Control method, control device, terminal and storage medium for virtual machine occupation flow table

Abstract

The present disclosure is about a control method, control device, terminal and storage medium for virtual machine occupied flow tables. The method includes monitoring the number of kernel state flow tables occupied by virtual machines; determining whether the number of kernel state flow tables occupied by virtual machines reaches a preset threshold; when the number of kernel state flow tables occupied by at least one virtual machine reaches the preset threshold, limiting the number of kernel state flow tables occupied by the virtual machines reaching the preset threshold to be less than or equal to the preset threshold, so that when multiple virtual machines share a storage space for storing a limited number of kernel state flow tables, the number of kernel state flow tables that each virtual machine can occupy can be limited to achieve that each virtual machine can have a kernel state flow table available, thereby improving the situation where a certain virtual machine encounters a prominent situation, a sudden increase in messages, a large number of flow tables are consumed, and other virtual machines have no flow tables available, thereby improving the system communication quality.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a method, a control device, a terminal and a storage medium for controlling a flow table occupied by a virtual machine. Background Art

[0002] OVS (Open vSwitch, open source virtual switch) is a high-quality virtual switch that supports multi-layer data forwarding. It is mainly deployed on servers. Compared with traditional switches, it has good programming scalability. At the same time, it has the network isolation and data forwarding functions implemented by traditional switches. It runs on each virtualized physical machine and provides remote management. When there is an application, OVS can forward messages through the virtual machine port to achieve communication between servers. At the same time, message forwarding depends on matching the flow table. When there is no flow table for matching the message, the message will be discarded, which will affect data communication. Summary of the invention

[0003] In view of this, the embodiments of the present disclosure are intended to provide a method, a control device, a terminal and a storage medium for controlling a virtual machine occupation flow table.

[0004] The technical solution of the present disclosure is achieved as follows:

[0005] In one aspect, the present disclosure provides a method for controlling a virtual machine occupation flow table.

[0006] The method for controlling a virtual machine occupation flow table provided in an embodiment of the present disclosure includes:

[0007] Monitor whether the number of kernel flow tables occupied by the virtual machine reaches a preset threshold;

[0008] When the number of kernel-mode flow tables occupied by at least one of the virtual machines reaches the preset threshold, based on a limit operation, the number of kernel-mode flow tables occupied by the virtual machines is made less than or equal to the preset threshold; wherein the limit operation is used to limit the number of kernel-mode flow tables occupied by the virtual machines that reach the preset threshold.

[0009] In some embodiments, the virtual machine has at least one port; wherein the kernel state flow table comprises: a port indication field; the port indication field indicates the port corresponding to the kernel state flow table;

[0010] The monitoring of whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold includes:

[0011] Based on the port indication field, the number of kernel state flow tables respectively occupied by each port of the virtual machine is counted.

[0012] In some embodiments, the limit-based operation so that the number of kernel-mode flow tables occupied by the virtual machine is less than or equal to the preset threshold value includes:

[0013] If each of the virtual machines has one port, the number of kernel-mode flow tables occupied by each virtual machine port is made less than or equal to the preset threshold;

[0014] If there is a virtual machine with multiple ports, the total number of kernel state flow tables occupied by each port in the virtual machine with multiple ports is made less than or equal to the preset threshold.

[0015] In some embodiments, the limit operation includes:

[0016] discarding the message to be transmitted containing the address indicating the virtual machine, and / or,

[0017] Clear the kernel-state flow tables occupied by the virtual machine, the kernel-state flow tables that have not been matched by packets for a period exceeding a preset time length.

[0018] In some embodiments, before monitoring whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold, the method includes:

[0019] According to the service type processed by the virtual machine, a preset threshold corresponding to the number of flow tables required to process the service type is set.

[0020] On the other hand, the present disclosure provides a control device for a virtual machine occupying a flow table. The control device for a virtual machine occupying a flow table provided in an embodiment of the present disclosure includes:

[0021] The first processing unit is used to monitor whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold;

[0022] The second processing unit is used to, when the number of kernel-mode flow tables occupied by at least one of the virtual machines reaches the preset threshold, make the number of kernel-mode flow tables occupied by the virtual machines less than or equal to the preset threshold based on a limit operation; wherein the limit operation is used to limit the number of kernel-mode flow tables occupied by the virtual machines that reach the preset threshold.

[0023] In some embodiments, the virtual machine has at least one port; wherein the kernel state flow table comprises: a port indication field; the port indication field indicates the port corresponding to the kernel state flow table;

[0024] The first processing unit is used to monitor whether the number of kernel state flow tables occupied by the virtual machine reaches a preset threshold, including:

[0025] The first processing unit is specifically configured to count the number of kernel-mode flow tables respectively occupied by each port of the virtual machine based on the port indication field.

[0026] In some embodiments, the second processing unit is configured to make the number of kernel-mode flow tables occupied by the virtual machine less than or equal to the preset threshold based on the limit operation, including:

[0027] The second processing unit is specifically configured to make the number of kernel-mode flow tables occupied by each virtual machine port less than or equal to the preset threshold if each virtual machine has one port;

[0028] If there is a virtual machine with multiple ports, the total number of kernel-mode flow tables occupied by the ports in the virtual machine with multiple ports is made smaller than or equal to the preset threshold.

