Method, device, equipment, storage medium and computer program product for accessing virtual machines

Abstract

The present disclosure provides a method, device, equipment and storage medium for accessing a virtual machine, and relates to the field of computer technology, and in particular to the field of address port conversion technology. The specific implementation scheme is: applied to a server, in which a virtual switch, at least one virtual machine, a physical network card interface and a virtual bridge interface are deployed, and an initial access request is received through the virtual bridge interface; the initial access request includes first destination address information; based on the virtual bridge interface, the first destination address information is converted into second destination address information to obtain a processed access request; and based on the virtual bridge interface, the processed access request is sent to the port of the virtual switch according to the second destination address information; based on the virtual switch, the second destination address information is converted into third destination address information to obtain a final access request; based on the third destination address information in the final access request, the virtual machine indicated by the initial access request is accessed.

Description

Technical Field

[0001] The present disclosure relates to address port conversion technology in the field of computer technology, and in particular to a method, device, equipment and storage medium for accessing a virtual machine. Background Art

[0002] Before the implementation of network virtualization, the network of virtual machines is in the physical network (underlay), that is, the virtual machine network of the server (compute node) and the host network are generally bridged together through a Linux bridge (such as br0), and the virtual machine accesses the external network through the physical network interface of br0. After the implementation of network virtualization, the virtual machine network of the server (compute node) is an overlay network, that is, it is connected to the network node through a tunnel (such as vxlan) and enters and exits the underlay network at the network node. Therefore, the method of directly connecting to the virtual machine IP in the underlay network (such as ssh) is no longer available.

[0003] In the prior art, it is necessary to set an independent and external virtual IP (VitalIP, VIP for short) in the physical network card as the entrance of DNAT, and combine the virtual switch OVS to access the virtual machine.

[0004] However, the virtual machine access method in the prior art may lead to problems of high IP resource consumption and high access cost. Summary of the invention

[0005] The present disclosure provides a method, apparatus, device and storage medium for accessing a virtual machine.

[0006] According to a first aspect of the present disclosure, a method for accessing a virtual machine is provided, which is applied to a server, wherein a virtual switch, at least one virtual machine, a physical network card interface, and a virtual bridge interface are deployed in the server, wherein the virtual bridge interface is connected to the physical network card interface and the virtual switch, respectively, and the method comprises:

[0007] receiving an initial access request transmitted by the physical network card interface through the virtual bridge interface; wherein the initial access request is used to indicate access to the virtual machine, and the initial access request includes first destination address information, and the first destination address information is address information of the virtual bridge interface;

[0008] Based on the virtual bridge interface, convert the first destination address information in the initial access request into second destination address information to obtain a processed access request; wherein the second destination address information is address information of a port of a virtual switch, and based on the virtual bridge interface, send the processed access request to the port of the virtual switch according to the second destination address information;

[0009] Based on the virtual switch, convert the second destination address information in the processed access request into third destination address information to obtain a final access request; wherein the third destination address information is address information of the virtual machine;

[0010] Based on the third destination address information in the final access request, access the virtual machine indicated by the initial access request.

[0011] According to a second aspect of the present disclosure, a device for accessing a virtual machine is provided, which is applied to a server, wherein a virtual switch, at least one virtual machine, a physical network card interface, and a virtual bridge interface are deployed in the server, wherein the virtual bridge interface is connected to the physical network card interface and the virtual switch, respectively, and the device comprises:

[0012] A receiving unit, configured to receive an initial access request transmitted by the physical network card interface through the virtual bridge interface; wherein the initial access request is used to indicate access to a virtual machine, and the initial access request includes first destination address information, and the first destination address information is address information of the virtual bridge interface;

[0013] a first conversion unit, configured to convert the first destination address information in the initial access request into second destination address information based on the virtual bridge interface, so as to obtain a processed access request; wherein the second destination address information is address information of a port of a virtual switch, and based on the virtual bridge interface, send the processed access request to the port of the virtual switch according to the second destination address information;

[0014] A second conversion unit, configured to convert the second destination address information in the processed access request into third destination address information based on the virtual switch to obtain a final access request; wherein the third destination address information is address information of the virtual machine;

[0015] An access unit is used to access the virtual machine indicated by the initial access request based on the third destination address information in the final access request.

[0016] According to a third aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for accessing a virtual machine described in the first aspect.

[0017] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the virtual machine access method described in the first aspect.

[0018] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising: a computer program, wherein the computer program is stored in a readable storage medium, at least one processor of an electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program so that the electronic device executes the method described in the first aspect.

[0019] The technology disclosed in the present invention solves the problem of high consumption of IP resources when accessing virtual machines, thereby reducing access costs.

[0020] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0022] Figure 1 is a schematic diagram according to a first embodiment of the present disclosure;

[0023] Figure 2 is a schematic diagram according to a second embodiment of the present disclosure;

[0024] Figure 3 is a schematic diagram according to a third embodiment of the present disclosure;

[0025] Figure 4 is a schematic diagram of the structure of a server used to implement the method for accessing a virtual machine according to an embodiment of the present disclosure;

[0026] Figure 5 is a block diagram of a virtual machine access device for implementing the virtual machine access method of the embodiment of the present disclosure;

[0027] Figure 6 The present invention is a block diagram of an electronic device for implementing the method for accessing a virtual machine according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0029] The present invention discloses a method, apparatus, device and storage medium for accessing a virtual machine, which are applied to the field of address port conversion technology in the field of computer technology to reduce the IP address resource consumption and access cost of virtual machine access.

[0030] Figure 1 Schematic diagram of the first embodiment of the present disclosure. Figure 1 As shown, the method for accessing a virtual machine provided by the first embodiment of the present disclosure includes:

[0031] S101, receiving an initial access request transmitted by a physical network card interface through a virtual bridge interface.

[0032] Among them, the execution device of the embodiment of the present disclosure may be a server, in which a virtual switch, at least one virtual machine, a physical network card interface and a virtual bridge interface are deployed, and the virtual bridge interface is connected to the physical network card interface and the virtual switch respectively.

[0033] Among them, the virtual switch (Open vSwitch, referred to as OVS) is a high-quality virtual switch that supports multi-layer data forwarding. It is mainly deployed on servers. Compared with traditional switches, it has good programming scalability. At the same time, it has the network isolation and data forwarding functions implemented by traditional switches. It runs on each virtualized physical machine and provides remote management. OVS provides two protocols for remote management in a virtualized environment: one is OpenFlow, which manages the behavior of the switch through flow tables, and the other is the OVSDB management protocol, which is used to expose the port status of the switch. Among them, the OpenFlow protocol can be used in SDN networks to achieve the separation of the network forwarding plane and the control plane. Among them, the virtual machine (Virtual Machine, referred to as VM) refers to a complete computer system with complete hardware system functions simulated by software and running in a completely isolated environment. The work that can be completed in a physical computer can be achieved in a virtual machine. When creating a virtual machine in a computer, part of the hard disk and memory capacity of the physical machine needs to be used as the hard disk and memory capacity of the virtual machine. Each virtual machine has an independent CMOS, hard disk and operating system, and can operate the virtual machine like a physical machine. The virtual switch VM can include multiple virtual bridges. Among them, the physical network card interface eth0 is the interface of the physical network card. The physical network card is used to connect the computer to the network. The physical network card can identify the computer through the MAC address and send the data packet to the correct destination. Among them, the virtual bridge interface br0 is connected to the physical network card eth0 and the virtual switch OVS respectively to realize the connection between the physical network card interface eth0 and the virtual bridge of the virtual switch.

[0034] The initial access request is used to indicate access to the virtual machine. Specifically, the initial access request is sent by the client and transmitted by the physical network card interface eth0, and is used to indicate an initial access request for accessing the virtual machine.

[0035] The initial access request includes the first destination address information, and the first destination address information is the address information of the virtual bridge interface. Optionally, the first destination address information is the address information of the component of the server to which the initial access request will be sent based on the client, and in the embodiment of the present disclosure, it is the address information of the virtual bridge interface. Optionally, the first destination address information includes, but is not limited to: the IP address of the virtual bridge interface, the port number of the virtual bridge interface, and the MAC address of the virtual bridge interface.

