Selecting a routing table based on alternative route indicators

Abstract

In some examples, a computer device contains a virtual processing unit (VPU) and a virtual network interface between the VPU and a network outside the computer device. The computer device stores a first routing table used for routing packets destined for the virtual network interface and a second routing table used for routing packets destined for a different interface, distinct from the virtual network interface in the computer device.Based on a packet that satisfies a packet filter rule, the computer device assigns an alternate route indicator for an IP flow to the packet, where the alternate route indicator specifies the use of the first routing table instead of the second routing table to address an IP subnet collision between an IP subnet of the virtual network interface and an IP subnet of another entity.

Description

background

[0001] Virtualization can be performed within a computer device to create virtual processing units (VPUs). Examples of VPUs include containers and virtual machines (VMs). A program running within a VPU can communicate with internal VPUs or with external VPUs outside the device. Brief description of the drawings

[0002] Some embodiments of the present disclosure are described with reference to the following figures. Fig. Figure 1 is a block diagram of an arrangement containing a computer device connected via an external network to a remote server and a remote client, in accordance with some examples. Fig. Figure 2 is a flowchart of a layer 3 packet filtering process according to some examples. Fig. Figure 3 is a flowchart of an internal address resolution protocol (ARP) processing process according to some examples. Fig. Figure 4 is a block diagram of a computer device according to some examples. Fig. Figure 5 is a block diagram of a storage medium that stores machine-readable instructions according to some examples. Fig. Figure 6 is a flowchart of a procedure according to some examples.

[0003] In the drawings, identical reference numerals denote similar, but not necessarily identical, elements. The illustrations are not necessarily to scale, and the size of some parts may be exaggerated to make the example shown clearer. Furthermore, the drawings contain examples and / or embodiments that correspond to the description; however, the description is not limited to the examples and / or embodiments shown in the drawings. Detailed description

[0004] In a computer device (also called a "host device") with a virtual environment containing one or more virtual processing units, a virtual network interface (also called a virtual gateway bridge) can be established to enable communication between programs of the virtual processing units in the host device and external devices outside the host device. The virtual gateway bridge acts as a transit point for traffic between the programs of the virtual processing units in the host device and the external devices. The virtual gateway bridge is part of an Internet Protocol (IP) subnet, which can be referred to as the "virtual interface IP subnet." The virtual interface IP subnet has a range of IP addresses. The virtual gateway bridge can be assigned an IP address from this range of IP addresses.An IP address of the virtual interface's IP subnet consists of two parts: a routing prefix (also called a network number) that identifies the virtual interface's IP subnet, and a host identifier that identifies an entity within the virtual interface's IP subnet, such as the virtual gateway bridge. Virtual computing units connected to the virtual gateway bridge also receive IP addresses from this virtual interface's IP subnet.

[0005] An IP subnet collision can occur if either: (1) the IP subnet of the virtual interface of the virtual gateway bridge is the same as an IP subnet assigned to an external entity outside the host device, or (2) the IP subnet of the virtual interface is the same as an IP subnet assigned to a physical or virtual interface within the same host device. For example, in scenario (1), an IP address of 172.18.0.2 / 24 assigned to the virtual gateway bridge means that the IP subnet of the virtual interface of the virtual gateway bridge is represented by 172.18.0 (the routing prefix). The value "24" after the " / " in the IP address refers to the number of bits in an IP mask, all of which are set to "1" to specify the length of the routing prefix of an IP address. If an external entity is assigned the IP address 172.18.0.2 / 24, the IP subnet will be 172.18.0.2 / 24.If x / 24 is assigned (where x is the host identifier of the external entity), then the external entity is part of an IP subnet that would conflict with the IP subnet of the virtual interface of the virtual gateway bridge. Similarly, scenario (2) can occur if the virtual gateway bridge and another physical or virtual internal interface in the same host device are assigned the same IP subnet.

[0006] If an IP subnet collision occurs (e.g., the virtual interface's IP subnet and an external entity's IP subnet are both represented by 172.18.0.x / 24, meaning 172.18.0 is the routing prefix and "x" can be any value), then the network stack of an operating system kernel in the host device would be unable to properly route an outgoing packet from an internal entity to its intended destination. For example, the internal entity in the host device might send the outgoing packet with the destination IP address 172.18.0.x, which is the IP address of the external entity. However, due to the IP subnet collision, the operating system kernel's network stack, based on a routing table in the host device, might incorrectly determine that the packet should be forwarded to the virtual interface's IP subnet instead of the external entity's IP subnet.As a result, the package may not reach its intended destination.

[0007] A routing table misdirection can also occur for a packet arriving from the external entity that is received by the host device due to an IP subnet collision.

[0008] Besides an IP subnet collision, which leads to the misrouting of Layer 3 (L3) packets, such as IP packets, an IP subnet collision can also cause mishandling of Layer 2 (L2) packets. An L3 packet (an IP packet) contains a source IP address to identify the packet's source and a destination IP address to identify its destination. An L2 packet contains a source MAC (Media Access Control) address to identify the source and a destination MAC address to identify the destination. An example of an L2 packet is an ARP (Address Resolution Protocol) packet, which is used to determine an L2 address (e.g., a MAC address) from an L3 address (e.g., an IP address) (or vice versa). The presence of an IP subnet collision can cause the operating system kernel to discard the ARP packet.If the virtual gateway bridge in the host device is assigned to the same IP subnet as an external server, both the host device and the external server can respond to an ARP request, which can confuse an external client that sent the ARP request.

