Data message processing method and device, equipment and medium
By using a dual hash table structure in the user-space protocol stack for data packet processing, the latency and performance issues of the user-space protocol stack under high-throughput network traffic are solved, achieving efficient and flexible packet filtering and stable network performance.
Patent Information
- Application Number
- CN202511561263.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-29
- Publication Date
- 2026-01-13
AI Technical Summary
In network communication, the packet filtering method of the user-space protocol stack leads to processing latency and performance degradation when handling high-throughput network traffic, especially in large-scale data transmission and high-speed network environments where it is difficult to meet the requirements of real-time performance and efficiency.
It adopts a dual hash table structure, including an available hash table and a backup hash table. Data packets are processed through a user-space protocol stack, and the hash table is used for efficient filtering and detection, reducing the overhead of frequent write operations and enabling batch updates and flexible filtering.
It improves the efficiency of bag filtration, enhances filtration flexibility, reduces system overhead, and achieves stable performance and dynamic adaptability under high load conditions.
Smart Images
Figure CN121333718A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of communication technology, and in particular to a method, apparatus, device and medium for processing data packets. Background Technology
[0002] Currently, network protocol stacks in network communication are mostly implemented in kernel space. While this implementation is stable and reliable, it often leads to performance bottlenecks when processing network data packets. To address these issues, user-space protocol stacks have emerged, allowing network protocols to run in user space, thereby reducing the overhead of context switching and system calls and improving the efficiency of network data processing.
[0003] Packet filtering is a key function in user-space protocol stack applications; it is used to implement network security policies by detecting and controlling the inflow and outflow of data packets to protect the network from potential security threats.
[0004] In related technologies, packet filtering employs methods such as rule-based packet filtering and deep packet inspection. However, this approach requires inspecting each packet individually, which significantly increases processing latency when handling high-throughput network traffic, leading to a decline in network performance. In particular, when facing large-scale data transmission and high-speed network environments, this packet-by-packet inspection-based filtering method struggles to meet the demands for real-time performance and efficiency. Summary of the Invention
[0005] In view of the above problems, a method, apparatus, device, and medium for data message processing are proposed to overcome or at least partially solve the above problems, including: A method for processing data packets, the method comprising: Create a dual hash table; wherein the dual hash table includes an available hash table and a spare hash table; In response to the IP addition operation, the first IP address is added to the backup hash table, and according to the update operation, the IP address in the backup hash table is updated to the available hash table; The system acquires the data packet input to the user-space protocol stack and parses the data packet using the main entry processing function in the user-space protocol stack to obtain the second IP address. Based on the available hash table, the second IP address is filtered and detected, and the data packet is processed according to the result of the filtering and detection.
[0006] Optionally, based on the available hash table, filtering and detection are performed on the second IP address, including: In the available hash table, query the second IP address; When the second IP address is found in the available hash table, the data packet is determined to be a packet that needs to be filtered; when the second IP address is not found in the available hash table, the data packet is determined to be a packet that does not need to be filtered.
[0007] Optionally, the data packet is processed based on the results of the filtering detection, including: When the filtering detection result indicates that the data packet is a packet that needs to be filtered, the data packet is discarded; when the filtering detection result indicates that the data packet is a packet that does not need to be filtered, the data packet is allowed to pass.
[0008] Optionally, querying the second IP address in the available hash table includes: Determine the hash value corresponding to the second IP address, and query the second IP address in the available hash table based on the hash value corresponding to the second IP address.
[0009] Optionally, before updating the IP addresses in the backup hash table to the available hash table according to the update operation, the method further includes: In response to the IP deletion operation, the third IP address is queried in the backup hash table, and then deleted from the backup hash table.
[0010] Optionally, it also includes: In response to a lookup operation, the contents of the double hash table are presented.
[0011] Optionally, the second IP address is the source address of the data packet.
