WO2018086014A1 - 云计算系统中报文处理的方法、主机和系统 - Google Patents

云计算系统中报文处理的方法、主机和系统 Download PDF

Info

Publication number
WO2018086014A1
WO2018086014A1 PCT/CN2016/105228 CN2016105228W WO2018086014A1 WO 2018086014 A1 WO2018086014 A1 WO 2018086014A1 CN 2016105228 W CN2016105228 W CN 2016105228W WO 2018086014 A1 WO2018086014 A1 WO 2018086014A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual
data packet
virtual machine
mac address
network
Prior art date
Application number
PCT/CN2016/105228
Other languages
English (en)
French (fr)
Inventor
于洲
张磊强
庄毓新
罗浩
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to BR112018000116-3A priority Critical patent/BR112018000116A2/pt
Priority to AU2016414390A priority patent/AU2016414390B2/en
Priority to EP16909060.2A priority patent/EP3525423B1/en
Priority to PCT/CN2016/105228 priority patent/WO2018086014A1/zh
Priority to CA2991359A priority patent/CA2991359C/en
Priority to CN202010929666.0A priority patent/CN112217746A/zh
Priority to CN201680009028.9A priority patent/CN107278359B/zh
Priority to SG11201800020UA priority patent/SG11201800020UA/en
Priority to JP2018510708A priority patent/JP6605713B2/ja
Publication of WO2018086014A1 publication Critical patent/WO2018086014A1/zh
Priority to US16/253,930 priority patent/US11005755B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/42—Centralised routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/58—Association of routers
    • H04L45/586—Association of routers of virtual routers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/70—Virtual switches