[0009] According to some implementations of this disclosure, an alternative routing table (in addition to one or more primary routing tables) is created for an IP subnet of a virtual gateway bridge in a host device. The alternative routing table can be used to determine routes for IP traffic passing through the virtual gateway bridge between an internal entity within the host device and an external entity outside the host device. The use of the alternative routing table is specified based on an alternative route indicator associated with an IP flow containing packets. The alternative route indicator can be stored in packet metadata, which an operating system kernel uses to determine that the alternative routing table should be used instead of one or more primary or local routing tables in the host device.By using the alternative routing table, the IP subnet of the virtual gateway bridge is isolated from other IP subnets in the host device.

[0010] A "primary routing table" can refer to a main routing table or a local routing table within the host device that the operating system kernel (and more specifically, the kernel's network stack) typically uses to route a data packet. For example, the main routing table might be used to forward a packet to an external entity outside the host device. A local routing table might be used to forward a packet to an internal instance of the host device.

[0011] In accordance with some implementations of this disclosure, the alternate route indicator is set for packets that satisfy one or more specified packet filter rules. Packets that satisfy such specified packet filter rules and for which the alternate route indicator is set would use the alternate routing table instead of the primary routing table (the main routing table or the local routing table). The alternate route indicator can be set for both outgoing and incoming packets traversing the virtual gateway bridge to trigger the use of the alternate routing table. The one or more specified packet filter rules can indicate that the alternate route indicator is set for a packet in an IP flow destined for the virtual gateway bridge and targeting a specified destination port number.The alternative routing table can be used for both IPv4 version 4 (IPv4) and IPv6 version 6 (IPv6) flows.

[0012] Additionally, the alternate route indicator can be set for certain L2 packets, such as ARP request packets, that seek information (e.g., a MAC address) from the virtual gateway bridge or otherwise affect its ability to interact with it. For such L2 packets, the alternate routing table can be used to verify whether the packets are intended for communication with the virtual gateway bridge. Furthermore, the alternate route indicator can be set when an internal entity within the host device attempts to access a virtual processing unit (VPU) within the host device. This triggers the use of the alternate routing table to ensure that a packet destined for the VPU within the host device is not redirected to an external entity.

[0013] To prevent both the virtual gateway bridge in the host device and an external server from responding to an ARP request from an external client that sent the ARP request, in some examples an operating system kernel configuration (e.g. a configuration in a network stack of the operating system kernel) can be set so that a host device does not respond to an ARP request from an external client.

[0014] Fig. Figure 1 is a block diagram of an example arrangement comprising a host device 102 connected to an external network 104 with other devices, including a remote server 106 and a remote client 108. An external network refers to a network located outside the host device 102. The host device 102 also includes one or more local networks, including a local network 110 and a local network 112 in the example shown. Although in Fig. While two local networks are shown in Figure 1, other examples may integrate a different number of local networks (one or more) into the host device 102. A local network is a network within the host device 102 through which units of the host device 102 can communicate with each other.

[0015] In accordance with some examples in the present disclosure, the host device 102 comprises different virtual computing units, including containers 114-1 and 114-2. Although only two containers are shown, other examples may include a different number (one or more) of containers in the host device 102. Instead of or in addition to containers, the host device 102 may also run other virtual computing units, e.g., virtual machines (VMs).

[0016] In some examples, the host device 102 can be a network device, such as an access point (AP) or gateway device connected to a wireless local area network (WLAN). In other examples, the host device 102 can be a different type of network device, such as a switch or router. In still other examples, the host device 102 can include other types of electronic devices, including desktop computers, notebook computers, tablet computers, server computers, storage systems, vehicles, household appliances, and so on.

[0017] Host device 102 contains a virtual gateway bridge 116 (implemented with machine-readable instructions) that is connected to the local network 110. The virtual gateway bridge 116 is part of an IP subnet with a virtual interface. In the example of Fig. The virtual gateway bridge 116 is assigned the IP address 172.18.0.1, where 172.18.0 represents the routing prefix that defines the IP subnet of the virtual interface. Containers 114-1 and 114-2 are connected to the local network 110 via their respective local interfaces 118-1 and 118-2. Local interface 118-1 is assigned the IP address 172.18.0.2, and local interface 118-2 is assigned the IP address 172.18.0.3. Local interfaces 118-1 and 118-2 are also part of the IP subnet of the virtual interface (indicated by 172.18.0 in the example). Although in the example of Fig. While one specific IP address is given, it should be noted that in other examples different IP addresses may be assigned to the respective units.

[0018] Containers 114-1 and 114-2 are also connected to local network 112 via their respective local interfaces 120-1 and 120-2. Local interface 120-1 is assigned the IP address 10.0.0.2, and local interface 120-2 is assigned the IP address 10.0.0.3. Local interfaces 120-1 and 120-2 are part of a separate IP subnet, defined by the routing prefix of the IP addresses 10.0.0.2 and 10.0.0.3. In other examples, containers 114-1 and 114-2 are not connected to local network 112.

[0019] The local interfaces 118-1, 118-2, 120-1 and 120-2 are virtual interfaces that allow the containers 114-1 and 114-2 to communicate with local networks.

[0020] The host device 102 also includes a physical network interface 122, a physical component that enables the host device 102 to connect to the external network 104. The physical network interface 122 can, for example, contain a network interface controller as a single transceiver for sending and receiving signals. In the example of Fig. 1. The physical network interface is assigned an IP address 10.16.33.85, which is used for communication between the host device 102 and an external unit, such as the remote server 106 and the remote client 108.

[0021] Packets sent from host device 102, for example to remote server 106, would contain the IP address 10.16.33.85 as the source IP address. Similarly, packets sent to host device 102, for example from remote client 108, would contain the IP address 10.16.33.85 as the destination IP address.

