Flow table entry control method and device

Abstract

An embodiment of the present specification provides a method and device for controlling flow table items, wherein the method for controlling flow table items includes: receiving a data packet sent by a user, and determining a target flow table item that matches the data packet, wherein the target flow table item is one of at least one flow table item corresponding to a local target virtual machine, and when a first version number of the target virtual machine included in the target flow table item is inconsistent with a second version number of the target virtual machine recorded locally, deleting the local flow table item containing the first version number; and sending the data packet to a virtual switch so that the virtual switch forwards the data packet to a target host machine, wherein the second version number is generated when the target virtual machine migrates to the target host machine.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular to a method for controlling a flow table entry. Background Art

[0002] With the rapid development of cloud computing and virtualization technology, the scale of cloud computing production environment deployment is getting larger and larger. The development of virtualization technology has led to the emergence of virtual servers (also called virtual machines). A virtual machine refers to a complete computer system that is simulated by software, has complete hardware system functions, and runs in a completely isolated environment. When hardware failures require maintenance or data processing needs are transferred, the running services need to be migrated to other platforms to continue running, and this process cannot affect the application services carried by the virtual machine. This involves virtual machine migration technology, which enables virtual machines to quickly migrate online between physical machines and keep the virtual machines running uninterrupted during operation, effectively improving resource allocation. It can be seen that virtual machines will migrate on different hosts.

[0003] In actual use, if a virtual machine is migrated, the flow table corresponding to the virtual machine before the migration needs to be aged and deleted. However, most of the current methods are to search and poll one by one according to the flow table information corresponding to the virtual machine, that is, all flow tables need to be traversed. This process takes a lot of time, and during this period, a large number of messages will still be forwarded according to the behavior of the undeleted flow table, resulting in message forwarding errors. Therefore, an effective method is urgently needed to solve this problem. Summary of the invention

[0004] In view of this, an embodiment of the present specification provides a flow entry control method. One or more embodiments of the present specification also relate to a flow entry control device, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0005] According to a first aspect of an embodiment of this specification, a flow table entry control method is provided, including:

[0006] Receive a data message sent by a user, and determine a target flow table entry matching the data message, wherein the target flow table entry is one of at least one flow table entry corresponding to a local target virtual machine;

[0007] When the first version number of the target virtual machine included in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally, deleting the local flow table entry including the first version number; and

[0008] The data message is sent to a virtual switch so that the virtual switch forwards the data message to a target host machine, wherein the second version number is generated when the target virtual machine is migrated to the target host machine.

[0009] Optionally, the flow entry control method further includes:

[0010] Generate the first version number of the target virtual machine, and add the first version number to the at least one flow table entry;

[0011] When it is determined that the target virtual machine is migrated from the local machine to the target host machine, the second version number of the target virtual machine after the migration is recorded.

[0012] Optionally, the flow entry control method further includes:

[0013] If no target flow table entry matching the data message is found, sending the data message to the virtual switch so that the virtual switch generates a first flow table entry according to the data message;

[0014] Add the first version number to the first flow table entry.

[0015] Optionally, the flow entry control method further includes:

[0016] When the first version number of the target virtual machine included in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally, sending the data message to the virtual switch so that the virtual switch generates a second flow table entry corresponding to the data message;

[0017] The second version number is added to the second flow table entry, the data message is forwarded according to the second flow table entry, and the second flow table entry is sent to the target host machine.

[0018] Optionally, the flow entry control method further includes:

[0019] When the first version number of the target virtual machine included in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally, determining the attribute identifier of the data message;

[0020] An action set corresponding to the attribute identifier in the target flow entry is determined, and the data message is forwarded according to the action set.

[0021] Optionally, determining a target flow table entry matching the data packet includes:

[0022] Determining the target virtual machine locally associated with the user according to the user identifier of the user;

[0023] The at least one flow table entry corresponding to the target virtual machine is determined, and a target flow table entry matching the data packet is determined according to tuple data included in a packet header field of each flow table entry.

[0024] Optionally, sending the data message to the virtual switch so that the virtual switch generates a first flow table entry according to the data message includes:

[0025] The data message is sent to the virtual switch, so that the virtual switch establishes a long connection data channel with the client of the user according to the client identifier of the user contained in the data message, and constructs a first flow table entry according to the establishment result of the long connection data channel, wherein the first flow table entry includes interface configuration information of the long connection data channel.

[0026] Optionally, sending the data message to the virtual switch so that the virtual switch generates a second flow table entry according to the data message includes:

[0027] The data packet is sent to the virtual switch, so that the virtual switch establishes a long connection data channel between the target host and the user's client according to the user's client identifier contained in the data packet, and constructs a second flow table entry according to the establishment result of the long connection data channel, wherein the second flow table entry contains interface configuration information of the long connection data channel.

[0028] Optionally, when the first version number of the target virtual machine included in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally, it is determined that the target flow table entry is hit;

[0029] Accordingly, the method further includes:

[0030] Counting the number of hits of the target flow entry within a target time interval;

[0031] When the hit count is less than a preset count threshold, the local flow table entry containing the first version number is deleted.