Definitions

  • the present invention relates to the field of IT technologies, and in particular, to a message processing method, a host, and a system in a cloud computing system.
  • Virtualization technology is one of the key technologies in the field of cloud computing. It can abstract the physical resources of a host into a shared resource pool for use by several virtual machines (VMs) running on the host. Several virtual machines running on the host can share the host's network card and communicate with the host's external network.
  • the network card can be allocated to the virtual machine by means of network card virtualization, and the network card virtualization can adopt Single-Root I/O Virtualization (SR-IOV) or multiple inputs. Multi-root Input/Output Virtualization (MR-IOV).
  • SR-IOV Single-Root I/O Virtualization
  • MR-IOV Multi-root Input/Output Virtualization
  • the above-mentioned network card virtualization is also called NIC pass-through. Take SR-IOV straight through as an example. When the network card supports SR-IOV, the SR-IOV technology can be used to share the host network card to several virtual machines running on the host.
  • the network port of the network card virtualizes at least one physical function (PF) and multiple virtual functions (VF), and the virtual machine on the host is connected to at least A VF.
  • the NIC internally contains a switching device with switch function.
  • the switching device forwards the data packet according to the Media Access Control (MAC) table, and is responsible for packet forwarding between the PF, the VF, and the physical network port.
  • MAC Media Access Control
  • Rich network functions such as security group, quality of service (QoS), Layer 2 tunnel encapsulation, and distributed routing.
  • This document describes a method, host, and system for packet processing in a cloud computing system to solve the problem that a network function cannot be provided in a network card through scenario.
  • an embodiment of the present invention provides a host, where at least one network card is connected to the host, A virtual machine monitor VMM is running on the host, and a first virtual machine is running on the VMM.
  • the VMM includes a virtual bridge and a virtual network function module, and the virtual network function module can provide network function processing capability.
  • the network card includes a switching device and at least two network ports, wherein the first network port supports the network card virtualization capability, and the first network port corresponds to at least one physical function PF and multiple virtual functions VF, the first network At least one VF of the port is directly passed to the first virtual machine,
  • the first virtual machine sends the data packet from the VF connected to itself, and the destination MAC address of the data packet is the MAC address of the virtual bridge uplink port, and the switching device of the first network port according to the purpose of the data packet
  • the MAC address forwards the data packet, sends the data packet to the virtual bridge on the VMM, and transmits the data packet to the virtual network function module through the virtual network bridge, and the virtual network function module provides rich network functions for the data packet.
  • the data packet can be guided from the network card to the virtual network function module in the VMM by using the above method, and the software module is used to provide rich network functions for the user.
  • a plurality of virtual machines may be run on the host, and each virtual machine is connected to at least one VF of the first network port, and multiple VFs of the first network port have different Virtual LAN VLAN ID.
  • the broadcast packets with the VLAN ID are transmitted only on the virtual LAN corresponding to the VLAN ID and are not sent to other VFs with different VLAN IDs.
  • the first virtual machine obtains the destination MAC address of the data packet to be sent through the APR process. specific:
  • the first virtual machine sends an ARP request packet by using the VF connected to the first virtual machine, where the ARP request packet carries the VLAN identifier of the VF that sends the ARP request packet.
  • the switching device of the first network port broadcasts the ARP request packet, and after the virtual bridge in the VMM receives the ARP request packet broadcast by the switching device, the SDN packet is sent to the SDN.
  • the controller forwards the ARP request packet.
  • the SDN controller records the network topology information of the cloud computing system.
  • the SDN controller constructs a flow entry, and returns the flow entry to the virtual bridge, where the flow entry includes
  • the ARP pickup setting is used to indicate that the virtual bridge constructs an ARP response packet, and the ARP response packet carries the MAC of the virtual bridge uplink port.
  • the address is used as the destination MAC address of the data packet to be sent;
  • the virtual bridge returns an ARP response packet to the first virtual machine according to the flow entry, and the ARP response packet carries the MAC address of the virtual bridge uplink port as the data packet to be sent. Destination MAC address.
  • the embodiment of the present invention defines a new ARP process, and sets the destination MAC address of the data packet to be sent to the MAC address of the virtual bridge uplink port, so that the data packet sent by the first virtual machine is forwarded to the second layer to Virtual bridge, which achieves the effect of redirecting packets from the NIC back to the VMM.
  • the flow entry further includes a MAC address setting, where the MAC address is configured to indicate that the virtual bridge receives the data packet sent by the first virtual machine to the second virtual machine.
  • the destination MAC address of the data packet is modified to the MAC address of the second virtual machine. Because the destination MAC address of the data packet sent by the first virtual machine is the MAC address of the virtual bridge uplink port, when the virtual bridge receives the data packet, the destination MAC address of the data packet needs to be replaced with the second virtual machine. MAC address, so that packets sent by the virtual bridge can be routed to the second virtual machine according to the real address of the second virtual machine.
  • the virtual bridge uplink port is a PF of the first network port, and the virtual bridge is connected to the network card by using the PF; or, the virtual bridge is uplinked.
  • the link port is a selected VF of the first network port, and the virtual bridge is connected to the network card by the selected VF, wherein the selected VF connected to the virtual bridge Is set to promiscuous mode.
  • the connection between the virtual bridge and the network card through the PF or the VF means that the virtual bridge is logically connected to the network card, that is, the virtual bridge and the network card transmit data packets through the PF or the VF. .
  • the source virtual machine (first virtual machine) and the destination virtual machine (second virtual machine) of the data packet are on the same host.
  • the processed data packet is returned to the virtual bridge, and the virtual bridge receives the processed data packet according to the data packet.
  • the destination MAC address sends the processed data packet to the second virtual machine through the switching device.
  • the second virtual machine and the first virtual machine may also run on different hosts.
  • the virtual network function module establishes another virtual network function mode on the host where the second virtual machine is located. a tunnel between the blocks, the processed data packet is sent to the second network port of the network card, and then the processed data packet is sent to the host where the second virtual machine is located through the tunnel. So that the another virtual network function module sends the processed data packet to the second virtual machine.
  • the embodiment of the present invention further provides a method for processing a packet in a cloud computing system, where at least one host in the cloud computing system includes a virtual machine monitor VMM, and at least one network card running on the host
  • the first virtual machine includes a virtual network bridge and a virtual network function module, where the network card includes a switching device and at least two network ports, wherein the first network port supports the network card virtualization capability, and the first network port Corresponding to the at least one PF and the plurality of VFs, the first virtual machine is connected to the at least one VF of the first network port, and the method includes:
  • the first virtual machine sends the data packet to the second virtual machine by using the VF connected to the first virtual machine, where the destination IP address carried by the data packet is an IP address of the second virtual machine, and the destination MAC address carried The MAC address of the uplink port of the virtual bridge;
  • the switching device receives the data packet, and sends the data packet to the virtual bridge through an uplink port of the virtual bridge according to a destination MAC address of the data packet;
  • the processed data packet is sent, and the destination MAC address of the processed data packet is a MAC address of the second virtual machine.
  • the multiple VFs of the first network port have different virtual local area network VLAN identifiers.
  • the first virtual machine obtains a destination MAC address of the to-be-sent data packet from the SDN controller through an ARP process, where the destination MAC address is a MAC address of the virtual bridge uplink port.
  • the manner of obtaining is the same as the description of the first aspect.
  • an embodiment of the present invention provides a cloud computing system, where the cloud computing system includes On the one hand, the host and the SDN controller, the SDN controller is configured to receive an ARP request packet from the first virtual machine that is forwarded by the virtual bridge, and return a flow entry to the virtual bridge.
  • the flow entry includes an ARP pickup setting and a MAC address setting, where the ARP pickup setting is used to instruct the virtual bridge to construct an ARP response packet for the ARP request, where the ARP response packet carries the The MAC address of the virtual bridge uplink port is used as the destination MAC address of the data packet to be sent.
  • an embodiment of the present invention provides a host having a function of implementing a host defined in the first aspect.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the host includes a first processor, a first memory, and at least one network card, where the network card includes a second processor, a second memory, and at least two network ports, wherein the first network port supports the network card virtualization capability.
  • the first network port is connected to at least one PF and the plurality of VFs, and the first virtual machine is connected to at least one VF of the first network port, where the first memory and the second memory are stored.
  • the first processor is configured to execute instructions in the first memory to implement functions of the first virtual machine, the virtual bridge, and the virtual network function module in the first aspect;
  • the second processor is configured to execute instructions in the second memory to implement the functionality of the switching device in the first aspect.
  • the host and SDN controller are implemented by a general purpose or dedicated server including a processor, a memory, a system bus, and an input and output interface, the processor being configured to support the system The corresponding function of the host.
  • the input and output interface is for communicating with other components in the cloud computing system, and the processor executes instructions stored in the memory.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use by the host, including a program designed to perform the above aspects.
  • an embodiment of the present invention provides another computer storage medium for storing computer software instructions for use in a switching device in the network card, including a program designed to perform the above aspects.
  • an embodiment of the present invention provides a computer program, when the physical server runs the meter In the computer program, the physical server performs the functions of the virtual machine, the virtual bridge, and the virtual network function module in the host.
  • an embodiment of the present invention provides a computer program, when a processor or a programmable logic circuit in a network card runs the computer program, the network card performs the functions of the switching device in the foregoing aspect.
  • FIG. 1A is a schematic diagram of a virtualization structure on a host according to an embodiment of the present invention.
  • FIG. 1B is a schematic diagram of a virtualization structure on a host in a NIC passthrough scenario according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a virtualization architecture on another host provided by the implementation of the present invention.
  • FIG. 3 is a schematic diagram of an ARP process according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a VM1 sending a data packet to a VM2 according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of hardware of a computer device according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a cloud computing system according to an embodiment of the present invention.
  • the network architecture and the service scenario described in the embodiments of the present invention are used to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation of the technical solutions provided by the embodiments of the present invention.
  • the technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.
  • FIG. 1A is a schematic diagram of a virtualization structure on a host according to an embodiment of the present invention.
  • the host is a physical server
  • the bottom layer of the physical server is the hardware layer
  • the hardware layer mainly includes the central processing.
  • Hardware resources such as CPU (Central Processing Unit), memory, hard disk, and network card.
  • Server virtualization is a virtualized operating environment for multiple virtual machines (VMs) on a physical server with virtualization software such as VMWare ESX and Citrix XEN.
  • the software layer that is installed on the server to implement the virtualized environment is called the Virtual Machine Monitor (VMM).
  • the VMM running on top of the hardware layer assumes the scheduling, allocation, and management of hardware resources in the hardware layer. Multiple virtual machine VMs are run on the VMM.
  • the VMM provides virtualized CPU, memory, storage, IO devices (such as network cards) and Ethernet switches for each virtual machine to ensure that multiple virtual machines run in isolation.
  • the VMM creates a virtual network interface card (vNIC) for each virtual machine.
  • the virtual switch VSwitch provides communication between virtual machines and between virtual machines and external networks.
  • the virtual NIC of each virtual machine corresponds to a logical port of the VSwitch.
  • the physical NIC of the host corresponds to the port that the VSwitch connects to the external physical switch.
  • the virtual network function module in the VMM performs network function processing on the passed data. Since the virtual network function module is a software module, it can be updated as needed, and therefore, the virtual in the VMM
  • the network function module can provide users with rich network functions.
  • the physical port's network port support virtualization capability can be achieved by Single Root Input/Output Virtualization (SR-IOV) or Multiple Root Input/Output Virtualization (MR-IOV).
  • SR-IOV Single Root Input/Output Virtualization
  • MR-IOV Multiple Root Input/Output Virtualization
  • the embodiment of the present invention is described by taking the SR-IOV technology as an example.
  • SR-IOV technology is a hardware-based virtualization solution that efficiently shares PCIe (Peripheral Component Interconnect Express) devices between virtual machines, and because SR-IOV technology is implemented in hardware Therefore, it is possible to obtain efficient I/O performance.
  • PCIe Peripheral Component Interconnect Express
  • PCI-SIG Peripheral Component Interconnect Special Interest Group
  • SR-IOV enabled PCIe Devices such as the network port of a physical NIC
  • the physical network card supporting the SR-IOV includes a plurality of network ports, and the SR-IOV capability can be enabled/disabled for each network port.
  • the network port with the SR-IOV capability enabled corresponds to at least one physical function. (Physical Function, PF) and multiple Virtual Functions (VF).
  • each PF can have up to 64,000 VFs associated with it. After the VF is created, the VF can be directly assigned to the virtual machine on the host, so that multiple virtual machines can share the PCIe device through at least one VF connected to the VF.
  • FIG. 1B is a schematic diagram of a virtualization structure on a host in a NIC passthrough scenario according to an embodiment of the present invention.
  • the physical NIC supports a single IO virtualization, and one network port of the physical NIC corresponds to For at least one PF and multiple VFs, each VF can share physical resources (such as a network card port) of the physical network card.
  • the switching device is a virtual ethernet bridge&classifier.
  • the implementation of the network card through-through may be an SR-IOV or an MR-IOV, which is not limited in this embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a virtualization architecture on another host provided by the implementation of the present invention.
  • the host includes a virtual machine monitor VMM and at least one physical network card, and the host runs at least one virtual machine.
  • the at least one physical network card includes at least two network ports, a first network port and a second network port.
  • the first network port supports the network card virtualization capability, and the second network port is connected to the physical switch outside the host.
  • the first network port virtualizes at least one PF and at least two VFs (illustrated by taking two VFs in FIG. 2 as an example), and the first virtual machine and the second virtual machine are installed with a VF driver, a first virtual machine, and a second virtual machine.
  • the virtual machine is connected to at least one VF, and the PF is connected to the virtual bridge on the VMM.
  • the virtual bridge is connected to the virtual network function module on the VMM.
  • the virtual network function module is connected to the physical switch outside the host through the second network port. even.
  • the virtual bridge on the VMM can be an openvswitch bridge, and the PF of the first network port is used as an uplink port of the virtual bridge.
  • a VF of the first network port can also be selected as the uplink port of the virtual bridge, that is, the first network port is connected to the virtual bridge on the VMM through the selected VF, and at this time, it needs to be on the VMM.
  • the VF driver is loaded, and the VF connected to the virtual bridge is set to the promiscuous mode, and the VF set to the promiscuous mode is similar to the PF, and can receive the data packet whose destination address is not its own MAC address.
  • the first network port and the second network port may be located on the same network card, or may be located on different network cards, which is not limited in this embodiment of the present invention.
  • the network card virtualization specifically refers to network card hardware virtualization.
  • the first virtual machine and the second virtual machine are respectively connected to at least one VF of the first network port, and each VF of the first network port is provided with a different virtual local area network (VLAN) identifier, because one VLAN is one In a broadcast domain, broadcast packets can only be sent to virtual machines in a VLAN. Therefore, each virtual machine is in a different broadcast domain by using different VLAN IDs set for each VF.
  • the broadcast packets sent by the VM can only be received by the VM itself and the PF.
  • VLAN IDs on different hosts can be the same.
  • the first virtual machine sends a data packet to the second virtual machine, which is communication between two virtual machines inside the same host.
  • the second virtual machine and the first virtual machine may also be located on different hosts, and the first virtual machine and the second virtual machine communicate with each other.
  • the network card supporting the network card virtualization function can be virtualized into at least one PF and multiple VFs, and is not limited to two. VF, correspondingly, the number of VLAN sub-interfaces is not limited to two.
  • the embodiment of the present invention takes VM1 (first virtual machine) to send a data packet to VM2 (second virtual machine) as an example.
  • the processing flow of the data packet is described.
