Data traffic transmission method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a data traffic transmission method and device, computer equipment, a readable storage medium and a program product. The method comprises the following steps: acquiring a data traffic packet, and detecting a traffic type identifier of the data traffic packet according to a transport layer protocol and a port type identifier of the data traffic packet; when the traffic type identifier is a first preset identifier, entering a callback processing logic according to the first preset identifier, obtaining a protocol identifier corresponding to the data traffic packet, and detecting a network card queue identifier matched with the protocol identifier; under the condition that the traffic type identifier is a second preset identifier, acquiring a source address and a source port of the data traffic packet, and generating a network card queue identifier matched with the source address and the source port; and determining a network card queue corresponding to the network card queue identifier, and forwarding the data traffic packet to a processor corresponding to the network card queue. By adopting the method, the security of data traffic transmission can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of cloud computing, and in particular to a data traffic transmission method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of science and technology, the field of cloud computing has become a hot topic. Among them, how to process data traffic packets in this field is crucial, which can provide convenience and security for data transmission.

[0003] In traditional technologies, in cloud network scenarios, data traffic packets are all service packets generated by VPN (Virtual Private Network) encapsulated based on vxlan (Virtual eXtensible Local Area Network), that is, vxlan is used between the front-end gateway of the VPN gateway and the VPN gateway to encapsulate IPsec (Internet Protocol Security, a collection of protocols and services that provide security for IP networks) / SSL (Secure Sockets Layer) service packets, and the tenant granularity between the front-end gateway and the VPN gateway is isolated by vxlan. In the cloud network architecture, most VPN gateways use DPDK (Data plane development kit) / VPP (Vector Packet Processing) technology as the technical architecture of the data plane, and hash the data traffic packets through RSS (Really Simple Syndication). At this time, a tenant's data traffic packet is generally hashed into a network card queue, and then processed by a CPU (Central Processing Unit) core.

[0004] However, the current data traffic transmission method is not secure enough. Summary of the invention

[0005] Based on this, it is necessary to provide a secure data traffic transmission method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems.

[0006] In a first aspect, the present application provides a data traffic transmission method, comprising:

[0007] Acquire a data flow packet, and detect a flow type identifier of the data flow packet according to a transport layer protocol and a port type identifier of the data flow packet;

[0008] In the case where the traffic type identifier is the first preset identifier, entering the processing callback logic according to the first preset identifier, obtaining the protocol identifier corresponding to the data traffic packet, and detecting the network card queue identifier matching the protocol identifier;

[0009] When the traffic type identifier is the second preset identifier, the source address and source port of the data traffic packet are obtained, and according to the source address and the source port, a network card queue identifier matching the source address and the source port is generated;

[0010] Determine the network card queue corresponding to the network card queue identifier, and forward the data flow packet to the processor corresponding to the network card queue.

[0011] In one embodiment, detecting the traffic type identifier of the data traffic packet according to the transport layer protocol and the port type identifier of the data traffic packet includes:

[0012] When it is detected that the virtual extended local area network information in the data traffic packet matches the preset virtual extended local area network information, detecting the port type identifier of the data traffic packet;

[0013] According to the transport layer protocol and port type identifier of the data traffic packet, the traffic type identifier of the data traffic packet is detected.

[0014] In one embodiment, detecting the traffic type identifier of the data traffic packet according to the transport layer protocol and the port type identifier of the data traffic packet includes:

[0015] Generate identification matching rules according to the transport layer protocol of the data flow packet;

[0016] According to the identifier matching rule, detecting the traffic type identifier that matches the port type identifier, wherein the identifier matching rule represents the mapping relationship between the port type identifier and the traffic type identifier;

[0017] If the port type identifier is the first port identifier, determining that the traffic type identifier of the data traffic packet is the first preset identifier;

[0018] If the port type identifier is the second port identifier, it is determined that the traffic type identifier of the data traffic packet is the second preset identifier.

[0019] In one embodiment, forwarding the data traffic packet to a processor corresponding to a network card queue includes:

[0020] Forward the data traffic packet to the network card queue corresponding to the network card queue identifier;

[0021] Forward the data traffic packets in the network card queue to the processor corresponding to the network card queue in the application layer.

[0022] In one embodiment, forwarding a data flow packet in a network card queue to a processor corresponding to the network card queue in an application layer includes:

[0023] Call the preset transmission function to forward the data flow packets in the network card queue to the processor corresponding to the network card queue in the application layer.

[0024] In one embodiment, the method further comprises:

[0025] When the data flow packet is forwarded to the network card queue corresponding to the network card queue identifier, the count number of the data flow packets in each network card queue is updated;

[0026] Based on the updated count quantity, the data traffic processing log is updated.

[0027] In a second aspect, the present application also provides a data flow transmission device, including:

[0028] A traffic analysis module, used to obtain a data traffic packet and detect a traffic type identifier of the data traffic packet according to a transport layer protocol and a port type identifier of the data traffic packet;

[0029] A first processing module, configured to, when the traffic type identifier is a first preset identifier, enter a processing callback logic according to the first preset identifier, obtain a protocol identifier corresponding to the data traffic packet, and detect a network card queue identifier matching the protocol identifier;

[0030] The second processing module is used to obtain the source address and source port of the data traffic packet when the traffic type identifier is the second preset identifier, and generate a network card queue identifier that matches the source address and the source port according to the source address and the source port;

[0031] The traffic forwarding module is used to determine the network card queue corresponding to the network card queue identifier and forward the data traffic packet to the processor corresponding to the network card queue.

