A network interface redirection method and apparatus

Abstract

The present disclosure provides a network interface redirection method, comprising: determining a target communication link for sending a to-be-sent packet based on a redirection program deployed at a first network interface, the first network interface being a preset sending interface for the to-be-sent packet, the redirection program being a program loaded from a user mode into a kernel mode and independent of source code of the kernel mode; determining a second network interface according to the target communication link; and switching the sending interface of the to-be-sent packet from the first network interface to the second network interface.

Description

Technical Field

[0001] This disclosure relates to the field of data processing, and in particular to a method and apparatus for redirecting network interfaces. Background Technology

[0002] Data communication between different data processing systems or between different units within a system is typically conducted via message transmission. For example, in a vehicle-to-everything (V2X) system, numerous sensing devices are deployed on the roadside. These devices encapsulate the sensed data into messages and send them to an edge computing platform via a communication link. The edge computing platform then forwards the messages to the cloud platform in the management center for processing. Given the constantly changing network environment, it is crucial to ensure the high availability of communication links and the security of message transmission within those links. Summary of the Invention

[0003] In view of this, the present disclosure provides a network interface redirection method and apparatus.

[0004] One aspect of this disclosure provides a network interface redirection method, comprising: determining a target communication link for sending a message to be sent based on a redirection program deployed at a first network interface, wherein the first network interface is a preset sending interface for the message to be sent, and the redirection program is a program loaded from user mode into kernel mode and independent of the source code in kernel mode; determining a second network interface according to the target communication link; and switching the sending interface of the message to be sent from the first network interface to the second network interface.

[0005] According to an embodiment of this disclosure, determining the target communication link for sending a message to be sent based on a redirection program deployed at the first network interface includes: determining the target network address corresponding to the first network interface according to a routing policy stored in kernel mode; and determining the target communication link for sending the message to be sent based on the target network address and preset routing rules, wherein the preset routing rules are stored in user mode, based on the redirection program.

[0006] According to embodiments of this disclosure, determining the target communication link for sending a message to be sent based on a redirection program deployed at the first network interface includes: determining the first communication link corresponding to the first network interface according to a routing policy in the kernel mode; if the first communication link does not meet a preset routing rule, determining the target communication link for sending the message to be sent based on the target network address corresponding to the first communication link and the preset routing rule, according to the redirection program; and if the first communication link meets the preset routing rule, determining the first communication link as the target communication link for sending the message to be sent.

[0007] According to an embodiment of this disclosure, the target communication link for sending a message is determined based on the redirection procedure, according to the target network address and preset routing rules. This includes: based on the redirection procedure, querying the link state table for a communication link that conforms to the preset routing rules as the target communication link, according to the target network address and preset routing rules. The link state table is stored in the kernel state.

[0008] According to an embodiment of this disclosure, determining a second network interface based on a target communication link includes: querying a link information table corresponding to the target communication link based on a redirection procedure, wherein the link information table is stored in user space.

[0009] According to an embodiment of this disclosure, switching the sending interface of the message to be sent from a first network interface to a second network interface includes: based on a redirection procedure, modifying the communication parameters of the message to be sent according to the communication parameters of the second network interface and the communication parameters of the target communication link to obtain the modified message to be sent; and switching the sending interface of the modified message to be sent from the first network interface to the second network interface.

[0010] According to an embodiment of this disclosure, modifying the communication parameters of a message to be sent based on the communication parameters of the second network interface and the communication parameters of the target communication link to obtain a modified message to be sent includes: determining statistical information of the message to be sent based on the communication parameters of the second network interface and the communication parameters of the target communication link; and encapsulating the statistical information of the message to be sent in the header of the message to be sent to obtain the modified message to be sent.

[0011] A second aspect of this disclosure provides a network interface redirection apparatus, comprising: a determining unit, configured to determine a target communication link for sending a message to be sent based on a redirection program deployed at a first network interface, wherein the first network interface is a preset sending interface for the message to be sent, and the redirection program is a program loaded from user mode into kernel mode and independent of the source code in kernel mode; and a determining unit, configured to switch the sending interface of the message to be sent from the first network interface to the second network interface.

[0012] A third aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the network interface redirection method described above.

[0013] A fourth aspect of this disclosure also provides a computer program product, including a computer program stored on at least one of a readable storage medium and an electronic device, wherein the computer program, when executed by a processor, implements the network interface redirection method described above. Attached Figure Description

[0014] The above and other objects, features and advantages of this disclosure will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0015] Figure 1 This illustration schematically depicts an application scenario of a network interface redirection method and apparatus according to an embodiment of the present disclosure.

