WO2024093478A1 - 基于策略路由的数据处理方法和装置、设备和存储介质 - Google Patents

基于策略路由的数据处理方法和装置、设备和存储介质 Download PDF

Info

Publication number
WO2024093478A1
WO2024093478A1 PCT/CN2023/115585 CN2023115585W WO2024093478A1 WO 2024093478 A1 WO2024093478 A1 WO 2024093478A1 CN 2023115585 W CN2023115585 W CN 2023115585W WO 2024093478 A1 WO2024093478 A1 WO 2024093478A1
Authority
WO
WIPO (PCT)
Prior art keywords
routing
data packet
network card
data
target
Prior art date
Application number
PCT/CN2023/115585
Other languages
English (en)
French (fr)
Inventor
王传国
崔士伟
许鑫
韩春超
徐国振
吴保锡
Original Assignee
苏州元脑智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州元脑智能科技有限公司 filed Critical 苏州元脑智能科技有限公司
Publication of WO2024093478A1 publication Critical patent/WO2024093478A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/14—Routing performance; Theoretical aspects

Definitions

  • the present application relates to the field of communication technology, and in particular to a data processing method and apparatus based on policy routing, a device, and a non-volatile readable storage medium.
  • Network devices In the process of data processing, network devices usually need to perform policy routing to achieve data transmission.
  • the data transmission process usually adopts network filters (Netfilter) to perform policy routing.
  • Network filters Netfilter
  • Netfilter is a very large kernel framework with great redundancy.
  • the use of Netfilter for policy routing requires that the data packet completely goes through the kernel protocol stack. The data packet passes through many processing paths, so the use of Netfilter for policy routing will lead to a decrease in network performance.
  • the use of Netfilter for policy routing is closely related to the kernel protocol stack, the implementation method is complex, and the maintenance cost is high.
  • the present application provides a data processing method and apparatus based on policy routing, a device and a non-volatile readable storage medium, aiming to solve the problems of network performance degradation, complex implementation method and high maintenance cost caused by using Netfilter for policy routing.
  • a data processing method based on policy routing is provided, which is applied to a network device, and the method comprises:
  • the configuration of policy routing is performed based on the kernel data structure of the extended Berkeley packet filter; the policy routing includes: a plurality of routing tables;
  • Intercepting a data packet to be sent includes: a destination address and a number of routing rules
  • the data packet is sent based on the target network card through the data packet sending function of BPF.
  • the configuration of policy routing is performed based on the kernel data structure of the extended Berkeley packet filter, and the data packet is intercepted. After interception, the policy routing configured based on the kernel data structure of the extended Berkeley packet filter is used for routing, and the target network card corresponding to the destination address of the data packet is found and obtained.
  • the data packet sending function based on BPF sends the data packet based on the target network card.
  • policy routing is implemented by the extended Berkeley packet filter, bypassing Netfilter and part of the kernel protocol stack, reducing the changes to the kernel, reducing the processing path of the data packet, and the policy routing is efficient, which greatly improves network performance.
  • the data packet is a data packet received by the network device and needs to be forwarded, and the intercepting of the data packet to be sent includes:
  • the data packet that needs to be forwarded and is received by the network device is intercepted.
  • the data packet is a data packet generated by the network device and needs to be sent, and before intercepting the data packet that needs to be sent, the method further includes: adding a hook point of an extended Berkeley data packet filter at a position before the route lookup in the BPF route lookup function;
  • the interception of the data packet to be sent includes:
  • the data packets generated by the network device and need to be sent are intercepted at the added hook point of the extended Berkeley data packet filter.
  • the method before the packet sending function of BPF sends the packet based on the target network card, the method further includes:
  • the data packet sending function through BPF sends the data packet based on the target network card, including:
  • the data packet is sent from the target network card through the data packet sending function of the BPF.
  • the method before the packet sending function of BPF sends the packet based on the target network card, the method further includes:
  • the first length is greater than a preset length
  • the data packet sending function through BPF sends the data packet based on the target network card, including:
  • the data packet is sent from the idle network card through the data packet sending function of the BPF.
  • the sending of the data packet based on the target network card through the data packet sending function of BPF includes:
  • the data packet is sent from the target network card through the data packet sending function of the BPF.
  • the sending of the data packet based on the target network card through the data packet sending function of BPF includes:
  • the data packet is sent from the target network card through the data packet sending function of the BPF.
  • the sending of the data packet based on the target network card through the data packet sending function of BPF includes:
  • the data packet is sent from the target network card through the data packet sending function of the BPF.
  • the configuration of policy routing based on the kernel data structure of the extended Berkeley packet filter includes:
  • the two-layer kernel data structure of the extended Berkeley packet filter is used to configure policy routing;
  • the two-layer kernel data structure includes: an inner kernel data structure and an outer kernel data structure,
  • the inner kernel data structure includes a target routing table inner kernel data structure and at least one inner routing rule kernel data structure,
  • the inner routing rule kernel data structure includes a routing rule
  • the target routing table inner kernel data structure includes: a target routing table;
  • the outer kernel data structure in the two-layer kernel data structure includes: routing rules corresponding to all the inner routing rule kernel data structures in the two-layer kernel data structure and a target routing table corresponding to the inner kernel data structure of the target routing table.
  • the configuration of policy routing based on the kernel data structure of the extended Berkeley packet filter includes:
  • routing rules and routing tables are established based on the kernel data structure of the extended Berkeley packet filter.
  • the method before obtaining the first length of the queue of data packets to be sent of the target network card and the priority of the target network card, the method further includes:
  • the method further includes:
  • the method Before respectively acquiring the second lengths of the to-be-sent data packet queues of the first network cards and the priorities of the first network cards, the method further includes:
  • a priority is set for each of the first network cards.
  • the preset length is 70%-80% of the length of the queue of data packets to be sent of the target network card when the queue of data packets to be sent of the target network card is fully loaded.
  • the BPF routing lookup function includes: a bpf_fib_lookup function.
  • the BPF data packet sending function includes: bpf_redirect series functions.
  • the method further comprises:
  • the data packet is sent out through a network filter.
  • the method further comprises:
  • the data packet is sent out through a network filter.
  • a data processing device based on policy routing is provided, which is applied to a network device, and the device includes:
  • a configuration module is used to configure policy routing based on the kernel data structure of the extended Berkeley packet filter; the policy routing includes: a plurality of routing tables;
  • An interception module is used to intercept a data packet to be sent; the data packet includes: a destination address and a number of routing rules;
  • a target routing table determination module used to determine a target routing table matching each of the routing rules of the data packet from among the plurality of routing tables;
  • a target network card determination module used for searching the target network card corresponding to the destination address of the data packet in the target routing table based on a BPF routing search function
  • the sending module is used to send the data packet based on the target network card through the data packet sending function of BPF.
  • the data processing device based on policy routing further includes:
  • a hook point adding module used to add a hook point of the extended Berkeley packet filter at a position before the route lookup in the BPF route lookup function
  • the interception module comprises:
  • the first interception unit is used to intercept the data packets generated by the network device and need to be sent out at the added hook point of the extended Berkeley data packet filter.
  • an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps of any of the aforementioned policy-based routing data processing methods are implemented.
  • a non-volatile readable storage medium on which a computer program is stored.
  • the computer program is executed by a processor, the steps of any of the aforementioned policy-based routing data processing methods are implemented.
  • the data processing device, electronic device, and non-volatile readable storage medium based on policy routing in the present application all have the same or similar beneficial effects as any of the aforementioned data processing methods based on policy routing.
  • FIG1 shows a flow chart of the steps of a first data processing method based on policy routing in an embodiment of the present application
  • FIG2 shows a schematic flow chart of configuring policy routing based on a kernel data structure of an extended Berkeley packet filter in an embodiment of the present application
  • FIG3 shows a schematic diagram of determining a target routing table in an embodiment of the invention
  • Fig. 4 shows a schematic flow diagram of data processing using Netfilter for policy routing in the prior art
  • FIG5 is a schematic diagram showing a flow chart of a data processing method based on policy routing in an embodiment of the present application
  • FIG6 is a schematic diagram showing a process of sending a data packet in an embodiment of the present application.
  • FIG7 shows a schematic diagram of a network card group in an embodiment of the present application.
  • FIG8 shows a schematic flow chart of a data processing method based on policy routing in an embodiment of the present application
  • FIG. 9 shows a schematic structural diagram of a data processing device based on policy routing in an embodiment of the present application.
  • the present application provides a data processing method based on policy routing, which is applied to network devices.
  • the network devices here can refer to network devices in a broad sense or network devices in a narrow sense.
  • Network devices in a broad sense can be network computers (including: personal computers or servers, such as cloud platforms), network printers, network cameras, RTUs, smart phones, etc.
  • Network devices in a narrow sense can include: switches, routers, firewalls, bridges, hubs, gateways, VPN servers, network interface cards (NICs), wireless access points (WAPs), modems, 5G base stations, optical terminals, optical transceivers, optical cables, etc.
  • Routing here means that the network device determines the output port, output network card and next hop address according to the network layer destination address (Destination IP address) in the data packet to be sent and the internally maintained routing table, and rewrites the link layer data packet header (MAC address) to achieve data packet sending and forwarding.
  • This process is called routing, and sometimes the records (routing items) in the routing table are referred to as routing. Routing is generally maintained and viewed using the command ip route.
  • Policy routing is a more flexible packet routing mechanism than routing based on the target network. Policy routing consists of many policies, each of which defines one or more matching routing rules and corresponding operations. Routing rule objects can be not only destination IP addresses, but also destination ports, source IP addresses, source ports, protocol types, etc., which makes sending and controlling packets more flexible. Policy routing has a higher priority than routing. Policy routing is generally maintained and viewed using the command ip rule.
  • Policy routing rules or selectors are data elements that can be matched, such as destination IP address, destination port, source IP address, source port, protocol type, fwmark, etc., where fwmark refers to the mark data of the check data packet.
  • FIG1 shows a flow chart of the steps of a first data processing method based on policy routing in an embodiment of the present application.
  • the method is applied to the aforementioned network device, as shown in FIG1 , the data processing method based on policy routing may include the following steps:
  • Step 101 configure policy routing based on the kernel data structure of the extended Berkeley packet filter; the policy routing includes: a plurality of routing tables.
  • Extended Berkeley Packet Filter is a packet filtering technology that provides a mechanism for safely injecting code when kernel events and user program events occur. Later, it was gradually extended to network, kernel, security, tracing, etc., and has been widely used in fault diagnosis, network optimization, security control, performance monitoring and other fields.
  • eBPF is an extension of BPF (Berkeley Packet Filter).
  • the kernel data structure refers to map.
  • the kernel data structure of the extended Berkeley packet filter refers to eBPFmap.
  • eBPFmap is a key/value data structure that resides in the kernel and can be accessed by any eBPF program that knows about them. Programs running in user space can also access eBPFmap by using file descriptors. Any type of data can be stored in eBPFmap as long as the data size is correctly specified in advance. In the kernel, both keys and values are stored as binary. eBPFmap is used for data exchange and information transfer between user space and kernel space.
  • the configuration can include adding, deleting, modifying, and querying policy routing. Due to the characteristics of eBPFmap, it can take effect immediately after configuration without restarting services or processes, and will not change any kernel source code. It reduces the coupling between eBPF programs and the kernel, reduces changes to the kernel, reduces the processing path of data packets, improves network performance, and has good functional scalability.
  • FIG2 shows a schematic diagram of a process of configuring policy routing based on the kernel data structure of the extended Berkeley packet filter in an embodiment of the present application.
  • the routing rule validity check refers to the check of the specific routing rules. The correctness of the rules is checked, for example: whether it is a legal IP, whether the mask is in [1, 24], whether the IP protocol type is legal (the kernel header file has macro definitions that it is legal), whether the input and output device names exist, etc.
  • the logical check of the routing rules refers to whether there is a routing table, whether there are other routing rules or selectors except the routing table selector, and whether there are no repeated types of routing rules or selectors. It should be noted that if at least one of the routing rule legality check and routing rule logical check fails, a failure prompt can be given.
  • the specific form of the failure prompt is not specifically limited, for example, it can be a failure prompt dialog box.
  • Policy routing can be stored in a map in a variety of ways, and there is no limitation on the specific storage method of policy routing in the map.
  • the number of routing tables included in policy routing can be 256, and the routing table can be of unsignedshort (unsigned short integer) type, and the value range can be [0, 255].
  • the specific routing rules and the possible values of the routing rules For example, referring to Table 1, Table 1 shows a routing rule and the possible values of each routing rule.
  • policy routing includes at least one routing rule.
  • Table 1 Routing rules and possible values for each routing rule
  • IP address is a unified address format provided by IP protocol, which assigns a logical address to each network and each host on the Internet to shield the difference of physical address. For example: 192.168.0.10 (IPv4) and 2001:DB8:2de::e13 (IPv6).
  • MAC address is media access control address, also known as LAN address, MAC address, Ethernet address or physical address. It is an address used to identify the location of network devices.
  • the third layer, the network layer is responsible for the IP address
  • the second layer, the data link layer is responsible for the MAC address.
  • the MAC address is used to uniquely identify a network card in the network. If a device has one or more network cards, each network card needs and will have a unique MAC address. For example: 11:22:33:44:55:66.
  • policy routing technology originates from the special needs of multi-network access environments. There are communication problems when different operator networks exchange data, resulting in low network data transmission rates between different operators. Using policy routing can achieve specific data transmission on a specific operator network in an environment with multiple operator networks.
