A flow redirection method and apparatus, an electronic device, and a storage medium

Abstract

The application provides a flow redirection method and device, electronic equipment and storage medium. The method comprises the following steps: obtaining a flow message sent by a first virtual machine to a second virtual machine through a hook function in a virtual network device; and redirecting the flow message to a target object, so that the target object processes the flow message. The virtual network device is used for mutual communication between the first virtual machine and the second virtual machine. Since the virtual machines on the same host machine directly communicate with each other through the virtual network device, the flow message between the virtual machines is obtained and redirected through the hook function in the virtual network device, thereby avoiding the problem that the flow message between the virtual machines cannot pass through the physical network device to be redirected by the physical network device, and thus the flow message between the virtual machines can be effectively redirected through the hook function in the virtual network device.

Description

Technical Field

[0001] This application relates to the technical fields of cloud computing, cloud security, and virtual machines, and more specifically, to a traffic redirection method, apparatus, electronic device, and storage medium. Background Technology

[0002] A virtual machine (VM) is a special type of software in computer science. A virtual machine can create an environment between a computer platform and the end user, and the end user operates the software based on the environment created by the virtual machine. A virtual machine can run computer software programs just like a real machine.

[0003] Current traffic redirection methods mostly redirect traffic packets within the physical network. For example, after a physical network device receives a traffic packet from the communication network, it redirects the traffic packet by configuring flow table forwarding rules or port mirroring. However, in practice, it has been found that since traffic packets between virtual machines on the same host do not pass through physical network devices, it is difficult to redirect traffic packets between virtual machines on the same host. Summary of the Invention

[0004] The purpose of this application is to provide a traffic redirection method, apparatus, electronic device, and storage medium to improve the problem of difficulty in redirecting traffic packets between virtual machines on the same host.

[0005] This application provides a traffic redirection method, comprising: obtaining traffic packets sent from a first virtual machine to a second virtual machine through a hook function in a virtual network device; redirecting the traffic packets to a target object so that the target object can process the traffic packets; and using the virtual network device for communication between the first and second virtual machines. In the implementation of the above scheme, since virtual machines on the same host communicate directly with each other through a virtual network device, obtaining and redirecting traffic packets between virtual machines through a hook function in the virtual network device avoids the problem of traffic packets between virtual machines not passing through a physical network device, thus preventing the use of the physical network device for redirecting traffic packets. Therefore, it is possible to effectively redirect traffic packets between virtual machines through a hook function in the virtual network device.

[0006] Optionally, in this embodiment, obtaining traffic packets sent from the first virtual machine to the second virtual machine through a hook function in the virtual network device includes: determining whether the traffic packets pass through the user space corresponding to the virtual network device, where the user space is a shared memory space between the first and second virtual machines; if so, intercepting the traffic packets using the hook function in the virtual network device. In the implementation of the above scheme, since the user space corresponding to the virtual network device is a necessary path between virtual machines on the same host, the hook function in the virtual network device can be used to obtain and redirect traffic packets between virtual machines, thereby completing the function of redirecting traffic packets between virtual machines.

[0007] Optionally, in this embodiment, intercepting traffic packets using a hook function in the virtual network device includes: calling the hook function through the OpenVSwitch runtime in the virtual network device to intercept traffic packets passing through the user space. In the implementation of the above scheme, since the hook function can be obtained by modifying the source code of the OpenVSwitch runtime, and the dp_netdev_process_rxq_port function in the OpenVSwitch runtime's source code is the user space path that all traffic packets passing through the virtual network device (e.g., the OpenvSwitch virtual bridge) must traverse, it is possible to obtain and redirect traffic packets between virtual machines through the hook function in the virtual network device, thereby completing the function of redirecting traffic packets between virtual machines.

[0008] Optionally, in this embodiment, the target object is a virtualized firewall; redirecting traffic packets to the target object includes: using a virtual network device to redirect traffic packets to the virtualized firewall; and performing security filtering on the traffic packets through the virtualized firewall. In the implementation of the above scheme, by using a virtual network device to redirect traffic packets to the virtualized firewall and performing security filtering on the traffic packets through the virtualized firewall, the problem of not being able to perform security filtering on traffic packets communicating between virtual machines is avoided, effectively improving the security of traffic packets communicating between virtual machines.

