Traffic redirection method and device, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a traffic redirection method and device, electronic equipment, a computer storage medium and a computer program product. The method comprises the following steps: acquiring a data packet from a target data packet queue; the target data packet queue comprises a data packet queue corresponding to a network card supporting a data plane development kit; obtaining a newly generated redirection rule table, and matching the data packet with the redirection rule table to obtain a matching result; the redirection rule table comprises a plurality of redirection rules and behaviors corresponding to each redirection rule; and under the condition that the matching result represents that the first redirection rule matched with the data packet exists in the redirection rule table, executing a behavior corresponding to the first redirection rule.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a traffic redirection method, device, electronic device, computer storage medium, and computer program product. Background Art

[0002] In daily software deployment, considering the impact of factors such as cost, performance and architecture, it is often necessary to deploy a variety of software with different functions on the same device. Due to the functional differences of different software, the network protocols, Internet Protocol (IP) and ports processed by these software are different, which increases the difficulty of traffic redirection. For this reason, the Data Plane Development Kit (DPDK) is introduced. DPDK is an open source data plane development tool set that mainly runs on the Linux system and can realize fast processing of data packets. Since DPDK has the characteristics of exclusive network card, it is necessary to classify, filter and forward network traffic in the DPDK program, and dispatch specific traffic to the corresponding software for processing.

[0003] In the related technology, the DPDK-based traffic redirection solution is usually: based on the traffic interface provided by DPDK, the corresponding traffic processing rules are configured on the network card, and the traffic processing rules are used to redirect the traffic. However, this solution is limited by the hardware capabilities of the network card, and only a small number of network cards have complete traffic classification, filtering and forwarding capabilities, resulting in a small scope of application of this solution. Summary of the invention

[0004] In view of the above problems, embodiments of the present application are proposed to provide a traffic redirection method, device, electronic device, computer storage medium and computer program product that overcome the above problems or at least partially solve the above problems.

[0005] The technical solution of this application is implemented as follows:

[0006] The present application provides a traffic redirection method, the method comprising:

[0007] Acquire a data packet from a target data packet queue; the target data packet queue includes a data packet queue corresponding to a network card supporting a data plane development toolkit;

[0008] Obtaining a newly generated redirection rule table, and matching the data packet with the redirection rule table to obtain a matching result; the redirection rule table includes a plurality of redirection rules and a behavior corresponding to each redirection rule;

[0009] When the matching result indicates that there is a first redirection rule matching the data packet in the redirection rule table, an action corresponding to the first redirection rule is executed.

[0010] The present application also provides a traffic redirection device, which includes:

[0011] An acquisition module, used for acquiring a data packet from a target data packet queue; the target data packet queue includes a data packet queue corresponding to a network card supporting a data plane development toolkit;

[0012] A matching module, used to obtain a newly generated redirection rule table, and match the data packet with the redirection rule table to obtain a matching result; the redirection rule table includes a plurality of redirection rules and a behavior corresponding to each redirection rule;

[0013] The execution module is used to execute the behavior corresponding to the first redirection rule when the matching result indicates that there is a first redirection rule matching the data packet in the redirection rule table.

[0014] An embodiment of the present application provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the traffic redirection method provided by one or more of the aforementioned technical solutions when executing the program.

[0015] An embodiment of the present application provides a computer storage medium, which stores a computer program; after the computer program is executed by a processor, it can implement the traffic redirection method provided by one or more of the above-mentioned technical solutions.

[0016] The present application provides a computer program product, including a computer program, which, when executed by a processor, implements the traffic redirection method provided by one or more of the aforementioned technical solutions.

[0017] An embodiment of the present application proposes a traffic redirection method, device, electronic device, computer storage medium and computer program product, the method comprising: obtaining a data packet from a target data packet queue; the target data packet queue comprises a data packet queue corresponding to a network card that supports a data plane development toolkit; obtaining a newly generated redirection rule table, matching the data packet with the redirection rule table to obtain a matching result; the redirection rule table comprises multiple redirection rules and a behavior corresponding to each redirection rule; and when the matching result indicates that there is a first redirection rule in the redirection rule table that matches the data packet, executing the behavior corresponding to the first redirection rule.

[0018] It can be seen that in the embodiment of the present application, since the target data packet queue for acquiring data packets includes each data packet queue corresponding to the network card supporting DPDK, even if the network card supporting DPDK does not have a complete traffic redirection capability, the technical solution of the present application can be used to provide traffic redirection capabilities to all network cards supporting DPDK, thereby solving the problem of lack of or imperfect redirection function due to hardware differences between different network cards. It can be seen that the traffic redirection method provided by the present application can adapt to all network cards supporting DPDK and has a wider scope of use. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a flow chart of a traffic redirection method in an embodiment of the present application;

[0020] Figure 2 It is a structural diagram of a redirection rule table in an embodiment of the present application;

[0021] Figure 3 This is a schematic diagram of the structure of a redirection rule in an embodiment of the present application;

[0022] Figure 4 It is a structural schematic diagram of a behavior in an embodiment of the present application;

[0023] Figure 5 This is a flowchart of setting redirection rules and behaviors in an embodiment of the present application;

[0024] Figure 6 It is a flowchart of another traffic redirection method in an embodiment of the present application;

[0025] Figure 7 It is a schematic diagram of the composition structure of the traffic redirection device in the embodiment of the present application;

[0026] Figure 8 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The present application will be further described in detail below in conjunction with the accompanying drawings and Examples. It should be understood that the embodiments provided herein are only used to explain the present application and are not intended to limit the present application. In addition, the embodiments provided below are partial embodiments for implementing the present application, rather than providing all embodiments for implementing the present application. In the absence of conflict, the technical solutions recorded in the embodiments of the present application can be implemented in any combination.

