WO2014094420A1

WO2014094420A1 - Message processing method and device

Info

Publication number: WO2014094420A1
Application number: PCT/CN2013/079571
Authority: WO
Inventors: 骆绍开
Original assignee: 华为技术有限公司
Priority date: 2012-12-20
Filing date: 2013-07-18
Publication date: 2014-06-26
Also published as: CN103051529B; CN103051529A

Abstract

Disclosed are a message processing method and device, which relate to the technical field of networks, and solve the problems that when virtual local area network division and message processing are performed using front-back-end modes in the prior art, all the messages need to be transferred by a virtual machine manager, and the network performance is not high.A network device acquires a message. According to a port identifier corresponding to the port where the message is acquired, configuration information corresponding to the port identifier is searched. According to whether the message carries a virtual local area network identifier, a target virtual local area network identifier is determined from the designated virtual local area network identifier. The message is sent to a target virtual local area network corresponding to the target virtual local area network identifier.The embodiments of the present invention are applied in the virtual local area network division and message processing process.

Description

Message processing method and device

The present invention relates to the field of network technologies, and in particular, to a packet processing method and apparatus. Background technique

With the development of cloud computing, network entities no longer stick to physical devices, but simulate multiple virtual devices through physical devices. Generally, virtual machines are created through VMM (Virtual Machine Manager) on physical servers. The virtualization technology enables the virtual machine to communicate with other devices on the network after establishing a corresponding relationship through the physical NIC on the physical server. The physical network card that provides virtualization functions is called a virtual network card.

A virtual local area network (VLAN) is a communication technology that logically divides a local area network device into multiple broadcast domains (multiple virtual local area networks). In a network virtualization scenario, VMM manages virtual machines and physical resources into two categories: front-end mode and pass-through mode. In the prior art, the Xen platform is used as an example. When the front-end mode is used for virtual local area network division and packet processing, a virtual local area network (LAN) is configured in advance on Domain 0 for each DomainU NIC. When a packet is sent, all the packets of the DomainU need to reach the DomainO side first. The DomainO writes the corresponding virtual LAN label to the packet according to the configuration, and then sends the packet through the network card. When receiving a packet, the NIC sends the packet to the domain O. The domain O is checked by the domain O. The label is removed from the packet and sent to the DomainU. Otherwise, the packet is discarded.

During the implementation of the above-mentioned virtual LAN division and packet processing, all packets need to be transferred by the virtual machine manager, which reduces network performance. If the direct-pass mode is used for virtual LAN division and packet processing, network management should be opened to virtual machine users, which poses a security risk in management. Summary of the invention

Embodiments of the present invention provide a packet processing method and apparatus to improve security and network performance.

In order to achieve the above object, the embodiment of the present invention adopts the following technical solutions:

In a first aspect, the present invention provides a method for processing a message, including:

Obtain a message;

^{^:} Gen data acquisition corresponding to the 4-port port identifier Gen packets, searching the port identifier corresponding to the configuration information, the configuration information includes a specified virtual local area network identifier, the designated virtual local area network identifier is allowed to pass through the port Virtual local area network identifier;

Determining a target virtual local area network identifier from the specified virtual local area network identifier according to whether the packet carries a virtual local area network identifier;

Sending the message to the target virtual local area network corresponding to the target virtual local area network identifier. In a first possible implementation manner of the first aspect, before the acquiring the packet, the method further includes:

The preset configuration information corresponding to the port identifier is received from the management device. With reference to the first aspect, in a second possible implementation, the port is an uplink port or a downlink port of the network device, where the network device is installed on a physical server, and the physical server passes the network device The external device is connected, the uplink port is a physical port that the network device is connected to the external device, and the lower link is a queue that the network device is connected to the physical server, where the external device includes a switch, a router, or another physical network card. . With reference to the second possible implementation manner of the first aspect, in a third possible implementation manner, the network device is a physical network card in a virtualized scenario. In combination with the first aspect or the first possible implementation of the first aspect or the second possible implementation of the first aspect or the third possible implementation of the first aspect, in a fourth possible implementation Determining, according to whether the packet carries a virtual local area network identifier, determining the target virtual local area network identifier from the specified virtual local area network identifier, includes:

Determining whether the packet carries a virtual local area network identifier;

When the packet does not carry the virtual local area network identifier, the default virtual local area network identifier corresponding to the port is determined as the target virtual local area network identifier, and the default virtual local area network identifier is in the designated virtual local area network identifier;

When the packet carries the virtual local area network identifier, it is determined whether the virtual local area network identifier in the packet is in the specified virtual local area network identifier;

When the virtual local area network identifier in the specified virtual local area network identifier is in the specified virtual local area network identifier, the default virtual local area network identifier corresponding to the port is determined as the target virtual local area network identifier. With reference to the fourth possible implementation manner of the foregoing aspect, in a fifth possible implementation manner, when the packet is a packet to be received, the sending the packet to the target virtual local area network After the corresponding target virtual local area network is identified, the method further includes: receiving the packet by using the target virtual local area network, and writing the target virtual local area network identifier into the packet that does not carry the virtual local area network identifier. With reference to the fourth possible implementation manner of the foregoing aspect, in a sixth possible implementation manner, when the packet is a packet to be sent, the sending the packet to the target virtual local area network Before the corresponding target virtual local area network is identified, the method further includes: when the virtual local area network identifier carried by the packet is the same as the default virtual local area network identifier corresponding to the port, deleting the virtual local area network label carried by the fourth file, Virtual office In a second aspect, the present invention provides a network device, including:

An obtaining unit, configured to acquire a message;

a searching unit, configured to search for configuration information corresponding to the port identifier according to the port identifier corresponding to the port of the packet obtained by the acquiring unit, where the configuration information includes a specified virtual local area network identifier, where the designated virtual local area network identifier is The virtual local area network identifier that the port allows to pass;

a first processing unit, configured to determine, according to whether the packet carries a virtual local area network identifier, the target virtual local area network identifier from the specified virtual local area network identifier found by the searching unit;

And a sending unit, configured to send the packet to the target virtual office i or the network corresponding to the target virtual office i or the network identifier determined by the processing unit. In a first possible implementation manner of the second aspect, the network device further includes: a receiving unit, configured to receive preset configuration information corresponding to the port identifier from the management device. With reference to the second aspect, in a second possible implementation manner, the port of the network device is an uplink port or a downlink port, where the network device is installed on a physical server, and the physical server passes the network device The external device is connected, the uplink port is a physical port that the network device is connected to the external device, and the lower link is a queue that the network device is connected to the physical server, where the external device includes a switch, a router, or another physical network card. . With reference to the second possible implementation of the second aspect, in a third possible implementation manner, the network device is a physical network card in a virtualized scenario. With reference to the second aspect or the first possible implementation of the second aspect or the second possible implementation of the second aspect or the third possible implementation of the second aspect, in a fourth possible implementation manner The first processing unit includes:

a first determining module, configured to determine whether the packet carries a virtual local area network identifier, where the first processing module is configured to: when the first determining module determines that the packet does not carry a virtual local area network identifier, Determining, by the default virtual local area network identifier, the target virtual local area network identifier, where the default virtual local area network identifier is in the specified virtual local area network identifier;

a second determining module, configured to: when the first determining module determines that the packet carries a virtual local area network identifier, determine whether the virtual local area network identifier in the packet is in the specified virtual local area network identifier;

a second processing module, configured to: when the second determining module determines that the virtual local area network identifier in the packet is in the specified virtual local area network identifier, determine a default virtual local area network identifier corresponding to the port as the target Virtual LAN ID. With the fourth possible implementation of the second aspect, in a fifth possible implementation, when the packet is a packet to be received, the network device further includes:

And a second processing unit, configured to receive the packet by using the target virtual local area network, and write the target virtual local area network identifier into the packet that does not carry the virtual local area network identifier. With the fourth possible implementation of the second aspect, in a sixth possible implementation, when the packet is a packet to be sent, the network device further includes:

a third processing unit, configured to: when the virtual local area network identifier carried by the packet is the same as the default virtual local area network identifier corresponding to the port, delete the virtual local area carried by the fourth embodiment of the present invention. The message processing method and device, by acquiring the message, And determining, according to the port identifier corresponding to the port of the packet, the configuration information corresponding to the port identifier, and determining the target from the specified virtual local area network identifier in the configuration information according to whether the packet carries the virtual local area network identifier. The virtual local area network identifier is sent to the target virtual local area network corresponding to the target virtual local area network identifier. The embodiment of the present invention solves the problem that all the packets need to be transferred by the virtual machine manager and the network performance is not high when the virtual local area network is divided and the packet processing is performed by using the front-end mode in the prior art, and the security and network performance are improved. .

