Method and system for fast forwarding of network packets with zero patch kernel integration

Abstract

The present application relates to the technical field of computer network, and especially relates to a fast forwarding method and system of network data packet of zero-patch kernel integration. The method comprises the following steps: registering a hook function at a key node of data packet processing, obtaining a registration custom processing function, expanding a connection tracking structure in a Linux kernel connection tracking system, and adding a custom field to store a fast forwarding state; constructing a fast NAT connection table; when the data packet reaches the registration custom processing function, calculating a hash value of the data packet, searching for a corresponding connection node in the fast NAT connection table through the hash value; if the valid connection node is found, updating header information of the data packet and sending the data packet to a target interface; otherwise, marking connection tracking information and making the data packet go through a regular Netfilter processing flow. The present application can solve the performance bottleneck problem caused by the dependence of the Netfilter complete flow in the traditional Linux kernel network forwarding scheme.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, and in particular to a method and system for fast forwarding of network packets with a zero-patch kernel integration. Background Technology

[0002] In the field of computer networking, network devices such as routers and gateways rely on efficient packet forwarding and network address translation technologies to meet the high-traffic data transmission needs of enterprises and various scenarios. Linux, with its open-source nature, has become the mainstream operating platform for these network devices, and its packet processing capabilities directly determine the overall performance of the equipment.

[0003] Currently, packet forwarding and Network Address Translation (NAT) functions on Linux network devices are primarily implemented using network filters (Netfilter) and IP tables (iptables). Some solutions incorporate hardware acceleration technologies to improve processing efficiency, while others optimize the forwarding process by modifying the kernel source code to adapt to different hardware platforms.

[0004] However, in traditional solutions, each data packet needs to go through a complete multi-layer hook process, which relies on the complete Netfilter process. This results in high CPU overhead, significant performance degradation in high-traffic scenarios, and unreasonable memory layout and low cache hit rate in traditional connection tracking mechanisms. Summary of the Invention

[0005] This invention provides a method and system for fast forwarding of network packets integrated with a zero-patch kernel, in order to solve the performance bottleneck problem caused by the reliance on the complete Netfilter process in traditional Linux kernel network forwarding schemes.

[0006] In a first aspect, embodiments of the present invention provide a method for fast forwarding of network packets integrated with a zero-patch kernel, comprising:

[0007] Register hook functions at key nodes in packet processing to obtain registered custom processing functions, and extend the connection tracking structure in the Linux kernel connection tracking system of the Netfilter framework by adding custom fields to store fast forwarding status, achieving zero-patch kernel integration;

[0008] Construct a fast network address translation (NAT) connection table, which is a static hash table that calculates hash values ​​based on data packets and achieves O(1) complexity connection lookup through the hash values;

[0009] When a data packet arrives at the registered custom processing function, a hash value is calculated for the data packet, and the corresponding connection node is searched in the Fast NAT connection table using the hash value. If a valid connection node is found, the header information of the data packet is updated and sent to the target interface. If no valid connection node is found, the connection tracking information is marked and the data packet is processed through the regular Netfilter process.

[0010] In one possible implementation, the entries in the fast NAT connection table are connection state structures with cached rows aligned to the size of SMP_CACHE_BYTES. The connection state structure is divided into a hot data area and a secondary hot data area. The hot data area stores network device pointers, connection activity timestamps, magic numbers, Virtual Local Area Network (VLAN) information, source / destination Internet Protocol (IP) addresses, and source / destination ports. The secondary hot data area stores connection statistics, rate data, and user pointers.

[0011] The number of entries in the Fast NAT Connection Table is configured according to the hardware platform, and the Fast NAT Connection Table uses linear probing to handle hash collisions.

[0012] In one possible implementation, the step of updating the header information of the data packet and sending it to the target interface if a valid connection node is found includes:

[0013] If the value of the magic field of the node to be matched in the Fast NAT Connection Table is consistent with the system's preset natflow_path_magic constant, and the source IP address, destination IP address, source port, destination port, and transport layer protocol type stored in the node to be matched match the five-tuple information of the data packet to be forwarded, and the difference between the current system timestamp and the last active timestamp recorded in the jiffies field of the node to be matched is less than a preset threshold, then the node to be matched is determined to be a valid connection node, and the header information of the data packet is updated and sent to the target interface.

[0014] In one possible implementation, updating the header information of the data packet and sending it to the target interface includes:

[0015] The L2 Ethernet header, L3 IP header, and L4 transport protocol header of the data packet are updated. Specifically, the L2 Ethernet header updates the source Media Access Control (MAC) address and destination MAC address stored in the connection node, the L3 IP header updates the source IP address information and destination IP address information after NAT translation stored in the connection node, and the L4 transport protocol header updates the source port information and destination port information after NAT translation stored in the connection node.

[0016] Returns a network filter packet hijacking flag to skip the full Netfilter processing flow.

[0017] One possible implementation also includes:

[0018] The status field of the connection status structure is preset with a first flag bit and a second flag bit. The first flag bit uses a first flag to track the hardware acceleration status of the original direction data packet, and the second flag bit uses a second flag to track the hardware acceleration status of the reply direction data packet.

[0019] After a valid connection node is matched, the status of the corresponding direction flag and the running status of the hardware acceleration module are detected in real time.

[0020] When a hardware acceleration failure is detected, the packet forwarding path is automatically switched to the software path, the hardware acceleration flag in the corresponding direction is cleared, the cause of the failure is recorded, and the hardware statistics information is updated synchronously.

[0021] One possible implementation also includes:

[0022] Users are identified based on their source IP address, their authentication status is checked, and flow control is performed on authenticated users.

[0023] In kernel space, Hypertext Transfer Protocol (HTTP) / Hypertext Transfer Protocol Secure (HTTPS) requests are inspected, HTTP request headers or Transport Layer Security (TLS) Server Name Indication (SNI) information is parsed to extract Uniform Resource Locator (URL), and the URL information is stored in the log buffer.

[0024] Based on user identity, IP address, or port information, the corresponding Quality of Service (QoS) policy is executed using traffic control (TC) tools.

[0025] One possible implementation also includes:

[0026] When the system starts, it iterates through all network interfaces, parses the network interface name suffix to extract the region identifier (ID) and region type, builds a mapping table of interface name-region ID-region type and caches it in the kernel space; the region type includes local area network (LAN) region or wide area network (WAN) region.

[0027] When a data packet arrives at the registered custom processing function, the source network interface name and target network interface name of the data packet are extracted. Based on the mapping table, the corresponding source region ID, source region type, target region ID, and target region type are queried and written into the connection state structure.

[0028] Differentiated forwarding strategies are executed based on the combination of source region type and target region type.

[0029] In one possible implementation, the execution of the differentiated forwarding strategy based on the combination relationship between the source region type and the target region type includes:

[0030] If the combination relationship is LAN area - LAN area, then the data packet is forwarded directly;

[0031] If the combination relationship is LAN area - WAN area, then the data packet is forwarded after Source Network Address Translation (SNAT).

[0032] If the combination relationship is WAN area - LAN area, then the data packet is forwarded after Destination Network Address Translation (DNAT) is performed.

[0033] One possible implementation also includes:

[0034] The connection tracking information is formatted into a readable text format, and a paginated query function for the connection tracking information is provided through the user-space character device interface.

[0035] Secondly, embodiments of the present invention provide a fast network packet forwarding system integrated with a zero-patch kernel, comprising:

[0036] The registration module is used to register hook functions at key nodes in packet processing, thereby obtaining registered custom processing functions;

[0037] An extension module for extending the connection tracing structure in the Linux kernel connection tracing system of the Netfilter framework, adding custom fields to store fast forwarding status, and achieving zero-patch kernel integration;

[0038] The module is used to build a fast network address translation (NAT) connection table. The fast NAT connection table is a static hash table that calculates hash values ​​based on data packets and achieves O(1) complexity connection lookup through the hash values.

[0039] The core forwarding module is used to calculate the hash value of the data packet when it arrives at the registered custom processing function, and use the hash value to look up the corresponding connection node in the fast NAT connection table; if a valid connection node is found, the header information of the data packet is updated and sent to the target interface; if no valid connection node is found, the connection tracking information is marked and the data packet is processed through the regular Netfilter process.