[0036] S102, based on the virtual bridge interface, convert the first destination address information in the initial access request into second destination address information to obtain a processed access request; wherein the second destination address information is the address information of the port of the virtual switch, and based on the virtual bridge interface, send the processed access request to the port of the virtual switch according to the second destination address information.

[0037] Optionally, the second destination address information is the address information of the component of the server to which the processed access request is sent based on the virtual bridge interface, and in the embodiment of the present disclosure, it is the address information of the port of the virtual switch OVS. Optionally, the second destination address information includes, but is not limited to: the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch.

[0038] Among them, the IP address of the port of the virtual switch is the virtual IP address (VirtualIP, VIP for short) pre-deployed on the port of the virtual switch. Optionally, the flow table of the virtual switch OVS can be pre-deployed, and then the VIP can be deployed through the flow table of the virtual switch OVS. Among them, the so-called flow table can actually be regarded as an abstraction of the data forwarding function of the network device by OpenFlow. In traditional network devices, the data forwarding of switches and routers needs to rely on the second-layer MAC address forwarding table or the third-layer IP address routing table stored in the device, and the flow table used in the OpenFlow switch is the same, but its table items integrate the network configuration information of each layer in the network, so that richer rules can be used when forwarding data. Each flow table entry of the OpenFlow flow table consists of three parts: the header field (Header Fields) used for data packet matching, the counter (Counters) used to count the number of matching data packets, and the action (Actions) used to show how the matching data packets are processed. Optionally, the process of deploying VIP through the flow table of the virtual switch OVS may include: first, obtaining the ARP (Address Resolution Protocol, ARP for short) address resolution protocol ARP Replay through the flow table of the pre-deployed virtual switch OVS, whose basic function is to query the MAC address of the target device through the IP address of the target device to ensure smooth communication, and secondly, if the source IP address field rp_spa is the IP address of the virtual bridge interface and the destination IP address field arp_tpa is VIP, a MAC address request arp request is issued, and then the ARP address resolution protocol ARP Replay returns the MAC address of the port of the virtual switch. To complete the deployment of the virtual IP address (VirtualIP, VIP for short) on the port of the virtual switch, that is, the virtual IP address and the MAC address of the port of the virtual switch are bound through the flow table of the virtual switch OVS.

[0039] Among them, in the embodiment of the present disclosure, the process of converting the first destination address information in the initial access request into the second destination address information based on the virtual bridge interface is not limited. Optionally, the first destination address information in the initial access request can be converted into the second destination address information according to the correspondence between the first destination address and the second destination address of the virtual bridge interface br0 pre-deployed on the server. Specifically, the correspondence between the first destination address and the second destination address of the virtual bridge interface br0 pre-deployed on the server can be obtained through the IP container rule (iptables rule) of the destination network address translation (Destination Network Address Translation, referred to as DNAT). Among them, DNAT is a network address translation technology used to change the target IP address and port number in the data packet. When the data packet is transmitted from the external network to the internal network, DNAT replaces the target IP address and port number in the data packet with the corresponding IP address and port number in the internal network so as to correctly pass the data packet to the internal host. Among them, the IP container iptables acts according to the rules. The rules are actually the conditions predefined by the network administrator. The rules are generally defined as "if the data packet header meets such conditions, process the data packet in this way." Rules are stored in the packet filter table in kernel space. These rules specify the source address, destination address, transport protocol (such as TCP, UDP, ICMP) and service type (such as HTTP, FTP and SMTP). When a data packet matches a rule, iptables processes the data packet according to the method defined by the rule, such as accept, reject and drop. The main task of configuring a firewall is to add, modify and delete these rules.

[0040] Optionally, the IP address of the port of the virtual switch, that is, the host static route of the virtual IP address VIP, can be deployed in the virtual bridge interface br0, so that the processed access request is sent to the port of the virtual switch based on the virtual bridge interface.

[0041] Among them, this embodiment does not limit the process of sending the processed access request to the port of the virtual switch based on the virtual bridge interface according to the second destination address information. Optionally, based on the MAC address information in the second destination address information, in the disclosed embodiment of the present invention, the MAC address of the port of the virtual switch can be used to send the processed access request to the port of the virtual switch.

[0042] S103, based on the virtual switch, convert the second destination address information in the processed access request into third destination address information to obtain a final access request.

[0043] The third destination address information is the address information of the virtual machine; optionally, the third destination address information is the address information of the component of the server to which the final access request is sent based on the virtual switch, and in the embodiment of the present disclosure, it is the address information of the virtual machine. Optionally, the third destination address information includes, but is not limited to: the IP address of the virtual machine, the port number of the virtual machine, and the MAC address of the virtual machine. The IP address of the virtual machine is the IP address of the virtual machine indicated by the access request, the port number of the virtual machine is the port number of the port of the virtual machine indicated by the access request, and the MAC address of the virtual machine is the MAC address of the virtual machine indicated by the access request.

[0044] Among them, in the embodiment of the present disclosure, the process of converting the second destination address information in the processed access request into the third destination address information based on the virtual switch is not limited. Optionally, the second destination address information in the processed access request can be converted into the third destination address information according to the correspondence between the second destination address and the third destination address of the virtual switch pre-deployed on the server. Specifically, the correspondence between the second destination address and the third destination address of the virtual switch of the deployment server can be achieved by pre-deploying the flow table of the virtual switch OVS.

[0045] S104: Access the virtual machine indicated by the initial access request based on the third destination address information in the final access request.

[0046] Among them, this embodiment does not limit the process of accessing the virtual machine indicated by the initial access request based on the third destination address information in the final access request. Optionally, based on the MAC address information in the third destination address information, in the embodiment of the present disclosure, the MAC address of the virtual machine can be used to access the virtual machine indicated by the initial access request. Optionally, based on the MAC address information in the third destination address information, the final access request can be sent to the virtual machine indicated by the initial access request, and then based on the virtual machine indicated by the initial access request, access response data is generated, and the access response data is fed back to the client that issued the initial access request.

[0047] In the disclosed embodiment, an initial access request transmitted by a physical network card interface is received through a virtual bridge interface, and based on the virtual bridge interface, the first destination address information in the initial access request is converted into second destination address information to obtain a processed access request, and based on the virtual switch, the second destination address information in the processed access request is converted into third destination address information to obtain a final access request, and based on the third destination address information in the final access request, the virtual machine indicated by the initial access request is accessed, wherein the destination address information is converted based on the virtual bridge interface and the virtual switch of the server to complete the access to the virtual machine, thereby reducing the occupation of IP address resources and the use of physical network cards, and saving the cost of IP address resources and virtual machine access.

[0048] In order to enable readers to more deeply understand the implementation principle of the present disclosure, the following Figure 2-Figure 6 right Figure 1 The illustrated embodiment is further refined.

[0049] Figure 2 is a schematic diagram according to the second embodiment of the present disclosure. Figure 2 As shown, the method for accessing a virtual machine provided by the second embodiment of the present disclosure includes:

[0050] S201, receiving an initial access request transmitted by a physical network card interface through a virtual bridge interface.

[0051] Among them, the execution device of the embodiment of the present disclosure may be a server, in which a virtual switch, at least one virtual machine, a physical network card interface and a virtual bridge interface are deployed, and the virtual bridge interface is connected to the physical network card interface and the virtual switch respectively.

[0052] Among them, the initial access request is used to indicate access to the virtual machine, and the initial access request includes first destination address information, and the first destination address information is the address information of the virtual bridge interface; specifically, the specific description of this step can refer to the description in step S101, and this step will not be repeated.

[0053] Optionally, the first destination address information includes the IP address of the interface, the port number of the interface and the MAC address of the interface; wherein the IP address of the interface is the IP address of the virtual bridge interface, the port number of the interface is the port number of the virtual bridge interface, and the MAC address of the interface is the port number of the virtual bridge interface, wherein the port number of the virtual bridge interface is a preset port number corresponding to the port number of the virtual host, and the initial access request is used not only to indicate access to the virtual host, but also to indicate the port number of the virtual bridge interface and the port number of the virtual host.