[0032] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0033] Acquire a data flow packet, and detect a flow type identifier of the data flow packet according to a transport layer protocol and a port type identifier of the data flow packet;

[0034] In the case where the traffic type identifier is the first preset identifier, entering the processing callback logic according to the first preset identifier, obtaining the protocol identifier corresponding to the data traffic packet, and detecting the network card queue identifier matching the protocol identifier;

[0035] When the traffic type identifier is the second preset identifier, the source address and source port of the data traffic packet are obtained, and according to the source address and the source port, a network card queue identifier matching the source address and the source port is generated;

[0036] Determine the network card queue corresponding to the network card queue identifier, and forward the data flow packet to the processor corresponding to the network card queue.

[0037] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0038] Acquire a data flow packet, and detect a flow type identifier of the data flow packet according to a transport layer protocol and a port type identifier of the data flow packet;

[0039] In the case where the traffic type identifier is the first preset identifier, entering the processing callback logic according to the first preset identifier, obtaining the protocol identifier corresponding to the data traffic packet, and detecting the network card queue identifier matching the protocol identifier;

[0040] When the traffic type identifier is the second preset identifier, the source address and source port of the data traffic packet are obtained, and according to the source address and the source port, a network card queue identifier matching the source address and the source port is generated;

[0041] Determine the network card queue corresponding to the network card queue identifier, and forward the data flow packet to the processor corresponding to the network card queue.

[0042] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0043] Acquire a data flow packet, and detect a flow type identifier of the data flow packet according to a transport layer protocol and a port type identifier of the data flow packet;

[0044] In the case where the traffic type identifier is the first preset identifier, entering the processing callback logic according to the first preset identifier, obtaining the protocol identifier corresponding to the data traffic packet, and detecting the network card queue identifier matching the protocol identifier;

[0045] When the traffic type identifier is the second preset identifier, the source address and source port of the data traffic packet are obtained, and according to the source address and the source port, a network card queue identifier matching the source address and the source port is generated;

[0046] Determine the network card queue corresponding to the network card queue identifier, and forward the data flow packet to the processor corresponding to the network card queue.

[0047] The above-mentioned data traffic transmission method, device, computer equipment, computer-readable storage medium and computer program product, instead of hashing the data traffic message through the simple aggregation technology, so that multiple data traffic packets are hashed into a network card queue to be processed by the same processor, the present application proposes a safer data traffic processing method. Specifically, for each data traffic packet, first, according to the transport layer protocol and port type identifier of the data traffic packet, the traffic type identifier of the data traffic packet is detected, and secondly, according to the traffic type identifier, different data traffic processing is performed on the data traffic packet, so that in the case where the traffic type identifier is the first preset identifier Under the present invention, according to the first preset identifier, the processing callback logic is entered, the protocol identifier corresponding to the data traffic packet is obtained, and the network card queue identifier matching the protocol identifier is detected. When the traffic type identifier is the second preset identifier, the source address and source port of the data traffic packet are obtained, and a network card queue identifier matching both the source address and the source port is generated to determine the network card queue corresponding to the network card queue identifier. Since each data traffic packet has a network card queue of a queue, all data traffic packets can be forwarded to the processors corresponding to the respective network card queues to reduce the occurrence of a large number of packet losses due to too many data traffic packets, thereby improving the security of data traffic processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments of the present application or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 An application environment diagram of a data traffic transmission method in an embodiment;

[0050] Figure 2 A schematic diagram of a flow chart of a data traffic transmission method in an embodiment;

[0051] Figure 3 A schematic diagram of a flow chart of a data traffic transmission method in another embodiment;

[0052] Figure 4 It is a flowchart of a data traffic transmission method in another embodiment;

[0053] Figure 5 is a structural block diagram of a data flow transmission device in an embodiment;

[0054] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are used to explain the present application and are not used to limit the present application.

[0056] At present, in cloud network scenarios, data traffic packets are all service packets generated by VPN based on vxlan encapsulation, that is, vxlan is used between the front gateway of the VPN gateway and the VPN gateway to encapsulate IPsec / SSL service packets, and the tenant granularity between the front gateway and the VPN gateway is isolated by vxlan. In the cloud network architecture, most VPN gateways use DPDK / VPP technology as the technical architecture of the data plane, and hash the data traffic packets through RSS. At this time, if multiple data traffic packets are sent by the same tenant, they are generally hashed to one CPU core. When the traffic of the data traffic packets sent by the tenant is too large, the performance of a single CPU core cannot handle it. Therefore, the bandwidth of a single tenant does not take advantage of the multi-core advantage, so there may be a large number of packet losses in the case of a sudden increase in the traffic of a single tenant, and the security of data traffic transmission is poor. Among them, vxlan is a virtual networking technology that creates a virtual layer 2 tunnel on the IP (Internet Protocol) network to achieve dynamic migration of virtual machines and isolation of massive tenants.