[0016] Figure 2 A flowchart illustrating a network interface redirection method according to an embodiment of the present disclosure is shown schematically.

[0017] Figure 3 This diagram illustrates the relationship between kernel mode and user mode in a network interface redirection method according to an embodiment of the present disclosure.

[0018] Figure 4 This schematic diagram illustrates a vehicle-to-everything (V2X) system with a network interface redirection method according to an embodiment of the present disclosure.

[0019] Figure 5 A flowchart illustrating a network interface redirection method according to an embodiment of the present disclosure is shown schematically.

[0020] Figure 6 A schematic diagram illustrating a network interface redirection device according to an embodiment of the present disclosure is shown; and

[0021] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a network interface redirection method according to an embodiment of the present disclosure. Detailed Implementation

[0022] The embodiments of this disclosure will now be described with reference to the accompanying drawings. Various details of the embodiments of this disclosure are included to aid understanding and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0023] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0024] Data communication between different data processing systems or between different units within a system is typically conducted via message transmission. For example, in a vehicle-to-everything (V2X) system, numerous sensing devices are deployed on the roadside. These devices encapsulate the sensed data into messages and send them to an edge computing platform via a communication link. The edge computing platform then forwards the messages to the cloud platform in the management center for processing. Given the constantly changing network environment, it is crucial to ensure the high availability of communication links and the security of message transmission within those links.

[0025] In related technologies, high availability of communication links is ensured by deploying physical devices with redundant links and failover mechanisms, guaranteeing timely switching and normal operation of communication links when the network environment changes. When the external environment of network devices and the hardware configuration changes, such as link failures, bandwidth changes, switch configuration updates, or network interface replacements, if the routing table is not updated in time, the communication link will not be able to switch to the backup link in time when encountering a failure, resulting in the communication link becoming unavailable. In this case, the communication link used for sending packets is dynamically adjusted by detecting the link status in user space and manually configuring the routing table to adapt to changes in the external physical device configuration. Alternatively, high availability components can be developed to enhance the link failure recovery capability.

[0026] However, these related technologies have the following problems:

[0027] (1) Due to the constant changes in the external environment of network devices and the way hardware devices are set up, it is not convenient to customize and expand physical devices;

[0028] (2) Different types of message transmission require different routing rules for communication links, and the routing rules need to be customized according to business needs. When the external environment of the network device and the hardware device settings change, the routing table needs to be manually modified. Setting routing rules and routing policies requires manual modification of the kernel source code, which is cumbersome and poses a security threat to the kernel source code, thus limiting the flexibility and scalability of routing policies and routing policies;

[0029] (3) Developing high-availability components requires modifying the kernel source code, which brings challenges to kernel system upgrades and maintenance, and increases the security risks of the kernel system.

[0030] To address the aforementioned problems, embodiments of this disclosure provide a network interface redirection method and apparatus.

[0031] Figure 1 The diagram illustrates an application scenario of a network interface redirection method according to an embodiment of the present disclosure.

[0032] like Figure 1As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0033] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication systems and client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0035] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0036] It should be noted that the network interface redirection method provided in this embodiment can generally be executed by server 105. Correspondingly, the message processing device provided in this embodiment can generally be located in server 105. The network interface redirection method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the message processing device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0037] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0038] The following will be based on Figure 1 The described scene, through Figures 2-5 A network interface redirection method according to a disclosed embodiment is described in detail.

[0039] Figure 2 A flowchart illustrating a network interface redirection method according to an embodiment of this disclosure is shown schematically. Figure 2 As shown, a network interface redirection method according to an embodiment of this disclosure includes operations S201 to S203, as detailed below:

[0040] Operation S201: Based on the redirection procedure deployed at the first network interface, determine the target communication link for sending the message to be sent.

[0041] The first network interface is the preset sending interface for the packet to be sent, determined by the routing policy stored in kernel mode. Examples include network interface cards configured in the system, Ethernet interfaces, wireless interfaces, or logical interfaces in a VPN (Virtual Private Network) tunnel. The routing policy stores packet sending rules to determine which network interface a packet should be sent through. If the routing policy in kernel mode needs to be updated, the kernel source code must be modified. Without modification of the kernel source code, the routing policy in the kernel will not be updated.