[0012] An apparatus for processing data packets, the apparatus comprising: A dual hash table creation module is used to create dual hash tables; wherein, the dual hash table includes an available hash table and a backup hash table; An IP operation response module is added to respond to an IP addition operation by adding a first IP address to the backup hash table and updating the IP address in the backup hash table to the available hash table according to an update operation. The data packet parsing module is used to obtain the data packets input to the user-space protocol stack, and parse the data packets through the main entry processing function in the user-space protocol stack to obtain the second IP address; The filtering mechanism processing module is used to perform filtering detection on the second IP address based on the available hash table, and process the data packet according to the filtering detection result.
[0013] An electronic device includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method described above.
[0014] A computer-readable storage medium on which a computer program is stored, which, when executed by a processor, implements the method described above.
[0015] The embodiments of the present invention have the following advantages: In some embodiments of the present invention, a dual hash table is created; wherein the dual hash table includes an available hash table and a backup hash table; in response to an IP addition operation, a first IP address is added to the backup hash table, and according to an update operation, the IP address in the backup hash table is updated to the available hash table; a data packet input to the user-space protocol stack is obtained, and the data packet is parsed through the general entry processing function in the user-space protocol stack to obtain a second IP address; based on the available hash table, the second IP address is filtered and detected, and the data packet is processed according to the filtering and detection results. This achieves batch updating and efficient filtering and detection of IP addresses by creating a dual hash table, reducing the overhead of frequent write operations, improving the efficiency and accuracy of data packet processing, and enhancing the dynamic adaptability of the system in high-concurrency scenarios. Attached Figure Description
[0016] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0017] Figure 1 This is a flowchart of the steps of a data packet processing method provided in some embodiments of the present invention; Figure 2 This is a diagram of a dual hash table architecture provided in some embodiments of the present invention; Figure 3 This is a flowchart of the steps of a second method for processing data packets provided in some embodiments of the present invention; Figure 4 This is a flowchart of the steps of a third method for data packet processing provided in some embodiments of the present invention; Figure 5 This is a structural block diagram of a data packet processing apparatus provided in some embodiments of the present invention. Detailed Implementation
[0018] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.
[0019] In related technologies, packet filtering methods employ rule-based packet filtering and deep packet inspection, which require checking each packet individually. This can significantly increase processing latency when handling high-throughput network traffic.
[0020] Packet filtering refers to the process of filtering data packets entering a network system according to preset rules. Through packet filtering, the system can allow data packets that conform to the rules to pass through, while blocking data packets that do not conform to the rules, thereby achieving the goals of protecting network security and optimizing network traffic.
[0021] Deep packet inspection refers to the process of performing in-depth analysis and inspection of the content of data packets. Through deep packet inspection, the type of data packets, application layer protocols, and potential security threats can be identified more accurately, thereby providing more granular network control and security protection.
[0022] Based on this, in order to achieve efficient packet filtering in the user-space protocol stack, this invention proposes a data packet processing method. By utilizing efficient data structures (such as hash tables and Bloom filters) and parallel processing techniques, the method improves packet filtering performance, reduces computational overhead, and enhances the performance and flexibility of data packet processing through flexible filtering strategies, while maintaining the accuracy and effectiveness of network security strategies.
[0023] The embodiments of the present invention have the following advantages: 1. Improve packet filtering efficiency: By optimizing data structures and algorithm design, the processing time for each data packet is reduced, thereby significantly improving the overall packet filtering speed of the system. This will help the user-space protocol stack maintain stable performance under high load.
[0024] 2. Enhanced Filtering Flexibility: Supports more complex and dynamic filtering rules, configuration and lookup of precise and fuzzy IPs, allowing users to flexibly adjust filtering policies based on real-time network traffic and security requirements. This flexibility enables network administrators to more precisely control network traffic and adapt to different security needs and business scenarios.
[0025] 3. Reduce system overhead: By reducing context switching and system calls, memory usage is optimized, and the consumption of system resources during packet filtering is reduced. This will help improve the overall efficiency of the user-space protocol stack and reduce dependence on underlying hardware.
[0026] 4. Achieve Scalability: Provides a scalable packet filtering framework that supports future feature expansion and performance optimization. This ensures the method remains efficient in constantly changing network environments, adapting to emerging network technologies and security challenges.
[0027] Reference Figure 1 The diagram illustrates a flowchart of a data packet processing method provided by some embodiments of the present invention, which is applied to a packet filtering system.
