WO2020151030A1 - 一种处理数据报文的方法和装置 - Google Patents

一种处理数据报文的方法和装置 Download PDF

Info

Publication number
WO2020151030A1
WO2020151030A1 PCT/CN2019/074461 CN2019074461W WO2020151030A1 WO 2020151030 A1 WO2020151030 A1 WO 2020151030A1 CN 2019074461 W CN2019074461 W CN 2019074461W WO 2020151030 A1 WO2020151030 A1 WO 2020151030A1
Authority
WO
WIPO (PCT)
Prior art keywords
target data
data message
target
load balancing
processing
Prior art date
Application number
PCT/CN2019/074461
Other languages
English (en)
French (fr)
Inventor
杨光
马涛
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to EP19911953.8A priority Critical patent/EP3913893A4/en
Priority to US17/423,487 priority patent/US20220078120A1/en
Publication of WO2020151030A1 publication Critical patent/WO2020151030A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/12—Avoiding congestion; Recovering from congestion
    • H04L47/125—Avoiding congestion; Recovering from congestion by balancing the load, e.g. traffic engineering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1004—Server selection for load balancing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/02—Protocol performance
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/161—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses

Definitions

  • the present invention relates to the technical field of data transmission, in particular to a method and device for processing data messages.
  • the CDN system usually adopts the deployment of server clusters to process the four-layer business processing on the CDN nodes, and usually deploys load balancing equipment with traffic scheduling and distribution functions that work at the transport layer on each CDN node, thereby reducing the business traffic Balanced distribution in the server cluster.
  • the netfilter framework provides a complete set of hook function management mechanisms, such as packet filtering, network address translation (NAT, Network Address Translation), and connection tracking based on protocol types.
  • KO plug-in is loaded into the netfilter framework.
  • Linux virtual servers (LVS, Linux Virtual Server) are generally deployed on load balancing equipment to achieve load balancing of business traffic in the server cluster.
  • the LVS works in the kernel mode and can be based on the netfilter framework of the kernel firewall.
  • the plug-in method realizes the above-mentioned load balancing function.
  • LVS needs to pass the message to the kernel protocol stack.
  • the resulting message copy and a large number of processing procedures in the kernel protocol stack will occupy a large amount of processing performance of the entire load balancing device and greatly affect business traffic. Processing efficiency;
  • due to the great coupling between LVS and the kernel the process of maintenance and processing such as upgrades and replacements is more complicated and cumbersome.
  • the embodiments of the present invention provide a method and device for processing data packets.
  • the technical solution is as follows:
  • a method for processing data packets including:
  • the load balancing device receives the target data message, performs protocol stack processing on the target data message based on the user mode protocol stack, and determines the target protocol type of the target data message;
  • the load balancing device performs scheduling processing on the target data message through the scheduling processing function corresponding to the target protocol type registered in the user mode netfilter framework;
  • the load balancing device performs forwarding or response processing on the target data packet based on the result of the scheduling processing.
  • the method further includes:
  • the load balancing device performs protection processing on the target data message through the message protection function corresponding to the target protocol type registered in the user mode netfilter framework;
  • the load balancing device discards the target data message.
  • the scheduling processing of the target data message includes:
  • the load balancing device When the target protocol type is TCP or UDP, the load balancing device performs scheduling processing on the target data message according to the quintuple information of the target data message;
  • the load balancing device constructs a response message of the target data message according to a preset pickup rule.
  • the load balancing device performs scheduling processing on the target data message according to the quintuple information of the target data message, including:
  • the load balancing device searches whether there is a target session table entry corresponding to the quintuple information of the target data packet locally;
  • the load balancing device determines the target back-end server recorded in the target session entry as the dispatch destination device of the target data packet;
  • the load balancing device determines the scheduling destination device of the target data packet according to a preset scheduling algorithm.
  • the load balancing device determines the scheduling destination device of the target data packet according to a preset scheduling algorithm, including:
  • the load balancing device determines the target data packet according to the preset scheduling algorithm of the target configuration service The scheduling destination device of the message, otherwise the target data message is discarded.
  • the method further includes:
  • the load balancing device parses the target data message through the ARP processing function registered in the user-mode netfilter framework, and establishes neighbor table entries and routing table entries.
  • the method further includes:
  • the load balancing device inputs the target data message into the kernel protocol stack through the KNI channel based on the shared memory mode of the ring queue.
  • the method further includes:
  • the load balancing device binds the protocol stack address of the user mode protocol stack to the message receiving port, so as to process the received data message of the message receiving port through the user mode protocol stack.
  • an apparatus for processing data packets includes:
  • a message receiving module configured to receive a target data message, perform protocol stack processing on the target data message based on the user mode protocol stack, and determine the target protocol type of the target data message;
  • a load balancing module configured to perform scheduling processing on the target data message through the scheduling processing function corresponding to the target protocol type registered in the user mode netfilter framework;
  • the message scheduling module is configured to perform forwarding or response processing on the target data message based on the result of the scheduling processing.
  • the device further includes a message protection module for:
  • the target data message is discarded.
  • the load balancing module is specifically used for:
  • the target protocol type is TCP or UDP
  • a response message of the target data message is constructed through a preset pickup rule.
  • the load balancing module is specifically used for:
  • the scheduling destination device of the target data packet is determined according to a preset scheduling algorithm.
  • the load balancing module is specifically used for:
  • the scheduling target device of the target data message is determined according to the preset scheduling algorithm of the target configuration service , Otherwise discard the target data message.
  • the load balancing module is also used for:
  • the ARP processing function registered in the user-mode netfilter framework is used to parse the target data message, and establish neighbor entries and routing entries.
  • the device further includes a kernel interaction module for:
  • the target data message is input into the kernel protocol stack through the KNI channel through the shared memory mode based on the ring queue.
  • the device further includes a protocol stack binding module for:
  • a load balancing device in a third aspect, includes a processor and a memory.
  • the memory stores at least one instruction, at least one program, code set, or instruction set.
  • the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the method for processing a data message as described in the first aspect.
  • a computer-readable storage medium stores at least one instruction, at least one program, code set, or instruction set, the at least one instruction, the at least one program, and the code
  • the set or instruction set is loaded and executed by the processor to implement the method for processing a data message as described in the first aspect.
  • the load balancing device receives the target data message, performs protocol stack processing on the target data message based on the user mode protocol stack, and determines the target protocol type of the target data message; the load balancing device passes through the user mode netfilter framework
  • the scheduling processing function corresponding to the registered target protocol type performs scheduling processing on the target data message; the load balancing device performs forwarding or response processing on the target data message based on the result of the scheduling processing.
  • the load balancing device implements data message processing through the user-mode netfilter framework, reducing the dependence of the message processing process on the kernel mode, reducing the processing frequency of message copying, and saving the processing performance consumption of the load balancing device. At the same time, it is more convenient and simpler to upgrade and replace the processing flow of the data message.
  • FIG. 1 is a schematic diagram of a scenario for processing data packets according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for processing data packets according to an embodiment of the present invention
  • Figure 3 is a structural diagram of an apparatus for processing data packets provided by an embodiment of the present invention.
  • Figure 4 is a structural diagram of an apparatus for processing data packets provided by an embodiment of the present invention.
  • Figure 5 is a structural diagram of an apparatus for processing data packets provided by an embodiment of the present invention.