[0042] A redirector is a program loaded from user space into kernel space and operates independently of the kernel's source code. For example, a redirector written in user space might be loaded into kernel space using the eBPF (extended Berkeley Packet Filter) mechanism to intercept and modify network packets, as well as redirect packet sending interfaces. eBPF is a high-performance kernel technology that allows developers to run sandboxed user-defined code within the operating kernel without modifying kernel code or loading kernel modules. Redirectors implemented using eBPF can be dynamically loaded, updated, and unloaded in kernel space. In user space, eBPF applications can interact with redirectors in kernel space through functional interfaces. Redirectors execute in a sandboxed state within kernel space and do not modify the operating kernel source code.

[0043] Kernel mode is a privileged execution mode in an operating system, running the core code of the operating system, such as drivers and kernel modules. Kernel mode allows programs direct access to hardware and all system resources. Code running in kernel mode has the highest privileges, can execute any CPU instruction, and has unrestricted access to memory and I / O devices. Errors in kernel-mode programs can cause the entire system to crash, therefore requiring extremely careful handling.

[0044] User mode is a non-privileged execution mode in the operating system, where most applications run. Programs running in user mode cannot directly access hardware resources and must request services from the kernel through system calls. The crash of a user-mode program usually does not affect the stability of the overall system because the operating system restricts user-mode programs' access to resources.

[0045] For example, see Figure 3 . Figure 3 This is a schematic diagram illustrating the relationship between kernel mode and user mode in a network interface redirection method according to an embodiment of this disclosure. Figure 3 As shown, based on the eBPF mechanism, programs implementing intelligent routing and passive link status detection are written in user space. These programs are then loaded into kernel space via the user-space eBPF application. The intelligent routing and passive detection programs are part of the scheduler in the kernel space. The eBPF redirection program, i.e., the eBPF redirection program, can include the intelligent routing and passive detection programs, or it can be implemented based on these programs and other programs. eBPF provides the ability to insert user-defined programs at ingress and egress points. Ingress refers to the process of a packet entering a network device or network stack. In the Linux kernel, this typically refers to the moment a packet arrives at the network interface. During the ingress phase, a series of operations can be performed on the packet in kernel space, such as classification, marking, modification, or dropping. Egress refers to the process of a packet leaving a network device or network stack. In the Linux kernel, this typically refers to the moment a packet has passed all necessary network layer processing and is about to be sent to the network interface to leave the system. During the egress phase, the kernel can also perform operations on packets, such as flow shaping and flow control mechanisms, to manage the sending rate and priority of packets to be sent.

[0046] In kernel-mode programs, eBPF redirection programs can be inserted at ingress and egress points to redirect the network interface from which packets are to be sent. eBPF programs registered at TC (Traffic Control) hook points can intercept packets passing through the first network interface and redirect them according to preset rules. TC is a flow control framework in the Linux kernel that allows packets to be classified, marked, shaped, and scheduled at ingress and egress points. The TC's ingress queue and egress queue correspond to the points where packets enter and leave the network interface, respectively.

[0047] The eBPF mechanism allows user-space eBPF applications to interact and communicate with eBPF redirectors running in kernel space. This communication is primarily achieved through eBPF maps. eBPF maps are a key-value pair storage method that allows data to be shared between user space and kernel space. In user-space programs, in addition to the eBPF application, there are VPN management programs, Sell (command line) control programs, active probe programs, WireGuard (tunneling interface) programs, and communication protocol programs. The active probe program is used to detect the communication link status and update the communication link information.

[0048] The message to be sent stores data that needs to be transmitted outward through the first network interface. In vehicular networks and other systems requiring high availability and secure transmission, it is necessary to ensure that the message to be sent can be transmitted through the most suitable communication link, i.e., to determine the target communication link for the message to be sent. The redirection procedure is used to determine the target communication link for the message to be sent. The sending interface corresponding to the target communication link can be the first network interface or other interfaces.

[0049] Because the routing policy in kernel mode is not updated when the network environment changes or the hardware settings within the network environment change, the communication link corresponding to the first network interface may not be the optimal link for sending the packet. Therefore, when the packet arrives at the first network interface, if a redirection program is deployed at the first network interface, the most suitable communication link for sending the packet is determined based on the redirection program's analysis of the packet's header information, the current network status, and the quality of each communication link. For example, if the redirection program detects that a certain communication link has low bandwidth utilization and low latency, it will select that communication link as the target communication link.

[0050] Operation S202: Determine the second network interface based on the target communication link.

[0051] After identifying the target communication link, the second network interface corresponding to the target communication link can be found using the mapping table between network interfaces and communication links. For example, if the target communication link is a specific VPN tunnel, then the second network interface is the logical interface corresponding to that VPN tunnel. Because the routing policy in kernel mode is not updated when the network environment changes or the hardware settings in the network environment change, the second network interface may be different from or the same as the first network interface.