[0028] As some examples, a packet filtering system can perform the following functions: 1. Create and configure a dual hash table, including an available hash table and a backup hash table. Configure the function to input precise or fuzzy IP addresses into the dual hash table, which will be used as the basis for the filtering function to find a match. The available hash table is used to store the user-configured filtering IPs, which is the basis for the processing function to query and match IPs. As long as the IP address exists, the packet will be filtered.
[0029] 2. Implement configuration functions, etc., to operate the dual hash table through configuration, and define various command codes to operate the dual hash table; for example, add an exact IP address to the standby table (standby hash table), delete an ambiguous IP address from the standby table (standby hash table), and query an exact IP address in the active table (available hash table).
[0030] 3. In the user-space protocol stack, the incoming data packets are parsed through the main entry processing function to obtain the source IP address, and a match is performed in the active table to determine whether the data packet should be allowed or dropped.
[0031] 4. Provide users with configuration tools to configure the active and standby tables in the dual hash tables, allowing users to configure IP addresses to the standby table in the hash tables.
[0032] 5. The filtering function matches the source IP address in the passed data packets with the IPs in the active table, performing source IP filtering on each data packet.
[0033] 6. Configure various operations for the dual hash table, such as adding and deleting for the standby table; querying for the active table; and updating, rebuilding, and viewing operations for the dual hash table.
[0034] As examples, the packet filtering system includes configuration, query, deletion, update, and filtering operations, all of which support both exact IP address matching and fuzzy IP address matching.
[0035] The configuration operation refers to manipulating the double hash table that stores IP addresses; the add operation is to send the IP addresses to be filtered to the standby table of the hash table through the configuration tool; and the delete operation is to remove the IP addresses from the standby table of the double hash table.
[0036] The query operation checks if the target IP address exists in the active table of the double hash table; the update operation updates the IP address in the standby table of the double hash table to the active table. After the update is complete, the IP addresses in the active table and the standby table are exactly the same; the view operation allows users to view the double hash table file, making it convenient for users to view the configured IP information.
[0037] Specifically, this may include the following steps: Step 101: Create a dual hash table; wherein the dual hash table includes an available hash table and a backup hash table.
[0038] In practical applications, such as Figure 2 It can create a dual hash table architecture, which improves system efficiency by separating dynamic update and stable query functions.
[0039] As some examples, a dual hash table data format architecture can be represented by the following code: / * hash table struct * / typedef struct hash_list { void _ptr_t *hash_list; unint32_t (*fn)(unint32_t cnt, unint32_t start); / * hash function * / unint32_t bucket_num; / * hash table bucket number * / unint32_t hash_node; exact_ip_struct_t exact_ip_list; fuzzy_ip_struct_t fuzzy_ip_list; } hash_list_t; / * include master and mirror hash table * / typedef struct two_hash_table { hash_list_t*active_table; hash_list_t*standby_table; rwlock_t active_lock; rwlock_t standby_lock; } two_hash_table_t; As examples, the available hash table (i.e., the active table) can be used to handle real-time query tasks, storing the set of currently active IP addresses. The standby hash table can be used as a data buffer layer, receiving temporary storage for newly added IP addresses and synchronizing with the available table through a batch update mechanism.
[0040] When a new IP address needs to be added, the system can first write it to the backup table to avoid interfering with query performance; when the number of new IP addresses accumulates to a preset threshold or a manual update is triggered, the contents of the backup table are merged into the available table to achieve lock-free data updates.
[0041] Step 102: In response to the add IP operation, the first IP address is added to the backup hash table, and the IP address in the backup hash table is updated to the available hash table according to the update operation.
[0042] In practical applications, adding an IP address refers to adding the IP address issued by the resolution configuration tool to the hash table according to the command code.
[0043] As examples, the first IP address refers to the IP address that needs to be added to the hash table. This IP address can be the address of a newly connected device or a specific address that needs to be filtered according to network policies.
[0044] During data packet processing, the first IP address, as the processing target, can be preferentially written into the backup hash table to ensure the continuity and efficiency of real-time query tasks. Subsequently, according to a preset update mechanism, this IP address will be synchronized from the backup hash table to the available hash table to complete the filtering or forwarding of data packets.