[0057] Therefore, the present application mainly provides a data traffic transmission method, which is used to solve the problem that in the existing cloud network scenario, IPsec / SSL traffic is transmitted between the same tenant's front-end speed-limiting gateway and the VPN gateway through only one vxlan tunnel, resulting in the tenant's IPsec / SSL traffic being processed on one CPU core when passing through the RSS simple information aggregation function of the network card. That is, at this time, the traffic forwarded by the VPN gateway will only be processed on one core.

[0058] Specifically, this application mainly distributes VPN traffic to multiple CPU cores for processing by configuring IPsec's ESP (Encapsulating Security Payload) information and the source IP and source port information of the SSL tunnel, making full use of multiple cores, improving the performance of the VPN gateway, reducing the number of large-scale packet loss in the event of a sudden increase in single-tenant traffic, and improving the security of data traffic transmission.

[0059] The data flow transmission method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown.

[0060] When at least one data flow is transmitted between the front-end gateway and the VPN gateway of the same tenant through the virtual extended LAN tunnel 102, the data flow will pass through the smart network card 104. At this time, the smart network card 104 obtains at least one data flow packet, and for each data flow packet, detects the flow type of the data flow packet. When the flow type is an IPsec ESP message, the ESP identifier of the data flow packet is obtained, and the network card queue identifier that matches the ESP identifier is detected. When the type is an SSL message, the source address and source port of the data flow packet are obtained, and the network card queue identifier that matches the source address and source port is detected, the network card queue 106 corresponding to the network card queue identifier is determined, and all data flow packets are forwarded to the processor 108 corresponding to the network card queue 106.

[0061] In an exemplary embodiment, Figure 2 As shown, a data flow transmission method is provided, and the method is applied to Figure 1 The intelligent network card 104 in FIG. 1 is used as an example for explanation.

[0062] S100, obtaining a data flow packet, and detecting a flow type identifier of the data flow packet according to a transport layer protocol and a port type identifier of the data flow packet.

[0063] Among them, network traffic refers to the amount of data transmitted in a computer network, usually the number or size of data packets passing through the network within a period of time. The data traffic packet is the basic unit of network traffic transmission, which is defined as a small piece of data, including necessary control information and user data.

[0064] Specifically, when data traffic is transmitted between the front-end gateway and the VPN gateway of the same tenant through the vxlan tunnel, the data traffic will pass through the smart network card. At this time, the smart network card obtains the data traffic packet, and the smart network card obtains at least one data traffic packet.

[0065] Detect the transport layer protocol and port type identifier of the data traffic packet, and detect the traffic type identifier of the data traffic packet according to the transport layer protocol and port type identifier of the data traffic packet, wherein the traffic type identifier of the data traffic packet includes a first preset identifier or a second preset identifier, the first preset identifier indicates that the traffic in the data traffic packet is a message of the ESP protocol under the IPsec protocol package, and the second preset identifier indicates that the traffic in the data traffic packet is a message under the SSL protocol package, for example, a tcp (Transmission Control Protocol) message or a udp (User Datagram Protocol) message.

[0066] S200, when the traffic type identifier is the first preset identifier, enter the processing callback logic according to the first preset identifier, obtain the protocol identifier corresponding to the data traffic packet, and detect the network card queue identifier matching the protocol identifier.

[0067] Specifically, in order to forward data traffic packets of different traffic types to multiple processors, first, it is necessary to determine the forwarding queues of the data traffic packets of different traffic types, that is, their corresponding network card queues.

[0068] When the traffic type identifier is the first preset identifier, that is, when the traffic type is an ESP protocol message under an IPsec protocol packet, the processing callback logic is entered according to the first preset identifier to obtain the IPsec protocol identifier in the data traffic packet. Further, the protocol identifier is obtained from the ESP header information of IPsec, and the protocol identifier is also the ESP id protocol identifier. The ESP header information is actually obtained from the ip_header field in the issued matching rule.

[0069] Then, the network card queue identifier that matches the protocol identifier is detected to determine the network card queue used to transmit the data flow packet.

[0070] Further, detecting the network card queue identifier that matches the protocol identifier includes: obtaining preset first network card queue matching information; and detecting the network card queue identifier that matches the protocol identifier from the preset first network card queue matching information. The preset first network card queue matching information is information that maps the protocol identifier and the network card queue identifier to each other, and is generally represented in the form of a graph or table.

[0071] S300, when the traffic type identifier is the second preset identifier, obtain the source address and source port of the data traffic packet, and generate a network card queue identifier that matches the source address and the source port according to the source address and the source port.

[0072] Specifically, when the traffic type identifier is the second preset identifier, that is, when the traffic type is a message under the SSL protocol packet, the source address and source port of the data traffic packet are obtained. At this time, the source address and source port are also obtained from the ip_header field in the issued matching rule. A network card queue identifier matching both the source address and the source port is generated, and the network card queue used to transmit the data traffic packet can be determined.

[0073] Further, generating a network card queue identifier that matches both the source address and the source port includes: obtaining preset second network card queue matching information; generating a network card queue identifier that matches both the source address and the source port from the preset second network card queue matching information. The preset second network card queue matching information is information that maps the source address, the source port, and the network card queue identifier to each other, and is generally represented in the form of a graph or table.