[0052] Operation S203: Switch the sending interface of the message to be sent from the first network interface to the second network interface.

[0053] Switching the sending interface of a packet from the first network interface to the second network interface can be achieved by modifying the corresponding routing or interface information in the packet, then encapsulating the packet and sending it through the second network interface. Alternatively, the routing policy on the network device can be updated to specify which interface the packet should be sent from based on specific attributes of the packet (such as source address, destination address, port number, etc.). The source MAC address of the packet can also be modified at the link layer, causing the switch to forward the packet to the second network interface based on the new MAC address. Furthermore, the first and second network interfaces can be bound together as a single logical interface, indirectly redirecting the sending interface of the packet to the second network interface.

[0054] For example, see Figure 4 . Figure 4 This is a schematic diagram of a vehicle-to-everything (V2X) system according to an embodiment of the present disclosure, illustrating a network interface redirection method. Figure 4 As shown, in the vehicle-to-everything (V2X) system, the roadside sensing devices and the edge computing platform are divided into two server groups, namely pod1 and pod2. The roadside sensing devices need to send the collected data to the edge computing platform. The system's default routing strategy uses Ethernet interface 1 as the first network interface to send packets to Ethernet interface 2. However, if the Ethernet link becomes congested or fails, when the packet arrives at the first network interface, a redirection procedure deployed at the first network interface will switch the sending interface of the packet from the Ethernet interface to the corresponding tunnel interface 1, that is, switch the sending interface of the packet from the first network interface to the second network interface. The packet is then sent to the tunnel interface 2 corresponding to the Ethernet interface 2 of the edge computing platform through tunnel interface 1.

[0055] VPN networks ensure data transmission security by establishing encrypted tunnels over public networks. When the network environment changes, VPNs provide virtual links across different physical networks, which can be dynamically adjusted based on business needs. For example... Figure 4As shown, in vehicle-to-everything (V2X) systems and other communication systems, an OverLay network can be established on top of the existing cloud-edge-base network (underLay), that is, on top of the existing physical network. This OverLay network is the logical network layer corresponding to the physical network layer. The OverLay network abstracts the network interfaces in the underlying physical network into logical network interfaces. Through the OverLay network, two-way communication across physical networks can be achieved. For example, in the OverLay network, encrypted tunnels can be established using VPNs, and each VPN tunnel has corresponding logical sending and receiving interfaces. Figure 4 As shown, the logical sending interface is tunnel interface 1, and the logical receiving interface is tunnel interface 2. The redirection program can determine which tunnel to switch the transmission link of the packet to based on the status and performance indicators of the tunnels corresponding to these logical interfaces. The relationship between overlay and underlay networks is not necessarily one-to-one. By configuring technologies such as VRF (Virtual Routing and Forwarding), multiple virtual networks can be created on the same physical network, each with its own routing policy and isolation space.

[0056] According to the network interface redirection method provided in the above embodiments, when the network environment changes or the hardware device settings in the network change, when the packet to be sent arrives at the first network interface, the sending interface of the packet to be sent can be dynamically adjusted based on the redirection program deployed at the first network interface to ensure that the packet to be sent is transmitted through the optimal path. This also adapts to changes in the network environment or the hardware device settings in the network. Since the redirection program is written and configured in user space, loaded from user space into kernel space, and is independent of the kernel source code, it can update the sending interface and communication link of the packet to be sent in a timely manner without modifying the kernel code. This facilitates the customization of routing rules according to business needs, while also ensuring program security and reducing system risks.

[0057] exist Figure 2 Based on the embodiments shown, in some embodiments, the target communication link for sending the message to be sent is determined based on the redirection program deployed at the first network interface, including: determining the target network address corresponding to the first network interface according to the routing policy stored in the kernel mode; and determining the target communication link for sending the message to be sent based on the target network address and preset routing rules according to the redirection program.

[0058] The preset routing rules are stored in user space. These rules, stored in user space, are customizable based on factors such as business requirements, message type, current network environment, link status, message priority, and link quality to select the target communication link for the message to be sent. The target network address is the network address where the message will ultimately arrive. The target network address can correspond to multiple network interfaces.

[0059] When determining the target network address corresponding to the first network interface, the routing policy stored in kernel space can be read, and the target network address can be determined according to the routing policy. For example, using eBPF technology, a redirection procedure can be registered at the fib_lookup hook point in the kernel. fib_lookup is a function call point in the routing system used to insert custom processing logic when looking up the routing table. This hook point is called during route lookup at the IP layer. In the routing table, the target network address to which the packet to be sent should be found based on the first network interface.