  • the network management program can be flexibly configured to specify which network the data is sent from.
  • the VPN network it is also convenient to implement VPN proxy and configure which applications use the VPN network for data proxy.
  • eBPFmap has a fast routing lookup algorithm, for example, the bpf_fib_lookup function, which facilitates quick search of the target routing table.
  • Step 102 intercepting a data packet to be sent; the data packet includes: a destination address and a number of routing rules.
  • the data packet to be sent can be a data packet generated by the network device itself, or a data packet received by the network device and needs to be forwarded by the network device.
  • the source of the data packet is not specifically limited here.
  • the data packet can include: a destination address and several routing rules.
  • the destination address is the address that the data packet needs to reach.
  • the data packets to be sent can be intercepted by various hook points in eBPF.
  • hook point is used for interception.
  • Step 103 Determine, among the plurality of routing tables, a target routing table that matches each of the routing rules of the data packet.
  • a routing table corresponds to at least one routing rule, and each routing rule of a data packet is compared with the routing rules corresponding to each routing table. If each routing rule of a data packet matches each routing rule corresponding to a certain routing table one by one, the routing table is considered to be the target routing table that matches each routing rule of the data packet. As long as one routing rule does not match, the routing table is considered not to be the target routing table that matches each routing rule of the data packet.
  • each Key in the data packet and the Value corresponding to each Key are compared with each Key corresponding to each routing table in the policy routing and the Value corresponding to each Key.
  • the routing table is considered to be the target routing table that matches each routing rule of the data packet.
  • the routing table is considered not to be the target routing table that matches each routing rule of the data packet.
  • FIG3 shows a schematic diagram of determining a target routing table in an embodiment of the invention.
  • a data packet includes only one routing rule. If the routing rule of the data packet is the same as routing rule 1, and routing rule 1 corresponds to routing table 1, then the target routing table that matches the routing rule of the data packet is routing table 1. If the routing rule of the data packet is different from routing rule 1, but the same as routing rule 2, and routing rule 2 corresponds to routing table 2, then the target routing table that matches the routing rule of the data packet is routing table 2. If the routing rule of the data packet is different from routing rule 2, but the same as routing rule 3, and routing rule 3 corresponds to routing table 3, then the target routing table that matches the routing rule of the data packet is routing table 3. If the routing rule of the data packet is different from routing rule 3 but the same as routing rule 4, and routing rule 4 corresponds to routing table 4, then the target routing table that matches the routing rule of the data packet is routing table 4.
  • Step 104 Based on the BPF routing lookup function, search the target network card corresponding to the destination address of the data packet in the target routing table.
  • the BPF route lookup function may be a bpf_fib_lookup function, which is compatible with the existing route lookup function in BPF and is simple to implement. This step may be to search for the target network card corresponding to the destination address of the data packet in the target routing table based on the bpf_fib_lookup function.
  • Step 105 Send the data packet based on the target network card through the data packet sending function of BPF.
  • the packet sending function of BPF can be a bpf_redirect series function.
  • the packet sending function of BPF is compatible with the existing packet sending function in BPF, and the implementation method is simple. This step can be to send the data packet based on the target network card through the bpf_redirect series function.
  • FIG. 4 shows a flow diagram of data processing using Netfilter for policy routing in the prior art.
  • the chain matched before routing refers to the PREROUTING chain, which is mainly used to intercept messages or data packets before routing.
  • the chain matched after routing refers to the POSTROUTING chain, which is mainly used to intercept messages or data packets after routing.
  • the routing and data packet forwarding chain refers to the FORWARD chain, specifically the routing and data packet forwarding of the Linux kernel, which is mainly used to intercept messages or data packets that need to be forwarded.
  • the chain into which data packets flow refers to the INPUT chain, which is mainly used to intercept data packets or messages to the local machine.
  • the chain from which data packets flow out refers to the OUTPUT chain, which is mainly used to intercept data packets or messages generated by the local machine.
  • the filtering configuration information table refers to the Filter table, which is used to store configuration information for filtering messages.
  • the network address translation table refers to the NAT table, which is used to store relevant configuration information for network address translation.
  • the message modification configuration information table refers to the Mangle table, which is used to store the configuration information of the message modification, and the tracking processing table refers to the RAW table, which is mainly used to track and process the original message at the entrance of the protocol stack.
  • the solid quadrilateral box represents the processing based on the RAW table
  • the solid hexagonal box represents the processing based on the Mangle table
  • the solid long hole box represents the processing based on the NAT table
  • the solid trapezoidal box represents the processing based on the Filter table.
  • Netfilter is a very large kernel framework, which appears in multiple places of the kernel data path, has great redundancy, and in the presence of a large number of routing rules, Netfilter will cause network performance to degrade. The more routing rules there are, the lower the performance.
  • the MTU (Maximum Transmission Unit) of the two export networks is different. In order to optimize the performance, it is necessary to let packets with a length greater than a certain value go through a specific network, and the packet length needs to be checked.
  • the policy routing that determines the direction of the data packet according to the process to which it belongs needs to be checked; there is also the identification of the custom protocol part, which is not supported by the iprule ordinary routing rules or selectors, and iptables/mark needs to be used in Netfilter.
  • the fwmark selector or routing rules of policy routing in Netfilter you must use it with iptables/mark. Specifically, first use iptables to set the routing rules with mark tags, and then use the fwmark selector of policy routing to match the mark.
  • the MTU here is used to inform the other party of the maximum size of the data service unit that can be accepted, indicating the payload size that the sender can accept. It is the maximum length of a packet or frame, usually recorded in bytes. If the MTU is too large, it will be rejected when it encounters a router because it cannot handle packets that are too large. If it is too small, because the protocol must add a header to the packet (or frame), the actual amount of data transmitted will be too small, which is not worth it. Most operating systems will provide users with a default value, which is generally more suitable for users.
  • the iptables here is built on Netfilter and is a user space application. Mark is a module in iptables that can set a mark (management data) for qualified data packets. This mark is the mark. Netfilter can perform a series of operations on the data packet according to the mark later.
  • the policy routing is configured based on eBPFmap, and the data packet is intercepted. After interception, the policy routing configured based on eBPFmap is used for routing, and the target network card corresponding to the destination address of the data packet is found. Based on the data packet sending function of BPF, the data packet is sent based on the target network card.
  • the policy routing is implemented by eBPF, bypassing Netfilter and part of the kernel protocol stack, reducing the changes to the kernel, reducing the processing path of the data packet, and the policy routing is efficient, which greatly improves the network performance. At the same time, by bypassing part of the kernel protocol stack, the policy routing is greatly simplified.
  • the configuration of policy routing based on eBPFmap replaces the complex requirements of ip rule/fwmark routing rules, so that the configuration of routing rules, such as adding, deleting, modifying, and checking, can be easily set without interrupting the application.
  • the kernel versions of current network devices basically support eBPF.
  • the eBPF program type has good scalability.
  • eBPF has corresponding APIs for route lookup and packet forwarding. Therefore, the application scope of this application is wide and the implementation method is simple. After sending a data packet, the network device can discard the data packet and record the data packet sending log.
  • the aforementioned step 101 may include: establishing a correspondence between a routing rule and a routing table, and then when a data packet is sent, the target routing table can be matched according to the routing rule included in the data packet.
  • FIG5 shows a schematic flow chart of a data processing method based on policy routing in an embodiment of the present application.
  • the aforementioned data packet may be a data packet received by the network device and needs to be forwarded
  • the aforementioned step 102 may include: intercepting the data packet received by the network device and needs to be forwarded at the hook point of the fast data path (eXpress Data Path, XDP).
  • XDP is an eBPF hook in the Linux network processing flow, which can mount the eBPF program. It can process the data packet when it reaches the network card driver layer, has very excellent data plane processing performance, and opens up the highway of Linux network processing.
  • the data packet in the lower left corner may be the data packet that needs to be forwarded and received by the network device.
  • the data packet that needs to be forwarded and received by the network device is intercepted at the hook point of the fast data path (eXpress Data Path, XDP).
  • the dotted arrow in FIG5 shows the main direction of the data packet of the present application, and the solid arrow shows the main direction of the data packet of the prior art.
  • the XDP hook point intercepts the data packet that needs to be forwarded and received by the network device, it matches the target routing table according to the various routing rules included in the data packet in the several routing tables of the policy routing.
  • the target network card corresponding to the destination address of the data packet is searched in the target routing table based on the BPF routing search function, and then the data packet is sent based on the target network card through the BPF data packet sending function, such as the bpf_redirect series of functions.
  • the data packet that needs to be forwarded and received by the network device In the process of searching for the target network card, the data packet bypasses Netfilter and at least part of the kernel data protocol stack, reducing changes to the kernel and the processing path of the data packet.
  • the policy routing is highly efficient and greatly improves network performance.
  • the XDP hook point intercepts the data packet that needs to be forwarded and is received by the network device, if the target routing table is not matched according to the various routing rules included in the data packet in several routing tables of the policy routing, Netfilter is still used to perform policy routing on the data packet, and the data packet is finally sent out, thereby ensuring that the data packet can be sent out without matching the target routing table.
  • the data packet is sent through Netfilter, thereby ensuring that the data packet can be sent if the target network card is not found.
  • Netfilter is still used to perform policy routing on the data packet and finally send the data packet.
  • the aforementioned data packet may be a data packet generated by the network device and needs to be sent.
  • the method may further include: adding an eBPF hook point at the position before the route search in the aforementioned BPF route search function.
  • the step 102 may include: intercepting the data packet generated by the network device and needs to be sent at the added eBPF hook point. Referring to the right side of FIG5, after the added eBPF hook point intercepts the data packet generated by the network device and needs to be sent, the target routing table can also be matched according to the various routing rules included in the data packet in several routing tables of the policy routing.
  • the target routing table is matched, then based on the BPF route search function, the target network card corresponding to the destination address of the data packet is searched in the target routing table, and then the data packet is sent based on the target network card through the BPF data packet sending function, such as the bpf_redirect series function.
  • the data packet generated by the network device and needs to be sent bypasses Netfilter and at least part of the kernel data protocol stack, reduces the changes to the kernel, reduces the processing path of the data packet, and has high policy routing efficiency, which greatly improves network performance.
  • the BPF route lookup function add an eBPF hook point, or add an eBPF program type (if it is called routeForSelf), before the route lookup.
  • the eBPF program can be mounted to the hook point. For example, you can add this eBPF hook point at the beginning of the fib_lookup function.
  • the data packet is sent through Netfilter, thereby ensuring that the data packet can be sent if the target network card is not found.
  • the added eBPF hook point intercepts the data packet that needs to be forwarded received by the network device, if the target routing table is matched according to the various routing rules included in the data packet in the several routing tables of policy routing, but the target network card corresponding to the destination address included in the data packet is not found in the target routing table, Netfilter is still used to perform policy routing on the data packet, and the data packet is finally sent out.
  • the method may further include: obtaining a first length of the queue of data packets to be sent of the target network card, and the step 105 may include: when the first length is less than or equal to a preset length, sending the data packet from the target network card through the aforementioned BPF data packet sending function. That is, after determining the target network card, if the load to be sent by the target network card is not particularly large, the data packet can be directly sent through the target network card, thereby speeding up the sending of the data packet.
  • the preset length can be determined based on the speed of sending data packets, etc., and this is not specifically limited in the present application.
  • the preset length may be 70%-80% of the length of the queue of data packets to be sent when the queue of data packets to be sent of the target network card is fully loaded.
  • the preset length range is set reasonably, and the sending efficiency of data packets is high.
  • the preset length may be 70%, 73%, 74%, 75%, 77%, 79%, or 80% of the length of the queue of data packets to be sent when the queue of data packets to be sent of the target network card is fully loaded.
  • the method may further include: obtaining the first length of the queue of data packets to be sent of the target network card, and the priority of the target network card.
  • the first length is greater than the preset length, determine the remaining first network cards in the network card group where the target network card is located, and each first network card and the target network card correspond to the destination address of the data packet.
  • the aforementioned step 105 may include: sending the data packet from the idle network card through the aforementioned BPF data packet sending function.
  • the method may further include: receiving priority setting data for the target network card, and setting the priority for the target network card based on the priority setting data of the target network card.
  • the priority setting data may specifically be setting the priority of the target network card to a certain level, etc. Setting the priority of the target network card in advance facilitates the subsequent rapid acquisition of the priority of the target network card.
  • the method may further include: receiving priority setting data for each first network card, and setting the priority of each first network card based on the priority setting data of each first network card.
  • the priority setting data may also be the level at which the priority of the first network card is set. Setting the priority of each first network card in advance is conducive to quickly obtaining the priority of each first network card later.
  • the priority of each network card can be set, and there is no specific limitation on the setting of the priority of each network card.
  • network card A is a sim (Subscriber Identity Module) card such as a mobile phone card
  • network card B is a WLAN network card, i.e., wifi
  • the priority of network card A can be defined as higher, which can reduce the corresponding payment of network card A.