[0032] According to a second aspect of an embodiment of this specification, a flow table entry control device is provided, including:

[0033] A receiving module, configured to receive a data message sent by a user, and determine a target flow table entry matching the data message, wherein the target flow table entry is one of at least one flow table entry corresponding to a local target virtual machine;

[0034] a deleting module configured to delete the local flow table entry containing the first version number when the first version number of the target virtual machine contained in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally; and

[0035] The sending module is configured to send the data message to the virtual switch so that the virtual switch forwards the data message to the target host machine, wherein the second version number is generated when the target virtual machine is migrated to the target host machine.

[0036] According to a third aspect of an embodiment of this specification, a network card is provided, including:

[0037] Memory and processor;

[0038] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement any step of the flow table entry control method.

[0039] According to a fourth aspect of an embodiment of this specification, a computing device is provided, including:

[0040] Memory and processor;

[0041] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement any step of the flow table entry control method.

[0042] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of any one of the flow table entry control methods are implemented.

[0043] According to a sixth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned flow table entry control method.

[0044] One embodiment of the present specification receives a data packet sent by a user and determines a target flow table entry that matches the data packet, wherein the target flow table entry is one of at least one flow table entry corresponding to a local target virtual machine, and when a first version number of the target virtual machine contained in the target flow table entry is inconsistent with a second version number of the target virtual machine recorded locally, the local flow table entry containing the first version number is deleted; and the data packet is sent to a virtual switch so that the virtual switch forwards the data packet to a target host machine, wherein the second version number is generated when the target virtual machine is migrated to the target host machine.

[0045] The embodiment of the present specification sets a version number for the local virtual machine and adds the version number to the flow table item corresponding to the virtual machine. When the virtual machine migrates, its version number will change after the migration. Therefore, after receiving the data message of the user, the embodiment of the present specification determines the target flow table item that matches the data message, and compares the first version number of the target virtual machine in the target flow table item with the second version number of the target virtual machine to determine whether the target virtual machine has migrated; in the case of inconsistent comparison, it is determined that the target virtual machine has migrated, and it is necessary to determine the forwarding path of the data message according to the location of the target virtual machine after the migration, specifically, re-determine the forwarding path of the data message through the virtual switch, and forward the data message to the target host according to the path. In this way, when it is determined that the target virtual machine has migrated, the forwarding path of the data message can be changed in time to avoid the erroneous forwarding of the data message, which is conducive to improving the accuracy of the data message forwarding result, thereby helping to improve the user experience.

[0046] In addition, in the event of an inconsistent comparison, if it is determined that the target virtual machine has migrated, the local flow table entries containing the first version number can be deleted in batches, that is, by adding the version number of the target virtual machine to the flow table entry, and determining the flow table entry to be deleted by searching the version number, which is beneficial to improving the aging and deletion speed of the flow table entries, and is also beneficial to avoiding the problem of data packet forwarding errors caused by untimely deletion of flow table entries, that is, it is beneficial to improve the accuracy of data packet forwarding results, thereby improving user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 is a flow chart of a flow table entry control method provided by an embodiment of this specification;

[0048] Figure 2 is a schematic diagram of a control process of a flow table item provided by an embodiment of this specification;

[0049] Figure 3 is a flowchart of a process of controlling a flow table entry provided by an embodiment of the present specification;

[0050] Figure 4 It is a structural schematic diagram of a flow table entry control device provided by an embodiment of this specification;

[0051] Figure 5 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0052] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0053] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0054] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0055] First, the terms involved in one or more embodiments of this specification are explained.

[0056] Centrex: A virtual switch that uses public network resources to form a private network and provides special switching functions such as virtual PBX (Private Branch Exchange) services to public network users.

[0057] In this specification, a method for controlling a flow table entry is provided. This specification also relates to a flow table entry control device, a computing device, a computer-readable storage medium, and a computer program, which are described in detail one by one in the following embodiments.

[0058] Figure 1 A flow chart of a method for controlling a flow table entry provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0059] Step 102: Receive a data message sent by a user, and determine a target flow table entry matching the data message, wherein the target flow table entry is one of at least one flow table entry corresponding to a local target virtual machine.

[0060] The flow entry control method provided in the embodiments of this specification is applied to a source host machine, that is, a host machine (physical machine) where a target virtual machine is located before migration.

[0061] In actual applications, the user has permission to use the target virtual machine. Therefore, the user can send data packets to the source host machine and forward the data packets between the target virtual machine and / or other virtual machines to meet corresponding data processing requirements.

[0062] Since the user has the right to use the target virtual machine, when it is necessary to forward data packets from the target virtual machine to other virtual machines, a communication protocol between the target virtual machine and the other virtual machines can be set, and a long connection data channel can be established between the virtual machines based on the communication protocol. A flow table entry corresponding to the target virtual machine can also be generated based on the long connection data channel. The flow table entry can be used to record the protocol status information of the connection established between the target virtual machine and the other virtual machines based on the target communication protocol.