[0060] Based on the redirection procedure, the target communication link for sending the packet is determined according to the target network address and preset routing rules. For example, a redirection procedure under the eBPF mechanism is registered at the TC hook point. The redirection procedure is invoked when the packet to be sent is about to be sent from the network interface specified by the routing policy after the routing policy has been selected according to the IP layer; that is, the redirection procedure is invoked when the packet to be sent arrives at the first network interface.

[0061] The redirection procedure first checks the tagging or header information of the packet to be sent, determining whether a link switch is required based on this information. If a link switch is required, the redirection procedure looks up the target network address in the routing table using the index of the first network interface. Based on preset routing rules and the target network address, it selects the optimal communication link from the routing table to send the packet to the target network address. If a link switch is not required, the kernel continues with the standard packet sending process, sending the packet via the first network interface. The routing table stores the mapping between network interfaces and target network addresses, and can also store the mapping between target network addresses and communication links, as well as the status information of the communication links.

[0062] Based on Figure 2Based on the embodiments of this disclosure shown, in some embodiments, determining the target communication link for sending the message to be sent based on a redirection program deployed at the first network interface includes: determining the first communication link corresponding to the first network interface according to the routing policy in the kernel mode; if the first communication link does not meet the preset routing rules, determining the target communication link for sending the message to be sent based on the target network address corresponding to the first communication link and the preset routing rules, according to the redirection program; if the first communication link meets the preset routing rules, determining the first communication link as the target communication link for sending the message to be sent.

[0063] Based on the routing policy in kernel mode, the first communication link corresponding to the first network interface is determined. This can be done by querying the routing information table stored in kernel mode for the first communication link corresponding to the first network interface when the packet to be sent passes through the IP layer. The routing information table stores the mapping between network interfaces and communication links, and can also store the mapping between communication links and target network addresses. The first network interface is the default sending interface for the packet to be sent, and the first communication link is the system's default communication link used to send the packet.

[0064] If the system's default communication link meets the preset routing rules, the system's default communication link will be used as the target communication link for sending the message. If the system's default communication link does not meet the preset routing rules, other communication links that can be used to send the message and meet the preset routing rules will be queried in the routing information table based on the target network address corresponding to the system's default communication link and the preset routing rules, and these will be used as the target communication links.

[0065] For example, see Figure 5 . Figure 5 This is a flowchart of a network interface redirection method according to an embodiment of the present disclosure. Figure 5 As shown, a network interface redirection method includes the following operations:

[0066] Operation S501: Receive software interrupt messages or application process messages.

[0067] The message to be sent may include a message related to a soft interrupt context or a message related to an application process context.

[0068] Operation S502: Determine the first network interface according to the IP layer routing policy.

[0069] Operation S503: When a packet arrives at the first network interface, determine whether an eBPF procedure is registered at the first network interface. For example, register a redirection procedure under the eBPF mechanism at the TC hook point in kernel mode. The redirection procedure is invoked when the packet to be sent is about to be sent from the network interface specified by the routing policy after the routing policy of the IP layer has been selected, that is, when the packet to be sent arrives at the first network interface. If an eBPF procedure is registered at the first network interface, execute operations S504 to S507; if an eBPF procedure is not registered at the first network interface, execute operation S508.

[0070] Operation S504: Determine whether the message needs to be redirected based on its type. If yes, execute operations S505 to S507; otherwise, execute operation S508.

[0071] Operation S505: Determine the target communication link for sending the message based on the target network address corresponding to the first network interface and the routing rules.

[0072] Operation S506: Determine the second network interface based on the target communication link.

[0073] Operation S507: Switch the message sending interface from the first network interface to the second network interface.

[0074] Operation S508: Send the message from the first network interface.

[0075] For example, an application process attempts to send a message to a remote server. After IP layer routing, the first network interface for the message to be sent is determined to be eth0. When the message arrives at the first network interface, at the TC hook point, the redirection procedure is called. First, it checks the tagging information or header information of the message to determine whether a link switch is needed. If a link switch is needed, the redirection procedure looks up the first communication link corresponding to the eth0 interface in the routing table using the index of eth0. Then, it checks whether the first communication link meets the preset routing rules. If it does, the first communication link is directly used as the target communication link for sending the message. If it does not meet the rules, the redirection procedure selects the optimal communication link as the target communication link according to the preset routing rules.