[0028] It should be noted that, in the embodiments of the present application, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a method or apparatus including a series of elements includes not only the elements explicitly recorded, but also includes other elements not explicitly listed, or also includes elements inherent to the implementation of the method or apparatus. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other related elements (such as steps in a method or units in a device, for example, a unit may be a portion of a circuit, a portion of a processor, a portion of a program or software, etc.) in the method or apparatus including the element.

[0029] The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, I and / or J can represent the three situations that I exists alone, I and J exist at the same time, and J exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of I, J, and R can represent including any one or more elements selected from the set consisting of I, J, and R.

[0030] For example, the traffic redirection method provided in the embodiment of the present application includes a series of steps, but the traffic redirection method provided in the embodiment of the present application is not limited to the recorded steps. Similarly, the traffic redirection device provided in the embodiment of the present application includes a series of modules, but the traffic redirection device provided in the embodiment of the present application is not limited to including the modules explicitly recorded, and may also include modules required to obtain relevant task data or perform processing based on task data.

[0031] The embodiments of the present application can be applied to a computer system composed of a terminal device and a server, and can operate with many other general or special computing system environments or configurations. Here, the terminal device can be a thin client, a thick client, a handheld or laptop device, a microprocessor-based system, a set-top box, a programmable consumer electronic product, a network personal computer, a small computer system, etc., and the server can be a small computer system, a large computer system, and a distributed cloud computing technology environment including any of the above systems, etc.

[0032] Electronic devices such as terminal devices and servers can implement corresponding functions through the execution of program modules. Generally, program modules can include routines, programs, target programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in a distributed cloud computing environment, in which tasks are performed by remote processing devices linked through a communication network. In a distributed cloud computing environment, program modules can be located on local or remote computing system storage media including storage devices.

[0033] In related technologies, DPDK-based traffic redirection solutions mainly include the following three:

[0034] 1) Set corresponding traffic processing rules based on the traffic interface provided by DPDK, and use the traffic processing rules to redirect traffic. This solution is limited by the hardware capabilities of the network card. Only a small number of network cards have complete traffic classification, filtering and forwarding capabilities. Even if the network card has the capabilities, it is limited by the storage space of the network card and other conditions, and can only set a small number of rules.

[0035] 2) Based on hardware pass-through technology (such as SR-IOV), DPDK runs on a virtual network card. Each software needs to occupy a virtual network card exclusively. This solution is limited by the capabilities of the physical network card. In addition, the number of virtual network cards is generally only a dozen, which will also limit the number of stand-alone software deployments. In addition, each virtual network card needs to have an independent Media Access Control Address (MAC), IP and other information, which increases the complexity of operation and maintenance management.

[0036] 3) Run DPDK on a virtual network card based on virtual network card technology (such as TAP / TUN, virtio-user, etc.); the virtual network card technology provided by the kernel needs to go through the kernel protocol stack, which has a relatively large impact on performance. Although user-mode technology does not need to go through the complete kernel protocol stack, it still has switching overhead, which affects performance; and each virtual network card needs to have independent MAC, IP and other information, which will also increase the complexity of operation and maintenance management.

[0037] In view of the above technical problems, the following embodiments are proposed.

[0038] In some embodiments of the present application, the traffic redirection method can be implemented using a processor in a traffic redirection device, and the above-mentioned processor can be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller, and a microprocessor.

[0039] Figure 1 is a flow chart of a traffic redirection method in an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0040] Step 100: Get a data packet from the target data packet queue.

[0041] In an embodiment of the present application, the target data packet queue refers to a data packet queue for which traffic redirection is required, which may include a data packet queue corresponding to a network card that supports DPDK; here, a network card that supports DPDK (referred to as network card) refers to a network card that is compatible with DPDK, and the data packet sequence corresponding to the network card includes each input queue (rx_ring) corresponding to the network card.

[0042] Exemplarily, the target data packet queue includes not only the data packet queue corresponding to the network card, but also other queues that need to redirect traffic, such as the loopback queue, the output queue (out_ring_buffer) corresponding to the application software (application, APP), etc., which are not specifically limited here.

[0043] Exemplarily, before obtaining a data packet from a target data packet queue, DPDK may be configured first, and a network card supporting DPDK may be registered with DPDK. Here, the number of network cards is not specifically limited and may be one or more.

[0044] It can be understood that compared with the related art that requires the creation of an additional virtual network card and can only run DPDK on the virtual network card to achieve traffic redirection, the traffic redirection method provided in the embodiment of the present application does not require the creation of an additional virtual network card, nor does it need to pay attention to whether DPDK is running on a virtual network card or a physical network card, thereby reducing the complexity of operation and maintenance management.