[0045] In practical applications, users can input IP addresses through configuration tools. After receiving the data, the user-space protocol stack can perform the IP address addition operation, determine the operation type based on the command code, and parse the IP address to complete the process of adding the IP address. Among them, the IP address addition operation supports inputting precise IP addresses and fuzzy IP addresses, and configures the active table (available hash table) and standby table (backup hash table) in the dual hash table.
[0046] The user-space protocol stack is responsible for receiving and initially processing data during the data processing process. It can also execute corresponding operations according to preset rules and command codes, such as the IP address addition operation mentioned above. Through the user-space protocol stack, the system can flexibly manage the addition, deletion, and updating of IP addresses, ensuring data consistency and system stability.
[0047] In practical applications, users configure IP addresses into the standby table of the hash table using configuration tools. At this time, the IP addresses are not yet effective. An update operation needs to be performed to update the standby table into the active table before the configured IP addresses take effect. The reason for not directly configuring IP addresses into the active table is to avoid data inconsistencies or conflicts between queries, additions, and deletions.
[0048] In the above embodiments, the user-space protocol stack can reduce context switching between the kernel and user space, thereby reducing processing latency; and the user-space protocol stack allows developers to implement customized filtering rules and processing logic in user space, making it more flexible and controllable; secondly, the user-space protocol stack can also utilize multi-threaded or asynchronous processing mechanisms to better support high-concurrency packet processing.
[0049] In some embodiments of the present invention, before updating the IP address in the backup hash table to the available hash table according to the update operation, the method further includes: in response to the delete IP operation, querying the backup hash table for a third IP address and deleting the third IP address in the backup hash table.
[0050] In practical applications, deleting an IP address refers to removing the IP address from the hash table based on the command code issued by the IP address resolution configuration tool.
[0051] As examples, a third IP address refers to an IP address that needs to be removed from the hash table. This IP address could be the address of a newly connected device or a specific address that needs to be filtered according to network policies.
[0052] In practical applications, users can flexibly manipulate the hash table according to their actual needs. When certain devices no longer need to access the network or when specific devices need to be filtered due to network policy adjustments, users can perform the IP deletion operation. By entering the IP address through the configuration tool, the user-space protocol stack can perform the IP deletion operation after receiving the data. The operation type is determined according to the command code, and the IP address is parsed to complete the process of deleting the IP address.
[0053] As examples, IP deletion operations can be divided into two types: one is total deletion (used during initialization), which involves traversing both hash tables and clearing all data. The other is selective and precise deletion, and the methods for selective deletion are listed below: Deletion is similar to addition, both operations are performed in the standby table; it also supports deletion by inputting precise IP and fuzzy IP; when receiving the IP address data configured by the user, the command code distinguishes the type and number of IP addresses to be deleted. For precise IP addresses, after calculating the hash value, the search and deletion are performed in the standby table; for fuzzy IP addresses, the search and deletion are performed by traversing the linked list.
[0054] In the above embodiments, when adding or querying an IP address, the system can calculate the hash value of the IP address and use this value to determine its storage location in the hash table (i.e., the index of the bucket). The bucket stores the complete IP address string or binary form, rather than the hash value itself.
[0055] Step 103: Obtain the data packet input to the user-space protocol stack, and parse the data packet through the main entry processing function in the user-space protocol stack to obtain the second IP address.
[0056] In practical applications, the user-space protocol stack can uniformly send and receive data packets, placing them into the sending queue and receiving queue, while the packet filtering system processes the data packets according to filtering rules.
[0057] The packet filtering system can read data packets to be processed from the receive queue of the user-space protocol stack. These data packets can be raw data packets received through the network interface, or data that needs further processing and is passed down from other upper-layer applications. The reading process is carried out according to the interface specifications and data formats preset by the protocol stack to ensure that key information in the data packets, such as source IP address, destination IP address, protocol type, and port number, can be correctly identified and extracted, providing an accurate data foundation for subsequent data packet parsing and processing.