[0076] Optionally, after the redirection program finds the first communication link corresponding to the first network interface, it can directly select an optimal communication link as the target communication link according to preset routing rules. Then, it determines whether the target communication link is consistent with the first communication link. If they are consistent, there is no need to switch the sending interface of the message to be sent. If they are inconsistent, it determines that the target communication link corresponds to a second network interface different from the first network interface, and switches the sending interface of the message to be sent from the first network interface to the second network interface.

[0077] According to the method provided in the above embodiments, determining whether the first communication link meets the preset routing rules can avoid unnecessary redirection operations. If the first communication link corresponding to the first network interface meets the preset routing rules, no redirection operation is required, which can reduce system overhead and improve packet forwarding efficiency.

[0078] Based on the above embodiments, in some embodiments, the target communication link for sending the message to be sent is determined according to the target network address and preset routing rules based on the redirection procedure, including: based on the redirection procedure, querying the link status table for a communication link that conforms to the preset routing rules as the target communication link according to the target network address and preset routing rules.

[0079] The link state table stores the status information of all communication links, such as link ID, connectivity status, packet loss rate, bandwidth, and latency. The link state table is stored in kernel mode and maintained and updated by kernel programs. It can also store the mapping between target network addresses and communication links.

[0080] For example, during link-state table initialization, the kernel space populates the link-state table based on routing configuration information. The kernel space periodically retrieves the status of each communication link; if an update event occurs, the updated link-state information is written to the link-state table via the RCU (Read-Copy Update) mechanism. User-space eBPF applications can read the link-state information in the link-state table and send it to the redirection procedure in the kernel space. When a packet to be sent arrives at the first network interface, the redirection procedure traverses the link-state table to find a set of all communication links matching the target network address. Then, according to preset routing rules, it queries the communication link set for the communication link that meets the preset routing rules as the target communication link. For example, the communication link with the lowest packet loss rate in the communication link set is selected as the target communication link. If the target communication link is different from the first communication link corresponding to the first network interface, the redirection procedure modifies the header information of the packet to be sent and redirects the packet to the new communication link. RCU is a synchronization mechanism in the Linux kernel that allows multiple read threads to concurrently read data without acquiring any locks, while allowing a write thread to modify a data structure without blocking the read thread.

[0081] exist Figure 2 Based on the embodiments of this disclosure shown, in some embodiments, determining the second network interface according to the target communication link includes: querying the link information table for the second network interface corresponding to the target communication link based on a redirection procedure.

[0082] The link information table stores basic information about communication links, such as the link ID, the network interface and target address corresponding to the link, the link type, and the link priority. The link information table is stored in user space and maintained and updated by the user space. Optionally, the link information table stores not only the physical interface information corresponding to the communication link but also the logical interface information corresponding to the VPN tunnel.

[0083] While the communication links within the cloud-edge-based network remain unchanged, when constructing a virtual network on this network to establish the relationship between logical and physical interfaces, user space can update the link information table with the updated logical interface information and the corresponding relationship between logical and physical interfaces. This link information update can be achieved without modifying the kernel code. User space can utilize the RCU mechanism to update the link information table. The redirection program in kernel space can read the link information table in user space and query the second network interface corresponding to the target communication link.

[0084] According to the method provided in the above embodiments, link information and link status are stored in separate tables. User space performs write operations on the link information table, while kernel space only performs read operations. Similarly, kernel space performs write operations on the link status table, while user space only performs read operations. This avoids contention between kernel and user space read / write operations, preventing errors in obtaining link information and link status. User space write operations on the link information table enable real-time updates of link information even when the communication link remains unchanged but the corresponding network interface and destination address change (e.g., when a virtual network is established on a physical network).

[0085] exist Figure 2 Based on the embodiments of this disclosure shown, in some embodiments, switching the sending interface of the message to be sent from the first network interface to the second network interface includes: modifying the communication parameters of the message to be sent according to the communication parameters of the second network interface and the communication parameters of the target communication link based on a redirection procedure to obtain the modified message to be sent; and switching the sending interface of the modified message to be sent from the first network interface to the second network interface.

[0086] The communication parameters of the second network interface may include the following parameters: MAC address: the media access control address of the network interface; IP address: the IP address configured for the interface; subnet mask: defines the address range of the network where the interface is located; gateway address: the default router address used by the interface to access external networks; other network configurations: such as maximum transmission unit (MTU), network interface index (ifindex), etc.

[0087] The communication parameters of the target communication link may include the following parameters: Destination MAC address: the MAC address of the next-hop device to which the packet is to be sent; Destination IP address: the IP address to which the packet will eventually arrive; Routing information: including the next-hop IP address, sending interface, etc.