[0029] In some embodiments, the limit operation includes:

[0030] discarding the message to be transmitted containing the address indicating the virtual machine, and / or,

[0031] Clear the kernel-state flow tables occupied by the virtual machine, the kernel-state flow tables that have not been matched by packets for a period exceeding a preset time length.

[0032] In some embodiments, before monitoring whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold, the first processing unit is also used to set a preset threshold corresponding to the number of flow tables required to process the business type processed by the virtual machine.

[0033] On the other hand, the present disclosure also provides a terminal.

[0034] The terminal provided by an embodiment of the present disclosure includes: a processor and a memory for storing a computer program that can be run on the processor, wherein the processor, when running the computer program, executes the steps of the method for controlling the virtual machine occupancy flow table provided by an embodiment of the present disclosure.

[0035] In yet another aspect, the present disclosure also provides a computer-readable storage medium.

[0036] The computer-readable storage medium provided in the embodiment of the present disclosure stores a computer program thereon, and when the computer program is executed by a processor, the steps of the method for controlling the virtual machine occupation flow table provided in the embodiment of the present disclosure are implemented.

[0037] The disclosed embodiment monitors the number of kernel-state flow tables occupied by virtual machines. When it is determined that the number of kernel-state flow tables occupied by at least one of the virtual machines reaches a preset threshold, a limit operation is performed to limit the number of kernel-state flow tables occupied by the virtual machines that have reached the preset threshold, so that the number of kernel-state flow tables occupied by the virtual machines is less than or equal to the preset threshold. This allows multiple virtual machines to share a storage space for storing a limited number of kernel-state flow tables, so that each virtual machine can have kernel-state flow tables available, thereby improving the situation where a certain virtual machine encounters an emergency, a sudden increase in messages, a large number of flow tables are consumed, and other virtual machines have no flow tables available, thereby improving the system communication quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 is a schematic diagram of a virtual machine structure according to an exemplary embodiment;

[0039] Figure 2 is a flow chart of a method for controlling a virtual machine occupying a flow table according to an exemplary embodiment;

[0040] Figure 3 A virtual machine software architecture and data forwarding process diagram according to an exemplary embodiment Figure 1 ;

[0041] Figure 4 A virtual machine software architecture and data forwarding process diagram according to an exemplary embodiment Figure 2 ;

[0042] Figure 5 The figure is a schematic diagram of the structure of a control device for a virtual machine occupying a flow table according to an exemplary embodiment.

[0043] Figure 6 is a schematic diagram of a terminal structure according to an exemplary embodiment. DETAILED DESCRIPTION

[0044] The technical solution of the present invention is further described in detail below in conjunction with the drawings and specific embodiments of the specification. The exemplary embodiments will be described in detail here, and examples thereof are shown in the drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are only examples of devices and methods consistent with some aspects of the present invention as detailed in the attached claims.

[0045] When OVS forwards a message, when the message arrives at the network card device, the network card will hand over the received message to the data packet receiving function defined in OVS for the port bound to the network card. In the datapath, the message header information is first obtained, and the key value of the matching flow table item is generated according to the message header information. After obtaining the key value, the kernel state flow table is matched. There are two flow tables in OVS, one is the kernel state flow table located in the kernel space, and the other is the user state flow table located in the user space. The kernel state flow table mainly stores the flow table items that have been matched recently, and the user state flow table is mainly sent by the controller through the ovs-ofctl tool provided by OVS. When the key value of the data packet matches the flow table item in the kernel state flow table, the data packet will not pass through the user space, and the kernel will directly perform the action operation and forward or discard the message. If the kernel state flow table item is not matched, the Netlink communication mechanism of the Linux system will be used to realize the communication between the kernel process and the user process, and the data packet will be sent to the user space for user state flow table matching, generate an accurate kernel state flow table, and send it to the kernel. Then, the message is sent back to the kernel for further forwarding.

[0046] However, the maximum number of kernel flow tables in OVS is limited. If the number of kernel flow tables is configured too large, it will affect the table lookup performance and reduce the packet forwarding performance. If the configured number is too small, when a large number of new connection packets enter OVS, the flow table will be exhausted quickly, causing the new connection to be discarded because there is no flow table available. Therefore, when sharing flow tables, how to balance the use of flow tables and take into account performance and large connections is a very important issue. In particular, when a small number of virtual machines in the host machine are attacked or business bursts cause a large number of flow tables to be consumed, resulting in a large reduction in the available flow tables for other virtual machines, causing the new traffic (new connections) to be discarded because the flow table cannot be learned. Figure 1 FIG. 1 is a schematic diagram of a virtual machine structure according to an exemplary embodiment. Figure 1 As shown in the figure, for example, the kernel state flow table is configured to 200,000. The virtual machine VM1 is attacked, resulting in a sudden increase in the corresponding messages, occupying 160,000 flow tables. The remaining VM2 to VMn can only occupy the remaining 40,000 flow tables, resulting in serious uneven distribution of flow tables. Ultimately, the newly added messages corresponding to other virtual machines are discarded because they cannot learn the flow table, thus affecting the system communication quality.