[0074] S400, determining a network card queue corresponding to the network card queue identifier, and forwarding the data flow packet to a processor corresponding to the network card queue.

[0075] Specifically, the network card queue corresponding to the network card queue identifier is determined, and according to the action in the action, the data flow packet is loaded to the corresponding network card queue, so that the data flow packet is forwarded to the processor corresponding to the network card queue through the network card queue, so that the data flow packet is processed on multiple processors. Generally, one network card queue corresponds to one processor, and different network card queues can correspond to the same processor.

[0076] In the above-mentioned data traffic transmission method, instead of hashing the data traffic message through the simple aggregation technology, so that multiple data traffic packets are hashed into the network card queue to be processed by the same processor, the present application proposes a safer data traffic processing method. Specifically, for each data traffic packet, first, according to the port type identifier of the data traffic packet, the transport layer protocol and traffic type identifier of the data traffic packet are detected. Secondly, according to the traffic type identifier, different data traffic processing is performed on the data traffic packet, so that when the traffic type identifier is a first preset identifier, the processing callback logic is entered according to the first preset identifier, the protocol identifier corresponding to the data traffic packet is obtained, and the network card queue identifier matching the protocol identifier is detected. When the traffic type identifier is a second preset identifier, the source address and source port of the data traffic packet are obtained, and a network card queue identifier matching the source address and the source port is generated, and the network card queue corresponding to the network card queue identifier is determined. Since each data traffic packet has a queue network card queue, all data traffic packets can be forwarded to the processors corresponding to the respective network card queues to reduce the occurrence of a large number of packet losses caused by too many data traffic packets, thereby improving the security of data traffic processing.

[0077] In an exemplary embodiment, Figure 3 As shown, S100 includes:

[0078] S120, obtaining a data traffic packet.

[0079] S140: When it is detected that the virtual extended LAN information in the data traffic packet is the preset virtual extended LAN information, detect the port type identifier of the data traffic packet.

[0080] S160, detecting the traffic type identifier of the data traffic packet according to the transport layer protocol and the port type identifier of the data traffic packet.

[0081] Specifically, when obtaining a data traffic packet and detecting the traffic type identifier of the data traffic packet, first, it is necessary to detect whether the data traffic packet is a data traffic packet encapsulated in a virtual extended LAN vxlan. If it is detected that the data traffic packet is a data traffic packet encapsulated in a virtual extended LAN vxlan, then it is detected whether the virtual extended LAN vxlan information is the virtual extended LAN vxlan information in the preset matching rule.

[0082] When it is detected that the virtual extended LAN vxlan information in the data traffic packet is the virtual extended LAN vxlan information in the preset matching rule, the traffic type identifier of the data traffic packet can be detected according to the transport layer protocol and port type identifier of the data traffic packet.

[0083] In this embodiment, by matching the virtual extended LAN vxlan information and port type of the data traffic packet according to the matching rules issued by the control plane, the traffic type identifier of the data traffic packet can be accurately detected, thereby improving the accuracy of subsequent forwarding of the data traffic packet.

[0084] In an exemplary embodiment, detecting a traffic type identifier of a data traffic packet according to a transport layer protocol and a port type identifier of the data traffic packet includes:

[0085] Generate an identifier matching rule based on the transport layer protocol of the data traffic packet; based on the identifier matching rule, detect the traffic type identifier that matches the port type identifier, and when the port type identifier is the first port identifier, determine that the traffic type identifier of the data traffic packet is the first preset identifier; when the port type identifier is the second port identifier, determine that the traffic type identifier of the data traffic packet is the second preset identifier.

[0086] The identifier matching rule represents the mapping relationship between the port type identifier and the traffic type identifier.

[0087] Specifically, according to the transport layer protocol of the data flow packet, an identification matching rule matching the transport layer protocol is obtained, and the identification matching rule is the mapping relationship between the port type identification and the flow type identification. From the identification matching rule, the flow type identification matching the port type identification is queried to accurately determine the flow type identification according to the port type identification.

[0088] Further, when the port type identifier is the first port identifier, the traffic type identifier of the data traffic packet is determined to be the first preset identifier, and when the port type identifier is the second port identifier, the traffic type identifier of the data traffic packet is determined to be the second preset identifier. Generally, the first port identifier generally refers to the destination port 4500, such as udp 4500, etc., and the second port identifier generally refers to the destination port 1194, such as tcp 1194 or udp 1194, etc.

[0089] In an exemplary embodiment, in the process of detecting the traffic type identifier of a data traffic packet, the traffic type identifier is not determined arbitrarily based on the port type identifier, but needs to be accurately determined based on a preset matching rule, that is, the traffic type identifier is accurately determined in combination with the preset matching rule and the port type identifier.

[0090] To this end, the present application involves a control plane and a data plane, wherein the control plane is used to split the matching rules and send the split matching rules to the smart network card, and the data plane mainly matches the data traffic packets with the corresponding network card queues according to the rules.