[0022] When a packet is transmitted via the virtual gateway bridge 116 between a unit inside the host device 102 and an external unit, the virtual gateway bridge 116 can perform network address translation to translate between the external IP address 10.16.33.85 of the host device 102 and an internal IP address used in the host device 102.

[0023] The host device 102 also contains an operating system kernel 124, which forms the core of an operating system for executing certain operating system functions. The operating system kernel 124 includes a network stack 126 (implemented, for example, with machine-readable instructions) that has various protocol layers for data communication. For example, the network stack 126 can include a link layer (layer 2), a network layer (layer 3), and a protocol layer (layer 4). The link layer can be an Ethernet layer, the network layer an IP layer, and the protocol layer a Transmission Control Protocol (TCP) layer or a User Datagram Protocol (UDP) layer.Packets passing through the network stack 126 are communicated with an entity in an application layer, the entity in the application layer being in one of the containers 114-1 and 114-2, or in another virtual computing unit, or in a host application 128 running in the host device 102.

[0024] A packet originating from host device 102 can be sent by a container (114-1 or 114-2) or the host application 128 to an external entity, such as the remote server 106. An incoming packet is sent to host device 102, for example, from the remote client 108, to be received by a container or the host application 128. Outgoing and incoming packets are routed through the virtual gateway bridge 116 (as well as the physical network interface 122).

[0025] The host device 102 also contains a memory 132 in which various data structures are stored, including the primary routing table(s) 134 (main and local routing tables) and an alternative routing table 136, which is used instead of the primary routing table(s) 134 when an alternative route indicator is set for a packet in an IP flow. In some examples, entries containing route and interface information for the virtual gateway bridge 116 are moved from the main routing table to the alternative routing table 136.

[0026] Other data structures in memory 132 include an ARP table 138, which is used to correlate IP addresses and MAC addresses, firewall flow information 140, packet metadata 142, layer 3 (L3) packet filter rules 144 and layer 2 (L2) packet filter rules 146.

[0027] Although the different data structures in Fig. While in example 1 the data structures are represented as stored in memory 132, in other examples some of the data structures may be stored in one or more other memories. A memory can be persistent memory, which retains the stored data even if the power supply to the persistent memory is interrupted. Alternatively, a memory can also include volatile memory, which loses its stored data when the power supply to the volatile memory is interrupted. All in Fig. The data structures shown in Figure 1 can be stored in permanent memory; alternatively, some of the data structures can be stored in volatile memory.

[0028] The L3 packet filter rules 144 comprise rules used by a packet filter 130 in the network stack 126 to determine how to handle an L3 packet, including how to forward the L3 packet. Similarly, the L2 packet filter rules 146 comprise rules used by the packet filter 130 to determine how to handle an L2 packet, including how to forward the L2 packet. Although in Fig. While only one packet filter 130 is shown, it should be noted that there can be multiple packet filters in the network stack 126, including packet filters at different layers of the network stack 126. The packet filter 130 can refer to a packet filter at any of the different layers of the network stack 126.

[0029] In one example, the L3 packet filter rules comprise 144 iptables rules (also known as iptables Mangle rules). Iptables refers to a program used to configure IP packet filter rules for a firewall in the operating system kernel (124) to handle L3 packets, such as IP packets. Instead of iptables rules, nftables can also be used to define rules for handling L3 packets. In other examples, an Extended Berkeley Packet Filter (eBPF) can be used to define rules for handling L3 packets.

[0030] In one example, the L2 packet filter rules contain 146 ebtables rules. Ebtables refers to a program used to define rules for handling L2 packets, such as Ethernet frames. Instead of ebtables rules, nftables can be used to define rules for handling L2 packets.

[0031] The L3 packet filter rules 144 and the L2 packet filter rules 146 can be used by packet filter 130 to set an alternative route indicator for a packet. In the example of Fig. The alternative route indicator is represented as FWMARK (firewall mark), which is part of the packet metadata 142 stored in memory 132. The packet metadata 142 is associated with an IP flow. An IP flow is defined by the following 5-tuple: a source IP address, a source port number, a destination IP address, a destination port number, and the transport protocol used, such as TCP or UDP. It should be noted that multiple instances of the packet metadata 142 are maintained for different IP flows.

[0032] The alternate route indicator, FWMARK, can be set to an active value (e.g., "1" or "0") to indicate that alternate routing table 136 should be used, or to an inactive value (e.g., "0" or "1") to indicate that a primary routing table should be used. If the alternate route indicator FWMARK is set for a first IP flow, packet filter 130 would use alternate routing table 136 to route each packet of the first IP flow, instead of a primary routing table, such as primary routing table(s) 134. Conversely, if the alternate route indicator, FWMARK, is cleared for a second IP flow, then packet filter 130 would use a primary routing table to forward each packet of the second IP flow.

[0033] Since the alternative route indicator, FWMARK, is set in the packet metadata 142, a packet in the IP flow does not need to be modified to include the alternative route indicator. Rather, the packet filter 130 can check the packet metadata 142 for packets in the IP flow to determine if the alternative route indicator, FWMARK, is set, and if so, the network stack 126 uses the alternative routing table 136 to perform the routing of packets in the IP flow.

[0034] In some examples, the alternate route indicator FWMARK for an IP flow can also be added to an entry 150 for the IP flow connection trace. Connection trace entry 150 is part of the firewall flow information 140. Connection trace entries are used by the operating system kernel firewall 124 to track how many connections (IP flows) are established. For example, connection trace entry 150 can contain the following information in addition to FWMARK: source IP address, destination IP address, and destination port number. The 5-tuple (a source IP address, a source port number, a destination IP address, a destination port number, and the transport protocol) of the IP flow can be compared with the information in the connection trace entries of the firewall flow information 140 to determine which connection trace entry applies to the IP flow.