  • FIG. 6 is a structural diagram of an apparatus for processing data packets according to an embodiment of the present invention.
  • Fig. 7 is a schematic structural diagram of a load balancing device provided by an embodiment of the present invention.
  • the embodiment of the present invention provides a method for processing data messages, which can be applied to load balancing equipment, where the load balancing equipment may be used in a server cluster (such as a CDN system) to guide business traffic, in a server cluster A device for load balancing.
  • the load balancing device can be connected to the core switch of the server cluster. After reaching the core switch, data packets can be dispatched and processed by the load balancing device before being transmitted back to the server cluster by the core switch.
  • the load balancing device can build a data message processing flow based on DPDK (Data Plane Development Kit) technology, so that high-performance message processing can be realized in the user mode.
  • DPDK Data Plane Development Kit
  • the above-mentioned load balancing device may include a processor, a memory, and a transceiver.
  • the processor may be used to execute the following process of processing data packets.
  • the memory may be used to store the data required and generated during the following processing.
  • the transceiver may Used to receive and send related data in the following processing.
  • the server cluster is the back-end service cluster of each CDN node as an example for description. Other clusters are similar to this, and the necessary parts will be specifically described.
  • Step 201 The load balancing device receives the target data message, performs protocol stack processing on the target data message based on the user mode protocol stack, and determines the target protocol type of the target data message.
  • the core switch of the CDN node can first send the target data message to the load balancing device connected to the core switch based on the dynamic routing mechanism.
  • the load balancing device can receive the target data message sent by the core switch, and then use the message reading and writing mechanism such as UIO (User Space I/O, I/O technology running in the user space) to input the message into the preset user
  • UIO User Space I/O, I/O technology running in the user space
  • the user-mode protocol stack can then perform protocol stack processing on the target data message through the user mode protocol stack.
  • the load balancing device can view the quintuple information of the target data message to determine the target protocol type to which the target data message belongs.
  • the load balancing device can also process ARP (Address Resolution Protocol) messages in the user mode.
  • ARP Address Resolution Protocol
  • the following processing may exist:
  • the target protocol type is ARP
  • load balancing The device parses the target data packet through the ARP processing function registered in the user-mode netfilter framework, and establishes neighbor entries and routing entries.
  • the load balancing device determines that the target protocol type of the target data message is ARP, it can analyze the target data message through the ARP processing function registered in the user-mode netfilter framework, and add ARP entries based on the analysis results , Establish neighbor table entries and routing table entries, and prepare for message forwarding in user mode. After that, the load balancing device can also process the parsed target data message in the kernel mode through the kernel protocol stack.
  • the load balancing device can use the KNI (Kernel Interface) channel to hand over the non-business packet to the kernel state for processing.
  • KNI Kernel Interface
  • the following processing can exist after step 201: If the target data packet is a non-business packet , The load balancing device inputs the target data message into the kernel protocol stack through the KNI channel based on the shared memory mode of the ring queue.
  • the load balancing device after the load balancing device receives the target data message, if the target data message is a non-business message, it can use the shared memory method to load the target data message into the kernel state through the KNI channel.
  • the data message enters the kernel protocol stack.
  • the shared memory here can be organized in the form of a circular queue, and the read and write processing of data messages in the circular queue is realized through the Read pointer and the Write pointer.
  • the shared memory method can also be used to return the processed target data message to the user state through the KNI channel.
  • Step 202 The load balancing device performs scheduling processing on the target data message through the scheduling processing function corresponding to the target protocol type registered in the user mode netfilter framework.
  • the load balancing device may be pre-configured with a user-mode netfilter framework, and the netfilter framework may be pre-registered with scheduling processing functions corresponding to multiple protocol types. After the load balancing device determines the target protocol type of the target data message, it can perform scheduling processing on the target data message through the scheduling processing function corresponding to the target protocol type registered in the user-mode netfilter framework.
  • the load balancing device may perform protection processing on the received data message before dispatching the data message to prevent the back-end server cluster from being attacked by malicious messages. Accordingly, the following processing may exist before step 202: Load The balancing device protects the target data message through the message protection function corresponding to the target protocol type registered in the user-mode netfilter framework; if the target data message is detected as a malicious message, the load balancing device discards the target data message .
  • the user-mode netfilter framework deployed on the load balancing device can also pre-register the message protection functions corresponding to different protocol types.
  • the different message protection functions are independent of each other and are registered in the form of plug-ins.
  • the hook function implements dynamic loading and unloading in the netfilter framework.
  • Message protection functions can include at least TCP (Transmission Control Protocol) protection functions (which can further include SYN FLOOD protection functions, ACK FLOOD protection functions, and HTTP FLOOD protection functions), UDP (User Datagram Protocol, User Datagram Protocol) protection Function and ICMP (Internet Control Message Protocol, Internet Control Protocol) protection function.
  • TCP Transmission Control Protocol
  • SYN FLOOD protection functions SYN FLOOD protection functions
  • ACK FLOOD protection functions ACK FLOOD protection functions
  • HTTP FLOOD protection functions HTTP FLOOD protection functions
  • UDP User Datagram Protocol
  • ICMP Internet Control Message Protocol, Internet Control Protocol
  • the load balancing device after the load balancing device determines the target protocol type of the target data message, it can first perform protection processing on the target data message through the message protection function corresponding to the target protocol type registered in the user-mode netfilter framework. Specifically, the load balancing device can perform detection and protection logic processing on target data messages, such as message characteristics, protocol characteristics, and message statistics, respectively, through message protection functions, to complete DDoS attack detection and protection processing. After the processing is completed, if the target data message is detected as a malicious message, the load balancing device can discard the target data message, and if the target data message is a normal message, the load balancing device can perform execution on the target data message Follow-up processing.
  • target data messages such as message characteristics, protocol characteristics, and message statistics, respectively, through message protection functions
  • the protocol stack type for the data message may mainly include TCP messages, UDP messages and ICMP messages.
  • the scheduling processing of the target data message in step 202 may be specifically as follows: When the target protocol type is In the case of TCP or UDP, the load balancing device performs scheduling processing on the target data message according to the 5-tuple information of the target data message; when the target protocol type is ICMP, the load balancing device constructs the target data according to the preset pickup rules The response message of the message.
  • the load balancing device can call the scheduling processing function corresponding to TCP or UDP registered in the user-mode netfilter framework to perform the following processing, namely load balancing
  • the device can first obtain the quintuple information of the target data message (including destination address/destination port/source address/source port/protocol type), and then schedule the target data message according to the quintuple information of the target data message .
  • the load balancing device can call the scheduling processing function corresponding to the ICMP registered in the user mode netfilter framework, and directly construct the target data message according to the preset pickup rules Response message.
  • the load balancing device finds the local Whether there is a target session table entry corresponding to the quintuple information of the target data packet; if so, the load balancing device will determine the target back-end server recorded in the target session table entry as the dispatch destination device of the target data packet; if not If it exists, the load balancing device determines the scheduling destination device of the target data packet according to the preset scheduling algorithm.