[0063] Therefore, when a user first accesses a target virtual machine through a client, since there is no connection between the target virtual machine and other virtual machines, in this case, if a data packet of the user is received, a target flow table entry matching the data packet cannot be found, and thus the packet cannot be forwarded through the target virtual machine. Therefore, when a target flow table entry matching the data packet is not found, the data packet is sent to the virtual switch, so that the virtual switch generates a first flow table entry according to the data packet;

[0064] Add the first version number to the first flow table entry.

[0065] Further, sending the data message to the virtual switch so that the virtual switch generates a first flow table entry according to the data message includes:

[0066] The data message is sent to the virtual switch, so that the virtual switch establishes a long connection data channel with the client of the user according to the client identifier of the user contained in the data message, and constructs a first flow table entry according to the establishment result of the long connection data channel, wherein the first flow table entry includes interface configuration information of the long connection data channel.

[0067] Specifically, in addition to running virtual machines, the host machine also runs a virtual switch, which can be responsible for simulating a physical switch to complete traffic (data message) forwarding. Normally, after a data message enters the host machine, it first passes through the smart network card, which queries the flow table to determine the target flow table item hit by the data message; if the data message hits the target flow table item, the message can be forwarded according to the action set in the target flow table item; if the data message does not hit the target flow table item, the data message can be sent to the virtual switch; the virtual switch generates a first flow table item corresponding to the data message, forwards the data message according to the generated first flow table item, and sends the generated first flow table item to the smart network card, so that subsequent data messages can directly hit the first flow table item of the target virtual machine for forwarding processing.

[0068] The interface configuration information may be target communication protocol information between a user's client and a source host machine, or between a user's client and a target virtual machine, or between a target virtual machine and other virtual machines.

[0069] In actual applications, if no target flow table entry matching the data packet is found, the data packet can be sent to the virtual switch, so that the virtual switch can establish a long connection data channel between the source host machine and the user's client based on the user's client identifier contained in the data packet, or establish a long connection data channel between the target virtual machine in the source host machine and the user's client based on the user's client identifier contained in the data packet. Alternatively, the target virtual machine that the user has permission to use can be determined based on the client identifier to establish a long connection data channel between the target virtual machine and other virtual machines.

[0070] It should be noted that, depending on the specific scenario, the recipient of the data message may be different when the data message is forwarded according to the target flow entry. For example, for a load balancing scenario, forwarding the data message according to the target flow entry may specifically be forwarding the data message to a destination virtual machine in a virtual machine cluster, or a destination server in a server cluster. For another example, for a network forwarding scenario, forwarding the data message according to the target flow entry may specifically be forwarding the data message to a next-level data message forwarding device (virtual switch or destination virtual machine) or the destination device of the data message.

[0071] In addition, before receiving the data message sent by the user, the first version number of the target virtual machine may be generated, and the first version number may be added to the at least one flow table entry;

[0072] When it is determined that the target virtual machine is migrated from the local machine to the target host machine, the second version number of the target virtual machine after the migration is recorded.

[0073] Specifically, after each data packet is received, it is necessary to determine the target flow table entry that matches the data packet in at least one flow table entry corresponding to the target virtual machine, so as to forward the data packet based on the action set recorded in the target flow table entry. Specifically, the forwarding path of the data packet can be determined according to the action set, and the data packet can be forwarded according to the forwarding path. However, in the case where the target virtual machine is migrated, the forwarding path corresponding to the data packet may change because the position of the target virtual machine changes before and after the migration. In this case, if the packet is still forwarded according to the action set in the aforementioned target flow table entry, the data packet may be forwarded incorrectly.

[0074] Based on this, the embodiments of the present specification can set a corresponding version number for each virtual machine in the source host machine, that is, set a first version number for the target virtual machine, and add the first version number to at least one flow table item corresponding to the target virtual machine; then, when it is determined that the target virtual machine has migrated, that is, when the target virtual machine has migrated from the local source host machine to the target host machine, the second version number can be re-set for the migrated target host machine, and the second version number can be set by the source host machine or the target host machine. After the setting is completed, the source host machine records the second version number.

[0075] After receiving the user's data packet and determining the target flow table entry that matches the data packet, the first version number in the target flow table entry can be compared with the second version number recorded locally, and whether the target virtual machine has migrated can be determined based on the comparison result. This ensures that when it is determined that the target virtual machine has migrated, the forwarding path of the data packet can be re-determined to avoid erroneous forwarding of the data packet.

[0076] In a specific implementation, determining a target flow table entry matching the data message includes:

[0077] Determining the target virtual machine locally associated with the user according to the user identifier of the user;

[0078] The at least one flow table entry corresponding to the target virtual machine is determined, and a target flow table entry matching the data packet is determined according to tuple data included in a packet header field of each flow table entry.