  • the switching device in the network card needs to send the data packet from the VM1 to the virtual network function module on the VMM for processing.
  • the first virtual machine determines that the destination medium access control MAC address of the data packet to be transmitted is the MAC address of the virtual bridge uplink port in the VMM.
  • the first virtual machine sends the data packet to the second virtual machine by using the VF connected to the first virtual machine, where the destination IP address carried by the data packet is an IP address of the second virtual machine, and the destination MAC address carried is The MAC address of the virtual bridge uplink port.
  • the switching device of the first network port receives the data packet sent by the first virtual machine through the VF, performs Layer 2 forwarding on the data packet according to the destination MAC address of the data packet, and passes the data packet through the uplink of the virtual bridge. The intersection is sent to the virtual bridge.
  • the virtual bridge receives the data packet, modifies the destination MAC address of the data packet to the MAC address of the second virtual machine, and sends the modified data packet to the virtual network function module, by modifying the destination MAC address of the data packet.
  • the address enables the subsequent transmission of the data to use the modified MAC address, thereby ensuring that the data packet can be sent to the second virtual machine.
  • the virtual network function module After receiving the modified data packet, the virtual network function module performs network function processing on the modified data packet to provide a rich network function service for the user, and then processes according to the MAC address of the second virtual machine. The subsequent packet is sent to the second virtual machine.
  • the virtual machine sends the data packet from the VF connected to the virtual machine, and is forwarded by the switching device of the first network port, and sends the data packet to the virtual bridge on the VMM, and the data is sent through the virtual bridge.
  • the package is passed to the virtual network function module, which provides rich network functions for the data packet.
  • the data packet can be sent to the virtual network function module in the VMM by using the above method, and the software module is used to provide the user with rich network functions.
  • the packet is processed by the virtual network function.
  • the embodiment of the present invention provides an address resolution protocol (ARP) process, so that the first virtual machine can obtain the MAC address of the virtual bridge uplink port before sending the data packet, thereby The destination MAC address of the packet is set to the MAC address of the virtual bridge uplink port.
  • ARP address resolution protocol
  • the Software Defined Network (SDN) controller picks up the ARP request initiated by the VM1, and carries the uplink port of the virtual bridge on the VMM in the ARP response. MAC address by passing the MAC address with the data
  • the destination IP of the packet corresponds so that the packet sent by VM1 is directed to the PF or VF connected to the virtual bridge.
  • the SDN controller can obtain the network topology of the cloud computing network, and the foregoing ARP process can be implemented.
  • FIG. 3 it is a schematic diagram of an ARP process provided by an embodiment of the present invention.
  • Step 301 The VM1 sends an ARP request packet, and carries the IP address of the VM2, and is used to obtain the MAC address of the VM2.
  • the ARP request packet is sent from the VF connected to the VM1, and the switching device on the network card receives the ARP request packet.
  • the ARP request packet carries the VLAN identifier of the VF that sends the ARP request packet.
  • Step 302 The switching device broadcasts the ARP request packet, and the ARP request packet is sent to the virtual bridge through the PF because the VFs of each virtual machine connected to the host have different VLAN identifiers.
  • the ARP request message is sent to the virtual bridge through the AF.
  • Step 303 The virtual bridge forwards the ARP request packet to the SDN controller.
  • the virtual bridge can send the ARP request packet to the SDN controller by using a packet-in message.
  • Step 304 The SDN controller sets a flow entry for the virtual bridge, and sends the flow entry to the virtual bridge.
  • the flow entry includes:
  • ARP pickup setting indicates that when the virtual bridge receives the ARP packet request from the VM1 for obtaining the MAC address of the VM2, the ARP response packet is constructed and carried in the ARP response packet.
  • the MAC address of the virtual bridge uplink port is the MAC address of the VM2, and the MAC address of the virtual bridge uplink port is the MAC address of the PF or VF connected to the virtual bridge;
  • VLAN identification processing setting remove the VLAN identifier carried in the unicast packet for the unicast packet sent by the VM1;
  • MAC address setting For the unicast message sent by VM1 to VM2, the destination MAC address of the unicast message is modified to the MAC address of the VM2, and the modified unicast message is sent to the virtual port through the port connected to the virtual network function module. Network function module.
  • Step 305 The virtual bridge configures a flow entry, and returns an ARP response packet to the VM1 according to the ARP proxy setting.
  • the ARP response packet carries the MAC address of the virtual bridge uplink interface, and the ARP response packet passes the uplink.
  • the link port is sent to the switching device.
  • Step 306 The switching device forwards the ARP response packet to VM1.
  • Step 307 VM1 receives the ARP response packet, and sets the MAC address of VM2 to the MAC address of the virtual bridge uplink port.
  • the embodiment of the present invention defines the foregoing ARP process, and does not need to implement Layer 2 forwarding control of VM traffic in the form of a self-learning MAC forwarding table.
  • the destination MAC of the data packet sent by the VM1 is the MAC address of the virtual bridge uplink port, thereby ensuring that the data packet is sent to the virtual bridge through the uplink port, and then the virtual bridge will be used by the virtual bridge.
  • the packet is forwarded to the virtual network function module for processing.
  • FIG. 4 it is a schematic flowchart of a VM1 sending a data packet to a VM2 according to an embodiment of the present invention.
  • VM1 on the host 1 sends a data packet to the VM2 on the host 2.
  • the VMM of the host 1 includes a first virtual bridge and a first virtual network function module, and the network card of the host 1 includes at least two networks.
  • the first switching device, the VMM of the host 2 includes a second virtual bridge and a second virtual network function module, and the network card of the host 2 includes at least two network ports and a second switching device.
  • the structures of the host 1 and the host 2 and the functions of the components are as shown in FIG. 2, and details are not described herein again.
  • the process of VM1 sending data packets to VM2 includes:
  • Step 401 VM1 sends a data packet destined for VM2 through a VF connected to itself, the destination IP address of the data packet is the IP address of VM2, and the destination MAC address is the MAC address of the uplink port of the first virtual bridge on the host 1.
  • the data packet carries a VLAN identifier of the VF;
  • Step 402 The first switching device of the network card 1 receives the data packet, and sends the data packet to the first virtual bridge through the uplink port according to the destination MAC address of the data packet.
  • Step 403 The first virtual bridge processes the data packet according to the preset flow entry, removes the VLAN identifier of the data packet, and modifies the destination MAC address of the data packet to the MAC address of the VM2.
  • Step 404 The first virtual bridge sends the modified data packet to the first virtual network function module.
  • Step 405 The first virtual network function module performs network function processing on the data packet, including Full group, QoS, Layer 2 tunnel encapsulation, distributed routing, etc.
  • the first virtual network function module performs the network function processing, and may adopt various implementation manners in the prior art, which is not limited by the embodiment of the present invention.
  • Step 406 The first virtual network function module sends the processed data packet to the physical switch outside the host 1 through the second network port, and the physical switch routes the data packet to the host 2 where the VM2 is located through the network;
  • the data packet carries the IP address and the MAC address of the VM2, and the data packet can be routed to the host 2 where the VM2 is located by using the existing routing manner.
  • the transmission process of the data packet in the network in the embodiment of the present invention is described.
  • the host 1 where VM1 is located and the host 2 where VM2 is located can establish a tunnel.
  • the endpoints of the tunnel are virtual network function modules of host 1 and host 2, respectively, so that VM1 is between the two hosts.
  • VM2 establishes the tunnel required for data transmission.
  • Step 407 The second virtual network function module of the host 2 where the VM2 is located performs network function processing on the received data packet, and sends the processed data packet to the second virtual network bridge.
  • Step 408 The second virtual bridge performs Layer 2 forwarding according to the MAC address of the VM2, and sends the data packet to the VF connected to the VM2 through the switching device, so as to send the data packet to the second virtual machine.
  • the data packet For a data packet sent from the outside of the host to the destination virtual machine on the host, the data packet is first transmitted to the virtual network function module through the second network port, and is processed by the virtual network function and then transmitted to the data packet through the first network port. virtual machine.
  • the embodiment shown in FIG. 4 is a cross-host communication between virtual machines. It can be understood that the source virtual machine and the destination virtual machine of the data packet can be located on the same host, and the data packet transmission process is similar to the process of FIG.
  • the virtual network function module of the host completes the network function processing after the source virtual machine and the destination virtual machine of the data packet are located on the same host, and then sends the processed data packet to the virtual bridge, which is determined by the virtual bridge according to the virtual bridge.
  • the MAC address of the destination VM sends the processed packet to the destination VM.
  • the mainframe and the SDN controller may be a general-purpose computer device.
  • FIG. 5 it is a schematic diagram of a hardware structure of a computer device according to an embodiment of the present invention.
  • Computer device 500 includes at least one processor 501, a communication bus 502, a memory 503, and at least one communication interface 504.
  • Processor 501 can be a general purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present invention.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • Communication bus 502 can include a path for communicating information between the components described above.
  • the communication interface 504 uses devices such as any transceiver for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), and the like.
  • RAN Radio Access Network
  • WLAN Wireless Local Area Networks
  • the memory 503 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • the dynamic storage device can also be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or other optical disc storage, and a disc storage device. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • the memory can exist independently and be connected to the processor via a bus.
  • the memory can also be integrated with the processor.
  • the memory 503 is used to store application code for executing the solution of the present invention, and is controlled by the processor 501 for execution.
  • the processor 501 is configured to execute application code stored in the memory 503.
  • the processor 501 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • computer device 500 can include multiple processors, such as processor 501 and processor 508 in FIG. Each of these processors can be a single-CPU processor or a multi-core processor.
  • processors herein may refer to one or more devices, circuits, and/or processing data (eg, computer program instructions) Processing core.
  • computer device 500 may also include an output device 505 and an input device 506 as an embodiment.
  • Output device 505 is in communication with processor 501 and can display information in a variety of ways.
  • the output device 505 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait.
  • Input device 506 is in communication with processor 501 and can accept user input in a variety of ways.
  • input device 506 can be a mouse, keyboard, touch screen device, or sensing device, and the like.
  • the computer device 500 described above can be a general purpose computer device or a special purpose computer device.
  • the computer device 500 can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet, a wireless terminal device, a communication device, an embedded device, or have FIG. A device of similar structure.
  • Embodiments of the invention do not limit the type of computer device 500.
  • the SDN controller and the host in FIG. 2 may be the device shown in FIG. 5, and the memory stores one or more software modules for implementing various functions of the host and the SDN controller.
  • the host and the SDN controller can implement the packet processing method disclosed in the embodiment of the present invention by using the processor and the program code in the memory.
  • the computer device shown in FIG. 5 merely gives possible hardware implementations of various parts of the cloud computing system, and may add or delete hardware components of the computer device according to different functions or changes of various parts of the system. In order to match the functions of the various parts of the system.
  • the network card in the above embodiment includes a processor and a memory, and the processor in the network card executes instructions in the memory to implement the functions of the switching device.
  • the embodiments of the present invention are not described again.
  • FIG. 6 a schematic structural diagram of a cloud computing system according to an embodiment of the present invention, where the cloud computing system includes at least one host 601 and an SDN controller 602, the host At least one network card is included, and the structure of the host is as shown in FIG. 2.
  • the host 601 includes a virtual machine monitor VMM, and at least one network card.
  • the host 601 runs a first virtual machine
  • the VMM includes a virtual bridge and a virtual network function module
  • the network card includes a switching device and at least two a network port
  • the first network port supports a single input and output virtualization
  • the first network port corresponds to at least one PF and multiple VFs
  • the first virtual machine is connected to at least the first network port a VF
  • the SDN controller 602 is configured to receive an ARP request packet that is forwarded by the virtual bridge from the first virtual machine, and return a flow entry to the virtual bridge, where the flow entry includes an ARP proxy Setting and MAC address setting, the ARP proxy setting is used to instruct the virtual bridge to construct an ARP response packet for the first virtual machine, where the ARP response packet carries the virtual bridge uplink port
  • the MAC address is used as the destination MAC address of the data packet to be sent;
  • the first virtual machine is configured to send the data packet to the second virtual machine by using the VF connected to the first virtual machine, where the destination IP address carried by the data packet is an IP address of the second virtual machine, and is carried by The destination MAC address is the MAC address of the virtual bridge uplink port;
  • the switching device is configured to receive the data packet, and send the data packet to the virtual bridge by using an uplink port of the virtual bridge according to a destination MAC address of the data packet;
  • the virtual bridge is configured to receive the data packet, modify a destination MAC address of the data packet to a MAC address of the second virtual machine, and send the modified data packet to a virtual network function module;
  • the virtual network function module is configured to send the processed data packet to the second virtual machine according to the MAC address of the second virtual machine after performing network function processing on the modified data packet.
  • the multiple VFs of the first network port have different virtual local area network VLAN identifiers.
  • the first virtual machine is further configured to send the ARP request packet by using the VF that is connected to the first virtual machine, where the ARP request packet carries a VLAN identifier of the VF that sends an ARP request packet.
  • the switching device is further configured to broadcast the ARP request packet, where the ARP request packet is sent to the virtual bridge by using the uplink port;
  • the virtual bridge is further configured to forward the ARP request packet to the SDN controller, receive the flow entry returned by the SDN controller, and return an ARP response packet to the first virtual machine.
  • ARP The response message carries the MAC address of the virtual bridge uplink port as the destination MAC address of the to-be-sent packet.
  • the flow entry further includes a MAC address setting, where the MAC address is configured to indicate that the virtual bridge sends the destination MAC address of the unicast packet when receiving the unicast packet sent by the first virtual machine to the second virtual machine.
  • the address is modified to the MAC address of the second virtual machine.
  • the flow entry further includes an output setting, the output setting is used to indicate that the modified data packet is sent through a port connected to the virtual network function module.
  • the virtual bridge uplink port is a PF of the first network port, and the virtual bridge is connected to the network card by using the PF; or the virtual bridge uplink port is the first A selected VF of the network port, the virtual bridge being connected to the network card by the selected VF, wherein the selected VF connected to the virtual bridge is set to a promiscuous mode.
  • the virtual bridge is further configured to receive the processed data packet, and the processing is performed according to the destination MAC address of the data packet.
  • the subsequent data packet is sent to the second virtual machine through the switching device.
  • a tunnel is established between the virtual network function modules of the two hosts where the first virtual machine and the second virtual machine are located, and the tunnel is processed through the tunnel.
  • the subsequent data packet is sent from the second network port and transmitted to the virtual network function module of the host where the second virtual machine is located.
  • the data packet is sent to the second virtual machine through the virtual bridge of the host where the second virtual machine is located.
  • the embodiment of the present invention further provides a computer storage medium for storing the computer software instructions used in the foregoing apparatus of FIG. 2-6, which includes a program designed to execute the foregoing method embodiments. By executing the stored program, a method of processing a message in a cloud computing system can be implemented.
  • the method for processing a message in a cloud computing system provided by the embodiment of the present invention, the host and the system, can guide the packet sent by the virtual machine using the direct VF to the virtual bridge on the VMM, and then by the VMM.
  • the virtual network function module performs network function processing on the data packet, thereby providing users with rich network functions.
  • embodiments of the present invention can be provided as a method, apparatus (device), or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, embodiments of the invention may take the form of a computer program product embodied on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program is stored/distributed in a suitable medium, provided with other hardware or as part of the hardware, or in other distributed forms, such as over the Internet or other wired or wireless telecommunication systems.
  • the computer program instructions relating to the embodiments of the present invention may be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, and the functions of the components in the foregoing embodiments may be implemented by executing computer program instructions.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Abstract