[0058] The main ingress processing function serves as the unified entry point for the user-space protocol stack. It processes data packets, performing initial parsing and classification of all data packets entering the user-space protocol stack. When a data packet arrives at the user-space protocol stack, the main ingress processing function is the first to receive and parse it.
[0059] In some embodiments of the present invention, the second IP address is the source address of the data packet.
[0060] In practical applications, the source address of a data packet refers to the IP address of the device that initiated the transmission of the data packet. This IP address identifies the source of the data, allowing the receiver to know which device sent the data from.
[0061] As examples, the second IP address can be either the destination IP address or the source IP address in the data packet, depending on the direction of message transmission and resolution requirements.
[0062] For example, the input data is the dpdk (Data Plane Development Kit) entering the receive queue of the user-space protocol stack (i.e., the data packet input to the user-space protocol stack). The network card receives external network data packets. The main information contained in the network data packets includes the source IP address and the destination IP address. By parsing out the source IP address, the IP address in its list is matched and searched. Based on the search result, the corresponding operation is executed.
[0063] DPDK is a set of libraries and drivers designed to enable fast packet processing in user space.
[0064] Step 104: Based on the available hash table, perform filtering and detection on the second IP address, and process the data packet according to the filtering and detection results.
[0065] After parsing the data packet and obtaining the second IP address, the filtering tools (such as filtering functions) in the packet filtering system can use the second IP address as the key to perform filtering checks in a pre-built available hash table and determine the result of the filtering check, such as successful matching / failed matching.
[0066] In practical applications, data packets can be processed based on the matching results, such as allowing the data packet to pass, modifying the data packet, or recording relevant information of the data packet. If the matching fails, it means that there is no corresponding rule for the second IP address of the data packet in the available hash table. The data packet can be processed according to the system's default settings, such as discarding the data packet or forwarding it to other specific processing modules.
[0067] In the above embodiments, the filtering tool can process a large number of data packets without being limited by kernel space processing, thereby improving overall throughput.
[0068] In some embodiments of the present invention, filtering and detection of the second IP address based on the available hash table includes: Sub-step 11: Query the second IP address in the available hash table.
[0069] As examples, queries can use hash algorithms to quickly determine whether a second IP address exists in the table. If a corresponding entry is found, it means that the second IP address has a matching rule, and the associated processing instructions can be obtained. If no corresponding entry is found, i.e., the match fails, the established default processing logic is followed, such as discarding the data packet or forwarding it to a specific exception handling module for subsequent analysis and processing.
[0070] In some embodiments of the present invention, querying the second IP address in the available hash table includes: determining the hash value corresponding to the second IP address, and querying the second IP address in the available hash table based on the hash value corresponding to the second IP address.
[0071] In practical applications, hashing is a data processing technique that uses a hash function to convert an IP address into a unique hash value, and then uses that value to query a pre-built hash table.
[0072] As examples, deterministic hashing algorithms (such as FNV-1a and CityHash) can be used to convert a second IP address into a fixed-length hash value, ensuring that the same IP always maps to the same value; the calculated hash value can be used as an index to directly access the corresponding bucket in the available hash table, avoiding a full table scan; and the query results (existence / non-existence) and related data (such as permission flags and expiration time) can be returned.
[0073] Sub-step 12: When the second IP address is found in the available hash table, the data packet is determined to be a packet that needs to be filtered; when the second IP address is not found in the available hash table, the data packet is determined to be a packet that does not need to be filtered.
[0074] In practical applications, "needing to filter" and "not needing to filter" refer to classifying and processing data packets according to preset filtering rules. Packets that need to be filtered are those whose second IP address has a corresponding record in the available hash table. These packets may involve unauthorized access, malicious attacks, or communication behaviors that do not comply with security policies. Packets that do not need to be filtered are those whose second IP address does not have a corresponding record in the available hash table. These packets can be considered legitimate or communication requests that comply with the current security policy.
[0075] In some embodiments of the present invention, the data packet is processed according to the result of the filtering detection, including: when the result of the filtering detection indicates that the data packet is a packet that needs to be filtered, the data packet is discarded; and when the result of the filtering detection indicates that the data packet is a packet that does not need to be filtered, the data packet is allowed to pass.