[0009] Optionally, in this embodiment, security filtering of traffic packets is performed through a virtualized firewall, including: determining whether the security policy processing action corresponding to the traffic packet is to discard it; if so, the traffic packet is discarded through the virtualized firewall; otherwise, the traffic packet is forwarded through the virtualized firewall. In the implementation of the above scheme, by discarding the traffic packet through the virtualized firewall when the security policy processing action corresponding to the traffic packet is to discard it, the problem of not being able to discard traffic packets used for communication between virtual machines is avoided, effectively improving the security of traffic packets used for communication between virtual machines.

[0010] Optionally, in this embodiment, the target object is a security protection virtual machine; redirecting traffic packets to the target object includes: using a virtual network device to redirect traffic packets to the security protection virtual machine; and performing security detection and protection on the traffic packets through the security protection virtual machine. In the implementation of the above scheme, by using a virtual network device to redirect traffic packets to the security protection virtual machine, and by performing security detection and protection on the traffic packets through the security protection virtual machine, the problem of not being able to perform security detection and protection on traffic packets communicating between virtual machines is avoided, effectively improving the security of traffic packets communicating between virtual machines.

[0011] Optionally, in this embodiment of the application, the virtual network device includes: a virtual bridge; redirecting traffic packets to the security protection virtual machine using the virtual network device includes: redirecting traffic packets to the security protection virtual machine using the virtual bridge.

[0012] This application also provides a traffic redirection device, including: a traffic packet acquisition module, used to acquire traffic packets sent from a first virtual machine to a second virtual machine through a hook function in a virtual network device; and a packet redirection module, used to redirect the traffic packets to a target object so that the target object can process the traffic packets, wherein the virtual network device is used for communication between the first virtual machine and the second virtual machine.

[0013] Optionally, in this embodiment, the traffic packet acquisition module includes: a traffic packet judgment submodule, used to determine whether the traffic packet passes through the user space corresponding to the virtual network device, wherein the user space is a memory space shared by the first virtual machine and the second virtual machine; and a traffic packet interception submodule, used to intercept the traffic packet using a hook function in the virtual network device if the traffic packet passes through the user space corresponding to the virtual network device.

[0014] Optionally, in this embodiment of the application, the traffic packet acquisition submodule includes: a hook function calling unit, used to call a hook function through the OpenVSwitch runtime in the virtual network device to intercept traffic packets passing through the user space.

[0015] Optionally, in this embodiment, the target object is a virtualized firewall; the packet redirection module includes: a first redirection submodule, used to redirect traffic packets to the virtualized firewall using a virtual network device; and a traffic security filtering submodule, used to perform security filtering on the traffic packets through the virtualized firewall.

[0016] Optionally, in this embodiment of the application, the traffic security filtering submodule includes: a traffic packet judgment unit, used to judge whether the security policy processing action corresponding to the traffic packet is to discard it; and a traffic packet processing unit, used to discard the traffic packet through the virtualized firewall if the security policy processing action corresponding to the traffic packet is to discard it, otherwise to forward the traffic packet through the virtualized firewall.

[0017] Optionally, in this embodiment, the target object is a security protection virtual machine; the packet redirection module includes: a second redirection submodule, used to redirect traffic packets to the security protection virtual machine using a virtual network device; and a traffic detection and protection submodule, used to perform security detection and security protection on the traffic packets through the security protection virtual machine.

[0018] Optionally, in this embodiment of the application, the virtual network device includes: a virtual bridge; the second redirection submodule includes: a traffic redirection unit, used to redirect traffic packets to the security protection virtual machine using the virtual bridge.

[0019] This application also provides an electronic device, including a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the machine-readable instructions, when executed by the processor, perform the method described above.

[0020] This application also provides a computer-readable storage medium storing a computer program that is executed by a processor to perform the methods described above.

[0021] Other features and advantages of embodiments of this application will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing embodiments of this application. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 The flowchart shown is a schematic diagram of the traffic redirection method provided in an embodiment of this application;

[0024] Figure 2 The diagram illustrates the processing flow of traffic packets provided in the embodiments of this application.