本发明实施例提供了一种计算系统中报文处理的方法、主机和系统。至少一个网卡连接到该主机，所述主机上运行有虚拟机监视器VMM，VMM上运行有第一虚拟机，所述VMM包含虚拟网桥以及虚拟网络功能模块。所述网卡包含交换设备以及至少两个网口，所述第一网口对应于至少一个物理功能PF和多个虚拟功能VF，所述第一网口的至少一个VF直通给所述第一虚拟机。第一虚拟机将数据包从与虚拟机相连的VF发出，由第一网口的交换设备根据数据包的目的MAC地址对数据包进行转发，将数据包发送给VMM上的虚拟网桥，通过该虚拟网桥将数据包传递到虚拟网络功能模块，由虚拟网络功能模块为该数据包提供丰富的虚拟网络功能处理。在网卡直通的场景下，虚拟机将数据包从直通的VF发出后，通过上述方式可以将数据包从网卡重定向到VMM中的虚拟网络功能模块，利用该软件模块为用户提供丰富的虚拟网络功能。

Description

云计算系统中报文处理的方法、主机和系统 技术领域
本发明涉及IT技术领域，尤其涉及云计算系统中报文处理的方法、主机和系统。
背景技术
虚拟化技术是云计算领域的关键技术之一，可将主机的物理资源抽象成共享资源池，供主机上运行的若干个虚拟机(Virtual Machine，VM)使用。主机上运行的若干个虚拟机可以共享使用主机的网卡，与主机外部网络进行通信。在现有技术中，可以通过网卡虚拟化的方式将网卡分配给虚拟机使用，网卡虚拟化可以采用单根输入输出虚拟化(Single-Root I/O Virtualization，SR-IOV)或或多根输入输出虚拟化(Multi Root Input/Output Virtualization，MR-IOV)，上述网卡虚拟化又称为网卡直通。以SR-IOV直通为例，当网卡支持SR-IOV时，使用SR-IOV技术可以将主机上网卡共享给主机上运行的若干个虚拟机。
在主机上使用支持SR-IOV能力的网卡时，网卡的网口会虚拟出至少一个物理功能(Physical Function,PF)以及多个虚拟功能(Virtual Function,VF)，主机上的虚拟机连接到至少一个VF。网卡内部包含具备交换机功能的交换设备。该交换设备按照介质访问控制(MediaAccessControl，MAC)表转发数据包，负责着PF、VF和物理网口之间的数据包转发，但由于该交换设备的处理和存储能力有限，因此无法为用户提供丰富的网络功能，例如安全组、服务质量(Quality of Service，QoS)、二层隧道封装以及分布式路由等等。
发明内容
本文描述了一种云计算系统中报文处理的方法、主机和系统，以解决网卡直通场景下无法提供丰富的网络功能的问题。
第一方面，本发明实施例提供了一种主机，至少一个网卡连接到该主机， 所述主机上运行有虚拟机监视器VMM，VMM上运行有第一虚拟机，所述VMM包含虚拟网桥以及虚拟网络功能模块，所述虚拟网络功能模块可以提供网络功能处理的能力。所述网卡包含交换设备以及至少两个网口，其中，第一网口支持网卡虚拟化能力，所述第一网口对应于至少一个物理功能PF和多个虚拟功能VF，所述第一网口的至少一个VF直通给所述第一虚拟机，
第一虚拟机将数据包从与自身相连的VF发出，所述数据包的目的MAC地址为所述虚拟网桥上行链路口的MAC地址，由第一网口的交换设备根据数据包的目的MAC地址对数据包进行转发，将数据包发送给VMM上的虚拟网桥，通过该虚拟网桥将数据包传递到虚拟网络功能模块，由虚拟网络功能模块为该数据包提供丰富的网络功能。在网卡直通的场景下，虚拟机将数据包从直通的VF发出后，通过上述方式可以将数据包从网卡引导到VMM中的虚拟网络功能模块，利用该软件模块为用户提供丰富的网络功能。
在一种可能的设计中，所述主机上可以运行有多个虚拟机，每个虚拟机与所述第一网口的至少一个VF相连，所述第一网口的多个VF具有不同的虚拟局域网VLAN标识。通过为每个VF设置与其他VF不同的VLAN标识，保证带有VLAN标识的广播报文只在VLAN标识对应的虚拟局域网传播，从而不会被发送给具有不同VLAN标识的其他VF。
在一种可能的设计中，第一虚拟机通过APR流程获取待发送的数据包的目的MAC地址。具体的：
第一虚拟机通过与自身相连的VF发出ARP请求报文，所述ARP请求报文携带发出ARP请求报文的所述VF的VLAN标识，
第一网口的交换设备接收到所述ARP请求报文后，广播所述ARP请求报文，当VMM中的虚拟网桥接收到所述交换设备广播的所述ARP请求报文后，向SDN控制器转发所述ARP请求报文。SDN控制器记录有云计算系统的网络拓扑信息，当SDN控制器收到ARP请求报文时，构建流表项，并向所述虚拟网桥返回所述流表项，所述流表项包括ARP代答设置，所述ARP代答设置用于指示所述虚拟网桥构造ARP响应报文，所述ARP响应报文携带所述虚拟网桥上行链路口的MAC 地址作为所述待发送的数据包的目的MAC地址；
所述虚拟网桥根据所述流表项向所述第一虚拟机返回ARP响应报文，ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址。
本发明实施例定义了新的ARP流程，将待发送的数据包的目的MAC地址设定为虚拟网桥上行链路口的MAC地址，从而使得第一虚拟机发出的数据包经过二层转发到虚拟网桥，从而实现数据包从网卡重定向回VMM的效果。
在一种可能的设计中，所述流表项还包括MAC地址设置，所述MAC地址设置用于指示所述虚拟网桥在接收到第一虚拟机发送给第二虚拟机的所述数据包时，将所述数据包的目的MAC地址修改为第二虚拟机的MAC地址。由于第一虚拟机发出的数据包的目的MAC地址为虚拟网桥上行链路口的MAC地址，当虚拟网桥收到该数据包时，需要将数据包的目的MAC地址替换为第二虚拟机的MAC地址，从而使得虚拟网桥发出的数据包可以根据第二虚拟机真实的地址路由到第二虚拟机。
在一种可能的设计中，所述虚拟网桥上行链路口为所述第一网口的PF，所述虚拟网桥通过所述PF与所述网卡相连；或者，所述虚拟网桥上行链路口为所述第一网口的选定的VF，所述虚拟网桥通过所述选定的VF与所述网卡相连，其中，与所述虚拟网桥相连的所述选定的VF被设置为混杂模式。需要说明的是，所述虚拟网桥通过PF或VF与所述网卡相连指虚拟网桥与所述网卡存在逻辑相连，即所述虚拟网桥与所述网卡之间通过PF或VF传输数据包。
在一种可能的设计中，数据包的源虚拟机(第一虚拟机)和目的虚拟机(第二虚拟机)在同一主机上。此时，当虚拟网络功能模块处理完所述数据包后，将所述处理后的数据包返回给所述虚拟网桥，所述虚拟网桥接收处理后的数据包，根据所述数据包的目的MAC地址将所述处理后的数据包通过所述交换设备发送给所述第二虚拟机。
所述第二虚拟机与所述第一虚拟机也可以运行在不同主机上，此时，所述虚拟网络功能模块建立与所述第二虚拟机所在的主机上的另一虚拟网络功能模 块之间的隧道，将所述处理后的数据包发送到所述网卡的第二网口，然后通过所述隧道将所述处理后的数据包发送到所述第二虚拟机所在的主机，以使得所述另一虚拟网络功能模块将所述处理后的数据包发送到所述第二虚拟机。
第二方面，本发明实施例还提供了一种云计算系统中报文处理的方法，所述云计算系统中的至少一个主机包括虚拟机监视器VMM，以及至少一个网卡，所述主机上运行有第一虚拟机，所述VMM包含虚拟网桥以及虚拟网络功能模块，所述网卡包含交换设备以及至少两个网口，其中，第一网口支持网卡虚拟化能力，所述第一网口对应于至少一个PF和多个VF，所述第一虚拟机连接到所述第一网口的至少一个VF，所述方法包括：
所述第一虚拟机确定待发送的数据包的目的MAC地址，所述待发送的数据包的MAC地址为所述虚拟网桥上行链路口的MAC地址；
所述第一虚拟机通过与自身相连的所述VF向第二虚拟机发送所述数据包，所述数据包携带的目的IP地址为所述第二虚拟机的IP地址，携带的目的MAC地址为所述虚拟网桥上行链路口的MAC地址；
所述交换设备接收所述数据包，根据所述数据包的目的MAC地址，将所述数据包通过所述虚拟网桥的上行链路口发送到所述虚拟网桥；
所述虚拟网桥接收所述数据包，将所述数据包的目的MAC地址修改为所述第二虚拟机的MAC地址，将修改后的数据包发送给虚拟网络功能模块；
所述虚拟网络功能模块对所述修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的MAC地址为所述第二虚拟机的MAC地址。
在一种可能的设计中，所述第一网口的多个VF具有不同的虚拟局域网VLAN标识。
在另一种可能的设计中，第一虚拟机通过ARP流程从SDN控制器获取待发送数据包的目的MAC地址，所述目的MAC地址为所述虚拟网桥上行链路口的MAC地址。具体获取的方式与第一方面的描述相同。
第三方面，本发明实施例提供了一种云计算系统，所述云计算系统包括第 一方面所述的主机以及SDN控制器，所述SDN控制器，用于接收所述虚拟网桥转发的来自所述第一虚拟机的ARP请求报文，向所述虚拟网桥返回流表项，所述流表项包括ARP代答设置和MAC地址设置，所述ARP代答设置用于指示所述虚拟网桥针对所述ARP请求构造ARP响应报文，所述ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为待发送的数据包的目的MAC地址。
第四方面，与前述装置、方法以及系统相对应，本发明实施例提供了一种主机，该主机具有实现第一方面中定义的主机的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。具体的，所述主机包括第一处理器、第一存储器以及至少一个网卡，所述网卡包含第二处理器、第二存储器以及至少两个网口，其中，第一网口支持网卡虚拟化能力，所述第一网口对应于至少一个PF和多个VF，所述第一虚拟机连接到所述第一网口的至少一个VF，所述第一存储器和所述第二存储器中存储有指令，
所述第一处理器用于执行所述第一存储器中的指令以实施第一方面中第一虚拟机、虚拟网桥以及虚拟网络功能模块的功能；
所述第二处理器用于执行所述第二存储器中的指令以实施第一方面中交换设备的功能。
在一个可能的设计中，所述主机和SDN控制器由通用或专用的服务器实现，服务器的结构中包括处理器、存储器、系统总线以及输入输出接口，所述处理器被配置为支持所述系统中主机的相应的功能。所述输入输出接口用于与所述云计算系统中的其他部件进行通信，处理器执行所述存储器中存储的指令。
第五方面，本发明实施例提供了一种计算机存储介质，用于储存为上述主机所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第六方面，本发明实施例提供了另一种计算机存储介质，用于储存为上述网卡中的交换设备所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第七方面，本发明实施例提供了一种计算机程序，当物理服务器运行该计 算机程序时，该物理服务器执行主机中虚拟机、虚拟网桥以及虚拟网络功能模块的功能。
第八方面，本发明实施例提供了一种计算机程序，当网卡中的处理器或可编程逻辑电路运行该计算机程序时，网卡执行前述方面中交换设备的功能。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍。显而易见地，下面附图中反映的仅仅是本发明的一部分实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得本发明的其他实施方式。而所有这些实施例或实施方式都在本发明的保护范围之内。
图1A是本发明实施例提供的主机上的虚拟化结构示意图；
图1B是本发明实施例提供的一种网卡直通场景下主机上的虚拟化结构示意图；
图2是本发明实施提供的另一种主机上的虚拟化架构示意图；
图3是本发明实施例提供的ARP流程示意图；
图4是本发明实施例提供的VM1向VM2发送数据包的流程示意图；
图5是本发明实施例提供的一种计算机设备硬件结构示意图；
图6是本发明实施例提供的一种云计算系统结构示意图。
具体实施方式
本发明实施例描述的网络架构以及业务场景是为了更加清楚的说明本发明实施例的技术方案，并不构成对于本发明实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本发明实施例提供的技术方案对于类似的技术问题，同样适用。
如图1A所示，为本发明实施例提供的主机上的虚拟化结构示意图。主机为一台物理服务器，该物理服务器的底层为硬件层，硬件层主要包括中央处理 器(CPU，Central Processing Unit)、内存、硬盘以及网卡等硬件资源。服务器虚拟化是在物理服务器上借助虚拟化软件(如VMWare ESX、Citrix XEN)实现多个虚拟机(Virtual Machine，VM)的虚拟化运行环境。安装在服务器上实现虚拟化环境的软件层被称为虚拟机监视器(Virtual MAChine Monitor,VMM)。运行在硬件层之上的VMM承担对硬件层中的硬件资源进行调度、分配和管理工作。VMM之上运行多个虚拟机VM，VMM为每个虚拟机提供虚拟化的CPU、内存、存储、IO设备(如网卡)以及以太网交换机等硬件环境，保证多个虚拟机相互隔离运行。
在虚拟化运行环境中，VMM为每个虚拟机创建虚拟网卡(Virtual Network Interface Card，vNIC)，虚拟交换机VSwitch提供了虚拟机之间，以及虚拟机与外部网络之间的通讯能力。每个虚拟机的虚拟网卡对应到VSwitch的一个逻辑端口上，主机的物理网卡对应于VSwitch与外部物理交换机相连的端口。当虚拟机发送或接收的数据包经过VMM时，VMM中的虚拟网络功能模块对经过的数据进行网络功能处理，由于虚拟网络功能模块为软件模块，可以根据需要进行更新，因此，VMM中的虚拟网络功能模块可以为用户提供丰富的网络功能。
物理网卡的网口支持虚拟化能力可以通过单根输入输出虚拟化(Single Root Input/Output Virtualization，SR-IOV)或多根输入输出虚拟化(Multi Root Input/Output Virtualization，MR-IOV)来实现，本发明实施例以SR-IOV技术为例进行说明。SR-IOV技术是一种基于硬件的虚拟化解决方案，可以在虚拟机之间高效共享PCIe(Peripheral Component Interconnect Express，快速外设组件互连)设备，并且由于SR-IOV技术是在硬件中实现的，因此可以能够获得高效的I/O性能。
标准化组织PCI-SIG(Peripheral Component Interconnect Special Interest Group，外围设备互连专业组)定义了SR-IOV规范，SR-IOV规范可参阅http://www.pcisig.com。
通过使用SR-IOV技术，单个I/O资源可由主机上的多个虚拟机共享，这样，每个虚拟机都可访问同一个的硬件资源。因此，启用了SR-IOV的PCIe 设备(例如物理网卡的网口)可以显示为多个单独的设备，显示出的每个单独的设备都具有独立的PCIe配置空间。以支持SR-IOV的物理网卡为例，该物理网卡上包含若干个网口，可以分别针对各个网口启用/禁用SR-IOV能力，启用了SR-IOV能力的网口对应于至少一个物理功能(Physical Function,PF)以及多个虚拟功能(Virtual Function,VF)，根据现有的SR-IOV规范，每个PF最多可有64,000个与其关联的VF。创建VF后，可以直接将VF指定给主机上的虚拟机使用，从而使得多个虚拟机通过与其相连的至少一个VF共享PCIe设备。
如图1B所示，为本发明实施例提供的一种网卡直通场景下主机上的虚拟化结构示意图，与图1A不同的是，物理网卡支持单根IO虚拟化，物理网卡的一个网口对应于至少一个PF以及多个VF，各VF能共享物理网卡的物理资源(例如网卡端口)。
当主机上的虚拟机通过直通VF发送数据包时，虚拟机发出的数据包将会通过虚拟机上安装的VF驱动直接传递给网卡的VF，导致数据包无法经过VMM中的虚拟网络功能模块。由于网卡的交换设备中的MAC表容量有限，处理能力有限，且无法进行自由的功能扩展，因此网卡无法提供丰富的网络功能。在一种可能的场景中，交换设备为virtual ethernet bridge&classifier。
需要说明的是，本发明实施例针对网卡直通的场景，上述网卡直通的实现可以是SR-IOV或者MR-IOV，本发明实施例对此并不进行限定。
如图2所示，为本发明实施提供的另一种主机上的虚拟化架构示意图，该主机包含虚拟机监视器VMM以及至少一个物理网卡，所述主机上运行有至少一个虚拟机。所述至少一个物理网卡包括至少两个网口，第一网口和第二网口。其中，第一网口支持网卡虚拟化能力，第二网口连接到主机外部的物理交换机。第一网口虚拟出至少一个PF以及至少两个VF(图2中以两个VF为例进行说明)，第一虚拟机和第二虚拟机上安装有VF驱动，第一虚拟机和第二虚拟机分别连接到至少一个VF,PF连接到VMM上的虚拟网桥，该虚拟网桥与VMM上的虚拟网络功能模块相连，该虚拟网络功能模块通过第二网口与主机外部的物理交换机相 连。
在一种具体的场景中，VMM上的虚拟网桥可以为openvswitch bridge，将第一网口的PF作为该虚拟网桥的上行链路口。需要说明的是，也可以选择第一网口的一个VF作为虚拟网桥的上行链路口，即第一网口通过选择的VF与VMM上的虚拟网桥相连，此时，需要在VMM上加载VF驱动，同时将与虚拟网桥相连的VF设置为混杂模式，设置为混杂模式的VF类似于PF，可以接收到目的地址不是自身MAC地址的数据包。混杂模式的具体说明可以参阅https://en.wikipedia.org/wiki/Promiscuous_mode。本发明各实施例以第一网口的PF连接虚拟网桥为例进行说明，本领域技术人员可以理解的是，通过上述的设置方式，也可以使用混杂模式(promiscuous mode)的VF连接虚拟网桥。