  • the method may further include: all network cards of the network device may be first divided into at least one or more network card groups according to the different destination addresses corresponding to them.
  • the number of network card groups corresponding to a network device is not specifically limited, and the number of network cards in a network card group is not specifically limited. All network cards in the same network card group correspond to the same destination address. For example, all network cards in the same network card group correspond to the same destination address, or all network cards in the same network card group correspond to the same multiple destination addresses.
  • the present application is to find a target network card according to policy routing, and the length of the queue of data packets to be sent of the target network card is long, and select a network card group where the length of the queue of data packets to be sent is short and the length of the queue of data packets to be sent is short from the network card group where the target network card is located.
  • the data packet is sent to the idlest network card with the shortest packet queue, thereby realizing link aggregation, increasing bandwidth, and achieving traffic load balancing.
  • the subsequent implementation method is simple by dividing the network card group.
  • the aforementioned step 105 may include: when the target network card is the only network card in the network card group where the target network card is located, sending the data packet from the target network card through the aforementioned BPF data packet sending function. That is, if the target network card is the only network card in the network card group where the target network card is located, then the destination addresses corresponding to the remaining network cards of the network device do not correspond to the destination address in the data packet, and then the data packet needs to be sent from the target network card.
  • the aforementioned step 105 may include: when no candidate network card is selected, sending the data packet from the target network card through the aforementioned BPF data packet sending function. That is, if the network card group where the target network card is located includes other network cards besides the target network card, but the priorities of the other network cards are higher than the priority of the target network card, then the data packet needs to be sent from the target network card.
  • the aforementioned step 105 may include: in the case where no idle network card is selected, sending the data packet from the target network card through the aforementioned BPF data packet sending function. That is, in addition to the target network card, there are other network cards in the network card group where the target network card is located, and there are candidate network cards with priorities equal to or less than the priority of the target network card among the remaining network cards, but the lengths of the queues of data packets to be sent of the candidate network cards are all long, that is, the candidate network cards are also very busy, then the data packet needs to be sent from the target network card.
  • FIG6 shows a schematic diagram of a data packet sending process in an embodiment of the present application.
  • the specific process can be as follows: based on the BPF routing lookup function, after finding the target network card corresponding to the destination address of the data packet in the target routing table, it can be checked whether the first length of the queue of data packets to be sent of the target network card is less than or equal to the preset length. If so, the data packet is sent from the target network card through the BPF data packet sending function. If not, whether the network card group where the target network card is located has only one network card, the target network card. If so, the data packet is sent from the target network card through the BPF data packet sending function.
  • the data packet is sent from the target network card through the BPF data packet sending function. If yes, whether there is an idle network card with a second length less than the preset length and the smallest second length among the candidate network cards. If not, the data packet is sent from the target network card through the BPF data packet sending function. If yes, the data packet is sent from the idle network card through the BPF data packet sending function.
  • FIG7 shows a schematic diagram of a network card group in an embodiment of the present application.
  • the target network card corresponding to the destination address of the determined data packet is network card 1
  • the first length of the queue of data packets to be sent of network card 1 is less than or equal to the preset length, then, through the packet sending function of BPF, the data packet is sent from network card 1.
  • the network card group where network card 1 is located is searched, and the network cards in the network card group where network card 1 is located are network card 1, network card 2, and network card 3, a total of 3 network cards.
  • the priority of network card 1 is higher than the priority of network card 2, and is equal to the priority of network card 3.
  • the network cards to be selected are network card 2 and network card 3. If the second length of the queue of data packets to be sent of network card 2 is greater than the preset length, and the second length of the queue of data packets to be sent of network card 3 is less than or equal to the preset length, then, the idle network card determined from the network cards to be selected is network card 3, then, through the packet sending function of BPF, the data packet is sent from network card 3.
  • Figure 8 shows a flow chart of a data processing method based on policy routing in an embodiment of the present application. Referring to Figure 8, policy routing is configured first, and then different transmission paths can be selected according to whether the receipt packet is a data packet received by the network device and needs to be forwarded, or a data packet generated by the network device and needs to be sent. After the target network card is determined, based on the aforementioned link aggregation, it is determined through which network card the data packet is sent.
  • the above step 101 may include: configuring policy routing based on a two-layer kernel data structure (map) of eBPF; a two-layer kernel data structure (map) includes: an inner map and an outer map, the inner map includes an inner map of a target routing table and at least one inner routing rule map, the inner routing rule map includes a routing rule, and the inner map of the target routing table includes: a target routing table; an outer map in a two-layer map includes: routing rules corresponding to all inner routing rule maps in the two-layer map and a target routing table corresponding to the inner map of the target routing table, that is, using Map-in-map to configure policy routing, the outer map is equivalent to a two-dimensional array or linked list, which is convenient for later changes or combinations of routing rules. Routing rules cannot be repeated in an outer map record.
  • the following program shows the configuration of policy routing based on two-layer maps of eBPF.
  • 101: ⁇ "target routing table":100 ⁇ is an inner map record of the target routing table
  • 102: ⁇ "destination IP address":192.168.1.0/24 ⁇ is an inner routing rule map.
  • 201: ⁇ "Destination routing table":200 ⁇ is an inner map record of the destination routing table
  • 202: ⁇ "Destination IP address":192.168.2.0/24 ⁇ is an inner routing rule map.
  • 203: ⁇ "Destination port":80 ⁇ is another inner routing rule map.
  • a policy route can include multiple routing rules, which must include a "target routing table", and the same type of routing rules in Table 1 cannot appear repeatedly in a policy route.
  • FIG9 shows a schematic diagram of the structure of a data processing device based on policy routing in an embodiment of the present application. Applicable to network equipment. Referring to FIG9 , the device may include:
  • Configuration module 201 configured to configure policy routing based on the kernel data structure of the extended Berkeley packet filter; the policy routing includes: a plurality of routing tables;
  • the interception module 202 is used to intercept the data packet to be sent; the data packet includes: a destination address and a number of routing rules;
  • a target routing table determination module 203 is used to determine a target routing table that matches each of the routing rules of the data packet among the plurality of routing tables;
  • a target network card determination module 204 is used to search for a target network card corresponding to the destination address of the data packet in the target routing table based on a BPF routing search function;
  • the sending module 205 is used to send the data packet based on the target network card through the data packet sending function of BPF.
  • the data processing device based on policy routing has the same or similar beneficial effects as any of the aforementioned data processing methods based on policy routing, and they can be referenced to each other. To avoid repetition, they will not be described in detail here.
  • the data packet is a data packet received by the network device and needs to be forwarded
  • the interception module 202 may include:
  • the second interception unit is used to intercept the data packet that needs to be forwarded and is received by the network device at the hook point of the fast data path.
  • the data packet is a data packet generated by the network device and needs to be sent, and the apparatus may further include:
  • a hook point adding module used to add a hook point of the extended Berkeley packet filter at a position before the route lookup in the BPF route lookup function
  • the interception module 202 may include:
  • the first interception unit is used to intercept the data packets generated by the network device and need to be sent out at the added hook point of the extended Berkeley data packet filter.
  • the apparatus may further include:
  • a first length acquisition module used to acquire a first length of a queue of data packets to be sent of the target network card
  • the issuing module 205 may include:
  • the first sending unit is used to send the data packet from the target network card through the data packet sending function of the BPF when the first length is less than or equal to a preset length.
  • the data processing device based on policy routing may further include:
  • a first length and priority acquisition module used to acquire a first length of a queue of data packets to be sent of the target network card and a priority of the target network card;
  • a first network card determining module configured to determine, when the first length is greater than a preset length, the remaining first network cards in the network card group where the target network card is located; each of the first network cards and the target network card corresponds to the destination address;
  • a second length and priority acquisition module used to respectively acquire the second lengths of the to-be-sent data packet queues of the first network cards and the priorities of the first network cards;
  • a candidate network card determination module configured to select a candidate network card having a priority equal to or less than the priority of the target network card from the remaining first network cards in the network card group where the target network card is located;
  • An idle network card determining module configured to select an idle network card whose second length is smaller than the preset length and whose second length is the smallest from the candidate network cards;
  • the issuing module 205 may include:
  • the second sending unit is used to send the data packet from the idle network card through the data packet sending function of the BPF.
  • the issuing module 205 may include:
  • the third sending unit is used to send the data packet from the target network card through the data packet sending function of the BPF when the network card group where the target network card is located has only the target network card.
  • the issuing module 205 may include:
  • the fourth sending unit is used to send the data packet from the target network card through the data packet sending function of the BPF when the candidate network card is not selected.
  • the issuing module 205 may include:
  • the fifth sending unit is used to send the data packet from the target network card through the data packet sending function of the BPF when no idle network card is selected.
  • the configuration module 201 may include:
  • the first configuration unit is used to configure policy routing based on the two-layer map of eBPF; one of the two-layer maps includes: an inner map and an outer map, the inner map includes an inner map of a target routing table and at least one inner routing rule map, the inner routing rule map includes a routing rule, and the inner map of the target routing table includes: a target routing table; the outer map in one of the two-layer maps includes: routing rules corresponding to all the inner routing rule maps in the two-layer map and a target routing table corresponding to the inner map of the target routing table.
  • the configuration module 201 may include:
  • the second configuration unit is used to establish a corresponding relationship between routing rules and routing tables based on the kernel data structure of the extended Berkeley packet filter.
  • the data processing device based on policy routing may further include:
  • a first priority setting data receiving module used for receiving priority setting data for the target network card
  • a first priority setting module configured to set a priority for the target network card based on the priority setting data of the target network card
  • a network card group division module used for dividing all network cards of the network device into at least one network card group according to corresponding destination addresses; all network cards in the network card group correspond to the same destination address;
  • a second priority setting data receiving module used for receiving priority setting data for each of the first network cards respectively;
  • the second priority setting module is used to set the priority for each of the first network cards based on the priority setting data of each of the first network cards.
  • the preset length is 70%-80% of the length of the queue of data packets to be sent of the target network card when the queue of data packets to be sent of the target network card is fully loaded.
  • the BPF routing lookup function includes: a bpf_fib_lookup function.
  • the BPF data packet sending function includes: bpf_redirect series functions.
  • the data processing device based on policy routing may further include:
  • the first sending module is used to send out the data packet through a network filter when a target routing table matching each routing rule of the data packet is not determined in the plurality of routing tables.
  • the data processing device based on policy routing may further include:
  • the second sending module is used to send the data packet through a network filter when the target network card corresponding to the destination address of the data packet is not found in the target routing table.
  • the present application also provides an electronic device, which includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements any of the steps of the aforementioned data processing method based on policy routing when executed by the processor.
  • processors can be general-purpose processors, including central processing units (CPU), network processors (NP), etc.; they can also be digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • CPU central processing units
  • NP network processors
  • DSP digital signal processors
  • ASIC application specific integrated circuits
  • FPGA field programmable gate arrays
  • the memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory.
  • the memory may also be at least one storage device located away from the aforementioned processor.
  • An embodiment of the present application also provides a non-volatile readable storage medium, on which a computer program is stored.
  • a computer program is stored on which a computer program is stored.
  • the steps of any of the aforementioned data processing methods based on policy routing are implemented.
  • Configure policy routing based on eBPFmap Specifically, first, create routing table 100 and add a policy route with gateway 172.16.100.1 from network card ens3. For example, this can be achieved through the following program: #ip route add default via 172.16.100.1 table 100
  • ens3 and ens4 form a network card group. In this way, if the network traffic of 192.168.1.0/24 accumulates a lot on ens3, it will borrow the bandwidth of ens4 to send data packets, but the network traffic of 192.168.2.0/24 can only be sent on ens4, which is equivalent to setting the priority of the network traffic of 192.168.1.0/24 higher than that of 192.168.2.0/24.
  • the technical solution of the present application can be embodied in the form of a software product, which is stored in a non-volatile readable storage medium (such as ROM/RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.
  • a non-volatile readable storage medium such as ROM/RAM, magnetic disk, optical disk
  • a terminal which can be a mobile phone, computer, server, air conditioner, or network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了基于策略路由的数据处理方法和装置、设备和非易失性可读存储介质，涉及通信技术领域。方法包括：基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置；拦截需要发出的数据包；数据包包括：目的地址和若干个路由规则；在若干个路由表中，确定与数据包的各个路由规则匹配的目标路由表；基于BPF路由查找函数，在目标路由表中，查找数据包的所述目的地址对应的目标网卡；通过BPF的数据包发送函数，将数据包基于所述目标网卡发出。本申请中，策略路由由eBPF实现，绕过了Netfilter和部分内核协议栈，减少了对内核的更改，减少了数据包的处理路径，策略路由效率高，提升了网络性能，降低了开发成本和维护成本。