[0040] This invention provides a method and system for fast forwarding of network packets in a zero-patch kernel-integrated system. Hook functions are registered at key nodes in packet processing, and the connection tracking structure is extended in the Linux kernel connection tracking system of the Netfilter framework. Custom fields are added to store the fast forwarding status, so that seamless integration with the standard kernel can be achieved without modifying the Linux kernel source code through the extension mechanism and hook registration, with strong compatibility.

[0041] A fast NAT connection table is constructed. The fast NAT connection table is a static hash table that calculates the hash value based on the data packet and realizes O(1) complexity connection lookup through the hash value, thereby greatly shortening the connection status query time.

[0042] When a data packet arrives at the registered custom processing function, a hash value is calculated on the packet, and the corresponding connection node is searched in the Fast NAT connection table using the hash value. If a valid connection node is found, the packet header information is updated and sent to the target interface, thus skipping the entire Netfilter processing flow. This allows for forwarding performance far exceeding traditional solutions with only a single-core processor, significantly breaking through the performance bottleneck of conventional packet forwarding mechanisms. If no valid connection node is found, connection tracking information is marked and the data packet follows the conventional Netfilter processing flow, implementing a layered processing mechanism of "fast path first, conventional path as a fallback," balancing performance and functional completeness. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a flowchart illustrating the implementation of the fast forwarding method for network packets integrated with a zero-patch kernel provided in this embodiment of the invention.

[0045] Figure 2 This is a schematic diagram of the connection state structure provided in an embodiment of the present invention;

[0046] Figure 3 This is a schematic diagram of the fast data packet forwarding process provided in an embodiment of the present invention;

[0047] Figure 4 This is a schematic diagram of the user authentication and traffic control process provided in an embodiment of the present invention;

[0048] Figure 5 This is a schematic diagram of the URL log recording process provided in an embodiment of the present invention;

[0049] Figure 6 This is a schematic diagram of the area-aware forwarding decision-making process provided in an embodiment of the present invention;

[0050] Figure 7 This is a schematic diagram of the structure of a fast forwarding system for network packets integrated with a zero-patch kernel provided in an embodiment of the present invention;

[0051] Figure 8 This is a schematic diagram of the structure of a fast forwarding system for network packets integrated with a zero-patch kernel provided in another embodiment of the present invention. Detailed Implementation

[0052] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0053] See Figure 1 The document illustrates a flowchart of a fast network packet forwarding method integrated with a zero-patch kernel, provided by an embodiment of the present invention, which is described in detail below:

[0054] Step 101: Register hook functions at key nodes in packet processing to obtain registered custom processing functions, and extend the connection tracking structure in the Linux kernel connection tracking system of the Netfilter framework by adding custom fields to store fast forwarding status, thus achieving zero-patch kernel integration.

[0055] This step integrates the fast forwarding function with the kernel without modifying the standard Linux kernel source code, through the Netfilter hook registration mechanism and the connection tracking structure extension mechanism.

[0056] The Netfilter framework provides several custom packet processing functions for registering in the Linux kernel network protocol stack. This embodiment selects key nodes to inject fast forwarding logic. Optionally, in this embodiment, hook functions can be registered at key nodes in packet processing through the Netfilter hook registration mechanism. The registered hook functions may include:

[0057] natflow_fastnat_forward_hook: Registered in NF_INET_FORWARD, it is a custom processing function that is responsible for intercepting and processing data packets that need to be forwarded.

[0058] natflow_fastnat_pre_hook: Registered in NF_INET_PRE_ROUTING, this registers custom processing functions used to preprocess incoming network packets and extract basic information required for connection tracking.

[0059] natflow_fastnat_post_hook: Registers custom processing functions in NF_INET_POST_ROUTING to handle packets that will be sent after forwarding and to complete cleanup operations such as updating statistics.

[0060] The hook functions mentioned above are loaded into the kernel through the Netfilter standard registration interface, without requiring any modification to the kernel source code, thus ensuring compatibility with the standard Linux kernel.

[0061] The connection tracking (conntrack) system in the Linux kernel is a core component of the Netfilter framework, used to track network connection status. The core structure of the connection tracking system is `struct nf_conn`, which stores basic information about the network connection, such as the source IP address, destination IP address, port, and protocol type. It also contains an `ext` extension field of type `struct nf_ct_ext *`, which points to a custom extended data area. This structure is fixed in the kernel and cannot be directly modified.

[0062] Netfilter provides an extension mechanism that allows modules to add custom data to connection tracking without modifying the kernel source code. This embodiment uses the `nf_ct_ext_add` extension mechanism to add a custom extension field to `struct nf_conn` to store fast forwarding state information, achieving zero-patch kernel integration. It should be noted that the operation of adding a custom extension field to `struct nf_conn` using the `nf_ct_ext_add` extension mechanism in this embodiment is based on the standard Netfilter extension mechanism and does not modify the kernel source code, thus achieving a zero-patch kernel. The specific implementation is as follows:

[0063] This embodiment adopts a custom extension mechanism, which differs from the fixed offset extension method of the standard nf_ct_ext_add. It manages the extended memory by dynamically calculating the offset and introduces a magic number verification mechanism to ensure the validity of the extended data.

[0064] The core information stored in the extended data area includes fast forwarding node pointers, hardware acceleration status flags, connection timeout timestamps, and area attribute information. This information provides key basis for fast forwarding decisions.

[0065] The allocation and reclamation of extended memory are manually managed in this embodiment. Compared with the standard nf_ct_ext_add mechanism, which is uniformly managed by Netfilter, it is more flexible in adapting to the high-frequency access requirements of fast forwarding and reduces memory management overhead.

[0066] This embodiment achieves zero-patch integration with the standard Linux kernel through the hook registration and structure extension mechanism described above. It does not require modification of the kernel source code and can support multiple versions of Linux kernel 3.10-6.x, adapting to various hardware platforms such as MT7621, MT7622, ​​MT7981, and MT7986. The fast forwarding logic is loaded as a kernel module and can be enabled or disabled as needed without affecting the original network functions of the kernel. Extended data is stored in association with native connection tracking data, ensuring the consistency of connection status and avoiding data redundancy.

[0067] Step 102: Construct a fast NAT connection table. The fast NAT connection table is a static hash table that calculates hash values ​​based on data packets and achieves O(1) complexity connection lookup through hash values.

[0068] This step is used to build a static hash table that enables O(1) complexity connection lookup, providing efficient connection status query capabilities for fast packet forwarding and solving the technical problems of unreasonable memory layout, low cache hit rate, and low lookup efficiency in traditional connection tracking mechanisms.

[0069] In one embodiment, the entries in the fast NAT connection table are connection state structures that are cache line aligned according to the size of the Symmetric Multiprocessing Cache Line Alignment Unit (SMP_CACHE_BYTES). The connection state structure is divided into a hot data area and a secondary hot data area.

[0070] The number of entries in the Fast NAT connection table depends on the hardware platform configuration. The Fast NAT connection table uses linear probing to handle hash collisions.

[0071] In one embodiment, the hotspot data area stores network device pointers, connection activity timestamps, magic number, VLAN information, source / destination IP addresses, and source / destination ports, while the secondary hotspot data area stores connection statistics, rate data, and user pointers.

[0072] The fast NAT connection table is a global static hash table, whose core definition is struct natflow_fastnat_node_t natflow_fast_nat_table[NATFLOW_FASTNAT_TABLE_

[0073] [SIZE]. This hash table is based on the 5-tuple information of the data packet. It calculates the hash value using the natflow_hash_v4 / natflow_hash_v6 hash function and uses linear probing to handle hash collisions. This effectively avoids the performance loss caused by the traditional linked list collision handling method and achieves a connection lookup with an average complexity of O(1).

[0074] The number of entries in the hash table, NATFLOW_FASTNAT_TABLE_SIZE, can be flexibly configured based on the performance and memory resources of the hardware platform, with a value range of 4096-16384 entries. This achieves an optimal balance between memory usage and search performance and is compatible with different hardware platforms such as MT7621, MT7622, ​​MT7981, and MT7986.

[0075] The entries in the Fast NAT connection table are connection state structures called struct natflow_fastnat_node_t. This structure is explicitly aligned to the cache line size using the __attribute__((__aligned__(SMP_CACHE_BYTES))) keyword, which solves the problems of cross-cache line access, false sharing, and low prefetching efficiency in traditional connection tracking structures.

[0076] The connection state structure is divided into a first N bytes of hot data and a last N bytes of secondary hot data. Optionally, N can be 64.