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the embodiments of the present invention will be briefly described below. Obviously, the drawings described below are only some embodiments of the present invention. Other drawings may also be obtained from those of ordinary skill in the art in view of the drawings.

1 is a flowchart of a method for processing a packet according to Embodiment 1 of the present invention; FIG. 2 is a schematic diagram of a connection relationship between a network device and a physical server and an external device according to Embodiment 1 of the present invention;

3 is a schematic diagram of a connection relationship between a physical network card and a physical server and an external device according to Embodiment 1 of the present invention;

4 is a flowchart of still another method for processing a packet according to Embodiment 1 of the present invention; FIG. 5 is a diagram showing an example of a configuration of configuration information of an uplink and a backup port according to Embodiment 1 of the present invention; 1 provides a flow chart of the physical network card entering from the physical port 1 when the virtual LAN attribute of the physical port 1 is a trunk port;

7 is a flowchart of a physical network card from a physical port 1 when a virtual local area network attribute of the physical port 1 is a hybr i d port according to Embodiment 1 of the present invention;

8 is a flowchart of a physical network card from a physical port 1 when a virtual local area network attribute of the physical port 1 is an acce s s port according to Embodiment 1 of the present invention;

FIG. 9 is a flowchart of still another method for processing a packet according to Embodiment 1 of the present invention; 10 is a flowchart of a physical network card from a queue 1 when a virtual local area network attribute of queue 1 is an acce ss port according to Embodiment 1 of the present invention;

11 is a flowchart of a physical network card from a queue 1 when a virtual local area network attribute of queue 1 is a t runk port according to Embodiment 1 of the present invention;

12 is a flowchart of a physical network card from a queue 1 when a virtual local area network attribute of queue 1 is a hybr i d port according to Embodiment 1 of the present invention;

FIG. 13 is a structural diagram of a network device 13 according to Embodiment 1 of the present invention; FIG. 14 is a structural diagram of another network device 13 according to Embodiment 2 of the present invention; FIG. 16 is a structural diagram of another network device 13 according to Embodiment 2 of the present invention; FIG. 17 is a schematic diagram of another network device 17 according to Embodiment 1 of the present invention; FIG. 18 is a structural diagram of a network device 18 according to Embodiment 3 of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Example 1

A packet processing method is provided in the embodiment of the present invention. The embodiment is applied to a network virtualization scenario, and the network device implements virtual local area network division and packet processing in a direct mode, as shown in FIG. Including the following steps:

101. Obtain a message.

Obtaining a packet through a port in the network device, as shown in FIG. 2, the connection relationship between the network device and the physical server and the external device, where the port is an uplink port or a downlink port, and the uplink port is a physical port to which the network device is connected to the external device, the downlink The port is a queue in which the network device is connected to the physical server, that is, the queue is a channel through which the network device interacts with the physical server, and each queue corresponds to a virtual machine on the physical server, and the report is The packet is received from the external device through the uplink port, and is sent to the physical server through the downlink interface, or received from the physical server through the downlink interface, and is received by the physical server. A message sent by the interface to the external device.

102. Search for the port identifier corresponding to the port that obtains the port, and search for the configuration information corresponding to the port identifier, where the configuration information includes a specified virtual local area network identifier, where the designated virtual local area network identifier is allowed to pass through the port. Virtual LAN ID.

The configuration information may be configured in the form of a list, for example, including a port identifier in the list, and configuration information corresponding to the port identifier, including a specified virtual local area network identifier, where the specified virtual local area network identifier includes a default virtual local area network. Identification, and a list of virtual local area network IDs that are allowed to pass.

In addition, the configuration information also includes virtual local area network attributes. According to the definition of virtual local area network frames in the IEEE (Institute of Electrical and Electronics Engineers) 802.1Q standard, virtual local area network attributes are classified into three categories: The port, the trunk port, and the hybrid port, the virtual LAN attribute included in the configuration information is any one of an access port, a trunk port, or a hybrid port. The access port can only belong to one virtual local area network, and is generally used for the connection between the switch and the end user. The trunk port can belong to multiple virtual local area networks, and can receive and send packets of multiple virtual local area networks, which are generally used in switches. The hybrid port can belong to multiple virtual LANs. It can receive and send packets of multiple virtual LANs. It is generally used for connection between switches, and can also be used to connect users' computers. The hybrid port can allow multiple ports. The packets of the virtual local area network are not carried with the virtual local area network label.

103. Determine, according to whether the packet carries a virtual local area network identifier, determine a target virtual local area network identifier from the designated virtual local area network identifier. The case where the packet carries the virtual local area network identifier is classified into carrying the virtual local area network identifier and not carrying the virtual local area network identifier.

When the virtual local area network identifier in the specified virtual local area network identifier is in the specified virtual local area network identifier, the default virtual local area network identifier corresponding to the port is determined as the target virtual local area network identifier.

When the virtual local area network identifier in the packet is not in the specified virtual local area network identifier, the packet is discarded, and step 1 04 is not performed.

1 04. Send the message to the target virtual local area network corresponding to the target virtual local area network identifier.

After the target virtual local area network identifier is determined, the packet is sent to the target virtual local area network corresponding to the target virtual local area network identifier, and the packet is forwarded by the target virtual local area network.

The method for processing a packet according to the embodiment of the present invention, obtains a packet, and searches for the configuration information corresponding to the port identifier according to the port identifier corresponding to the port that obtains the packet, and then, according to the packet, Whether the virtual local area network identifier is carried, the target virtual local area network identifier is determined from the specified virtual local area network identifier in the configuration information, and the information is sent to the target virtual local area network corresponding to the target virtual local area network identifier. The embodiment of the present invention solves the problem that all the packets need to be transferred by the virtual machine manager and the network performance is not high when the virtual local area network is divided and the packet processing is performed by using the front-end mode in the prior art, and the security and network performance are improved. . In a first implementation manner of the embodiment of the present invention, a method for processing a packet is provided. In the network virtualization scenario, the virtual LAN segmentation and packet processing are implemented in the pass-through mode by the physical network card. The pass-through mode is a mode in which the obtained packet does not need to be transferred by the virtual machine manager and directly forwarded by the physical network card. . The physical network card is connected to the physical port of the physical network card, and the external device is a switch, a router, another physical network card or other network device. The physical network card is connected to the physical network card and the physical server. A queue, that is, the queue is a channel through which the network device interacts with the physical server, and each queue corresponds to a virtual machine on the physical server. The process of entering and leaving the physical network card into four physical processes is divided into four processes, as shown in Figure 3, which are 1 packet processing from the uplink port (physical port) into the physical network card, and 2 from the lower link port (queue) to the physical network card. Packet processing, 3 processing from the lower joint port (queue) into the physical network card, 4 from the upper joint port (physical port) to the physical network card. In this implementation, as shown in FIG. 4, the processing of receiving a packet from the uplink port (physical port) into the physical network card is taken as an example, that is, the processing of receiving the packet from the uplink port is taken as an example. include:

401. The physical network card receives preset configuration information corresponding to the port identifier from a management device.

The configuration information corresponding to the port identifier is preset in the management device having the management function, and is sent to the physical network card by using the management device, for example, configuring configuration information of the upper and lower links through the virtual machine manager, and Sent to the physical network card. The virtual machine manager is connected to the physical network card, and configured to set and manage configuration information in the physical network card.

402. The physical network card acquires a packet.

The packet is obtained by the physical network card from the external device through the uplink port (physical port), and the external device is a switch, a router, or another physical network card.

403. The physical network card searches for the configuration information corresponding to the port identifier according to the port identifier corresponding to the port that obtains the packet.