[0076] In practical applications, such as Figure 3 If the second IP address exists in the available hash table (i.e., the result of the filtering test indicates that the data packet is a packet that needs to be filtered), then the NF_DROP operation (drop operation) is performed on the data packet; only when the second IP address does not exist in the available hash table (i.e., the result of the filtering test indicates that the data packet is a packet that does not need to be filtered) can the data packet be allowed to pass.
[0077] In some embodiments of the present invention, the method further includes: presenting the contents of the double hash table in response to a lookup operation.
[0078] As examples, users can initiate query requests to a dual hash table. The system can locate the dual hash table, extract its storage structure information (such as the number of buckets and load factor), convert key-value pair data, hash collision status, and table status statistics (such as fill rate and longest chain length) into structured output (such as JSON and console tables), and then display the dual hash table content through a terminal, web interface, or log file to assist developers in debugging or operations personnel in monitoring.
[0079] In some embodiments of the present invention, a dual hash table is created; wherein the dual hash table includes an available hash table and a backup hash table; in response to an IP addition operation, a first IP address is added to the backup hash table, and according to an update operation, the IP address in the backup hash table is updated to the available hash table; a data packet input to the user-space protocol stack is obtained, and the data packet is parsed through the general entry processing function in the user-space protocol stack to obtain a second IP address; based on the available hash table, the second IP address is filtered and detected, and the data packet is processed according to the filtering and detection results. This achieves batch updating and efficient filtering and detection of IP addresses by creating a dual hash table, reducing the overhead of frequent write operations, improving the efficiency and accuracy of data packet processing, and enhancing the dynamic adaptability of the system in high-concurrency scenarios.
[0080] Reference Figure 4 The diagram illustrates a flowchart of another data packet processing method provided by some embodiments of the present invention, which may specifically include the following steps: Step 401: Create a dual hash table; wherein the dual hash table includes an available hash table and a backup hash table.
[0081] Step 402: In response to the IP addition operation, the first IP address is added to the backup hash table.
[0082] Step 403: In response to the IP deletion operation, query the backup hash table for the third IP address and delete the third IP address from the backup hash table.
[0083] Step 404: According to the update operation, update the IP addresses in the backup hash table to the available hash table.
[0084] Step 405: Obtain the data packet input to the user-space protocol stack, and parse the data packet through the main entry processing function in the user-space protocol stack to obtain the second IP address.
[0085] Step 406: Based on the available hash table, filter and detect the second IP address, and process the data packet according to the result of the filter and detection.
[0086] In some embodiments of the present invention, a dual hash table is created; wherein the dual hash table includes an available hash table and a backup hash table; in response to an IP addition operation, a first IP address is added to the backup hash table, and according to an update operation, the IP address in the backup hash table is updated to the available hash table; a data packet input to the user-space protocol stack is obtained, and the data packet is parsed through the general entry processing function in the user-space protocol stack to obtain a second IP address; based on the available hash table, the second IP address is filtered and detected, and the data packet is processed according to the filtering and detection results. This achieves batch updating and efficient filtering and detection of IP addresses by creating a dual hash table, reducing the overhead of frequent write operations, improving the efficiency and accuracy of data packet processing, and enhancing the dynamic adaptability of the system in high-concurrency scenarios.
[0087] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.
[0088] Reference Figure 5 The diagram illustrates a structural schematic of a data packet processing apparatus according to some embodiments of the present invention, which may specifically include the following modules: A dual hash table creation module 501 is used to create a dual hash table; wherein, the dual hash table includes an available hash table and a backup hash table; An IP addition operation response module 502 is used to add a first IP address to the backup hash table in response to an IP addition operation, and update the IP address in the backup hash table to the available hash table according to an update operation. The data packet parsing module 503 is used to obtain the data packet input to the user-space protocol stack, and parse the data packet through the general entry processing function in the user-space protocol stack to obtain the second IP address; The filtering mechanism processing module 504 is used to perform filtering detection on the second IP address based on the available hash table, and process the data packet according to the filtering detection result.