[0079] Specifically, each target virtual machine may correspond to multiple flow tables, and each flow table may be composed of multiple flow table entries, which are key data structures for virtual machines or virtual switches to control data packet forwarding. Virtual machines or virtual switches decide to take appropriate actions for received data packets by looking up the flow table entries in the flow table. Each flow table entry includes three fields: header field, counter, and action. Among them, the header field is used to match the header content of the data packet received by the virtual machine or virtual switch. Usually, the header field of the flow table entry includes 12 tuples, specifically: input interface, mac source address, mac destination address, Ethernet type, virtual ID, virtual priority, IP source address, IP destination address, IP protocol, IPTOS bit, TCP / UDP destination port and source port; the counter is used to count certain information of the traffic, such as the number of packets sent; the action is the processing method of the virtual switch after receiving the data packet, such as discarding, forwarding port, etc.

[0080] Therefore, after receiving a data packet sent by a user, the target virtual machine associated with the user locally can be determined based on the user's user ID, and then the tuple data contained in the packet header field of the flow table item corresponding to the target virtual machine is matched with the packet header of the data packet. If the information contained in the packet header of the data packet matches or is consistent with the tuple data contained in the packet header field of the flow table item, the flow table item can be determined as the target flow table item that matches the data packet, and the target flow table item is one of at least one flow table item corresponding to the target virtual machine.

[0081] Step 104: When the first version number of the target virtual machine included in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally, the local flow table entry including the first version number is deleted.

[0082] Specifically, when the target virtual machine has not been migrated, the second version number and the first version number can both represent the version number set by the source host machine for the target virtual machine before the migration; when the target virtual machine has been migrated, the first version number can represent the version number set by the source host machine for the target virtual machine before the migration, and the second version number is the version number set by the source host machine or the target host machine for the target virtual machine after the migration.

[0083] After the source host determines the version number of each virtual machine, in addition to recording the version number of different virtual machines locally, it can also add the version number to the flow table corresponding to the virtual machine. In the case of migration of the target virtual machine, the version number recorded locally will be updated accordingly, but the version number added to the local flow table corresponding to the target virtual machine will not be updated.

[0084] Therefore, after receiving the user's data message and determining the target flow table entry that matches the data message, the first version number of the target virtual machine in the target flow table entry can be compared with the second version number of the target virtual machine recorded locally; if the comparison is inconsistent, it indicates that the target virtual machine has migrated. In this case, since the position of the target virtual machine has changed, the forwarding path of the data message will change accordingly. Based on this, since the forwarding path recorded in the flow table entry corresponding to the target flow table entry stored locally by the source host is still the forwarding path of the data message before the target virtual machine has migrated, if the data message is still forwarded according to the forwarding path, it will cause a data message forwarding error. Therefore, in the case of determining that the target virtual machine has migrated, the local flow table entry containing the first version number can be deleted (flow table aging).

[0085] In addition, when the first version number of the target virtual machine included in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally, determining the attribute identifier of the data message;

[0086] An action set corresponding to the attribute identifier in the target flow entry is determined, and the data message is forwarded according to the action set.

[0087] Specifically, if the first version number of the target virtual machine contained in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally, it indicates that the target virtual machine has not been migrated. In this case, the attribute identifier of the data message can be determined, and the action set corresponding to the attribute identifier in the target flow table entry can be determined, and then the data message can be forwarded according to the action set.

[0088] As mentioned above, the target flow table entry includes an action domain, and the actions included in the action domain include but are not limited to forwarding or discarding. Therefore, when it is determined that the target virtual machine has not been migrated, that is, when it is determined that the forwarding path of the data message has not changed, the action set included in the target flow table entry can be directly determined, and then the action set corresponding to the data message can be determined according to the attribute identifier of the data message, that is, according to the attribute identifier, it is determined whether the data message should be discarded or forwarded; when it is determined that the action set corresponding to the data message is forwarding, the data message is forwarded.

[0089] In a specific implementation, since the first version number of the target virtual machine included in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally, it is determined that the target flow table entry is hit;

[0090] Correspondingly, the source host machine may also count the number of hits of the target flow table entry within the target time interval;

[0091] When the hit count is less than a preset count threshold, the local flow table entry containing the first version number is deleted.

[0092] Specifically, since the second version number can be used to represent the version number reset for the target virtual machine after migration, if the second version number of the target virtual machine is different from the first version number after migration, in this case, the first version number of the target virtual machine included in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally, that is, the target flow table entry is not hit. It can be seen that if the target flow table entry of the target virtual machine in the local area is not hit for a long time, the reason may be that the target virtual machine has migrated.

[0093] Therefore, the embodiment of the present specification can count the number of hits of the target flow table entries within the target time interval. If the number of hits within the target time interval is less than the preset number threshold (the preset number threshold can be set to 0), it means that the target virtual machine has been migrated. In this case, the local flow table entries containing the first version number can be deleted in batches.

