A vxlan forwarding table self-learning method

Abstract

The invention discloses a vxlan forwarding table self-learning method, which specifically relates to the technical field of cloud computing, including: defining a vxlan message; when a vxlan message is sent on a host machine, processing the vxlan message; the host machine includes a host machine A and a host machine B; when a vxlan message is received on the host machine, processing the vxlan message; the invention does not need to notify each host machine of a vxlan forwarding table, and the host machine completes autonomous learning, thereby avoiding the problem of multicast causing pressure on a physical network in traditional self-learning implementation, and preventing attacks on unknown macs by defining a 0.0.0.0 forwarding table entry mechanism, thereby improving network security.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and more specifically, to a vxlan forwarding table self-learning method. Background Art

[0002] The VXLAN protocol is a typical tunnel encapsulation protocol in cloud computing scenarios. It encapsulates layer 2 data packets as payload in UDP packets to create a virtual network (overlay) on top of the physical network (underlay); OVS (OpenVswitch) is a widely used virtual switch that forwards network data packets for virtual machines. It supports the openflow protocol, receives forwarding rules from the openflow controller, and forwards data packets according to the rules. The vxlan forwarding table is a routing table that records the VNI, MAC address, and corresponding IP address in the VXLAN network. It is used to determine the IP address corresponding to the destination mac address in the VXLAN message so as to correctly forward the vxlan message.

[0003] like Figure 1 As shown in the figure, at present, based on cloud computing technology, the main transmission process of virtual machine network data packets includes: the data packets sent by the virtual machine are first sent to OVS. At this time, OVS needs to send the data packets to the next hop. OVS queries the openflow rules to learn the location of the next hop. The next hop may be another virtual machine on the same host machine, or it may be a virtual machine or gateway on a remote server. If it is a virtual machine on the same host machine, OVS directly transfers the data packet to the virtual machine according to the rules; if the next hop is a virtual machine or gateway on a remote server, OVS will encapsulate the layer 2 data packet sent by the virtual machine with a vxlan tunnel according to the openflow rules, and then transmit the data to the remote server through the physical network. After the remote service receives the vxlan message, it first performs vxlan decapsulation to obtain the data packet sent by the inner virtual machine, and then transfers it to the virtual machine on this server.

[0004] In the prior art, there are the following problems:

[0005] 1. When the number of hosts is very large, the frequency of virtual machine creation will become very high, and the number of hosts that need to be notified will also be very high. At this time, the overhead generated by sending openflow for notification is very high, which reduces the network rate;

[0006] 2. A self-learning function is implemented in the Linux kernel. When receiving a vxlan message sent by the other party, the corresponding relationship between the overlay source mac and the underlay source ip (vxlan forwarding table) is learned, which is equivalent to learning the corresponding relationship between the virtual machine and the host machine. However, before learning the corresponding relationship, if the virtual machines want to communicate with each other, they send data packets to all hosts through multicast. After receiving the message, the correct host forwards the message to the virtual machine, and other hosts discard the message. When the host scale is large, this method will generate a lot of multicast messages, which will cause great pressure on the physical network and is also easy to be attacked. For example, a virtual machine constructs an attack message and deliberately sends a data packet to a non-existent mac. Since the destination mac does not belong to any virtual machine, the other party will not reply, and the host machine will not be able to learn the other party's host information. It will continue to send attack messages to all hosts in a multicast manner, causing physical network failures. Summary of the invention

[0007] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a vxlan forwarding table self-learning method to solve the problems raised in the above-mentioned background technology.

[0008] To achieve the above object, the present invention provides the following technical solution: a vxlan forwarding table self-learning method, comprising:

[0009] Define the vxlan message;

[0010] When a vxlan message is sent on a host machine, the vxlan message is processed; the host machine includes a host machine A and a host machine B;

[0011] When the host receives a vxlan message, it processes the vxlan message;

[0012] The central control center parses the vxlan message after receiving it;

[0013] Virtual machine A in host machine A communicates with virtual machine B in host machine B.