[0047] The present disclosure provides a method for controlling a flow table occupied by a virtual machine. Figure 2 FIG. 1 is a flow chart of a method for controlling a virtual machine occupying a flow table according to an exemplary embodiment. Figure 2 As shown, the control method of the virtual machine occupying the flow table includes:

[0048] Step 20: Monitor whether the number of kernel flow tables occupied by the virtual machine reaches a preset threshold;

[0049] Step 21. When the number of kernel-state flow tables occupied by at least one of the virtual machines reaches the preset threshold, based on a limit operation, the number of kernel-state flow tables occupied by the virtual machines is made less than or equal to the preset threshold; wherein the limit operation is used to limit the number of kernel-state flow tables occupied by the virtual machines that reach the preset threshold.

[0050] In this exemplary embodiment, there can be multiple virtual machines. At the same time, the number of kernel-state flow tables occupied by each virtual machine is monitored to determine whether the number of kernel-state flow tables occupied by a virtual machine reaches a preset threshold. The preset threshold is set in OVS to limit the maximum number of kernel-state flow tables that each virtual machine can occupy. For example, the kernel-state flow table configuration in OVS is 200,000. In order to balance the kernel-state flow tables that can be occupied by each virtual machine, prevent individual virtual machines from occupying a large number of flow tables, and take into account the situation where some large connections occur, the preset threshold can be set to 50,000, so that when a single virtual machine can handle a limited burst connection, it can ensure that other virtual machines have flow tables available, thereby avoiding the discarding of new traffic from other virtual machines due to the inability to occupy flow tables.

[0051] In this exemplary embodiment, by monitoring the number of kernel-state flow tables occupied by virtual machines, when it is determined that the number of kernel-state flow tables occupied by at least one of the virtual machines reaches a preset threshold, the number of kernel-state flow tables occupied by the virtual machines that have reached the preset threshold is limited through a limit operation, so that the number of kernel-state flow tables occupied by the virtual machines is less than or equal to the preset threshold, so that when multiple virtual machines share a storage space for storing a limited number of kernel-state flow tables, each virtual machine can have kernel-state flow tables available, so as to improve the situation where a virtual machine encounters an emergency (such as being attacked by other servers, or being hijacked to actively attack other servers), resulting in a sudden increase in messages and a large number of flow tables being consumed, resulting in no flow tables available for other virtual machines, thereby improving the system communication quality.

[0052] In one embodiment, a virtual machine may be configured with one or more ports; the number of kernel flow tables of a virtual machine may be proportional to the ratio of the number of ports of the virtual machine to the total number of ports of the entire physical machine or computing node.

[0053] A virtual machine may be configured with one or more ports. The number of kernel flow tables of a virtual machine may be proportional to the ratio of the bandwidth configured for the virtual machine to the total bandwidth of the entire physical machine or computing node.

[0054] When performing statistics on kernel-state flow tables, the number of kernel-state flow tables corresponding to each port can also be set based on the port granularity.

[0055] In some embodiments, the virtual machine has at least one port; wherein the kernel state flow table comprises: a port indication field; the port indication field indicates the port corresponding to the kernel state flow table;

[0056] The monitoring of whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold includes:

[0057] Based on the port indication field, the number of kernel state flow tables respectively occupied by each port of the virtual machine is counted.

[0058] In this exemplary embodiment, in order to address the problem that the kernel-mode flow table is easily occupied by a small number of virtual machines, when the kernel-mode flow table is downloaded to the storage space of the flow table, a port indication field: flow_port_stats[MAX_PORT_NUM] can be added to the downloaded flow table.

[0059] Here, flow_port_stats[MAX_PORT_NUM] is only an example of the aforementioned port indication field. In specific implementation, the port indication field may also be in other forms.

[0060] The port indication field indicates the port to which the kernel state flow table belongs. Based on the port indication field, the number of kernel state flow tables at the port granularity can be counted. Further, according to the virtual machine to which the port belongs, the number of kernel state flow tables of a single virtual machine can be counted.

[0061] Statistics are collected based on the in_port field in the newly created flow table. That is, for each flow table corresponding to a virtual machine port, flow_port_stats[in_port] is incremented by 1. When a flow table is aged due to a long period of time without packet hits, flow_port_stats[in_port] is decremented by 1.

[0062] Therefore, the number of sent flow tables corresponding to each virtual machine port can be counted through the flow_port_stats[MAX_PORT_NUM] field. Based on this statistical information, the kernel flow table resources that each virtual machine can occupy can be controlled. For example, the maximum limit of the port on OVS is 50,000 flow tables. When the virtual machine VM1 is attacked by the network and the flow table increases suddenly, since the maximum number of flow tables for each port is configured to be 50,000, the 50001st flow attacking VM1 is directly discarded because the flow table cannot be learned. That is, when the 50001th flow of VM1 comes in, it is checked that the number of flow tables on the corresponding port of VM1 has reached 50,000, then the message is discarded, and the flow table matching message forwarding is no longer performed.

[0063] In some embodiments, the limit-based operation so that the number of kernel-mode flow tables occupied by the virtual machine is less than or equal to the preset threshold value includes:

[0064] If each of the virtual machines has one port, the number of kernel-mode flow tables occupied by each virtual machine port is made less than or equal to the preset threshold;

[0065] If there is a virtual machine with multiple ports, the total number of kernel-mode flow tables occupied by the ports in the virtual machine with multiple ports is made smaller than or equal to the preset threshold.