[0091] In detail, the control plane organizes and splits the FDIR (Intel® Ethernet Flow Director) rules that need to be configured in the smart network card. FDIR refers to the technology of directing data packets directly to the core where the target application is located through hardware acceleration, solving the performance bottleneck of RSS, and allocating them to a specific queue based on the precise matching of the packet fields. The settings of the splitting rules are classified according to different traffic types, and the specific processing is as follows:

[0092] Taking the case where the traffic in the data traffic packet represented by the first preset identifier is a message of the ESP protocol under the IPsec protocol packet as an example, at this time, the traffic type is an IPsec ESP message, for the IPsec ESP message:

[0093] The matching rules are sent to the smart NIC in the order of ethernet_header->ip_header->udp_header->vxlan_header (configure and send all vxlan information between the speed-limiting gateway)->ethernet_header->ip_header->udp_header (destination port 4500) as the pattern field configuration of rte_flow. The action field in rte_flow is used to redirect the matched data traffic packets to a specific NIC queue.

[0094] Taking the case where the traffic in the data traffic packet represented by the first preset identifier is a message under the SSL protocol packet as an example, at this time, the traffic type is an SSL message, for the SSL message:

[0095] Since the SSL VPN (Security Socket Layer Virtual Private Network, a new type of virtual private network technology that uses the SSL protocol to achieve remote access) gateway supports both udp and tcp bearer modes, its matching rules are divided into two types. Among them, the data flow of the udp protocol is sent in the order of ethernet_header->ip_header->udp_header->vxlan_header (configure and send all vxlan information between the speed-limited gateway)->ethernet_header->ip_header->udp_header (destination port 1194) as the pattern field of rte_flow, and the data flow of the tcp protocol is sent in the order of ethernet_header->ip_header->udp_header->vxlan_header (configure and send all vxlan information between the speed-limited gateway)->ethernet_header->ip_header->tcp_header (destination port 1194) through the pattern field of rte_flow. The action field of rte_flow is mainly used to redirect data traffic packets to a specific network card queue.

[0096] The data plane detects the data traffic type and forwards it according to the matching rules issued.

[0097] That is to say, after the smart network card receives the data traffic packet, it matches each field of the data traffic packet according to the matching rules sent down by the control plane to determine which message's matching rules the data traffic packet complies with. If the data traffic packet complies with the matching rules of the IPsec ESP message, the data traffic packet is an IPsec ESP message. At this time, the traffic type identifier is determined to be the first preset identifier. If the data traffic packet complies with the matching rules of the SSL message, the data traffic packet is an SSL message. At this time, the traffic type identifier is determined to be the second preset identifier.

[0098] Further, determining whether the data traffic packet complies with the matching rule of the IPsec ESP message or the SSL message is actually determining whether the data traffic packet complies with the port type identifier in the matching rule of the IPsec ESP message or the SSL message.

[0099] For example, when the port type identifier of the data traffic packet is the destination port 4500, it can be obtained that the port type identifier of the data traffic packet conforms to the port type identifier in the matching rule of the IPsec ESP message. Therefore, the data traffic packet is an IPsec ESP message, and the traffic type identifier is the first preset identifier; when the port type identifier of the data traffic packet is the destination port tcp / udp 1194, it can be obtained that the port type identifier of the data traffic packet conforms to the port type identifier in the matching rule of the SSL message. Therefore, the data traffic packet is an SSL message, and the traffic type identifier is the second preset identifier.

[0100] Based on the above analysis, it can be obtained that when the port type identifier is a first port identifier that matches the first preset identifier, the traffic type identifier of the data traffic packet is determined to be the first preset identifier; when the port type identifier is a second port identifier that matches the second preset identifier, the traffic type identifier of the data traffic packet is determined to be the second preset identifier.

[0101] In this embodiment, according to the identifier matching rule, the traffic type identifier that matches the port type identifier is detected. When the port type identifier is the first port identifier, such as the first port identifier is udp 4500, the traffic type of the data traffic packet is determined to be an IPsec ESP message. When the port type identifier is the second port identifier, such as the second port identifier is tcp1194 or udp 1194, the traffic type of the data traffic packet is determined to be an SSL message. The traffic type of the data traffic packet can be accurately determined by the identifier matching rule and the specific port type of the data traffic packet.

[0102] In an exemplary embodiment, forwarding a data traffic packet to a processor corresponding to a network card queue includes:

[0103] For each data flow packet, the data flow packet is forwarded to the network card queue corresponding to the network card queue identifier, and the data flow packet in the network card queue is forwarded to the processor corresponding to the network card queue in the application layer.

[0104] Specifically, all data traffic packets are forwarded to the processor corresponding to the network card queue. One data traffic packet corresponds to one network card queue, one network card queue corresponds to one processor, and one data traffic packet also has a corresponding processor. Different data traffic packets may correspond to different processors. Therefore, different data traffic packets can be forwarded to different processors to reduce the occurrence of packet loss caused by excessive traffic and improve the security of data traffic transmission.

[0105] More specifically, for each data flow packet, first, the data flow packet is forwarded to the network card queue corresponding to the network card queue identifier, and then the data flow packet in the network card queue is forwarded to the processor corresponding to the network card queue in the application layer. In other words, the data flow packet is carried by the network card queue and transmitted to the processor.

