention. The data packet processing device, electronic device, computer program product and computer-readable storage medium described below can be referenced to the data packet processing method described above.

[0093] Please refer to Figure 4 , Figure 4 A structural block diagram of a data packet processing device provided by an embodiment of the present invention, the device may include:

[0094] The data packet moving module 401 is used to move the original data packet sent by the application to the physical network card to the virtual network card;

[0095] The tunnel diversion module 402 is used to encapsulate the original data packets that meet the preset communication diversion configuration in the virtual network card into tunnel data packets, and send them to the corresponding tunnel through the physical network card;

[0096] The tunnel reply processing module 403 is used to parse and restore the tunnel reply packet sent by the tunnel to the physical network card into the original reply packet, and send it to the application through the virtual network card.

[0097] Optionally, the tunnel reply processing module 403 may include:

[0098] A query submodule, used to query a matching target socket interface in a plurality of socket interfaces according to the communication information of the original reply packet; wherein the application sends the original data packet to the physical network card through the socket interface, and the socket interface records the communication information of the original data packet;

[0099] The return submodule is used to send the original reply packet to the target socket interface through the virtual network card.

[0100] Optionally, the tunnel reply processing module 403 may further include:

[0101] The encapsulation submodule is used to encapsulate the message header of the original reply packet according to the message protocol of the virtual network card, and send the encapsulated original reply packet to the virtual network card.

[0102] Optionally, the tunnel drainage module 402 may include:

[0103] A tunnel sending submodule, used for sending the tunnel data packet to the corresponding tunnel through the tunnel socket in the physical network card;

[0104] The tunnel recovery processing module 403 may further include:

[0105] The tunnel receiving submodule is used to monitor the tunnel socket and receive the tunnel reply packet from the tunnel socket.

[0106] Optionally, the data packet moving module 401 may be used to:

[0107] The original data packet is moved from the exit of the physical network card to the virtual network card by using a data packet filter.

[0108] Optionally, the device may further include:

[0109] The link layer encapsulation processing module is used to encapsulate the original data packets in the virtual network card that do not meet the preset communication diversion configuration into link layer data packets through the packet filter device, and send them to the corresponding destination address through the physical network card.

[0110] Optionally, the device may further include:

[0111] A filtering module, used to filter the original data packets in the virtual network card and remove abnormal original data packets;

[0112] The traffic diversion processing module is used to perform traffic diversion processing on the remaining original data packets using the preset communication traffic diversion configuration.

[0113] Furthermore, an embodiment of the present invention also provides an electronic device. Figure 5 This is a structural diagram of an electronic device 10 according to an exemplary embodiment, and the content in the diagram cannot be considered as any limitation on the scope of application of the present invention.

[0114] Figure 5The present invention provides a schematic diagram of the structure of an electronic device 10 provided in an embodiment of the present invention. The electronic device 10 may include: at least one processor 11, at least one memory 12, a power supply 13, a communication interface 14, an input / output interface 15, and a communication bus 16. The memory 12 is used to store a computer program, which is loaded and executed by the processor 11 to implement the relevant steps in the data packet processing method disclosed in any of the aforementioned embodiments.

[0115] In this embodiment, the power supply 13 is used to provide working voltage for each hardware device on the electronic device 10; the communication interface 14 can create a data transmission channel (such as a tunnel) between the electronic device 10 and an external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present invention, and is not specifically limited here; the input and output interface 15 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0116] In addition, the memory 12, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 121, a computer program 122 and data 123, etc. The storage method can be temporary storage or permanent storage.

[0117] Among them, the operating system 121 is used to manage and control the hardware devices and computer programs 122 on the electronic device 10 to realize the operation and processing of the massive data 123 in the memory 12 by the processor 11, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the data packet processing method performed by the electronic device 10 disclosed in any of the aforementioned embodiments, the computer program 122 can further include a computer program that can be used to complete other specific tasks. The data 123 can include original data packets, tunnel data packets, tunnel reply packets, and original reply packets collected by the electronic device 10.

[0118] Furthermore, an embodiment of the present invention also provides a computer program product, including a computer program / instruction, and when the computer program / instruction is executed by a processor, the data packet processing method described in the above embodiment is implemented.

[0119] Since the embodiments of the computer program product part correspond to the embodiments of the data packet processing method part, please refer to the description of the embodiments of the data packet processing method part for the embodiments of the computer program product part, and will not be repeated here.

[0120] Furthermore, an embodiment of the present invention also discloses a computer-readable storage medium, in which a computer program is stored. When the computer program is loaded and executed by a processor, the steps of the data packet processing method disclosed in any of the aforementioned embodiments are implemented.

[0121] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0122] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0123] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0124] The above is a detailed introduction to a data packet processing method, device, electronic device and storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A data packet processing method, characterized in that: include: Move the original data packets sent by the application to the physical network card to the virtual network card; Encapsulating the original data packets in the virtual network card that meet the preset communication diversion configuration into tunnel data packets, and sending them to the corresponding tunnel through the physical network card; The tunnel reply packet sent by the tunnel to the physical network card is parsed and restored to the original reply packet, and sent to the application through the virtual network card.

2. The data packet processing method according to claim 1, characterized in that: The sending to the application through the virtual network card includes: According to the communication information of the original reply packet, a matching target socket interface is searched in a plurality of socket interfaces; wherein the application sends the original data packet to the physical network card through the socket interface, and the socket interface records the communication information of the original data packet; The original reply packet is sent to the target socket interface through the virtual network card.

3. The data packet processing method according to claim 1, characterized in that: Before parsing and restoring the tunnel reply packet sent by the tunnel to the physical network card into the original reply packet, it also includes: Encapsulate a message header for the original reply packet according to the message protocol of the virtual network card, and send the encapsulated original reply packet to the virtual network card.

4. The data packet processing method according to claim 1, characterized in that: The sending to the corresponding tunnel through the physical network card includes: Sending the tunnel data packet to the corresponding tunnel through the tunnel socket in the physical network card; Before parsing and restoring the tunnel reply packet sent by the tunnel to the physical network card into the original reply packet, the method further includes: The tunnel socket is listened to, and the tunnel reply packet is received from the tunnel socket.

5. The data packet processing method according to claim 1, characterized in that: The step of moving the original data packet sent by the application to the physical network card to the virtual network card includes: The original data packet is moved from the exit of the physical network card to the virtual network card by using a data packet filter.

6. The data packet processing method according to any one of claims 1 to 5, characterized in that: After the original data packet sent by the application to the physical NIC is moved to the virtual NIC, it also includes: The original data packets in the virtual network card that do not meet the preset communication diversion configuration are encapsulated into link layer data packets through the packet filter device, and sent to the corresponding destination address through the physical network card.

7. The data packet processing method according to claim 6, characterized in that: After the original data packet sent by the application to the physical NIC is moved to the virtual NIC, it also includes: Filtering the original data packets in the virtual network card to remove abnormal original data packets; The preset communication diversion configuration is used to perform diversion processing on the remaining original data packets.

8. A data packet processing device, characterized in that: include: A data packet moving module, used for moving the original data packet sent by the application to the physical network card to the virtual network card; A tunnel diversion module, used to encapsulate the original data packets in the virtual network card that meet the preset communication diversion configuration into tunnel data packets, and send them to the corresponding tunnel through the physical network card; The tunnel reply processing module is used to parse and restore the tunnel reply packet sent by the tunnel to the physical network card into the original reply packet, and send it to the application through the virtual network card.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the data packet processing method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data packet processing method according to any one of claims 1 to 7 are implemented.

Images