[0014] Furthermore, the vxlan message header contains 8 bytes (64 bits), of which the last byte is a reserved field, and one bit is used to mark the destination mac as unreachable, and the 63rd bit is marked as Zbit, indicating that the host learns the IP as 0.0.0.0 after receiving the vxlan message. If the host queries the vxlan forwarding table and the IP is 0.0.0.0, the vxlan message is discarded and no further processing is carried out.

[0015] Furthermore, the central control center saves the correspondence between all virtual machines and host machines. When the central control center receives a vxlan message, it forwards the vxlan message to the corresponding host machine according to the destination mac of the inner message. When a new virtual machine is created, the central control center makes corresponding updates.

[0016] Furthermore, the method for the host machine to send and process the vxlan message includes:

[0017] Query the vxlan forwarding table;

[0018] If the IP address corresponding to the inner message destination MAC is found, check whether the IP address is 0.0.0.0;

[0019] If yes, the vxlan message is discarded and not sent;

[0020] If the IP address is not 0.0.0.0, the VXLAN message is encapsulated with the queried host IP and sent out, where the queried host IP address is used as the outer destination IP;

[0021] If the IP corresponding to the MAC is not found, the VXLAN message is encapsulated with the IP of the server where the central control center is located as the outer destination IP and sent to the central control center.

[0022] Furthermore, the method for the host machine to receive the vxlan message includes:

[0023] First, parse the vxlan message to obtain the inner message information and the outer message information, and mark the inner message information and the outer message information as inner and outer layer information;

[0024] If the Zbit of the vxlan packet header is 1, add or update the vxlan forwarding table entry and set ftb[overlay_src_mac]=0.0.0.0;

[0025] If the Zbit of the vxlan message header is 0, add or update the vxlan forwarding table entry, set ftb[overlay_src_mac] = underlay_src_ip, and forward the inner message to the virtual machine according to the forwarding rule.

[0026] Furthermore, the process of the central control center receiving the vxlan message and parsing it includes:

[0027] After receiving the vxlan message, the central control center parses it and queries the host information corresponding to the destination mac of the inner message;

[0028] If the central control center finds the corresponding host information, it uses the found host IP as the uderlay destination IP to encapsulate the VXLAN message and send it out; its host IP is the source host IP as the source IP of VXLAN. When the message is sent to the destination host, the destination host learns the corresponding relationship between the sending virtual machine and the host;

[0029] If the corresponding host information cannot be found, the source host mac is notified that the virtual machine corresponding to it is unreachable, preventing the host from sending vxlan messages to the central control center again.

[0030] Further, the steps of notifying the source host mac that the virtual machine corresponding to the source host mac is unreachable include the following:

[0031] Swap the source and destination MAC addresses of the inner message;

[0032] The vxlan message is encapsulated with the ip of the source host as the vxlan destination ip, and the vxlan message is sent back to the source host.

[0033] Furthermore, virtual machine A sends a message to OVS, and OVS searches the vxlan forwarding table. If there is no host information corresponding to the destination virtual machine B, the vxlan message is encapsulated and sent to the central control center;

[0034] The central control center queries the destination host B information, extracts the inner message, encapsulates the vxlan message and sends it to the destination host B;

[0035] The destination host B receives the vxlan message and extracts the inner and outer layer information. When it is checked that Zbit is 0, the destination host B learns the correspondence between the inner source mac and the outer source ip, and forwards the vxlan message to virtual machine B based on the learned correspondence between the inner source mac and the outer source ip.

[0036] Virtual machine B sends a reply packet, which is transmitted to OVS. OVS queries the vxlan forwarding table. If it learns the forwarding information of virtual machine A, it directly encapsulates the vxlan message and sends it to host A.

[0037] After receiving the vxlan message, host A performs parsing, extracts the inner and outer layer information, learns the forwarding information of virtual machine B, and then sends the inner layer message to virtual machine A;

[0038] Virtual machine A sends a reply packet, which is transmitted to OVS. OVS queries the vxlan forwarding table. If it learns the forwarding information of virtual machine B, it encapsulates the vxlan message and sends it to host B.