The configuration information may be in the form of a list, as shown in FIG. 5, in the list. The port identifier includes the configuration information corresponding to the port identifier, and the configuration information includes a specified virtual local area network identifier, where the designated virtual local area network identifier is a virtual local area network identifier that the port allows to pass, and the allowed virtual local area network identifier A default virtual local area network identifier and a list of allowed virtual local area network identifiers. The configuration information further includes a virtual local area network attribute, and a virtual local area network identifier list of the packet that does not carry the virtual local area network label, and the identifier in the virtual local area network identification list that is allowed to pass, including the allowed non-portable The identifier in the virtual local area network identifier list of the packets of the virtual local area network label.

The port identifier is an identifier that is set for each port of the physical NIC in advance. The default virtual local area network identifier ranges from 0 to 4095. The default virtual local area network identifier corresponding to the port can be set according to the range, for example, the physical There are four physical ports on the NIC. You can set the corresponding port IDs to 0, 1, 1, and 3 for the four physical ports in sequence. The default virtual LAN IDs are 0, 1, 2, and 3.

According to the definition of the virtual local area network frame in the IEEE802.1Q standard, the virtual local area network attributes are classified into three types: acce ss port, t runk port, and hy id port, and the acces s port can belong to only one virtual local area network, generally used for the switch. The connection to the end user; t runk port can belong to multiple virtual local area networks, can receive and send multiple virtual LAN messages, generally used for connection between switches; hybr id port can belong to multiple virtual local area networks, can Receiving and sending packets of multiple virtual local area networks, generally used for connection between switches, can also be used to connect users' computers, and the hybrid id port can allow multiple virtual local area networks to transmit without carrying virtual local area network labels. .

In the configuration information, the virtual local area network attribute is different, and the corresponding virtual local area network identifier list that is allowed to pass and the virtual local area network identification list of the packets that do not carry the virtual local area network label are different. When the virtual local area network attribute is the acce ss port, the corresponding virtual local area network identification list and the allowed virtual local area network identification list of the packets that do not carry the virtual local area network label are empty; when the virtual local area network attribute is the t runk port, The corresponding allowed virtual local area network identifier list is valid, and the port is connected. When receiving and sending a packet, the virtual local area network identifier in the virtual local area network identifier list is allowed to pass, and the virtual local area network identification list of the packet that does not carry the virtual local area network label is allowed to be empty; when the virtual local area network attribute is hybr When the id port is used, the corresponding virtual local area network identifier list and the virtual local area network identifier list of the packets that do not carry the virtual local area network label are allowed to pass, and the port is allowed to carry the virtual local area network when receiving and sending the message. The virtual local area network identifier in the identification list is passed, and the virtual local area network identifier carried in the 4 艮 text is in the allowed virtual local area network identification list, and is not allowed in the port. The packet can carry the virtual local area network label for transmission when the virtual local area network identifier list of the packet carrying the virtual local area network label is not received. In addition, when the virtual local area network attribute is a t runk port or a hy id port, the corresponding allowed virtual local area network identifier list includes a corresponding default virtual local area network identifier.

In general, the virtual LAN attribute of the physical port is set to t runk port or hybr i d port. Of course, it can also be acce s s port, which is not limited here.

404. The physical network card determines, according to whether the packet carries a virtual local area network identifier, a target virtual local area network identifier from the designated virtual local area network identifier.

405. The physical network card sends the message to a target virtual office or network corresponding to the target virtual local area network identifier.

406. The physical network card receives the packet by using the target virtual local area network.

For the step 404-step 406, the following describes the physical network card from the physical port 1 as an example. The physical port 1 obtains the packet according to the physical port 1 as shown in FIG. 6, FIG. 7 and FIG. Port ID 1 is used to find the configuration information corresponding to the port identifier 1. The configuration information includes the specified virtual local area network identifier, where the specified virtual local area network identifier includes a default virtual local area network identifier of 1 and the allowed virtual local area network identifier list includes 1, 2, 3, and the configuration information further includes a virtual local area network attribute. For the t runk port, the virtual local area network identifier list of the packets that do not carry the virtual local area network label is empty. As shown in FIG. 6, the method includes the following steps: 601. The physical network card determines whether the four-dimensional text carries a virtual local area network identifier.

602. When the virtual network identifier is not carried, the physical network card determines the default virtual local area network identifier corresponding to the port as the target virtual local area network identifier.

The packet header that does not carry the virtual local area network label includes the destination address (DMAC), the source address (SMAC), and the packet type (Ether-Type). The packet type does not carry the identifier of the 8100. The 8100 identifier indicates the location. The message carries a virtual local area network label.

For the packet that does not carry the virtual local area network label, the physical network card finds that the corresponding virtual local area network attribute is a trunk port according to the port identifier 1 corresponding to the physical port 1 of the obtained port, and the default virtual local area network identifier is 1. Determining the virtual local area network 1 corresponding to the default virtual local area network identifier as the target virtual local area network, receiving the information by using the target virtual local area network, and writing the target virtual local area network identifier to the non-carrying virtual In the message of the LAN identifier. The default virtual local area network identifier is written into the file, and the destination address and source address are included in the header, and the 8100 type, priority (PRI), specification flag (CFI), and virtual are carried. The local area network identifier, where the destination address and the source address are both 6 bytes, the packet type carrying the 8100 is 1 byte, the priority is 3 bits (bits), the specification flag is lbit, and the virtual local area network identifier is 12 bits. The provincial virtual local area network identifier is written in the 12-bit virtual local area network identifier.

603, when the virtual network local area network identifier is carried, the physical network card determines whether the virtual local area network identifier in the packet is in the allowed virtual local area network identifier list;

604. When the virtual local area network identifier in the allowed network identifier is in the allowed virtual local area network identifier list, the physical network card determines the default virtual local area network identifier corresponding to the port as the target virtual local area network identifier. In the case of the text type, the packet carries the virtual local area network label, and the physical network card acquires the virtual local area network identifier in the virtual local area network label. Wherein, the physical port 1 pair The virtual local area network identifier list that is allowed to pass includes 1, 2, 3, and when the virtual local area network identifier carried by the message is 1, the corresponding port is corresponding to the allowed virtual local area network identifier list. The default virtual local area network identifier 1 is determined as the target virtual local area network identifier, and the packet is received by the target virtual local area network corresponding to the target virtual local area network identifier.

605. When the virtual local area network identifier in the text is not in the allowed virtual local area network identifier list, discard the message.

For example, when the virtual local area network identifier carried by the packet is Q, the packet is discarded in the virtual local area network identifier list that is allowed to pass.

When the configuration information corresponding to the physical port 1 is the default virtual local area network identifier is 1, the virtual local area network attribute is a hybrid port, and the allowed virtual local area network identification list includes 1, 2, 3, and the allowed non-transported virtual local area network label is allowed. The virtual local area network identifier list adopted by the text is 1, 2, as shown in Figure 7, which specifically includes the following steps:

701. The physical network card determines whether the fourth file carries a virtual local area network identifier.

702. When the virtual network identifier is not carried, the physical network card determines the default virtual local area network identifier corresponding to the port as the target virtual local area network identifier.

For the packet that does not carry the virtual local area network label, the physical network card finds that the corresponding virtual local area network attribute is a hybrid port, and the default virtual local area network identifier is 1, according to the port identifier 1 corresponding to the physical port 1 of the obtained port. The virtual local area network 1 corresponding to the default virtual local area network identifier is determined as the target virtual local area network, the packet is received by the target virtual local area network, and the target virtual local area network identifier is written into the non-carrying virtual local area network identifier. In the message. The default virtual local area network identifier is written into the packet, and the packet header includes the destination address and the source address, and the packet type of the 8100 is carried. Priority (PRI), specification flag (CF I ), virtual local area network identifier, where the destination address and source address are both 6 bytes, the packet type carrying 8100 is 1 byte, and the priority is 3b it (bit) ), the specification flag is lb it , the virtual local area network identifier is 12b it , and the default virtual local area network identifier is written in the virtual local area network identifier of 12b it.

703. When the virtual network local area network identifier is carried, the physical network card determines whether the virtual local area network identifier in the packet is in the allowed virtual local area network identifier list.