Description

基于策略路由的数据处理方法和装置、设备和存储介质
本申请要求于2022年11月03日提交中国专利局，申请号为202211369071.X，申请名称为“基于策略路由的数据处理方法和装置、设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别是涉及基于策略路由的数据处理方法和装置、设备和非易失性可读存储介质。
背景技术
数据处理过程中，网络设备通常需要进行策略路由，以实现数据传输。目前，数据传输过程通常采用网络过滤器(Netfilter)，进行策略路由。
然而，Netfilter是一个非常庞大的内核框架，且具有很大的冗余，同时，采用Netfilter进行策略路由，要求数据包完整走完内核协议栈，数据包经过的处理路径较多，使得采用Netfilter进行策略路由会导致网络性能下降，同时，采用Netfilter，进行策略路由，与内核协议栈关联较深，实现方法复杂，维护成本高。
发明内容
本申请提供一种基于策略路由的数据处理方法和装置、设备和非易失性可读存储介质，旨在解决采用Netfilter进行策略路由导致网络性能下降、实现方法复杂、维护成本高的问题。
本申请的第一方面，提供一种基于策略路由的数据处理方法，应用于网络设备，所述方法包括：
基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置；所述策略路由包括：若干个路由表；
拦截需要发出的数据包；所述数据包包括：目的地址和若干个路由规则；
在所述若干个路由表中，确定与所述数据包的各个所述路由规则匹配的目标路由表；
基于BPF路由查找函数，在所述目标路由表中，查找所述数据包的所述目的地址对应的目标网卡；
通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出。
本申请中，基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置、对数据包进行拦截，拦截后由基于扩展的伯克利数据包过滤器的内核数据结构配置的策略路由进行路由，查找得到该数据包的目的地址对应的目标网卡，基于BPF的数据包发送函数，将数据包基于该目标网卡发出，数据传输过程中，策略路由由扩展的伯克利数据包过滤器实现，绕过了Netfilter和部分内核协议栈，减少了对内核的更改，减少了数据包的处理路径，策略路由效率高，大大提升了网络性能。同时，通过绕过部分内核协议栈，使得策略路由大大简化，由于减少了对内核的更改，简化了策略路由的实现步骤，因此，基本不会破会内核的稳定性，并提升了扩展性和适应范围，降低了开发成本和维护成本。
在一些实施例中，所述数据包为所述网络设备接收到的需要转发的数据包，所述拦截需要发出的数据包，包括：
在快速数据路径的钩子点，拦截所述网络设备接收到的需要转发的数据包。
在一些实施例中，所述数据包为所述网络设备产生、且需要发出的数据包，所述拦截需要发出的数据包之前，所述方法还包括：在所述BPF路由查找函数中路由查找之前的位置处，增加扩展的伯克利数据包过滤器的钩子点；
所述拦截需要发出的数据包，包括：
在增加的所述扩展的伯克利数据包过滤器的钩子点拦截所述网络设备产生、且需要发出的数据包。
在一些实施例中，所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出之前，所述方法还包括：
获取所述目标网卡的待发送数据包队列的第一长度；
所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出，包括：
在所述第一长度小于或等于预设长度的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
在一些实施例中，所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出之前，所述方法还包括：
获取所述目标网卡的待发送数据包队列的第一长度，和所述目标网卡的优先级；
在所述第一长度大于预设长度的情况下，确定所述目标网卡所在的网卡组中的其余各个第一网卡；各个所述第一网卡与所述目标网卡均与所述目的地址对应；
分别获取各个所述第一网卡的待发送数据包队列的各个第二长度，和各个所述第一网卡的优先级；
从所述目标网卡所在的网卡组中的其余各个第一网卡中，选择优先级等于或小于所述目标网卡的优先级的待选网卡；
从所述待选网卡中选择所述第二长度小于所述预设长度，且所述第二长度最小的空闲网卡；
所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出，包括：
通过所述BPF的数据包发送函数，将所述数据包从所述空闲网卡发出。
在一些实施例中，所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出，包括：
在所述目标网卡所在的网卡组仅有所述目标网卡一个网卡的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
在一些实施例中，所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出，包括：
在未选择到待选网卡的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
在一些实施例中，所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出，包括：
在未选择到空闲网卡的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
在一些实施例中，所述基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置，包括：
基于扩展的伯克利数据包过滤器的两层内核数据结构进行策略路由的配置；一个所述两层内核数据结构包括：内侧内核数据结构和外侧内核数据结构，所述内侧内核数据结构包括一个目标路由表内侧内核数据结构和至少一个内侧路由规则内核数据结构，所述内侧路由规则内核数据结构包括一个路由规则，所述目标路由表内侧内核数据结构包括：目标路由表；一个所述两层内核数据结构中的所述外侧内核数据结构包括：所述两层内核数据结构中所有的所述内侧路由规则内核数据结构对应的路由规则和所述目标路由表内侧内核数据结构对应的目标路由表。
在一些实施例中，所述基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置，包括：
基于扩展的伯克利数据包过滤器的内核数据结构建立路由规则与路由表的对应关系。
在一些实施例中，所述获取所述目标网卡的待发送数据包队列的第一长度，和所述目标网卡的优先级之前，所述方法还包括：
接收对于所述目标网卡的优先级设定数据；
基于所述目标网卡的优先级设定数据，为所述目标网卡设置优先级；
所述确定所述目标网卡所在的网卡组中的其余各个第一网卡之前，所述方法还包括：
将所述网络设备的所有网卡，根据对应的目的地址划分为至少一个网卡组；所述网卡组中的所有网卡均对应相同的目的地址；
所述分别获取各个所述第一网卡的待发送数据包队列的各个第二长度，和各个所述第一网卡的优先级之前，所述方法还包括：
分别接收对于各个所述第一网卡的优先级设定数据；
基于各个所述第一网卡的优先级设定数据，分别为各个所述第一网卡设置优先级。
在一些实施例中，所述预设长度为所述目标网卡的待发送数据包队列满载情况下，所述目标网卡的待发送数据包队列长度的70％-80％。
在一些实施例中，所述BPF路由查找函数，包括：bpf_fib_lookup函数。
在一些实施例中，所述BPF的数据包发送函数，包括：bpf_redirect系列函数。
在一些实施例中，所述方法还包括：
在所述若干个路由表中未确定到与所述数据包的各个所述路由规则匹配的目标路由表的情况下，通过网络过滤器，将所述数据包发出。
在一些实施例中，所述方法还包括：
在所述目标路由表中未查找到所述数据包的所述目的地址对应的目标网卡的情况下，通过网络过滤器，将所述数据包发出。
本申请的第二方面，提供一种基于策略路由的数据处理装置，应用于网络设备，所述装置包括：
配置模块，用于基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置；所述策略路由包括：若干个路由表；
拦截模块，用于拦截需要发出的数据包；所述数据包包括：目的地址和若干个路由规则；
目标路由表确定模块，用于在所述若干个路由表中，确定与所述数据包的各个所述路由规则匹配的目标路由表；
目标网卡确定模块，用于基于BPF路由查找函数，在所述目标路由表中，查找所述数据包的所述目的地址对应的目标网卡；
发出模块，用于通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出。
在一些实施例中，所述的基于策略路由的数据处理装置还包括：
钩子点增加模块，用于在所述BPF路由查找函数中路由查找之前的位置处，增加扩展的伯克利数据包过滤器的钩子点；
所述拦截模块，包括：
第一拦截单元，用于在增加的所述扩展的伯克利数据包过滤器的钩子点拦截所述网络设备产生、且需要发出的数据包。
本申请的第三方面，提供一种电子设备，包括：处理器、存储器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述计算机程序被所述处理器执行时实现如任一前述的基于策略路由的数据处理方法的步骤。
本申请的第四方面，提供一种非易失性可读存储介质，所述非易失性可读存储介质上存储计算机程序，所述计算机程序被处理器执行时实现如任一前述的基于策略路由的数据处理方法的步骤。
本申请中基于策略路由的数据处理装置、电子设备、非易失性可读存储介质均具有与任一前述的基于策略路由的数据处理方法相同或相似的有益效果。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出了本申请实施例中的第一种基于策略路由的数据处理方法的步骤流程图；
图2示出了本申请实施例中的一种基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置的流程示意图；
图3示出了发明实施例中的一种目标路由表确定的示意图；
图4示出了现有技术中的一种采用Netfilter进行策略路由的数据处理的流程示意图；
图5示出了本申请实施例中的一种基于策略路由的数据处理方法的流程示意图；
图6示出了本申请实施例中的一种数据包发出流程的示意图；
图7示出了本申请实施例中的一种网卡组的示意图；
图8示出了本申请实施例中的一种基于策略路由的数据处理方法的流程示意图；
图9示出了本申请实施例中的一种基于策略路由的数据处理装置的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例， 本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请提供一种基于策略路由的数据处理方法，应用于网络设备，此处的网络设备可以是指广义的网络设备、狭义的网络设备。广义的网络设备，可以是网络计算机(可以包括：个人电脑或服务器，如，云平台)、网络打印机、网络摄像头、RTU、智能手机等。狭义的网络设备可以包括：交换机、路由器、防火墙、网桥、集线器、网关、VPN服务器、网络接口卡(NIC)、无线接入点(WAP)、调制解调器、5G基站、光端机、光纤收发器、光缆等。
此处的路由是指网络设备根据需要发出的数据包中的网络层目的地址(Destination IP地址)以及内部维护的路由表决定输出端口、输出网卡以及下一跳地址，并且重写链路层数据包头(MAC地址)实现数据包发送、转发，这一过程叫路由，有时也把路由表中的记录(路由项)简称为路由。路由一般使用命令ip route进行维护和查看。