[0045] Furthermore, the input queue rx_ring and output queue tx_ring corresponding to the network card are initialized, and the receive side scaling (RSS) function is enabled for the input direction; here, the number of input queues rx_ring and output queues tx_ring can be set according to actual conditions, and no specific limitation is given here; RSS is a network driver technology that can distribute data packets in the input direction to the corresponding input queue rx_ring.

[0046] Exemplarily, the data packets sent by the network will first pass through the network card, at which time the network card will receive the data packets sent by the network; it should be noted that for the data packets received by the network card, these data packets can be distributed to the data packet queue corresponding to the network card through the RSS function of the network card.

[0047] Exemplarily, the RSS function can use a hash function to distribute the data packets received by the network card to each data packet queue to ensure that the data packets can be evenly distributed to different data packet queues; here, there is no specific limitation on the method of determining the hash function; for example, the hash function can be calculated by including one or more information of the source IP, destination IP, source port and destination port of the data packet.

[0048] In some embodiments, before obtaining a data packet from a target data packet queue, the above method may further include: obtaining a third redirection rule set through a software interface and a behavior corresponding to the third redirection rule; the third redirection rule includes at least one matching pattern, each matching pattern having a corresponding priority; generating a redirection rule table according to the priority of the matching pattern in the third redirection rule; the redirection rule table includes the third redirection rule and the behavior corresponding to the third redirection rule.

[0049] Exemplarily, the software interface is also called the software application programming interface (API), and the software interface can be a software interface provided by a rule setter; wherein, the rule setter is also called a rule engine, which is a software component that can provide a software interface, which allows developers to set redirection rules and the behaviors corresponding to the redirection rules through the software interface; that is, developers can set the third redirection rule and the behaviors corresponding to the third redirection rule through the software interface provided by the rule setter.

[0050] It can be seen that in the embodiment of the present application, the redirection rules in the redirection rule table are set through the software interface and are not limited by the hardware capabilities of the network card. Therefore, a larger number of redirection rules can be set to solve the problem of being limited by the hardware capabilities of the network card when there are too many rules to be set.

[0051] Exemplarily, the third redirection rule may include one or more matching patterns, and each matching pattern has a corresponding priority; here, the type of matching pattern is not specifically limited, for example, the matching pattern may be Ethernet protocol, Virtual Local Area Network (VLAN) protocol, Internet Protocol version 4 (IPv4), Internet Control Message Protocol (ICMP), User Datagram Protocol (UDP) or Transmission Control Protocol (TCP), etc.

[0052] It should be noted that the priorities of different matching modes can be divided according to the network Open System Interconnect (OSI) model. The matching modes at different layers of the OSI model have different corresponding priorities, and the closer the layer where the matching mode is located is to the physical layer (the first layer of the OSI model), the higher the corresponding priority.

[0053] For example, assume that a third redirection rule includes two matching patterns, namely the Ethernet protocol and the IPv4 protocol. Since the Ethernet protocol is located at the data link layer, which is the second layer of the OSI model, and the IPv4 protocol is located at the network layer, which is the third layer of the OSI model, the Ethernet protocol has a higher priority than the IPv4 protocol.

[0054] In an embodiment of the present application, a redirection rule table can be generated according to the priority of the matching pattern in the third redirection rule, and the generated redirection rule table can be stored in the rule matcher. The redirection rule table may include the third redirection rule set by the developer through the software interface and the behavior corresponding to the third redirection rule; here, the number of third redirection rules is multiple. For the convenience of description, the third redirection rule in the redirection rule table may be referred to as the redirection rule in the future.

[0055] Exemplarily, each redirection rule in the redirection rule table has a corresponding data packet direction; wherein, the data packet direction can be one of an input direction and an output direction; it should be noted that the redirection rule table includes multiple rules for these two different directions and the behaviors corresponding to each rule. The data packet direction is set by the developer when setting each redirection rule. The purpose of the setting is to ensure that each redirection rule can match the data packet in the corresponding data packet direction.

[0056] In some embodiments, generating a redirection rule table according to the priority of the matching pattern in the third redirection rule may include: determining the storage location of the third redirection rule in the redirection rule table according to the priority of the matching pattern in the third redirection rule; generating a redirection rule table according to the storage location of the third redirection rule in the redirection rule table.

[0057] It can be understood that since the matching pattern in the third redirection rule has a corresponding priority, after obtaining the third redirection rule set by the developer through the software interface and the behavior corresponding to the third redirection rule, for each third redirection rule, the storage position of the third redirection rule in the redirection rule table can be determined according to the priority of the matching pattern in the third redirection rule; and then, the redirection rule table is generated according to the storage positions of multiple third redirection rules in the redirection rule table.

[0058] Exemplarily, multiple redirection rules in the redirection rule table are arranged in order of priority from high to low; that is, the priority of the matching pattern in the third redirection rule can represent its storage position in the redirection rule table, and thus, the storage position of the third redirection rule in the redirection rule table can be determined according to the priority of the matching pattern in the third redirection rule.

[0059] For example, see Figure 2In the case where the redirection rule table includes redirection rule 1 to redirection rule 5, the redirection rule table includes 5 table entries, each of which points to a redirection rule and a behavior corresponding to the redirection rule; in the redirection rule table, redirection rules with high priority are arranged in front, and redirection rules with low priority are arranged in the back, that is, the position order of redirection rule 1 to redirection rule 5 in the redirection rule table is arranged in descending order of priority.