[0066] In this exemplary embodiment, when monitoring the number of kernel-state flow tables occupied by each virtual machine, the number of kernel-state flow tables occupied by each port in each virtual machine can be monitored. When limiting the number of kernel-state flow tables occupied by virtual machines, the number of kernel-state flow tables occupied by each virtual machine port can be limited by a limit operation. When each virtual machine has one port, the number of kernel-state flow tables occupied by each virtual machine port is limited to be less than or equal to a preset threshold. For example, the kernel-state flow table configuration in OVS is 200,000, and the maximum number of occupied flow tables for each port can be configured to be 50,000, that is, the preset threshold is 50,000. When the kernel-state flow table occupied by any port reaches 50,000, the port will no longer increase the flow table occupancy.

[0067] When a virtual machine among multiple virtual machines has multiple ports, all the multiple ports of the virtual machine can forward packets and occupy flow tables. When limiting the number of kernel-mode flow tables occupied by a virtual machine, multiple ports can be limited to have the same maximum number of occupied flow tables, and the sum of the number of flow tables occupied by multiple ports is less than or equal to the preset threshold. For example, if virtual machine VM1 has 2 ports, each port can be limited to occupy a maximum of 25,000 flow tables.

[0068] In some embodiments, the limit operation includes:

[0069] discarding the message to be transmitted containing the address indicating the virtual machine, and / or,

[0070] Clear the kernel-state flow tables occupied by the virtual machine, the kernel-state flow tables that have not been matched by packets for a period exceeding a preset time length.

[0071] In this exemplary embodiment, the virtual machine address may be composed of the IP address of the virtual machine and the port number of the port configured for the virtual machine. The message to be transmitted is forwarded by the corresponding virtual machine port according to the IP address contained therein. Before forwarding, the message needs to match the kernel state flow table. When the match succeeds, the message is forwarded. If the match fails, the user state flow table is matched in the user space, and the corresponding kernel state flow table is generated and sent to the kernel, that is, the new kernel state flow table is learned and generated and occupied by the virtual machine.

[0072] In this exemplary embodiment, discarding the to-be-transmitted message containing an indication of the virtual machine address includes: discarding the to-be-transmitted message containing an indication of the virtual machine address that cannot be successfully matched with the flow table already occupied by the virtual machine. In order to limit individual virtual machines from occupying a large number of kernel-state flow tables and over-consuming flow table resources, when the number of kernel-state flow tables occupied by the virtual machine reaches a preset threshold, the to-be-transmitted message that cannot be successfully matched with the flow table already occupied by the virtual machine can be discarded. Because when forwarding, the to-be-transmitted message that cannot be successfully matched with the flow table already occupied by the virtual machine needs to learn to generate a new kernel-state flow table in the user space, and send it to the kernel to be occupied by the virtual machine. This will cause the number of flow tables occupied by the virtual machine to increase. Therefore, the to-be-transmitted message that cannot be successfully matched with the flow table already occupied by the virtual machine can be discarded. Without a message to learn to generate a new flow table for sending, the number of kernel-state flow tables occupied by the virtual machine will not increase, so that the number of kernel-state flow tables occupied by the virtual machine does not exceed the preset threshold.

[0073] In this exemplary embodiment, discarding the to-be-transmitted message containing the address indicating the virtual machine may be discarding all to-be-transmitted messages containing the address indicating the virtual machine. When the number of flow tables occupied by the virtual machine is less than a preset threshold, the message can learn that the new flow table is occupied by the virtual machine.

[0074] At the same time, the kernel-state flow tables occupied by the virtual machine that have not been matched by packets for a period of time exceeding the preset time length are cleared, that is, the aged old flow tables are cleared. In this way, the number of flow tables occupied by the virtual machine is less than or equal to the preset threshold. When the number of flow tables occupied by the virtual machine is less than the preset threshold, a new flow table can be learned and occupied.

[0075] In this exemplary embodiment, the preset time length can be any value between 300 and 500 seconds, that is, the flow table aging time is configured to be any value between 300 and 500 seconds. When the flow table is not hit by a message (i.e., not matched successfully) for more than the preset time length, the flow table will be aged and deleted.

[0076] In some embodiments, before monitoring whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold, the method includes:

[0077] According to the service type processed by the virtual machine, a preset threshold corresponding to the number of flow tables required to process the service type is set.

[0078] For example, different virtual machines process different types of services, and some virtual machines process data services that require more flow tables. At this time, the preset thresholds corresponding to these virtual machines can be set to be larger as needed. For example, when a virtual machine processes WEB services, a large number of Internet terminals will come to access it. At this time, processing this data service requires occupying more kernel-state flow tables. For virtual machines that process this type of service, the corresponding preset thresholds can be appropriately set to be larger to ensure the normal business needs of the virtual machines. For example, the total number of kernel-state flow tables is 200,000. When a virtual machine processes WEB services, it needs to occupy 80,000 kernel-state flow tables. Then, as needed, the preset threshold corresponding to the virtual machine that processes WEB services can be set to 80,000 to ensure the normal business needs of the virtual machine.