[0077] like Figure 2The diagram shown illustrates the connection state structure, visually demonstrating the memory layout design of the `struct natflow_fastnat_node_t` structure. The core design optimizes memory access efficiency through cache line alignment and hierarchical data storage. This connection state structure has a total size of 256 bytes, divided into three contiguous memory regions based on access frequency and function. Each core region is aligned to the size of `SMP_CACHE_BYTES` (typically 64 bytes) to avoid performance overhead from cross-cache line accesses.

[0078] Cache line 1 is the hot data area, storing bytes 0 to 63. This is the core area that is frequently accessed during fast packet forwarding. A single cache load can obtain all the key information required for fast packet forwarding, which may include:

[0079] outdev: Pointer to the target network device, occupying 8 bytes, used to quickly locate the forwarding exit of data packets;

[0080] jiffies: Connects to the last activity timestamp, occupying 8 bytes, used for timeout management;

[0081] magic: The magic number field, which occupies 2 bytes, is used to verify the validity of the connected node;

[0082] VLAN information: includes vlan_present, vlan_proto, and vlan_tci, occupying 2 bytes, and used to process data packets with VLAN tags;

[0083] flags: Connection status flags, including identifiers such as protocol type and hardware acceleration status, occupying 1 byte;

[0084] count: Auxiliary key field, occupying 1 byte, used to record the reference count or probe count of the current connected node;

[0085] ifindex: Auxiliary key field, occupying 2 bytes, used to store the index of the output network interface corresponding to the current connection;

[0086] saddr / daddr, source / dest: The source / destination IP address and port in the original 5-tuple. saddr / daddr each occupy 4 bytes, and source / dest each occupy 2 bytes.

[0087] nat_source / nat_dest: The source and destination ports after NAT translation, each occupying 2 bytes;

[0088] The design of the hot data area ensures that the fast forwarding path does not need to access other memory areas. The system mainly needs key information such as IP address, port, and device pointer, so only the first 64 bytes need to be accessed. Since the first 64 bytes are aligned, only one cache line needs to be loaded to obtain all the key information, avoiding cache pollution caused by accessing secondary fields such as statistics. This increases the cache hit rate from 70%-80% to over 95%, and can increase throughput by 20%-50% in multi-core systems.

[0089] Cache line 2 is the secondary hotspot data area, storing bytes 64-127. This area stores auxiliary information that is not frequently accessed, primarily for traffic statistics and status management, and may include:

[0090] nat_saddr / nat_daddr: The source / destination IP address after NAT translation, each occupying 4 bytes;

[0091] h_source / h_dest: Source / destination MAC addresses, each occupying 6 bytes, used to update the L2 header of the data packet;

[0092] pppoe_sid: PPPoE session identifier, occupying 2 bytes, used to identify and process packets of the Point-to-Point Protocol over Ethernet (PPPoE) protocol;

[0093] mss: Maximum segment size, occupying 2 bytes, used for transmission optimization of the Transmission Control Protocol (TCP);

[0094] keepalive_jiffies: Connection keep-alive timestamps, occupying 8 bytes, used for maintaining the state of long-lived connections;

[0095] status: Extended status field, which includes hardware acceleration flags (NF_FF_ORIGINAL_OK / NF_FF_REPLY_OK), user authentication status, etc., and occupies 8 bytes;

[0096] flow_bytes / flow_packets: The cumulative number of bytes and packets of traffic for the connection, each occupying 4 bytes, used for traffic statistics;

[0097] speed_bytes / speed_packets: Rate statistics, each occupying 16 bytes, used for flow control and QoS policy implementation;

[0098] ptr: User-defined pointer, occupying 8 bytes, used for feature expansion and data association between modules.

[0099] Additionally, it includes the Internet Protocol Version 6 (IPv6) extension area, which is a low-frequency data area storing bytes 128-255. This area is specifically used to store IPv6 protocol-related address information and contains four fields: saddr6, daddr6, nat_saddr6, and nat_daddr6. Each field contains four __be32 type variables, each occupying 16 bytes, which is exactly enough to store a 128-bit IPv6 address.

[0100] Since IPv6 traffic accounts for a relatively small percentage in the current scenario, this area is designed as a separate extension area that is only accessed when processing IPv6 packets, thus avoiding occupying the cache space of the hot data area.

[0101] The core advantage of the entire connection state structure design lies in its cache friendliness. Through data layering and alignment optimization, it solves problems such as cross-cache line access and false sharing in traditional connection tracking structures, and greatly improves forwarding throughput in multi-core systems.

[0102] In this embodiment, the fast NAT connection table employs a memory pre-allocation and reuse strategy. A fixed-size memory block is allocated all at once during system initialization to store the connection state structure, avoiding frequent memory allocation and release operations during operation and reducing memory management overhead. When a connection times out, the system reclaims the memory corresponding to that connection entry and marks it as free for reuse by new connection states, further improving memory utilization efficiency.

[0103] Using the hash value calculated from the packet's 5-tuple as the lookup key, the system locates the corresponding connection state structure in the Fast NAT connection table. Then, it verifies the validity of the connection node through steps such as magic number verification, 5-tuple information matching, and timeout checks, ensuring that only legitimate and active connection nodes are used for fast packet forwarding.

[0104] Step 103: When a data packet arrives at the registered custom processing function, a hash value is calculated on the data packet, and the corresponding connection node is searched in the fast NAT connection table using the hash value. If a valid connection node is found, the header information of the data packet is updated and sent to the target interface. If no valid connection node is found, the connection tracking information is marked and the data packet is processed through the regular Netfilter process.

[0105] This step is the core execution flow for fast packet forwarding. After the packet arrives at NF_INET_FORWARD and a custom processing function is registered, a high-performance processing logic of "fast forwarding first, conventional process as a fallback" is achieved through efficient lookup of the fast NAT connection table and node validity verification.

[0106] Optional, such as Figure 3 The diagram illustrates the fast packet forwarding process. When a packet arrives at the kernel's NF_INET_FORWARD registers a custom processing function, it triggers the fast forwarding logic in this embodiment. This is the core interception node for packet forwarding. The system first determines the network layer protocol type of the packet, distinguishing between IPv4 and IPv6. Based on this, it selects the corresponding hash function. If the network layer protocol type is IPv4, the selected hash function is natflow_hash_v4; if the network layer protocol type is IPv6, the selected hash function is natflow_hash_v6. The system extracts the packet's five-tuple information—source IP, destination IP, source port, destination port, and transport layer protocol—and calculates a unique hash value using the corresponding hash function. This hash value serves as the lookup key in the fast NAT connection table.

[0107] The system searches for the corresponding connection node in the fast NAT connection table based on the calculated hash value. If a hash collision occurs, the system traverses the table entries using linear probing to find the connection node to be matched. If a matching connection node is found, i.e., a valid connection node exists, a triple check is performed on the valid connection node: magic number consistency check, 5-tuple information matching check, and connection timeout check. The system checks whether all checks pass. Only if all checks pass is the connection node determined to be valid.

[0108] In one embodiment, if a valid connection node is found, updating the header information of the data packet and sending it to the target interface may include:

[0109] If the value of the magic field of the node to be matched in the Fast NAT Connection Table is consistent with the system's preset NAT flow path magic number natflow_path_magic constant, and the source IP address, destination IP address, source port, destination port, and transport layer protocol type stored in the node to be matched match the five-tuple information of the data packet to be forwarded, and the difference between the current system timestamp and the last active timestamp recorded in the jiffies field of the node to be matched is less than a preset threshold, then the node to be matched is determined to be a valid connection node, the header information of the data packet is updated, and it is sent to the target interface.

[0110] Optionally, during magic number consistency verification, the value of the magic field of the node to be matched must be consistent with the system's preset natflow_path_magic constant, thereby filtering out illegal connection nodes caused by memory corruption or invalid writes.

[0111] When checking for connection timeout, the preset threshold can be set according to requirements, for example, it can be 30 seconds.

[0112] If a valid connection node is found, the system will perform packet header information update and fast forwarding operations. In one embodiment, updating the packet header information and sending it to the target interface includes:

[0113] Update the L2 Ethernet header, L3 IP header, and L4 transport protocol header of the data packet. The L2 Ethernet header updates the source MAC address and destination MAC address stored in the connection node, such as h_source and h_dest. The L3 IP header updates the source IP address and destination IP address information after NAT translation stored in the connection node, such as nat_saddr and nat_daddr. The L4 transport protocol header updates the source port information and destination port information after NAT translation stored in the connection node, such as nat_source and nat_dest.