[0094] Compared with the aforementioned flow table aging method in which when the first version number of the target virtual machine contained in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally, the local flow table entry containing the first version number is deleted, when it is determined that the target flow table entry has not been hit within a certain period of time, the flow table entry containing the first version number is deleted, which is beneficial to avoid the occurrence of accidental deletion of flow table entries, thereby helping to improve the reliability and security of the system.

[0095] Step 106: Send the data message to the virtual switch, so that the virtual switch forwards the data message to the target host machine, wherein the second version number is generated when the target virtual machine is migrated to the target host machine.

[0096] In a specific implementation, when the first version number of the target virtual machine included in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally, the data message is sent to the virtual switch so that the virtual switch generates a second flow table entry corresponding to the data message;

[0097] The second version number is added to the second flow table entry, the data message is forwarded according to the second flow table entry, and the second flow table entry is sent to the target host machine.

[0098] Further, sending the data message to the virtual switch so that the virtual switch generates a second flow table entry according to the data message includes:

[0099] The data packet is sent to the virtual switch, so that the virtual switch establishes a long connection data channel between the target host and the user's client according to the user's client identifier contained in the data packet, and constructs a second flow table entry according to the establishment result of the long connection data channel, wherein the second flow table entry contains interface configuration information of the long connection data channel.

[0100] Specifically, the second version number can be used to represent the new version number set for the target virtual machine after migration, that is, when the target virtual machine migrates from the source host (local) to the target host, the source host or the target host can set the second version number for the target virtual machine.

[0101] In addition, as mentioned above, in addition to running virtual machines, the host machine also runs a virtual switch, which can be responsible for simulating a physical switch to complete traffic (data message) forwarding. Normally, after the data message enters the host machine, it first passes through the smart network card, and the smart network card queries the flow table to determine the target flow table item hit by the data message; if the data message hits the target flow table item, the first version number in the target flow table item can be compared with the second version number recorded locally. If the comparison is inconsistent, the data message can be sent to the virtual switch; the virtual switch generates a second flow table item corresponding to the data message, forwards the data message to the target host machine according to the generated second flow table item, and sends the generated second flow table item to the target host machine, that is, to the smart network card of the target host machine, so that subsequent data messages can directly hit the second flow table item of the target virtual machine for forwarding processing.

[0102] The interface configuration information may be target communication protocol information between a user's client and a target host machine, or between a user's client and a target virtual machine, or between a target virtual machine and other virtual machines.

[0103] In actual applications, when the first version number of the target virtual machine contained in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally, the data packet can be sent to the virtual switch, so that the virtual switch can establish a long connection data channel between the target host machine and the user's client according to the user's client identifier contained in the data packet, or establish a long connection data channel between the target virtual machine in the target host machine and the user's client according to the user's client identifier contained in the data packet, or, according to the user's client identifier contained in the data packet, determine the target virtual machine that the user has the right to use, so as to establish a long connection data channel between the target virtual machine and other virtual machines.

[0104] It should be noted that, depending on the specific scenario, the recipient of the data message may be different when the data message is forwarded according to the second flow table entry. For example, for a load balancing scenario, forwarding the data message according to the second flow table entry may specifically be forwarding the data message to a destination virtual machine in a virtual machine cluster, or a destination server in a server cluster. For another example, for a network forwarding scenario, forwarding the data message according to the second flow table entry may specifically be forwarding the data message to a next-level data message forwarding device (virtual switch or destination virtual machine) or a destination device of the data message.

[0105] A schematic diagram of a flow entry processing process provided by an embodiment of this specification is as follows Figure 2 As shown, the source host can set different version numbers for each virtual machine in the source host, and since different virtual machines correspond to different flow tables, each flow table can contain multiple flow table entries. Therefore, after determining the version number of each virtual machine, in addition to recording the version numbers of different virtual machines locally, the version number can also be added to the flow table entry corresponding to the virtual machine. In the case of migration of the target virtual machine, the locally recorded version number will be updated accordingly, but the version number added to the local flow table entry corresponding to the target virtual machine will not be updated.

[0106] Therefore, after the source host machine receives the user's data packet, it can determine the target flow table entry that matches the data packet in at least one flow table entry corresponding to the target virtual machine through the header information of the data packet, and then compare the first version number contained in the target flow table entry with the second version number of the target virtual machine recorded locally.

[0107] If the comparison is consistent, the action set corresponding to the data message in the target flow table entry can be determined, and the data message can be forwarded according to the action set;

[0108] In the event of an inconsistency in the comparison, the data packet is sent to the virtual switch so that the virtual switch generates a second flow table entry corresponding to the data packet, and then the virtual switch adds the second version number to the second flow table entry, forwards the data packet according to the second flow table entry, and sends the second flow table entry to the target host machine.