[0079] In some embodiments, the monitoring of whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold value comprises:

[0080] According to the ratio between the number of cores of each virtual machine and the total number of kernel state flow tables, a preset threshold corresponding to each virtual machine is set.

[0081] In this exemplary embodiment, each virtual machine may have a different number of cores, resulting in different data processing capabilities of each virtual machine. A virtual machine with more cores has a higher ability to process data, and its corresponding preset threshold can also be appropriately set to be larger. For example, the total number of kernel state flow tables is 200,000. OVS contains 7 virtual machines, namely VM1 to VM7. The kernel ratio corresponding to VM1 to VM7 is 3:2:1:1:1:1:1. The preset threshold ratio corresponding to VM1 to VM7 can also be 3:2:1:1:1:1:1. The preset thresholds corresponding to VM1 to VM7 are: 60,000, 40,000, 20,000, 20,000, 20,000, 20,000, and 20,000, respectively.

[0082] In some embodiments, before the monitoring virtual machine's occupied kernel flow table number reaches a preset threshold, the method includes:

[0083] Based on the ratio between the number of ports corresponding to each virtual machine and the total number of kernel state flow tables, a preset threshold corresponding to each virtual machine is set.

[0084] In this exemplary embodiment, there may be a virtual machine with multiple ports, or multiple virtual machines may have multiple ports. In either case, the preset threshold corresponding to each virtual machine can be set based on the ratio between the number of ports corresponding to each virtual machine and the total number of kernel-state flow tables. For example, the total number of kernel-state flow tables is 200,000. OVS contains 8 virtual machines, namely VM1 to VM8. Among them, virtual machine VM1 has 3 ports, and the remaining virtual machines have 1 port. At this time, the port ratio corresponding to VM1 to VM8 is 3:1:1:1:1:1:1:1:1. The preset threshold ratio corresponding to VM1 to VM8 can also be 3:1:1:1:1:1:1:1:1. The preset thresholds corresponding to VM1 to VM8 are: 60,000, 20,000, 20,000, 20,000, 20,000, 20,000, 20,000, and 20,000, respectively. Or,

[0085] For example, the total number of kernel flow tables is 200,000. OVS contains 8 virtual machines, namely VM1 to VM7. Among them, virtual machine VM1 has 3 ports, virtual machine VM2 has 2 ports, and the remaining virtual machines have 1 port. At this time, the port ratio corresponding to VM1 to VM7 is 3:2:1:1:1:1:1. The preset threshold ratio corresponding to VM1 to VM7 can also be 3:2:1:1:1:1:1. The preset thresholds corresponding to VM1 to VM7 are: 60,000, 40,000, 20,000, 20,000, 20,000, 20,000, and 20,000. In this way, each port can occupy the kernel flow table evenly.

[0086] The control method for virtual machine flow table occupation provided by the present disclosure adds a port-based flow table statistics function in the virtual switch, and limits the number of flow tables that each port can learn based on this statistical information. By limiting the number of flow tables that a port can learn, the traffic on this port is indirectly controlled to perform flow control, which can effectively defend against attacks and traffic bursts. When individual virtual machines are attacked, hijacked and actively attack others, or traffic bursts occur, only individual virtual machines will be affected. Other virtual machine services under the same host machine will not be affected.

[0087] Figure 3 A virtual machine software architecture and data forwarding process diagram according to an exemplary embodiment Figure 1 .

[0088] The data forwarding process includes:

[0089] Step 1: The message to be transmitted is input from the network card port, and the kernel flow table is queried. If a flow table matching the message is found, it is directly forwarded to the message in the kernel;

[0090] Step 2: If no kernel-mode flow table matching the message is found, the message is transferred to the user space to match the user-mode flow table;

[0091] Step 3: Generate an accurate kernel flow table;

[0092] Step 4: Send the generated kernel state flow table to the kernel;

[0093] Step 5: Send the message back to the kernel;

[0094] Step 6: Query the kernel flow table again to perform flow table matching;

[0095] Step 7: The message successfully matches the kernel flow table and is forwarded.

[0096] Figure 4 A virtual machine software architecture and data forwarding process diagram according to an exemplary embodiment Figure 2 .like Figure 4 As shown in the figure, when the flow table is sent to the flow table, the port indication field flow_port_stats[MAX_PORT_NUM] is added to the flow table; when each flow table corresponding to the virtual machine port is sent, flow_port_stats[in_port] is increased by 1. When the flow table is aged due to a long period of time without packet hits, flow_port_stats[in_port] is reduced by 1. Therefore, the number of sent flow tables corresponding to each virtual machine port can be counted through the flow_port_stats[MAX_PORT_NUM] field. Based on this statistical information, the kernel state flow table resources that each virtual machine can occupy can be controlled.