  • the load balancing device may first find out whether the target session entry corresponding to the quintuple information of the target data message already exists locally. If there is a target session entry, the load balancing device can schedule the target data packet according to the target session entry, that is, the target back-end server recorded in the target session entry is determined as the scheduling destination device of the target data packet. Update the session information in the session table entry. If there is no target session entry, the load balancing device can determine the scheduling destination device of the target data packet according to a preset scheduling algorithm, and create a session entry corresponding to the five-tuple of the target data packet.
  • the processing of determining the scheduling destination device according to the preset scheduling algorithm can be as follows: There is a target configuration service corresponding to the quintuple information of the target data message in the configuration service table, and the load balancing device determines the scheduling destination device of the target data message according to the preset scheduling algorithm of the target configuration service, otherwise the target data message is discarded Text.
  • the load balancing device can first determine whether the quintuple information of the target data packet exists in the locally pre-stored configuration service table The corresponding target configuration service can be specifically searched based on the destination address, destination port, and protocol type in the quintuple. If there is a target configuration service, the load balancing device can determine the scheduling destination device of the target data packet according to the preset scheduling algorithm of the target configuration service, and create a session table entry corresponding to the quintuple information of the target data packet; if If there is no target configuration server, the load balancing device can directly discard the target data packet.
  • Step 203 The load balancing device performs forwarding or response processing on the target data packet based on the result of the scheduling processing.
  • the device network card may perform forwarding processing on the target data message or perform response processing on the target data message.
  • the load balancing device can modify the destination IP of the target data message, and transmit the target data message to any server in the back-end server cluster via the core switch; for response processing, the load balancing device can directly pass the core switch The response message of the target data message is fed back to the sender of the target data message.
  • the load balancing device can load the data message into the user mode for processing by binding the protocol stack address and the port of the device.
  • the corresponding processing can be as follows: the load balancing device combines the protocol stack address of the user mode protocol stack with The message receiving port is bound to process the data message received by the message receiving port through the user mode protocol stack.
  • the load balancing device may bind the protocol stack address of the user mode protocol stack with the message receiving port of the device, and associate the message processing flow with the above protocol stack address. In this way, after the load balancing device receives the data message through the message receiving port, the data message can be directly input to the user mode protocol stack, and the data message can be processed according to the message processing flow associated with the protocol stack address of the user mode protocol stack. Perform specific processing.
  • the load balancing device receives the target data message, performs protocol stack processing on the target data message based on the user mode protocol stack, and determines the target protocol type of the target data message; the load balancing device passes through the user mode netfilter framework
  • the scheduling processing function corresponding to the registered target protocol type performs scheduling processing on the target data message; the load balancing device performs forwarding or response processing on the target data message based on the result of the scheduling processing.
  • the load balancing device implements data message processing through the user-mode netfilter framework, reducing the dependence of the message processing process on the kernel mode, reducing the processing frequency of message copying, and saving the processing performance consumption of the load balancing device. At the same time, it is more convenient and simpler to upgrade and replace the processing flow of the data message.
  • an embodiment of the present invention also provides an apparatus for processing data packets. As shown in FIG. 3, the apparatus includes:
  • the message receiving module 301 is configured to receive a target data message, perform protocol stack processing on the target data message based on the user mode protocol stack, and determine the target protocol type of the target data message;
  • the load balancing module 302 is configured to perform scheduling processing on the target data message through the scheduling processing function corresponding to the target protocol type registered in the user mode netfilter framework;
  • the message scheduling module 303 is configured to perform forwarding or response processing on the target data message based on the result of the scheduling processing.
  • the device further includes a message protection module 304 for:
  • the target data message is discarded.
  • the load balancing module 302 is specifically configured to:
  • the target protocol type is TCP or UDP
  • a response message of the target data message is constructed through a preset pickup rule.
  • the load balancing module 302 is specifically configured to:
  • the scheduling destination device of the target data packet is determined according to a preset scheduling algorithm.
  • the load balancing module 302 is specifically configured to:
  • the scheduling target device of the target data message is determined according to the preset scheduling algorithm of the target configuration service , Otherwise discard the target data message.
  • the load balancing module 302 is further configured to:
  • the ARP processing function registered in the user-mode netfilter framework is used to parse the target data message, and establish neighbor entries and routing entries.
  • the device further includes a kernel interaction module 305 for:
  • the target data message is input into the kernel protocol stack through the KNI channel through the shared memory mode based on the ring queue.
  • the device further includes a protocol stack binding module 306, configured to:
  • the load balancing device receives the target data message, performs protocol stack processing on the target data message based on the user mode protocol stack, and determines the target protocol type of the target data message; the load balancing device passes through the user mode netfilter framework
  • the scheduling processing function corresponding to the registered target protocol type performs scheduling processing on the target data message; the load balancing device performs forwarding or response processing on the target data message based on the result of the scheduling processing.
  • the load balancing device implements data message processing through the user-mode netfilter framework, reducing the dependence of the message processing process on the kernel mode, reducing the processing frequency of message copying, and saving the processing performance consumption of the load balancing device. At the same time, it is more convenient and simpler to upgrade and replace the processing flow of the data message.
  • the apparatus for processing data messages provided in the above embodiments only uses the division of the above functional modules for illustration when processing data messages.
  • the above function can be allocated to different functions according to needs.
  • the function module is completed, that is, the internal structure of the device is divided into different function modules to complete all or part of the functions described above.
  • the apparatus for processing a data message provided by the above-mentioned embodiment belongs to the same concept as the embodiment of the method for processing a data message. For the specific implementation process, please refer to the method embodiment, which will not be repeated here.
  • Fig. 7 is a schematic structural diagram of a load balancing device provided by an embodiment of the present invention.
  • the load balancing device 700 may have relatively large differences due to different configurations or performances, and may include one or more central processing units 722 (for example, one or more processors) and a memory 732, and one or more storage application programs 742 Or a storage medium 730 for data 744 (for example, one or a storage device with a large amount of storage).
  • the memory 732 and the storage medium 730 may be short-term storage or persistent storage.
  • the program stored in the storage medium 730 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the load balancing device 700.
  • the central processing unit 722 may be configured to communicate with the storage medium 730, and execute a series of instruction operations in the storage medium 730 on the load balancing device 700.
  • the load balancing device 700 may also include one or more power supplies 729, one or more wired or wireless network interfaces 750, one or more input and output interfaces 758, one or more keyboards 756, and/or, one or more operations System 741, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.
  • one or more operations System 741 such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.
  • the load balancing device 700 may include a memory, and one or more programs, where one or more programs are stored in the memory and configured to be executed by one or more processors. Perform the above instructions for processing data messages.
  • the program can be stored in a computer-readable storage medium.
  • the storage medium mentioned can be a read-only memory, a magnetic disk or an optical disk, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了一种处理数据报文的方法和装置，属于数据传输技术领域。所述方法包括：负载均衡设备接收目标数据报文，基于用户态协议栈对所述目标数据报文执行协议栈处理，并确定所述目标数据报文的目标协议类型；所述负载均衡设备通过用户态netfilter框架中注册的所述目标协议类型对应的调度处理函数，对所述目标数据报文进行调度处理；所述负载均衡设备基于所述调度处理的结果，对所述目标数据报文执行转发或者响应处理。采用本发明，减轻了报文处理流程对内核态的依赖，降低了报文拷贝的处理频率，从而节省了负载均衡设备的处理性能消耗，同时，对于数据报文的处理流程的升级替换等维护处理也更为方便、简单。