[0039] In a second aspect, the present invention provides an electronic device, comprising: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0040] The processor executes the above-mentioned vxlan forwarding table self-learning method by calling the computer program stored in the memory.

[0041] In a third aspect, the present invention provides a computer-readable storage medium storing instructions, which, when executed on a computer, enables the computer to execute the above-mentioned vxlan forwarding table self-learning method.

[0042] Technical effects and advantages of the present invention:

[0043] 1. The present invention does not need to notify each host of the vxlan forwarding table. The host completes autonomous learning, avoiding the problem of multicast causing pressure on the physical network in traditional self-learning implementation, and preventing attacks on unknown macs by defining the 0.0.0.0 forwarding table entry mechanism, thereby improving network security;

[0044] 2. The present invention improves the self-learning process of vxlan. By adding a central control center, it solves the problem of large-scale multicast in the physical network caused by traditional vxlan learning. By introducing the Zbit mark of vxlan, it solves the resource overhead caused by malicious, invalid and unknown MAC. Compared with the existing arp gateway agent, the present invention can not only proxy broadcast messages such as arp, but also proxy unicast messages, avoiding network resource overhead caused by unlearned unicast triggering broadcast. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a virtual machine network data flow diagram of the present invention;

[0046] Figure 2 This is a schematic diagram of the vxlan header message format of Example 1;

[0047] Figure 3 Sending flow chart for the host vxlan of Example 1;

[0048] Figure 4 The host vxlan receiving flow chart of Example 1;

[0049] Figure 5 This is a flowchart of the central control center of Example 1;

[0050] Figure 6 This is a flow chart of data packet forwarding based on the central control center in Example 1;

[0051] Figure 7 This is a schematic diagram of the structure of an electronic device according to Example 3. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0054] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, a first unit may be referred to as a second unit, and similarly a second unit may be referred to as a first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0055] Install multiple hosts and a central control machine; configure the IP address of the vxlan central control center on the host, do not configure vxlan multicast, and create virtual machines A and B on host A and host B respectively; establish a tcp link from one virtual machine to another, and the tcp link within the virtual machine is established normally; at this time, check the vxlan forwarding table on the two hosts and learn each other's forwarding information.

[0056] Example 1

[0057] This embodiment discloses a vxlan forwarding table self-learning method, including:

[0058] Define the vxlan message;

[0059] When a vxlan message is sent on a host machine, the vxlan message is processed; the host machine includes a host machine A and a host machine B;

[0060] When the host receives a vxlan message, it processes the vxlan message;

[0061] The central control center parses the vxlan message after receiving it;

[0062] Virtual machine A in host machine A communicates with virtual machine B in host machine B;

[0063] 1. Define the vxlan message;

[0064] See also Figure 2 As shown, the vxlan message header contains 8 bytes (64 bits), among which the last byte is a reserved field, and one bit is used to mark the destination mac as unreachable, and the 63rd bit is marked as Zbit, indicating that the host learns the IP as 0.0.0.0 after receiving the vxlan message. If the host queries the vxlan forwarding table and the IP is 0.0.0.0, the vxlan message will be discarded and no further processing will be carried out to save network resources and reduce the pressure on the central control center.

[0065] It should be noted that the central control center saves the correspondence between all virtual machines and host machines. When the central control center receives a vxlan message, it forwards the vxlan message to the corresponding host machine according to the destination mac of the inner message. When a new virtual machine is created, the central control center makes corresponding updates.

[0066] See also Figure 3 As shown, the method for the host to send a vxlan message includes:

[0067] Query the vxlan forwarding table;

[0068] If the IP address corresponding to the inner message destination MAC is found, check whether the IP address is 0.0.0.0;

[0069] If yes, the vxlan message is discarded and not sent;

[0070] If the IP address is not 0.0.0.0, the VXLAN message is encapsulated with the queried host IP and sent out, where the queried host IP address is used as the outer destination IP;

[0071] If the IP corresponding to the MAC is not found, the VXLAN message is encapsulated with the IP of the server where the central control center is located as the outer destination IP and sent to the central control center.