[0097] The data forwarding process includes:

[0098] Step 1: When the message to be transmitted is input from the network card port, the kernel flow table is queried. If a flow table matching the message is found, the message is directly forwarded in the kernel; if no flow table is found, the number of flow tables occupied by the forwarding port corresponding to the message is queried; if the number of flow tables reaches the preset threshold, the message is abandoned;

[0099] Step 2: If it is found that the number of flow tables occupied by the forwarding port corresponding to the message does not reach the preset threshold, the message is transferred to the user space to match the user state flow table;

[0100] Step 3: Generate an accurate kernel flow table;

[0101] Step 4: Send the generated kernel state flow table to the kernel;

[0102] Step 5: Send the message back to the kernel;

[0103] Step 6: Query the kernel flow table again to perform flow table matching;

[0104] Step 7: The message successfully matches the kernel flow table and is forwarded.

[0105] On the other hand, the present disclosure provides a control device for a virtual machine occupation flow table. Figure 5 FIG. 1 is a schematic diagram of a control device structure of a virtual machine occupying a flow table according to an exemplary embodiment. Figure 5 As shown, the control device for a virtual machine occupying a flow table provided in an embodiment of the present disclosure includes:

[0106] The first processing unit 51 is used to monitor whether the number of kernel state flow tables occupied by the virtual machine reaches a preset threshold;

[0107] The second processing unit 52 is used to, when the number of kernel-state flow tables occupied by at least one of the virtual machines reaches the preset threshold, make the number of kernel-state flow tables occupied by the virtual machines less than or equal to the preset threshold based on a limit operation; wherein the limit operation is used to limit the number of kernel-state flow tables occupied by the virtual machines that reach the preset threshold.

[0108] In this exemplary embodiment, there can be multiple virtual machines. At the same time, the number of kernel-state flow tables occupied by each virtual machine is monitored to determine whether the number of kernel-state flow tables occupied by a virtual machine reaches a preset threshold. The preset threshold is set in OVS to limit the maximum number of kernel-state flow tables that each virtual machine can occupy. For example, the kernel-state flow table configuration in OVS is 200,000. In order to balance the kernel-state flow tables that can be occupied by each virtual machine, prevent individual virtual machines from occupying a large number of flow tables, and take into account the situation where some large connections occur, the preset threshold can be set to 50,000, so that when a single virtual machine can handle a limited burst connection, it can ensure that other virtual machines have flow tables available, thereby avoiding the discarding of new traffic from other virtual machines due to the inability to occupy flow tables.

[0109] In this exemplary embodiment, the number of kernel-state flow tables occupied by virtual machines is monitored by the first processing unit. When the second processing unit determines that the number of kernel-state flow tables occupied by at least one of the virtual machines reaches a preset threshold, the number of kernel-state flow tables occupied by the virtual machines that have reached the preset threshold is limited by a limit operation, so that the number of kernel-state flow tables occupied by the virtual machines is less than or equal to the preset threshold. This allows multiple virtual machines to share a storage space for storing a limited number of kernel-state flow tables, so that each virtual machine can have kernel-state flow tables available, thereby improving the situation where a virtual machine encounters an emergency (such as being attacked by other servers, or being hijacked to actively attack other servers), resulting in a sudden increase in messages and a large number of flow tables being consumed, resulting in no flow tables available for other virtual machines, thereby improving the system communication quality.

[0110] In some embodiments, the virtual machine has at least one port; wherein the kernel state flow table comprises: a port indication field; the port indication field indicates the port corresponding to the kernel state flow table;

[0111] The first processing unit is used to monitor whether the number of kernel state flow tables occupied by the virtual machine reaches a preset threshold, including:

[0112] The first processing unit is specifically configured to count the number of kernel-mode flow tables respectively occupied by each port of the virtual machine based on the port indication field.

[0113] In this exemplary embodiment, in order to solve the problem that the kernel-mode flow table is easily occupied by a few virtual machines, a port indication field flow_port_stats[MAX_PORT_NUM] can be added when the flow table is downloaded to the flow table. Statistics are performed based on the in_port field in the newly created flow table. That is, when a flow table corresponding to each virtual machine port is downloaded, flow_port_stats[in_port] is increased by 1. When the flow table has not been hit by a message for a long time and is aged, flow_port_stats[in_port] is reduced by 1. Therefore, the number of sent flow tables corresponding to each virtual machine port can be counted through the flow_port_stats[MAX_PORT_NUM] field. Based on this statistical information, the kernel-mode flow table resources that each virtual machine can occupy can be controlled. For example, the maximum limit of a port on OVS is 50,000 flow tables. When the virtual machine VM1 is attacked by the network and the flow table increases suddenly, since a maximum of 50,000 flow tables are configured for each port, the 50001st flow attacking VM1 is directly discarded because the flow table cannot be learned. That is, when the 50001th flow of VM1 comes in, it is found that the number of flow tables on the corresponding port of VM1 has reached 50000, so the message is discarded and the flow table matching message is no longer forwarded.

[0114] In some embodiments, the second processing unit is configured to make the number of kernel-mode flow tables occupied by the virtual machine less than or equal to the preset threshold based on the limit operation, including:

[0115] The second processing unit is specifically configured to make the number of kernel-mode flow tables occupied by each virtual machine port less than or equal to the preset threshold if each virtual machine has one port;

[0116] If there is a virtual machine with multiple ports, the total number of kernel-mode flow tables occupied by the ports in the virtual machine with multiple ports is made smaller than or equal to the preset threshold.