704. When the virtual local area network identifier in the text is in the allowed virtual local area network identifier list, the physical network card determines the default virtual local area network identifier corresponding to the port as the target virtual local area network identifier. In the case of the text type, the packet carries the virtual local area network label, and the virtual local area network identifier in the virtual local area network label is obtained. The virtual local area network identifier list corresponding to the physical port 1 includes 1, 2, and 3, and when the virtual local area network identifier carried in the packet is 1, the virtual local area network identifier list is allowed to pass. The default virtual office i or the network identifier 1 corresponding to the port is determined as the target virtual office i or the network identifier, and the target virtual local area network corresponding to the target virtual local area network identifier is received by the target virtual local area network.

705. When the virtual local area network identifier in the text is not in the allowed virtual local area network identifier list, discard the message.

For example, when the virtual local area network identifier carried by the packet is Q, not in the list of all the virtual local area network identifiers allowed to pass, the packet is discarded.

When the configuration information corresponding to the physical port 1 is that the default virtual local area network identifier is 1 and the virtual local area network attribute is an acce ss port, the corresponding allowed virtual local area network identifier list and the allowed packets that do not carry the virtual local area network label are allowed to pass. The virtual local area network identifier list is empty, as shown in Figure 8, which specifically includes the following steps:

801. The physical network card determines whether the fourth file carries a virtual local area network identifier.

802. When the WLAN does not carry the virtual local area network identifier, the physical NIC determines the default virtual local area network identifier corresponding to the port as the target virtual local area network identifier. For the obtained packet header that does not carry the virtual LAN label, the destination address is included.

(DMAC), the source address (SMAC), and the packet type (E ther-Type), and the packet type does not carry the identifier of the 8100. The 8100 identifier indicates that the packet carries the virtual local area network label.

For the packet that does not carry the virtual local area network label, the physical network card finds the corresponding virtual local area network attribute as the acce ss port according to the port identifier 1 corresponding to the physical port 1 of the obtained 艮 ,, the default virtual office i or the network If the identifier is 1, the virtual local area network corresponding to the default virtual office i or the network identifier is determined as the target virtual local area network, the packet is received by the target virtual local area network, and the target virtual local area network identifier is written. The packet does not carry the virtual local area network identifier. The default virtual local area network identifier is written into the packet. The packet header includes the destination address, the source address, the packet type carrying the 8100, the priority (PRI), the specification flag (CF I ), and the virtual local area network identifier. , the destination address and the source address are both 6 bytes, the packet type carrying 8100 is 1 byte, the priority is 3b it (bit), the specification flag is lb it, and the virtual local area network identifier is 12b it, The default virtual local area network identifier is written in the virtual local area network identifier of 12b it.

803. The physical network card determines whether the virtual local area network identifier in the text is the same as the default virtual local area network identifier corresponding to the port identifier, when the virtual local area network identifier is carried.

804. Determine, when the virtual local area network identifier in the message is a default identifier corresponding to the port identifier, the target virtual local area network identifier.

805. When the virtual local area network identifier in the text is different from the default virtual local area network identifier corresponding to the port identifier, discard the message. In the case of the text type, the packet carries the virtual local area network label, and the virtual local area network identifier in the virtual local area network label is obtained. The default virtual local area network identifier corresponding to the physical port 1 is 1, and when the virtual local area network identifier carried by the fourth port is 1, the The virtual office i or the network identifier is the same as the default virtual office i or the network identifier corresponding to the port identifier, and the default virtual local area network identifier 1 corresponding to the port is determined as the target virtual local area network identifier, and the target virtual local area network identifier is determined by the target virtual area identifier. Receiving, by the target virtual local area network corresponding to the local area network identifier, the virtual local area network identifier corresponding to the port identifier is different, and the virtual local area network identifier corresponding to the port identifier is different, Discard the message.

For the process of receiving the message from the lower link, the process of receiving the message from the uplink port is similar to the process of receiving the message from the uplink port as described in FIG. 4-8. I will not repeat them here. In the second implementation manner of the embodiment of the present invention, a packet processing method is provided. In a network virtualization scenario, virtual local area network division and packet processing are implemented in a pass-through mode by using a physical network card, and the direct mode is The obtained packet does not need to be transferred by the virtual machine manager and directly forwarded by the physical network card. The physical network card is connected to the physical port of the physical network card, and the external device is a switch, a router, another physical network card or other network device. The physical network card is connected to the physical network card and the physical server. A queue, that is, the queue is a channel through which the network device interacts with the physical server, and each queue corresponds to a virtual machine on the physical server. The process of entering and leaving the physical network card into four physical processes is divided into four processes, as shown in Figure 3, which are 1 packet processing from the uplink port (physical port) into the physical network card, and 2 from the lower link port (queue) to the physical network card. Packet processing, 3 processing from the lower joint port (queue) into the physical network card, 4 from the upper joint port (physical port) to the physical network card. This implementation manner may be subsequent packet processing in the implementation manner shown in FIG. 4, that is, after the packet shown in FIG. 4 enters the physical network card from the uplink port (physical port), after the physical network card performs other processing, it needs to be The physical network card sends the packet to the physical server, which is an example of the packet processing of the physical network card from the lower joint port (queue) in FIG. According to the prior art, the packet is determined by the destination address list in the physical network card. The sent queue, and then the processing of sending the packet from the lower joint port, as shown in FIG. 9, the method includes:

901. The physical NIC receives, from the management device, configuration information corresponding to the port identifier that is preset.

The configuration information corresponding to the port identifier is preset by the management device having the management function, and is sent to the physical network card. For example, the configuration information of the upper and lower links is configured by the virtual machine manager, and sent to the physical Network card. The virtual machine manager is connected to the physical network card, and configured to set and manage the physical network card.

902. The physical network card acquires a to-be-sent packet.

The packet to be sent from the physical network card carries a virtual local area network label, and the packet is a packet obtained from the downlink interface.

903. The physical network card searches for the configuration information corresponding to the port identifier according to the port identifier corresponding to the port that obtains the packet.

The configuration information may be in the form of a list. As shown in FIG. 5, the list includes a port identifier and configuration information corresponding to the port identifier, where the configuration information includes a specified virtual local area network identifier, and the specified virtual The local area network identifier is a virtual local area network identifier that the port is allowed to pass, and the allowed virtual local area network identifier is a default virtual local area network identifier and a list of allowed virtual local area network identifiers. The configuration information further includes a virtual local area network identifier, and a virtual local area network identifier list of the message that does not carry the virtual local area network label, and the virtual local area network identification list of the message that does not carry the virtual local area network label is allowed to be The port of the virtual local area network identifier list that is allowed to pass, the port identifier is an identifier that is set for each queue of the physical network card in advance. The default virtual local area network identifier ranges from 0 to 4095, and the default corresponding to the port can be set according to the range. The virtual local area network identifier, for example, has four queues of the physical network card, and the corresponding identifiers of the four queues may be set to 0, 1, 1, 3, and the default virtual local area network identifiers are 0, 1, 2, and 3. According to the definition of the virtual local area network frame in the IEEE802.1Q standard, the virtual local area network attributes are classified into three types: an access port, a trunk port, and a hybrid id port. The access port can belong to only one virtual local area network, and is generally used for switches and end users. The trunk port can belong to multiple virtual LANs. It can receive and send packets from multiple virtual LANs. It is generally used for connections between switches. The hybrid port can belong to multiple virtual LANs and can receive and send multiple packets. The packets of the virtual local area network are generally used for connecting between switches, and can also be used for connecting the user's computer, and the hybrid port can allow multiple virtual local area networks to transmit without carrying the virtual local area network label.