Description

一种处理数据报文的方法和装置 技术领域
本发明涉及数据传输技术领域，特别涉及一种处理数据报文的方法和装置。
背景技术
CDN系统中通常采用服务器集群的部署方式来处理CDN节点上的四层业务处理，并通常在每个CDN节点上部署工作在传输层的具备流量调度和分发功能负载均衡设备，从而将业务流量在服务器集群中均衡分配。
netfilter框架作为一个通用的、抽象的框架，通过其提供的一整套的hook函数的管理机制，诸如数据包过滤、网络地址转换(NAT，Network Address Translation)和基于协议类型的连接跟踪等功能可以以KO插件的方式加载至netfilter框架中。目前，负载均衡设备上一般会部署Linux虚拟服务器(即LVS，Linux Virtual Server)，以实现业务流量在服务器集群内的负载均衡，该LVS工作在内核态，可以基于内核防火墙的netfilter框架，以KO插件的方式实现上述负载均衡功能。
在实现本发明的过程中，发明人发现现有技术至少存在以下问题：
LVS的处理逻辑需要将报文传递至内核协议栈，由此带来的报文拷贝以及内核协议栈内大量的处理流程，将会占用整台负载均衡设备大量的处理性能，大幅影响业务流量的处理效率；同时，由于LVS跟内核耦合性很大，升级、替换等维护处理的过程较为复杂、繁琐。
发明内容
为了解决现有技术的问题，本发明实施例提供了一种处理数据报文的方法和装置。所述技术方案如下：
第一方面，提供了一种处理数据报文的方法，所述方法包括：
负载均衡设备接收目标数据报文，基于用户态协议栈对所述目标数据报文执行协议栈处理，并确定所述目标数据报文的目标协议类型；
所述负载均衡设备通过用户态netfilter框架中注册的所述目标协议类型对应的调度处理函数，对所述目标数据报文进行调度处理；
所述负载均衡设备基于所述调度处理的结果，对所述目标数据报文执行转发或者响应处理。
可选的，所述负载均衡设备通过用户态netfilter框架中注册的所述目标协议类型对应的调度处理函数，对所述目标数据报文进行调度处理之前，还包括：
所述负载均衡设备通过用户态netfilter框架中注册的所述目标协议类型对应的报文防护函数，对所述目标数据报文进行防护处理；
如果检测出所述目标数据报文为恶意报文，所述负载均衡设备则丢弃所述目标数据报文。
可选的，所述对所述目标数据报文进行调度处理，包括：
当所述目标协议类型为TCP或UDP时，所述负载均衡设备根据所述目标数据报文的五元组信息，对所述目标数据报文进行调度处理；
当所述目标协议类型为ICMP时，所述负载均衡设备通过预设的代答规则，构造所述目标数据报文的响应报文。
可选的，所述负载均衡设备根据所述目标数据报文的五元组信息，对所述目标数据报文进行调度处理，包括：
所述负载均衡设备查找本地是否存在所述目标数据报文的五元组信息对应的目标会话表项；
如果存在，所述负载均衡设备则将所述目标会话表项中记录的目标后端服务器确定为所述目标数据报文的调度目的设备；
如果不存在，所述负载均衡设备则根据预设的调度算法确定所述目标数据报文的调度目的设备。
可选的，所述负载均衡设备则根据预设的调度算法确定所述目标数据报文的调度目的设备，包括：
如果本地预存的配置服务表中存在所述目标数据报文的五元组信息对应的目标配置服务，所述负载均衡设备则根据预设的所述目标配置服务的调度算法确定所述目标数据报文的调度目的设备，否则丢弃所述目标数据报文。
可选的，所述确定所述目标数据报文的目标协议类型之后，还包括：
当所述目标协议类型为ARP时，所述负载均衡设备通过用户态netfilter框 架中注册的ARP处理函数，解析所述目标数据报文，建立邻居表项和路由表项。
可选的，所述确定所述目标数据报文的目标协议类型之后，还包括：
如果所述目标数据报文为非业务报文，所述负载均衡设备则基于环形队列的共享内存方式将所述目标数据报文通过KNI通道输入内核协议栈。
可选的，所述方法还包括：
所述负载均衡设备将所述用户态协议栈的协议栈地址与报文接收端口绑定，以通过所述用户态协议栈处理所述报文接收端口的接收到的数据报文。
第二方面，提供了一种处理数据报文的装置，所述装置包括：
报文接收模块，用于接收目标数据报文，基于用户态协议栈对所述目标数据报文执行协议栈处理，并确定所述目标数据报文的目标协议类型；
负载均衡模块，用于通过用户态netfilter框架中注册的所述目标协议类型对应的调度处理函数，对所述目标数据报文进行调度处理；
报文调度模块，用于基于所述调度处理的结果，对所述目标数据报文执行转发或者响应处理。
可选的，所述装置还包括报文防护模块，用于：
通过用户态netfilter框架中注册的所述目标协议类型对应的报文防护函数，对所述目标数据报文进行防护处理；
如果检测出所述目标数据报文为恶意报文，则丢弃所述目标数据报文。
可选的，所述负载均衡模块，具体用于：
当所述目标协议类型为TCP或UDP时，根据所述目标数据报文的五元组信息，对所述目标数据报文进行调度处理；
当所述目标协议类型为ICMP时，通过预设的代答规则，构造所述目标数据报文的响应报文。
可选的，所述负载均衡模块，具体用于：
查找本地是否存在所述目标数据报文的五元组信息对应的目标会话表项；
如果存在，则将所述目标会话表项中记录的目标后端服务器确定为所述目标数据报文的调度目的设备；
如果不存在，则根据预设的调度算法确定所述目标数据报文的调度目的设备。
可选的，所述负载均衡模块，具体用于：
如果本地预存的配置服务表中存在所述目标数据报文的五元组信息对应的目标配置服务，则根据预设的所述目标配置服务的调度算法确定所述目标数据报文的调度目的设备，否则丢弃所述目标数据报文。
可选的，所述负载均衡模块，还用于：
当所述目标协议类型为ARP时，通过用户态netfilter框架中注册的ARP处理函数，解析所述目标数据报文，建立邻居表项和路由表项。
可选的，所述装置还包括内核交互模块，用于：
如果所述目标数据报文为非业务报文，则基于环形队列的共享内存方式将所述目标数据报文通过KNI通道输入内核协议栈。
可选的，所述装置还包括协议栈绑定模块，用于：
将所述用户态协议栈的协议栈地址与报文接收端口绑定，以通过所述用户态协议栈处理所述报文接收端口的接收到的数据报文。
第三方面，提供了一种负载均衡设备，所述负载均衡设备包括处理器和存储器，所述存储器中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由所述处理器加载并执行以实现如第一方面所述的处理数据报文的方法。
第四方面，提供了一种计算机可读存储介质，所述存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由处理器加载并执行以实现如第一方面所述的处理数据报文的方法。
本发明实施例提供的技术方案带来的有益效果是：
本发明实施例中，负载均衡设备接收目标数据报文，基于用户态协议栈对目标数据报文执行协议栈处理，并确定目标数据报文的目标协议类型；负载均衡设备通过用户态netfilter框架中注册的目标协议类型对应的调度处理函数，对目标数据报文进行调度处理；负载均衡设备基于调度处理的结果，对目标数据报文执行转发或者响应处理。这样，负载均衡设备通过用户态的netfilter框架实 现数据报文的处理，减轻了报文处理流程对内核态的依赖，降低了报文拷贝的处理频率，从而节省了负载均衡设备的处理性能消耗，同时，对于数据报文的处理流程的升级替换等维护处理也更为方便、简单。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例提供的一种处理数据报文的场景示意图；
图2是本发明实施例提供的一种处理数据报文的方法流程图；