[0114] Returns a network filter packet hijacking flag to skip the full Netfilter processing flow.

[0115] The network filter packet hijacking flag can be NF_STOLEN.

[0116] Optionally, after updating the packet header information, the packet is sent directly to the target network interface stored in the connection node; simultaneously, the connection node's traffic statistics are updated, including the flow_bytes (number of bytes) and flow_packets (number of packets). After processing, the system returns NF_STOLEN, terminating the subsequent hook processing flow of the Netfilter framework, thereby reducing redundant processing overhead and improving forwarding efficiency.

[0117] It should be noted that, as Figure 3 As shown, if no valid connection node is found, or the matching connection node fails the validity check, the system will execute the regular Netfilter processing procedure, the specific steps of which are as follows:

[0118] The system marks the connection tracking information for this data packet and sets the NF_FF_RETRY flag;

[0119] Allowing the data packet to enter the complete processing flow of the Netfilter framework involves executing the software NAT translation process, including connection tracking, NAT translation, and rule filtering. At the same time, a new connection record is created for the data packet and written to the fast NAT connection table for reuse by subsequent data packets with the same connection.

[0120] In one embodiment, the fast forwarding method for network packets integrated in the zero-patch kernel further includes a seamless switching process between hardware acceleration and software paths. This is a high-availability guarantee mechanism added on top of the fast packet forwarding process. Its core objective is to achieve millisecond-level automatic fallback in the event of hardware acceleration failure, ensuring uninterrupted network service while maintaining the consistency of traffic statistics. The seamless switching process between hardware acceleration and software paths includes:

[0121] The status field of the connection status structure is preset with a first flag and a second flag. The first flag is used to track the hardware acceleration status of the original direction data packet, and the second flag is used to track the hardware acceleration status of the reply direction data packet.

[0122] After a valid connection node is matched, the status of the corresponding direction flag and whether hardware acceleration is available are detected in real time.

[0123] When a hardware acceleration failure is detected, the packet forwarding path is automatically switched to the software path, the hardware acceleration flag in the corresponding direction is cleared, the cause of the failure is recorded, and hardware statistics are updated simultaneously.

[0124] Optionally, the first flag can be represented as the Netfilter fast forwarding original direction available flag, such as NF_FF_ORIGINAL_OK, and the second flag can be represented as the Netfilter fast forwarding reply direction available flag, such as NF_FF_REPLY_OK.

[0125] Optionally, in the status field of the connection status structure struct natflow_fastnat_node_t, two independent hardware acceleration status flags are preset to track the bidirectional acceleration status of the network connection:

[0126] NF_FF_ORIGINAL_OK: This flag is set by the system when the hardware acceleration function in this direction is successfully enabled and running normally; it is cleared when hardware acceleration malfunctions.

[0127] The setting and clearing logic of NF_FF_REPLY_OK is the same as that of NF_FF_ORIGINAL_OK.

[0128] The hardware acceleration status in both directions is tracked independently and does not interfere with each other, ensuring that the acceleration status of bidirectional data transmission can be accurately identified, providing a reliable basis for subsequent path switching.

[0129] like Figure 3 As shown, when the system matches a valid connection node in the fast NAT connection table, before performing the fast packet forwarding operation, it will trigger a real-time detection process for the hardware acceleration status. First, based on the current packet transmission direction, it will read the corresponding NF_FF_ORIGINAL_OK or NF_FF_REPLY_OK flag status to preliminarily determine whether the hardware acceleration function is available.

[0130] Synchronously monitor the operating status of the hardware acceleration module, including key indicators such as hardware resource utilization, acceleration task execution results, and hardware register status, to avoid forwarding failures caused by misjudgment of flag bits.

[0131] The system determines that hardware acceleration is available and performs hardware path forwarding only when the flag bit is set and the hardware acceleration module is running normally; if either condition is not met, hardware acceleration is determined to have failed.

[0132] like Figure 3 When hardware acceleration failure is detected, the system automatically switches the forwarding path of the current data packet from the hardware path to the software path. Following the software NAT translation process, it updates the L2, L3, and L4 header information of the data packet and completes the forwarding. The entire switching process is completed within 100ms, without the user's awareness, ensuring the continuity of network services.

[0133] After the software path forwards the data packet, the system synchronizes the traffic data of the data packet to the hardware statistics counter, including the flow_bytes field and the flow_packets field, to ensure the consistency between hardware and software statistics and avoid traffic statistics deviations caused by path switching.

[0134] Optionally, when a hardware acceleration failure is detected, the hardware acceleration flag corresponding to the current data packet transmission direction should be cleared, and the reason for the hardware acceleration failure should be recorded in the connection state structure to facilitate subsequent troubleshooting and maintenance analysis. Reasons for hardware acceleration failure may include insufficient resources, hardware failure, or unsupported data packet types.

[0135] In this embodiment, the system enables hardware acceleration through configuration items such as CONFIG_NET_RALINK_OFFLOAD and provides a dedicated control interface to support user space querying and adjusting hardware acceleration-related parameters and real-time monitoring of hardware acceleration status. Through this dedicated control interface, maintenance personnel can view information such as the hardware acceleration activation status, failure count, and fault causes, further improving system maintainability.

[0136] In one embodiment, the fast forwarding method for network packets integrated in a zero-patch kernel further includes a user-level function integration process. This process integrates high-level functional modules into the fast packet forwarding path. Its core objective is to achieve user authentication, flow control, URL logging, and QoS policy enforcement without reducing forwarding performance, avoiding the performance loss caused by sending packets to user space for processing in traditional solutions. This may include:

[0137] Users are identified based on their source IP address, their authentication status is checked, and flow control is performed on authenticated users.

[0138] In kernel space, HTTP / HTTPS requests are detected, HTTP request headers or TLSSNI information are parsed to extract the URL, and the URL information is stored in the log buffer.

[0139] Based on user identity, IP address, or port information, the corresponding QoS policy is executed using the tc tool.

[0140] The system embeds user management logic in the fast forwarding path, such as Figure 4 The diagram illustrates the user authentication and traffic control process. Data packets enter the user authentication and traffic control module, which is embedded in the fast forwarding path without interrupting the original high-performance forwarding process. The system uses the source IP address of the data packet as the unique identifier for the user and quickly matches the corresponding user identity using a user information table maintained in the kernel space. The user information table stores core parameters such as the user's authentication status, traffic quota, and rate limit threshold.

[0141] The system checks if the user exists. If the user does not exist, the system automatically creates a new user record for that source IP address and initializes parameters such as authentication status, traffic quota, and rate limit. If the user exists, the system proceeds directly to the next step of authentication status check.

[0142] During the authentication status check, the system reads the user's authentication status from the user record to determine whether the currently accessed resource requires authentication permissions: if no authentication is required, the subsequent authentication process is skipped and the system directly enters the traffic control stage; if authentication is required, the system continues to determine whether the user has completed authentication.

[0143] If a user is not authenticated, the system will trigger a redirection mechanism, executing different strategies based on the request type: for HTTP requests, a 302 redirect response will be returned, directing the user to the authentication page; for HTTPS requests, the TLS SNI information will be parsed, and the corresponding redirection operation will be performed.

[0144] If the user is already authenticated, the process proceeds directly to the traffic control stage.

[0145] For authenticated users, the system employs the token bucket algorithm to perform fine-grained traffic control, achieving independent limits on uplink and downlink bandwidth with a control precision of up to 10Kbps. The specific execution steps are as follows:

[0146] The system configures independent token bucket parameters for each user, including token generation rate and token bucket capacity, which correspond to the user's bandwidth limit and burst traffic limit, respectively.

[0147] During packet forwarding, the system deducts tokens from the corresponding token bucket based on the size and direction of the packet. If there are enough tokens in the token bucket, i.e. the rate limit is not exceeded, the packet forwarding is allowed. If there are not enough tokens, i.e. the rate limit is exceeded, the packet is buffered or dropped to prevent user traffic from exceeding the preset threshold.

[0148] Finally, the system updates status and statistics. Regardless of whether the data packet is allowed or not, the system performs three operations:

[0149] Update the user's last activity timestamp to maintain the user's online status;

[0150] Updating user traffic statistics will update the flow_bytes and flow_packets fields of the connection state structure in real time;

[0151] Update the rate statistics window count to provide data support for the next flow control verification.