Among them, in the configuration information, the virtual local area network attribute is different, and the corresponding virtual local area network identifier list that is allowed to pass and the virtual local area network identification list of the packets that do not carry the virtual local area network label are different. When the virtual local area network attribute is the access port, the corresponding virtual local area network identifier list and the allowed virtual local area network identifier list of the packets that do not carry the virtual local area network label are empty; when the virtual local area network attribute is a trunk port, the corresponding The virtual local area network identifier list that is allowed to pass is valid. When the port receives and sends the message, the port is allowed to carry the virtual local area network identification message in the virtual local area network identifier list, and the allowed packet that does not carry the virtual local area network label is allowed to pass. The virtual local area network identifier list is empty. When the virtual local area network attribute is a hybrid port, the corresponding allowed virtual local area network identifier list and the allowed virtual local area network identifier list of the packets that do not carry the virtual local area network label are valid, and the port is receiving. When the packet is sent, the virtual local area network identifier in the virtual local area network identifier list is allowed to pass, and the virtual local area network identifier carried in the 4 艮 text is allowed in the port when the port sends the message. Virtual office Network identifier list, and does not allow the packets carrying no VLAN tag virtual local area network identifier list when the packets can carry a virtual LAN tags to transmit. In addition, when the virtual local area network attribute is a trunk port or a hybrid port, the corresponding allowed virtual local area network identifier list includes a corresponding default virtual local area network identifier.

In general, the virtual LAN property of the queue is set to the access port, of course It can be a t runk port or a hyb rid port, which is not limited here.

904. The physical network card determines, according to whether the packet carries a virtual local area network identifier, a target virtual local area network identifier from the specified virtual local area network identifier.

905. Send the message to the target virtual local area network corresponding to the target virtual local area network identifier.

906. Send the message by using the target virtual local area network.

For the step 9 04 - step 9 06, the following takes the physical network card from the queue 1 as an example, as shown in FIG. 10, FIG. 1 1 and FIG. 12, as an example, when the queue 1 obtains the packet, according to the queue Port ID 1 of 1 searches for the configuration information corresponding to port ID 1. The configuration information includes the specified virtual local area network identifier, where the specified virtual local area network identifier includes a default virtual local area network identifier of 1 and a virtual local area network identifier list that is allowed to pass, and the configuration information further includes a virtual local area network attribute of an ac ce ss port. A virtual local area network identifier list of the packets that do not carry the virtual local area network label, and the list of the virtual local area network identifiers that are allowed to pass through and the virtual local area network identification list of the packets that do not carry the virtual local area network label are allowed to be empty, such as As shown in FIG. 10, the method includes the following steps: The default virtual local area network identifier corresponding to the port identifier is the same;

1 002. When the virtual local area network identifier in the fourth network is the same as the default virtual local area network identifier corresponding to the port identifier, the physical network card determines the virtual local area network identifier in the information as the target virtual local area network identifier. .

If the virtual local area network identifier in the message is the target virtual local area network identifier, the virtual local area network label carried in the packet is deleted, and the message is sent through the target virtual local area network.

1 003. When the virtual local area network identifier in the text is different from the default virtual local area network identifier corresponding to the port identifier, discard the message.

Comparing, by the physical network card, the virtual local area network identifier in the four-dimensional text with the default virtual local area network identifier corresponding to the port identifier, where the default virtual number corresponding to the queue 1 is The pseudo-local area network identifier is 1 and the virtual local area network identifier in the text is the same as the default virtual local area network identifier corresponding to the queue 1 when the virtual local area network identifier is 1 in the text, and the virtual local area network label is deleted. The packet is sent to the physical server through the queue 1; when the virtual local area network identifier of the packet is 2, the virtual local area network identifier in the packet is different from the default virtual local area network identifier corresponding to the queue 1 The 4 files are discarded and are not sent to the physical server.

When the default virtual local area network identifier corresponding to the queue 1 is 1, and the virtual local area network attribute is a t runk port, the allowed virtual local area network identifier list includes 1, 2, 3, and the virtual packets that are allowed to pass without carrying the virtual local area network label are virtual. When the local area network identifier list is empty, as shown in FIG. 11, the method includes the following steps: The default virtual local area network identifier corresponding to the port identifier is the same.

Comparing whether the virtual local area network identifier in the message is the same as the default virtual local area network identifier corresponding to the queue 1.

1102. The default virtual office corresponding to the port identifier of the virtual local area network identifier is the target virtual local area network identifier.

When the virtual local area network identifier is the same as the default virtual local area network identifier corresponding to the queue 1 in the virtual local area network identifier, the physical network card deletes the virtual local area network label carried in the packet. And sent to the physical server through queue 1.

1103. When the virtual local area network identifier is associated with the port identifier, whether the default virtual office corresponding to the port identifier is in the allowed virtual local area network identifier list.

When the virtual local area network identifier is 2, the virtual local area network identifier and the default virtual local area network identifier corresponding to the queue 1 are different, and it is determined whether the virtual local area network identifier is allowed to pass in the queue 1 The list of virtual LAN IDs. 1 1 04. When the virtual local area network identifier is in the list, the physical network card determines the default virtual local area network identifier corresponding to the port as the target virtual local area network identifier.

When the virtual local area network identifier is 0, the virtual local area network identifier is different from the default virtual local area network identifier corresponding to the queue 1, but it is determined that the virtual local area network identifier is allowed to pass through the queue 1 In the virtual local area network identifier list, the physical network card determines the default virtual local area network identifier corresponding to the port as the target virtual local area network identifier, and retains the virtual local area network label in the packet, and sends the packet Go to the target virtual local area network, and send the message to the physical server through the target virtual local area network.

1 1 05. When the virtual local area network identifier is not in the list, discard the message. When the virtual local area network identifier is not in the virtual local area network identifier list corresponding to the queue 1, the packet is discarded and not sent to the physical server.

When the default virtual local area network identifier corresponding to the queue 1 is 1, and the virtual local area network attribute is a hybr id port, the allowed virtual local area network identifier list includes 1, 2, 3, and the allowed virtual packets of the virtual local area network label are not allowed to pass. The local area network identifier list is 1, 2, as shown in FIG. 12, and specifically includes the following steps: The virtual network local area identifier list corresponding to the port identifier is allowed to pass;

1 202. When the virtual local area network identifier is in the allowed virtual local area network identifier list corresponding to the port identifier, the physical network card determines the default virtual local area network identifier corresponding to the port as the target virtual local area network identifier. And the subsequent processing of the 4 艮 text.

1 203. When the virtual local area network identifier is not in the virtual local area network identifier list corresponding to the port identifier, the packet is discarded.

When the virtual local area network identifier is 3, the virtual local area network identifier is in the virtual local area network identifier list corresponding to the queue 1 corresponding to the queue 1 After the virtual local area network identifier is 0, the virtual local area network identifier is not in the allowed virtual local area network identifier list corresponding to the queue 1, and the packet is discarded.

In addition, in step 1 2 02, according to the settings in the virtual local area network identifier list of the packets that do not carry the virtual local area network label that are allowed to pass through the queue 1, the subsequent processing of the message is as follows:

a. determining whether the virtual local area network identifier in the four-dimensional text is in the virtual local area network identifier list of the packet that does not carry the virtual local area network label corresponding to the port identifier; b. when the virtual local area network identifier is in the port And deleting the packet when the corresponding virtual network identifier list of the packet that does not carry the virtual local area network label is allowed to pass;

c. when the virtual local area network identifier is not allowed to pass through the port identifier, the

When the virtual local area network identifier is 2, the virtual local area network identifies the virtual office that is allowed to pass the packet that does not carry the virtual local area network label corresponding to the queue 1 and sends the virtual office to the physical server; When the virtual local area network identifier in the packet is 3, the virtual local area network identifier is not in the virtual local area network identifier list that passes the packet that does not carry the virtual local area network label corresponding to the queue 1 The message is sent to the physical server through queue 1.