图3是本发明实施例提供的一种处理数据报文的装置结构图；
图4是本发明实施例提供的一种处理数据报文的装置结构图；
图5是本发明实施例提供的一种处理数据报文的装置结构图；
图6是本发明实施例提供的一种处理数据报文的装置结构图；
图7是本发明实施例提供的一种负载均衡设备的结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
本发明实施例提供了一种处理数据报文的方法，该方法可以运用在负载均衡设备上，其中，负载均衡设备可以是服务器集群(如CDN系统)中用于引导业务流量，在服务器集群中实现负载均衡的设备。如图1所示，负载均衡设备可以与服务器集群的核心交换机相连，数据报文可以在到达核心交换机后，先经负载均衡设备进行调度处理，然后再由核心交换机传回服务器集群。负载均衡设备可以基于DPDK(Data Plane Development Kit，数据平面开发套件)技术构建数据报文的处理流程，从而可以在用户态实现高性能的报文处理。上述负载均衡设备可以包括处理器、存储器、收发器，处理器可以用于执行下述处理数据报文的流程，存储器可以用于存储下述处理过程中需要的数据以及产生的数据，收发器可以用于接收和发送下述处理过程中的相关数据。本实施例中以 服务器集群为每个CDN节点的后端服务集群为例进行说明，其它集群与之类似，必要处将会具体说明。
下面将结合具体实施方式，对图2所示的处理流程进行详细的说明，内容可以如下：
步骤201，负载均衡设备接收目标数据报文，基于用户态协议栈对目标数据报文执行协议栈处理，并确定目标数据报文的目标协议类型。
在实施中，目标数据报文到达CDN节点的核心交换机后，CDN节点的核心交换机可以基于动态路由机制，先将目标数据报文发送给与核心交换机相连的负载均衡设备。这样，负载均衡设备可以接收核心交换机发送的目标数据报文，然后采用UIO(UserSpace I/O，运行在用户空间的I/O技术)等报文读写机制，将报文输入预设的用户态协议栈，进而可以通过该用户态协议栈对目标数据报文执行协议栈处理，同时，负载均衡设备可以查看目标数据报文的五元组信息，确定目标数据报文所属的目标协议类型。
可选的，负载均衡设备还可以在用户态实现对ARP(Address Resolution Protocol，地址解析协议)报文的处理，相应的，步骤201之后可以存在如下处理：当目标协议类型为ARP时，负载均衡设备通过用户态netfilter框架中注册的ARP处理函数，解析目标数据报文，建立邻居表项和路由表项。
在实施中，负载均衡设备如果确定出目标数据报文的目标协议类型为ARP，则可以通过用户态netfilter框架中注册的ARP处理函数，对目标数据报文进行解析，根据解析结果添加ARP表项，建立邻居表项和路由表项，做好在用户态上进行报文转发的准备。之后，负载均衡设备还可以通过内核协议栈在内核态对解析后的目标数据报文进行处理。
可选的，负载均衡设备可以使用KNI(Kernel Interface，内核接口)通道将非业务报文交由内核态处理，相应的，步骤201之后可以存在如下处理：如果目标数据报文为非业务报文，负载均衡设备则基于环形队列的共享内存方式将目标数据报文通过KNI通道输入内核协议栈。
在实施中，负载均衡设备在接收到目标数据报文之后，如果目标数据报文为非业务报文，则可以采用共享内存的方式，通过KNI通道将目标数据报文载入内核态，即将目标数据报文输入内核协议栈。具体的，此处的共享内存可以被组织为环形队列的形式，并通过Read指针和Write指针来实现在环形队列中 数据报文的读写处理。同理，内核协议栈对目标数据报文处理完成后，也可以采用该共享内存方式将处理后的目标数据报文通过KNI通道返回至用户态。
步骤202，负载均衡设备通过用户态netfilter框架中注册的目标协议类型对应的调度处理函数，对目标数据报文进行调度处理。
在实施中，负载均衡设备中可以预先配置有用户态netfilter框架，且netfilter框架中可以预先注册有多种协议类型对应的调度处理函数。负载均衡设备在确定了目标数据报文的目标协议类型之后，可以通过用户态netfilter框架中注册的目标协议类型对应的调度处理函数，对目标数据报文进行调度处理。
可选的，负载均衡设备可以在调度数据报文前先对收到的数据报文进行防护处理，以防止后端的服务器集群受到恶意报文攻击，相应的，步骤202之前可以存在以下处理：负载均衡设备通过用户态netfilter框架中注册的目标协议类型对应的报文防护函数，对目标数据报文进行防护处理；如果检测出目标数据报文为恶意报文，负载均衡设备则丢弃目标数据报文。
在实施中，负载均衡设备上部署的用户态netfilter框架中还可以预先注册有不同协议类型对应的报文防护函数，不同报文防护函数之间相互独立，且以插件的形式进行注册，并通过钩子函数在netfilter框架中实现动态的加载和卸载。报文防护函数可以至少包括TCP(Transmission Control Protocol传输控制协议)防护函数(可进一步包括SYN FLOOD防护函数、ACK FLOOD防护函数和HTTP FLOOD防护函数)、UDP(User Datagram Protocol，用户数据报协议)防护函数和ICMP(Internet Control Message Protocol，Internet控制协议)防护函数。这样，负载均衡设备在确定目标数据报文的目标协议类型之后，可以先通过用户态netfilter框架中注册的目标协议类型对应的报文防护函数，对目标数据报文进行防护处理。具体的，负载均衡设备可以通过报文防护函数分别对目标数据报文进行报文特征、协议特性、报文统计等检测和防护逻辑处理，完成DDoS攻击检测和防护的处理。在处理完成后，如果检测出目标数据报文为恶意报文，负载均衡设备则可以丢弃目标数据报文，而如果目标数据报文为正常报文，负载均衡设备则可以对目标数据报文执行后续处理。
可选的，对于数据报文的协议栈类型主要可以包括TCP报文、UDP报文和ICMP报文，相应的，步骤202中对目标数据报文的调度处理可以具体如下：当目标协议类型为TCP或UDP时，负载均衡设备根据目标数据报文的五元组信息， 对目标数据报文进行调度处理；当目标协议类型为ICMP时，负载均衡设备通过预设的代答规则，构造目标数据报文的响应报文。
在实施中，当确定出目标数据报文的目标协议类型为TCP或者UDP时，负载均衡设备可以调取用户态netfilter框架中注册的TCP或UDP对应的调度处理函数执行下述处理，即负载均衡设备可以先获取目标数据报文的五元组信息(包括目的地址/目的端口/源地址/源端口/协议类型)，然后根据目标数据报文的五元组信息对目标数据报文进行调度处理。而当目标数据报文的目标协议类型为ICMP时，负载均衡设备则可以调取用户态netfilter框架中注册的ICMP对应的调度处理函数，按照预设的代答规则，直接构造目标数据报文的响应报文。
可选的，对于TCP报文或者UDP报文进行调度处理时，可以优先按照已有的会话表项执行，相应的，上述根据五元组信息进行调度的处理具体可以为：负载均衡设备查找本地是否存在目标数据报文的五元组信息对应的目标会话表项；如果存在，负载均衡设备则将目标会话表项中记录的目标后端服务器确定为目标数据报文的调度目的设备；如果不存在，负载均衡设备则根据预设的调度算法确定目标数据报文的调度目的设备。
在实施中，负载均衡设备在获取目标数据报文的五元组信息后，可以先查找本地是否已存在目标数据报文的五元组信息对应的目标会话表项。如果存在目标会话表项，负载均衡设备则可以按照目标会话表项对目标数据报文进行调度，即将目标会话表项中记录的目标后端服务器确定为目标数据报文的调度目的设备，同时可以更新会话表项中的会话信息。而如果不存在目标会话表项，负载均衡设备则可以根据预设的调度算法，确定目标数据报文的调度目的设备，并创建目标数据报文的五元组对应的会话表项。