[0117] In this exemplary embodiment, when monitoring the number of kernel-state flow tables occupied by each virtual machine, the number of kernel-state flow tables occupied by each port in each virtual machine can be monitored. When limiting the number of kernel-state flow tables occupied by virtual machines, the number of kernel-state flow tables occupied by each virtual machine port can be limited. When each virtual machine has one port, the number of kernel-state flow tables occupied by each virtual machine port is limited to be less than or equal to a preset threshold. For example, the kernel-state flow table configuration in OVS is 200,000, and the maximum number of occupied flow tables for each port can be configured to be 50,000, that is, the preset threshold is 50,000. When the kernel-state flow table occupied by any port reaches 50,000, the port will no longer increase the flow table occupancy.

[0118] When a virtual machine among multiple virtual machines has multiple ports, all the multiple ports of the virtual machine can forward packets and occupy flow tables. When limiting the number of kernel-mode flow tables occupied by a virtual machine, multiple ports can be limited to have the same maximum number of occupied flow tables, and the sum of the number of flow tables occupied by multiple ports is less than or equal to the preset threshold. For example, if virtual machine VM1 has 2 ports, each port can be limited to occupy a maximum of 25,000 flow tables.

[0119] In some embodiments, the limit operation includes:

[0120] discarding the message to be transmitted containing the address indicating the virtual machine, and / or,

[0121] Clear the kernel-state flow tables occupied by the virtual machine, the kernel-state flow tables that have not been matched by packets for a period exceeding a preset time length.

[0122] In this exemplary embodiment, the virtual machine address may be the IP address of the virtual machine. The message to be transmitted is forwarded by the corresponding virtual machine port according to the IP address contained therein. Before forwarding, the message needs to match the kernel state flow table. When the match succeeds, the message is forwarded. If the match fails, the user state flow table is matched in the user space, and the corresponding kernel state flow table is generated and sent to the kernel, that is, the new kernel state flow table is learned and generated and occupied by the virtual machine.

[0123] In order to prevent individual virtual machines from occupying a large number of kernel-state flow tables and over-consuming flow table resources, when the number of kernel-state flow tables occupied by a virtual machine reaches a preset threshold, the transmission message forwarded through the virtual machine port can be discarded. At the same time, the kernel-state flow tables occupied by the virtual machine that have not been matched by messages for a time length exceeding the preset time length are cleared, that is, the aged flow tables are cleared. In this way, the number of flow tables occupied by the virtual machine is less than or equal to the preset threshold. When the number of flow tables occupied by the virtual machine is less than the preset threshold, new message forwarding can be performed, occupying new flow tables.

[0124] In some embodiments, before monitoring whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold, the first processing unit is also used to set a preset threshold corresponding to the number of flow tables required to process the business type processed by the virtual machine.

[0125] For example, different virtual machines process different types of services, and some virtual machines process data services that require more flow tables. At this time, the preset thresholds corresponding to these virtual machines can be set to be larger as needed. For example, when a virtual machine processes WEB services, a large number of Internet terminals will come to access it. At this time, processing this data service requires occupying more kernel-state flow tables. For virtual machines that process this type of service, the corresponding preset thresholds can be appropriately set to be larger to ensure the normal business needs of the virtual machines. For example, the total number of kernel-state flow tables is 200,000. When a virtual machine processes WEB services, it needs to occupy 80,000 kernel-state flow tables. Then, as needed, the preset threshold corresponding to the virtual machine that processes WEB services can be set to 80,000 to ensure the normal business needs of the virtual machine.

[0126] In some embodiments, before the number of kernel-state flow tables occupied by the monitoring virtual machine reaches a preset threshold, the first processing unit is also used to set a preset threshold corresponding to each virtual machine based on the ratio between the number of ports corresponding to each virtual machine and the total number of kernel-state flow tables.

[0127] In this exemplary embodiment, there may be a virtual machine with multiple ports, or multiple virtual machines may have multiple ports. In either case, the preset threshold corresponding to each virtual machine can be set based on the ratio between the number of ports corresponding to each virtual machine and the total number of kernel-state flow tables. For example, the total number of kernel-state flow tables is 200,000. OVS contains 8 virtual machines, namely VM1 to VM8. Among them, virtual machine VM1 has 3 ports, and the remaining virtual machines have 1 port. At this time, the port ratio corresponding to VM1 to VM8 is 3:1:1:1:1:1:1:1:1. The preset threshold ratio corresponding to VM1 to VM8 can also be 3:1:1:1:1:1:1:1:1. The preset thresholds corresponding to VM1 to VM8 are: 60,000, 20,000, 20,000, 20,000, 20,000, 20,000, 20,000, and 20,000, respectively. Or,

[0128] For example, the total number of kernel flow tables is 200,000. OVS contains 8 virtual machines, namely VM1 to VM7. Among them, virtual machine VM1 has 3 ports, virtual machine VM2 has 2 ports, and the remaining virtual machines have 1 port. At this time, the port ratio corresponding to VM1 to VM7 is 3:2:1:1:1:1:1. The preset threshold ratio corresponding to VM1 to VM7 can also be 3:2:1:1:1:1:1. The preset thresholds corresponding to VM1 to VM7 are: 60,000, 40,000, 20,000, 20,000, 20,000, 20,000, and 20,000. In this way, each port can occupy the kernel flow table evenly.