在一种可能的实施方式中，第一网口和第二网口可以处在同一网卡上，也可以单独位于不同的网卡上，本发明实施例对此并不进行限定。
在本发明各实施例中，网卡虚拟化具体是指网卡硬件虚拟化。
第一虚拟机和第二虚拟机分别连接到第一网口的至少一个VF，第一网口的每个VF设置有不同的虚拟局域网(Virtual Local Area Network，VLAN)标识，由于一个VLAN就是一个广播域，广播报文只能发送到到一个VLAN内的虚拟机。所以，通过为每个VF设置的不同的VLAN标识，使得每个虚拟机处在不同的广播域，虚拟机发出的广播报文只能被虚拟机自身和PF收到。在设置VF的VLAN标识时，需要保证主机范围内VLAN标识唯一即可，不同主机上的VLAN标识可以相同。
需要说明的是，图2所示的实施例中，第一虚拟机向第二虚拟机发送数据包是同一主机内部的两个虚拟机之间的通信。本领域技术人员可以理解的是，第二虚拟机与第一虚拟机也可以位于不同主机上，此时第一虚拟机和第二虚拟机为跨主机通信。图2中仅以两个VF以及两个VLAN子接口为例进行说明，在实际产品实现时，支持网卡虚拟化功能的网卡可以虚拟化为至少一个PF以及多个VF，并不限定为两个VF，相对应的，VLAN子接口的数量也并不限定为两个。
本发明实施例以VM1(第一虚拟机)发送数据包到VM2(第二虚拟机)为例 对数据包的处理流程进行说明，网卡中的交换设备需要将来自VM1的数据包发送到VMM上的虚拟网络功能模块进行处理。在发送数据包之前，第一虚拟机确定待发送的数据包的目的介质访问控制MAC地址为所述VMM中的虚拟网桥上行链路口的MAC地址。第一虚拟机通过与自身相连的所述VF向第二虚拟机发送所述数据包，所述数据包携带的目的IP地址为所述第二虚拟机的IP地址，携带的目的MAC地址为所述虚拟网桥上行链路口的MAC地址。第一网口的交换设备接收第一虚拟机通过VF发出的数据包，根据所述数据包的目的MAC地址对数据包进行二层转发，将所述数据包通过所述虚拟网桥的上行链路口发送到所述虚拟网桥。虚拟网桥接收所述数据包，将所述数据包的目的MAC地址修改为所述第二虚拟机的MAC地址，将修改后的数据包发送给虚拟网络功能模块，通过修改数据包的目的MAC地址，使得数据后续的传输过程可以使用修改后的MAC地址，从而保证数据包可以发送到第二虚拟机。虚拟网络功能模块在接收到修改后的数据包后，对所述修改后的数据包进行网络功能处理，为用户提供丰富的网络功能服务，然后根据所述第二虚拟机的MAC地址，将处理后的数据包发送到第二虚拟机。
本发明实施例中，虚拟机将数据包从与虚拟机相连的VF发出，由第一网口的交换设备进行转发，将数据包发送给VMM上的虚拟网桥，通过该虚拟网桥将数据包传递到虚拟网络功能模块，由虚拟网络功能模块为该数据包提供丰富的网络功能。在网卡直通的场景上，虚拟机将数据包从直通的VF发出后，通过上述方式可以将数据包发送到VMM中的虚拟网络功能模块，利用该软件模块为用户提供丰富的网络功能，实现对数据包进行虚拟网络功能处理。
进一步的，本发明实施例提供了一种地址解析协议(Address Resolution Protocol，ARP)流程，以使得第一虚拟机在发送数据包前可以获得虚拟网桥上行链路口的MAC地址，从而将数据包的目的MAC地址设定为虚拟网桥上行链路口的MAC地址。在本发明实施例提供的ARP流程中，由软件定义网络(Software Defined Network,SDN)控制器对VM1发起的ARP请求进行代答，在ARP响应中携带VMM上的虚拟网桥的上行链路口的MAC地址，通过将该MAC地址与数据 包的目的IP相对应，从而使得将VM1发出的数据包引导到与虚拟网桥相连的PF或者VF。需要说明的是，SDN控制器可以获得云计算网络的网络拓扑，即可实现上述ARP流程。
具体的，如图3所示，为本发明实施例提供的ARP流程示意图。
步骤301：VM1发出ARP请求报文，携带VM2的IP地址，用于获取VM2的MAC地址，该ARP请求报文从与VM1相连的VF发出，网卡上的交换设备接收到该ARP请求报文，该ARP请求报文携带发出所述ARP请求报文的VF的VLAN标识；
步骤302：交换设备广播该ARP请求报文，由于主机上的每个虚拟机连接的VF都具备不同的VLAN标识，该ARP请求报文被通过PF发送给虚拟网桥；
在一种可能的设计中，当虚拟网桥通过VF与网卡相连时，所述ARP请求报文通过AF发送到虚拟网桥。
步骤303：虚拟网桥将该ARP请求报文转发给SDN控制器；
具体的，虚拟网桥可以通过packet-in消息将该ARP请求报文发送给SDN控制器。
步骤304：SDN控制器对虚拟网桥设置流表项，将流表项下发到虚拟网桥；
所述流表项包括：
1)ARP代答设置，该ARP代答设置表示：当虚拟网桥接收到VM1发出的用于获取VM2的MAC地址的ARP报文请求时，构造ARP响应报文，在ARP响应报文中携带虚拟网桥上行链路口的MAC地址作为VM2的MAC地址，该虚拟网桥上行链路口的MAC地址为与虚拟网桥相连的PF或VF的MAC地址；
2)VLAN标识处理设置：对于VM1发出的单播报文，去除单播报文携带的VLAN标识；
3)MAC地址设置：对于VM1发送给VM2的单播报文，将单播报文的目的MAC地址修改为VM2的MAC地址，将修改后的单播报文通过与虚拟网络功能模块相连的端口发送到虚拟网络功能模块。
需要说明的是，上述流表项的设置原理可以基于Openflow协议。
步骤305：虚拟网桥配置流表项，根据ARP代答设置向VM1返回ARP响应报文，该ARP响应报文携带虚拟网桥上行链路口的MAC地址，将该ARP响应报文通过该上行链路口发送给交换设备；
步骤306：交换设备转发该ARP响应报文至VM1；
步骤307：VM1接收该ARP响应报文，将VM2的MAC地址设置为虚拟网桥上行链路口的MAC地址。
本发明实施例定义了上述ARP过程，无需通过自学习MAC转发表的形式实现VM流量的二层转发控制。通过上述ARP流程，使得VM1发出的数据包的目的MAC为虚拟网桥上行链路口的MAC地址，从而保证了数据包通过该上行链路口发送到虚拟网桥，进而由虚拟网桥将该数据包转发到虚拟网络功能模块进行处理。
如图4所示，为本发明实施例提供的VM1向VM2发送数据包的流程示意图。在本发明实施例中，主机1上的VM1向主机2上的VM2发送数据包，主机1的VMM中包含第一虚拟网桥以及第一虚拟网络功能模块，主机1的网卡包含至少两个网口以及第一交换设备，主机2的VMM中包含第二虚拟网桥以及第二虚拟网络功能模块，主机2的网卡包含至少两个网口以及第二交换设备。具体的，主机1和主机2的结构和各组件的功能如图2所示，此处不再赘述。VM1向VM2发送数据包的流程包括：
步骤401：VM1通过与自身相连的VF发送目的为VM2的数据包，数据包的目的IP地址为VM2的IP地址，目的MAC地址为主机1上的第一虚拟网桥上行链路口的MAC地址，所述数据包携带所述VF的VLAN标识；
步骤402：网卡1的第一交换设备接收该数据包，根据数据包的目的MAC地址将数据包通过该上行链路口发送给第一虚拟网桥；
步骤403：第一虚拟网桥根据预先设置的流表项，对该数据包进行处理，去除该数据包的VLAN标识，将数据包的目的MAC地址修改为VM2的MAC地址；
步骤404：第一虚拟网桥将修改后的数据包发送给第一虚拟网络功能模块；
步骤405：第一虚拟网络功能模块对该数据包进行网络功能处理，包括安 全组、QoS、二层隧道封装以及分布式路由等等；
需要说明的是，第一虚拟网络功能模块进行网络功能处理可以采用现有技术中的各种实现方式，本发明实施例对此并不进行限定。
步骤406：第一虚拟网络功能模块将处理后的数据包通过第二网口发送到主机1外部的物理交换机，物理交换机经过网络将数据包路由到VM2所在的主机2；
需要说明的是，数据包中携带有VM2的IP地址和MAC地址，采用现有的路由方式即可将数据包路由到VM2所在的主机2，本发明实施例对数据包在网络中的传输过程并不进行限定，示例性的，VM1所在的主机1和VM2所在的主机2可以建立隧道，隧道的端点分别为主机1和主机2的虚拟网络功能模块，从而在两个主机之间为VM1和VM2建立数据传输所需的隧道。
步骤407：VM2所在主机2的第二虚拟网络功能模块对接收到的数据包进行网络功能处理，将处理后的数据包发送给第二虚拟网桥；
步骤408：第二虚拟网桥根据VM2的MAC地址进行二层转发，通过交换设备将数据包发送给与VM2连接的VF，从而将该数据包发送到第二虚拟机。
对于从主机外部发送到主机上的目的虚拟机的数据包，该数据包首先经过第二网口传递到虚拟网络功能模块，经过虚拟网络功能处理后再经过第一网口传递到数据包的目的虚拟机。
图4所示的实施例为虚拟机间跨主机的通信，可以理解的是，数据包的源虚拟机和目的虚拟机可以位于同一主机上，数据包的传输过程与图4的流程类似，不同之处在于，当数据包的源虚拟机和目的虚拟机位于同一主机上时，主机的虚拟网络功能模块完成网络功能处理后，将处理后的数据包发送给虚拟网桥，由虚拟网桥根据目的虚拟机的MAC地址将处理后的数据包发送给目的虚拟机。
主机、SDN控制器可以采用通用的计算机设备，示例性的，如图5所示，为本发明实施例提供的计算机设备硬件结构示意图。计算机设备500包括至少一个处理器501，通信总线502，存储器503以及至少一个通信接口504。
处理器501可以是一个通用中央处理器(CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本发明方案程序执行的集成电路。
通信总线502可包括一通路，在上述组件之间传送信息。所述通信接口504，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(RAN)，无线局域网(Wireless Local Area Networks，WLAN)等。
存储器503可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。存储器也可以和处理器集成在一起。
其中，所述存储器503用于存储执行本发明方案的应用程序代码，并由处理器501来控制执行。所述处理器501用于执行所述存储器503中存储的应用程序代码。
在具体实现中，作为一种实施例，处理器501可以包括一个或多个CPU，例如图5中的CPU0和CPU1。
在具体实现中，作为一种实施例，计算机设备500可以包括多个处理器，例如图5中的处理器501和处理器508。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令) 的处理核。
在具体实现中，作为一种实施例，计算机设备500还可以包括输出设备505和输入设备506。输出设备505和处理器501通信，可以以多种方式来显示信息。例如，输出设备505可以是液晶显示器(liquid crystal display，LCD),发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备506和处理器501通信，可以以多种方式接受用户的输入。例如，输入设备506可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的计算机设备500可以是一个通用计算机设备或者是一个专用计算机设备。在具体实现中，计算机设备500可以是台式机、便携式电脑、网络服务器、掌上电脑(Personal Digital Assistant，PDA)、移动手机、平板电脑、无线终端设备、通信设备、嵌入式设备或有图5中类似结构的设备。本发明实施例不限定计算机设备500的类型。
SDN控制器和图2中的主机可以为图5所示的设备，存储器中存储了一个或多个软件模块，用于实现主机和SDN控制器的各项功能。主机和SDN控制器可以通过处理器以及存储器中的程序代码来实现本发明实施例公开的报文处理的方法。
需要说明的是，图5所示的计算机设备仅仅是给出了云计算系统中各部分的可能的硬件实现方式，根据系统各部分功能的不同或者变化，可以对计算机设备的硬件组件进行增删，以使得与系统各部分的功能进行匹配。
进一步的，与图5所示的硬件装置类似，上述实施例中的网卡中包含处理器以及存储器，网卡中的处理器执行存储器中的指令以实现上述交换设备的功能。本发明实施例不再赘述。
更进一步的，如图6所示，为本发明实施例提供的一种云计算系统结构示意图，所述云计算系统包括至少一个主机601以及SDN控制器602，所述主机 中包含至少一个网卡，所述主机的结构如图2所示。
所述主机601包括虚拟机监视器VMM，以及至少一个网卡，所述主机601上运行有第一虚拟机，所述VMM包含虚拟网桥以及虚拟网络功能模块，所述网卡包含交换设备以及至少两个网口，其中，第一网口支持单根输入输出虚拟化，所述第一网口对应于至少一个PF和多个VF，所述第一虚拟机连接到所述第一网口的至少一个VF，
所述SDN控制器602，用于接收所述虚拟网桥转发的来自所述第一虚拟机的ARP请求报文，向所述虚拟网桥返回流表项，所述流表项包括ARP代答设置和MAC地址设置，所述ARP代答设置用于指示所述虚拟网桥为所述第一虚拟机构造ARP响应报文，所述ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为待发送的数据包的目的MAC地址；
所述第一虚拟机，用于通过与自身相连的所述VF向第二虚拟机发送所述数据包，所述数据包携带的目的IP地址为所述第二虚拟机的IP地址，携带的目的MAC地址为所述虚拟网桥上行链路口的MAC地址；
所述交换设备，用于接收所述数据包，根据所述数据包的目的MAC地址，将所述数据包通过所述虚拟网桥的上行链路口发送到所述虚拟网桥；
所述虚拟网桥，用于接收所述数据包，将所述数据包的目的MAC地址修改为所述第二虚拟机的MAC地址，将修改后的数据包发送给虚拟网络功能模块；
所述虚拟网络功能模块，用于对所述修改后的数据包进行网络功能处理后，根据所述第二虚拟机的MAC地址，将处理后的数据包发送到第二虚拟机。
其中，所述第一网口的多个VF具有不同的虚拟局域网VLAN标识。
所述第一虚拟机，还用于通过所述与自身相连的所述VF发出所述ARP请求报文，所述ARP请求报文携带发出ARP请求报文的所述VF的VLAN标识；
所述交换设备，还用于广播所述ARP请求报文，所述ARP请求报文通过所述上行链路口发送到所述虚拟网桥；
所述虚拟网桥，还用于向所述SDN控制器转发所述ARP请求报文，接收所述SDN控制器返回的所述流表项，向所述第一虚拟机返回ARP响应报文，ARP 响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址。
所述流表项还包括MAC地址设置，所述MAC地址设置用于指示所述虚拟网桥在接收到第一虚拟机发送给第二虚拟机的单播报文时，将单播报文的目的MAC地址修改为第二虚拟机的MAC地址。
进一步的流表项中还包括输出设置，所述输出设置用于指示将修改后的数据包通过与所述虚拟网络功能模块相连的端口发出。
所述虚拟网桥上行链路口为所述第一网口的PF，所述虚拟网桥通过所述PF与所述网卡相连；或者，所述虚拟网桥上行链路口为所述第一网口的选定的VF，所述虚拟网桥通过所述选定的VF与所述网卡相连，其中，与所述虚拟网桥相连的所述选定的VF被设置为混杂模式。
当所述第二虚拟机与所述第一虚拟机运行在同一主机上时，所述虚拟网桥，还用于接收处理后的数据包，根据所述数据包的目的MAC地址将所述处理后的数据包通过所述交换设备发送给所述第二虚拟机。
当所述第二虚拟机与所述第一虚拟机运行在不同主机上时，在第一虚拟机和第二虚拟机所在的两个主机的虚拟网络功能模块之间建立隧道，通过隧道将处理后的数据包从第二网口发出，传输到第二虚拟机所在的主机的虚拟网络功能模块。在第二虚拟机所在的虚拟网络功能模块对数据包完成网络功能处理后，将数据包通过第二虚拟机所在的主机的虚拟网桥发送到第二虚拟机。
本发明实施例还提供了一种计算机存储介质，用于储存为上述图2-6中的设备所用的计算机软件指令，其包含用于执行上述方法实施例所设计的程序。通过执行存储的程序，可以实现云计算系统中报文处理的方法。
综上所述，本发明实施例提供的云计算系统中报文处理的方法，主机和系统，可以将使用直通VF的虚拟机发出的报文引导到VMM上的虚拟网桥，进而由VMM上的虚拟网络功能模块对数据包进行网络功能处理，从而为用户提供丰富的网络功能。
尽管在此结合各实施例对本发明进行了描述，然而，在实施所要求保护的 本发明实施例过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
本领域技术人员应明白，本发明的实施例可提供为方法、装置(设备)、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。计算机程序存储/分布在合适的介质中，与其它硬件一起提供或作为硬件的一部分，也可以采用其他分布形式，如通过Internet或其它有线或无线电信系统。
本发明实施例涉及到的计算机程序指令可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，通过执行计算机程序指令可以实现前述各实施例中各部件的功能
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管结合具体特征及其实施例对本发明进行了描述，显而易见的，在不脱离本发明的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本发明的示例性说明，且视为已覆盖本发明范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (24)