[0054] S202: Based on the virtual bridge interface, convert the IP address of the interface in the first destination address information into the IP address of the port of the virtual switch, and change the MAC address of the interface in the first destination address information into the MAC address of the port of the virtual switch.

[0055] Optionally, the first destination address information includes the IP address of the interface, the port number of the interface, and the MAC address of the interface; the second destination address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch. After further limiting the first destination address information and the second destination address information, the specific content of converting the first destination address information in the access request into the second destination address information is clearer.

[0056] Specifically, after receiving the initial access request transmitted by the physical network card interface through the virtual bridge interface, the IP address of the interface in the first destination address information can be converted into the IP address of the port of the virtual switch based on the virtual bridge interface, and the MAC address of the interface in the first destination address information can be changed to the MAC address of the port of the virtual switch. Among them, this process is a specific process of converting the first destination address information in the access request into the second destination address information after further limiting the first destination address information and the second destination address information described above. The access process is more specific. Optionally, the IP address of the interface in the first destination address information can be converted into the IP address of the port of the virtual switch in the second address information according to the IP container rule (iptables rule) of the destination network address translation (DNAT) described in step S102, that is, the iptables rule of DNAT, while keeping the port number of the interface in the first destination address information unchanged; then, according to the process described in step S102 of pre-deploying the flow table of the virtual switch OVS and then deploying the VIP through the flow table of the virtual switch OVS, the MAC address of the port of the virtual switch bound to the IP address of the port of the virtual switch is determined, and the MAC address of the interface in the first destination address information is changed to the MAC address of the port of the virtual switch in the second destination address information. Among them, the IP container rules (iptables rules) of the Destination Network Address Translation (DNAT) are based on the connection tracking technology conntrack. Specifically, the connection tracking technology (conntrack) is one of the important functions built on the Netfilter framework. Connection tracking allows the kernel to track all logical network connections or sessions, thereby associating all data packets that may constitute the connection. Network address translation NAT relies on this information to translate all related data packets in the same way, and the container rule iptables can use this information to act as a stateful firewall.

[0057] Optionally, the initial access request also includes first source address information, where the first source address information is address information of a client that issues the initial access request; wherein the first source address information includes an IP address of the client, a port number of the client, and a MAC address of the client;

[0058] The processed access request also includes second source address information, which includes the IP address of the client, the port number of the client, and the MAC address of the interface, and the MAC address of the interface is the MAC address of the virtual bridge interface. Here, the initial access request and the processed access request are further limited. On the basis of the destination address information, the source address information is also included, so that the description of the initial access request and the processed access request is more specific.

[0059] Optionally, the MAC address of the client in the first source address information can be changed to the MAC address of the interface based on the virtual bridge interface. Based on the further definition of the initial access request and the processed access request above, while converting the first destination address information in the initial access request to the second destination address information based on the virtual bridge interface, the first source address information in the initial access request is also converted to the corresponding address information. This process further refines the process of converting the initial access request to the processed access request.

[0060] S203: Based on the virtual bridge interface, send the processed access request to the port of the virtual switch according to the second destination address information.

[0061] For the specific description of this step, please refer to the description in step S102, and this step will not be repeated here.

[0062] Optionally, the server is also deployed with a first virtual Ethernet device port and a second virtual Ethernet device port, the first virtual Ethernet device port is respectively connected to the virtual bridge interface and the second virtual Ethernet device port, and the second virtual Ethernet device port is respectively connected to the first virtual Ethernet device port and the virtual switch; wherein, a virtual Ethernet device pair (Virtual Ethernet, referred to as veth) is a pair of virtual Ethernet devices, a pair of veth devices are connected together through a virtual link, and they are usually used to create a network topology similar to a bridge or tunnel, in which one device can be regarded as a network interface of a virtual machine or container, and the other device is connected to the network stack of the host. Specifically, the first virtual Ethernet device port veth_br0 is the network interface of the virtual machine or container, and the second virtual Ethernet device port veth_br-tun is the network stack connected to the host. Optionally, the IP address of the port of the virtual switch deployed in the virtual bridge interface br0, that is, the host static route of the virtual IP address VIP, can be based on the virtual bridge interface, so that the processed access request enters the first virtual Ethernet device port veth_br0 from the virtual bridge interface, and further based on the first virtual Ethernet device port veth_br0, the processed access request is sent from the first virtual Ethernet device port veth_br0 to the second virtual Ethernet device port veth_br-tun.

[0063] Optionally, if the server is further deployed with a first virtual Ethernet device port and a second virtual Ethernet device port, the second destination address information is the address information of the second virtual Ethernet device port. That is, the address information of the port of the virtual switch is the address information of the second virtual Ethernet device port, for example: the IP address of the port of the virtual switch is the IP address information of the second virtual Ethernet device port, the MAC address of the port of the virtual switch is the MAC address of the second virtual Ethernet device port, and the port number of the interface is the port number of the second virtual Ethernet device port.

[0064] Optionally, if the server is further deployed with a first virtual Ethernet device port and a second virtual Ethernet device port, based on the virtual bridge interface, the processed access request is sent to the port of the virtual switch according to the second destination address information, including: based on the virtual bridge interface, the processed access request is sent to the second virtual Ethernet device port through the first virtual Ethernet device port according to the second destination address information, so that the virtual switch receives the processed access request through the second virtual Ethernet device port.

[0065] S204, based on the virtual switch, convert the IP address of the port of the virtual switch in the second destination address information into the IP address of the virtual machine, convert the port number of the interface in the second destination address information into the port number of the virtual machine, and change the MAC address of the port of the virtual switch in the second destination address information into the MAC address of the virtual machine.

[0066] Optionally, the third destination address information includes the IP address of the virtual machine, the port number of the virtual machine and the MAC address of the virtual machine. After further limiting the third destination address information, the specific content of converting the second destination address information in the access request into the third destination address information is clearer.

[0067] Specifically, after sending the processed access request to the port of the virtual switch according to the second destination address information based on the virtual bridge interface, the IP address of the port of the virtual switch in the second destination address information can be converted to the IP address of the virtual machine based on the virtual switch, the port number of the interface in the second destination address information can be converted to the port number of the virtual machine, and the MAC address of the port of the virtual switch in the second destination address information can be changed to the MAC address of the virtual machine. This process is a specific process of converting the second destination address information in the access request to the third destination address information after further limiting the third destination address information described above, and the access process is more specific.

[0068] Optionally, based on the virtual switch, according to the flow table of the pre-deployed virtual switch OVS, the IP address of the port of the virtual switch in the second destination address information can be first converted to the IP address of the virtual machine, and the port number of the interface in the second destination address information can be converted to the port number of the virtual machine. Specifically, based on the virtual switch, according to the flow table item of the flow table, if the destination IP address of the matched received data packet is the IP address of the port of the virtual switch, the destination port number is the port number of the interface, and the data packet is received by the virtual switch via the second virtual Ethernet device port, then the data packet is first forwarded to the dedicated table for destination address conversion, and then according to the flow table item of the flow table, the data packet is extracted from the dedicated table for destination address conversion, and according to the destination address conversion rule NAT of the virtual switch OVS, the IP address of the port of the virtual switch in the second destination address information is converted to the IP address of the virtual machine, and the port number of the interface in the second destination address information is converted to the port number of the virtual machine. Among them, the destination address conversion rule NAT is based on the connection tracking technology conntrack. Specifically, the connection tracking technology (Connection Tracking, referred to as conntrack) is one of the important functions built on the Netfilter framework. Connection tracking allows the kernel to track all logical network connections or sessions, thereby correlating all packets that may constitute that connection. Network address translation NAT relies on this information to translate all related packets in the same way, while container rules iptables can use this information to act as a stateful firewall.

[0069] Optionally, based on the virtual switch, according to the flow table of the pre-deployed virtual switch OVS, the MAC address of the port of the virtual switch in the second destination address information may be changed to the MAC address of the virtual machine.

[0070] Optionally, if based on a virtual switch, according to the flow table entry of the flow table, if the destination IP address of the received data packet is not matched and is the IP address of the port of the virtual switch, or the destination port number is the port number of the interface, or the data packet is received by the virtual switch via the second virtual Ethernet device port, the corresponding data packet is discarded.