[0152] Figure 5 This is a flowchart illustrating the URL logging process. It shows how the system efficiently extracts the URL information of HTTP / HTTPS requests in the kernel space and completes the entire logging process. Its core advantage is that it does not require sending data packets to user space for processing, and it achieves URL log collection without affecting forwarding performance.

[0153] The system intercepts TCP packets in the fast forwarding path. First, it determines whether the destination port of the packet is 80 (HTTP protocol port) or 443 (HTTPS protocol port). Packets that are not destined for the port are skipped directly and do not proceed to the next step.

[0154] For data packets that match the destination port, the system further parses the application layer data to determine whether it is a standard HTTP request method. URL extraction is only performed for the three commonly used methods: GET, POST, and HEAD. Requests using other methods are ignored.

[0155] When performing URL extraction, for the HTTP request branch, the HTTP request line in the data packet is directly parsed to extract the requested URL path. At the same time, the Host field in the HTTP header is parsed, and the Host and URI are merged into a complete URL. For the HTTPS request branch, since HTTPS traffic is transmitted in encrypted form, the system parses the SNI field in the Client Hello message during the TLS handshake phase to extract the accessed domain name information as the URL.

[0156] The system compares the extracted URLs with existing records in the log buffer to determine whether the same URL has been accessed repeatedly within a preset time window. If repeated access is found, the access count for that URL is incremented without creating a new log record, thus reducing the log buffer's usage. If repeated access is not found, a new log record is created, recording the URL, access time, corresponding user identity, and other information, and the timestamp of the URL record is updated.

[0157] The system writes newly created or updated log records to the kernel-mode log buffer while checking the buffer's storage capacity.

[0158] If the storage capacity of the buffer does not reach the preset threshold, the storage will be completed directly;

[0159] If the buffer's storage capacity has reached the threshold, a first-in, first-out (FIFO) strategy is adopted to delete the oldest log record, making room for new records and ensuring the availability of the buffer.

[0160] After logging is complete, the data packet continues to flow along the fast forwarding path. The entire URL extraction and logging process is completed in one go in the kernel space without interrupting the data packet forwarding process.

[0161] In this embodiment, the core value of the entire URL logging process lies in its lossless performance. Compared with the traditional solution of forwarding data packets to user space for log processing, this process can achieve the ability to record more than 1,000 URLs per second without affecting the throughput of data packet forwarding.

[0162] Optionally, users can read URL records from the log buffer through the urllogger_queue character device interface.

[0163] When implementing QoS policies using the tc tool, the system supports implementing differentiated QoS policies based on multiple dimensions such as user identity, source IP address, and destination port, in conjunction with the Linux tc tool.

[0164] The system marks QoS-related attributes such as user identity and service type in the connection state structure as the basis for QoS policy matching;

[0165] Administrators configure QoS rules through the qos_ctl control interface, including rule priority, matching conditions, and scheduling policies. The system then sends the rules to the tc scheduler in the kernel space.

[0166] During packet forwarding, the system matches the corresponding TC rules based on the QoS attributes of the connection state and performs operations such as queue scheduling, bandwidth allocation, and priority marking to prioritize the forwarding of traffic from high-priority users or services, thus ensuring the quality of service for critical services.

[0167] In one embodiment, to achieve intelligent forwarding decisions based on network regions, intelligent traffic processing based on LAN / WAN regions is realized through network interface region attribute identification and differentiated forwarding strategies. The core is to parse region information using interface name suffixes, avoiding additional data structure overhead. The fast forwarding method for network packets integrated in the zero-patch kernel also includes:

[0168] When the system starts up, it iterates through all network interfaces, parses the network interface name suffix to extract the region ID and region type, builds a mapping table of interface name-region ID-region type and caches it in the kernel space; the region type includes LAN region or WAN region.

[0169] When a data packet arrives at the registered custom processing function, for example, when a data packet arrives at the NF_INET_FORWARD registered custom processing function, the source network interface name and the destination network interface name of the data packet are extracted, the corresponding source region ID, source region type and destination region ID and destination region type are queried based on the mapping table, and written into the connection state structure;

[0170] Differentiated forwarding strategies are executed based on the combination of source region type and target region type.

[0171] Optionally, the interface naming convention adopts the format of "interface name_region ID_region type", for example, eth0_1_LAN represents the LAN interface with region ID 1, and eth1_2_WAN represents the WAN interface with region ID 2.

[0172] The area types include only LAN and WAN, which are used to define the internal or external network attributes of the interface; the area ID is a numerical identifier used to distinguish different subnets under the same type, such as office area LAN, visitor area LAN, etc.

[0173] The system constructs a mapping table from the parsed "interface name → region ID + region type" correspondence and caches it in the kernel space for quick lookup during packet forwarding, eliminating the need to repeatedly parse the interface name each time it is forwarded.

[0174] Figure 6 This is a schematic diagram of the area-aware forwarding decision-making process. It shows the complete logic of the system executing differentiated forwarding strategies based on the area type of the source and destination interfaces of data packets. The core objective is to achieve intelligent management and control of intranet and extranet traffic.

[0175] After the data packet arrives at the NF_INET_FORWARD registered custom processing function, it enters the area-aware forwarding decision module, which works based on the "interface name → area ID + area type" mapping table built during system initialization.

[0176] The system extracts the names of the source network interface (data packet inflow interface) and the destination network interface (data packet outflow interface) from the socket buffer (SkB) structure of the data packet. Based on the kernel cache mapping table, it queries the source region ID and source region type corresponding to the source interface, and the destination region ID and destination region type corresponding to the destination interface.

[0177] The aforementioned region information is written into a dedicated field of the connection state structure struct natflow_fastnat_node_t, which serves as the basis for determining subsequent forwarding strategies and allows subsequent data packets on the same connection to be directly reused, thereby improving processing efficiency.

[0178] If the combination relationship is LAN area-LAN area, that is, the source area type is LAN and the destination area type is LAN, it is determined to be an intranet cross-area forwarding, and the data packet is forwarded directly without performing NAT translation, only updating the L2 layer MAC address; at the same time, the intranet partition access control rules can be executed according to the source / destination area ID.

[0179] Based on the source / target region ID, execute access control rules for the intranet partition. This may include: verifying whether the source region ID and the target region ID belong to the same intranet cluster. If they belong to different partitions, more detailed access control rules can be matched as needed to achieve fine-grained management of the intranet partition.

[0180] If the combination relationship is LAN area - WAN area, that is, the source area type is LAN and the destination area type is WAN, it is determined to be an internal network accessing the external network. The system reads the public IP pool corresponding to the WAN area ID, performs SNAT translation, replaces the source IP address (internal private IP) of the data packet with an available address in the public IP pool, and maps the source port; after updating the L3 layer IP header and L4 layer port information of the data packet, it forwards it to the WAN interface, and applies user authentication and traffic control rules at the same time.

[0181] If the combination relationship is WAN area - LAN area, i.e., the source area type is WAN and the destination area type is LAN, it is determined to be an external network accessing the internal network. After performing DNAT conversion, the data packet is forwarded. The system reads the DNAT rule table corresponding to the target LAN area ID, replaces the destination IP and port of the data packet with the corresponding internal network server address and port in the rule table; applies the security policy, i.e., verifies the blacklist and whitelist permissions for external network access. If approved, the data packet is forwarded to the LAN interface to ensure the access security of internal network services.

[0182] If the combination relationship is WAN area - WAN area, that is, when both the source area type and the destination area type are WAN, special forwarding processing is performed.

[0183] The special forwarding process here includes: the system activates a WAN-WAN special forwarding mode based on a zero-copy memory sharing mechanism. Through efficient collaborative processing between kernel space and user space, it eliminates the overhead of multiple memory copies and complex route lookups in traditional forwarding, achieving ultimate forwarding performance in WAN-WAN scenarios. The processing flow includes three stages: packet enqueueing, user space processing, and kernel space completion. The execution logic of each stage is as follows:

[0184] 1. Data packet enqueue phase;

[0185] The system intercepts WAN-WAN type packets in the Netfilter custom processing function. First, it extracts the key metadata of the packet, including the five-tuple information, source and destination interface information, and destination interface information. It only writes the packet descriptor to the independent slot of the global circular buffer queue corresponding to the current CPU core. After completion, it updates the queue write pointer and uses a memory barrier to ensure the visibility of the operation in a multi-core environment. At this point, the packet enqueue is completed, and there is no actual data copying operation.