[0025] Figure 3 The diagram shown illustrates the network connection of a centrally managed cloud platform provided in an embodiment of this application.

[0026] Figure 4 The diagram shown is a structural schematic of the traffic redirection device provided in an embodiment of this application;

[0027] Figure 5 The diagram shows a structural schematic of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. The components of the embodiments of this application described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed embodiments of this application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of the embodiments of this application.

[0029] It is understood that the terms "first" and "second" in the embodiments of this application are used to distinguish similar objects. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that the terms "first" and "second" are not necessarily different.

[0030] Before introducing the traffic redirection method provided in the embodiments of this application, let's first introduce some concepts involved in the embodiments of this application:

[0031] Server virtualization refers to the process of abstracting a physical server into multiple virtual machines using software and hardware technologies. Each virtual machine can have an operating system installed and is logically isolated from the others, but these virtual machines share various resources of the same physical server (such as CPU, memory, and storage).

[0032] The Data Plane Development Kit (DPDK), also known as the Data Plane Development Package, refers to a series of libraries that accelerate data packet load processing and run on a multi-CPU architecture.

[0033] It should be noted that the traffic redirection method provided in this application can be executed by an electronic device. Here, an electronic device refers to a device terminal or server with the function of executing computer programs. Device terminals include, for example, smartphones, personal computers, tablets, personal digital assistants, or mobile internet devices. A server refers to a device that provides computing services through a network. Servers include, for example, x86 servers and non-x86 servers. Non-x86 servers include, for example, mainframes, minicomputers, and UNIX servers.

[0034] The following describes the application scenarios applicable to this traffic redirection method. These scenarios include, but are not limited to, server virtualization and cloud platforms. In server virtualization, this traffic redirection method can be used to intercept and redirect traffic packets between virtual machines on the same host. Traditionally, traffic packets sent between multiple virtual machines on the same physical server are obtained by configuring OpenVSwitch flow table forwarding rules. However, this method alters the network topology of electronic devices (e.g., devices in a cloud platform). If the cloud platform itself is also configured with OpenVSwitch flow table forwarding rules to implement its business functions, this method will affect those functions. Therefore, by using hook functions set in virtual network devices to intercept traffic packets sent between virtual machines, the impact on the forwarding rules (e.g., OpenVSwitch flow table rules) configured in the electronic or virtual network device can be avoided, thus preventing the business functions of the cloud platform hosting the electronic device from being affected.

[0035] Please see Figure 1 The illustrated flowchart illustrates the traffic redirection method provided in this application embodiment. The main idea of ​​this traffic redirection method is that, since communication traffic packets between virtual machines on the same host machine inevitably pass through virtual network devices, the traffic packets sent between virtual machines can be intercepted through hook functions set in the virtual network device (these hook functions can be functions added to the OpenVSwitch source code for intercepting traffic packets), and then the traffic packets can be redirected. The implementation of the above traffic redirection method may include:

[0036] Step S110: Obtain the traffic packets sent from the first virtual machine to the second virtual machine through the hook function in the virtual network device.

[0037] Please see Figure 2 The diagram illustrates the traffic packet processing flow provided in this application embodiment. The aforementioned virtual network device can be a virtual bridge of OpenVSwitch (represented as br0). This virtual network device can be configured with three veth type virtual network cards, including veth0, veth1, and veth2. Among them, veth0 is the virtual network card that virtual machine 1 is bridged to the virtual network device through a virtual Ethernet card (Eth-0). Similarly, veth1 is the virtual network card that virtual machine 2 is bridged to the virtual network device through a virtual Ethernet card (Eth-0). veth2 is the virtual network card that the management channel network card of the target object (i.e., the virtualized firewall or security protection virtual machine) is bridged to the virtual network device.

[0038] Both the first and second virtual machines mentioned above can be virtual machines based on the OpenVSwitch-Data Plane Development Kit (OVS-DPDK) network architecture. Therefore, the traffic packets (also known as data packets) mentioned above are traffic packets between virtual machines based on the OVS-DPDK network architecture. The hook functions set in the virtual network device can be used to intercept the traffic packets sent between virtual machines and then redirect the traffic packets.

[0039] Step S120: Redirect the traffic packets to the target object so that the target object can process the traffic packets. The virtual network device is used for communication between the first virtual machine and the second virtual machine.