[0109] One embodiment of the present specification receives a data packet sent by a user and determines a target flow table entry that matches the data packet, wherein the target flow table entry is one of at least one flow table entry corresponding to a local target virtual machine, and when a first version number of the target virtual machine contained in the target flow table entry is inconsistent with a second version number of the target virtual machine recorded locally, the local flow table entry containing the first version number is deleted; and the data packet is sent to a virtual switch so that the virtual switch forwards the data packet to a target host machine, wherein the second version number is generated when the target virtual machine is migrated to the target host machine.

[0110] The embodiment of the present specification sets a version number for the local virtual machine and adds the version number to the flow table item corresponding to the virtual machine. When the virtual machine migrates, its version number will change after the migration. Therefore, after receiving the data message of the user, the embodiment of the present specification determines the target flow table item that matches the data message, and compares the first version number of the target virtual machine in the target flow table item with the second version number of the target virtual machine to determine whether the target virtual machine has migrated; in the case of inconsistent comparison, it is determined that the target virtual machine has migrated, and it is necessary to determine the forwarding path of the data message according to the location of the target virtual machine after the migration, specifically, re-determine the forwarding path of the data message through the virtual switch, and forward the data message to the target host according to the path. In this way, when it is determined that the target virtual machine has migrated, the forwarding path of the data message can be changed in time to avoid the erroneous forwarding of the data message, which is conducive to improving the accuracy of the data message forwarding result, thereby helping to improve the user experience.

[0111] In addition, in the event of an inconsistent comparison, if it is determined that the target virtual machine has migrated, the local flow table entries containing the first version number can be deleted in batches, that is, by adding the version number of the target virtual machine to the flow table entry, and determining the flow table entry to be deleted by searching the version number, which is beneficial to improving the aging and deletion speed of the flow table entries, and is also beneficial to avoiding the problem of data packet forwarding errors caused by untimely deletion of flow table entries, that is, it is beneficial to improve the accuracy of data packet forwarding results, thereby improving user experience.

[0112] The following combination Figure 3 , taking the application of the flow table entry control method provided in this specification in an actual scenario as an example, the flow table entry control method is further described. Figure 3 A flow chart of a process of controlling a flow table entry provided in an embodiment of the present specification is shown, which specifically includes the following steps.

[0113] Step 302: Generate a first version number of the target virtual machine, and add the first version number to at least one flow table entry corresponding to the target virtual machine.

[0114] Step 304: When it is determined that the target virtual machine is migrated from the local machine to the target host machine, the second version number of the target virtual machine after the migration is recorded.

[0115] Step 306: Receive a data message sent by the user.

[0116] Step 308: Determine whether there is a target virtual machine associated with the user locally according to the user identifier of the user.

[0117] If yes, execute step 310; if no, send the data message to the virtual switch, so that the virtual switch establishes a long connection data channel with the user's client according to the user's client identifier contained in the data message.

[0118] Step 310: determine at least one flow table entry corresponding to the target virtual machine, and determine a target flow table entry that matches the data packet based on the tuple data included in the packet header field of each flow table entry.

[0119] The target flow table entry is one of at least one flow table entry corresponding to the local target virtual machine.

[0120] Step 312: determine whether the first version number of the target virtual machine included in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally.

[0121] If not, execute step 314 ; if so, execute step 320 .

[0122] Step 314: Delete the local flow table entry containing the first version number.

[0123] Step 316: Send the data message to the virtual switch so that the virtual switch generates a second flow table entry corresponding to the data message.

[0124] Step 318: Add the second version number to the second flow table entry, forward the data message according to the second flow table entry, and send the second flow table entry to the target host machine.

[0125] Among them, when the target virtual machine has not been migrated, the second version number and the first version number can both represent the version number set by the source host machine for the target virtual machine before the migration; when the target virtual machine has been migrated, the first version number can represent the version number set by the source host machine for the target virtual machine before the migration, and the second version number is the version number set by the source host machine or the target host machine for the target virtual machine after the migration.

[0126] Step 320: When the first version number of the target virtual machine included in the target flow entry is consistent with the second version number of the target virtual machine recorded locally, determine the attribute identifier of the data message.

[0127] Step 322: determine the action set corresponding to the attribute identifier in the target flow entry, and forward the data message according to the action set.

[0128] In addition, when no target flow table entry matching the data message is found, the data message is sent to the virtual switch, so that the virtual switch establishes a long connection data channel with the user's client according to the user's client identifier contained in the data message.

[0129] A first flow table entry is constructed according to the establishment result of the long connection data channel.

[0130] Among them, the first flow table entry contains the interface configuration information of the long connection data channel.

[0131] A first version number is added to a first flow table entry, the first flow table entry is sent to a target virtual machine, and the data message is forwarded based on an action set included in the first flow table entry.