The processing of the packet sent from the uplink interface to the physical NIC, that is, the processing of sending the packet from the uplink interface is similar to the processing of sending the packet from the lower interface as described in FIG. 9 to FIG. Narration. In the third implementation manner of the embodiment of the present invention, a packet processing method is provided In the network virtualization scenario, the virtual LAN segmentation and packet processing are implemented in the pass-through mode by the physical network card. The pass-through mode is a mode in which the obtained packet does not need to be transferred by the virtual machine manager and directly forwarded by the physical network card. . The physical network card is connected to the physical port of the physical network card, and the external device is a switch, a router, another physical network card or other network device. The physical network card is connected to the physical network card and the physical server. A queue, that is, the queue is a channel through which the network device interacts with the physical server, and each queue corresponds to a virtual machine on the physical server. The process of entering and leaving the physical network card into four physical processes is divided into four processes, as shown in Figure 3, which are 1 packet processing from the uplink port (physical port) into the physical network card, and 2 from the lower link port (queue) to the physical network card. Packet processing, 3 processing from the lower joint port (queue) into the physical network card, 4 from the upper joint port (physical port) to the physical network card. In this implementation manner, after the packet 3 enters the physical network card from the lower interface (queue), the packet processing is performed on the physical network card from the uplink port (physical port) after the physical network card performs other processing. For the processing of the physical network card from the lower joint port (queue), it is similar to the processing of the packet from the upper joint port (physical port) to the physical network card as shown in Figure 4-8. (Physical port) The packet processing of the physical NIC is similar to the processing of the physical NIC from the lower port (queue) shown in Figure 9-12. For all the physical network cards, including the physical network card from the uplink port (physical port) and the physical network card from the lower port (queue), it can be regarded as 4 from the peer device to the physical network card. For all the physical NICs, including the physical NIC from the uplink port (physical port) and the physical NIC from the downlink port (queue), it can be seen as sending 4 从 from the physical NIC to the peer device. Text. Therefore, the implementation manner is that the packet is received from the downlink interface, and then the packet is sent from the uplink port, and the packet is received from the uplink port as described in FIG. 4-8 and FIG. The processing of sending packets on the interface is similar, and is not mentioned here.

The embodiment of the present invention is not limited to a physical network card, and may be any network device capable of realizing virtual local area network division and processing. In addition, the embodiments of the present invention can be applied to VEB (V i ua l E therne t Br i dge, virtual Ethernet bridge) and VEPA (V ir tua l In the standard, for example, when the virtual machine 1 on the physical server is to communicate with the virtual machine 2, the virtual machine 1 first sends a message to the physical network card, The physical network card sends the message to the virtual machine 2, that is, the VEB function is implemented; for the VEPA standard, after the physical network card receives the message sent by the virtual machine 1, the physical network card will The packet is sent to the external device connected to the physical network card, and is processed by the external device, and then returned to the physical network card. In the embodiment of the present invention, the virtual local area network is divided in the network virtualization scenario, and the network is improved. The security of management also encapsulates the configuration of virtual machine users, and at the same time realizes virtual LAN acceleration under the physical network card, improving network performance. Example 2

The embodiment of the present invention provides a network device 13, as shown in FIG. 13, which includes an obtaining unit 131, a searching unit 132, a first processing unit 133, and a sending unit 134.

The obtaining unit 131 is configured to acquire a packet.

The searching unit 132 is configured to search for configuration information corresponding to the port identifier according to the port identifier corresponding to the port of the packet that is obtained by the acquiring unit, where the configuration information includes a specified virtual local area network identifier, and the specified virtual local area network identifier A virtual local area network identifier that is allowed to pass through for the port.

The first processing unit 133 is configured to determine, according to whether the packet carries a virtual local area network identifier, the target virtual local area network identifier from the specified virtual local area network identifier found by the searching unit;

The sending unit 134 is configured to send the packet to the target virtual office i or the target virtual office i or the network corresponding to the network identifier determined by the processing unit.

After the target virtual local area network identifier is determined, the packet is sent to the target virtual local area network corresponding to the target virtual local area network identifier, and the packet is forwarded by the target virtual local area network. The network device provided by the embodiment of the present invention obtains the configuration information corresponding to the port identifier according to the port identifier corresponding to the port that obtains the port, and then according to whether the packet carries the virtual The local area network identifier is determined, and the target virtual local area network identifier is determined from the specified virtual local area network identifier in the configuration information, and the information is sent to the target virtual local area network corresponding to the target virtual local area network identifier. The embodiment of the present invention solves the problem that all the packets need to be transferred by the virtual machine manager and the network performance is not high when the virtual local area network is divided and the packet processing is performed by using the front-end mode in the prior art, and the security and network performance are improved. .

The port is obtained by using a port in the network device, and the port is an uplink port or a downlink port, where the uplink port is a physical port connected to the external device, and the downlink port is the network device and the physical port. a queue to which the server is connected, that is, the queue is a channel through which the network device interacts with the physical server, and each queue corresponds to a virtual machine on the physical server, and the packet passes through the uplink port. And receiving, by the external device, a packet to be sent to the physical server by using the downlink interface, or receiving the packet from the physical server through the downlink interface, and waiting for the external device through the uplink port The message sent.

In addition, the configuration information further includes a virtual local area network attribute. According to the definition of the virtual local area network frame in the IEEE802.1Q standard, the virtual local area network attributes are classified into three categories: an acce ss port, a t runk port, and a hybrid id port. The virtual local area network attribute included in the configuration information is any one of an acce ss port, a t runk port, or a hybrid id port. The acce ss port can only belong to one virtual local area network, and is generally used for the connection between the switch and the end user. The t runk port can belong to multiple virtual local area networks, and can receive and send multiple virtual local area network (LAN) packets, which are generally used for Connection between switches; hybr id A port can belong to multiple virtual local area networks, can receive and send multiple virtual local area network messages, generally used for connection between switches, and can also be used to connect users' computers, and the hybrid id port can allow multiple virtual local area networks. The virtual local area network label is not carried when the text is sent.

In the configuration information, the virtual local area network attributes are different, and the corresponding virtual local area network identifier list that is allowed to pass and the virtual office i or network identification list that allows the passed packets that do not carry the virtual local area network label are also different. When the virtual office i or network attribute is an acce ss port, the corresponding allowed virtual local area network identifier list and the allowed virtual local area network identifier list of the packets that do not carry the virtual local area network label are empty; when the virtual local area network attribute is t runk In the case of a port, the corresponding virtual local area network identifier list is allowed to pass, and the port is allowed to carry the virtual local area network identification message in the virtual local area network identifier list when the port receives and sends the message, and the allowed non-carrying virtual local area network is allowed to pass. The virtual local area network identifier list of the packet is empty. When the virtual local area network attribute is a hybrid id port, the corresponding allowed virtual local area network identifier list and the allowed virtual local area network identifier list of the packets that do not carry the virtual local area network label are valid. When the port receives and sends a message, the port is allowed to carry the virtual local area network identifier in the virtual local area network identifier list, and the port only transmits the virtual data carried in the 4th text. The local area network identifier is in the allowed virtual local area network identifier When the list is not in the virtual local area network identifier list of the packet that does not carry the virtual local area network label, the packet can carry the virtual local area network label for sending. In addition, when the virtual local area network attribute is a t runk port or a hy id port, the corresponding allowed virtual local area network identifier list includes a corresponding default virtual local area network identifier. In general, the virtual LAN attribute of the physical port is set to t runk port or hybrid id port. Of course, it can also be acc ss port. The virtual LAN attribute of the queue is set to acce ss port. Of course, it can also be t runk port or hybrid id port. , there is no limit here.

Optionally, as shown in FIG. 14, the network device further includes a receiving unit 1 35, configured to receive, from the management device, preset configuration information corresponding to the port identifier.

The configuration information corresponding to the port identifier is preset by the management device having the management function, and is sent to the physical network card, where the method can be sent once and supports the processing method of receiving the message, or can be modified. When the configuration information is sent, the updated configuration information is sent to the network device, and is not limited herein. Specifically, the network device receives the configuration information. For example, the configuration information of the upper and lower interfaces is configured by the virtual machine manager and sent to the physical network card. The virtual machine manager is connected to the physical network card, and configured to set and manage the physical network card.

Optionally, as shown in FIG. 15, the first processing unit 1 33 includes:

The first determining module 151 is configured to determine whether the packet carries a virtual local area network identifier. The first processing module 152 is configured to: when the first determining module determines that the packet does not carry a virtual local area network identifier, the port is Corresponding default virtual local area network identifier is determined as the target virtual local area network identifier, and the default virtual local area network identifier is in the designated virtual local area network identifier;

The packet header that does not carry the virtual local area network label includes the destination address (DMAC), the source address (SMAC), and the packet type (E ther-Type), and the packet type does not carry the identifier of the 8100. The 8100 identifier indicates The message carries a virtual local area network label.

When the packet header of the packet includes the packet type of the 8100, the packet carries the virtual local area network label, and the virtual office ID or the network identifier in the virtual local area network label is obtained.