[0040] The target object refers to the device used to process traffic packets. This target object can be a virtualized firewall or a security protection virtual machine. It can include four virtual network interfaces: eth0, eth1, eth2, and eth3. eth0 is the virtual network interface that serves as the management channel, and it is bridged on an OpenvSwitch virtual bridge. eth1 is the virtual network interface for incoming traffic from the service virtual machine, and it is bridged on an OpenvSwitch virtual bridge named inbr. eth2 is the virtual network interface for outgoing traffic from the service virtual machine, and it is bridged on an OpenvSwitch virtual bridge named outbr. eth3 is the virtual network interface that serves as the interaction channel with the packet redirection driver, and it is bridged on an OpenvSwitch virtual bridge named chlbr.

[0041] The four virtual network cards of the aforementioned virtualized firewall can be bound to different virtual bridges, so that the traffic packets sent by the target object (including the virtualized firewall or security protection virtual machine) can be intercepted and processed by the packet redirection driver, and can also prevent the virtual network device (such as the virtual bridge) from broadcasting the destination Media Access Control (MAC) address, which would cause a broadcast loop.

[0042] In the above implementation process, since virtual machines on the same host communicate directly with each other through virtual network devices, the traffic packets between virtual machines are obtained and redirected through the hook functions in the virtual network devices. This avoids the problem that the traffic packets between virtual machines cannot be redirected by the physical network devices because they do not pass through the physical network devices. Therefore, the traffic packets between virtual machines can be effectively redirected through the hook functions in the virtual network devices.

[0043] Please see Figure 3 The diagram illustrates a network connection of a centrally managed cloud platform according to an embodiment of this application. The cloud platform may include multiple electronic devices, which may include a first electronic device and a second electronic device. In the application scenario of a centrally managed cloud platform (also known as a centralized management platform), a packet redirection driver can be installed and deployed on each electronic device (which can act as a host or a compute node) within the cloud platform. This packet redirection driver is used to redirect traffic packets on business virtual machines (including the aforementioned first and second virtual machines). Similarly, a virtualized firewall virtual machine can be installed and deployed on each electronic device (which can act as a host or a compute node) within the cloud platform. The virtualized firewall communicates with the packet redirection driver, which runs within the OVS-DPDK network architecture environment.

[0044] As an optional implementation of step S110 above, obtaining traffic packets sent from the first virtual machine to the second virtual machine through a hook function in the virtual network device includes:

[0045] Step S111: Determine whether the traffic packet passes through the user space corresponding to the virtual network device. The user space is the memory space shared by the first virtual machine and the second virtual machine.

[0046] For example, the implementation of step S111 above can be achieved by using the virtual bridge of OpenVSwitch to determine whether the traffic packet passes through the user space corresponding to the virtual network device. The user space is the memory space shared by the first virtual machine and the second virtual machine.

[0047] Step S112: If the traffic packet passes through the user space corresponding to the virtual network device, the hook function in the virtual network device is used to intercept the traffic packet.

[0048] For example, in implementing step S112 above: if a traffic packet passes through the user space corresponding to the virtual network device, a hook function is called by the OpenVSwitch runtime in the virtual network device to intercept the traffic packet passing through the user space. Specifically, this hook function can be obtained by modifying the source code of the OpenVSwitch runtime. The dp_netdev_process_rxq_port function in the source code of the OpenVSwitch runtime is the user space path that all traffic packets passing through the virtual network device (e.g., the openvSwitch virtual bridge) must pass through. Therefore, a hook function can be inserted into the dp_netdev_process_rxq_port function, and this hook function can complete the function of intercepting all traffic packets passing through the virtual network device (e.g., the openvSwitch virtual bridge).

[0049] As an optional implementation of step S120 above, the target object may be a virtualized firewall; the implementation of redirecting traffic packets to the target object may include:

[0050] Step S121: Use a virtual network device to redirect traffic packets to the virtualized firewall.