[0132] The embodiment of the present specification sets a version number for the local virtual machine and adds the version number to the flow table item corresponding to the virtual machine. When the virtual machine migrates, its version number will change after the migration. Therefore, after receiving the data message of the user, the embodiment of the present specification determines the target flow table item that matches the data message, and compares the first version number of the target virtual machine in the target flow table item with the second version number of the target virtual machine to determine whether the target virtual machine has migrated; in the case of inconsistent comparison, it is determined that the target virtual machine has migrated, and it is necessary to determine the forwarding path of the data message according to the location of the target virtual machine after the migration, specifically, re-determine the forwarding path of the data message through the virtual switch, and forward the data message to the target host according to the path. In this way, when it is determined that the target virtual machine has migrated, the forwarding path of the data message can be changed in time to avoid the erroneous forwarding of the data message, which is conducive to improving the accuracy of the data message forwarding result, thereby helping to improve the user experience.

[0133] In addition, in the event of an inconsistent comparison, if it is determined that the target virtual machine has migrated, the local flow table entries containing the first version number can be deleted in batches, that is, by adding the version number of the target virtual machine to the flow table entry, and determining the flow table entry to be deleted by searching the version number, which is beneficial to improving the aging and deletion speed of the flow table entries, and is also beneficial to avoiding the problem of data packet forwarding errors caused by untimely deletion of flow table entries, that is, it is beneficial to improve the accuracy of data packet forwarding results, thereby improving user experience.

[0134] Corresponding to the above method embodiment, this specification also provides a flow table entry control device embodiment, Figure 4 FIG. 1 is a schematic diagram showing a structure of a flow table entry control device provided by an embodiment of the present specification. Figure 4 As shown, the device comprises:

[0135] The receiving module 402 is configured to receive a data message sent by a user and determine a target flow table entry matching the data message, wherein the target flow table entry is one of at least one flow table entry corresponding to a local target virtual machine;

[0136] The deleting module 404 is configured to delete the local flow table entry containing the first version number when the first version number of the target virtual machine contained in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally; and

[0137] The sending module 406 is configured to send the data message to the virtual switch, so that the virtual switch forwards the data message to the target host machine, wherein the second version number is generated when the target virtual machine is migrated to the target host machine.

[0138] Optionally, the flow table entry control device further includes a recording module configured to:

[0139] Generate the first version number of the target virtual machine, and add the first version number to the at least one flow table entry;

[0140] When it is determined that the target virtual machine is migrated from the local machine to the target host machine, the second version number of the target virtual machine after the migration is recorded.

[0141] Optionally, the flow entry control device further includes a first processing module configured to:

[0142] If no target flow table entry matching the data message is found, sending the data message to the virtual switch so that the virtual switch generates a first flow table entry according to the data message;

[0143] Add the first version number to the first flow table entry.

[0144] Optionally, the flow entry control device further includes a second processing module configured to:

[0145] When the first version number of the target virtual machine included in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally, sending the data message to the virtual switch so that the virtual switch generates a second flow table entry corresponding to the data message;

[0146] The second version number is added to the second flow table entry, the data message is forwarded according to the second flow table entry, and the second flow table entry is sent to the target host machine.

[0147] Optionally, the flow entry control device further includes a forwarding module configured to:

[0148] When the first version number of the target virtual machine included in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally, determining the attribute identifier of the data message;

[0149] An action set corresponding to the attribute identifier in the target flow entry is determined, and the data message is forwarded according to the action set.

[0150] Optionally, the receiving module 402 is further configured to:

[0151] Determining the target virtual machine locally associated with the user according to the user identifier of the user;

[0152] The at least one flow table entry corresponding to the target virtual machine is determined, and a target flow table entry matching the data packet is determined according to tuple data included in a packet header field of each flow table entry.

[0153] Optionally, the first processing module is further configured to:

[0154] The data message is sent to the virtual switch, so that the virtual switch establishes a long connection data channel with the client of the user according to the client identifier of the user contained in the data message, and constructs a first flow table entry according to the establishment result of the long connection data channel, wherein the first flow table entry includes interface configuration information of the long connection data channel.

[0155] Optionally, the second processing module is configured to:

[0156] The data packet is sent to the virtual switch, so that the virtual switch establishes a long connection data channel between the target host and the user's client according to the user's client identifier contained in the data packet, and constructs a second flow table entry according to the establishment result of the long connection data channel, wherein the second flow table entry contains interface configuration information of the long connection data channel.

[0157] Optionally, when the first version number of the target virtual machine included in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally, it is determined that the target flow table entry is hit;

[0158] Accordingly, the device further includes a statistical module configured to:

[0159] Counting the number of hits of the target flow entry within a target time interval;

[0160] When the hit count is less than a preset count threshold, the local flow table entry containing the first version number is deleted.

[0161] The above is a schematic scheme of a flow table item control device of this embodiment. It should be noted that the technical scheme of the flow table item control device and the technical scheme of the flow table item control method described above belong to the same concept, and the details of the technical scheme of the flow table item control device that are not described in detail can be found in the description of the technical scheme of the flow table item control method described above.

[0162] Figure 5 The structure block diagram of a computing device 500 provided according to an embodiment of the present specification is shown. The components of the computing device 500 include but are not limited to a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and the database 550 is used to store data.