[0060] In some embodiments, determining the storage location of the third redirection rule in the redirection rule table based on the priority of the matching pattern in the third redirection rule may include: comparing the priority of the matching pattern in the third redirection rule with the priority of the matching pattern in the fourth redirection rule stored in the redirection rule table generated last time to obtain a comparison result; and determining the storage location of the third redirection rule in the redirection rule table based on the comparison result.

[0061] Exemplarily, according to the above content, it can be known that the matching pattern in the third redirection rule has a corresponding priority. When the redirection rule is stored in the redirection rule table, the priority of the matching pattern in the third redirection rule can be compared with the priority of the matching pattern in the fourth redirection rule stored in the redirection rule table generated last time to obtain a comparison result; here, the comparison process is performed in order of matching pattern priority from high to low, that is, the highest priority matching pattern included in the third redirection rule and the fourth redirection rule can be determined first, and it is determined whether the priorities of these two highest priority matching patterns are the same. If it is determined to be no, it means that the priorities of the third redirection rule and the fourth redirection rule are not the same. At this time, the highest priority of the matching pattern in the third redirection rule can be determined as the priority of the third redirection rule in the redirection rule table; if it is determined to be yes, continue to determine the second highest priority matching pattern included in the third redirection rule and the fourth redirection rule, and determine whether the priorities of these two second highest priority matching patterns are the same, and so on, until the matching patterns included in the third redirection rule and the fourth redirection rule are judged, or it is determined that the priorities of the third redirection rule and the fourth redirection rule are different.

[0062] In some embodiments, determining the storage position of the third redirection rule in the redirection rule table based on the comparison result may include: when the comparison result indicates that the fourth redirection rule with the same priority as the matching pattern in the third redirection rule is not stored in the redirection rule table, determining the storage position of the third redirection rule in the redirection rule table based on the storage position of the fourth redirection rule in the redirection rule table; when the comparison result indicates that the fourth redirection rule with the same priority as the matching pattern in the third redirection rule is stored in the redirection rule table, determining the storage position of the third redirection rule in the redirection rule table based on the longest match principle and according to the matching pattern of the fourth redirection rule.

[0063] It should be noted that after the matching patterns included in the third redirection rule and the fourth redirection rule are judged, a comparison result can be obtained. If it is determined according to the comparison result that the fourth redirection rule with the same priority as the matching pattern in the third redirection rule is not stored in the last generated redirection rule table, it means that the priority of the fourth redirection rule and the third redirection rule are different. At this time, the storage position of the third redirection rule in the redirection rule table can be determined according to the storage position of the fourth redirection rule in the redirection rule table. Accordingly, if the priority of the fourth redirection rule is higher than that of the third redirection rule, the third redirection rule will be stored after the fourth redirection rule; if it is determined that the priority of the fourth redirection rule is lower than that of the third redirection rule, the third redirection rule will be stored in front of the fourth redirection rule.

[0064] Exemplarily, if it is determined based on the comparison result that a fourth redirection rule with the same priority as the matching pattern in the third redirection rule has been stored in the last generated redirection rule table, the storage location of the third redirection rule in the redirection rule table is determined based on the longest match principle and the matching pattern of the fourth redirection rule.

[0065] Exemplarily, assume that the third redirection rule and the fourth redirection rule both include a matching mode of the IPv4 protocol, wherein the IPv4 protocol included in the third redirection rule has a 24-bit source IP, and the IPv4 protocol included in the fourth redirection rule has a 32-bit source IP. If the above-mentioned priority comparison is performed, it will be determined that the priorities of the third redirection rule and the fourth redirection rule are the same. At this time, the priority of the third redirection rule in the redirection rule table can be further determined based on the longest match principle and the IPv4 protocol included in the fourth redirection rule; since the source IP length of the IPv4 protocol included in the fourth redirection rule is greater than the IPv4 protocol included in the third redirection rule, it can be determined that the priority of the fourth redirection rule is higher than the third redirection rule. At this time, it can be determined that the third redirection rule is located behind the fourth redirection rule, that is, the storage position of the third redirection rule in the redirection rule table can be determined.

[0066] It should be noted that if the priority of the third redirection rule in the redirection rule table cannot be determined according to the longest match principle and the matching mode of the fourth redirection rule, the priority of the third redirection rule can be determined according to the setting time of the third redirection rule, and then the storage location of the third redirection rule in the redirection rule table can be determined according to the priority; exemplarily, the third redirection rule that is set first has a higher corresponding priority.

[0067] Exemplarily, to ensure the validity of data storage, when storing each redirection rule and the behavior corresponding to the redirection rule in the redirection rule table, their data structure may be converted into a data structure that conforms to the redirection rule table before being stored.

[0068] Step 101: Obtain the latest generated redirection rule table, match the data packet with the redirection rule table to obtain a matching result; the redirection rule table includes multiple redirection rules and the behavior corresponding to each redirection rule.

[0069] Exemplarily, according to the above content, the redirection rule table in the rule matcher includes multiple rules sorted in order of priority from high to low and the behavior corresponding to each rule; after obtaining a data packet from the target data packet queue, the latest generated redirection rule table can be obtained from the rule matcher, and the data packet can be matched with the redirection rule table to obtain a matching result.