[0051] For example, the implementation of step S121 described above is as follows: After obtaining a traffic packet, the virtual network device first calculates the data packet characteristics of the traffic packet, and then determines whether a fast forwarding flow table entry matching the data packet characteristics of the traffic packet is found in the fast forwarding flow table. If a fast forwarding flow table entry matching the data packet characteristics of the traffic packet is found, the traffic packet is processed according to the flow table entry forwarding rule corresponding to the fast forwarding flow table entry. If no fast forwarding flow table entry matching the data packet characteristics is found, the traffic packet is redirected to the virtualized firewall. The fast forwarding flow table entry may include: data packet characteristics and flow table entry forwarding rules. The data packet characteristics may include: source MAC address, destination MAC address, virtual LAN identifier (VLAN ID), network layer protocol, source IP address, destination IP address, transport layer protocol, source port, destination port, and the session identifier (ID) of the associated connection, etc.

[0052] Step S122: Perform security filtering on traffic packets through a virtualized firewall.

[0053] For example, in implementing step S122 above, the virtualized firewall can receive traffic packets sent by electronic devices during redirection via Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). Then, based on a pre-configured security policy table, it detects the security policy processing action corresponding to the traffic packet and determines whether the security policy processing action corresponding to the traffic packet is secure. If the traffic packet is insecure, it can be filtered; conversely, if the traffic packet is secure, it can be forwarded directly.

[0054] As an optional implementation of step S122 above, the implementation of security filtering of traffic packets through a virtualized firewall may include:

[0055] Step S122a: Determine whether the security policy action corresponding to the traffic packet is to discard it.

[0056] An example implementation of step S122a above is as follows: an executable program compiled or interpreted using a preset programming language is used to determine whether the security policy processing action corresponding to the traffic packet is to drop it. The programming languages ​​that can be used include, for example, C, C++, Java, BASIC, JavaScript, LISP, Shell, Perl, Ruby, Python, and PHP, etc.

[0057] Step S122b: If the security policy action corresponding to the traffic packet is to drop it, then drop the traffic packet through the virtualization firewall.

[0058] Step S122c: If the security policy action corresponding to the traffic packet is not to discard it, then forward the traffic packet through the virtualized firewall.

[0059] For example, the implementation of steps S122b to S122c above is as follows: After matching the security policy using the traffic packet, if a security policy is matched, the security policy processing action is obtained. If it is determined that the security policy processing action corresponding to the traffic packet is to discard it, the traffic packet is discarded through the virtualization firewall. If it is determined that the security policy processing action corresponding to the traffic packet is not to discard it, the traffic packet is forwarded through the virtualization firewall so that the traffic packet is sent out from the traffic egress network card of the service virtual machine (including the first virtual machine and the second virtual machine).

[0060] Understandably, in practice, the virtual network device within the electronic device can periodically send heartbeat keep-alive packets to the virtualized firewall, prompting the virtualized firewall to return heartbeat keep-alive packets. The virtual network device can determine whether it has received the heartbeat keep-alive packets from the virtualized firewall within a preset time period; if it has not received the heartbeat keep-alive packets from the virtualized firewall within the preset time period, it enables the bypass function on the virtual network device, preventing it from sending redirected traffic packets to the virtualized firewall.

[0061] Specifically, the virtual network device can monitor the deregistration events of the inbound and outbound network interfaces (NICs) of the virtualized firewall's service virtual machine traffic. If it detects these deregistration events, it can disable the redirection function, preventing the virtual network device from sending redirected traffic packets to any target, thus avoiding the redirection function from still being active. Furthermore, the virtualized firewall can periodically construct heartbeat keep-alive packets and send them to the packet redirection driver, enabling the packet redirection driver to monitor the virtualized firewall's operational status.

[0062] As an optional implementation of step S120 above, the target object may be a security protection virtual machine; the implementation of redirecting traffic packets to the target object may include:

[0063] Step S123: Use a virtual network device to redirect traffic packets to the security protection virtual machine.

[0064] Since there are many ways to implement step S123, the implementation of step S123 will be described in detail below.

[0065] Step S124: Perform security detection and security protection on traffic packets through a security protection virtual machine.

[0066] For example, in the implementation of step S124 above, the virtual network device can receive traffic packets sent by electronic devices during redirection via TCP or UDP protocols. Then, based on a pre-set security policy configuration table, it detects the security policy processing action corresponding to the traffic packet and determines whether the security policy processing action corresponding to the traffic packet is secure. If the traffic packet is insecure, it can be filtered; conversely, if the traffic packet is secure, it can be directly forwarded, that is, the traffic packet is sent to the security protection virtual machine.