[0071] Optionally, the final access request also includes third source address information, which includes the IP address of the client, the port number of the client, and the MAC address of the port of the virtual switch. This is a further limitation on the final access request, and in addition to the destination address information, the source address information is also included, so that the description of the final access request is more specific.

[0072] Optionally, based on the virtual switch, the MAC address of the interface in the second source address information can be changed to the MAC address of the port of the virtual switch. Based on the further definition of the final access request above, while converting the second destination address information in the processed access request to the third destination address information based on the virtual switch, the second source address information in the processed access request is also converted to the corresponding address information. This process further refines the process of converting the processed access request to the final access request.

[0073] Optionally, a tunnel bridge br-tun and an integrated bridge br-int are also deployed in the virtual switch in the server, wherein the integrated bridge, the virtual network card and other virtual network devices can be connected to the bridge. A tunnel bridge, a virtual extended local area network VxLAN based on tunnel technology and a routing encapsulation protocol GRE network can use the bridge for communication. Specifically, based on the virtual switch, the IP address of the port of the virtual switch in the second destination address information is converted to the IP address of the virtual machine, the port number of the interface in the second destination address information is converted to the port number of the virtual machine, and the MAC address of the port of the virtual switch in the second destination address information is changed to the MAC address of the virtual machine, including: based on the tunnel bridge br-tun, the IP address of the port of the virtual switch in the second destination address information is converted to the IP address of the virtual machine, the port number of the interface in the second destination address information is converted to the port number of the virtual machine, and the MAC address of the port of the virtual switch in the second destination address information is changed to the MAC address of the virtual machine.

[0074] Optionally, the server also deploys a correspondence between the first destination address information and the second destination address information, a correspondence between the second destination address information and the third destination address information, a correspondence between the first source address information and the second source address information, and a correspondence between the second source address information and the third source address information. The pre-deployed multiple correspondences can provide a conversion basis for address conversion.

[0075] S205: Based on the virtual switch, send the final access request to the virtual machine indicated by the initial access request according to the third destination address information.

[0076] Optionally, if the virtual switch in the server also deploys a tunnel bridge br-tun and an integrated bridge br-int, based on the virtual switch, the final access request is sent to the virtual machine indicated by the initial access request according to the third destination address information, including: based on the tunnel bridge br-tun and the integrated bridge br-int, the final access request is sent to the virtual machine indicated by the initial access request according to the third destination address information. Specifically, after converting the IP address of the port of the virtual switch in the second destination address information into the IP address of the virtual machine based on the tunnel bridge br-tun, converting the port number of the interface in the second destination address information into the port number of the virtual machine, and changing the MAC address of the port of the virtual switch in the second destination address information into the MAC address of the virtual machine, the final access request can be sent to the integrated bridge br-int based on the tunnel bridge br-tun, and then based on the integrated bridge br-int, the final access request can be sent to the virtual machine indicated by the initial access request. Optionally, based on the integrated bridge br-int, according to the MAC address information in the third destination address information, in the embodiment of the present disclosure, the final access request can be sent to the virtual machine indicated by the initial access request for the MAC address of the virtual machine. In the process of accessing the virtual machine indicated by the initial access request based on the third destination address information in the final access request, first, the final access request is sent to the indicated virtual machine so that the virtual machine makes an access response according to the received access request.

[0077] The integrated bridge br-int and the tunnel bridge br-tun are connected via a first bridge port patch-int and a second bridge port patch-tun.

[0078] Optionally, an Ethernet interface veth is also deployed in the integrated bridge br-int, and a physical network card interface eth0 is also deployed in the virtual machine. Specifically, based on the integrated bridge br-int, according to the Normal rule, the final access request can be sent to the Ethernet interface veth, and then based on the Ethernet interface veth, it can be sent to the virtual machine indicated by the initial access request through the physical network card interface eth0 deployed in the virtual machine.

[0079] S206, generating access response data based on the virtual machine indicated by the initial access request; and feeding back the access response data to the client that issued the initial access request.

[0080] Among them, after the final access request is sent to the virtual machine indicated by the initial access request based on the virtual switch according to the third destination address information, access response data can be generated based on the virtual machine indicated by the initial access request. Optionally, the service or application pointed to by the final access request can be determined based on the IP address of the virtual machine, the port number of the virtual machine, and the MAC address of the virtual machine in the third address information, and the corresponding response data can be obtained to generate access response data. The access response data is fed back to the client that issued the initial access request to complete the access process of the virtual machine.

[0081] In the disclosed embodiment, an initial access request transmitted by a physical network card interface is received through a virtual bridge interface, and based on the virtual bridge interface, the IP address of the interface in the first destination address information is converted into the IP address of the port of the virtual switch, and the MAC address of the interface in the first destination address information is changed into the MAC address of the port of the virtual switch; based on the virtual bridge interface, the processed access request is sent to the port of the virtual switch according to the second destination address information, and based on the virtual switch, the IP address of the port of the virtual switch in the second destination address information is converted into the IP address of the virtual machine, the port number of the interface in the second destination address information is converted into the port number of the virtual machine, and the MAC address of the port of the virtual switch in the second destination address information is changed into the MAC address of the virtual machine; based on the virtual switch, The method further comprises the following steps: first, converting the first destination address information in the initial access request into the second destination address information based on the virtual bridge interface to obtain a processed access request; second, converting the second destination address information in the processed access request into the third destination address information based on the virtual switch to obtain a final access request; and accessing the virtual machine indicated by the initial access request based on the third destination address information. The method further comprises the steps of: converting the first destination address information in the initial access request into the second destination address information based on the virtual bridge interface to obtain a processed access request; converting the second destination address information in the processed access request into the third destination address information based on the virtual switch to obtain a final access request; and accessing the virtual machine indicated by the initial access request based on the third destination address information in the final access request, thereby achieving accurate conversion of the destination address information and improving the accuracy of virtual machine access.

[0082] Figure 3 is a schematic diagram according to the third embodiment of the present disclosure. Figure 3 As shown, the method for accessing a virtual machine provided by the third embodiment of the present disclosure includes:

[0083] S301. Generate initial access response data based on the virtual machine indicated by the initial access request, and send the initial access response data to the port of the virtual switch; wherein the initial access response data includes fourth source address information, and the fourth source address information is the address information of the virtual machine.

[0084] The description of the initial access response data may refer to the description in step S206, and this step will not be repeated. Specifically, after the initial access response data is generated based on the virtual machine indicated by the initial access request, the initial access response data may be sent to the port of the virtual switch, wherein the description of the port of the virtual switch may refer to the description in step S203, and this step will not be repeated.

[0085] The fourth source address information includes the IP address of the virtual machine, the port number of the virtual machine, and the MAC address of the virtual machine; the fifth source address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch. Here, the fourth source address information and the fifth source address information are further limited, so that the specific content of converting the fourth source address information into the fifth address information is clearer.

[0086] S302. Based on the virtual switch, convert the fourth source address information in the initial access response data into fifth source address information to obtain processed access response data; wherein the fifth source address information is the address information of the port of the virtual switch; and based on the virtual switch, send the processed access response data to the virtual bridge interface.

[0087] Optionally, based on the virtual switch, converting the fourth source address information in the initial access response data into the fifth source address information to obtain the processed access response data may include:

[0088] Based on the virtual switch, the IP address of the virtual machine in the fourth source address information is converted into the IP address of the port of the virtual switch, the port number of the virtual machine in the fourth source address information is converted into the port number of the interface, and the MAC address of the virtual machine in the fourth source address information is changed into the MAC address of the port of the virtual switch. This process is a specific process of converting the fourth source address information in the access response data into the fifth source address information after further limiting the fourth source address information and the fifth source address information described above, and the access process is more specific.