[0035] In some examples, the operating system kernel 124 can restore the value of the alternate route indicator FWMARK from a connection trace entry in the corresponding packet metadata for each IP flow. This restoration can occur during the startup of the host device 102, so that the state of the alternate route indicator FWMARK in the packet metadata matches the respective connection trace entry.

[0036] The L3 packet filter rules 144 can contain a first packet filter rule for outgoing L3 packets from a virtual computing unit that are to be forwarded to an external network (e.g., 104) via the virtual gateway bridge 116. This first packet filter rule can specify that for each outgoing L3 packet sent to the virtual gateway bridge 116 that contains a specific destination port number (e.g., port number 5001 or another defined port number) (or other specific information such as an IPv4 or IPv6 protocol in use, or other information), the alternative route indicator FWMARK is set. The alternative routing table 136 contains an entry for an outgoing L3 packet that includes a destination IP address that points to the virtual gateway bridge 116. This entry would route the outgoing L3 packet to the virtual gateway bridge 116.A primary routing table would not have an entry for the outgoing L3 packet with a destination IP address that points to virtual gateway bridge 116, so a search in the primary routing table would not yield a matching entry, resulting in the outgoing L3 packet being dropped.

[0037] L3 packet filter rules 144 can include a second packet filter rule for L3 packets sent from an internal source unit to an internal destination unit. An internal unit can refer to container 114-1 or 114-2, the host application 128, or another internal unit within the host device 102. This second packet filter rule can specify that for each L3 packet sent to a local destination containing a specific destination port number (e.g., port number 5001 or another defined port number) (or other specific information), the alternate route indicator FWMARK is set. For example, host application 128 can send an L3 packet destined for 10.16.33.85:5001, where the IP address 10.16.33.85 is that of a destination container (114-1 or 114-2) and the port number is 5001. It should be noted that the IP address is 10.16.33.85 is also the IP address of physical network interface 122 (in other words, physical network interface 122 and the container have the same IP address). Since the destination IP address 10.16.33.85 in the L3 packet is the IP address of physical network interface 122, packet filter 130 would perform a network address translation of the destination IP address 10.16.33.85 to the IP address of the virtual gateway bridge 116. The translated destination IP address would be 172.18.0.1:5001 in this example. However, if the alternate route indicator FWMARK is not set, packet filter 130 would perform a search in a primary routing table 134 (e.g., a local routing table) that does not contain an entry for the subnet 172.18.0 (the IP subnet of the virtual interface). As a result, this search would fail and packet filter 130 would not be able to forward the L3 packet to the destination container.However, if the alternative route indicator FWMARK is set, the packet filter 130 performs a search in the alternative route table 136, which contains an entry that directs the L3 packet to the destination container.

[0038] The L3 packet filter rules 144 can further include a third packet filter rule for incoming L3 packets received from an external entity and forwarded via the virtual gateway bridge 116 to an internal destination entity within the host device 102. This third packet filter rule can specify that for each incoming L3 packet sent to an internal destination instance containing a specific destination port number (e.g., port number 5001 or another defined port number) (or other specific information), the alternate route indicator FWMARK is set. An incoming L3 packet contains the IP address 10.16.33.85 of the physical network interface 122 as the destination IP address. Virtual gateway bridge 116 uses network address translation to translate the destination IP address 10.16.33.85 to 172.18.0.1, which is the IP address of virtual gateway bridge 116.Alternative routing table 136 contains an entry for an incoming L3 packet with a destination IP address that refers to virtual gateway bridge 116 and is directed to an internal destination instance. This entry would forward the incoming L3 packet to the internal destination instance. A primary routing table would not have an entry for the incoming L3 packet with a destination IP address that refers to virtual gateway bridge 116, so a query of the primary routing table would not return a matching entry.

[0039] Fig. Figure 2 is a flowchart of an L3 packet filtering process 200, which is executed by the packet filter 130 according to some examples of the present disclosure. Although Fig. Two tasks of the L3 packet filtering process 200 are shown, which are executed in a specific order; it is noted that in other examples the tasks may be executed in a different order, some tasks may be omitted, and other tasks may be added.

[0040] Packet filter 130 receives (at 202) an L3 packet. The L3 packet can be an outgoing L3 packet destined for an external entity outside the host device 102, an L3 packet sent from an internal source entity to an internal destination entity, or an incoming L3 packet destined for an internal destination entity. Packet filter 130 determines (at 204) using the L3 packet filter rules 144 (including the first, second, and third packet filter rules above) which routing table to use (a primary routing table 134 or the alternate routing table 136). Based on the L3 packet filter rules 144, packet filter 130 determines whether to set or clear the alternate route indicator, FWMARK.It should be noted that before checking the L3 packet filter rule 144, packet filter 130 can check entry 150 for the connection trace of the IP flow to which the L3 packet belongs, to determine whether FWMARK was previously set or cleared. If so, packet filter 130 would use this previously programmed state of FWMARK.

[0041] When FWMARK is set, packet filter 130 performs a query (at 206) of the alternative routing table 136 to determine how the L3 packet should be forwarded. If the L3 packet is an outgoing L3 packet destined for an external entity, a first entry in alternative routing table 136 would route the L3 packet to the virtual gateway bridge 116. If the L3 packet is an L3 packet sent from an internal source instance to an internal destination virtual instance, a second entry in alternative routing table 136 would route the L3 packet to the internal destination virtual instance. If the L3 packet is an incoming L3 packet destined for an internal virtual compute unit, a third entry in alternative routing table 136 would route the L3 packet to the internal virtual compute unit.