可选的，在按预设调度算法对数据报文进行调度前，可以先确定本地是否存在相应的配置服务，相应的，根据预设的调度算法确定调度目的设备的处理可以如下：如果本地预存的配置服务表中存在目标数据报文的五元组信息对应的目标配置服务，负载均衡设备则根据预设的目标配置服务的调度算法确定目标数据报文的调度目的设备，否则丢弃目标数据报文。
在实施中，在本地不存在目标数据报文的五元组信息对应的目标会话表项情况下，负载均衡设备可以先判断本地预存的配置服务表中是否存在目标数据报文的五元组信息对应的目标配置服务，具体可以根据五元组中的目的地址、 目的端口和协议类型三项信息查找。如果存在目标配置服务，负载均衡设备则可以根据预设的目标配置服务的调度算法，确定目标数据报文的调度目的设备，并创建目标数据报文的五元组信息对应的会话表项；如果不存在目标配置服务器，负载均衡设备则可以直接丢弃目标数据报文。
步骤203，负载均衡设备基于调度处理的结果，对目标数据报文执行转发或者响应处理。
在实施中，负载均衡设备在对目标数据报文进行调度处理后，可以基于调度处理的结果，通过设备网卡对目标数据报文执行转发处理，或者对目标数据报文执行响应处理。具体的，对于转发处理，负载均衡设备可以修改目标数据报文的目的IP，将目标数据报文经核心交换机传输至后端的服务器集群中任意服务器；对于响应处理，负载均衡设备可以直接经核心交换机向目标数据报文的发送端反馈目标数据报文的响应报文。
可选的，负载均衡设备可以通过绑定协议栈地址和设备的端口的方式将数据报文加载至用户态进行处理，相应的处理可以如下：负载均衡设备将用户态协议栈的协议栈地址与报文接收端口绑定，以通过用户态协议栈处理报文接收端口的接收到的数据报文。
在实施中，负载均衡设备可以将用户态协议栈的协议栈地址与设备的报文接收端口进行绑定，并且将报文处理流程与上述协议栈地址进行关联。这样，负载均衡设备通过报文接收端口接收到数据报文之后，数据报文可以直接输入用户态协议栈，并按照与用户态协议栈的协议栈地址关联的报文处理流程，对数据报文执行具体的处理。
本发明实施例中，负载均衡设备接收目标数据报文，基于用户态协议栈对目标数据报文执行协议栈处理，并确定目标数据报文的目标协议类型；负载均衡设备通过用户态netfilter框架中注册的目标协议类型对应的调度处理函数，对目标数据报文进行调度处理；负载均衡设备基于调度处理的结果，对目标数据报文执行转发或者响应处理。这样，负载均衡设备通过用户态的netfilter框架实现数据报文的处理，减轻了报文处理流程对内核态的依赖，降低了报文拷贝的处理频率，从而节省了负载均衡设备的处理性能消耗，同时，对于数据报文的处理流程的升级替换等维护处理也更为方便、简单。
基于相同的技术构思，本发明实施例还提供了一种处理数据报文的装置，如图3所示，所述装置包括：
报文接收模块301，用于接收目标数据报文，基于用户态协议栈对所述目标数据报文执行协议栈处理，并确定所述目标数据报文的目标协议类型；
负载均衡模块302，用于通过用户态netfilter框架中注册的所述目标协议类型对应的调度处理函数，对所述目标数据报文进行调度处理；
报文调度模块303，用于基于所述调度处理的结果，对所述目标数据报文执行转发或者响应处理。
可选的，如图4所示，所述装置还包括报文防护模块304，用于：
通过用户态netfilter框架中注册的所述目标协议类型对应的报文防护函数，对所述目标数据报文进行防护处理；
如果检测出所述目标数据报文为恶意报文，则丢弃所述目标数据报文。
可选的，所述负载均衡模块302，具体用于：
当所述目标协议类型为TCP或UDP时，根据所述目标数据报文的五元组信息，对所述目标数据报文进行调度处理；
当所述目标协议类型为ICMP时，通过预设的代答规则，构造所述目标数据报文的响应报文。
可选的，所述负载均衡模块302，具体用于：
查找本地是否存在所述目标数据报文的五元组信息对应的目标会话表项；
如果存在，则将所述目标会话表项中记录的目标后端服务器确定为所述目标数据报文的调度目的设备；
如果不存在，则根据预设的调度算法确定所述目标数据报文的调度目的设备。
可选的，所述负载均衡模块302，具体用于：
如果本地预存的配置服务表中存在所述目标数据报文的五元组信息对应的目标配置服务，则根据预设的所述目标配置服务的调度算法确定所述目标数据报文的调度目的设备，否则丢弃所述目标数据报文。
可选的，所述负载均衡模块302，还用于：
当所述目标协议类型为ARP时，通过用户态netfilter框架中注册的ARP处理函数，解析所述目标数据报文，建立邻居表项和路由表项。
可选的，如图5所示，所述装置还包括内核交互模块305，用于：
如果所述目标数据报文为非业务报文，则基于环形队列的共享内存方式将所述目标数据报文通过KNI通道输入内核协议栈。
可选的，如图6所示，所述装置还包括协议栈绑定模块306，用于：
将所述用户态协议栈的协议栈地址与报文接收端口绑定，以通过所述用户态协议栈处理所述报文接收端口的接收到的数据报文。
本发明实施例中，负载均衡设备接收目标数据报文，基于用户态协议栈对目标数据报文执行协议栈处理，并确定目标数据报文的目标协议类型；负载均衡设备通过用户态netfilter框架中注册的目标协议类型对应的调度处理函数，对目标数据报文进行调度处理；负载均衡设备基于调度处理的结果，对目标数据报文执行转发或者响应处理。这样，负载均衡设备通过用户态的netfilter框架实现数据报文的处理，减轻了报文处理流程对内核态的依赖，降低了报文拷贝的处理频率，从而节省了负载均衡设备的处理性能消耗，同时，对于数据报文的处理流程的升级替换等维护处理也更为方便、简单。
需要说明的是：上述实施例提供的处理数据报文的装置在处理数据报文时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的处理数据报文的装置与处理数据报文的方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
图7是本发明实施例提供的负载均衡设备的结构示意图。该负载均衡设备700可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器722(例如，一个或一个以上处理器)和存储器732，一个或一个以上存储应用程序742或数据744的存储介质730(例如一个或一个以上海量存储设备)。其中，存储器732和存储介质730可以是短暂存储或持久存储。存储在存储介质730的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对负载均衡设备700中的一系列指令操作。更进一步地，中央处理器722可以设置为与存储介质730通信，在负载均衡设备700上执行存储介质730中的一 系列指令操作。
负载均衡设备700还可以包括一个或一个以上电源729，一个或一个以上有线或无线网络接口750，一个或一个以上输入输出接口758，一个或一个以上键盘756，和/或，一个或一个以上操作系统741，例如Windows Server，Mac OS X，Unix，Linux，FreeBSD等等。
负载均衡设备700可以包括有存储器，以及一个或者一个以上的程序，其中一个或者一个以上程序存储于存储器中，且经配置以由一个或者一个以上处理器执行所述一个或者一个以上程序包含用于进行上述处理数据报文的指令。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (18)