[0072] See also Figure 4 As shown, the method for receiving a vxlan message on a host includes:

[0073] First, parse the vxlan message to obtain the inner message information and the outer message information, and mark the inner message information and the outer message information as inner and outer layer information;

[0074] If the Zbit of the vxlan packet header is 1, add or update the vxlan forwarding table entry and set ftb[overlay_src_mac]=0.0.0.0;

[0075] If the Zbit of the vxlan message header is 0, add or update the vxlan forwarding table entry, set ftb[overlay_src_mac] = underlay_src_ip, and forward the inner message to the virtual machine according to the forwarding rule.

[0076] See also Figure 5 As shown in the figure, the process of the central control center receiving the vxlan message and parsing it includes:

[0077] After receiving the vxlan message, the central control center parses it and queries the host information corresponding to the destination mac of the inner message;

[0078] If the central control center finds the corresponding host information, it uses the found host IP as the uderlay destination IP to encapsulate the vxlan message and send it out. It should be noted that the host IP is the source host IP as the source IP of vxlan. When the message is sent to the destination host, the destination host learns the corresponding relationship between the sending virtual machine and the host;

[0079] If the corresponding host information cannot be found, the source host mac is notified that the virtual machine corresponding to it is unreachable, preventing the host from sending vxlan messages to the central control center again.

[0080] It should be specifically noted that the steps of notifying the source host mac that the virtual machine corresponding to the source host mac is unreachable include the following:

[0081] Swap the source and destination MAC addresses of the inner message;

[0082] The vxlan message is encapsulated with the ip of the source host as the vxlan destination ip, and the vxlan message is sent back to the source host.

[0083] See also Figure 6 As shown in the figure, the communication process between virtual machines A and B is as follows:

[0084] Virtual machine A sends a message to OVS. OVS searches the vxlan forwarding table. If there is no host information corresponding to the destination virtual machine B, it encapsulates the vxlan message and sends it to the central control center.

[0085] The central control center queries the destination host B information, extracts the inner message, encapsulates the vxlan message and sends it to the destination host B;

[0086] The destination host B receives the vxlan message and extracts the inner and outer layer information. When it is checked that Zbit is 0, the destination host B learns the correspondence between the inner source mac and the outer source ip, and forwards the vxlan message to virtual machine B based on the learned correspondence between the inner source mac and the outer source ip.

[0087] Virtual machine B sends a reply packet, which is transmitted to OVS. OVS queries the vxlan forwarding table. If it learns the forwarding information of virtual machine A, it directly encapsulates the vxlan message and sends it to host A.

[0088] After receiving the vxlan message, host A performs parsing, extracts the inner and outer layer information, learns the forwarding information of virtual machine B, and then sends the inner layer message to virtual machine A;

[0089] Virtual machine A sends a reply packet, which is transmitted to OVS. OVS queries the vxlan forwarding table. If it learns the forwarding information of virtual machine B, it encapsulates the vxlan message and sends it to host B.

[0090] This embodiment does not need to notify each host vxlan forwarding table. The host completes autonomous learning, avoiding the problem of multicast putting pressure on the physical network in traditional self-learning implementations. It also prevents attacks from unknown macs by defining a 0.0.0.0 forwarding table entry mechanism, thereby improving network security.

[0091] Example 2

[0092] See also Figure 7 As shown, this embodiment provides an electronic device, including: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0093] The processor executes a vxlan forwarding table self-learning method of Example 1 by calling the computer program stored in the memory.

[0094] Example 3

[0095] This embodiment provides a computer-readable storage medium storing instructions. When the instructions are executed on a computer, the computer executes a vxlan forwarding table self-learning method of embodiment 1.