策略路由是一种比基于目标网络进行路由更加灵活的数据包路由发送机制。策略路由由很多条策略组成，每个策略都定义了1个或多个的匹配路由规则和对应操作。路由规则对象不但可以是目的IP地址，还可以是目的端口、源IP地址、源端口、协议类型等，这样发送、控制数据包更灵活。策略路由的优先级比路由高。策略路由一般使用命令ip rule进行维护和查看。
策略路由规则或选择器就是可以进行匹配的数据元素，比如目的IP地址、目的端口、源IP地址、源端口、协议类型、fwmark等，其中fwmark是指检查数据包的mark数据。
图1示出了本申请实施例中的第一种基于策略路由的数据处理方法的步骤流程图。该方法应用于前述的网络设备，参照图1所示，该基于策略路由的数据处理方法可以包括如下步骤：
步骤101，基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置；所述策略路由包括：若干个路由表。
扩展的伯克利数据包过滤器是(Extended Berkeley Packet Filter，eBPF)一种数据包过滤技术，提供了一种在内核事件和用户程序事件发生时安全注入代码的机制，后来逐步扩展到了网络、内核、安全、跟踪等，在故障诊断、网络优化、安全控制、性能监控等领域获得大量应用。eBPF是在BPF(Berkeley Packet Filter，伯克利数据包过滤器)基础上扩展的。内核数据结构指的是map。扩展的伯克利数据包过滤器的内核数据结构指的是eBPFmap。
eBPFmap是驻留在内核中的以键/值方式存储的数据结构，可以被任何知道它们的eBPF程序访问。在用户空间运行的程序也可以通过使用文件描述符来访问eBPFmap。可以在eBPFmap中存储任何类型的数据，只要事先正确指定数据大小。在内核中，键和值都被视为二进制的方式来存储。eBPFmap用于用户空间和内核空间之间的数据交换、信息传递。
实现一个用户空间应用程序，基于eBPFmap进行策略路由的配置，此处的配置可以包括新增、删除、修改、查询策略路由等。因为eBPFmap的特性，可以配置后立刻生效，而不需要重启服务或进程之类的操作，不会改变任何内核源代码，减少了eBPF程序与内核之间的耦合，减少了对内核的更改，减少了数据包的处理路径，提升了网络性能，具备良好的功能可扩展性。
图2示出了本申请实施例中的一种基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置的流程示意图。参照图2所示，eBPFmap进行策略路由的配置的过程中，需要进行路由规则合法性检查，以及路由规则逻辑性检查等。路由规则合法性检查是指对具体路 由规则的正确性检查，例如：是否是合法IP、掩码是否在[1，24]，IP协议类型是否合法(内核头文件有宏定义认为合法)，出入设备名是否存在等。路由规则逻辑性检查是指是否具有路由表，是否具有除路由表选择器以外的其它路由规则或选择器，不能具有重复类型的路由规则或选择器等。需要说明的是，在路由规则合法性检查，以及路由规则逻辑性检查等至少一项检查不通过的情况下，可以进行失败提示。对于失败提示的具体形式不作具体限定，例如，可以是显示失败提示对话框等。
策略路由在map中可以由多种存放方式，对于策略路由在map中的具体存放方式不作限定。
对于策略路由包括的路由表的数量不作具体限定。例如，路由表的数量可以为256个，路由表可以为unsginedshort(无符号短整型)类型，取值范围可以为[0，255]。对于具体的路由规则，以及路由规则可能的取值不作具体限定。例如，参照表1所示，表1示出了一种路由规则与各个路由规则可能的取值。策略路由具体包括多少个路由规则不作具体限定，策略路由至少包括一个路由规则。
表1：路由规则与各个路由规则可能的取值表
在表1中IP地址是IP协议提供的一种统一的地址格式，它为互联网上的每一个网络和每一台主机分配一个逻辑地址，以此来屏蔽物理地址的差异。例如：192.168.0.10(IPv4)和2001:DB8:2de::e13(IPv6)。
MAC地址为媒体存取控制位址，也称为局域网地址(LAN Address)、MAC位址、以太网地址(Ethernet Address)或物理地址(Physical Address)，它是一个用来确认网络设备位置的位址。在OSI模型中，第三层网络层负责IP地址，第二层数据链路层则负责MAC位址。MAC地址用于在网络中唯一标示一个网卡，一台设备若有一或多个网卡，则每个网卡都需要并会有一个唯一的MAC地址。例如：11:22:33:44:55:66。
需要说明的是，策略路由技术源自于多网络接入环境的特殊需求。不同运营商网络交互数据时存在通信问题，导致不同运营商之间网络数据传输速率较低。使用策略路由可以在存在多运营商网络的环境下，实现特定数据在特定运营商网络上传递。
在多网卡的情况下，例如，包括数据网络、WLAN网络、以太网网络、网络管理程序可以进行灵活的配置，指定数据从哪个网络发出。另一方面在vpn网络下，也能方便实现vpn代理，配置哪些应用通过vpn网络进行数据代理。
需要说明的是，eBPFmap中具有快速的路由查找算法，例如，bpf_fib_lookup函数，便于快速查找到目标路由表。
步骤102，拦截需要发出的数据包；所述数据包包括：目的地址和若干个路由规则。
需要发出的数据包可以是网络设备自身产生的数据包，也可以是网络设备接受的需要网络设备转发的数据包，此处对数据包的来源不作具体限定。数据包可以包括：目的地址和若干个路由规则。目的地址就是该数据包需要达到的地址。
该步骤中，可以通过eBPF中的各个钩子(hook)点拦截需要发出的数据包。具体是用哪个hook点拦截不作具体限定。
步骤103，在所述若干个路由表中，确定与所述数据包的各个所述路由规则匹配的目标路由表。
具体的，一个路由表与至少一个路由规则对应，将数据包的各个路由规则，与各个路由表对应的路由规则进行比对，数据包的各个路由规则，与某一个路由表对应的各个路由规则均一一相符的情况下，认为该路由表就是与该数据包的各个路由规则匹配的目标路由表，只要有一个路由规则不相符就认为该路由表不是该数据包的各个路由规则匹配的目标路由表。
例如，针对前述表1而言，就是将数据包中每一个Key，以及每一个Key对应的Value，与策略路由中的每个路由表对应的每一个Key，以及每一个Key对应的Value分别进行比对，在数据包中每一个Key，以及每一个Key对应的Value，与某一个路由表对应的每一个Key，以及每一个Key对应的Value均一一相符的情况下，认为该路由表就是与该数据包的各个路由规则匹配的目标路由表。只要数据包中有一个Key，以及该Key对应的Value与某一个路由表对应的一个Key，以及每一个Key对应的Value不相符的情况下，就认为该路由表不是与该数据包的各个路由规则匹配的目标路由表。
图3示出了发明实施例中的一种目标路由表确定的示意图。如图3所示，数据包中仅包括一个路由规则，若数据包的路由规则与路由规则1相同，而路由规则1与路由表1对应，则，与该数据包的路由规则匹配的目标路由表即为路由表1。若数据包的路由规则与路由规则1不相同，而与路由规则2相同，而路由规则2与路由表2对应，则，与该数据包的路由规则匹配的目标路由表即为路由表2。若数据包的路由规则与路由规则2不相同，而与路由规则3相同，而路由规则3与路由表3对应，则，与该数据包的路由规则匹配的目标路由表即为路由表3。 若数据包的路由规则与路由规则3不相同，而与路由规则4相同，而路由规则4与路由表4对应，则，与该数据包的路由规则匹配的目标路由表即为路由表4。
步骤104，基于BPF路由查找函数，在所述目标路由表中，查找所述数据包的所述目的地址对应的目标网卡。
对于BPF路由查找函数不作具体限定。在一些实施例中，BPF路由查找函数可以为bpf_fib_lookup函数，BPF路由查找函数兼容了BPF中已有的路由查找函数，实现方式简单。该步骤可以是，基于bpf_fib_lookup函数，在目标路由表中，查找该数据包的目的地址对应的目标网卡。
步骤105，通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出。
对于BPF的数据包发送函数不作具体限定。在一些实施例中，BPF的数据包发送函数可以是bpf_redirect系列函数，BPF的数据包发送函数兼容了BPF中已有的数据包发送函数，实现方式简单。该步骤可以是，通过bpf_redirect系列函数，将数据包基于目标网卡发出。
更为具体的，图4示出了现有技术中的一种采用Netfilter进行策略路由的数据处理的流程示意图。图4中：路由前匹配的链是指PREROUTING链，主要用于在报文或数据包路由前对报文或数据包进行拦截。路由后匹配的链是指POSTROUTING链，主要用于在报文或数据包路由后对报文或数据包进行拦截。路由和数据包转发链是指FORWARD链，具体是Linux内核的路由和数据包转发，主要用于对需要转发的报文或数据包进行拦截。数据包流进的链是指INPUT链，主要用于对到本机的数据包或报文进行拦截。数据包流出的链是指OUTPUT链，主要用于对本机生成的数据包或报文进行拦截。过滤配置信息表是指Filter表，用于存储对报文的过滤的配置信息。网络地址转换表是指NAT表，用来存储网络地址转换的相关配置信息。报文修改配置信息表是指Mangle表，用于存储对报文的修改的配置信息，跟踪处理表是指RAW表，主要用于在协议栈入口处对原始报文进行跟踪和处理。图4中实线四边形方框表征为基于RAW表的处理，实线六边形框表征为基于Mangle表的处理，实线长条孔框表征为基于NAT表的处理，实线梯形框表征为基于Filter表的处理。
发明人发现现有技术中，采用Netfilter进行策略路由导致网络性能下降的主要原因在于：一是，参照图4所示，Netfilter是一个非常庞大的内核框架，这个框架出现在内核数据路径的多个地方，有很大的冗余，而且在大量路由规则存在的情况下，Netfilter会导致网络性能下降，路由规则越多，性能就越低。二是，如果是简单的策略路由，只涉及出入网卡、源地址、源端口、目的地址、目的端口、协议类型等，可以直接使用命令(ip rule)添加，但如果涉及到复杂路由规则，在Netfilter中就需要使用iptables/mark了，比如只允许本地网络某些规定机器的数据从5G网卡出，其他的走WLAN，则需要检查源MAC。两个出口网络的MTU(Maximum Transmission Unit，最大传输单元)不一样，为了让性能最优，所以需要让长度大于某个值的包走特定网络，则需要检查包长。根据所属进程决定数据包走向的策略路由，则需要检查；还有自定义协议部分的识别，iprule普通路由规则或选择器也支持不了，在Netfilter中需要使用iptables/mark。三是，同时，在Netfilter中使用策略路由的fwmark选择器或路由规则时，必须搭配iptables/mark一起使用。具体的，先使用iptables设置打mark标签的路由规则，然后策略路由再使用fwmark选择器对mark进行匹配，比如：#iptables-t mangle-A PREROUTING-i eth3 -p tcp--dport 80-j MARK--set-mark 1，把从eth3网卡进入的端口为80的TCP数据包打上mark 标记1。#ip rule add fwmark 1table 100，mark标记为1的数据包都采用路由表100进行路由查找，过程较为复杂。
需要说明的是，此处的MTU用来通知对方所能接受数据服务单元的最大尺寸，说明发送方能够接受的有效载荷大小。是包或帧的最大长度，一般以字节记。如果MTU过大，在碰到路由器时会被拒绝转发，因为它不能处理过大的包。如果太小，因为协议一定要在包(或帧)上加上包头，那实际传送的数据量就会过小，这样也划不来。大部分操作系统会提供给用户一个默认值，该值一般对用户是比较合适的。此处的iptables就是建立在Netfilter之上，是用户空间应用程序。mark是iptables有一个模块可以为符合条件的数据包设置一个标记(属于管理数据)，该标记就是mark，在Netfilter后续都可以依照该标记对数据包进行一系列的操作。