[0070] In some embodiments, matching a data packet with a redirection rule table to obtain a matching result may include: obtaining a target direction corresponding to the data packet; determining at least one second redirection rule that matches the target direction from the redirection rule table; and matching the data packet with the at least one second redirection rule to obtain a matching result.

[0071] Exemplarily, for the acquired data packet, the target direction corresponding to the data packet can be obtained first, and then at least one second redirection rule that matches the target direction is determined from the redirection rule table. Here, the matched second redirection rules are also sorted in order from high to low priority; then, the data packet is traversed and matched with each matching second redirection to obtain a matching result.

[0072] Here, the target direction is one of the input direction and the output direction; the redirection rule table includes multiple redirection rules for these two different directions and the behaviors corresponding to each redirection rule; therefore, according to the target direction corresponding to the data packet, each second redirection rule matching the target direction can be determined from the multiple redirection rules included in the redirection rule table.

[0073] In some embodiments, matching a data packet with at least one second redirection rule to obtain a matching result may include: determining, in descending order of priority of the second redirection rules, whether the data packet successfully matches all matching patterns included in each second redirection rule; when it is determined that there is a target second redirection rule in which all matching patterns successfully match at least one second redirection rule, determining the target second redirection rule as the first redirection rule that matches the data packet.

[0074] Exemplarily, the position of at least one second redirection rule in the redirection rule table is sorted in descending order of priority, that is, it can be determined in descending order of priority of the second redirection rule whether the data packet successfully matches all the matching patterns included in each second redirection rule; see Figure 3 Therefore, during the traversal process, the matching patterns contained in the second redirection rules can be matched sequentially. When it is determined that there is a target second redirection rule in which all matching patterns are successfully matched in at least one second redirection rule, the target second redirection rule is determined as the first redirection rule that matches the data packet.

[0075] Exemplarily, the matching pattern has a corresponding matching structure, which is a network protocol header data structure, which may include a mask and a range; wherein mask is used to specify which bits need to be matched; range defines a range, specifying the position from which the match starts and the position to which the match ends, which can be expressed as [spec, last], where spec represents the starting position and last represents the ending position.

[0076] For ease of understanding, the matching process of a data packet based on a matching structure of a matching pattern is exemplarily described below.

[0077] For example, when the matching mode is Ethernet protocol, the data structure of mask and range is struct ethhdr, assuming that:

[0078] mask = (source MAC: 0xFFFFFFFFFFFF, destination MAC: 0x000000000000, protocol: 0xFFFF). The mask means exact match of source MAC, no match of destination MAC, and exact match of protocol.

[0079] range = [(source MAC: 0x0242c8c2e5a0, destination MAC: 0x000000000000, protocol: 0x0800), (source MAC: 0x0242c8c2e5a0, destination MAC: 0x000000000000, protocol: 0x0800)]

[0080] Data packet 1 = (source MAC: 0x0242c8c2e5a0, destination MAC: 0x0242c8c2e5a2, protocol: 0x0800). Since both the source MAC and the protocol of data packet 1 match, data packet 1 successfully matches the matching pattern.

[0081] Data packet 2 = (source MAC: 0x0242c8c2e5a1, destination MAC: 0x0242c8c2e5a2, protocol: 0x0800). Since the source MAC of data packet 1 does not match, data packet 1 fails to match the matching pattern.

[0082] Data packet 3 = (source MAC: 0x0242c8c2e5a0, destination MAC: 0x0242c8c2e5a2, protocol: 0x0806). Since the protocol of data packet 1 does not match, data packet 1 fails to match the matching pattern.

[0083] For example, when the matching mode is IPv4 protocol, the data structure of mask and range is structiphdr, assuming that:

[0084] mask = (others: 0, source address: 0xFFFFFF00, destination address: 0x00000000), the mask means matching the first 24 bits of the source address and not matching the rest.

[0085] range = [(others: 0, source address: 0xC0A80B00, destination address: 0x00000000), (others: 0, source address: 0x C0A80C00, destination address: 0x00000000)], which means matching source IP addresses from 192.168.11.0 to 192.168.12.255.

[0086] Data packet 1 = (others: 0, source address: 0xC0A80C7B, destination address: 0xC0A80C79). Since the first 24 bits of the source address of data packet 1 match the source IP, data packet 1 successfully matches the matching pattern.

[0087] Data packet 2 = (other: 0, source address: 0xC0A80D7B, destination address: 0xC0A80C79). Since the source IP of data packet 2 does not match, data packet 1 fails to match the matching pattern.

[0088] For example, when the matching mode is ICMP protocol, the data structure of mask and range is structicmphdr, assuming that:

[0089] mask = (type: 0xFF, others: 0), the mask means exact match type, others do not match.

[0090] range = [(type: 8, others: 0), (type: 8, others: 0)], which means matching packets with ICMP type 8.

[0091] Data packet 1 = (type: 8), since the ICMP type of data packet 1 matches, data packet 1 successfully matches the matching pattern.

[0092] Data packet 2 = (type: 0), since the ICMP type of data packet 2 does not match, data packet 2 fails to match the matching pattern.