[0089] Optionally, based on the virtual switch, according to the flow table of the pre-deployed virtual switch OVS, the IP address of the virtual machine in the fourth source address information can be first converted to the IP address of the port of the virtual switch, and the port number of the virtual machine in the fourth source address information can be converted to the port number of the interface. Specifically, based on the virtual switch, according to the flow table item of the flow table, if the source IP address of the matched received data packet is the IP address of the virtual machine, the source port number is the port number of the virtual machine, and the data packet is received by the virtual switch via the integrated bridge br-int, then the data packet is first forwarded to the dedicated table for destination address conversion, and then according to the flow table item of the flow table, the data packet is extracted from the dedicated table for destination address conversion, and according to the network address conversion NAT of the virtual switch OVS, the IP address of the virtual machine in the fourth source address information is converted to the IP address of the port of the virtual switch, and the port number of the virtual machine in the fourth source address information is converted to the port number of the interface. Among them, the destination address conversion rule NAT is based on the connection tracking technology conntrack. Specifically, the connection tracking technology (ConnectionTracking, referred to as conntrack) is one of the important functions built on the Netfilter framework. Connection tracking allows the kernel to track all logical network connections or sessions, thereby correlating all packets that may constitute that connection. Network address translation NAT relies on this information to translate all related packets in the same way, while container rules iptables can use this information to act as a stateful firewall.

[0090] Optionally, based on the virtual switch and according to the flow table of the pre-deployed virtual switch OVS, the MAC address of the virtual machine in the fourth source address information may be changed to the MAC address of the port of the virtual switch.

[0091] Optionally, if based on a virtual switch, according to the flow table entry of the flow table, if the source IP address of the received data packet that is not matched is the IP address of the virtual machine, or the source port number is the port number of the virtual machine, or the data packet is received by the virtual switch via the integrated bridge br-int, then based on the virtual switch, through the virtual extended LAN tunnel vxlan tunnel deployed on the tunnel bridge br-tun, transmit it to the network node network node, and then forward it to the physical network underlay through the network node network node, and then enter the external network.

[0092] The initial access response data also includes fourth destination address information, which is address information of a client receiving the initial access response data; the fourth destination address information includes an IP address of the client, a port number of the client, and a MAC address of a port of the virtual switch;

[0093] The processed access response data also includes fifth destination address information, which includes the IP address of the client, the port number of the client, and the MAC address of the interface. Here, the initial access response data and the processed access response data are further limited. On the basis of the source address information, the destination address information is also included, making the description of the initial access response data and the processed access response data more specific.

[0094] Optionally, before sending the processed access response data to the virtual bridge interface based on the virtual switch, the method further includes: based on the virtual switch, changing the MAC address of the port of the virtual switch in the fourth destination address information to the MAC address of the interface. Based on the further definition of the initial access response data and the processed access response data above, while converting the fourth source address information in the initial access response data to the fifth source address information based on the virtual bridge interface, the fourth destination address information in the initial access response data is also converted to the corresponding address information. This process further refines the process of converting the initial access response data to the processed access response data.

[0095] Optionally, based on the virtual switch, according to the flow table of the pre-deployed virtual switch OVS, the MAC address of the port of the virtual switch in the fourth destination address information may be changed to the MAC address of the interface.

[0096] S303. Based on the virtual bridge interface, convert the fifth source address information in the processed access response data into the sixth source address information to obtain the final access response data; wherein the sixth source address information is the address information of the virtual bridge interface; and based on the virtual bridge interface, send the final access response data to the client.

[0097] Optionally, the sixth source address information includes the IP address of the interface, the port number of the interface, and the MAC address of the interface. Wherein, after further limiting the sixth source address information, the specific content of converting the fifth source address information in the access response data into the sixth source address information is clearer. Optionally, based on the virtual bridge interface, the fifth source address information in the processed access response data is converted into the sixth source address information to obtain the final access response data, which may include: based on the virtual bridge interface, converting the IP address of the port of the virtual switch in the fifth source address information into the IP address of the interface, and changing the MAC address of the port of the virtual switch in the fifth source address information into the MAC address of the interface. Wherein, this process is the specific process of converting the fifth source address information in the access request into the sixth source address information after further limiting the sixth source address information described above, and the access process is more specific. Specifically, the correspondence between the pre-deployed fifth source address information and the sixth source address information can be obtained first, and then based on the virtual bridge interface, according to the correspondence between the pre-deployed fifth source address information and the sixth source address information, the IP address of the port of the virtual switch in the fifth source address information is converted to the IP address of the interface, and the MAC address of the port of the virtual switch in the fifth source address information is changed to the MAC address of the interface. Optionally, the correspondence between the fifth source address information and the sixth source address information of the virtual bridge interface of the server can be pre-deployed through the source network address conversion SDNT IP container rule (iptables rule), that is, the iptables rule of SNAT. Among them, SNAT is a network address translation technology used to change the source IP address and port number in the data packet. When a data packet is transmitted from an internal network to an external network, SNAT replaces the source IP address and port number in the data packet with the public IP address and port number used by the NAT device so that it can be transmitted and responded on the external network.

[0098] Among them, the final access response data also includes the sixth destination address information, and the sixth destination address information includes the IP address of the client, the port number of the client and the MAC address of the client. Among them, this is a further limitation on the final access response data. On the basis of the source address information, it also includes the destination address information, so that the description of the final access response data is more specific. Specifically, before sending the final access response data to the client based on the virtual bridge interface, it can also include: based on the virtual bridge interface, changing the MAC address of the interface in the fifth destination address information to the MAC address of the client. Among them, based on the further limitation on the final access response data above, while converting the fifth source address information in the processed access response data into the sixth source address information based on the virtual bridge interface, the fifth destination address information in the processed access response data is also converted to the corresponding address information. This process further refines the process of converting the processed access response data to the final access response data.

[0099] Optionally, the server also deploys a correspondence between the fourth source address information and the fifth source address information, a correspondence between the fifth source address information and the sixth source address information, a correspondence between the fourth destination address information and the fifth destination address information, and a correspondence between the fifth destination address information and the sixth destination address information. The pre-deployed multiple correspondences can provide a conversion basis for address conversion.

[0100] Figure 4 A schematic diagram of the structure of a server for implementing the method of accessing a virtual machine according to an embodiment of the present disclosure. A virtual switch, at least one virtual machine, a physical network card interface, and a virtual bridge interface are deployed in the server, and the virtual bridge interface is connected to the physical network card interface and the virtual switch, respectively. Specifically, a first virtual Ethernet device port and a second virtual Ethernet device port, a tunnel bridge, and an integrated bridge are also deployed in the server, wherein the first virtual Ethernet device port is connected to the virtual bridge interface and the second virtual Ethernet device port, respectively, wherein the second virtual Ethernet device port is connected to the first virtual Ethernet device port and the tunnel bridge, wherein the tunnel bridge and the integrated bridge are connected via the first bridge port and the second bridge port deployed thereon, respectively, wherein the integrated bridge and the virtual machine are connected via the Ethernet interface and the physical network card interface deployed thereon, respectively.

[0101] In an embodiment of the present disclosure, an access response data is generated based on a virtual machine indicated by an initial access request; and a process of feeding back the access response data to a client that issued the initial access request is described in detail. The initial access response data is generated based on the virtual machine indicated by the initial access request, and the initial access response data is sent to a port of a virtual switch; wherein the initial access response data includes fourth source address information, and the fourth source address information is address information of the virtual machine. Based on the virtual switch, the fourth source address information in the initial access response data is converted into fifth source address information to obtain processed access response data; wherein the fifth source address information is address information of the port of the virtual switch. address information; and based on the virtual switch, sending the processed access response data to the virtual bridge interface, based on the virtual bridge interface, converting the fifth source address information in the processed access response data into the sixth source address information to obtain final access response data; wherein the sixth source address information is the address information of the virtual bridge interface; and based on the virtual bridge interface, sending the final access response data to the client, wherein, by converting the fourth source address information in the initial access response data into the fifth source address information, and converting the fifth source address information in the processed access response data into the sixth source address information, accurate conversion of the source address information is achieved, thereby improving the accuracy of virtual machine access.