针对上述问题，本申请中，基于eBPFmap进行策略路由的配置、对数据包进行拦截，拦截后由基于eBPFmap配置的策略路由进行路由，查找得到该数据包的目的地址对应的目标网卡，基于BPF的数据包发送函数，将数据包基于该目标网卡发出，数据传输过程中，策略路由由eBPF实现，绕过了Netfilter和部分内核协议栈，减少了对内核的更改，减少了数据包的处理路径，策略路由效率高，大大提升了网络性能。同时，通过绕过部分内核协议栈，使得策略路由大大简化，由于减少了对内核的更改，因此，基本不会破会内核的稳定性，且简化了策略路由的实现步骤，并提升了扩展性和适应范围，降低了开发成本和维护成本。而且，基于eBPFmap进行策略路由的配置替代了ip rule/fwmark路由规则的复杂需求，使得路由规则的配置，如，增、删、改、查等可以方便设置，且不会中断应用。
需要说明的是，目前的网络设备的内核版本基本都已支持eBPF，同时，eBPF程序类型具有良好的可扩展性，eBPF具有路由查找和数据包转发的相应API，因此，本申请的适用范围广，且实现方式简单。在将数据包发出后，该网络设备可以将该数据包丢弃，并记录数据包发出日志等。
在一些实施例中，前述步骤101可以包括：建立路由规则与路由表的对应关系，进而在对数据包发出时，就可以根据该数据包包括的路由规则，匹配目标路由表了。
图5示出了本申请实施例中的一种基于策略路由的数据处理方法的流程示意图。
在一些实施例中，前述的数据包可以是该网络设备接收到的需要转发的数据包，前述步骤102可以包括：在快速数据路径(eXpress Data Path，XDP)的hook点，拦截该网络设备接收到的需要转发的数据包。XDP是Linux网络处理流程中的一个eBPF钩子，能够挂载eBPF程序，它能够在数据包到达网卡驱动层时对其进行处理，具有非常优秀的数据面处理性能，打通了Linux网络处理的高速公路。
具体的，参照图5所示，左下角的数据包可以是该网络设备接收到的需要转发的数据包。按照图5的数据包传输路径，该网络设备接收到的需要转发的数据包在快速数据路径(eXpress Data Path，XDP)的hook点被拦截。图5中虚线箭头所示的是本申请的数据包的主要走向示意，实线箭头所示就是现有技术的数据包的主要走向示意。XDP的hook点将该网络设备接收到的需要转发的数据包拦截之后，在策略路由的若干个路由表中，根据该数据包包括的各个路由规则匹配目标路由表，如果匹配到目标路由表，再基于BPF路由查找函数，在该目标路由表中，查找该数据包的目的地址对应的目标网卡，然后通过BPF的数据包发送函数，如bpf_redirect系列函数，将该数据包基于该目标网卡发出。该网络设备接收到的需要转发的数 据包在查找目标网卡的过程中，绕过了Netfilter，以及至少部分内核数据协议栈，减少了对内核的更改，减少了数据包的处理路径，策略路由效率高，大大提升了网络性能。
在一些实施例中，参照图5所示，XDP的hook点将该网络设备接收到的需要转发的数据包拦截之后，如果在策略路由的若干个路由表中，根据该数据包包括的各个路由规则没有匹配到目标路由表，则，依然采用Netfilter对该数据包进行策略路由，并最终将该数据包发出，进而，在没有匹配到目标路由表的情况下，保证数据包可以被发出。
在一些实施例中，参照图5所示，在目标路由表中未查找到该数据包的目的地址对应的目标网卡的情况下，通过Netfilter，将数据包发出，进而，在没有找到目标网卡的情况下，保证数据包可以被发出。
例如，XDP的hook点将该网络设备接收到的需要转发的数据包拦截之后，如果在策略路由的若干个路由表中，根据该数据包包括的各个路由规则匹配到目标路由表，但是目标路由表中没有找到该数据包包括的目的地址对应的目标网卡，则，依然采用Netfilter对该数据包进行策略路由，并最终将该数据包发出。
在一些实施例中，前述数据包可以是该网络设备产生、且需要发出的数据包。前述步骤102之前，该方法还可以包括：在前述的BPF路由查找函数中路由查找之前的位置处，增加eBPF的hook点。该步骤102可以包括：在增加的eBPF的hook点拦截该网络设备产生、且需要发出的数据包。参照图5右侧所示，在增加的eBPF的hook点拦截该网络设备产生、且需要发出的数据包之后，同样可以在策略路由的若干个路由表中，根据该数据包包括的各个路由规则匹配目标路由表，如果匹配到目标路由表，再基于BPF路由查找函数，在该目标路由表中，查找该数据包的目的地址对应的目标网卡，然后通过BPF的数据包发送函数，如bpf_redirect系列函数，将该数据包基于该目标网卡发出。该网络设备产生、且需要发出的数据包在查找目标网卡的过程中，绕过了Netfilter，以及至少部分内核数据协议栈，减少了对内核的更改，减少了数据包的处理路径，策略路由效率高，大大提升了网络性能。
更为具体的，在前述的BPF路由查找函数中路由查找之前的位置处，增加eBPF的hook点，或者说增加eBPF程序类型(假如叫routeForSelf)，eBPF的hook点新增成功后，就可以把eBPF程序挂载到该hook点。例如，可以在fib_lookup函数内部开头时增加这个eBPF的hook点。
在一些实施例中，参照图5所示，在目标路由表中未查找到该数据包的目的地址对应的目标网卡的情况下，通过Netfilter，将数据包发出，进而，在没有找到目标网卡的情况下，保证数据包可以被发出。
例如，参照图5所示，在前述的BPF路由查找函数中路由查找之前的位置处，增加的eBPF的hook点将该网络设备产生、且需要发出的数据包拦截之后，如果在策略路由的若干个路由表中，根据该数据包包括的各个路由规则没有匹配到目标路由表，则，依然采用Netfilter对该数据包进行策略路由，并最终将该数据包发出。增加的eBPF的hook点将该网络设备接收到的需要转发的数据包拦截之后，如果在策略路由的若干个路由表中，根据该数据包包括的各个路由规则匹配到目标路由表，但是目标路由表中没有找到该数据包包括的目的地址对应的目标网卡，则，依然采用Netfilter对该数据包进行策略路由，并最终将该数据包发出。
在一些实施例中，前述步骤105之前，该方法还可以包括：获取该目标网卡的待发送数据包队列的第一长度，该步骤105可以包括：在第一长度小于或等于预设长度的情况下，通过前述的BPF的数据包发送函数，将该数据包从该目标网卡发出。就是说，在确定了目标网卡之后，若目标网卡待发送的负载不是特别多，可以直接通过该目标网卡将该数据包发出，进而可以加快数据包的发出速度。
需要说明的是，该预设长度可以根据对于数据包的发出速度等进行确定，本申请中，对此不作具体限定。
在一些实施例中，该预设长度可以是目标网卡的待发送数据包队列满载情况下，待发送数据包队列长度的70％-80％。预设长度范围设置较为合理，数据包的发送效率较高。
例如，该预设长度可以是目标网卡的待发送数据包队列满载情况下，待发送数据包队列长度的70％、73％、74％、75％、77％、79％、80％。
在一些实施例中，前述步骤105之前，该方法还可以包括：获取该目标网卡的待发送数据包队列的第一长度，和该目标网卡的优先级。在该第一长度大于预设长度的情况下，确定该目标网卡所在的网卡组中的其余各个第一网卡，各个第一网卡与该目标网卡均与该数据包的目的地址对应。分别获取各个第一网卡的待发送数据包队列的各个第二长度，和各个第一网卡的优先级。从该目标网卡所在的网卡组中的其余各个第一网卡中，选择优先级等于或小于该目标网卡的优先级的待选网卡，然后，从待选网卡中选择第二长度小于前述预设长度，且该第二长度最小的空闲网卡。前述步骤105可以包括：通过前述的BPF的数据包发送函数，将该数据包从该空闲网卡发出。
在一些实施例中，在获取目标网卡的优先级之前，该方法还可以包括：接收对于目标网卡的优先级设定数据，基于该目标网卡的优先级设定数据，为目标网卡设置优先级。该优先级设定数据具体可以是将目标网卡的优先级设置为几级等。提前设定目标网卡的优先级，利于后续快速获取该目标网卡的优先级。
在一些实施例中，在获取第一网卡的优先级之前，该方法还可以包括：接收对于各个第一网卡的优先级设定数据，基于各个第一网卡的优先级设定数据，分别为各个第一网卡设置优先级。该优先级设定数据同样可以是将第一网卡的优先级设置为几级等。提前设定各个第一网卡的优先级，利于后续快速获取各个第一网卡的优先级。
例如，网络设备如果有多个网卡，可以给各个网卡设置优先级，对于各个网卡的优先级的设置不作具体限定。例如，若某个网络设备具有网卡A和网卡B，网卡A是sim(Subscriber Identity Module，用户识别卡)卡如手机卡，网卡B是WLAN网卡即wifi，可以把网卡A的优先级定义高一些，可以减少网卡A对应的缴费。
在一些实施例中，在确定目标网卡所在的网卡组中的其余各个第一网卡之前，该方法还可以包括：可以先将网络设备的所有网卡，根据其所对应的目的地址的不同划分为至少一个或若干个网卡组。一个网络设备对应的网卡组的数量不作具体限定，一个网卡组中网卡的数量也不作具体限定。同一个网卡组中的所有网卡均对应相同的目的地址。例如，同一网卡组中的所有网卡均与同一个目的地址对应，或，同一网卡组中的所有网卡均与相同的多个目的地址对应。
本申请的就是在根据策略路由找到了目标网卡，且该目标网卡的待发送数据包队列的长度较长的情况下，可以从该目标网卡所在的网卡组中，选择待发送数据包队列的长度较短，且数 据包队列的长度最短的最空闲的网卡，将该数据包发出，进而实现了链路聚合、可以增加带宽、实现流量负载均衡。相对于现有技术中，为了实现链路聚合、增加带宽，需要将根据本地网络的IP地址或MAC地址进行流量拆分，比如：两个1G的网卡，一半IP的流量走一个网卡，另一个IP的流量走另一个网卡，相当于具有2G网卡带宽，而言，本申请中通过对于网卡组的划分，使得后续实现方式简单。
在一些实施例中，前述步骤105可以包括：在目标网卡所在的网卡组仅有该目标网卡一个网卡的情况下，通过前述BPF的数据包发送函数，将数据包从该目标网卡发出。就是说，目标网卡所在的网卡组只有目标网卡一个网卡，则，该网络设备的其余网卡对应的目的地址和该数据包中的目的地址不对应，则，需要从该目标网卡将该数据包发出。
在一些实施例中，前述步骤105可以包括：在未选择到待选网卡的情况下，通过前述BPF的数据包发送函数，将数据包从该目标网卡发出。就是说，目标网卡所在的网卡组中除了目标网卡还有其余网卡，但是其余网卡的优先级均高于该目标网卡的优先级，则，需要从该目标网卡将该数据包发出。
在一些实施例中，前述步骤105可以包括：在未选择到空闲网卡的情况下，通过前述BPF的数据包发送函数，将数据包从该目标网卡发出。就是说，目标网卡所在的网卡组中除了目标网卡还有其余网卡，且其余网卡中存在的优先级等于或小于该目标网卡的优先级的待选网卡，但是待选网卡的待发送数据包队列的长度均较长，也就是说待选网卡也很忙碌，那么需要从该目标网卡将该数据包发出。
图6示出了本申请实施例中的一种数据包发出流程的示意图。参照图6所示，具体过程可以如下，基于BPF路由查找函数，在目标路由表中，查找到该数据包的目的地址对应的目标网卡之后，可以检查目标网卡的待发送数据包队列的第一长度是否小于或等于预设长度，若是，则通过BPF的数据包发送函数，将该数据包从目标网卡发出。若否，该目标网卡所在的网卡组是否只有目标网卡一个网卡，若是，则通过BPF的数据包发送函数，将该数据包从目标网卡发出。若否，目标网卡所在的网卡组中的其余各个第一网卡中，是否具有优先级等于或小于该目标网卡的优先级的待选网卡，若否，则通过BPF的数据包发送函数，将该数据包从目标网卡发出。若是，待选网卡中是否具有第二长度小于预设长度，且第二长度最小的空闲网卡，若否，则通过BPF的数据包发送函数，将该数据包从目标网卡发出。若是，则通过BPF的数据包发送函数，将该数据包从空闲网卡发出。
图7示出了本申请实施例中的一种网卡组的示意图。例如，参照图7所示，若确定的数据包的目的地址对应的目标网卡为网卡1，若网卡1的待发送数据包队列的第一长度小于或等于该预设长度，则，通过BPF的数据包发送函数，将该数据包从网卡1发出。若网卡1的待发送数据包队列的第一长度大于该预设长度，则，查找该网卡1所在的网卡组，该网卡1所在的网卡组中的网卡为网卡1、网卡2、网卡3共3个网卡。其中，网卡1的优先级高于网卡2的优先级，等于网卡3的优先级。则，得到的待选网卡就是网卡2和网卡3。若网卡2的待发送数据包队列的第二长度大于该预设长度，网卡3的待发送数据包队列的第二长度小于等于该预设长度，则，从待选网卡中确定的空闲网卡就是网卡3，则，通过BPF的数据包发送函数，将该数据包从网卡3发出。