[0106] In this embodiment, the network card queue corresponding to the network card queue identifier can make the data traffic packet efficiently transmitted to the processor, and one data traffic packet corresponds to one network card queue, and one network card queue corresponds to one processor. Different data traffic packets can also be transmitted to different processors, reducing the occurrence of packet loss caused by excessive traffic and improving the security of data traffic transmission.

[0107] In an exemplary embodiment, forwarding a data traffic packet in a network card queue to a processor corresponding to the network card queue in an application layer includes:

[0108] Call the preset transmission function to forward the data flow packets in the network card queue to the processor corresponding to the network card queue in the application layer.

[0109] Specifically, the transmission function preset in the present application can be the DPDK API (Application Programming Interface) rte_eth_rx_burst function, which is a key function in DPDK for receiving data packets from a specified network port. The function attempts to retrieve up to nb_pkts data packets from the specified receive queue and store them in the rte_mbuf structure provided in the rx_pkts array.

[0110] In the network card driver before calling the DPDK API rte_eth_rx_burst function, the encapsulation format of the message is matched by the matching rules in the rte_flow framework to see whether it is IPsec traffic encapsulated by vxlan or SSL traffic. If the data traffic packet is matched, it is processed according to the corresponding action in the matching rule to load the traffic to other queues at the network card hardware level, so that it can be processed by the multi-core processor at the vpp application layer after rte_eth_rx_burst.

[0111] That is to say, before calling the preset transmission function, the present application needs to first detect the traffic type of the data traffic packet, and then forward the data traffic packets of different traffic types to the network card queue, so as to call the preset transmission function to forward the data traffic packets in multiple network card queues to the processors corresponding to the network card queues in the application layer.

[0112] In this embodiment, by calling a preset transmission function, the data traffic packets in the network card queue can be efficiently pushed to the processor corresponding to the application layer.

[0113] In an exemplary embodiment, the method further comprises:

[0114] When the data traffic packet is forwarded to the network card queue corresponding to the network card queue identifier, the count quantity of the data traffic packet in each network card queue is updated, and the data traffic processing log is updated based on the updated count quantity.

[0115] Specifically, the action field of rte_flow can not only forward the data flow packet to the network card queue corresponding to the network card queue identifier, but also count the matched data flow packets. That is to say, first, obtain the count quantity at the initial moment, which is generally set to 0, and when the next data flow packet is forwarded to the network card queue corresponding to the network card queue identifier, update the count quantity of the data flow packet in each network card queue, and then update the data flow processing log based on the updated count quantity.

[0116] Furthermore, the method of updating the count number of data traffic packets in each network card queue is to increase the count number by 1.

[0117] In this embodiment, by counting the data flow packets forwarded to the network card queue corresponding to the network card queue identifier, the data flow processing log can be updated to achieve traceability of the data flow transmission process.

[0118] In an exemplary embodiment, Figure 4 As shown, a detailed example will be used to describe the data traffic transmission method, which specifically includes:

[0119] This application is divided into a control plane and a data plane. The control plane is mainly responsible for splitting matching rules and sending them to smart network cards, while the data plane is mainly responsible for matching messages according to the rules.

[0120] Control plane: By organizing and splitting the FDIR rules configured in the smart network card, the rule settings are classified according to two types of traffic. The specific processing is as follows:

[0121] Matching rules for IPsec tunnels:

[0122] The pattern field of the rte_flow component is configured and sent in the order of ethernet_header->ip_header->udp_header->vxlan_header (configure and send the vxlan information between the speed-limiting gateway)->ethernet_header->ip_header->udp_header (destination port 4500). The action field of the rte_flow component mainly counts the matched traffic and redirects the flow to a specific network card queue.

[0123] Matching rules for SSL tunnels:

[0124] SSL VPN gateway supports two bearer modes: udp and tcp. The data flow of udp protocol is sent as the pattern field of rte_flow component in the order of ethernet_header->ip_header->udp_header->vxlan_header (configure and send all vxlan information between the speed limit gateway)->ethernet_header->ip_header->udp_header (destination port 1194). The data of tcp protocol is sent through the pattern field of rte_flow component in the order of ethernet_header->ip_header->udp_header->vxlan_header (configure and send all vxlan information between the speed limit gateway)->ethernet_header->ip_header->tcp_header (destination port 1194). The action field of rte_flow component mainly counts the matched traffic and redirects the flow to a specific network card queue.

[0125] Data forwarding plane (explained separately according to IPsec and SSL protocols):

[0126] After the data traffic of the IPsec tunnel is encapsulated through vxlan, after the network card receives the data traffic packet, it matches the vxlan information and whether the message is an IPsec ESP message according to the rules issued by the control layer, that is, according to the port type identifier of the data traffic packet, it determines whether the data traffic packet meets the matching rules of the IPsec ESP message or the matching rules of the SSL message. If the port type identifier of the data traffic packet is udp 4500, it meets the matching rules of the IPsec ESP message, and the traffic type of the data traffic packet is an IPsec ESP message, and its traffic type identifier is the first preset identifier. At this time, the ESP protocol identifier in the ESP header information in IPsec is obtained, and the network card queue identifier is obtained according to the ESP protocol identifier mapping, and action processing is performed according to the matched information. According to the action, counting and loading are performed to the network card queue corresponding to the network card queue identifier, and then the DPDK API rte_eth_rx_burst function is called to push the data traffic packet in the network card queue to the CPU core corresponding to the network card queue in the application layer.