[0102] Figure 5 The block diagram of the apparatus for accessing a virtual machine used to implement the method for accessing a virtual machine of the embodiment of the present disclosure is as follows: Figure 5 As shown, the virtual machine access device 500 provided in the fourth embodiment of the present disclosure is applied to a server, in which a virtual switch, at least one virtual machine, a physical network card interface and a virtual bridge interface are deployed. The virtual bridge interface is connected to the physical network card interface and the virtual switch respectively. The device includes:

[0103] The receiving unit 501 is used to receive an initial access request transmitted by the physical network card interface through the virtual bridge interface; wherein the initial access request is used to indicate access to the virtual machine, and the initial access request includes first destination address information, and the first destination address information is address information of the virtual bridge interface;

[0104] The first conversion unit 502 is used to convert the first destination address information in the initial access request into the second destination address information based on the virtual bridge interface to obtain a processed access request; wherein the second destination address information is the address information of the port of the virtual switch, and based on the virtual bridge interface, send the processed access request to the port of the virtual switch according to the second destination address information;

[0105] The second conversion unit 503 is used to convert the second destination address information in the processed access request into third destination address information based on the virtual switch to obtain a final access request; wherein the third destination address information is address information of the virtual machine;

[0106] The access unit 504 is configured to access the virtual machine indicated by the initial access request based on the third destination address information in the final access request.

[0107] In some embodiments, the first destination address information includes the IP address of the interface, the port number of the interface, and the MAC address of the interface; the second destination address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch.

[0108] In some embodiments, the first conversion unit 502 is specifically used to convert the IP address of the interface in the first destination address information into the IP address of the port of the virtual switch based on the virtual bridge interface, and change the MAC address of the interface in the first destination address information into the MAC address of the port of the virtual switch.

[0109] In some embodiments, the initial access request also includes first source address information, which is the address information of the client that issues the initial access request; wherein the first source address information includes the IP address of the client, the port number of the client, and the MAC address of the client; the processed access request also includes second source address information, which includes the IP address of the client, the port number of the client, and the MAC address of the interface, and the MAC address of the interface is the MAC address of the virtual bridge interface.

[0110] In some embodiments, the device further includes: a third conversion unit, configured to change the MAC address of the client in the first source address information to the MAC address of the interface based on the virtual bridge interface.

[0111] In some embodiments, the second destination address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch; the third destination address information includes the IP address of the virtual machine, the port number of the virtual machine, and the MAC address of the virtual machine.

[0112] In some embodiments, the second conversion unit 503 is specifically used to: based on the virtual switch, convert the IP address of the port of the virtual switch in the second destination address information into the IP address of the virtual machine, convert the port number of the interface in the second destination address information into the port number of the virtual machine, and change the MAC address of the port of the virtual switch in the second destination address information into the MAC address of the virtual machine.

[0113] In some embodiments, the processed access request also includes second source address information, which includes the IP address of the client, the port number of the client and the MAC address of the interface, and the MAC address of the interface is the MAC address of the virtual bridge interface; the final access request also includes third source address information, which includes the IP address of the client, the port number of the client and the MAC address of the port of the virtual switch.

[0114] In some embodiments, the device further includes: a fourth conversion unit, configured to change the MAC address of the interface in the second source address information to the MAC address of the port of the virtual switch based on the virtual switch.

[0115] In some embodiments, a first virtual Ethernet device port and a second virtual Ethernet device port are also deployed in the server, and the first virtual Ethernet device port is connected to the virtual bridge interface and the second virtual Ethernet device port respectively; wherein the second destination address information is the address information of the second virtual Ethernet device port.

[0116] In some embodiments, the first conversion unit 502 is further configured to: based on the virtual bridge interface, send the processed access request to the second virtual Ethernet device port through the first virtual Ethernet device port according to the second destination address information.

[0117] In some embodiments, the access unit 504 includes: a sending module, which is used to send the final access request to the virtual machine indicated by the initial access request based on the virtual switch and according to the third destination address information; a response module, which is used to generate access response data based on the virtual machine indicated by the initial access request; and feed back the access response data to the client that issued the initial access request.

[0118] In some embodiments, the response module includes: a response submodule, which is used to generate initial access response data based on the virtual machine indicated by the initial access request, and send the initial access response data to the port of the virtual switch; wherein the initial access response data includes fourth source address information, and the fourth source address information is the address information of the virtual machine;

[0119] A first conversion submodule is used to convert the fourth source address information in the initial access response data into fifth source address information based on the virtual switch to obtain processed access response data; wherein the fifth source address information is address information of the port of the virtual switch; and based on the virtual switch, send the processed access response data to the virtual bridge interface;

[0120] The second conversion submodule is used to convert the fifth source address information in the processed access response data into the sixth source address information based on the virtual bridge interface to obtain the final access response data; wherein the sixth source address information is the address information of the virtual bridge interface; and based on the virtual bridge interface, send the final access response data to the client.

[0121] In some embodiments, the fourth source address information includes the IP address of the virtual machine, the port number of the virtual machine and the MAC address of the virtual machine; the fifth source address information includes the IP address of the port of the virtual switch, the port number of the interface and the MAC address of the port of the virtual switch.

[0122] In some embodiments, the first conversion submodule is specifically used to: based on the virtual switch, convert the IP address of the virtual machine in the fourth source address information into the IP address of the port of the virtual switch, convert the port number of the virtual machine in the fourth source address information into the port number of the interface, and change the MAC address of the virtual machine in the fourth source address information into the MAC address of the port of the virtual switch.

[0123] In some embodiments, the initial access response data also includes fourth destination address information, which is the address information of the client receiving the initial access response data; wherein the fourth destination address information includes the IP address of the client, the port number of the client, and the MAC address of the port of the virtual switch; the processed access response data also includes fifth destination address information, which includes the IP address of the client, the port number of the client, and the MAC address of the interface.

[0124] In some embodiments, the response module further includes: a third conversion submodule, configured to change the MAC address of the port of the virtual switch in the fourth destination address information into the MAC address of the interface based on the virtual switch.

[0125] In some embodiments, the fifth source address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch; the sixth source address information includes the IP address of the interface, the port number of the interface, and the MAC address of the interface.

[0126] In some embodiments, the second conversion submodule is specifically used to: based on the virtual bridge interface, convert the IP address of the port of the virtual switch in the fifth source address information into the IP address of the interface, and change the MAC address of the port of the virtual switch in the fifth source address information into the MAC address of the interface.

[0127] In some embodiments, the processed access response data also includes fifth destination address information, which includes the IP address of the client, the port number of the client, and the MAC address of the interface; the final access response data also includes sixth destination address information, which includes the IP address of the client, the port number of the client, and the MAC address of the client.

[0128] In some embodiments, the response module further includes: a fourth conversion submodule, configured to change the MAC address of the interface in the fifth destination address information to the MAC address of the client based on the virtual bridge interface.

[0129] In some embodiments, the server also deploys a correspondence between the first destination address information and the second destination address information, a correspondence between the second destination address information and the third destination address information, a correspondence between the first source address information and the second source address information, and a correspondence between the second source address information and the third source address information.

[0130] In some embodiments, the server also deploys a correspondence between the fourth source address information and the fifth source address information, a correspondence between the fifth source address information and the sixth source address information, a correspondence between the fourth destination address information and the fifth destination address information, and a correspondence between the fifth destination address information and the sixth destination address information.

[0131] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a computer program product.

[0132] According to an embodiment of the present disclosure, the present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute Figures 1 to 3 Any of the methods.

[0133] According to an embodiment of the present disclosure, the present disclosure also provides a computer program product, which includes: a computer program, the computer program is stored in a readable storage medium, at least one processor of an electronic device can read the computer program from the readable storage medium, and at least one processor executes the computer program so that the electronic device executes the solution provided by any of the above embodiments.

[0134] Figure 5 The provided virtual machine access device can execute the steps involved in the terminal in the above-mentioned corresponding method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0135] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the solution provided by any of the above embodiments.

[0136] According to an embodiment of the present disclosure, the present disclosure further provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute a solution provided by any of the above embodiments.

[0137] According to an embodiment of the present disclosure, the present disclosure also provides a computer program product, which includes: a computer program, the computer program is stored in a readable storage medium, at least one processor of an electronic device can read the computer program from the readable storage medium, and at least one processor executes the computer program so that the electronic device executes the solution provided by any of the above embodiments.