[0089] In some embodiments of the present invention, the filtering mechanism processing module 504 includes: The second IP address query submodule is used to query the second IP address in the available hash table; The packet filtering judgment submodule is used to determine that the data packet is a packet that needs to be filtered when the second IP address is found in the available hash table, and to determine that the data packet is a packet that does not need to be filtered when the second IP address is not found in the available hash table.
[0090] In some embodiments of the present invention, the filtering mechanism processing module 504 includes: The message processing submodule is used to discard the data message when the result of the filtering detection indicates that the data message is a message that needs to be filtered, and to allow the data message when the result of the filtering detection indicates that the data message is a message that does not need to be filtered.
[0091] In some embodiments of the present invention, the second IP address query submodule includes: The hash value lookup and determination unit is used to determine the hash value corresponding to the second IP address, and to query the second IP address in the available hash table based on the hash value corresponding to the second IP address.
[0092] In some embodiments of the present invention, the apparatus further includes: The third IP address deletion module is used to query the backup hash table for a third IP address in response to an IP deletion operation, and delete the third IP address from the backup hash table.
[0093] In some embodiments of the present invention, the apparatus further includes: The hash table response module is used to present the contents of the double hash table in response to a lookup operation.
[0094] In some embodiments of the present invention, the second IP address is the source address of the data packet.
[0095] Some embodiments of the present invention also provide an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method described above.
[0096] Some embodiments of the present invention also provide a computer-readable storage medium on which a computer program is stored, and which, when executed by a processor, implements the method described above.
[0097] Some embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the method described above.
[0098] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.
[0099] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.
[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0101] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0102] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0103] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0104] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0105] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.
[0106] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes the aforementioned element.
[0107] The above provides a detailed description of a data packet processing method, apparatus, device, and medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. A method for processing data packets, characterized in that, The method includes: Create a dual hash table; wherein the dual hash table includes an available hash table and a spare hash table; In response to the IP addition operation, the first IP address is added to the backup hash table, and according to the update operation, the IP address in the backup hash table is updated to the available hash table; The system acquires the data packet input to the user-space protocol stack and parses the data packet using the main entry processing function in the user-space protocol stack to obtain the second IP address. Based on the available hash table, the second IP address is filtered and detected, and the data packet is processed according to the result of the filtering and detection.
2. The method according to claim 1, characterized in that, Based on the available hash table, the second IP address is filtered and detected, including: In the available hash table, query the second IP address; When the second IP address is found in the available hash table, the data packet is determined to be a packet that needs to be filtered; when the second IP address is not found in the available hash table, the data packet is determined to be a packet that does not need to be filtered.
3. The method according to claim 2, characterized in that, Based on the results of the filtering and detection, the data packets are processed, including: When the filtering detection result indicates that the data packet is a packet that needs to be filtered, the data packet is discarded; when the filtering detection result indicates that the data packet is a packet that does not need to be filtered, the data packet is allowed to pass.
4. The method according to claim 2, characterized in that, In the available hash table, a query for the second IP address includes: Determine the hash value corresponding to the second IP address, and query the second IP address in the available hash table based on the hash value corresponding to the second IP address.
5. The method according to any one of claims 1-4, characterized in that, Before updating the IP addresses in the backup hash table to the available hash table according to the update operation, the method further includes: In response to the IP deletion operation, the third IP address is queried in the backup hash table, and then deleted from the backup hash table.
6. The method according to any one of claims 1-4, characterized in that, Also includes: In response to a lookup operation, the contents of the double hash table are presented.
7. The method according to claim 1, characterized in that, The second IP address is the source address of the data packet.
8. An apparatus for processing data packets, characterized in that, The device includes: A dual hash table creation module is used to create dual hash tables; wherein, the dual hash table includes an available hash table and a backup hash table; An IP operation response module is added to respond to an IP addition operation by adding a first IP address to the backup hash table and updating the IP address in the backup hash table to the available hash table according to an update operation. The data packet parsing module is used to obtain the data packets input to the user-space protocol stack, and parse the data packets through the main entry processing function in the user-space protocol stack to obtain the second IP address; The filtering mechanism processing module is used to perform filtering detection on the second IP address based on the available hash table, and process the data packet according to the filtering detection result.
9. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the method as described in any one of claims 1 to 7.