The second determining module 153 is configured to: when the first determining module determines that the packet is carried When the virtual local area network identifier is used, it is determined whether the virtual local area network identifier in the four-dimensional text is in the specified virtual local area network identifier;

The second processing module 154 is configured to: when the second determining module determines that the virtual local area network identifier in the packet is in the specified virtual local area network identifier, determine a default virtual local area network identifier corresponding to the port as the Target virtual local area network identifier.

Optionally, as shown in FIG. 16, when the packet is a packet to be received, the network device further includes:

The second processing unit 161 is configured to receive the packet by using the target virtual local area network, and write the target virtual local area network identifier into the packet that does not carry the virtual local area network identifier.

The default virtual local area network identifier is written into the packet. The packet header includes the destination address, the source address, the packet type of the 8100, the priority (PRI), the specification flag (CFI), and the virtual local area network identifier. The destination address and the source address are both 6 bytes. The packet type carrying 8100 is 2 bytes, the priority is 3 bits (bits), the specification flag is lbit, and the virtual office i or network identifier is 12 bits. The provincial virtual office i or network identifier is written in the 12-bit virtual local area network identifier. The physical network card then performs subsequent processing in the prior art on the modified message.

Optionally, as shown in FIG. 17, when the packet is a packet to be sent, the network device further includes:

The third processing unit 171 is configured to delete, when the virtual local area network identifier carried by the fourth file is the same as the default virtual local area network identifier corresponding to the port, delete the virtualized network device 13 in the foregoing embodiment. It is not limited to a physical NIC in a virtualization scenario, and may be any network device capable of realizing virtual LAN division and packet processing. In addition, the embodiment of the present invention can be applied to a VEB (Virtual Ethernet Bridge) and VEPA (Virtual Ethernet Port Aggregator) standard, for example, when the virtual machine 1 on the physical server To be virtual When the machine 2 performs communication, the virtual machine 1 first sends a message to the physical network card, and the physical network card sends the message to the virtual machine 2, that is, the VEB function is implemented; for the VEPA standard, when the physical After receiving the packet sent by the virtual machine 1, the physical network card sends the packet to an external device connected to the physical network card, and is processed by the external device, and then returned to the physical network card, and then The physical network card sends the processed packet to the virtual machine 2.

For the operation process of the network device 13, refer to the process of processing the packet.

The embodiment of the invention realizes the virtual local area network division by using the through mode in the network virtualization scenario, improves the security of the network management, and also configures the configuration of the virtual machine user, and realizes the virtual local area network acceleration under the physical network card, thereby improving Network performance. Example 3

The embodiment of the present invention provides a network device 1 8 , as shown in FIG. 18 , including a memory 1 8 1 and a processor 1 8 2 .

The memory 1 8 1 is configured to store the instruction, the obtained packet, and the configuration information corresponding to the port identifier;

The processor 1 82 is configured to execute the instruction in the memory 18 1 , and specifically:

Obtain a message;

Sending the message to the target virtual local area network corresponding to the target virtual local area network identifier.

The network device provided by the embodiment of the present invention obtains the configuration information corresponding to the port identifier by acquiring the packet and obtaining the port identifier corresponding to the port corresponding to the port. Then, according to whether the packet carries the virtual local area network identifier, the target virtual local area network identifier is determined from the specified virtual local area network identifier in the configuration information, and the message is sent to the target virtual local area network corresponding to the target virtual local area network identifier. The embodiment of the present invention solves the problem that all the packets need to be transferred by the virtual machine manager and the network performance is not high when the virtual local area network is divided and the packet processing is performed by using the front-end mode in the prior art, and the security and network performance are improved. .

Obtaining a packet through a port in the network device, as shown in FIG. 2, the connection relationship between the network device and the physical server and the external device, where the port is an uplink port or a downlink port, and the uplink port is a physical port that is connected to the external device by the network device, the lower link is a queue that is connected to the physical device by the network device, and the packet is received from the external device through the uplink port, and passes through the lower interface A packet to be sent to the physical server, or a packet to be sent from the physical server through the uplink port and sent to the external device by the uplink port.

For all the packets entering the network device, including the network device from the uplink port (physical port) and the network device from the downlink port (queue), it can be regarded as the packet sent from the peer device to the network device. For all outgoing network devices, including the network device from the uplink port (physical port) and the network device from the downlink port (queue), it can be regarded as sending 4 messages from the network device to the peer device.

The external device is a switch, a router, or another physical network card.

In addition, the configuration information further includes a virtual local area network attribute. According to the definition of the virtual local area network frame in the IEEE802.1Q standard, the virtual local area network attributes are classified into three categories: an acce ss port, a t runk port, and a hybrid id port. The virtual local area network attribute included in the configuration information is any one of an acce ss port, a t runk port, or a hybrid id port. Kind. The acce ss port can only belong to one virtual local area network, and is generally used for the connection between the switch and the end user. The t runk port can belong to multiple virtual local area networks, and can receive and send multiple virtual local area network (LAN) packets, which are generally used for The connection between the switches; the hybr id port can belong to multiple virtual local area networks, can receive and send multiple virtual local area network messages, generally used for connection between switches, can also be used to connect users' computers, and hybrid id ports It is possible to allow multiple virtual local area networks to transmit without carrying a virtual local area network label.

In the configuration information, the virtual local area network attributes are different, and the corresponding virtual local area network identifier list that is allowed to pass and the virtual office i or network identification list that allows the passed packets that do not carry the virtual local area network label are also different. When the virtual office i or network attribute is an acce ss port, the corresponding allowed virtual local area network identifier list and the allowed virtual local area network identifier list of the packets that do not carry the virtual local area network label are empty; when the virtual local area network attribute is t runk In the case of a port, the corresponding virtual local area network identifier list is allowed to pass, and the port is allowed to carry the virtual local area network identification message in the virtual local area network identifier list when the port receives and sends the message, and the allowed non-carrying virtual local area network is allowed to pass. The virtual local area network identifier list of the packet is empty. When the virtual local area network attribute is a hybrid id port, the corresponding allowed virtual local area network identifier list and the allowed virtual local area network identifier list of the packets that do not carry the virtual local area network label are valid. When the port receives and sends a message, the port is allowed to carry the virtual local area network identifier in the virtual local area network identifier list, and the When the port is configured to send a message, only the virtual local area network identifier carried in the message is in the allowed virtual local area network identifier list, and is not in the virtual local area network identifier of the packet that does not carry the virtual local area network label. In the list, the packet can carry the virtual local area network label for sending. In addition, when the virtual local area network attribute is a t runk port or a hy id port, the corresponding allowed virtual local area network identifier list includes a corresponding default virtual local area network identifier.

In general, the virtual LAN attribute of the physical port is set to t runk port or hybrid id port. Of course, it can also be acc ss port. The virtual LAN attribute of the queue is set to acce ss port. Of course, it can also be t runk port or hybrid id port. , there is no limit here.

Optionally, before the obtaining the packet, the processor 182 is further configured to: receive, from the management device, preset configuration information corresponding to the port identifier. The configuration information corresponding to the port identifier is preset by the management device having the management function, and is sent to the physical network card, where the method can be sent once and supports the processing method of receiving the message, or can be modified. When the configuration information is sent, the updated configuration information is sent to the network device, and is not limited herein. Specifically, the network device receives the configuration information. For example, the configuration information of the upper and lower interfaces is configured by the virtual machine manager and sent to the physical network card. The virtual machine manager is connected to the physical network card, and configured to set and manage the physical network card.

Optionally, the processor 182 is further configured to:

Determining whether the packet carries a virtual local area network identifier;

When the packet does not carry the virtual local area network identifier, the default virtual local area network identifier corresponding to the port is determined as the target virtual local area network identifier, and the default virtual local area network identifier is in the specified virtual local area network identifier.

The packet header that does not carry the virtual local area network label includes the destination address (DMAC), the source address (SMAC), and the packet type (E ther-Type), and the packet type does not carry the identifier of the 8100. The 8100 identifier indicates The message carries a virtual local area network Label. When the packet header of the received packet includes the packet type of the 8100, the packet carries the virtual local area network label, and the virtual office i or the network identifier in the virtual local area network label is obtained.