[0042] If FWMARK is cleared, packet filter 130 performs a lookup (at 208) in a primary routing table to determine how the L3 packet should be routed. Once FWMARK has been set or cleared in the packet metadata 142 for a given IP flow, packet filter 130 can consult the packet metadata 142 to determine, based on the state of FWMARK, which routing table to use for subsequent packets in the given IP flow.

[0043] For L2 packets, the L2 packet filter rules 146 are accessed to determine which of the primary routing table(s) 134 or the alternative routing table 136 should be used. As mentioned above, an example of an L2 packet is an ARP packet, including ARP requests and responses. Although some examples refer to ARP packets, it should be noted that similar techniques can be used for other types of L2 packets.

[0044] Several problems are associated with the handling of ARP packets. Problem 1: The lack of information for the virtual gateway bridge 116 in a primary routing table 134 can cause the operating system kernel 124 to discard an ARP packet, as a lookup attempt in the primary routing table would fail. Problem 2: If the virtual gateway bridge 116 in the host device 102 is assigned to the same IP subnet as an external server (e.g. 106), both the host device 102 and the external server can respond to an ARP request from a client (e.g. the remote client 108), which can confuse the client that sent the ARP request.

[0045] In scenario 1, an internal unit (e.g., container 114-1 or 114-2) of host device 102 can send an ARP request, which is received by the operating system kernel 124. The ARP request sent by the internal unit looks for the MAC address of virtual gateway bridge 116. The internal unit knows the IP address of virtual gateway bridge 116, but not its MAC address. The ARP request sent by the internal unit is called an internal ARP request. The internal unit receives the MAC address of virtual gateway bridge 116 to communicate with an external unit.

[0046] Fig. Figure 3 shows an internal ARP processing process 300 of the operating system kernel 124 in response to receiving (at 302) the internal ARP request. Although in Fig. 3. While the tasks of the internal ARP processing process 300 are presented in a specific order, it is noted that the tasks in other examples may be performed in a different order, that some tasks may be omitted, and that other tasks may be added.

[0047] The internal ARP request contains a destination IP address of virtual gateway bridge 116. The operating system kernel 124 performs a validation of the internal ARP request to ensure that the destination IP address contained in the request is a local IP address belonging to an entity in host device 102. This validation relies on accessing a routing table. If the operating system kernel 124 accesses a primary routing table 134 to perform this check, the primary routing table 134 would not contain an entry for the IP address of virtual gateway bridge 116. Consequently, the validation would fail, and the operating system kernel 124 would discard the internal ARP request.

[0048] According to some examples in the present disclosure, the operating system kernel 124 determines, for the internal ARP request (at port 304), based on a given rule in the L2 packet filter rules 146, which routing table to use (a primary routing table 134 or the alternative routing table 136). The given rule of the L2 packet filter rules 146 (e.g., ebtables rules) can specify that ARP requests from an internal unit of the host device 102, targeting the IP address of the virtual gateway bridge 116, should be marked by setting the alternative routing indicator FWMARK.

[0049] Based on the setting of FWMARK, the operating system kernel 124 accesses the alternative routing table 136 (at 306) to confirm that the IP address in the internal ARP request is a local IP address. Since the alternative routing table 136 contains an entry for the IP address of the virtual gateway bridge 116, the operating system kernel 124 can successfully perform this confirmation. Consequently, the operating system kernel 124 performs a lookup (at 308) in the ARP table 138 to determine the MAC address that corresponds to the IP address of the virtual gateway bridge 116. The operating system kernel 124 then sends (at 310) an ARP response containing the MAC address to the internal entity that sent the ARP request.

[0050] However, if the FWMARK is deleted, the operating system kernel 124 accesses a primary routing table 134 (at 312) to handle the internal ARP request (which in this latter case specifies an IP address of an internal entity that is not the virtual gateway bridge 116).

[0051] Problem 2 concerns an external ARP request (e.g., from remote client 108) received by host device 102. The external ARP request sent by remote client 108 may be directed to remote server 106, which has the IP address 172.18.0.1. However, this IP address is also the IP address of virtual gateway bridge 116. In this scenario, both remote server 106 and the operating system kernel 124 on host device 102 may send ARP responses to the external ARP request from remote client 108. This can cause an error on remote client 108 because the ARP responses may contain conflicting information that remote client 108 cannot resolve.

[0052] To solve the aforementioned problem, the operating system kernel 124 can specify an ARP-related configuration setting 131, associated with the network stack 126, to specify that an incoming interface responds to an ARP request only if the following criteria are met: (a) a destination IP address in the ARP request is a local IP address configured on the incoming interface, and (b) the sender's IP address is also part of the same IP subnet as the incoming interface. In the case of the external ARP request received at the physical network interface 122 of the host device 102, the incoming interface is the physical network interface 122. For example, the remote client 108 is assigned an IP address 10.16.33.x (where x can be any value), and the physical network interface 122 is assigned an IP address 10.16.33.x.If the network interface is assigned to 85 / 24, the remote client 108 and the physical network interface 122 would be in the same IP subnet (identified by the routing prefix 10.16.33). In this example, the physical network interface 122 would respond to the external ARP request because criteria (a) and (b) are met. In this case, the response from the physical network interface 122 is an ignore message, meaning that the physical network interface 122 can ignore the external ARP request and send no message. If the physical network interface 122 and the remote client 108 are not in the same IP subnet, criterion (b) is not met, and the physical network interface 122 would simply discard the external ARP request. In each of the above examples, the host device 102 does not respond to the external ARP request, so the remote client 108 does not receive multiple ARP responses with potentially conflicting information.Effectively, host device 102 ignores the external ARP request.