[0186] The packet descriptor mentioned above is not the actual packet data, but a lightweight data structure used to describe the key characteristics of network packets.

[0187] For example, packet descriptor = {

[0188] Source IP address: 192.168.1.100

[0189] Target IP address: 8.8.8.8

[0190] Source port: 54321

[0191] Target port: 53

[0192] Protocol type: UDP

[0193] Receive interface: eth0

[0194] Sending interface: wan1

[0195] Packet length: 74 bytes

[0196] Timestamp: 1234567890

[0197] Priority: 0

[0198] }

[0199] Compared to transmitting the entire data packet, the data packet descriptor is usually only a few tens of bytes, which greatly reduces memory transfer overhead.

[0200] The system maintains a global circular buffer queue, which is managed in segments according to the number of CPU cores. Each CPU core corresponds to a segment in an independent circular buffer queue. The queue adopts a fixed-size slot design, and each slot can hold complete network data packet information.

[0201] 2. User space processing stage;

[0202] User-space processes directly access the kernel-space circular buffer queue through shared memory mapping via the mmap mechanism. They poll and check the readable status of the circular buffer queue corresponding to each CPU core, read the packet descriptors to be processed in batches, and make fast forwarding decisions according to the system's preset policies. Forwarding decision types include direct forwarding and policy routing. After the decision is completed, the processing results are written back to the response queue corresponding to the circular buffer queue for kernel-space calls.

[0203] Shared memory mapping directly maps the kernel-mode circular buffer queue to user space via the mmap mechanism, avoiding the memory copy overhead of traditional copy_to_user or copy_from_user.

[0204] System preset policies refer to a set of pre-configured forwarding rules used to guide WAN-WAN special forwarding decisions. These policies mainly include: direct forwarding policies, load balancing policies, link quality optimization policies, and security policies.

[0205] Among them, the direct forwarding strategy is to forward directly between WAN ports of the same operator, bypassing gateway processing;

[0206] Load balancing strategy: Traffic distribution rules among multiple WAN links;

[0207] Link quality optimization strategy: Select the optimal exit point based on metrics such as latency and packet loss rate;

[0208] Security policies include security filtering rules such as ACL rules and access control lists.

[0209] These strategies are loaded into memory when the system starts up, and user-space programs can quickly make forwarding decisions based on these preset rules.

[0210] Policy-based routing is an advanced routing mechanism. It is a flexible routing control technology that differs from traditional routing forwarding methods based on destination IP addresses. It breaks away from the single rule of traditional routing that only looks up the routing table based on the destination IP of the data packet. It can formulate forwarding policies based on a combination of multiple dimensions such as source IP address, destination IP address, source port, destination port, protocol type, data packet size, interface information, and service type. Then, based on the policy, it selects the corresponding forwarding path, exit interface, or next-hop address for the data packet, thereby achieving fine-grained and personalized traffic scheduling and management.

[0211] 3. Kernel mode completion phase;

[0212] Netfilter callback functions continuously monitor the processing results of the corresponding response queue in the circular buffer queue. Based on the forwarding decisions in user space, they perform actual forwarding operations on data packets, while simultaneously updating the system connection tracking status and WAN-WAN forwarding traffic statistics, thus completing the entire special forwarding process for WAN-WAN data packets.

[0213] Throughout the entire process of WAN-WAN special forwarding processing, the system achieves a forwarding capability of over 80% reduction in forwarding latency and millions of PPS in WAN-WAN scenarios through three major designs: multi-core fragmentation management of the ring buffer queue, synchronization mechanism of lock-free atomic operations, and shared data structure with cache line alignment. At the same time, it saves more than 50% of CPU resources. Moreover, this special forwarding mode is fully compatible with the existing Linux network stack and does not affect the normal operation of the original network functions of the kernel.

[0214] Before forwarding data packets in combinations of LAN-WAN and WAN-LAN regions, the system checks whether the preset region matching rules are successful. If a match is successful, the corresponding QoS policy is applied; otherwise, the standard forwarding process is followed.

[0215] After completing packet forwarding, the system updates information such as "source region ID, destination region ID, and forwarding policy type" to the connection state structure to ensure consistency of the forwarding policy for subsequent packets in the same connection. At the same time, it counts traffic data for each region, including the number of forwarded packets and bytes between regions, and allows users to query regional traffic information through the control interface, which is convenient for network monitoring and maintenance.

[0216] The core advantage of the entire area-aware forwarding decision-making process lies in the absence of additional data structure overhead. It directly parses area information through the interface name suffix, achieving fine-grained forwarding control without affecting the performance of fast packet forwarding.

[0217] In one embodiment, the fast forwarding method for network packets integrated in a zero-patch kernel further includes exporting connection tracing information, that is, exporting connection tracing data from kernel space to user space to provide data support for network monitoring and troubleshooting. The core is to implement formatted storage and paginated querying to avoid low query efficiency due to excessive data volume. The process of exporting connection tracing information may include:

[0218] The connection tracking information is formatted into a readable text format, and paginated query functionality for the connection tracking information is provided through the user-space character device interface.

[0219] During the formatting of connection tracking information, the system extracts the complete connection tracking information from the struct natflow_fastnat_node_t structure of the Fast NAT Connection Table and formats it into a user-readable text format.

[0220] The core information to be exported includes: source IP address, destination IP address, source port, destination port, transport layer protocol type, NAT-translated address and port, connection status, traffic statistics (flow_bytes, flow_packets), connection last activity timestamp, and region attribute information.

[0221] The system organizes text data according to preset field delimiter rules, ensuring that each connection record has a uniform format, making it easy for user space tools to parse and display directly without additional data conversion operations.

[0222] Create a dedicated user-space character device interface to establish a data interaction channel between kernel space and user space.

[0223] The user-space character device interface is implemented based on the Linux character device driver framework and supports standard read / write system calls. Users can access this interface through command-line tools or management programs.

[0224] User space character device interface permissions can be configured as needed. Only authorized administrator accounts can query connection tracking information to prevent sensitive data leakage and ensure network security.

[0225] To avoid problems such as high system resource consumption and slow response caused by querying a large amount of connection data at once, this embodiment implements a paginated query mechanism, the specific process of which is as follows:

[0226] When a user initiates a query request through the conntrackinfo_ctl interface, they can specify the page number to be queried and the number of records per page. The system limits the number of records returned in a single query by default.

[0227] After receiving a query request, the kernel extracts the corresponding range of data from the connection tracking information buffer according to the paging parameters specified by the user, formats it, and returns it to the user space.

[0228] When the amount of connection tracking data is large, users can obtain all records through multiple rounds of pagination queries, which not only ensures query efficiency but also reduces the data transfer overhead between the kernel and user space.

[0229] In this embodiment, a dedicated connection tracking information buffer is maintained in the kernel space to cache connection data to be exported. The specific management strategy is as follows:

[0230] The buffer uses a first-in, first-out update mechanism. When the connection status changes, the system will update the corresponding record in the buffer in real time. Changes in connection status include: new connection record, timeout, traffic update, etc.

[0231] When the buffer capacity reaches a preset threshold, the system will automatically clean up timed-out connection records, free up memory space, and ensure the efficient operation of the buffer.

[0232] It supports manual data synchronization. Administrators can use control commands to force the synchronization of tracking information of all currently active connections to the buffer, thus meeting real-time monitoring requirements.

[0233] This invention provides a fast forwarding method for network packets integrated with a zero-patch kernel. It utilizes the Netfilter hook registration mechanism to register hook functions at key nodes in packet processing. Furthermore, it extends the connection tracking structure within the Linux kernel connection tracking system of the Netfilter framework using the nf_ct_ext_add extension mechanism, adding custom fields to store the fast forwarding status. This allows for seamless integration with the standard kernel without modifying the Linux kernel source code, demonstrating strong compatibility.

[0234] A fast NAT connection table is constructed. The fast NAT connection table is a static hash table that calculates the hash value based on the data packet and realizes O(1) complexity connection lookup through the hash value, thereby greatly shortening the connection status query time.