[0067] There are many ways to implement step S123 above, including but not limited to the following:

[0068] In a first optional implementation, the aforementioned virtual network device may include a virtual bridge; when using the virtual network device to redirect traffic packets, the virtual bridge can be used for redirection. This implementation may include:

[0069] Step S123a: Use a virtual bridge to redirect traffic packets to the security protection virtual machine.

[0070] For example, the implementation of step S123a above can be as follows: The virtual bridge can receive traffic packets sent by electronic devices during redirection via TCP or UDP protocols. Then, based on a pre-set security policy configuration table, it can detect the security policy processing action corresponding to the traffic packet and determine whether the security policy processing action corresponding to the traffic packet is secure. If the traffic packet is insecure, it can be filtered; conversely, if the traffic packet is secure, it can be directly forwarded, that is, the traffic packet can be sent to the security protection virtual machine.

[0071] In a second alternative implementation, the virtual network device described above may include a virtual switch; when using the virtual network device for traffic packet redirection, the virtual switch can be used for redirection, and this implementation may include:

[0072] Step S123b: Use a virtual switch to redirect traffic packets to the security protection virtual machine.

[0073] For example, in the implementation of step S123b above, the virtual switch can receive traffic packets sent by electronic devices during redirection via TCP or UDP protocols. Then, based on a pre-set security policy configuration table, it detects the security policy processing action corresponding to the traffic packet and determines whether the security policy processing action corresponding to the traffic packet is secure. If the traffic packet is insecure, it can be filtered; conversely, if the traffic packet is secure, it can be directly forwarded, that is, the traffic packet is sent to the security protection virtual machine.

[0074] Please see Figure 4 The diagram shown is a structural schematic of a traffic redirection device provided in an embodiment of this application; this application provides a traffic redirection device 200, including:

[0075] The traffic packet acquisition module 210 is used to acquire traffic packets sent from the first virtual machine to the second virtual machine through hook functions in the virtual network device.

[0076] The message redirection module 220 is used to redirect traffic messages to a target object so that the target object can process the traffic messages. The virtual network device is used for communication between the first virtual machine and the second virtual machine.

[0077] Optionally, in this embodiment of the application, the traffic packet acquisition module includes:

[0078] The traffic packet judgment submodule is used to determine whether a traffic packet has passed through the user space corresponding to the virtual network device. The user space is the memory space shared by the first virtual machine and the second virtual machine.

[0079] The traffic packet interception submodule is used to intercept traffic packets using hook functions in the virtual network device if the traffic packets pass through the user space corresponding to the virtual network device.

[0080] Optionally, in this embodiment of the application, the traffic packet acquisition submodule includes:

[0081] The hook function call unit is used to call hook functions through the OpenVSwitch runtime in the virtual network device to intercept traffic packets passing through the user space.

[0082] Optionally, in this embodiment, the target object is a virtualized firewall; the packet redirection module includes:

[0083] The first redirection submodule is used to redirect traffic packets to the virtualized firewall using a virtual network device.

[0084] The traffic security filtering submodule is used to perform security filtering on traffic packets through a virtual firewall.

[0085] Optionally, in this embodiment of the application, the traffic security filtering submodule includes:

[0086] The traffic packet judgment unit is used to determine whether the security policy processing action corresponding to the traffic packet is to discard it.

[0087] The traffic packet processing unit is used to discard the traffic packet through the virtualized firewall if the security policy action corresponding to the traffic packet is to discard it; otherwise, it forwards the traffic packet through the virtualized firewall.

[0088] Optionally, in this embodiment of the application, the target object is a security protection virtual machine; the message redirection module includes:

[0089] The second redirection submodule is used to redirect traffic packets to the security protection virtual machine using a virtual network device.

[0090] The Traffic Inspection and Protection submodule is used to perform security inspection and protection on traffic packets through a security protection virtual machine.

[0091] Optionally, in this embodiment of the application, the virtual network device includes: a virtual bridge; the second redirection submodule includes:

[0092] The traffic redirection unit is used to redirect traffic packets to the security protection virtual machine using a virtual bridge.