[0088] The communication parameters of the message to be sent may include the following parameters: source MAC address: the MAC address of the sending device; source IP address: the IP address of the sending device; destination MAC address: the MAC address of the next-hop device to which the message is to be sent; destination IP address: the IP address to which the message will eventually arrive, etc.

[0089] Based on the redirection procedure, the communication parameters of the packet to be sent are modified according to the communication parameters of the second network interface and the target communication link, resulting in the modified packet. For example, the redirection procedure reads the communication parameters of the second network interface and the target communication link. Then, it modifies the communication parameters of the packet to be sent, such as updating the source MAC address to the MAC address of the second network interface, updating the source IP address to the IP address of the second network interface, and updating the destination MAC address to the destination MAC address of the target communication link. It should be noted that when modifying the communication parameters of the packet to be sent, the destination IP address must remain unchanged.

[0090] After modifying the communication parameters of the message to be sent, the kernel will switch the sending interface of the modified message from the first network interface to the second network interface according to the communication parameters of the message to be sent.

[0091] Based on the above embodiments, in some embodiments, the communication parameters of the message to be sent are modified according to the communication parameters of the second network interface and the communication parameters of the target communication link to obtain the modified message to be sent. This includes: determining the statistical information of the message to be sent according to the communication parameters of the second network interface and the communication parameters of the target communication link; and encapsulating the statistical information of the message to be sent in the header of the message to be sent to obtain the modified message to be sent.

[0092] Statistical information refers to statistical data collected during message transmission, such as packet loss rate and notification information. Statistical information can be determined based on the communication parameters of the second network interface and the target communication link. For example, if the second network interface is a tunnel interface for a VPN channel, the statistical information could include the VPN channel establishment time, the amount of messages transmitted, and the packet loss rate.

[0093] Statistics are encapsulated in the header of the packet to be sent. For example, for a packet encapsulated using WireGuard tunneling technology, the IP header of the packet is not processed by the network device inside the tunnel. Statistics can be encapsulated in the IP options section of the IP header. Specifically, since the Linux kernel does not handle options of type IPOPT_SEC in IP options, a custom IPOPT_SEC option can be defined to store statistics. The IPOPT_SEC option is used to indicate security requirements or other processing requirements for the packet. An IPOPT_SEC option can be added to the IP header of the packet to be sent, and the statistics can be encoded into the field of this option. After adding or modifying options in the IP header, the checksum of the IP header must be recalculated to ensure the integrity of the IP header.

[0094] Figure 6The diagram illustrates a structural block diagram of an apparatus according to an embodiment of the present disclosure.

[0095] like Figure 6 As shown, the apparatus 600 of this embodiment includes:

[0096] The determining unit 601 is used to determine the target communication link for sending the message to be sent based on the redirection program deployed at the first network interface. The first network interface is the preset sending interface for the message to be sent. The redirection program is a program loaded from user mode into kernel mode and runs independently of the source code in kernel mode. The second network interface is determined according to the target communication link.

[0097] The switching unit 602 switches the sending interface of the message to be sent from the first network interface to the second network interface.

[0098] In some embodiments, the determining unit 601 is further configured to determine the target network address corresponding to the first network interface according to the routing policy stored in the kernel mode; and based on the redirection procedure, determine the target communication link for sending the message to be sent according to the target network address and the preset routing rules, wherein the preset routing rules are stored in the user mode.

[0099] In some embodiments, the determining unit 601 is further configured to determine the first communication link corresponding to the first network interface according to the routing policy in the kernel mode; if the first communication link does not meet the preset routing rules, determine the target communication link for sending the message to be sent based on the redirection procedure, according to the target network address corresponding to the first communication link and the preset routing rules; if the first communication link meets the preset routing rules, determine the first communication link as the target communication link for sending the message to be sent.

[0100] In some embodiments, the determining unit 601 is further configured to, based on the redirection procedure, query the link state table for communication links that conform to the preset routing rules as target communication links according to the target network address and preset routing rules, and the link state table is stored in the kernel state.

[0101] In some embodiments, the determining unit 601 is further configured to query the link information table corresponding to the target communication link based on the redirection procedure, wherein the link information table is stored in user space.

[0102] In some embodiments, the switching unit 602 is further configured to modify the communication parameters of the message to be sent based on the redirection procedure, according to the communication parameters of the second network interface and the communication parameters of the target communication link, to obtain the modified message to be sent; and switch the sending interface of the modified message to be sent from the first network interface to the second network interface.