[0235] When a data packet arrives at the NF_INET_FORWARD registered custom processing function, a hash value is calculated for the data packet. The hash value is then used to look up the corresponding connection node in the Fast NAT connection table. If a valid connection node is found, the header information of the data packet is updated and sent to the target interface. This allows the entire Netfilter processing flow to be skipped, achieving forwarding performance far exceeding traditional solutions with only a single-core processor, significantly breaking through the performance bottleneck of conventional data packet forwarding mechanisms. If no valid connection node is found, connection tracking information is marked and the data packet follows the conventional Netfilter processing flow, implementing a layered processing mechanism of "fast path first, conventional path fallback," balancing performance and functional completeness.

[0236] This invention significantly improves cache hit rate and throughput in multi-core scenarios by aligning the connection state structure to cache lines. It integrates user authentication, traffic control, and URL logging within the fast forwarding path, with all processing completed in kernel space. This eliminates the need to schedule data packets to user space, enabling efficient URL log collection and further improving packet forwarding efficiency. It supports an intelligent forwarding decision mechanism based on network area attributes, executing differentiated forwarding strategies for different area interaction scenarios such as LAN-LAN, LAN-WAN, and WAN-LAN, fully meeting the diverse business needs in complex network environments. It possesses highly reliable service assurance capabilities, seamlessly switching between hardware acceleration and software forwarding paths. In case of hardware malfunction, it can automatically roll back in milliseconds without user awareness, while ensuring the consistency and accuracy of traffic statistics. It provides comprehensive control and query interfaces, supporting paginated retrieval of connection tracking information, providing strong support for network monitoring, maintenance, and rapid fault diagnosis.

[0237] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0238] The following are device embodiments of the present invention. For details not described in detail, please refer to the corresponding method embodiments described above.

[0239] Figure 7 This diagram illustrates the structure of a fast network packet forwarding system with a zero-patch kernel integration according to an embodiment of the present invention. For ease of explanation, only the parts relevant to the embodiment of the present invention are shown, and are described in detail below:

[0240] like Figure 7 As shown, the network packet fast forwarding system integrated in the zero-patch kernel includes: registration module 71, extension module 72, construction module 73, and core forwarding module 74.

[0241] Registration module 71 is used to register hook functions at key nodes in packet processing, thereby obtaining registered custom processing functions;

[0242] Extension module 72 is used to extend the connection tracking structure in the Linux kernel connection tracking system of the Netfilter framework, add custom fields to store fast forwarding status, and achieve zero-patch kernel integration;

[0243] Module 73 is used to construct a fast network address translation (NAT) connection table. The fast NAT connection table is a static hash table that calculates hash values ​​based on data packets and achieves O(1) complexity connection lookup through the hash values.

[0244] The core forwarding module 74 is used to calculate the hash value of the data packet when it arrives at the registered custom processing function, and use the hash value to look up the corresponding connection node in the fast NAT connection table; if a valid connection node is found, the header information of the data packet is updated and sent to the target interface; if no valid connection node is found, the connection tracking information is marked and the data packet is processed by the regular Netfilter process.

[0245] In one possible implementation, the entries of the fast NAT connection table are connection state structures that are cache line aligned according to the size of Symmetric Multiprocessing Cache Line Alignment Unit (SMP_CACHE_BYTES). The connection state structure is divided into a hot data area and a secondary hot data area. The hot data area stores network device pointers, connection activity timestamps, magic numbers, virtual LAN (VLAN) information, source / destination Internet Protocol (IP) addresses, and source / destination ports. The secondary hot data area stores connection statistics, rate data, and user pointers.

[0246] The number of entries in the Fast NAT Connection Table is configured according to the hardware platform, and the Fast NAT Connection Table uses linear probing to handle hash collisions.

[0247] In one possible implementation, when the core forwarding module 74 updates the header information of the data packet and sends it to the target interface if a valid connection node is found, it is used for:

[0248] If the value of the magic field of the node to be matched in the Fast NAT Connection Table is consistent with the system's preset NAT flow path magic number natflow_path_magic constant, and the source IP address, destination IP address, source port, destination port, and transport layer protocol type stored in the node to be matched match one-to-one with the five-tuple information of the data packet to be forwarded, and the difference between the current system timestamp and the last active timestamp recorded in the jiffies field of the node to be matched is less than a preset threshold, then the node to be matched is determined to be a valid connection node, and the header information of the data packet is updated and sent to the target interface.

[0249] In one possible implementation, when the core forwarding module 74 updates the header information of the data packet and sends it to the target interface, it is used to:

[0250] The L2 Ethernet header, L3 IP header, and L4 transport protocol header of the data packet are updated. Specifically, the L2 Ethernet header updates the MAC address and destination MAC address stored in the connection node, the L3 IP header updates the source IP address and destination IP address information after NAT translation stored in the connection node, and the L4 transport protocol header updates the source port information and destination port information after NAT translation stored in the connection node.

[0251] Returns a network filter packet hijacking flag to skip the full Netfilter processing flow.

[0252] In one possible implementation, such as Figure 8 As shown, the network packet fast forwarding system integrated in the zero-patch kernel also includes: a hardware acceleration adaptation module 75;

[0253] The hardware acceleration adaptation module 75 is used to preset a first flag bit and a second flag bit in the status field of the connection status structure. The first flag bit uses a first flag to track the hardware acceleration status of the original direction data packet, and the second flag bit uses a second flag to track the hardware acceleration status of the reply direction data packet.

[0254] After a valid connection node is matched, the status of the corresponding direction flag and the running status of the hardware acceleration module are detected in real time.

[0255] When a hardware acceleration failure is detected, the packet forwarding path is automatically switched to the software path, the hardware acceleration flag in the corresponding direction is cleared, the cause of the failure is recorded, and hardware statistics are updated simultaneously.

[0256] In one possible implementation, such as Figure 8As shown, the network packet fast forwarding system integrated in the zero-patch kernel also includes: a user management module 76 and a URL log module 77;

[0257] User management module 76 is used to identify users based on source IP address, check user authentication status, and perform flow control on authenticated users;

[0258] The URL logging module 77 is used to detect HTTP / HTTPS requests in kernel space, parse the HTTP request header or TLS server name indication SNI information to extract the Uniform Resource Locator (URL), and store the URL information in the log buffer.

[0259] The user management module 76 is also used to execute corresponding Quality of Service (QoS) policies based on user identity, IP address, or port information, in conjunction with traffic control tools.

[0260] In one possible implementation, such as Figure 8 As shown, the network packet fast forwarding system integrated in the zero-patch kernel also includes: a region management module 78;

[0261] When the system starts up, it traverses all network interfaces, parses the network interface name suffix to extract the region identifier ID and region type, constructs a mapping table of interface name-region ID-region type and caches it in the kernel space; the region type includes local area network (LAN) region or wide area network (WAN) region.

[0262] When a data packet arrives at the registered custom processing function, the source network interface name and target network interface name of the data packet are extracted. Based on the mapping table, the corresponding source region ID, source region type, target region ID, and target region type are queried and written into the connection state structure.

[0263] Differentiated forwarding strategies are executed based on the combination of source region type and target region type.

[0264] In one possible implementation, when the region management module 78 executes a differentiated forwarding strategy based on the combination of source region type and target region type, it is used for:

[0265] If the combination relationship is LAN area - LAN area, then the data packet is forwarded directly;

[0266] If the combination relationship is LAN area-WAN area, then perform source network address translation (SNAT) and forward the data packet;

[0267] If the combination relationship is WAN area-LAN area, then the data packet is forwarded after the destination network address translation (DNAT) is performed.

[0268] In one possible implementation, such as Figure 8 As shown, the fast forwarding system for network packets integrated in the zero-patch kernel also includes: a connection tracing information export module 79;

[0269] The connection tracking information export module 79 is used to format the connection tracking information into a readable text format and provide a paginated query function for the connection tracking information through the user space character device interface.

[0270] The above embodiments provide a fast forwarding system for network packets integrated with a zero-patch kernel. The registration module registers hook functions at key nodes in packet processing, and the extension module extends the connection tracking structure in the Linux kernel connection tracking system of the Netfilter framework, adding custom fields to store the fast forwarding status. This allows for seamless integration with the standard kernel without modifying the Linux kernel source code, through the extension mechanism and Netfilter hook registration, resulting in strong compatibility.

[0271] The building module constructs a fast NAT connection table. The fast NAT connection table is a static hash table that calculates hash values ​​based on data packets and achieves O(1) complexity connection lookup through hash values, thereby greatly shortening the connection status query time.