[0093] For example, when the matching mode is UDP protocol, the mask and range data structures are structudphdr, assuming that:

[0094] mask = (source port: 0xFFFF, destination port: 0x0000, others: 0). The mask means exact match of the source port and mismatch of others.

[0095] range = [(source port: 1000, destination port: 0, others: 0), (source port: 5000, destination port: 0, others: 0)], which means matching data packets with source ports 1000-5000.

[0096] Data packet 1 = (source port: 1000, destination port: 9999). Since the source port of data packet 1 matches, data packet 1 successfully matches the matching pattern.

[0097] Data packet 2 = (source port: 999, destination port: 9999). Since the source port of data packet 2 is not within the range, data packet 2 fails to match the matching pattern.

[0098] For example, when the matching mode is TCP protocol matching, the mask and range data structures are structtcphdr, assuming that:

[0099] mask = (source port: 0xFFFF, destination port: 0x0000, others: 0). The mask means exact match of the source port and mismatch of others.

[0100] range = [(source port: 1000, destination port: 0, others: 0), (source port: 5000, destination port: 0, others: 0)], which means matching data packets with source ports 1000-5000.

[0101] Data packet 1 = (source port: 1000, destination port: 9999). Since the source port of data packet 1 is successfully matched, data packet 1 is successfully matched with the matching pattern.

[0102] Data packet 2 = (source port: 999, destination port: 9999). Since the source port of data packet 2 does not match, data packet 2 fails to match the matching pattern.

[0103] In the embodiment of the present application, by performing the above-mentioned traversal matching on the data packet imported into the rule matcher in the redirection rule table, a matching result corresponding to the data packet can be obtained.

[0104] Step 102: When the matching result indicates that there is a first redirection rule matching the data packet in the redirection rule table, execute the action corresponding to the first redirection rule.

[0105] In the embodiment of the present application, after obtaining the matching result corresponding to the data packet according to the above steps, it can be determined whether there is a first redirection rule matching the data packet in the redirection rule table according to the matching result.

[0106] Exemplarily, if the matching result indicates that there is a first redirection rule in the redirection rule table that matches the data packet, it means that the rule match is successful. At this time, the data packet can be delivered to the behavior executor to execute the behavior corresponding to the first redirection rule; conversely, if the matching result indicates that there is no first rule in the redirection rule table that matches the data packet, it means that the rule match fails, and no processing will be performed on the data packet at this time; wherein the behavior executor pre-stores the behaviors corresponding to each redirection rule in the redirection rule table.

[0107] For example, the behavior corresponding to each redirection rule in the redirection rule table may include one or more actions; see Figure 4 , the behavior corresponding to a redirection rule may include action 1 to action 5; here, the type of each action is not specifically limited, for example, the action may be to use a hash function to distribute received data packets to different receive queues, to deliver sent data packets to a loopback buffer, to discard data packets, and to forward data packets to the kernel through the kernel NIC interface (KNI) interface.

[0108] It can be seen that the traffic redirection method provided in the embodiment of the present application can adapt to all network cards that support DPDK and can break through the hardware capability limitations of the network card; and the entire process occurs in user mode, does not require the kernel, has almost no impact on performance, can take into account both ease of use and performance, and has a wider range of uses.

[0109] In order to better reflect the purpose of the present application, further examples are given based on the above embodiments of the present application.

[0110] Figure 5 is a flow chart of setting redirection rules and behaviors in an embodiment of the present application, such as Figure 5 As shown, the rule setter may include a rule generator and a behavior generator. Developers may set various redirection rules for different data packet directions in the rule generator through a software API, and set various behaviors corresponding to different redirection rules in the behavior generator through a software API; then, the set redirection rules and the behaviors corresponding to the redirection rules are converted into a specific structure that conforms to the redirection rule table structure, and then the redirection rule table is generated in order of priority, and the behaviors corresponding to the redirection rules are stored in the behavior executor; for the data packet imported into the rule matcher, the data packet can be traversed and matched with the various redirection rules in the redirection rule table, and after the rule matching is successful, the data packet is delivered to the behavior executor for executing the behavior corresponding to the redirection rule; wherein each behavior may include one or more actions, and the behavior executor includes an action selector, and the actions corresponding to the redirection behavior can be determined through the action selector, and the behaviors corresponding to the redirection rule are executed in a sequential manner.

[0111] Figure 6 is a flow chart of another traffic redirection method in an embodiment of the present application, such as Figure 6 As shown, in the receiving process of the network card, the traffic redirection device reads the data packet from the input queue (tx_ring) or the loopback queue (lp_ring), imports it into the inbound rule matcher for rule matching, and after the match is successful, executes the behavior corresponding to the redirection rule. After the behavior is executed, the traffic will be redirected to the corresponding location, which may include other queues or the kernel; if the traffic is redirected to the input queue (in_ring_buffer) of the APP, the APP can obtain the corresponding data packet from the input queue and perform business processing. In the sending process of the network card, the APP can send the data packet to the output queue (out_ring_buffer), the traffic redirection device obtains the data packet from the output queue, and imports it into the outbound rule matcher for rule matching, and after the match is successful, executes the behavior corresponding to the redirection rule. After the behavior is executed, the traffic will be redirected to the corresponding location, which may include the output queue (tx_ring) or the loopback queue (lp_ring) of the network card. Here, the above-mentioned rule matcher includes an inbound rule matcher and an outbound rule matcher. Figure 6The purpose of distinguishing the inbound rule matcher and the outbound rule matcher is to illustrate that the rule matcher can perform rule matching on both the input data packets (corresponding to the inbound rule matcher) and the output data packets (corresponding to the outbound rule matcher).