  1. 一种主机，其特征在于，所述主机包括虚拟机监视器VMM，以及至少一个网卡，所述主机上运行有第一虚拟机，所述VMM包含虚拟网桥以及虚拟网络功能模块，所述至少一个网卡包含交换设备以及至少两个网口，其中，第一网口支持网卡虚拟化能力，所述第一网口对应于至少一个物理功能PF和多个虚拟功能VF，所述第一虚拟机连接到所述第一网口的至少一个VF，
    所述第一虚拟机，用于确定待发送的数据包的目的介质访问控制MAC地址，所述待发送的数据包的MAC地址为所述虚拟网桥上行链路口的MAC地址；
    所述第一虚拟机，还用于通过与自身相连的所述VF向第二虚拟机发送所述数据包，所述数据包携带的目的IP地址为所述第二虚拟机的IP地址，携带的目的MAC地址为所述虚拟网桥上行链路口的MAC地址；
    所述交换设备，用于接收所述数据包，根据所述数据包的目的MAC地址，将所述数据包通过所述虚拟网桥的上行链路口发送到所述虚拟网桥；
    所述虚拟网桥，用于接收所述数据包，将所述数据包的目的MAC地址修改为所述第二虚拟机的MAC地址，将修改后的数据包发送给虚拟网络功能模块；
    所述虚拟网络功能模块，用于对所述修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的MAC地址为所述第二虚拟机的MAC地址。
  2. 如权利要求1所述的主机，其特征在于，所述第一网口的多个VF具有不同的虚拟局域网VLAN标识。
  3. 如权利要求2所述的主机，其特征在于，
    所述第一虚拟机，还用于通过所述与自身相连的所述VF发出地址解析协议ARP请求报文，所述ARP请求报文携带发出ARP请求报文的所述VF的VLAN标识；
    所述交换设备，还用于广播所述ARP请求报文，所述ARP请求报文通过所述上行链路口发送到所述虚拟网桥；
    所述虚拟网桥，还用于向软件定义网络SDN控制器转发所述ARP请求报文， 接收所述SDN控制器返回的流表项，所述流表项包括ARP代答设置，所述ARP代答设置用于指示所述虚拟网桥针对所述ARP请求报文构造ARP响应报文，所述ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址；
    所述虚拟网桥，还用于向所述第一虚拟机返回ARP响应报文，ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址。
  4. 如权利要求3所述的主机，其特征在于，所述流表项还包括MAC地址设置，所述MAC地址设置用于指示所述虚拟网桥在接收到第一虚拟机发送给第二虚拟机的所述数据包时，将所述数据包的目的MAC地址修改为第二虚拟机的MAC地址。
  5. 如权利要求1-4任一所述的主机，其特征在于，
    所述虚拟网桥上行链路口为所述第一网口的PF，所述虚拟网桥通过所述PF与所述网卡相连；或者，
    所述虚拟网桥上行链路口为所述第一网口的选定的VF，所述虚拟网桥通过所述选定的VF与所述网卡相连，其中，与所述虚拟网桥相连的所述选定的VF被设置为混杂模式。
  6. 如权利要求1-4任一所述的主机，其特征在于，所述第二虚拟机与所述第一虚拟机运行在同一主机上，
    所述虚拟网桥，还用于接收处理后的数据包，根据所述数据包的目的MAC地址将所述处理后的数据包通过所述交换设备发送给所述第二虚拟机。
  7. 如权利要求1-4任一所述的主机，其特征在于，所述第二虚拟机与所述第一虚拟机运行在不同主机上，
    所述虚拟网络功能模块，具体用于建立与所述第二虚拟机所在的主机上的另一虚拟网络功能模块之间的隧道，将所述处理后的数据包发送到所述网卡的第二网口，通过所述隧道将所述处理后的数据包发送到所述第二虚拟机所在的主机，以使得所述另一虚拟网络功能模块将所述处理后的数据包发送到所述第 二虚拟机。
  8. 一种云计算系统中报文处理的方法，其特征在于，所述云计算系统中的至少一个主机包括虚拟机监视器VMM，以及至少一个网卡，所述主机上运行有第一虚拟机，所述VMM包含虚拟网桥以及虚拟网络功能模块，所述网卡包含交换设备以及至少两个网口，其中，第一网口支持网卡虚拟化能力，所述第一网口对应于至少至少一个PF和多个VF，所述第一虚拟机连接到所述第一网口的至少一个VF，所述方法包括：
    所述第一虚拟机确定待发送的数据包的目的MAC地址，所述待发送的数据包的MAC地址为所述虚拟网桥上行链路口的MAC地址；
    所述第一虚拟机通过与自身相连的所述VF向第二虚拟机发送所述数据包，所述数据包携带的目的IP地址为所述第二虚拟机的IP地址，携带的目的MAC地址为所述虚拟网桥上行链路口的MAC地址；
    所述交换设备接收所述数据包，根据所述数据包的目的MAC地址，将所述数据包通过所述虚拟网桥的上行链路口发送到所述虚拟网桥；
    所述虚拟网桥接收所述数据包，将所述数据包的目的MAC地址修改为所述第二虚拟机的MAC地址，将修改后的数据包发送给虚拟网络功能模块；
    所述虚拟网络功能模块对所述修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的MAC地址为所述第二虚拟机的MAC地址。
  9. 如权利要求8所述的方法，其特征在于，所述第一网口的多个VF具有不同的虚拟局域网VLAN标识。
  10. 如权利要求9所述的方法，其特征在于，所述第一虚拟机确定待发送的数据包的目的MAC地址包括：
    所述第一虚拟机通过所述与自身相连的所述VF发出ARP请求报文，所述ARP请求报文携带发出ARP请求报文的所述VF的VLAN标识；
    所述交换设备广播所述ARP请求报文，所述ARP请求报文通过所述上行链路口发送到所述虚拟网桥；
    所述虚拟网桥向SDN控制器转发所述ARP请求报文，接收所述SDN控制器返回的流表项，所述流表项包括ARP代答设置，所述ARP代答设置用于指示所述虚拟网桥针对所述ARP请求报文构造ARP响应报文，所述ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址；
    所述虚拟网桥，还用于向所述第一虚拟机返回ARP响应报文，ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址。
  11. 如权利要求10所述的方法，其特征在于，所述流表项还包括MAC地址设置所述MAC地址设置用于指示所述虚拟网桥在接收到第一虚拟机发送给第二虚拟机的所述数据包时，将所述数据包的目的MAC地址修改为第二虚拟机的MAC地址。
  12. 如权利要求8-11任一所述的方法，其特征在于，
    所述虚拟网桥上行链路口为所述第一网口的PF，所述虚拟网桥通过所述PF与所述网卡相连；或者，
    所述虚拟网桥上行链路口为所述第一网口的选定的VF，所述虚拟网桥通过所述选定的VF与所述网卡相连，其中，与所述虚拟网桥相连的所述选定的VF被设置为混杂模式。
  13. 如权利要求8-11任一所述的方法，其特征在于，所述第二虚拟机与所述第一虚拟机运行在同一主机上，所述方法还包括：
    所述虚拟网桥接收处理后的数据包，根据所述数据包的目的MAC地址将所述处理后的数据包通过所述交换设备发送给所述第二虚拟机。
  14. 如权利要求8-11任一所述的方法，其特征在于，所述第二虚拟机与所述第一虚拟机运行在不同主机上，所述方法还包括：
    所述虚拟网络功能模块建立与所述第二虚拟机所在的主机上的另一虚拟网络功能模块之间的隧道，将所述处理后的数据包发送到所述网卡的第二网口，通过所述隧道将所述处理后的数据包发送到所述第二虚拟机所在的主机，以使得所述另一虚拟网络功能模块将所述处理后的数据包发送到所述第二虚拟机。
  15. 一种云计算系统，其特征在于，包括软件定义网络SDN控制器，以及至少一个主机，所述主机包括虚拟机监视器VMM，以及至少一个网卡，所述主机上运行有第一虚拟机，所述VMM包含虚拟网桥以及虚拟网络功能模块，所述网卡包含交换设备以及至少两个网口，其中，第一网口支持网卡虚拟化能力，所述第一网口对应于至少一个PF和多个VF，所述第一虚拟机连接到所述第一网口的至少一个VF，
    所述SDN控制器，用于接收所述虚拟网桥转发的来自所述第一虚拟机的ARP请求报文，向所述虚拟网桥返回流表项，所述流表项包括ARP代答设置和MAC地址设置，所述ARP代答设置用于指示所述虚拟网桥为所述第一虚拟机构造ARP响应报文，所述ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为待发送的数据包的目的MAC地址；
    所述第一虚拟机，用于通过与自身相连的所述VF向第二虚拟机发送所述数据包，所述数据包携带的目的IP地址为所述第二虚拟机的IP地址，携带的目的MAC地址为所述虚拟网桥上行链路口的MAC地址；
    所述交换设备，用于接收所述数据包，根据所述数据包的目的MAC地址，将所述数据包通过所述虚拟网桥的上行链路口发送到所述虚拟网桥；
    所述虚拟网桥，用于接收所述数据包，将所述数据包的目的MAC地址修改为所述第二虚拟机的MAC地址，将修改后的数据包发送给虚拟网络功能模块；
    所述虚拟网络功能模块，用于对所述修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的MAC地址为所述第二虚拟机的MAC地址。
  16. 如权利要求15所述的系统，其特征在于，所述第一网口的多个VF具有不同的虚拟局域网VLAN标识。
  17. 如权利要求16所述的系统，其特征在于，
    所述第一虚拟机，还用于通过所述与自身相连的所述VF发出所述ARP请求报文，所述ARP请求报文携带发出ARP请求报文的所述VF的VLAN标识；
    所述交换设备，还用于广播所述ARP请求报文，所述ARP请求报文通过所 述上行链路口发送到所述虚拟网桥；
    所述虚拟网桥，还用于向所述SDN控制器转发所述ARP请求报文，接收所述SDN控制器返回的所述流表项，所述流表项包括ARP代答设置，所述ARP代答设置用于指示所述虚拟网桥针对所述ARP请求报文构造ARP响应报文，所述ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址；
    所述虚拟网桥，还用于向所述第一虚拟机返回ARP响应报文，ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址。
  18. 如权利要求17所述的系统，其特征在于，所述流表项还包括MAC地址设置，所述MAC地址设置用于指示所述虚拟网桥在接收到第一虚拟机发送给第二虚拟机的所述数据包时，将所述数据包的目的MAC地址修改为第二虚拟机的MAC地址。
  19. 如权利要求15-18任一所述的系统，其特征在于，
    所述虚拟网桥上行链路口为所述第一网口的PF，所述虚拟网桥通过所述PF与所述网卡相连；或者，
    所述虚拟网桥上行链路口为所述第一网口的选定的VF，所述虚拟网桥通过所述选定的VF与所述网卡相连，其中，与所述虚拟网桥相连的所述选定的VF被设置为混杂模式。
  20. 如权利要求15-18任一所述的系统，其特征在于，所述第二虚拟机与所述第一虚拟机运行在同一主机上，
    所述虚拟网桥，还用于接收处理后的数据包，根据所述数据包的目的MAC地址将所述处理后的数据包通过所述交换设备发送给所述第二虚拟机。
  21. 如权利要求15-18任一所述的系统，其特征在于，所述第二虚拟机与所述第一虚拟机运行在不同主机上，
    所述虚拟网络功能模块，具体用于建立与所述第二虚拟机所在的主机上的另一虚拟网络功能模块之间的隧道，将所述处理后的数据包发送到所述网卡的 第二网口，通过所述隧道将所述处理后的数据包发送到所述第二虚拟机所在的主机，以使得所述另一虚拟网络功能模块将所述处理后的数据包发送到所述第二虚拟机。
  22. 一种主机，其特征在于，包括第一处理器、第一存储器以及至少一个网卡，所述网卡包含第二处理器、第二存储器以及至少两个网口，其中，第一网口支持网卡虚拟化能力，所述第一网口对应于至少一个PF和多个VF，所述第一存储器和所述第二存储器中存储有指令，所述第一处理器执行所述第一存储器中的第一指令以实现第一虚拟机的功能，所述第一虚拟机连接到所述第一网口的至少一个VF，所述第一处理器执行所述第一存储器中的第二指令以实现虚拟网桥的功能，所述第一处理器执行所述第一存储器中的第三指令以实现虚拟网络功能模块的功能，所述第二处理器用于执行所述第二存储器中的指令以实现交换设备的功能，
    所述第一处理器用于执行所述第一存储器中的第一指令以执行步骤：确定待发送的数据包的目的MAC地址，所述待发送的数据包的MAC地址为所述虚拟网桥上行链路口的MAC地址，通过与所述第一虚拟机相连的VF向第二虚拟机发送所述数据包，所述数据包携带的目的IP地址为所述第二虚拟机的IP地址，携带的目的MAC地址为所述虚拟网桥上行链路口的MAC地址；
    所述第二处理器用于执行所述第二存储器中的指令以执行步骤：接收所述数据包，根据所述数据包的目的MAC地址，将所述数据包通过所述虚拟网桥的上行链路口发送到所述虚拟网桥；
    所述第一处理器还用于执行所述第一存储器中的第二指令以执行步骤：接收所述数据包，将所述数据包的目的MAC地址修改为所述第二虚拟机的MAC地址；
    所述第一处理器还用于执行所述第一存储器中的第三指令以执行步骤：对修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的MAC地址为所述第二虚拟机的MAC地址。
  23. 如权利要求22所述的主机，其特征在于，述第一网口的多个VF具有不 同的虚拟局域网VLAN标识，
    所述第一处理器还用于执行所述第一存储器中的所述第一指令以执行步骤：通过与所述第一虚拟机相连的所述VF发出ARP请求报文，所述ARP请求报文携带发出ARP请求报文的所述VF的VLAN标识；
    所述第二处理器用于执行所述第二存储器中的指令以执行步骤：广播所述ARP请求报文，所述ARP请求报文通过所述上行链路口发送到所述虚拟网桥；
    所述第一处理器还用于执行所述第一存储器中的第二指令以执行步骤：向SDN控制器转发所述ARP请求报文，接收所述SDN控制器返回的流表项，所述流表项包括ARP代答设置，所述ARP代答设置用于指示所述虚拟网桥针对所述ARP请求报文构造ARP响应报文，所述ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址；向所述第一虚拟机返回ARP响应报文，ARP响应报文携带所述虚拟网桥上行链路口的MAC地址作为所述待发送的数据包的目的MAC地址。
  24. 如权利要求22所述的主机，其特征在于，所述流表项还包括MAC地址设置所述MAC地址设置用于指示所述虚拟网桥在接收到第一虚拟机发送给第二虚拟机的所述数据包时，将所述数据包的目的MAC地址修改为第二虚拟机的MAC地址。
PCT/CN2016/105228 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统 WO2018086014A1 (zh)