在确定了目标网卡之后，是将数据包通过目标网卡发出，还是通过空闲网卡发出就是实现了链路聚合。图8示出了本申请实施例中的一种基于策略路由的数据处理方法的流程示意图。参照图8所示，先进行策略路由的配置，然后可以根据收据包是网络设备接收的需要转发的数据包，还是网络设备产生、且需要发出的数据包选择不同的传输路径，在确定了目标网卡之后，在基于前述的链路聚合，确定将数据包通过那个网卡发出。
在一些实施例中，上述步骤101可以包括：基于eBPF的两层内核数据结构(map)进行策略路由的配置；一个两层内核数据结构(map)包括：内侧map和外侧map，内侧map包括一个目标路由表内侧map和至少一个内侧路由规则map，内侧路由规则map包括一个路由规则，目标路由表内侧map包括：目标路由表；一个两层map中的外侧map包括：该两层map中所有的内侧路由规则map对应的路由规则和目标路由表内侧map对应的目标路由表，也就是采用Map-in-map进行策略路由的配置，外侧map相当于是二维数组或链表，便于后期对于路由规则的更改或组合等。在一个外侧map记录中路由规则不能重复。
例如，如下程序所示是基于eBPF的两层map进行策略路由的配置。{
是一个两层map记录，也是一条策略路由，包含2条内侧map记录。101:{"目标路由表":100}，是一条目标路由表内侧map记录，102:{"目的IP地址":192.168.1.0/24}，是一条内侧路由规则map。
是另一个两层map记录，也是一条策略路由，包含3条内侧map记录。201:{"目标路由表":200}，是一条目标路由表内侧map记录，202:{"目的IP地址":192.168.2.0/24}，是一条内侧路由规则map。203:{"目的端口":80}，是另一条内侧路由规则map。
需要说明的是，在一条策略路由中，可以包括多条路由规则，必须包含“目标路由表”，且表1中同一类型的路由规则在一条策略路由中不能重复出现。
需要说明的是，上述方法中，某些步骤的先后顺序可以不作具体限定，能够实现前述的技术效果即可。
图9示出了本申请实施例中的一种基于策略路由的数据处理装置的结构示意图。应用于网络设备。参照图9所示，该装置可以包括：
配置模块201，用于基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置；所述策略路由包括：若干个路由表；
拦截模块202，用于拦截需要发出的数据包；所述数据包包括：目的地址和若干个路由规则；
目标路由表确定模块203，用于在所述若干个路由表中，确定与所述数据包的各个所述路由规则匹配的目标路由表；
目标网卡确定模块204，用于基于BPF路由查找函数，在所述目标路由表中，查找所述数据包的所述目的地址对应的目标网卡；
发出模块205，用于通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出。
该基于策略路由的数据处理装置与任一前述的基于策略路由的数据处理方法具有相同或相似的有益效果，可以相互参照，为了避免重复，此处不再赘述。
在一些实施例中，所述数据包为所述网络设备接收到的需要转发的数据包，所述拦截模块202，可以包括：
第二拦截单元，用于在快速数据路径的钩子点，拦截所述网络设备接收到的需要转发的数据包。
在一些实施例中，所述数据包为所述网络设备产生、且需要发出的数据包，所述装置还可以包括：
钩子点增加模块，用于在所述BPF路由查找函数中路由查找之前的位置处，增加扩展的伯克利数据包过滤器的钩子点；
所述拦截模块202，可以包括：
第一拦截单元，用于在增加的所述扩展的伯克利数据包过滤器的钩子点拦截所述网络设备产生、且需要发出的数据包。
在一些实施例中，所述装置还可以包括：
第一长度获取模块，用于获取所述目标网卡的待发送数据包队列的第一长度；
所述发出模块205，可以包括：
第一发出单元，用于在所述第一长度小于或等于预设长度的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
在一些实施例中，所述基于策略路由的数据处理装置还可以包括：
第一长度和优先级获取模块，用于获取所述目标网卡的待发送数据包队列的第一长度，和所述目标网卡的优先级；
第一网卡确定模块，用于在所述第一长度大于预设长度的情况下，确定所述目标网卡所在的网卡组中的其余各个第一网卡；各个所述第一网卡与所述目标网卡均与所述目的地址对应；
第二长度和优先级获取模块，用于分别获取各个所述第一网卡的待发送数据包队列的各个第二长度，和各个所述第一网卡的优先级；
待选网卡确定模块，用于从所述目标网卡所在的网卡组中的其余各个第一网卡中，选择优先级等于或小于所述目标网卡的优先级的待选网卡；
空闲网卡确定模块，用于从所述待选网卡中选择所述第二长度小于所述预设长度，且所述第二长度最小的空闲网卡；
所述发出模块205，可以包括：
第二发出单元，用于通过所述BPF的数据包发送函数，将所述数据包从所述空闲网卡发出。
在一些实施例中，所述发出模块205，可以包括：
第三发出单元，用于在所述目标网卡所在的网卡组仅有所述目标网卡一个网卡的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
在一些实施例中，所述发出模块205，可以包括：
第四发出单元，用于在未选择到待选网卡的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
在一些实施例中，所述发出模块205，可以包括：
第五发出单元，用于在未选择到空闲网卡的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
在一些实施例中，所述配置模块201，可以包括：
第一配置单元，用于基于eBPF的两层map进行策略路由的配置；一个所述两层map包括：内侧map和外侧map，所述内侧map包括一个目标路由表内侧map和至少一个内侧路由规则map，所述内侧路由规则map包括一个路由规则，所述目标路由表内侧map包括：目标路由表；一个所述两层map中的所述外侧map包括：所述两层map中所有的所述内侧路由规则map对应的路由规则和所述目标路由表内侧map对应的目标路由表。
在一些实施例中，所述配置模块201，可以包括：
第二配置单元，用于基于扩展的伯克利数据包过滤器的内核数据结构建立路由规则与路由表的对应关系。
在一些实施例中，所述基于策略路由的数据处理装置还可以包括：
优先级设定数据第一接收模块，用于接收对于所述目标网卡的优先级设定数据；
优先级第一设定模块，用于基于所述目标网卡的优先级设定数据，为所述目标网卡设置优先级；
网卡组划分模块，用于将所述网络设备的所有网卡，根据对应的目的地址划分为至少一个网卡组；所述网卡组中的所有网卡均对应相同的目的地址；
优先级设定数据第二接收模块，用于分别接收对于各个所述第一网卡的优先级设定数据；
优先级第二设定模块，用于基于各个所述第一网卡的优先级设定数据，分别为各个所述第一网卡设置优先级。
在一些实施例中，所述预设长度为所述目标网卡的待发送数据包队列满载情况下，所述目标网卡的待发送数据包队列长度的70％-80％。
在一些实施例中，所述BPF路由查找函数，包括：bpf_fib_lookup函数。
在一些实施例中，所述BPF的数据包发送函数，包括：bpf_redirect系列函数。
在一些实施例中，所述基于策略路由的数据处理装置还可以包括：
第一发送模块，用于在所述若干个路由表中未确定到与所述数据包的各个所述路由规则匹配的目标路由表的情况下，通过网络过滤器，将所述数据包发出。
在一些实施例中，所述基于策略路由的数据处理装置还可以包括：
第二发送模块，用于在所述目标路由表中未查找到所述数据包的所述目的地址对应的目标网卡的情况下，通过网络过滤器，将所述数据包发出。
本申请还提供一种电子设备，电子设备包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述计算机程序被所述处理器执行时实现任一前述的基于策略路由的数据处理方法的步骤。
上述的处理器可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(Digital Signal Processing，简称DSP)、专用集成电路(Application Specific Integrated Circuit，简称ASIC)、现场可编程门阵列(Field－Programmable Gate Array，简称FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
存储器可以包括随机存取存储器(Random Access Memory，简称RAM)，也可以包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。在一些实施例中，存储器还可以是至少一个位于远离前述处理器的存储装置。
本申请实施例还提供一种非易失性可读存储介质，所述非易失性可读存储介质上存储计算机程序，所述计算机程序被处理器执行时实现任一前述的基于策略路由的数据处理方法的步骤。
下面结合具体的实施例，进一步解释说明本申请：
实施例
基于eBPFmap进行策略路由的配置。具体可以是，首先、创建路由表100，并添加网关是172.16.100.1，从网卡ens3发出的策略路由。例如，大致可以通过以下程序实现：#ip route add default via 172.16.100.1 table 100
#ip route list table 100
default via 172.16.100.1 dev ens3。
接着、创建路由表200，并添加网关是172.16.200.1，从网卡ens4发出的策略路由。例如，大致可以通过以下程序实现：#ip route add default via 172.16.200.1 table 200
#ip route list table 200
default via 172.16.200.1 dev ens4。
将上述策略路由添加在用户空间应用程序。可以把192.168.1.0/24网段的所有流量都指向table100，把192.168.2.0/24网段的所有流量都指向table200。经过以上配置还实现了用策略路由拆分网络流量：192.168.1.0/24的流量使用路由表100，默认网关是172.16.100.1，从ens3发出；192.168.2.0/24的流量使用路由表200，默认网关是172.16.200.1，从ens4发出。
在BPF路由查找函数中路由查找之前的位置处，增加eBPF的hook点。加载数据包为网络设备接收到的需要转发的数据包的策略路由的eBPF程序和数据包为该网络设备产生、且需要发出的数据包的策略路由的eBPF程序。
如果有2个WAN网卡：ens3、ens4，两者对应的目的地址相同，ens3、ens4形成网卡组。这样就达到了：192.168.1.0/24的网络流量如果在ens3堆积较多的时候，会去借用ens4的带宽进行数据包发送，但192.168.2.0/24的网络流量只能在ens4发出，也就是相当于设定了192.168.1.0/24的网络流量优先级别高于192.168.2.0/24的网络流量。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个非易失性可读存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本申请各个实施例所述的方法。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，这些均属于本申请的保护之内。