[0127] After the data traffic of the SSL tunnel is encapsulated through vxlan, after the network card receives the data traffic packet, it matches the vxlan information and the message according to the rules issued by the control layer, that is, it determines whether the data traffic packet meets the matching rules of the IPsec ESP message or the matching rules of the SSL message. If the port type identifier of the data traffic packet is tcp / udp 1194, it is confirmed that it is the traffic of the SSL tunnel and meets the matching rules of the SSL message. The traffic type of the data traffic packet is SSL message, and its traffic type identifier is the second preset identifier. At this time, by obtaining the source IP, source port and protocol-related information of tcp / udp, the network card queue identifier is mapped, and then the data traffic packet is loaded to the network card queue corresponding to the network card queue identifier, so that the SSL traffic is processed in other queues of the network card, and then the DPDK API rte_eth_rx_burst function is called to push the data traffic packet in the network card queue to the CPU core corresponding to the network card queue in the application layer.

[0128] By operating each data traffic packet in this way, multiple data traffic packets can be pushed to multiple CPU cores.

[0129] In addition, if the traffic data packet does not meet the matching rules of the control plane, the data traffic transmission process is directly terminated.

[0130] Based on the above process, it can be seen that the present application applies the FDIR function provided by the smart network card to the VPN network element of the cloud network, realizing a high-performance network integrating software and hardware, and the performance of the previous network card only using the underlay five-tuple information RSS / RPS to load IPsec / SSL traffic to a specific core has been greatly improved. Compared with the existing technology, the main advantages are:

[0131] 1. The traffic forwarded by the cloud gateway VPN increases, and a single VPN physical network element can carry more network traffic, which increases the bandwidth supported by the resource pool VPN gateway and leads the performance.

[0132] 2. The network card hardware-level load queue does not require software-level load, releasing more CPU performance for business processing.

[0133] 3. Improve efficiency. This solution makes the VPN gateway fully multi-core, so that a single VPN gateway can support more users, unlike the previous solution where the number of users carried by the VPN gateway is small and the VPN gateway needs to be expanded when the number of users reaches the upper limit. That is, this application achieves a doubling of the number of users accessing a single VPN gateway.

[0134] Compared with the prior art, the most important creativity lies in:

[0135] This application fully considers the problem in the public cloud scenario that the VPN gateway previously performed single-core processing for a single tenant, resulting in excessive traffic for the same tenant and high load on the VPN gateway, resulting in packet loss for the tenant.

[0136] In addition, this application can also be applied to the following scenarios:

[0137] 1. DPDK all cloud network multi-layer tunnel scenarios using smart network cards.

[0138] 2. High-throughput, high-performance VPN forwarding field, especially network elements with high requirements for multi-core processing.

[0139] 3. Both the software and hardware integrated offload tunnel solutions can be implemented with reference to this application.

[0140] 4. The encryption and decryption of VPN tunnel data messages are transferred to the smart network card, and the DPU (Data Processing Unit) can be implemented with reference to this application.

[0141] 5. The cloud network VPN gateway is mainly designed based on the IPsec / SSL traffic on the control plane according to the source IP, source port and ESP information hash of the VPN traffic.

[0142] In an exemplary embodiment, starting from the control plane, the present application splits the IPsec rules and SSL rules into vxlan underlay and IPsec / SSL business message rules. The IPsec rules mainly focus on vxlan information, IPsec udp header and ESP header information, and the SSL rules mainly focus on vxlan information and SSL udp / TCP header information. All split rules are sent to the DPDK network card driver through the rte_flow_validate provided by rte_flow for data packets to pass through the network card for rte_flow rule query.

[0143] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0144] Based on the same inventive concept, the embodiment of the present application also provides a data flow transmission device for implementing the data flow transmission method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data flow transmission device embodiments provided below can refer to the limitations on the data flow transmission method above, and will not be repeated here.

[0145] In an exemplary embodiment, Figure 5 As shown, a data flow transmission device is provided, comprising: a flow analysis module 100, a first processing module 200, a second processing module 300 and a flow forwarding module 400, wherein:

[0146] The traffic analysis module 100 is used to obtain a data traffic packet and detect a traffic type identifier of the data traffic packet according to a transport layer protocol and a port type identifier of the data traffic packet;

[0147] The first processing module 200 is used to enter the processing callback logic according to the first preset identifier when the traffic type identifier is the first preset identifier, obtain the protocol identifier corresponding to the data traffic packet, and generate a network card queue identifier matching the protocol identifier according to the source address and the source port;

[0148] The second processing module 300 is used to obtain the source address and source port of the data traffic packet when the traffic type identifier is a second preset identifier, and detect the network card queue identifier that matches the source address and the source port;

[0149] The traffic forwarding module 400 is used to determine the network card queue corresponding to the network card queue identifier, and forward the data traffic packet to the processor corresponding to the network card queue.