[0096] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center via a wired network. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0097] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0098] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0099] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only one. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0100] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0101] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0102] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0103] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0104] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A vxlan forwarding table self-learning method, characterized in that: include: Define the vxlan message; The vxlan message header contains 8 bytes, that is, 64 bits, of which the last byte is a reserved field, and one bit is used to mark the destination mac as unreachable, and the 63rd bit is marked as Zbit, indicating that the host learns the IP as 0.0.0.0 after receiving the vxlan message. If the host queries the vxlan forwarding table and the IP is 0.0.0.0, the vxlan message is discarded and no further processing is carried out; The central control center saves the correspondence between all virtual machines and host machines. When the central control center receives a vxlan message, it forwards the vxlan message to the corresponding host machine according to the destination mac of the inner message. When a new virtual machine is created, the central control center makes corresponding updates. When a vxlan message is sent on a host machine, the vxlan message is processed; the host machine includes a host machine A and a host machine B; The method for a host machine to send and process a vxlan message includes: Query the vxlan forwarding table; If the IP address corresponding to the inner message destination MAC is found, check whether the IP address is 0.0.0.0; If yes, the vxlan message is discarded and not sent; If the IP address is not 0.0.0.0, the VXLAN message is encapsulated with the queried host IP and sent out, where the queried host IP address is used as the outer destination IP; If the IP corresponding to the MAC is not found, the VXLAN message is encapsulated with the IP of the server where the central control center is located as the outer destination IP and sent to the central control center; When the host receives a vxlan message, it processes the vxlan message; The method for a host machine to receive a vxlan message includes: First, parse the vxlan message to obtain the inner message information and the outer message information, and mark the inner message information and the outer message information as inner and outer layer information; If the Zbit of the vxlan packet header is 1, add or update the vxlan forwarding table entry and set ftb[overlay_src_mac]=0.0.0.0; If the Zbit of the vxlan message header is 0, add or update the vxlan forwarding table entry, set ftb[overlay_src_mac] = underlay_src_ip, and forward the inner message to the virtual machine according to the forwarding rule; The central control center parses the vxlan message after receiving it; The process of receiving and parsing the vxlan message at the central control center includes: After receiving the vxlan message, the central control center parses it and queries the host information corresponding to the destination mac of the inner message; If the central control center finds the corresponding host information, it uses the found host IP as the uderlay destination IP to encapsulate the VXLAN message and send it out; its host IP is the source host IP as the source IP of VXLAN. When the message is sent to the destination host, the destination host learns the corresponding relationship between the sending virtual machine and the host; If the corresponding host information cannot be found, the source host mac corresponding virtual machine is notified that it is unreachable, preventing the host from sending vxlan messages to the central control center again; Virtual machine A in host machine A communicates with virtual machine B in host machine B; Virtual machine A sends a message to OVS. OVS searches the vxlan forwarding table. If there is no host information corresponding to the destination virtual machine B, it encapsulates the vxlan message and sends it to the central control center. The central control center queries the destination host B information, extracts the inner message, encapsulates the vxlan message and sends it to the destination host B; The destination host B receives the vxlan message and extracts the inner and outer layer information. When it is checked that Zbit is 0, the destination host B learns the correspondence between the inner source mac and the outer source ip, and forwards the vxlan message to virtual machine B based on the learned correspondence between the inner source mac and the outer source ip. Virtual machine B sends a reply packet, which is transmitted to OVS. OVS queries the vxlan forwarding table. If it learns the forwarding information of virtual machine A, it directly encapsulates the vxlan message and sends it to host A. After receiving the vxlan message, host A performs parsing, extracts the inner and outer layer information, learns the forwarding information of virtual machine B, and then sends the inner layer message to virtual machine A; Virtual machine A sends a reply packet, which is transmitted to OVS. OVS queries the vxlan forwarding table. If it learns the forwarding information of virtual machine B, it encapsulates the vxlan message and sends it to host B.

2. A vxlan forwarding table self-learning method according to claim 1, characterized in that: The steps to notify the source host mac that the virtual machine corresponding to it is unreachable include the following: Swap the source and destination MAC addresses of the inner message; The vxlan message is encapsulated with the ip of the source host as the vxlan destination ip, and the vxlan message is sent back to the source host.

3. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores a computer program that can be called by the processor; The processor executes a vxlan forwarding table self-learning method described in any one of claims 1-2 by calling the computer program stored in the memory.

4. A computer-readable storage medium, characterized in that: Instructions are stored, and when the instructions are executed on a computer, the computer executes a vxlan forwarding table self-learning method as described in any one of claims 1-2.

Images