Claims (20)

  1. 一种基于策略路由的数据处理方法，其特征在于，应用于网络设备，所述方法包括：
    基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置；所述策略路由包括：若干个路由表；
    拦截需要发出的数据包；所述数据包包括：目的地址和若干个路由规则；
    在所述若干个路由表中，确定与所述数据包的各个所述路由规则匹配的目标路由表；
    基于BPF路由查找函数，在所述目标路由表中，查找所述数据包的所述目的地址对应的目标网卡；
    通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出。
  2. 根据权利要求1所述的基于策略路由的数据处理方法，其特征在于，所述数据包为所述网络设备接收到的需要转发的数据包，所述拦截需要发出的数据包，包括：
    在快速数据路径的钩子点，拦截所述网络设备接收到的需要转发的数据包。
  3. 根据权利要求1所述的基于策略路由的数据处理方法，其特征在于，所述数据包为所述网络设备产生、且需要发出的数据包，所述拦截需要发出的数据包之前，所述方法还包括：在所述BPF路由查找函数中路由查找之前的位置处，增加扩展的伯克利数据包过滤器的钩子点；
    所述拦截需要发出的数据包，包括：
    在增加的所述扩展的伯克利数据包过滤器的钩子点拦截所述网络设备产生、且需要发出的数据包。
  4. 根据权利要求1至3中任一所述的基于策略路由的数据处理方法，其特征在于，所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出之前，所述方法还包括：
    获取所述目标网卡的待发送数据包队列的第一长度；
    所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出，包括：
    在所述第一长度小于或等于预设长度的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
  5. 根据权利要求1至3中任一所述的基于策略路由的数据处理方法，其特征在于，所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出之前，所述方法还包括：
    获取所述目标网卡的待发送数据包队列的第一长度，和所述目标网卡的优先级；
    在所述第一长度大于预设长度的情况下，确定所述目标网卡所在的网卡组中的其余各个第一网卡；各个所述第一网卡与所述目标网卡均与所述目的地址对应；
    分别获取各个所述第一网卡的待发送数据包队列的各个第二长度，和各个所述第一网卡的优先级；
    从所述目标网卡所在的网卡组中的其余各个第一网卡中，选择优先级等于或小于所述目标网卡的优先级的待选网卡；
    从所述待选网卡中选择所述第二长度小于所述预设长度，且所述第二长度最小的空闲网卡；
    所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出，包括：
    通过所述BPF的数据包发送函数，将所述数据包从所述空闲网卡发出。
  6. 根据权利要求5所述的基于策略路由的数据处理方法，其特征在于，所述通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出，包括：
    在所述目标网卡所在的网卡组仅有所述目标网卡一个网卡的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出；
    或，
    在未选择到待选网卡的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出；
    或，
    在未选择到空闲网卡的情况下，通过所述BPF的数据包发送函数，将所述数据包从所述目标网卡发出。
  7. 根据权利要求1至3中任一所述的基于策略路由的数据处理方法，其特征在于，所述基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置，包括：
    基于扩展的伯克利数据包过滤器的两层内核数据结构进行策略路由的配置；一个所述两层内核数据结构包括：内侧内核数据结构和外侧内核数据结构，所述内侧内核数据结构包括一个目标路由表内侧内核数据结构和至少一个内侧路由规则内核数据结构，所述内侧路由规则内核数据结构包括一个路由规则，所述目标路由表内侧内核数据结构包括：目标路由表；一个所述两层内核数据结构中的所述外侧内核数据结构包括：所述两层内核数据结构中所有的所述内侧路由规则内核数据结构对应的路由规则和所述目标路由表内侧内核数据结构对应的目标路由表。
  8. 根据权利要求1至3中任一所述的基于策略路由的数据处理方法，其特征在于，所述基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置，包括：
    基于扩展的伯克利数据包过滤器的内核数据结构建立路由规则与路由表的对应关系。
  9. 根据权利要求5所述的基于策略路由的数据处理方法，其特征在于，所述获取所述目标网卡的待发送数据包队列的第一长度，和所述目标网卡的优先级之前，所述方法还包括：
    接收对于所述目标网卡的优先级设定数据；
    基于所述目标网卡的优先级设定数据，为所述目标网卡设置优先级；
    所述确定所述目标网卡所在的网卡组中的其余各个第一网卡之前，所述方法还包括：
    将所述网络设备的所有网卡，根据对应的目的地址划分为至少一个网卡组；所述网卡组中的所有网卡均对应相同的目的地址；
    所述分别获取各个所述第一网卡的待发送数据包队列的各个第二长度，和各个所述第一网卡的优先级之前，所述方法还包括：
    分别接收对于各个所述第一网卡的优先级设定数据；
    基于各个所述第一网卡的优先级设定数据，分别为各个所述第一网卡设置优先级。
  10. 根据权利要求5所述的基于策略路由的数据处理方法，其特征在于，所述预设长度为所述目标网卡的待发送数据包队列满载情况下，所述目标网卡的待发送数据包队列长度的70％-80％。
  11. 根据权利要求1至3中任一所述的基于策略路由的数据处理方法，其特征在于，所述BPF路由查找函数，包括：bpf_fib_lookup函数。
  12. 根据权利要求1至3中任一所述的基于策略路由的数据处理方法，其特征在于，所述BPF的数据包发送函数，包括：bpf_redirect系列函数。
  13. 根据权利要求1至3中任一所述的基于策略路由的数据处理方法，其特征在于，所述方法还包括：
    在所述若干个路由表中未确定到与所述数据包的各个所述路由规则匹配的目标路由表的情况下，通过网络过滤器，将所述数据包发出；
    或，
    在所述目标路由表中未查找到所述数据包的所述目的地址对应的目标网卡的情况下，通过网络过滤器，将所述数据包发出。
  14. 根据权利要求1所述的基于策略路由的数据处理方法，其特征在于，所述基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置，包括：
    基于扩展的伯克利数据包过滤器的内核数据结构进行路由规则合法性检查以及路由规则逻辑性检查；
    若所述路由规则合法性检查以及所述路由规则逻辑性检查均通过，则输出策略路由的配置成功；
    若所述路由规则合法性检查以及所述路由规则逻辑性检查存在至少一项不通过，则输出失败提示。
  15. 根据权利要求1所述的基于策略路由的数据处理方法，其特征在于，一个路由表与至少一个路由规则对象，所述在所述若干个路由表中，确定与所述数据包的各个所述路由规则匹配的目标路由表，包括：
    将数据包的各个第一路由规则，与各个路由表对应的第二路由规则进行比对；
    在数据包的各个第一路由规则，与其中一个路由表对应的各个第二路由规则均一一相符的情况下，判定该路由表为与数据包的各个第一路由规则匹配的目标路由表；
    在存在至少一个路由规则不相符的情况下，则认定该路由表不为与数据包的各个路由规则匹配的目标路由表。
  16. 根据权利要求1所述的基于策略路由的数据处理方法，其特征在于，所述数据包中包括若干个第一Key以及每一所述第一Key对应的第一value，所述路由表对应有第二Key以及每一个第二Key对应的第二value，所述在所述若干个路由表中，确定与所述数据包的各个所述路由规则匹配的目标路由表，包括：
    将所述数据包的各个所述第一Key以及所述第一Key对应的第一value，与所述路由表对应的每一个第二Key以及所述第二Key对应的第二value进行比较；
    在数据包中每一个第一Key，以及每一个第一Key对应的第一Value，与路由表对应的每一个第二Key，以及每一个第二Key对应的Value均一一相符的情况下，判定该路由表为与数据包的各个路由规则对应的目标路由表；
    在数据包中存在一个第一Key，以及第一Key对应的第一Value与路由表对应的一个第二Key，以及每一个第二Key对应的第二Value不相符的情况下，判定该路由表不是与该数据包的各个路由规则匹配的目标路由表。
  17. 根据权利要求2所述的基于策略路由的数据处理方法，其特征在于，还包括：
    在BPF路由查找函数中路由查找之前的位置处，增加eBPF的钩子点；
    在eBPF的钩子点新增成功后，将eBPF程序挂载到所述钩子点上。
  18. 一种基于策略路由的数据处理装置，其特征在于，应用于网络设备，所述装置包括：
    配置模块，用于基于扩展的伯克利数据包过滤器的内核数据结构进行策略路由的配置；所述策略路由包括：若干个路由表；
    拦截模块，用于拦截需要发出的数据包；所述数据包包括：目的地址和若干个路由规则；
    目标路由表确定模块，用于在所述若干个路由表中，确定与所述数据包的各个所述路由规则匹配的目标路由表；
    目标网卡确定模块，用于基于BPF路由查找函数，在所述目标路由表中，查找所述数据包的所述目的地址对应的目标网卡；
    发出模块，用于通过BPF的数据包发送函数，将所述数据包基于所述目标网卡发出。
  19. 一种电子设备，其特征在于，包括：处理器、存储器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述计算机程序被所述处理器执行时实现如权利要求1至17中任一所述的基于策略路由的数据处理方法的步骤。
  20. 一种非易失性可读存储介质，其特征在于，所述非易失性可读存储介质上存储计算机程序，所述计算机程序被处理器执行时实现如权利要求1至17中任一所述的基于策略路由的数据处理方法的步骤。
PCT/CN2023/115585 2022-11-03 2023-08-29 基于策略路由的数据处理方法和装置、设备和存储介质 WO2024093478A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211369071.XA CN115529272B (zh) 2022-11-03 2022-11-03 基于策略路由的数据处理方法和装置、设备和存储介质
CN202211369071.X 2022-11-03

Publications (1)

Publication Number Publication Date
WO2024093478A1 true WO2024093478A1 (zh) 2024-05-10

Family

ID=84705250

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/115585 WO2024093478A1 (zh) 2022-11-03 2023-08-29 基于策略路由的数据处理方法和装置、设备和存储介质

Country Status (2)

Country Link
CN (1) CN115529272B (zh)
WO (1) WO2024093478A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115529272B (zh) * 2022-11-03 2023-03-14 苏州浪潮智能科技有限公司 基于策略路由的数据处理方法和装置、设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190140983A1 (en) * 2017-11-09 2019-05-09 Nicira, Inc. Extensible virtual switch datapath
CN112532538A (zh) * 2020-11-23 2021-03-19 中信银行股份有限公司 流量的控制方法、装置、电子设备及计算机可读存储介质
CN114039930A (zh) * 2021-11-16 2022-02-11 中国联合网络通信集团有限公司 数据包处理方法及系统
CN115529272A (zh) * 2022-11-03 2022-12-27 苏州浪潮智能科技有限公司 基于策略路由的数据处理方法和装置、设备和存储介质

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111490939A (zh) * 2020-03-30 2020-08-04 苏州瑞立思科技有限公司 一种支持高级策略配置高性能的windows网卡驱动方法
CN114363170A (zh) * 2021-12-29 2022-04-15 中国电信股份有限公司 容器服务网络配置方法及相关产品

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190140983A1 (en) * 2017-11-09 2019-05-09 Nicira, Inc. Extensible virtual switch datapath
CN112532538A (zh) * 2020-11-23 2021-03-19 中信银行股份有限公司 流量的控制方法、装置、电子设备及计算机可读存储介质
CN114039930A (zh) * 2021-11-16 2022-02-11 中国联合网络通信集团有限公司 数据包处理方法及系统
CN115529272A (zh) * 2022-11-03 2022-12-27 苏州浪潮智能科技有限公司 基于策略路由的数据处理方法和装置、设备和存储介质

Also Published As

Publication number Publication date
CN115529272B (zh) 2023-03-14
CN115529272A (zh) 2022-12-27

Similar Documents

Publication Publication Date Title
US10693770B2 (en) Service chaining within computer networks
US10574763B2 (en) Session-identifer based TWAMP data session provisioning in computer networks
US20230041916A1 (en) Packet Transmission Method, Apparatus, and System
CN111901244B (zh) 一种网络报文转发系统
US10397066B2 (en) Content filtering for information centric networks
US8949413B2 (en) Filter selection and resuse
CN110808913B (zh) 报文处理的方法、装置及相关设备
US8576841B2 (en) Hybrid port range encoding
US9537755B2 (en) Access relay method and access gateway device
WO2017107814A1 (zh) 一种传播QoS策略的方法、装置及系统
US20130294449A1 (en) Efficient application recognition in network traffic
WO2024093478A1 (zh) 基于策略路由的数据处理方法和装置、设备和存储介质
US11800587B2 (en) Method for establishing subflow of multipath connection, apparatus, and system
CN110278152B (zh) 一种建立快速转发表的方法及装置
US11140075B1 (en) Network traffic steering among CPU cores using forwarding path elements
US10805202B1 (en) Control plane compression of next hop information
CN112637237A (zh) 基于SRoU的业务加密方法、系统、设备及存储介质
CN111953620B (zh) 一种分片报文的重组方法及装置
Lei et al. Can Host-Based SDNs Rival the Traffic Engineering Abilities of Switch-Based SDNs?
CN117596205A (zh) 报文处理方法、装置、电子设备及可读介质
CN117221201A (zh) 报文发送的方法、网络设备及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23884415

Country of ref document: EP

Kind code of ref document: A1