[0053] If the operating system kernel 124 is a Linux operating system kernel, the ARP-related configuration setting 131 in some examples contains proc entries of the Linux operating system kernel as follows: 1: echo 1 > / proc / sys / net / ipv4 / conf / virtual_gw_bridge / src_valid_mark 2: echo 2 > / proc / sys / net / ipv4 / conf / all / arp_ignore 3: echo 2 > / proc / sys / net / ipv4 / conf / virtual_gw_bridge / rp_filter.

[0054] Proc entry 1, which refers to "src_valid_mark", specifies that a route search for a traffic flow uses the value of the alternate route indicator FWMARK to select which routing table to use, both in the forward and reverse directions (outbound and inbound). In the Linux OS kernel, the default value for src_valid_mark is set to 0, meaning that FWMARK is only used for forward traffic and not for reverse traffic. In some examples, the value of src_valid_mark is set to 1 to use FWMARK for both forward and reverse directions.

[0055] Proc entry 2 above specifies that incoming ARP requests from an external entity should be ignored.

[0056] Proc entry 3 sets the value of rp_filter to 2 (instead of 1) because the route and interface information for virtual gateway bridge 116 has been moved to alternative routing table 136. The value of rp_filter controls how the Linux operating system kernel checks a received packet for its source IP address. Setting the value of rp_filter to 2 means the packet is accepted by the Linux OS kernel if the source address of the received packet is routable on any interface using one of the routes on that interface.

[0057] For other types of operating systems, various ARP-related configuration settings can be used to specify criteria (a) and (b).

[0058] Fig. Figure 4 is a block diagram of a computer device 400 according to some examples in the present disclosure. An example of the computer device 400 is the host device 102 from Fig. 1.

[0059] The computer device 400 includes a processing resource 402, which may include one or more hardware processors. A hardware processor may include a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or other hardware processing circuitry.

[0060] The computer device 400 further comprises a virtual processing unit 404, which can be a container or a VM. The computer device 400 also comprises a virtual network interface 406 between the virtual processing unit 404 and a network (e.g., 104 in Fig. 1) outside the computer device 400. An example of the virtual network interface 406 is the virtual gateway bridge 116 of Fig. 1. The virtual network interface 406 is a unit through which data is transferred between an internal unit of the computer device 400 and an external unit. The virtual network interface 406 is part of a first IP subnet, such as the IP subnet of the virtual interface described above.

[0061] The computer device 400 contains a memory 408 that stores a first routing table 410, which is used for routing packets destined for the virtual network interface 406, and a second routing table 412, which is used for routing packets destined for a different interface than the virtual network interface 406 of the computer device 400. An example of the first routing table 410 is the alternative routing table 136 of Fig. 1. An example of the second routing table 412 is a main or local routing table 134.

[0062] The computer device 400 further comprises a storage medium 414 on which machine-readable instructions are stored, which can be executed on the processing resource 402 to perform various tasks. In some examples, the machine-readable instructions are part of an operating system kernel in the computer device 400. In other examples, the machine-readable instructions may be part of other programs in the computer device 400.

[0063] The machine-readable instructions include instructions for determining packet filter rule 416 to ascertain whether a packet satisfies a packet filter rule. The packet can be, for example, an IP packet, and the packet filter rule is part of the L3 packet filter rules 144 of Fig. 1.

[0064] The machine-readable instructions include instruction 418 for setting an alternate route indicator to associate the packet that satisfies the packet filter rule with an alternate route indicator for an IP flow. The alternate route indicator specifies the use of the first routing table 410 instead of the second routing table 412 to address an IP subnet collision between the first IP subnet of the virtual network interface 406 and an IP subnet of another entity (external entity outside the computer device 400 or internal entity inside the computer device 400).

[0065] The machine-readable instructions contain first routing table query instructions 420 to query the first routing table in response to the alternate route indicator to determine a route for the packet. The first routing table can be used to route the packet to either the external or the internal entity.

[0066] In some examples, the machine-readable instructions can include the alternate route indicator as packet metadata (e.g., 142 in Fig. 1) Included are packets associated with the IP flow that meet the packet filter rule. The packet metadata can be stored in memory 408.

[0067] In some examples, the machine-readable instructions can insert the alternative route indicator into a connection tracking entry (e.g., 150 in Fig. 1) record, which is used by a firewall of the computer device.

[0068] In some examples, the machine-readable instructions can create the first routing table for the virtual network interface 406.

[0069] In some examples, the packet is an incoming packet from an external unit outside the computer device 400 to the virtual processing unit 404 inside the computer device, or an outgoing packet from the virtual processing unit 404 to the external unit, or an internal packet sent from an internal unit (e.g., the host application 128). Fig. 1) is sent to the virtual computing unit 404 in the computer device 400.

[0070] In some examples, processing the Layer 2 packet includes validating the Layer 2 packet using the first routing table 410. In some examples, validation includes verifying that an IP address contained in the Layer 2 packet identifies an entity within the computer device 400.

[0071] In some examples, the Layer 2 packet is an ARP packet, and validation involves verifying that an IP address contained in the ARP packet identifies the entity within the computer device.

[0072] In some examples, the unit within computer device 400, identified by the IP address contained in the ARP packet, is virtual computing unit 404.

[0073] In some examples, the machine-readable instructions can look up an ARP table to obtain a MAC packet that corresponds to the IP address contained in the ARP packet.

[0074] In some examples, the machine-readable instructions can program a configuration setting of an operating system kernel that specifies that an interface will only respond to an ARP request if a destination IP address in the ARP request is a local IP address configured on the interface, and an IP address of a sender of the ARP request is also part of the same IP subnet as the interface.