[0138] Figure 6 It is a block diagram of an electronic device for implementing the method of virtual machine access of the embodiment of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0139] like Figure 6 As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0140] A number of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0141] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as a virtual machine access method. For example, in some embodiments, the virtual machine access method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the virtual machine access method described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform the virtual machine access method in any other appropriate manner (e.g., by means of firmware).

[0142] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0143] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0144] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0145] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0146] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0147] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0148] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0149] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for accessing a virtual machine, applied to a server, wherein the server is deployed with a virtual switch, at least one virtual machine, a physical network card interface, and a virtual bridge interface, wherein the virtual bridge interface is connected to the physical network card interface and the virtual switch, respectively, the method comprising: receiving, through the virtual bridge interface, an initial access request transmitted by the physical network card interface; wherein the initial access request is used to instruct access to the virtual machine, and the initial access request includes first destination address information, and the first destination address information is address information of the virtual bridge interface; Based on the correspondence between the first destination address and the second destination address of the virtual bridge interface, convert the first destination address information in the initial access request into second destination address information to obtain a processed access request; wherein the second destination address information is address information of a port of the virtual switch, and based on the virtual bridge interface, send the processed access request to the port of the virtual switch according to the second destination address information; Based on the correspondence between the second destination address and the third destination address of the virtual switch, convert the second destination address information in the processed access request into third destination address information to obtain a final access request; wherein the third destination address information is address information of the virtual machine; Based on the third destination address information in the final access request, access the virtual machine indicated by the initial access request.

2. The method according to claim 1, wherein The first destination address information includes the IP address of the interface, the port number of the interface, and the MAC address of the interface; the second destination address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch.

3. The method according to claim 2, wherein: Converting the first destination address information in the initial access request to second destination address information based on the virtual bridge interface to obtain a processed access request includes: Based on the virtual bridge interface, the IP address of the interface in the first destination address information is converted into the IP address of the port of the virtual switch, and the MAC address of the interface in the first destination address information is changed into the MAC address of the port of the virtual switch.

4. The method according to claim 3, wherein: The initial access request also includes first source address information, which is the address information of the client that issues the initial access request; wherein the first source address information includes the client's IP address, the client's port number, and the client's MAC address; The processed access request also includes second source address information, which includes the IP address of the client, the port number of the client and the MAC address of the interface, and the MAC address of the interface is the MAC address of the virtual bridge interface.

5. The method according to claim 4, wherein Before sending the processed access request to the port of the virtual switch according to the second destination address information based on the virtual bridge interface, the method further includes: Based on the virtual bridge interface, the MAC address of the client in the first source address information is changed to the MAC address of the interface.

6. The method according to claim 5, wherein: The second destination address information includes the IP address of the virtual switch port, the port number of the interface, and the MAC address of the virtual switch port; the third destination address information includes the IP address of the virtual machine, the port number of the virtual machine, and the MAC address of the virtual machine.

7. The method according to claim 6, wherein: Based on the virtual switch, converting the second destination address information in the processed access request into third destination address information to obtain a final access request, including: Based on the virtual switch, the IP address of the port of the virtual switch in the second destination address information is converted into the IP address of the virtual machine, the port number of the interface in the second destination address information is converted into the port number of the virtual machine, and the MAC address of the port of the virtual switch in the second destination address information is changed to the MAC address of the virtual machine.

8. The method according to claim 7, wherein: The processed access request further includes second source address information, where the second source address information includes the IP address of the client, the port number of the client, and the MAC address of the interface, where the MAC address of the interface is the MAC address of the virtual bridge interface; The final access request also includes third source address information, and the third source address information includes the IP address of the client, the port number of the client, and the MAC address of the port of the virtual switch.

9. The method according to claim 8, wherein Before accessing the virtual machine indicated by the initial access request based on the third destination address information in the final access request, the method further includes: Based on the virtual switch, the MAC address of the interface in the second source address information is changed to the MAC address of the port of the virtual switch.

10. The method according to claim 9, wherein: The server is further provided with a first virtual Ethernet device port and a second virtual Ethernet device port, wherein the first virtual Ethernet device port is connected to the virtual bridge interface and the second virtual Ethernet device port respectively; The second destination address information is the address information of the second virtual Ethernet device port.

11. The method according to claim 10, wherein: The method includes sending the processed access request to the port of the virtual switch based on the virtual bridge interface and according to the second destination address information, comprising: Based on the virtual bridge interface, the processed access request is sent to the second virtual Ethernet device port through the first virtual Ethernet device port according to the second destination address information.

12. The method according to claim 11, wherein Accessing the virtual machine indicated by the initial access request based on the third destination address information in the final access request includes: Based on the virtual switch, sending the final access request to the virtual machine indicated by the initial access request according to the third destination address information; Based on the virtual machine indicated by the initial access request, access response data is generated; and the access response data is fed back to the client that issued the initial access request.

13. The method according to claim 12, wherein: Generating access response data based on the virtual machine indicated by the initial access request; and feeding back the access response data to the client that issued the initial access request, including: Generate initial access response data based on the virtual machine indicated by the initial access request, and send the initial access response data to the port of the virtual switch; wherein the initial access response data includes fourth source address information, and the fourth source address information is address information of the virtual machine; Based on the virtual switch, convert the fourth source address information in the initial access response data into fifth source address information to obtain processed access response data; wherein the fifth source address information is address information of a port of the virtual switch; and based on the virtual switch, send the processed access response data to the virtual bridge interface; Based on the virtual bridge interface, the fifth source address information in the processed access response data is converted into sixth source address information to obtain final access response data; wherein, the sixth source address information is the address information of the virtual bridge interface; and based on the virtual bridge interface, the final access response data is sent to the client.

14. The method according to claim 13, wherein The fourth source address information includes the IP address of the virtual machine, the port number of the virtual machine, and the MAC address of the virtual machine; the fifth source address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch.

15. The method according to claim 14, wherein Based on the virtual switch, converting the fourth source address information in the initial access response data into fifth source address information to obtain processed access response data, including: Based on the virtual switch, the IP address of the virtual machine in the fourth source address information is converted into the IP address of the port of the virtual switch, the port number of the virtual machine in the fourth source address information is converted into the port number of the interface, and the MAC address of the virtual machine in the fourth source address information is changed to the MAC address of the port of the virtual switch.

16. The method according to claim 15, wherein The initial access response data also includes fourth destination address information, which is address information of a client receiving the initial access response data; wherein the fourth destination address information includes an IP address of the client, a port number of the client, and a MAC address of a port of the virtual switch; The processed access response data further includes fifth destination address information, and the fifth destination address information includes the IP address of the client, the port number of the client, and the MAC address of the interface.

17. The method according to claim 16, wherein Before sending the processed access response data to the virtual bridge interface based on the virtual switch, the method further includes: Based on the virtual switch, the MAC address of the port of the virtual switch in the fourth destination address information is changed to the MAC address of the interface.

18. The method according to claim 17, wherein The fifth source address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch; the sixth source address information includes the IP address of the interface, the port number of the interface, and the MAC address of the interface.

19. The method according to claim 18, wherein Based on the virtual bridge interface, converting the fifth source address information in the processed access response data into sixth source address information to obtain final access response data, including: Based on the virtual bridge interface, the IP address of the port of the virtual switch in the fifth source address information is converted into the IP address of the interface, and the MAC address of the port of the virtual switch in the fifth source address information is changed into the MAC address of the interface.

20. The method according to claim 19, wherein The processed access response data further includes fifth destination address information, wherein the fifth destination address information includes the IP address of the client, the port number of the client, and the MAC address of the interface; The final access response data also includes sixth destination address information, and the sixth destination address information includes the IP address of the client, the port number of the client, and the MAC address of the client.

21. The method according to claim 20, wherein Before sending the final access response data to the client based on the virtual bridge interface, the method further includes: Based on the virtual bridge interface, the MAC address of the interface in the fifth destination address information is changed to the MAC address of the client.

22. The method according to claim 21, wherein The server also deploys the correspondence between the first destination address information and the second destination address information, the correspondence between the second destination address information and the third destination address information, the correspondence between the first source address information and the second source address information, and the correspondence between the second source address information and the third source address information.