  1. 一种处理数据报文的方法，其特征在于，所述方法包括：
    负载均衡设备接收目标数据报文，基于用户态协议栈对所述目标数据报文执行协议栈处理，并确定所述目标数据报文的目标协议类型；
    所述负载均衡设备通过用户态netfilter框架中注册的所述目标协议类型对应的调度处理函数，对所述目标数据报文进行调度处理；
    所述负载均衡设备基于所述调度处理的结果，对所述目标数据报文执行转发或者响应处理。
  2. 根据权利要求1所述的方法，其特征在于，所述负载均衡设备通过用户态netfilter框架中注册的所述目标协议类型对应的调度处理函数，对所述目标数据报文进行调度处理之前，还包括：
    所述负载均衡设备通过用户态netfilter框架中注册的所述目标协议类型对应的报文防护函数，对所述目标数据报文进行防护处理；
    如果检测出所述目标数据报文为恶意报文，所述负载均衡设备则丢弃所述目标数据报文。
  3. 根据权利要求1所述的方法，其特征在于，所述对所述目标数据报文进行调度处理，包括：
    当所述目标协议类型为TCP或UDP时，所述负载均衡设备根据所述目标数据报文的五元组信息，对所述目标数据报文进行调度处理；
    当所述目标协议类型为ICMP时，所述负载均衡设备通过预设的代答规则，构造所述目标数据报文的响应报文。
  4. 根据权利要求3所述的方法，其特征在于，所述负载均衡设备根据所述目标数据报文的五元组信息，对所述目标数据报文进行调度处理，包括：
    所述负载均衡设备查找本地是否存在所述目标数据报文的五元组信息对应的目标会话表项；
    如果存在，所述负载均衡设备则将所述目标会话表项中记录的目标后端服 务器确定为所述目标数据报文的调度目的设备；
    如果不存在，所述负载均衡设备则根据预设的调度算法确定所述目标数据报文的调度目的设备。
  5. 根据权利要求4所述的方法，其特征在于，所述负载均衡设备则根据预设的调度算法确定所述目标数据报文的调度目的设备，包括：
    如果本地预存的配置服务表中存在所述目标数据报文的五元组信息对应的目标配置服务，所述负载均衡设备则根据预设的所述目标配置服务的调度算法确定所述目标数据报文的调度目的设备，否则丢弃所述目标数据报文。
  6. 根据权利要求1所述的方法，其特征在于，所述确定所述目标数据报文的目标协议类型之后，还包括：
    当所述目标协议类型为ARP时，所述负载均衡设备通过用户态netfilter框架中注册的ARP处理函数，解析所述目标数据报文，建立邻居表项和路由表项。
  7. 根据权利要求1所述的方法，其特征在于，所述确定所述目标数据报文的目标协议类型之后，还包括：
    如果所述目标数据报文为非业务报文，所述负载均衡设备则基于环形队列的共享内存方式将所述目标数据报文通过KNI通道输入内核协议栈。
  8. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述负载均衡设备将所述用户态协议栈的协议栈地址与报文接收端口绑定，以通过所述用户态协议栈处理所述报文接收端口的接收到的数据报文。
  9. 一种处理数据报文的装置，其特征在于，所述装置包括：
    报文接收模块，用于接收目标数据报文，基于用户态协议栈对所述目标数据报文执行协议栈处理，并确定所述目标数据报文的目标协议类型；
    负载均衡模块，用于通过用户态netfilter框架中注册的所述目标协议类型对应的调度处理函数，对所述目标数据报文进行调度处理；
    报文调度模块，用于基于所述调度处理的结果，对所述目标数据报文执行 转发或者响应处理。
  10. 根据权利要求9所述的装置，其特征在于，所述装置还包括报文防护模块，用于：
    通过用户态netfilter框架中注册的所述目标协议类型对应的报文防护函数，对所述目标数据报文进行防护处理；
    如果检测出所述目标数据报文为恶意报文，则丢弃所述目标数据报文。
  11. 根据权利要求9所述的装置，其特征在于，所述负载均衡模块，具体用于：
    当所述目标协议类型为TCP或UDP时，根据所述目标数据报文的五元组信息，对所述目标数据报文进行调度处理；
    当所述目标协议类型为ICMP时，通过预设的代答规则，构造所述目标数据报文的响应报文。
  12. 根据权利要求11所述的装置，其特征在于，所述负载均衡模块，具体用于：
    查找本地是否存在所述目标数据报文的五元组信息对应的目标会话表项；
    如果存在，则将所述目标会话表项中记录的目标后端服务器确定为所述目标数据报文的调度目的设备；
    如果不存在，则根据预设的调度算法确定所述目标数据报文的调度目的设备。
  13. 根据权利要求12所述的装置，其特征在于，所述负载均衡模块，具体用于：
    如果本地预存的配置服务表中存在所述目标数据报文的五元组信息对应的目标配置服务，则根据预设的所述目标配置服务的调度算法确定所述目标数据报文的调度目的设备，否则丢弃所述目标数据报文。
  14. 根据权利要求9所述的装置，其特征在于，所述负载均衡模块，还用 于：
    当所述目标协议类型为ARP时，通过用户态netfilter框架中注册的ARP处理函数，解析所述目标数据报文，建立邻居表项和路由表项。
  15. 根据权利要求10所述的装置，其特征在于，所述装置还包括内核交互模块，用于：
    如果所述目标数据报文为非业务报文，则基于环形队列的共享内存方式将所述目标数据报文通过KNI通道输入内核协议栈。
  16. 根据权利要求9所述的装置，其特征在于，所述装置还包括协议栈绑定模块，用于：
    将所述用户态协议栈的协议栈地址与报文接收端口绑定，以通过所述用户态协议栈处理所述报文接收端口的接收到的数据报文。
  17. 一种负载均衡设备，其特征在于，所述负载均衡设备包括处理器和存储器，所述存储器中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由所述处理器加载并执行以实现如权利要求1至8任一所述的处理数据报文的方法。
  18. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由处理器加载并执行以实现如权利要求1至8任一所述的处理数据报文的方法。
PCT/CN2019/074461 2019-01-22 2019-02-01 一种处理数据报文的方法和装置 WO2020151030A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19911953.8A EP3913893A4 (en) 2019-01-22 2019-02-01 METHOD AND DEVICE FOR PROCESSING DATA MESSAGE
US17/423,487 US20220078120A1 (en) 2019-01-22 2019-02-01 Method and apparatus for processing data packet