Priority Applications (10)

Application Number Priority Date Filing Date Title
BR112018000116-3A BR112018000116A2 (pt) 2016-11-09 2016-11-09 método de processamento de pacote em sistema de computação em nuvem, hospedeiro e sistema
AU2016414390A AU2016414390B2 (en) 2016-11-09 2016-11-09 Packet processing method in cloud computing system, host, and system
EP16909060.2A EP3525423B1 (en) 2016-11-09 2016-11-09 Packet processing method in cloud computing system, host, and system
PCT/CN2016/105228 WO2018086014A1 (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统
CA2991359A CA2991359C (en) 2016-11-09 2016-11-09 Packet processing method in cloud computing system, host, and system
CN202010929666.0A CN112217746A (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统
CN201680009028.9A CN107278359B (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统
SG11201800020UA SG11201800020UA (en) 2016-11-09 2016-11-09 Packet processing method in cloud computing system, host, and system
JP2018510708A JP6605713B2 (ja) 2016-11-09 2016-11-09 クラウドコンピューティングシステムにおけるパケット処理方法、ホスト及びシステム
US16/253,930 US11005755B2 (en) 2016-11-09 2019-01-22 Packet processing method in cloud computing system, host, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/105228 WO2018086014A1 (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/253,930 Continuation US11005755B2 (en) 2016-11-09 2019-01-22 Packet processing method in cloud computing system, host, and system

Publications (1)

Publication Number Publication Date
WO2018086014A1 true WO2018086014A1 (zh) 2018-05-17

Family

ID=60052234

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/105228 WO2018086014A1 (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统

Country Status (9)

Country Link
US (1) US11005755B2 (zh)
EP (1) EP3525423B1 (zh)
JP (1) JP6605713B2 (zh)
CN (2) CN112217746A (zh)
AU (1) AU2016414390B2 (zh)
BR (1) BR112018000116A2 (zh)
CA (1) CA2991359C (zh)
SG (1) SG11201800020UA (zh)
WO (1) WO2018086014A1 (zh)