[0075] In some examples, the machine-readable instructions, based on the configuration setting, can ignore an ARP request from an external unit outside the computer device 400.

[0076] Fig. 5 is a block diagram of a non-transitory machine-readable or computer-readable storage medium 500 that stores machine-readable instructions which, when executed, are carried out by a computer device (e.g., the host device 102 of Fig. 1) cause various tasks to be carried out.

[0077] The machine-readable instructions on storage medium 500 contain IP packet receive instructions 502 for receiving an IP packet sent by a source unit. The source unit can be located inside or outside the data processing system.

[0078] The machine-readable instructions in storage medium 500 contain instructions for determining packet filter rule 504 to ascertain whether the IP packet satisfies a packet filter rule related to resolving an IP subnet collision between a virtual network interface of the computer device and another entity outside or inside the computer device. The packet filter rule may be part of the L3 packet filter rules 144 of Fig. Be 1.

[0079] The machine-readable instructions in storage medium 500 include instructions 506 for setting an alternate route indicator to associate the IP packet with an alternate route indicator for an IP flow based on the IP packet that satisfies the packet filter rule, where the alternate route indicator specifies the use of an alternate routing table instead of a primary routing table.

[0080] The machine-readable instructions in storage medium 500 contain instructions to look up the alternative routing table 508 in order to perform a lookup in the alternative routing table in response to the alternative route indicator in order to determine a route for the IP packet.

[0081] Fig. Figure 6 is a flowchart of a process 600 according to some examples, which takes place in a computer device (e.g., the host device 102 of Fig. 1) can be carried out.

[0082] Process 600 includes the determination (at 602) by the computer device of whether an IP packet satisfies a Layer 3 packet filter rule relating to the resolution of an IP subnet collision between a virtual network interface of the computer device and another entity outside or inside the computer device.

[0083] Process 600 involves assigning (at 604) the IP packet to an alternate route indicator for IP flow through the computer device based on the IP packet that satisfies the Layer 3 packet filter rule. The alternate route indicator specifies the use of an alternative routing table instead of a primary routing table.

[0084] Based on the association of the IP packet with the alternative route indicator, process 600 involves the computer device performing (at 606) a query of the alternative routing table to determine a route for the IP packet.

[0085] Process 600 involves the determination (at 608) by the computer device of whether a Layer 2 packet satisfies a Layer 2 packet filter rule. The Layer 2 packet can be an ARP packet.

[0086] Based on the Layer 2 packet that satisfies the Layer 2 packet filter rule, process 600 includes the assignment (at 610) of the Layer 2 packet by the computer device with the alternate route indicator.

[0087] Based on the assignment of the Layer 2 packet to the alternative route indicator, process 600 includes the processing (at 612) of the Layer 2 packet by the computer device using the alternative routing table.

[0088] Memory can be implemented using one or more memory chips. Persistent memory can be implemented using one or more flash memory chips or other types of memory chips capable of retaining stored data even when the power supply is interrupted. Volatile memory can be implemented using one or more dynamic random-access memory (DRAM) chips, static random-access memory (SRAM) chips, or other types of memory chips that lose stored data when the power supply is interrupted.

[0089] A storage medium (e.g., 414 in Fig. 4 or Fig. 500 in Fig.5) may include any or a combination of the following: a semiconductor storage device such as DRAM or SRAM, an erasable and programmable read-only memory (EPROM), an electrically erasable and programmable read-only memory (EEPROM), and flash memory; a magnetic disk such as a hard disk, a floppy disk, and a removable disk; another magnetic medium, including tape; an optical medium such as a compact disc (CD) or a digital video disc (DVD); or any other type of storage device. It should be noted that the instructions described above may be provided on a single computer- or machine-readable storage medium or, alternatively, on multiple computer- or machine-readable storage media distributed throughout a large system, possibly with multiple nodes.Such a computer-readable or machine-readable storage medium or media are considered part of an article (or manufactured item). An article or manufactured item may refer to any single manufactured component or to multiple components. The storage medium or media may be located either in the machine on which the machine-readable instructions are executed or at a remote location from which machine-readable instructions can be downloaded for execution over a network.

[0090] In this revelation, the use of the terms "a," "an," or "the" also includes the plural forms, unless the context clearly indicates otherwise. Similarly, the terms "comprises," "including," "encompasses," "have," or "have," when used in this revelation, specify the presence of the elements indicated but do not exclude the presence or addition of other elements.

[0091] The foregoing description includes numerous details to provide an understanding of the subject matter disclosed herein. However, implementations may be practiced without some of these details. Other implementations may involve modifications and variations of the details described above. It is intended that the attached claims cover such modifications and variations.