[0163] The computing device 500 also includes an access device 540 that enables the computing device 500 to communicate via one or more networks 560. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 540 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0164] In one embodiment of the present specification, the above components of the computing device 500 and Figure 5 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 5 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0165] The computing device 500 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 500 may also be a mobile or stationary server.

[0166] The processor 520 is used to execute the following computer executable instructions, which, when executed by the processor, implement the steps of the above-mentioned flow table entry control method.

[0167] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the flow table control method described above are of the same concept, and the details not described in detail in the technical scheme of the computing device can be found in the description of the technical scheme of the flow table control method described above.

[0168] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned flow table entry control method.

[0169] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the flow table control method described above are of the same concept, and the details not described in detail in the technical scheme of the storage medium can be found in the description of the technical scheme of the flow table control method described above.

[0170] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned flow table entry control method.

[0171] The above is a schematic scheme of a computer program of this embodiment. It should be noted that the technical scheme of the computer program and the technical scheme of the flow table control method described above are of the same concept, and the details not described in detail in the technical scheme of the computer program can be found in the description of the technical scheme of the flow table control method described above.

[0172] An embodiment of the present specification also provides a network card, including a memory and a processor, wherein the memory stores computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the above-mentioned flow table control method are implemented.

[0173] The above is a schematic scheme of a network card of this embodiment. It should be noted that the technical scheme of the network card and the technical scheme of the flow table control method described above are of the same concept, and the details not described in detail in the technical scheme of the network card can be referred to the description of the technical scheme of the flow table control method described above.

[0174] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0175] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0176] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0177] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0178] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A flow table entry control method, applied to a source host machine, include: Receive a data message sent by a user, and determine a target flow table entry matching the data message, wherein the target flow table entry is one of at least one flow table entry corresponding to a local target virtual machine; When the first version number of the target virtual machine included in the target flow table entry is inconsistent with the second version number of the target virtual machine recorded locally, deleting the local flow table entry including the first version number; and The data packet is sent to the virtual switch so that the virtual switch generates a second flow table entry corresponding to the data packet, the second version number is added to the second flow table entry, the data packet is forwarded to the target host machine according to the second flow table entry, and the second flow table entry is sent down to the target host machine, wherein the second version number is generated when the target virtual machine is migrated to the target host machine, and the second version number is re-set by the source host machine or the target host machine for the migrated target virtual machine.

2. The method for controlling a flow table entry according to claim 1, further comprising: include: Generate the first version number of the target virtual machine, and add the first version number to the at least one flow table entry; When it is determined that the target virtual machine is migrated from the local machine to the target host machine, the second version number of the target virtual machine after the migration is recorded.

3. The method for controlling a flow table entry according to claim 1, further comprising: include: If no target flow table entry matching the data message is found, sending the data message to the virtual switch so that the virtual switch generates a first flow table entry according to the data message; Add the first version number to the first flow table entry.

4. The method for controlling a flow entry according to any one of claims 1 to 3, further comprising: include: When the first version number of the target virtual machine included in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally, determining the attribute identifier of the data message; An action set corresponding to the attribute identifier in the target flow entry is determined, and the data message is forwarded according to the action set.

5. The method for controlling a flow entry according to claim 1, wherein the determining a target flow entry matching the data message, include: Determining the target virtual machine locally associated with the user according to the user identifier of the user; The at least one flow table entry corresponding to the target virtual machine is determined, and a target flow table entry matching the data packet is determined according to tuple data included in a packet header field of each flow table entry.

6. The method for controlling a flow table entry according to claim 3, wherein the data message is sent to the virtual switch so that the virtual switch generates a first flow table entry according to the data message. include: The data message is sent to the virtual switch, so that the virtual switch establishes a long connection data channel with the client of the user according to the client identifier of the user contained in the data message, and constructs a first flow table entry according to the establishment result of the long connection data channel, wherein the first flow table entry includes interface configuration information of the long connection data channel.

7. The method for controlling a flow table entry according to claim 1, wherein the data message is sent to a virtual switch so that the virtual switch generates a second flow table entry corresponding to the data message. include: The data packet is sent to the virtual switch, so that the virtual switch establishes a long connection data channel between the target host and the user's client according to the user's client identifier contained in the data packet, and constructs a second flow table entry according to the establishment result of the long connection data channel, wherein the second flow table entry contains interface configuration information of the long connection data channel.

8. The method for controlling flow table entries according to claim 1, wherein when the first version number of the target virtual machine contained in the target flow table entry is consistent with the second version number of the target virtual machine recorded locally, it is determined that the target flow table entry is hit; Accordingly, the method further includes: Counting the number of hits of the target flow entry within a target time interval; When the hit count is less than a preset count threshold, the local flow table entry containing the first version number is deleted.

9. A network card, include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the flow table entry control method described in any one of claims 1 to 8 are implemented.

10. A computing device, include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the flow table entry control method described in any one of claims 1 to 8 are implemented.

11. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the flow table entry control method according to any one of claims 1 to 8.

Images