[0112] In addition, when the size of the output queue (out_ring_buffer) is limited, in order to improve the outbound traffic processing performance and save the time and memory overhead of entering and exiting the output queue (out_ring_buffer), the data packets sent by the APP no longer need to bypass the external program through the output queue (out_ring_buffer). Instead, the traffic redirection device is connected to the APP as a component. The APP sends the data packet to the traffic redirection device, and after passing through the outbound traffic matcher, the corresponding traffic is directly delivered to the output queue (tx_ring) or the loopback queue (lp_ring).

[0113] It can be seen that the traffic redirection method provided in the embodiment of the present application can adapt to all network cards that support DPDK and can break through the hardware capability limitations of the network card; and the entire process occurs in user mode, does not require the kernel, has almost no impact on performance, can take into account both ease of use and performance, and has a wider range of uses; further, in the case of multiple network cards, each network card can use the same network card information to reduce the difficulty of operation and maintenance management.

[0114] Figure 7 Schematic diagram of the structure of the traffic redirection device in the embodiment of the present application. Figure 7 As shown, the device includes: an acquisition module 300, a matching module 301 and an execution module 302, wherein:

[0115] The acquisition module 300 is used to acquire a data packet from a target data packet queue; the target data packet queue includes a data packet queue corresponding to a network card supporting a data plane development toolkit;

[0116] The matching module 301 is used to obtain the latest generated redirection rule table, and match the data packet with the redirection rule table to obtain a matching result; the redirection rule table includes multiple redirection rules and the behavior corresponding to each redirection rule;

[0117] The execution module 302 is used to execute the behavior corresponding to the first redirection rule when there is a first redirection rule matching the data packet in the redirection rule table represented by the matching result.

[0118] In some embodiments, the matching module 301 is further configured to:

[0119] Get the target direction corresponding to the data packet;

[0120] Determining at least one second redirection rule matching the target direction from the redirection rule table;

[0121] The data packet is matched with at least one second redirection rule to obtain a matching result.

[0122] In some embodiments, the redirection rule table includes multiple redirection rules that are sorted by priority, and each redirection rule includes at least one matching pattern. The matching module 301 is further configured to:

[0123] In descending order of priority of the second redirection rules, determining in turn whether the data packet successfully matches all matching patterns included in each second redirection rule;

[0124] When it is determined that there is a target second redirection rule in which all matching patterns are successfully matched in at least one second redirection rule, the target second redirection rule is determined as the first redirection rule matching the data packet.

[0125] In some embodiments, the above apparatus further includes a generating module, and before obtaining the data packet from the target data packet queue, the generating module is configured to:

[0126] Acquire a third redirection rule set through a software interface and a behavior corresponding to the third redirection rule; the third redirection rule includes at least one matching pattern, and each matching pattern has a corresponding priority;

[0127] A redirection rule table is generated according to the priority of the matching pattern in the third redirection rule; the redirection rule table includes the third redirection rule and the behavior corresponding to the third redirection rule.

[0128] In some embodiments, the generating module is further configured to:

[0129] Determine a storage location of the third redirection rule in the redirection rule table according to the priority of the matching pattern in the third redirection rule;

[0130] A redirection rule table is generated according to the storage position of the third redirection rule in the redirection rule table.

[0131] In some embodiments, the generating module is further configured to:

[0132] Compare the priority of the matching pattern in the third redirection rule with the priority of the matching pattern in the fourth redirection rule stored in the redirection rule table generated last time, and obtain a comparison result;

[0133] According to the comparison result, a storage location of the third redirection rule in the redirection rule table is determined.

[0134] In some embodiments, the generating module is further configured to:

[0135] If the comparison result indicates that the last generated redirection rule table does not store a fourth redirection rule having the same priority as the matching pattern in the third redirection rule, determining a storage position of the third redirection rule in the redirection rule table according to a storage position of the fourth redirection rule in the redirection rule table;

[0136] When the comparison result indicates that a fourth redirection rule with the same priority as the matching pattern in the third redirection rule is stored in the last generated redirection rule table, the storage position of the third redirection rule in the redirection rule table is determined according to the longest match principle and the matching pattern of the fourth redirection rule.

[0137] In practical applications, the acquisition module 300, matching module 301, execution module 302 and generation module can all be implemented by a processor located in an electronic device, and the processor can be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor.

[0138] In addition, each functional module in this embodiment can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or software functional modules.

[0139] If the integrated unit is implemented in the form of a software function module and is not sold or used as an independent commodity, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment is essentially or the part that contributes to the relevant technology or the whole or part of the technical solution can be embodied in the form of a software commodity. The computer software commodity is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the method of this embodiment. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc. Various media that can store program codes.

[0140] Specifically, the computer program instructions corresponding to a traffic redirection method in this embodiment can be stored on a storage medium such as a CD, a hard disk, or a USB flash drive. When the computer program instructions corresponding to a traffic redirection method in the storage medium are read or executed by an electronic device, any traffic redirection method in the aforementioned embodiments is implemented.