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910059565.X 2019-01-22
CN201910059565.XA CN109547580B (zh) 2019-01-22 2019-01-22 一种处理数据报文的方法和装置

Publications (1)

Publication Number Publication Date
WO2020151030A1 true WO2020151030A1 (zh) 2020-07-30

Family

ID=65838027

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/074461 WO2020151030A1 (zh) 2019-01-22 2019-02-01 一种处理数据报文的方法和装置

Country Status (4)

Country Link
US (1) US20220078120A1 (zh)
EP (1) EP3913893A4 (zh)
CN (1) CN109547580B (zh)
WO (1) WO2020151030A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113014627A (zh) * 2021-02-10 2021-06-22 深圳震有科技股份有限公司 报文转发方法、装置、智能终端及计算机可读存储介质

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110661904B (zh) * 2019-10-25 2022-06-14 浪潮云信息技术股份公司 一种实现源网络地址转换网关水平扩展的方法
CN112929264B (zh) * 2019-12-06 2022-10-28 厦门网宿有限公司 业务流量传输方法、系统及网络设备
CN112995753B (zh) * 2019-12-16 2024-03-22 中兴通讯股份有限公司 一种媒体流分发方法、cdn节点服务器、cdn系统和可读存储介质
CN111131439A (zh) * 2019-12-20 2020-05-08 浪潮电子信息产业股份有限公司 基于iSCSI的报文传输方法、装置、设备及存储介质
CN111404964B (zh) * 2020-03-30 2022-05-24 恒安嘉新（北京）科技股份公司 对ip数据报进行汇聚分流的方法、装置、设备及介质
CN112217735A (zh) * 2020-09-08 2021-01-12 网宿科技股份有限公司 信息同步方法与负载均衡系统
CN112380001A (zh) * 2020-10-30 2021-02-19 网宿科技股份有限公司 日志输出方法、负载均衡设备及计算机可读存储介质
CN113485823A (zh) * 2020-11-23 2021-10-08 中兴通讯股份有限公司 数据传输方法、装置、网络设备、存储介质
CN113242232A (zh) * 2021-05-07 2021-08-10 建信金融科技有限责任公司 消息处理系统和方法
CN113301049B (zh) * 2021-05-26 2023-02-24 杭州安恒信息技术股份有限公司 一种工控设备的审计方法、装置、设备及可读存储介质
CN115442173B (zh) * 2022-06-07 2024-02-06 北京车和家信息技术有限公司 车辆报文转发、处理方法、装置、电子设备及存储介质
CN115361443B (zh) * 2022-08-16 2023-06-20 武汉思普崚技术有限公司 一种报文处理方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101068229A (zh) * 2007-06-08 2007-11-07 北京工业大学 一种基于网络过滤器的内容过滤网关实现方法
CN101330473A (zh) * 2007-06-18 2008-12-24 电子科技大学 一种多协议支持的网络垃圾信息过滤方法和装置
CN103139315A (zh) * 2013-03-26 2013-06-05 烽火通信科技股份有限公司 一种适用于家庭网关的应用层协议解析方法
CN103327025A (zh) * 2013-06-28 2013-09-25 北京奇虎科技有限公司 网络访问控制方法及装置
WO2017004952A1 (zh) * 2015-07-09 2017-01-12 安一恒通（北京）科技有限公司 用于检测和阻止恶意点击广告链接的方法和装置

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1276629C (zh) * 2003-11-21 2006-09-20 清华大学深圳研究生院 基于Netfilter架构的流媒体集群服务内容调度方法
US8458467B2 (en) * 2005-06-21 2013-06-04 Cisco Technology, Inc. Method and apparatus for adaptive application message payload content transformation in a network infrastructure element
CN101867558B (zh) * 2009-04-17 2012-11-14 深圳市永达电子股份有限公司 用户态网络协议栈系统及处理报文的方法
US9141580B2 (en) * 2010-03-23 2015-09-22 Citrix Systems, Inc. Systems and methods for monitoring and maintaining consistency of a configuration
CN101827029B (zh) * 2010-04-21 2013-01-02 烽火通信科技股份有限公司 一种Linux网络设备动态标记RTP流量的方法
US8688817B2 (en) * 2011-03-14 2014-04-01 Edgecast Networks, Inc. Network connection hand-off using state transformations
CN107483574B (zh) * 2012-10-17 2021-05-28 阿里巴巴集团控股有限公司 一种负载均衡下的数据交互系统、方法及装置
US9432245B1 (en) * 2013-04-16 2016-08-30 Amazon Technologies, Inc. Distributed load balancer node architecture
CN104142867B (zh) * 2013-05-09 2018-01-09 华为技术有限公司 数据处理装置及数据处理方法
CN104951357B (zh) * 2014-03-28 2018-06-26 华为技术有限公司 并行用户态协议栈的管理方法和协议栈系统
CN104753928B (zh) * 2015-03-16 2018-08-17 苏州科达科技股份有限公司 一种码流转发方法及系统
CN104852833A (zh) * 2015-06-04 2015-08-19 上海斐讯数据通信技术有限公司 Linux系统中网络协议栈管理方法及系统
CN107026890B (zh) * 2016-02-02 2020-10-09 华为技术有限公司 一种基于服务器集群的报文生成方法和负载均衡器
CN106686085B (zh) * 2016-12-29 2020-06-16 华为技术有限公司 一种负载均衡的方法、装置和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101068229A (zh) * 2007-06-08 2007-11-07 北京工业大学 一种基于网络过滤器的内容过滤网关实现方法
CN101330473A (zh) * 2007-06-18 2008-12-24 电子科技大学 一种多协议支持的网络垃圾信息过滤方法和装置
CN103139315A (zh) * 2013-03-26 2013-06-05 烽火通信科技股份有限公司 一种适用于家庭网关的应用层协议解析方法
CN103327025A (zh) * 2013-06-28 2013-09-25 北京奇虎科技有限公司 网络访问控制方法及装置
WO2017004952A1 (zh) * 2015-07-09 2017-01-12 安一恒通（北京）科技有限公司 用于检测和阻止恶意点击广告链接的方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3913893A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113014627A (zh) * 2021-02-10 2021-06-22 深圳震有科技股份有限公司 报文转发方法、装置、智能终端及计算机可读存储介质

Also Published As

Publication number Publication date
CN109547580B (zh) 2021-05-25
EP3913893A4 (en) 2022-03-09
US20220078120A1 (en) 2022-03-10
CN109547580A (zh) 2019-03-29
EP3913893A1 (en) 2021-11-24

Similar Documents

Publication Publication Date Title
WO2020151030A1 (zh) 一种处理数据报文的方法和装置
US10680951B2 (en) System and method for processing and forwarding transmitted information
US11036529B2 (en) Network policy implementation with multiple interfaces
US20200265005A1 (en) Network traffic routing in distributed computing systems
EP2828760B1 (en) Offloading packet processing for networking device virtualization
US8913613B2 (en) Method and system for classification and management of inter-blade network traffic in a blade server
US8634415B2 (en) Method and system for routing network traffic for a blade server
US10484233B2 (en) Implementing provider edge with hybrid packet processing appliance
CA2968964C (en) Source ip address transparency systems and methods
US10225194B2 (en) Transparent network-services elastic scale-out
US20030231632A1 (en) Method and system for packet-level routing
US11799821B2 (en) Service chains for inter-cloud traffic
US20170033992A1 (en) METHOD FOR PROCESSING VxLAN DATA UNITS
US11336570B1 (en) Layer three multi-homing for virtual networks
US11165703B2 (en) Prefix-based fat flows
US20120140640A1 (en) Apparatus and method for dynamically processing packets having various characteristics
CN112929264A (zh) 业务流量传输方法、系统及网络设备
US9374308B2 (en) Openflow switch mode transition processing

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19911953

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019911953

Country of ref document: EP

Effective date: 20210820