[0129] The present disclosure also provides a terminal. Figure 6 FIG. 1 is a schematic diagram of a terminal structure according to an exemplary embodiment. Figure 6 As shown, the terminal provided by the embodiment of the present disclosure includes: a processor 630 and a memory 620 for storing a computer program that can be run on the processor, wherein the processor 630 is used to execute the steps of the method provided in the above embodiments when running the computer program.

[0130] The present disclosure also provides a computer-readable storage medium. The computer-readable storage medium provided in the embodiments of the present disclosure stores a computer program, which, when executed by a processor, implements the steps of the method provided in the above embodiments.

[0131] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0132] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0133] In addition, all functional units in the embodiments of the present invention may be integrated into one processing module, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0134] In some cases, if any two of the above technical features do not conflict with each other, they can be combined into a new method technical solution.

[0135] In some cases, if any two of the above technical features do not conflict with each other, they can be combined into a new equipment technical solution.

[0136] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks or optical disks, etc., various media that can store program codes.

[0137] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for controlling a virtual machine's occupation of a flow table, characterized in that: The method comprises: Monitoring whether the number of kernel state flow tables occupied by the virtual machine reaches a preset threshold; wherein the number is determined by a port indication field in the kernel state flow table; When the number of kernel-state flow tables occupied by at least one of the virtual machines reaches the preset threshold, based on the limit operation, the number of kernel-state flow tables occupied by the virtual machines is made less than or equal to the preset threshold; wherein the limit operation is used to limit the number of kernel-state flow tables occupied by the virtual machines that reach the preset threshold, and includes discarding the to-be-transmitted messages containing the addresses indicating the virtual machines, and / or clearing the kernel-state flow tables in the kernel-state flow tables occupied by the virtual machines that have not been matched by messages for a time length exceeding the preset time length.

2. The method for controlling the virtual machine occupation flow table according to claim 1, characterized in that: The virtual machine has at least one port; wherein the kernel state flow table comprises: a port indication field; the port indication field indicates the port corresponding to the kernel state flow table; The monitoring of whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold includes: Based on the port indication field, the number of kernel state flow tables respectively occupied by each port of the virtual machine is counted.

3. The method for controlling the virtual machine occupation flow table according to claim 2, characterized in that: The limit-based operation makes the number of kernel-mode flow tables occupied by the virtual machine less than or equal to the preset threshold, including: If each of the virtual machines has one port, the number of kernel-mode flow tables occupied by each virtual machine port is made less than or equal to the preset threshold; If there is a virtual machine with multiple ports, the total number of kernel state flow tables occupied by each port in the virtual machine with multiple ports is made less than or equal to the preset threshold.

4. The method for controlling the virtual machine occupation flow table according to claim 1, characterized in that: Before the monitoring virtual machine's occupied kernel flow table number reaches a preset threshold, the method includes: According to the service type processed by the virtual machine, a preset threshold corresponding to the number of flow tables required to process the service type is set.

5. A control device for a virtual machine occupying a flow table, characterized in that: include: A first processing unit, configured to monitor whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold; wherein the number is determined by a port indication field in the kernel-mode flow table; The second processing unit is used to, when the number of kernel-state flow tables occupied by at least one of the virtual machines reaches the preset threshold, make the number of kernel-state flow tables occupied by the virtual machines less than or equal to the preset threshold based on a limit operation; wherein the limit operation is used to limit the number of kernel-state flow tables occupied by the virtual machines that reach the preset threshold, and includes discarding the to-be-transmitted messages containing the addresses indicating the virtual machines, and / or clearing the kernel-state flow tables occupied by the virtual machines that have not been matched by messages for a time length exceeding a preset time length.

6. The control device for virtual machine occupation flow table according to claim 5, characterized in that: The virtual machine has at least one port; wherein the kernel state flow table comprises: a port indication field; the port indication field indicates the port corresponding to the kernel state flow table; The first processing unit is used to monitor whether the number of kernel state flow tables occupied by the virtual machine reaches a preset threshold, including: The first processing unit is specifically configured to count the number of kernel-mode flow tables respectively occupied by each port of the virtual machine based on the port indication field.

7. The control device for virtual machine occupation flow table according to claim 6, characterized in that: The second processing unit is used to make the number of kernel state flow tables occupied by the virtual machine less than or equal to the preset threshold based on the limit operation, including: The second processing unit is specifically configured to make the number of kernel-mode flow tables occupied by each virtual machine port less than or equal to the preset threshold if each virtual machine has one port; If there is a virtual machine with multiple ports, the total number of kernel state flow tables occupied by each port in the virtual machine with multiple ports is made less than or equal to the preset threshold.

8. The control device for virtual machine occupation flow table according to claim 7, characterized in that: Before monitoring whether the number of kernel-mode flow tables occupied by the virtual machine reaches a preset threshold, the first processing unit is further used to set a preset threshold corresponding to the number of flow tables required to process the business type according to the business type processed by the virtual machine.

9. A terminal, characterized in that: include: A processor and a memory for storing a computer program that can be run on the processor, wherein the processor executes the steps of the method according to any one of claims 1 to 4 when running the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images