[0272] When a data packet arrives at the registered custom processing function, the core forwarding module calculates a hash value for the packet and uses this hash value to look up the corresponding connection node in the fast NAT connection table. If a valid connection node is found, the packet header information is updated and the packet is sent to the target interface. This allows the entire Netfilter processing flow to be skipped, achieving forwarding performance far exceeding traditional solutions with only a single processor, significantly overcoming the performance bottleneck of conventional packet forwarding mechanisms. If no valid connection node is found, connection tracking information is marked and the packet follows the conventional Netfilter processing flow, implementing a layered processing mechanism of "fast path first, conventional path as a fallback," balancing performance and functional completeness.

[0273] This invention significantly improves cache hit rate and throughput in multi-core scenarios by aligning the connection state structure to cache lines. It integrates user authentication, traffic control, and URL logging within the fast forwarding path, with all processing completed in kernel space. This eliminates the need to schedule data packets to user space, enabling efficient URL log collection and further improving packet forwarding efficiency. It supports an intelligent forwarding decision mechanism based on network area attributes, executing differentiated forwarding strategies for different area interaction scenarios such as LAN-LAN, LAN-WAN, and WAN-LAN, fully meeting the diverse business needs in complex network environments. It possesses highly reliable service assurance capabilities, seamlessly switching between hardware acceleration and software forwarding paths. In case of hardware malfunction, it can automatically roll back in milliseconds without user awareness, while ensuring the consistency and accuracy of traffic statistics. It provides comprehensive control and query interfaces, supporting paginated retrieval of connection tracking information, providing strong support for network monitoring, maintenance, and rapid fault diagnosis.

[0274] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for fast forwarding of network packets integrated with a zero-patch kernel, characterized in that, include: Register hook functions at key nodes in packet processing to obtain custom processing functions, and extend the connection tracking structure in the Linux kernel connection tracking system of the Netfilter framework by adding custom fields to store fast forwarding status, achieving zero-patch kernel integration; Construct a fast network address translation (NAT) connection table, which is a static hash table that calculates hash values ​​based on data packets and achieves O(1) complexity connection lookup through the hash values; When a data packet arrives at the registered custom processing function, a hash value is calculated for the data packet, and the corresponding connection node is found in the fast NAT connection table using the hash value; If a valid connection node is found, the header information of the data packet is updated and sent to the target interface; If no valid connection node is found, the connection tracking information is marked and the data packet is processed according to the normal Netfilter process; Updating the header information of the data packet and sending it to the target interface includes: Update the L2 Ethernet header, L3 IP header, and L4 transport protocol header of the data packet. Specifically, update the source MAC address and destination MAC address stored in the connection node in the L2 Ethernet header, update the source IP address and destination IP address information after NAT translation stored in the connection node in the L3 IP header, and update the source port information and destination port information after NAT translation stored in the connection node in the L4 transport protocol header. Return the network filter packet hijacking flag to skip the complete Netfilter processing flow.

2. The fast forwarding method for network packets integrated with a zero-patch kernel according to claim 1, characterized in that, The entries in the Fast NAT Connection Table are connection state structures that are cache line aligned according to the size of Symmetric Multiprocessing Cache Line Alignment Unit (SMP_CACHE_BYTES). The connection state structure is divided into a hot data area and a secondary hot data area. The hot data area stores network device pointers, connection activity timestamps, magic numbers, virtual LAN (VLAN) information, source / destination Internet Protocol (IP) addresses, and source / destination ports. The secondary hot data area stores connection statistics, rate data, and user pointers. The number of entries in the Fast NAT Connection Table is configured according to the hardware platform, and the Fast NAT Connection Table uses linear probing to handle hash collisions.

3. The fast forwarding method for network packets integrated with a zero-patch kernel according to claim 2, characterized in that, If a valid connection node is found, the header information of the data packet is updated and sent to the target interface, including: If the value of the magic field of the node to be matched in the Fast NAT Connection Table is consistent with the system's preset NAT flow path magic number natflow_path_magic constant, and the source IP address, destination IP address, source port, destination port, and transport layer protocol type stored in the node to be matched match one-to-one with the five-tuple information of the data packet to be forwarded, and the difference between the current system timestamp and the last active timestamp recorded in the jiffies field of the node to be matched is less than a preset threshold, then the node to be matched is determined to be a valid connection node, and the header information of the data packet is updated and sent to the target interface.

4. The fast forwarding method for network packets integrated with a zero-patch kernel according to claim 2 or 3, characterized in that, Also includes: The status field of the connection status structure is preset with a first flag bit and a second flag bit. The first flag bit uses a first flag to track the hardware acceleration status of the original direction data packet, and the second flag bit uses a second flag to track the hardware acceleration status of the reply direction data packet. After a valid connection node is matched, the status of the corresponding direction flag and the running status of the hardware acceleration module are detected in real time. When a hardware acceleration failure is detected, the packet forwarding path is automatically switched to the software path, the hardware acceleration flag in the corresponding direction is cleared, the cause of the failure is recorded, and hardware statistics are updated simultaneously.

5. The fast forwarding method for network packets integrated with a zero-patch kernel according to any one of claims 1-3, characterized in that, Also includes: Users are identified based on their source IP address, their authentication status is checked, and flow control is performed on authenticated users. In kernel space, detect HTTP / HTTPS requests, parse HTTP request headers or TLS server name indices (SNI) information to extract Uniform Resource Locators (URLs), and store the URL information in the log buffer. Based on user identity, IP address, or port information, and in conjunction with traffic control tools, the corresponding Quality of Service (QoS) policy is executed.

6. The fast forwarding method for network packets integrated with a zero-patch kernel according to any one of claims 1-3, characterized in that, Also includes: When the system starts up, it traverses all network interfaces, parses the network interface name suffix to extract the region identifier ID and region type, constructs a mapping table of interface name-region ID-region type and caches it in the kernel space; the region type includes local area network (LAN) region or wide area network (WAN) region. When a data packet arrives at the registered custom processing function, the source network interface name and target network interface name of the data packet are extracted. Based on the mapping table, the corresponding source region ID, source region type, target region ID, and target region type are queried and written into the connection state structure. Differentiated forwarding strategies are executed based on the combination of source region type and target region type.

7. The fast forwarding method for network packets integrated with a zero-patch kernel according to claim 6, characterized in that, The execution of differentiated forwarding strategies based on the combination of source region type and target region type includes: If the combination relationship is LAN area - LAN area, then the data packet is forwarded directly; If the combination relationship is LAN area-WAN area, then perform source network address translation (SNAT) and forward the data packet; If the combination relationship is WAN area-LAN area, then the data packet is forwarded after the destination network address translation (DNAT) is performed.

8. The method for fast forwarding of network packets integrated with a zero-patch kernel according to any one of claims 1-3, characterized in that, Also includes: The connection tracking information is formatted into a readable text format, and a paginated query function for the connection tracking information is provided through the user-space character device interface.

9. A fast network packet forwarding system integrated with a zero-patch kernel, characterized in that, include: The registration module is used to register hook functions at key nodes in packet processing, thereby obtaining registered custom processing functions; An extension module for extending the connection tracing structure in the Linux kernel connection tracing system of the Netfilter framework, adding custom fields to store fast forwarding status, and achieving zero-patch kernel integration; The building module is used to build a fast NAT connection table, which is a static hash table that calculates hash values ​​based on data packets and achieves O(1) complexity connection lookup through the hash values; The core forwarding module is used to calculate the hash value of the data packet when it arrives at the registered custom processing function, and then use the hash value to look up the corresponding connection node in the fast NAT connection table. If a valid connection node is found, the header information of the data packet is updated and sent to the target interface; If no valid connection node is found, the connection tracking information is marked and the data packet is processed according to the normal Netfilter process; When the core forwarding module updates the header information of the data packet and sends it to the target interface, it is used for: The L2 Ethernet header, L3 IP header, and L4 transport protocol header of the data packet are updated. Specifically, the L2 Ethernet header updates the source MAC address and destination MAC address stored in the connection node, the L3 IP header updates the source IP address and destination IP address information after NAT translation stored in the connection node, and the L4 transport protocol header updates the source port information and destination port information after NAT translation stored in the connection node. Returns a network filter packet hijacking flag to skip the full Netfilter processing flow.

Images