In addition, when the virtual local area network identifier in the packet is not in the specified virtual local area network identifier, the message is discarded.

Optionally, when the packet is a packet to be received, the processor 182 is further configured to:

The packet is received by the target virtual local area network, and the target virtual local area network identifier is written into the packet that does not carry the virtual local area network identifier.

Optionally, when the packet is a packet to be sent, the processor 182 is further configured to:

When the virtual local area network identifier carried by the packet is the same as the default virtual local area network identifier corresponding to the port, the virtual local area network label carried in the fourth file is deleted, and the virtual office additionally uses the port attribute as a trunk port. The processor is further configured to execute: When the virtual local area network identifier is in the virtual local area network identifier list corresponding to the port identifier of the default virtual local area network corresponding to the port identifier;

When the virtual local area network identifier is in the list, the physical network card determines the default virtual local area network identifier corresponding to the port as the target virtual local area network identifier.

When the virtual local area network identifier is not in the list, the message is discarded.

When the port attribute is a hybrid port, and the virtual local area network identifier is in the list of allowed virtual network identifiers corresponding to the port identifier, the processor is further executed according to the permission:

Determining whether the virtual local area network identifier in the four-dimensional text is in the virtual local area network identifier list of the packet that does not carry the virtual local area network label corresponding to the port identifier; when the virtual local area network identifier is corresponding to the port identifier When the virtual local area network identifier list of the packet that does not carry the virtual local area network label is passed, the virtual medium area network identifier that is not in the port identifier is allowed to be virtualized. In the case of the local area network identification list, the network device 18 in the above embodiment is not limited to the physical network in the virtualization scenario. The embodiment can be applied to VEB (Virtual Ethernet Bridge) and VEPA. (Virtual Ethernet Port Aggregator) In the standard, for example, when the virtual machine 1 on the physical server is to communicate with the virtual machine 2, the virtual machine 1 first sends a message to the physical network card. Sending, by the physical network card, the packet to the virtual machine 2, that is, implementing the VEB function; For the VEPA standard, after the physical network card receives the packet sent by the virtual machine 1, the physical network card sends the packet to an external device connected to the physical network card, and is processed by the external device. Machine 2.

For the operation process of the network device 18, refer to the processing procedure of the foregoing packet.

The embodiment of the invention realizes the virtual local area network division by using the through mode in the network virtualization scenario, improves the security of the network management, and also configures the configuration of the virtual machine user, and realizes the virtual local area network acceleration under the physical network card, thereby improving Network performance.

It can be clearly understood by those skilled in the art that for the convenience and cleanness of the description, only the division of each functional module described above is exemplified. In practical applications, the above function assignment can be completed by different functional modules as needed. The internal structure of the device is divided into different functional modules to perform all or part of the functions described above. For the specific working process of the system, the device and the unit described above, reference may be made to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be used. Combined or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise. The components displayed as the unit may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. The purpose of the embodiment of the present embodiment can be achieved by selecting some or all of the units according to actual needs.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware. It can also be implemented in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may contribute to the prior art or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. The instructions include a plurality of instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (pr o ss or ) to perform all or part of the steps of the methods of the various embodiments of the present invention. The foregoing storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Acce ss Memory), a magnetic disk or an optical disk, and the like, which can store program codes. Medium.

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

Rights request

1. A message processing method, characterized by including:

Get messages;

^ ^: According to obtaining the port identifier corresponding to the port of the file, searching for the configuration information corresponding to the port identifier, the configuration information includes a designated virtual LAN identifier, and the designated virtual LAN identifier is the port that is allowed to pass through. VLAN ID;

According to whether the message carries a virtual LAN identifier, determine the target virtual LAN identifier from the specified virtual LAN identifier;

The message is sent to the target virtual local area network corresponding to the target virtual local area network identification.

2. The method according to claim 1, characterized in that, before obtaining the message, the method further includes:

Receive preset configuration information corresponding to the port identifier from the management device.

3. The method according to claim 1, characterized in that, the port is an uplink port or a downlink port of a network device, the network device is installed on a physical server, and the physical server communicates with the network device through the network device. External device connection, the uplink port is a physical port connecting the network device and the external device, the downlink port is a queue connecting the network device and the physical server, wherein the external device is a switch, Router or another physical network card.

4. The method according to claim 3, wherein the network device is a physical network card in a virtualization scenario, and the physical network card is connected to a virtual machine on the physical server.

5. The method according to any one of claims 1 to 4, characterized in that, according to whether the message carries a virtual LAN identifier, determining the target virtual LAN identifier from the specified virtual LAN identifier includes: Determine whether the message carries a virtual LAN identifier;

When the message does not carry a virtual LAN identifier, determine the default virtual LAN identifier corresponding to the port as the target virtual LAN identifier, and the default virtual LAN identifier is in the specified virtual LAN identifier;

When the message carries a virtual LAN identifier, determine whether the virtual LAN identifier in the message is among the specified virtual LAN identifiers;

When the virtual LAN identifier in the text is in the specified virtual LAN identifier, the default virtual LAN identifier corresponding to the port is determined as the target virtual LAN identifier.

6. The method according to claim 5, characterized in that, when the message is a message to be received, the message is sent to the target virtual LAN corresponding to the target virtual LAN identifier. Afterwards, the method further includes:

The message is received through the target virtual local area network, and the target virtual local area network identifier is written into the message that does not carry the virtual local area network identifier.

7. The method according to claim 5, wherein when the message is a message to be sent, the message is sent to the target virtual LAN corresponding to the target virtual LAN identifier. Previously, the method also included:

When the virtual LAN identifier carried in the message is the same as the default virtual LAN identifier corresponding to the port, the virtual LAN label carried in the message is deleted, and the virtual LAN label is

8. A network device, characterized by including:

Acquisition unit, used to obtain messages;

A search unit configured to search for configuration information corresponding to the port identifier according to the port identifier corresponding to the port of the message obtained by the acquisition unit, where the configuration information includes a designated virtual LAN identifier, and the designated virtual LAN identifier is The identification of the virtual LAN allowed to pass through the port; The first processing unit is configured to determine the target virtual LAN identifier from the designated virtual LAN identifier found by the search unit according to whether the message carries a virtual LAN identifier;

A sending unit, configured to send the message to the target virtual office i or network corresponding to the target virtual office i or network identification determined by the processing unit.

9. The network device according to claim 8, characterized in that, the network device further includes:

A receiving unit, configured to receive preset configuration information corresponding to the port identification from the management device.

10. The network device according to claim 8, wherein the port of the network device is an uplink port or a downlink port, the network device is installed on a physical server, and the physical server passes through the network device Connected to external devices, the uplink port is a physical port connecting the network device to the external device, the downlink port is a queue connecting the network device to the physical server, where the external device is a switch , router, or another physical network card.

11. The network device according to claim 10, characterized in that the network device is a physical network card in a virtualization scenario.

12. The network device according to any one of claims 8-11, characterized in that the first processing unit includes:

The first judgment module is used to judge whether the message carries the virtual LAN identifier; the first processing module is used to change the port corresponding to the port when the first judgment module judges that the message does not carry the virtual LAN identifier. The default virtual local area network identifier is determined to be the target virtual local area network identifier, and the default virtual local area network identifier is in the specified virtual local area network identifier;

A second determination module, configured to determine whether the virtual LAN identifier in the message is among the designated virtual LAN identifiers when the first determination module determines that the message carries a virtual LAN identifier; The second processing module is configured to determine the default virtual LAN identifier corresponding to the port as the target when the second judgment module determines that the virtual LAN identifier in the message is among the specified virtual LAN identifiers. VLAN ID.

13. The network device according to claim 12, characterized in that, when the message is a message to be received, the network device further includes:

The second processing unit is configured to receive the message through the target virtual LAN, and write the target virtual LAN identifier into the message that does not carry the virtual LAN identifier.

14. The network device according to claim 12, characterized in that when the message is a message to be sent, the network device further includes:

A third processing unit configured to delete the virtual LAN identifier carried in the message when the virtual LAN identifier carried in the message is the same as the default virtual LAN identifier corresponding to the port.