[0141] Based on the same technical concept as the above embodiments, see Figure 8 , which shows an electronic device 400 provided in an embodiment of the present application, which may include: a memory 401 and a processor 402; wherein,

[0142] Memory 401, used for storing computer programs and data;

[0143] The processor 402 is used to execute the computer program stored in the memory to implement any one of the traffic redirection methods in the foregoing embodiments.

[0144] In practical applications, the memory 401 may be a volatile memory, such as RAM; or a non-volatile memory, such as ROM, flash memory, hard disk drive (HDD) or solid-state drive (SSD); or a combination of the above types of memory, and provide instructions and data to the processor 402.

[0145] The processor 402 may be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor. It is understandable that for different electronic devices, the electronic device used to implement the processor function may also be other, which is not specifically limited in the embodiments of the present application.

[0146] The present application provides a computer program product, including a computer program, which implements any one of the traffic redirection methods of the aforementioned embodiments when executed by a processor.

[0147] In some embodiments, the functions or modules included in the device provided in the embodiments of the present application can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments. For the sake of brevity, it will not be repeated here.

[0148] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0149] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments. The features disclosed in the various commodity embodiments provided in this application can be arbitrarily combined without conflict to obtain new commodity embodiments. The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0150] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program codes.

[0151] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0152] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0153] The above are only preferred embodiments of the present application and are not intended to limit the protection scope of the present application.

Claims

1. A traffic redirection method, characterized in that: The method comprises: Acquire a data packet from a target data packet queue; the target data packet queue includes a data packet queue corresponding to a network card supporting a data plane development toolkit; Obtaining a newly generated redirection rule table, and matching the data packet with the redirection rule table to obtain a matching result; the redirection rule table includes a plurality of redirection rules and a behavior corresponding to each redirection rule; When the matching result indicates that there is a first redirection rule matching the data packet in the redirection rule table, an action corresponding to the first redirection rule is executed.

2. The method according to claim 1, characterized in that The step of matching the data packet with the redirection rule table to obtain a matching result includes: Obtaining a target direction corresponding to the data packet; Determining at least one second redirection rule matching the target direction from the redirection rule table; The data packet is matched with the at least one second redirection rule to obtain the matching result.

3. The method according to claim 2, characterized in that The redirection rule table includes a plurality of redirection rules which are sorted according to priority, each of the redirection rules includes at least one matching pattern, and the matching result is obtained by matching the data packet with the at least one second redirection rule, including: In descending order of priority of the second redirection rules, determining in sequence whether the data packet successfully matches all matching patterns included in each second redirection rule; When it is determined that there is a target second redirection rule in which all matching patterns are successfully matched in the at least one second redirection rule, the target second redirection rule is determined as the first redirection rule matching the data packet.

4. The method according to claim 1, characterized in that: The method further comprises: Acquire a third redirection rule set through a software interface and a behavior corresponding to the third redirection rule; the third redirection rule includes at least one matching mode, and each matching mode has a corresponding priority; A redirection rule table is generated according to the priority of the matching pattern in the third redirection rule; the redirection rule table includes the third redirection rule and the behavior corresponding to the third redirection rule.

5. The method according to claim 4, characterized in that The step of generating a redirection rule table according to the priority of the matching pattern in the third redirection rule includes: Determining a storage location of the third redirection rule in the redirection rule table according to a priority of a matching pattern in the third redirection rule; The redirection rule table is generated according to the storage position of the third redirection rule in the redirection rule table.

6. The method according to claim 5, characterized in that The step of determining a storage location of the third redirection rule in the redirection rule table according to a priority of a matching pattern in the third redirection rule includes: Compare the priority of the matching pattern in the third redirection rule with the priority of the matching pattern in the fourth redirection rule stored in the redirection rule table generated last time, and obtain a comparison result; According to the comparison result, a storage location of the third redirection rule in the redirection rule table is determined.

7. The method according to claim 6, characterized in that Determining, according to the comparison result, a storage location of the third redirection rule in the redirection rule table includes: In a case where the comparison result indicates that the last generated redirection rule table does not store a fourth redirection rule having the same priority as the matching pattern in the third redirection rule, determining a storage position of the third redirection rule in the redirection rule table according to a storage position of the fourth redirection rule in the redirection rule table; When the comparison result represents that a fourth redirection rule having the same priority as a matching pattern in the third redirection rule is stored in the last generated redirection rule table, the storage position of the third redirection rule in the redirection rule table is determined according to the longest match principle and the matching pattern of the fourth redirection rule.

8. A traffic redirection device, characterized in that: The device comprises: An acquisition module, used for acquiring a data packet from a target data packet queue; the target data packet queue includes a data packet queue corresponding to a network card supporting a data plane development toolkit; A matching module, used to obtain a newly generated redirection rule table, and match the data packet with the redirection rule table to obtain a matching result; the redirection rule table includes a plurality of redirection rules and a behavior corresponding to each redirection rule; The execution module is used to execute the behavior corresponding to the first redirection rule when the matching result indicates that there is a first redirection rule matching the data packet in the redirection rule table.

9. An electronic device, characterized in that: The electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the method according to any one of claims 1 to 7 when executing the program.

10. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images