Claims

[1] A computer device comprising: a processing resource; a virtual computing unit; a virtual network interface between the virtual computing unit and a network outside the computer device, wherein the virtual network interface is part of a first Internet Protocol (IP) subnet; a storage space for storing: a first routing table used for routing packets addressed to the virtual network interface, and a second routing table used for routing packets destined for a different interface, distinct from the virtual network interface in the computer device; and A non-transitory storage medium that stores instructions that can be executed on the processing resource to: Determine whether a packet matches a packet filter rule, Based on the packet that satisfies the packet filter rule, an alternate route indicator for an IP flow is assigned to the packet, where the alternate route indicator specifies the use of the first routing table instead of the second routing table to address an IP subnet collision between the first IP subnet of the virtual network interface and an IP subnet of another entity, and In response to the alternative route indicator, a lookup is performed in the first routing table to determine a route for the packet. [2] Computer device according to claim 1, wherein the instructions on the processing resource are executable to: to include the alternative route indicator as metadata associated with the IP flow containing packets that meet the packet filter rule, with the metadata stored in memory. [3] Computer device according to claim 1, wherein the instructions on the processing resource are executable to: to include the alternate route indicator in a connection trace entry that is used by a firewall of the computer device. [4] Computer device according to claim 1, wherein the packet filter rule comprises a layer 3 packet filter rule and wherein the packet comprises an IP packet. [5] Computer device according to claim 1, wherein determining whether the packet satisfies the packet filter rule includes determining whether information in the packet satisfies the packet filter rule. [6] Computer device according to claim 1, wherein the instructions on the processing resource are executable for: Creating the first routing table for the virtual network interface. [7] Computer device according to claim 1, wherein the package comprises: an incoming packet from an external unit outside the computer device to the virtual processing unit inside the computer device or an outgoing packet from the virtual computing unit to the external unit or an internal packet that is sent from an internal unit in the computer device to the virtual computing unit. [8] Computer device according to claim 1, wherein the instructions on the processing resource are executable for: Receiving a Layer 2 package; Determine whether the layer 2 packet satisfies a layer 2 packet filter rule, Based on the fact that the Layer 2 package satisfies the Layer 2 package filter rule, assigning the alternative route indicator to the Layer 2 package, and In response to the assignment of the alternate route indicator to the layer 2 packet, the first routing table is used to process the layer 2 packet. [9] Computer device according to claim 8, wherein the processing of the layer 2 packet comprises validating the layer 2 packet using the first routing table. [10] Computer device according to claim 9, wherein the validation comprises verifying that an IP address contained in the layer 2 packet identifies an entity within the computer device. [11] Computer device according to claim 10, wherein the layer 2 packet comprises an Address Resolution Protocol (ARP) packet, and wherein the validation comprises verifying that an IP address contained in the ARP packet identifies the entity within the computer device. [12] Computer device according to claim 11, wherein the unit within the computer device, which is identified by the IP address contained in the ARP packet, is the virtual computing unit. [13] Computer device according to claim 12, wherein the instructions on the processing resource are executable for: Performing a lookup in an ARP table to obtain a Media Access Control (MAC) packet that corresponds to the IP address contained in the ARP packet. [14] Computer device according to claim 1, wherein the instructions on the processing resource are executable for: Programming a configuration setting of an operating system (OS) kernel that specifies that an interface will respond to an Address Resolution Protocol (ARP) request only if a destination IP address in the ARP request is a local IP address configured on the interface, and an IP address of a sender of the ARP request is also part of the same IP subnet as the interface. [15] Computer device according to claim 14, wherein the instructions on the processing resource are executable to: Ignoring an ARP request from an external unit outside the computer device based on the configuration setting. [16] A non-transitory, machine-readable storage medium containing instructions which, when executed, cause a computer device to: Receive an Internet Protocol (IP) packet that was sent by a source instance; to determine whether the IP packet satisfies a packet filter rule relating to the resolution of an IP subnet collision between a virtual network interface of the computer device and another entity located outside or inside the computer device; based on the IP packet that satisfies the packet filter rule, assigning an alternative route indicator for an IP flow to the IP packet, where the alternative route indicator specifies the use of an alternative routing table instead of a primary routing table, and In response to the alternate route indicator, perform a lookup in the alternate routing table to determine a route for the IP packet. [17] Non-transitory machine-readable storage medium according to claim 16, wherein the instructions, upon execution, cause the computer device to: Receiving an ARP (Address Resolution Protocol) packet from an internal unit in the computer device; Determine whether the ARP packet satisfies a Layer 2 packet filter rule that specifies that ARP packets destined for the virtual network interface should be associated with an alternate route indicator; based on the ARP packet that satisfies the Layer 2 packet filter rule, assign the alternate route indicator to the ARP packet; and In response to the assignment of the alternative route indicator to the ARP packet, the ARP packet is validated by accessing the alternative routing table. [18] Non-transitory machine-readable storage medium according to claim 16, wherein the instructions, upon execution, cause the computer device to: Programming a configuration setting of an operating system (OS) kernel that specifies that an interface responds to an ARP (Address Resolution Protocol) request only if a destination IP address in the ARP request is a local IP address configured on the interface, and an IP address of a sender of the ARP request is also part of the same IP subnet as the interface; and Ignoring an ARP request from an external unit outside the computer device based on the configuration setting. [19] A procedure, encompassing: Determine, by a computer device, whether an Internet Protocol (IP) packet satisfies a Layer 3 packet filtering rule relating to the resolution of an IP subnet collision between a virtual network interface of the computer device and another entity located outside or inside the computer device; Based on the IP packet satisfying the Layer 3 packet filter rule, the computer device assigns the IP packet to an alternate route indicator for an IP flow, where the alternate route indicator specifies the use of an alternate routing table instead of a primary routing table; based on the assignment of the alternative route indicator to the IP packet, the computer device performs a lookup in the alternative routing table to determine a route for the IP packet; Determine whether a Layer 2 packet satisfies a Layer 2 packet filter rule, using the computer device. Based on the fact that the Layer 2 packet satisfies the Layer 2 packet filter rule, the computer device assigns the alternate route indicator to the Layer 2 packet, and based on the assignment of the alternative route indicator to the layer 2 packet, processing of the layer 2 packet by the computer device using the alternative routing table. [20] The method of claim 19, further comprising: Programming a configuration setting of an operating system (OS) kernel that specifies that an interface will respond to an Address Resolution Protocol (ARP) request only if a destination IP address in the ARP request is a local IP address configured on the interface, and an IP address of a sender of the ARP request is also part of the same IP subnet as the interface; and Ignoring an ARP request from an external entity outside the computer device by the computer device based on the configuration setting.

Images