Families Citing this family (51)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107278362B (zh) 2016-11-09 2019-04-05 华为技术有限公司 云计算系统中报文处理的方法、主机和系统
BR112018000116A2 (pt) 2016-11-09 2018-09-04 Huawei Technologies Co., Ltd. método de processamento de pacote em sistema de computação em nuvem, hospedeiro e sistema
CN107643938A (zh) * 2017-08-24 2018-01-30 中国科学院计算机网络信息中心 数据传输方法、装置及存储介质
CN110519147A (zh) * 2018-05-22 2019-11-29 中兴通讯股份有限公司 数据帧传输方法、装置、设备和计算机可读存储介质
CN110636036A (zh) * 2018-06-22 2019-12-31 复旦大学 一种基于SDN的OpenStack云主机网络访问控制的方法
US11822946B2 (en) * 2018-06-28 2023-11-21 Cable Television Laboratories, Inc. Systems and methods for secure network management of virtual network functions
US11563677B1 (en) * 2018-06-28 2023-01-24 Cable Television Laboratories, Inc. Systems and methods for secure network management of virtual network function
CN108965169B (zh) * 2018-07-12 2020-09-25 联想(北京)有限公司 一种报文传输方法、网卡控制器、网卡及电子设备
CN108833305B (zh) * 2018-07-17 2024-04-05 北京西普阳光科技股份有限公司 主机的虚拟网络装置
US11108687B1 (en) * 2018-09-12 2021-08-31 Amazon Technologies, Inc. Scalable network function virtualization service
US10834044B2 (en) 2018-09-19 2020-11-10 Amazon Technologies, Inc. Domain name system operations implemented using scalable virtual traffic hub
CN109525515B (zh) * 2018-10-23 2021-04-30 郑州云海信息技术有限公司 一种云平台中网卡的管理方法和装置
CN111147369B (zh) * 2018-11-05 2022-02-08 中国电信股份有限公司 路由系统、路由方法和服务器
CN109587063B (zh) * 2018-12-29 2021-08-31 奇安信科技集团股份有限公司 一种数据的引流方法及装置
CN111698141B (zh) * 2019-03-13 2022-12-02 中兴通讯股份有限公司 报文的转发方法及装置
CN110149231B (zh) * 2019-05-21 2022-05-31 优刻得科技股份有限公司 更新虚拟交换机的方法、装置、存储介质和设备
CN110688237B (zh) 2019-06-25 2024-02-09 华为技术有限公司 转发报文的方法、中间设备和计算机设备
CN110677344A (zh) * 2019-09-27 2020-01-10 亚信科技（成都）有限公司 一种数据处理方法及服务器
CN112714073B (zh) * 2019-10-24 2024-04-30 中兴通讯股份有限公司 基于sr-iov网卡的报文分流方法、系统及存储介质
CN110912836B (zh) * 2019-11-14 2023-05-30 优刻得科技股份有限公司 使转发设备转发数据的方法、控制设备、存储介质和系统
CN111092876B (zh) * 2019-12-12 2021-10-01 北京首都在线科技股份有限公司 多主机系统、电子设备、存储介质、用于多主机系统的信息处理方法及装置
CN111211982B (zh) * 2019-12-30 2022-05-17 视联动力信息技术股份有限公司 数据转发方法及装置、电子设备、存储介质
CN113132200B (zh) * 2019-12-30 2024-01-19 中兴通讯股份有限公司 数据转发方法、转发器、系统、服务器和存储介质
US11153261B2 (en) 2020-01-22 2021-10-19 Cisco Technology, Inc. Routing traffic for virtualized/containerized network functions
CN111510365B (zh) * 2020-03-31 2021-12-17 杭州博联智能科技股份有限公司 基于Wi-Fi数据包的设备桥接云端方法、装置、设备及介质
US11677583B2 (en) * 2020-04-06 2023-06-13 Cisco Technology, Inc. Dynamic cellular connectivity between the hypervisors and virtual machines
US11689455B2 (en) 2020-05-28 2023-06-27 Oracle International Corporation Loop prevention in virtual layer 2 networks
US11962518B2 (en) 2020-06-02 2024-04-16 VMware LLC Hardware acceleration techniques using flow selection
US20230262149A1 (en) 2020-06-26 2023-08-17 Nippon Telegraph And Telephone Corporation Data node, data node management method, and data node management program
JP2023535152A (ja) * 2020-07-14 2023-08-16 オラクル・インターナショナル・コーポレイション 仮想レイヤ２ネットワーク
US11736566B2 (en) * 2020-09-28 2023-08-22 Vmware, Inc. Using a NIC as a network accelerator to allow VM access to an external storage via a PF module, bus, and VF module
US11792134B2 (en) 2020-09-28 2023-10-17 Vmware, Inc. Configuring PNIC to perform flow processing offload using virtual port identifiers
US11829793B2 (en) 2020-09-28 2023-11-28 Vmware, Inc. Unified management of virtual machines and bare metal computers
US11593278B2 (en) 2020-09-28 2023-02-28 Vmware, Inc. Using machine executing on a NIC to access a third party storage not supported by a NIC or host
US11636053B2 (en) 2020-09-28 2023-04-25 Vmware, Inc. Emulating a local storage by accessing an external storage through a shared port of a NIC
CN116866283A (zh) * 2020-10-31 2023-10-10 华为技术有限公司 一种流表处理方法及相关设备
CN112565113A (zh) * 2020-12-23 2021-03-26 科东(广州)软件科技有限公司 多虚拟机间的网卡共享系统、方法、装置、设备及介质
CN112631726B (zh) * 2020-12-25 2022-05-24 苏州浪潮智能科技有限公司 一种虚拟机数据处理方法、系统、设备以及介质
US11757773B2 (en) 2020-12-30 2023-09-12 Oracle International Corporation Layer-2 networking storm control in a virtualized cloud environment
US11671355B2 (en) 2021-02-05 2023-06-06 Oracle International Corporation Packet flow control in a header of a packet
US11777897B2 (en) 2021-02-13 2023-10-03 Oracle International Corporation Cloud infrastructure resources for connecting a service provider private network to a customer private network
DE102021113670A1 (de) * 2021-05-27 2022-12-01 Dspace Gmbh Verfahren zur Datenübertragung in einem Netzwerksystem sowie Netzwerksystem
CN113630265B (zh) * 2021-06-30 2023-04-07 济南浪潮数据技术有限公司 一种基于智能网卡的虚拟网络冗余备份方法及装置
CN113965521B (zh) * 2021-10-19 2024-03-01 京东科技信息技术有限公司 数据包的传输方法、服务器及存储介质
US11863376B2 (en) 2021-12-22 2024-01-02 Vmware, Inc. Smart NIC leader election
CN114844745B (zh) * 2022-03-29 2024-03-15 西安广和通无线软件有限公司 数据转发装置、方法、电子设备及存储介质
US11899594B2 (en) 2022-06-21 2024-02-13 VMware LLC Maintenance of data message classification cache on smart NIC
US11928367B2 (en) 2022-06-21 2024-03-12 VMware LLC Logical memory addressing for network devices
US11928062B2 (en) 2022-06-21 2024-03-12 VMware LLC Accelerating data message classification with smart NICs
CN115150327A (zh) * 2022-06-29 2022-10-04 济南浪潮数据技术有限公司 一种接口设置方法、装置、设备及介质
CN115834296B (zh) * 2023-02-16 2023-04-18 北京融为科技有限公司 一种数据传输方法、装置、电子设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101309180A (zh) * 2008-06-21 2008-11-19 华中科技大学 一种适用于虚拟机环境的安全网络入侵检测系统
CN102457586A (zh) * 2010-10-18 2012-05-16 中兴通讯股份有限公司 一种实现二层网络的扩展方法及扩展的二层网络
US20130031233A1 (en) * 2011-07-29 2013-01-31 International Business Machines Corporation Network filtering in a virtualized environment
CN103346981A (zh) * 2013-06-28 2013-10-09 华为技术有限公司 虚拟交换方法、相关装置和计算机系统

Family Cites Families (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2458154B (en) * 2008-03-07 2012-06-27 Hewlett Packard Development Co Routing across a virtual network
GB2459433B (en) * 2008-03-07 2012-06-06 Hewlett Packard Development Co Distributed network connection policy management
US8442048B2 (en) 2009-11-04 2013-05-14 Juniper Networks, Inc. Methods and apparatus for configuring a virtual network switch
US8533285B2 (en) 2010-12-01 2013-09-10 Cisco Technology, Inc. Directing data flows in data centers with clustering services
US8462780B2 (en) * 2011-03-30 2013-06-11 Amazon Technologies, Inc. Offload device-based stateless packet processing
US8867403B2 (en) * 2011-08-18 2014-10-21 International Business Machines Corporation Virtual network overlays
KR20130050156A (ko) * 2011-11-07 2013-05-15 한국전자통신연구원 가상 주소 공간 전환 장치
US9928107B1 (en) * 2012-03-30 2018-03-27 Amazon Technologies, Inc. Fast IP migration in a hybrid network environment
US8964735B2 (en) * 2012-05-18 2015-02-24 Rackspace Us, Inc. Translating media access control (MAC) addresses in a network hierarchy
US9059868B2 (en) 2012-06-28 2015-06-16 Dell Products, Lp System and method for associating VLANs with virtual switch ports
CN102790777B (zh) 2012-08-07 2016-06-15 华为技术有限公司 网络接口适配器注册方法及驱动设备、服务器
JPWO2014065315A1 (ja) 2012-10-24 2016-09-08 日本電気株式会社 通信システム、仮想マシンサーバ、仮想ネットワーク管理装置、ネットワーク制御方法及びプログラム
US10341263B2 (en) 2012-12-10 2019-07-02 University Of Central Florida Research Foundation, Inc. System and method for routing network frames between virtual machines
CN103051529B (zh) 2012-12-20 2016-03-30 华为技术有限公司 一种报文的处理方法和装置
JP6024474B2 (ja) 2013-01-23 2016-11-16 富士通株式会社 マルチテナントシステム、管理装置、管理プログラム、およびマルチテナントシステムの制御方法
WO2014115157A1 (en) * 2013-01-24 2014-07-31 Hewlett-Packard Development Comany, L.P. Address resolution in software-defined networks
US9432287B2 (en) * 2013-03-12 2016-08-30 International Business Machines Corporation Virtual gateways and implicit routing in distributed overlay virtual environments
WO2014161133A1 (zh) 2013-04-01 2014-10-09 华为技术有限公司 虚拟机的数据交换方法、装置和系统
WO2014201623A1 (zh) * 2013-06-18 2014-12-24 华为技术有限公司 用于数据传输的方法、装置和系统以及物理网卡
KR101644678B1 (ko) 2013-06-28 2016-08-01 주식회사 케이티 네크워크 입출력 가상화 환경에서 가상 머신의 이동성 지원 방법 및 이를 수행하는 장치
US9577845B2 (en) * 2013-09-04 2017-02-21 Nicira, Inc. Multiple active L3 gateways for logical networks
US9634948B2 (en) * 2013-11-07 2017-04-25 International Business Machines Corporation Management of addresses in virtual machines
CN103916314A (zh) * 2013-12-26 2014-07-09 杭州华为数字技术有限公司 报文转发控制方法和相关装置及物理主机
WO2015100656A1 (zh) * 2013-12-31 2015-07-09 华为技术有限公司 一种实现虚拟机通信的方法和装置
EP2911347B1 (en) * 2014-02-24 2019-02-13 Hewlett-Packard Enterprise Development LP Providing policy information
CN103873374B (zh) * 2014-03-27 2017-08-11 新华三技术有限公司 虚拟化系统中的报文处理方法及装置
CN105812340B (zh) * 2014-12-31 2019-01-08 新华三技术有限公司 一种虚拟网络访问外网的方法和装置
CN104506408B (zh) * 2014-12-31 2018-02-06 新华三技术有限公司 基于sdn的数据传输的方法及装置
US10812632B2 (en) * 2015-02-09 2020-10-20 Avago Technologies International Sales Pte. Limited Network interface controller with integrated network flow processing
CN105978828B (zh) 2016-05-16 2019-07-23 锐捷网络股份有限公司 一种实现虚拟机报文转发的方法和交换机
BR112018000116A2 (pt) 2016-11-09 2018-09-04 Huawei Technologies Co., Ltd. método de processamento de pacote em sistema de computação em nuvem, hospedeiro e sistema
CN107278362B (zh) 2016-11-09 2019-04-05 华为技术有限公司 云计算系统中报文处理的方法、主机和系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101309180A (zh) * 2008-06-21 2008-11-19 华中科技大学 一种适用于虚拟机环境的安全网络入侵检测系统
CN102457586A (zh) * 2010-10-18 2012-05-16 中兴通讯股份有限公司 一种实现二层网络的扩展方法及扩展的二层网络
US20130031233A1 (en) * 2011-07-29 2013-01-31 International Business Machines Corporation Network filtering in a virtualized environment
CN103346981A (zh) * 2013-06-28 2013-10-09 华为技术有限公司 虚拟交换方法、相关装置和计算机系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3525423A4 *

Also Published As

Publication number Publication date
EP3525423A1 (en) 2019-08-14
CN107278359A (zh) 2017-10-20
CN112217746A (zh) 2021-01-12
BR112018000116A2 (pt) 2018-09-04
AU2016414390B2 (en) 2019-06-20
CA2991359C (en) 2021-12-07
EP3525423B1 (en) 2021-04-07
US11005755B2 (en) 2021-05-11
JP6605713B2 (ja) 2019-11-13
US20190158396A1 (en) 2019-05-23
CN107278359B (zh) 2020-09-18
SG11201800020UA (en) 2018-06-28
AU2016414390A1 (en) 2018-05-24
EP3525423A4 (en) 2019-08-14
JP2019503599A (ja) 2019-02-07
CA2991359A1 (en) 2018-05-17

Similar Documents

Publication Publication Date Title
WO2018086014A1 (zh) 云计算系统中报文处理的方法、主机和系统
WO2018086013A1 (zh) 云计算系统中报文处理的方法、主机和系统
EP4004722B1 (en) Computer device including nested network interface controller switches
US11190375B2 (en) Data packet processing method, host, and system
US9413554B2 (en) Virtual network overlays
US9031081B2 (en) Method and system for switching in a virtualized platform
US20100287262A1 (en) Method and system for guaranteed end-to-end data flows in a local networking domain
US8792502B2 (en) Duplicate MAC address detection
EP4004721B1 (en) Computer device including process isolated containers with assigned virtual functions
US20230308398A1 (en) Latency-aware load balancer for topology-shifting software defined networks

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 11201800020U

Country of ref document: SG

WWE Wipo information: entry into national phase

Ref document number: 2991359

Country of ref document: CA

WWE Wipo information: entry into national phase

Ref document number: 2018510708

Country of ref document: JP

ENP Entry into the national phase

Ref document number: 2016414390

Country of ref document: AU

Date of ref document: 20161109

Kind code of ref document: A

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112018000116

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 112018000116

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20180103

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16909060

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2016909060

Country of ref document: EP

Effective date: 20180123