[0150] In an exemplary embodiment, the traffic analysis module 100 is also used to detect the port type identifier of the data traffic packet when it is detected that the virtual extended LAN information in the data traffic packet matches the preset virtual extended LAN information, and detect the traffic type identifier of the data traffic packet based on the transport layer protocol and port type identifier of the data traffic packet.

[0151] In an exemplary embodiment, the traffic analysis module 100 is also used to generate an identifier matching rule based on the transport layer protocol of the data traffic packet; based on the identifier matching rule, detect the traffic type identifier that matches the port type identifier, wherein the identifier matching rule characterizes the mapping relationship between the port type identifier and the traffic type identifier; if the port type identifier is a first port identifier, then determine that the traffic type identifier of the data traffic packet is a first preset identifier; if the port type identifier is a second port identifier, then determine that the traffic type identifier of the data traffic packet is a second preset identifier.

[0152] In an exemplary embodiment, the traffic forwarding module 400 is further configured to forward the data traffic packet to the network card queue corresponding to the network card queue identifier, and forward the data traffic packet in the network card queue to the processor corresponding to the network card queue in the application layer.

[0153] In an exemplary embodiment, the traffic forwarding module 400 is further configured to call a preset transmission function to forward the data traffic packets in the network card queue to a processor corresponding to the network card queue in the application layer.

[0154] In an exemplary embodiment, the data traffic transmission device also includes a counting module, which is used to update the count number of data traffic packets in each network card queue when forwarding the data traffic packet to the network card queue corresponding to the network card queue identifier, and update the data traffic processing log based on the updated count number.

[0155] Each module in the above-mentioned data flow transmission device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0156] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as data flow packets. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data flow transmission method is implemented.

[0157] Those skilled in the art will understand that Figure 6 The structure shown in the figure is a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0158] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0159] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0160] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0161] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0162] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0163] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data flow transmission method, characterized in that: The method comprises: Acquire a data traffic packet, and detect a traffic type identifier of the data traffic packet according to a transport layer protocol and a port type identifier of the data traffic packet; In the case where the traffic type identifier is a first preset identifier, entering the processing callback logic according to the first preset identifier, obtaining the protocol identifier corresponding to the data traffic packet, and detecting the network card queue identifier matching the protocol identifier; When the traffic type identifier is the second preset identifier, obtaining a source address and a source port of the data traffic packet, and generating a network card queue identifier that matches the source address and the source port according to the source address and the source port; Determine the network card queue corresponding to the network card queue identifier, and forward the data traffic packet to the processor corresponding to the network card queue.

2. The method according to claim 1, characterized in that The detecting the traffic type identifier of the data traffic packet according to the transport layer protocol and the port type identifier of the data traffic packet comprises: When it is detected that the virtual extended local area network information in the data traffic packet matches the preset virtual extended local area network information, detecting the port type identifier of the data traffic packet; The traffic type identifier of the data traffic packet is detected according to the transport layer protocol of the data traffic packet and the port type identifier.

3. The method according to claim 2, characterized in that The detecting the traffic type identifier of the data traffic packet according to the transport layer protocol and the port type identifier of the data traffic packet comprises: Generate an identification matching rule according to the transport layer protocol of the data traffic packet; According to the identifier matching rule, detecting a traffic type identifier that matches the port type identifier, wherein the identifier matching rule represents a mapping relationship between the port type identifier and the traffic type identifier; If the port type identifier is the first port identifier, determining that the traffic type identifier of the data traffic packet is the first preset identifier; If the port type identifier is the second port identifier, it is determined that the traffic type identifier of the data traffic packet is the second preset identifier.

4. The method according to claim 1, characterized in that: The step of forwarding the data traffic packet to a processor corresponding to the network card queue includes: Forwarding the data traffic packet to the network card queue corresponding to the network card queue identifier; The data traffic packet in the network card queue is forwarded to the processor corresponding to the network card queue in the application layer.

5. The method according to claim 4, characterized in that The step of forwarding the data flow packet in the network card queue to a processor corresponding to the network card queue in the application layer includes: Call a preset transmission function to forward the data traffic packet in the network card queue to the processor corresponding to the network card queue in the application layer.

6. The method according to claim 4, characterized in that The method further comprises: When the data traffic packet is forwarded to the network card queue corresponding to the network card queue identifier, updating the count number of the data traffic packets in each of the network card queues; Based on the updated count quantity, the data traffic processing log is updated.

7. A data flow transmission device, characterized in that: The device comprises: A traffic analysis module, used to obtain a data traffic packet, and detect a traffic type identifier of the data traffic packet according to a transport layer protocol and a port type identifier of the data traffic packet; A first processing module, configured to, when the traffic type identifier is a first preset identifier, enter a processing callback logic according to the first preset identifier, obtain a protocol identifier corresponding to the data traffic packet, and detect a network card queue identifier matching the protocol identifier; a second processing module, configured to obtain a source address and a source port of the data traffic packet when the traffic type identifier is a second preset identifier, and generate a network card queue identifier that matches the source address and the source port according to the source address and the source port; The traffic forwarding module is used to determine the network card queue corresponding to the network card queue identifier and forward the data traffic packet to the processor corresponding to the network card queue.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images