[0103] In some embodiments, the switching unit 602 is further configured to determine the statistical information of the message to be sent based on the communication parameters of the second network interface and the communication parameters of the target communication link; and encapsulate the statistical information of the message to be sent in the header of the message to be sent to obtain the modified message to be sent.

[0104] Figure 7 A schematic block diagram of an electronic device that can be used to implement the methods of embodiments of the present disclosure is shown.

[0105] like Figure 7 As shown, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 707 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0106] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 performs various operations of the method flow according to embodiments of this disclosure by executing programs in ROM 702 and / or RAM 703. It should be noted that the programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also implement the methods provided in embodiments of this disclosure by executing programs stored in said one or more memories.

[0107] According to embodiments of this disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0108] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0109] According to embodiments of this disclosure, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0110] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0111] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0112] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0113] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0114] It should be noted that the collection, storage, use, processing, transmission, provision, disclosure, and application of user personal information in this disclosed technical solution comply with relevant laws and regulations, necessary confidentiality measures have been taken, and it does not violate public order and good morals. In this disclosed technical solution, user authorization or consent has been obtained before acquiring or collecting user personal information.

[0115] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0116] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0117] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0118] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A network interface redirection method, comprising: Based on the redirection program deployed at the first network interface, the target communication link for sending the message to be sent is determined. The first network interface is the preset sending interface for the message to be sent. The redirection program is a program loaded from user mode into kernel mode and is independent of the source code of the kernel mode. Determine the second network interface based on the target communication link; Switch the sending interface of the message to be sent from the first network interface to the second network interface; The redirection procedure deployed at the first network interface determines the target communication link for sending the message to be sent, including: Based on the routing policy stored in the kernel mode, determine the target network address corresponding to the first network interface; Based on the redirection procedure, the target communication link for sending the message to be sent is determined according to the target network address and the preset routing rules, and the preset routing rules are stored in the user space.

2. The method according to claim 1, wherein determining the target communication link for sending the message to be sent based on the redirection procedure deployed at the first network interface includes: The first communication link corresponding to the first network interface is determined according to the routing policy in the kernel mode; If the first communication link does not meet the preset routing rules, the target communication link for sending the message to be sent is determined based on the redirection procedure, according to the target network address corresponding to the first communication link and the preset routing rules. If the first communication link satisfies the preset routing rules, the first communication link is determined as the target communication link for sending the message to be sent.

3. The method according to claim 1, wherein determining the target communication link for sending the message to be sent based on the redirection procedure, according to the target network address and preset routing rules, comprises: Based on the redirection procedure, according to the target network address and the preset routing rules, a communication link that conforms to the preset routing rules is queried in the link state table as the target communication link, and the link state table is stored in the kernel state.

4. The method according to claim 1, wherein determining the second network interface based on the target communication link comprises: Based on the redirection procedure, the second network interface corresponding to the target communication link is queried in the link information table, which is stored in user space.

5. The method according to claim 1, wherein switching the sending interface of the message to be sent from the first network interface to the second network interface includes: Based on the redirection procedure, the communication parameters of the message to be sent are modified according to the communication parameters of the second network interface and the communication parameters of the target communication link to obtain the modified message to be sent. The sending interface of the modified message to be sent is switched from the first network interface to the second network interface.

6. The method according to claim 5, wherein modifying the communication parameters of the message to be sent based on the communication parameters of the second network interface and the communication parameters of the target communication link to obtain the modified message to be sent includes: Based on the communication parameters of the second network interface and the communication parameters of the target communication link, determine the statistical information of the message to be sent; The statistical information of the message to be sent is encapsulated in the header of the message to be sent to obtain the modified message to be sent.

7. A network interface redirection device, comprising: A determining unit is configured to determine a target communication link for sending a message to be sent based on a redirection program deployed at a first network interface, wherein the first network interface is a preset sending interface for the message to be sent, and the redirection program is a program loaded from user mode into kernel mode and independent of the source code of the kernel mode; and determine a second network interface based on the target communication link. A switching unit is used to switch the sending interface of the message to be sent from the first network interface to the second network interface; The determining unit is further configured to: Based on the routing policy stored in the kernel mode, determine the target network address corresponding to the first network interface; Based on the redirection procedure, the target communication link for sending the message to be sent is determined according to the target network address and the preset routing rules, and the preset routing rules are stored in the user space.

8. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 6.

9. A computer program product comprising a computer program stored on at least one of a readable storage medium and an electronic device, the computer program implementing the method according to any one of claims 1 to 6 when executed by a processor.

Images