23. The method according to claim 22, wherein The server also deploys the correspondence between the fourth source address information and the fifth source address information, the correspondence between the fifth source address information and the sixth source address information, the correspondence between the fourth destination address information and the fifth destination address information, and the correspondence between the fifth destination address information and the sixth destination address information.

24. A device for accessing a virtual machine, applied to a server, wherein the server is deployed with a virtual switch, at least one virtual machine, a physical network card interface, and a virtual bridge interface, wherein the virtual bridge interface is connected to the physical network card interface and the virtual switch, respectively, the device comprising: a receiving unit, configured to receive, through the virtual bridge interface, an initial access request transmitted by the physical network card interface; wherein the initial access request is used to instruct access to the virtual machine, and the initial access request includes first destination address information, where the first destination address information is address information of the virtual bridge interface; a first conversion unit, configured to convert the first destination address information in the initial access request into second destination address information based on a correspondence between the first destination address and the second destination address of the virtual bridge interface, to obtain a processed access request; wherein the second destination address information is address information of a port of the virtual switch, and send the processed access request to the port of the virtual switch based on the virtual bridge interface and according to the second destination address information; a second conversion unit, configured to convert the second destination address information in the processed access request into third destination address information based on a correspondence between the second destination address and the third destination address of the virtual switch, to obtain a final access request; wherein the third destination address information is address information of the virtual machine; An access unit is configured to access the virtual machine indicated by the initial access request based on the third destination address information in the final access request.

25. The apparatus according to claim 24, wherein The first destination address information includes the IP address of the interface, the port number of the interface, and the MAC address of the interface; the second destination address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch.

26. The device according to claim 25, wherein The first conversion unit is specifically used to convert the IP address of the interface in the first destination address information into the IP address of the port of the virtual switch based on the virtual bridge interface, and change the MAC address of the interface in the first destination address information into the MAC address of the port of the virtual switch.

27. The device according to claim 26, wherein The initial access request also includes first source address information, which is the address information of the client that issues the initial access request; wherein the first source address information includes the client's IP address, the client's port number, and the client's MAC address; The processed access request also includes second source address information, which includes the IP address of the client, the port number of the client and the MAC address of the interface, and the MAC address of the interface is the MAC address of the virtual bridge interface.

28. The apparatus according to claim 27, wherein The device further comprises: The third conversion unit is configured to change the MAC address of the client in the first source address information to the MAC address of the interface based on the virtual bridge interface.

29. The apparatus according to claim 28, wherein The second destination address information includes the IP address of the virtual switch port, the port number of the interface, and the MAC address of the virtual switch port; the third destination address information includes the IP address of the virtual machine, the port number of the virtual machine, and the MAC address of the virtual machine.

30. The apparatus according to claim 29, wherein The second conversion unit is specifically configured to: Based on the virtual switch, the IP address of the port of the virtual switch in the second destination address information is converted into the IP address of the virtual machine, the port number of the interface in the second destination address information is converted into the port number of the virtual machine, and the MAC address of the port of the virtual switch in the second destination address information is changed to the MAC address of the virtual machine.

31. The device according to claim 30, wherein The processed access request further includes second source address information, where the second source address information includes the IP address of the client, the port number of the client, and the MAC address of the interface, where the MAC address of the interface is the MAC address of the virtual bridge interface; The final access request also includes third source address information, and the third source address information includes the IP address of the client, the port number of the client, and the MAC address of the port of the virtual switch.

32. The apparatus according to claim 31, wherein The device further comprises: The fourth conversion unit is configured to change the MAC address of the interface in the second source address information into the MAC address of the port of the virtual switch based on the virtual switch.

33. The apparatus according to claim 32, wherein The server is further provided with a first virtual Ethernet device port and a second virtual Ethernet device port, wherein the first virtual Ethernet device port is connected to the virtual bridge interface and the second virtual Ethernet device port respectively; The second destination address information is the address information of the second virtual Ethernet device port.

34. The apparatus according to claim 33, wherein The first conversion unit is further configured to: Based on the virtual bridge interface, the processed access request is sent to the second virtual Ethernet device port through the first virtual Ethernet device port according to the second destination address information.

35. The apparatus of claim 34, wherein: The access unit includes: a sending module, configured to send the final access request to the virtual machine indicated by the initial access request based on the virtual switch and according to the third destination address information; The response module is configured to generate access response data based on the virtual machine indicated by the initial access request, and feed back the access response data to the client that issued the initial access request.

36. The apparatus of claim 35, wherein: The response module includes: a response submodule, configured to generate initial access response data based on the virtual machine indicated by the initial access request, and send the initial access response data to the port of the virtual switch; wherein the initial access response data includes fourth source address information, and the fourth source address information is address information of the virtual machine; a first conversion submodule, configured to convert, based on the virtual switch, the fourth source address information in the initial access response data into fifth source address information to obtain processed access response data; wherein the fifth source address information is address information of a port of the virtual switch; and send the processed access response data to the virtual bridge interface based on the virtual switch; The second conversion sub-module is used to convert the fifth source address information in the processed access response data into sixth source address information based on the virtual bridge interface to obtain final access response data; wherein the sixth source address information is the address information of the virtual bridge interface; and based on the virtual bridge interface, send the final access response data to the client.

37. The apparatus according to claim 36, wherein The fourth source address information includes the IP address of the virtual machine, the port number of the virtual machine, and the MAC address of the virtual machine; the fifth source address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch.

38. The apparatus according to claim 37, wherein The first conversion submodule is specifically configured to: Based on the virtual switch, the IP address of the virtual machine in the fourth source address information is converted into the IP address of the port of the virtual switch, the port number of the virtual machine in the fourth source address information is converted into the port number of the interface, and the MAC address of the virtual machine in the fourth source address information is changed to the MAC address of the port of the virtual switch.

39. The apparatus according to claim 38, wherein The initial access response data also includes fourth destination address information, which is address information of a client receiving the initial access response data; wherein the fourth destination address information includes an IP address of the client, a port number of the client, and a MAC address of a port of the virtual switch; The processed access response data further includes fifth destination address information, and the fifth destination address information includes the IP address of the client, the port number of the client, and the MAC address of the interface.

40. The apparatus of claim 39, wherein The response module also includes: The third conversion submodule is configured to change the MAC address of the port of the virtual switch in the fourth destination address information to the MAC address of the interface based on the virtual switch.

41. The apparatus according to claim 40, wherein The fifth source address information includes the IP address of the port of the virtual switch, the port number of the interface, and the MAC address of the port of the virtual switch; the sixth source address information includes the IP address of the interface, the port number of the interface, and the MAC address of the interface.

42. The apparatus according to claim 41, wherein The second conversion submodule is specifically configured to: Based on the virtual bridge interface, the IP address of the port of the virtual switch in the fifth source address information is converted into the IP address of the interface, and the MAC address of the port of the virtual switch in the fifth source address information is changed into the MAC address of the interface.

43. The apparatus according to claim 42, wherein The processed access response data further includes fifth destination address information, wherein the fifth destination address information includes the IP address of the client, the port number of the client, and the MAC address of the interface; The final access response data also includes sixth destination address information, and the sixth destination address information includes the IP address of the client, the port number of the client, and the MAC address of the client.

44. The apparatus of claim 43, wherein: The response module also includes: The fourth conversion submodule is configured to change the MAC address of the interface in the fifth destination address information to the MAC address of the client based on the virtual bridge interface.

45. The apparatus of claim 44, wherein: The server also deploys the correspondence between the first destination address information and the second destination address information, the correspondence between the second destination address information and the third destination address information, the correspondence between the first source address information and the second source address information, and the correspondence between the second source address information and the third source address information.

46. ​​The apparatus of claim 45, wherein The server also deploys the correspondence between the fourth source address information and the fifth source address information, the correspondence between the fifth source address information and the sixth source address information, the correspondence between the fourth destination address information and the fifth destination address information, and the correspondence between the fifth destination address information and the sixth destination address information.

47. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 23.

48. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-23.

49. A computer program product comprising a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 23.

Images