[0093] It should be understood that this device corresponds to the traffic redirection method embodiment described above and is capable of performing the various steps involved in the above method embodiment. The specific functions of this device can be found in the description above, and detailed descriptions are omitted here to avoid repetition. The device includes at least one software functional module that can be stored in memory or embedded in the device's operating system (OS) in the form of software or firmware.

[0094] Please see Figure 5 The diagram shows a structural schematic of an electronic device provided in an embodiment of this application. An electronic device 300 provided in this application includes a processor 310 and a memory 320. The memory 320 stores machine-readable instructions executable by the processor 310. When the machine-readable instructions are executed by the processor 310, the method described above is performed.

[0095] This application embodiment also provides a computer-readable storage medium 330, on which a computer program is stored. This computer program is executed by a processor 310 to perform the methods described above. The computer-readable storage medium 330 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0096] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0097] It should be understood that the disclosed apparatus and methods can also be implemented in other ways, as provided in the embodiments of this application. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in the flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending primarily on the functions involved.

[0098] Furthermore, the functional modules of each embodiment in this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part. In addition, in the description of this specification, the reference to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., means that the specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0099] The above description is only an optional implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application.

Claims

1. A traffic redirection method, characterized by, include: Obtain traffic packets sent from the first virtual machine to the second virtual machine through hook functions in the virtual network device; The traffic packets are redirected to a target object so that the target object can process the traffic packets. The virtual network device is used for communication between the first virtual machine and the second virtual machine. The step of obtaining traffic packets sent from the first virtual machine to the second virtual machine through hook functions in the virtual network device includes: Determine whether the traffic packet passes through the user space corresponding to the virtual network device, wherein the user space is the memory space shared by the first virtual machine and the second virtual machine; If so, the traffic packets are intercepted using the hook function in the virtual network device; The step of intercepting the traffic packets using the hook function in the virtual network device includes: The OpenVSwitch runtime in the virtual network device calls a hook function to intercept the traffic packets passing through the user space. The hook function is inserted into the dp_netdev_process_rxq_port function in the source code of the OpenVSwitch runtime.

2. The method of claim 1, wherein, The target object is a virtualized firewall; redirecting the traffic packets to the target object includes: The traffic packets are redirected to the virtual firewall using the virtual network device. The virtual firewall performs security filtering on the traffic packets.

3. The method of claim 2, wherein, The security filtering of the traffic packets through the virtualized firewall includes: Determine whether the security policy action corresponding to the traffic packet is to discard it; If so, the traffic packet is dropped through the virtualized firewall; otherwise, the traffic packet is forwarded through the virtualized firewall.

4. The method of claim 1, wherein, The target object is a security protection virtual machine; redirecting the traffic packets to the target object includes: The traffic packets are redirected to the security protection virtual machine using the virtual network device. The security protection virtual machine performs security detection and protection on the traffic packets.

5. The method of claim 4, wherein, The virtual network device includes: a virtual bridge; the step of using the virtual network device to redirect the traffic packets to the security protection virtual machine includes: The virtual bridge is used to redirect the traffic packets to the security protection virtual machine.

6. A flow redirection device, characterized by, include: The traffic packet acquisition module is used to acquire traffic packets sent from the first virtual machine to the second virtual machine through hook functions in the virtual network device; The packet redirection module is used to redirect the traffic packets to a target object so that the target object can process the traffic packets. The virtual network device is used for communication between the first virtual machine and the second virtual machine. Specifically, the traffic packet acquisition module is used to determine whether the traffic packet passes through the user space corresponding to the virtual network device, where the user space is the memory space shared by the first virtual machine and the second virtual machine; if so, the traffic packet is intercepted using the hook function in the virtual network device. Specifically, the traffic packet acquisition module is used to call a hook function through the OpenVSwitch runtime in the virtual network device to intercept the traffic packets passing through the user space. The hook function is inserted into the dp_netdev_process_rxq_port function in the source code of the OpenVSwitch runtime.

7. An electronic device, characterized in that, include: A processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when executed by the processor, perform the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the method as described in any one of claims 1 to 5.

Images