Xin creation operating system kernel state virtual switch

Abstract

The application relates to the technical field of operating systems, in particular to a kernel-mode virtual switch of a Xiongmao operating system. The kernel-mode virtual switch of the Xiongmao operating system adopts an operating system kernel module to provide virtual switch services, supports loading and logging off of the kernel module, supports a standard virtual local area network (VLAN) model and a trunk relay mode, an overlay superposition tunnel, media access control (MAC) forwarding, Internet protocol (IP) routing, a lightweight database, quality of service (QoS) configuration and management, a source MAC load balancing mode, flow control and monitoring, a security group, network address translation (NAT) and Internet protocol version 6 (IPv6). The kernel-mode virtual switch of the Xiongmao operating system can effectively improve the processing speed of network data packets, guarantee network bandwidth indexes and improve the network use experience of cloud users.

Description

Technical Field

[0001] This invention relates to the field of operating system technology, and in particular to a kernel-mode virtual switch for a domestically developed operating system. Background Technology

[0002] With the continuous development and popularization of cloud computing technology, virtualization technology has also been widely used. A virtual switch is a network switching device based on software or hardware that can realize communication and data transmission between virtual networks. In the cloud computing environment, the virtual switch is one of the core components for realizing cloud service networks.

[0003] In operating systems, network applications are divided into two modes: kernel mode and user mode. Kernel mode refers to programs running in the operating system kernel, which have higher privileges and faster processing capabilities; while user mode refers to programs running in the operating system's user space, which are limited by the operating system's privileges and performance. In network applications, kernel mode is mainly responsible for the underlying network protocol stack processing and network device driver management, while user mode is responsible for implementing network protocols at the application layer, presentation layer, and session layer.

[0004] A virtual switch is typically an application running in user space, which transmits and processes network data by calling the network protocol stack and network device drivers in the operating system kernel space. However, this architecture has certain drawbacks, as frequent switching between kernel space and user space can lead to significant performance loss, affecting the performance and stability of the virtual switch.

[0005] To reduce performance loss caused by frequent switching between kernel mode and user mode, and to avoid affecting the performance and stability of virtual switches, this invention proposes a kernel-mode virtual switch for a domestically developed operating system. Summary of the Invention

[0006] To overcome the shortcomings of existing technologies, this invention provides a simple and efficient kernel-mode virtual switch for a domestically developed operating system.

[0007] This invention is achieved through the following technical solution:

[0008] A virtual switch in the kernel mode of an operating system for domestic IT innovation is characterized by providing virtual switch services in the form of an operating system kernel module, integrating network data exchange and network data routing into the operating system kernel, and supporting the loading and unloading functions of the kernel module.

[0009] The virtual switch supports the standard Virtual Local Area Network (VLAN) model and Trunk mode, supports Overlay tunneling, supports Media Access Control Address (MAC) forwarding, supports Internet Protocol (IP) routing, supports lightweight databases, supports Quality of Service (QoS) configuration and management, supports MAC-based load balancing, supports traffic control and monitoring, supports security groups, supports Network Address Translation (NAT), and supports Internet Protocol version 6 (IPv6).

[0010] This invention provides a kernel-mode virtual switch for the domestically developed operating system, supporting both Trunk mode and access port mode in the standard Virtual Local Area Network (VLAN) model.

[0011] The virtual local area network (VLAN) model conforms to the network communication standard IEEE 802.1Q to achieve tenant isolation based on the VLAN model;

[0012] Supported port trunk mode:

[0013] Upon receiving a message, first determine if the message contains VLAN information: if not, add the VLAN information of the Trunk trunk port and forward it; if it does, determine if the Trunk trunk port allows data from the VLAN model to enter: if allowed, forward the message with the original VLAN tag information; otherwise, discard the message.

[0014] When sending a message, the VLAN information of the trunk port is compared with the VLAN information of the message to be sent: if they are equal, the VLAN information is stripped before the message is sent; otherwise, the message is forwarded with the original VLAN tag information.

[0015] Supported access ports:

[0016] Upon receiving a message, first check if the message contains Virtual LAN (VLAN) information: if not, add the VLAN information of the port and forward it; if it does, discard it.

[0017] When sending a message, the VLAN information of the message is stripped off and sent directly.

[0018] This invention relates to a kernel-level virtual switch for a domestically developed operating system, supporting overlay tunnel functionality to meet the needs of virtual machines accessing the underlying underlay network, including:

[0019] It supports Generic Routing Encapsulation (GRE) tunnels. After configuring a Generic Routing Encapsulation (GRE) tunnel, traffic can be encapsulated and decapsulated according to the tunnel type and configuration.

[0020] It supports Virtual eXtensible Local Area Network (VXLAN) tunnels. After configuring a VXLAN tunnel, it encapsulates and decapsulates packets according to the tunnel type and parameters.

[0021] It supports Internet Protocol Security (IPsec) tunnels. After configuring the IPsec function, it encrypts incoming packets and decrypts received tunnel packets.

[0022] It supports Geneve tunnels for general network virtualization encapsulation. After configuring Geneve tunnels, packets are encapsulated and decapsulated according to the tunnel type and parameters.

[0023] This invention relates to a kernel-mode virtual switch for a domestically developed operating system, supporting Layer 2 forwarding rules and performing MAC address forwarding and learning on traffic, including:

[0024] Supports Layer 2 bridging functionality, including the creation and deletion of Layer 2 bridges, and the addition of virtual interfaces to bridges;

[0025] When a virtual machine packet in the same Layer 2 domain receives an Ethernet frame, it first writes the mapping between its source Media Access Control Address (MAC) and the receiving interface into the Media Access Control Address (MAC) table as the basis for subsequent Layer 2 forwarding. The MAC table entries have an aging update mechanism. Entries that have not been refreshed within a user-defined aging time will be deleted. The table also supports querying the Media Access Control Address (MAC) learning process.

[0026] When a virtual machine in the same Layer 2 domain receives an Ethernet frame, it looks up the Media Access Control Address (MAC) table based on the destination MAC address of the Ethernet frame. If no matching entry is found, it forwards the message to all interfaces except the incoming interface (flooding).

[0027] If a matching entry is found, forward the request to the corresponding interface indicated by the entry.

[0028] When the destination Media Access Control (MAC) address is a broadcast address, it is forwarded to all interfaces (except the ingress interface of the packet).

[0029] Simultaneously, the data link layer of the communication protocol can modify the Media Access Control Address (MAC) to perform load balancing;

[0030] Adding logic to support data distribution allows for modification of the target Media Access Control (MAC) address without changing the Internet Protocol (IP) address. This ensures that the virtual IP addresses of all machines in the real physical server cluster and the IP addresses of the load balancer are configured to be consistent, achieving the goal of data distribution without modifying the source and destination addresses of data packets.

[0031] This invention relates to a kernel-mode virtual switch in a domestically developed operating system, which supports Layer 3 Internet Protocol (IP) routing, as detailed below:

[0032] Supports route configuration functions, including route configuration, viewing, deletion, and forwarding.

[0033] It supports Internet Protocol (IP) routing forwarding rules and forwards routes based on the longest match rule;

[0034] Supports default routing, forwarding packets that do not match the rules according to the default routing rules;

[0035] This invention relates to a kernel-mode virtual switch for a domestically developed operating system, and also supports a lightweight database for storing the configuration information of the entire virtual switch, including but not limited to interfaces, switching content, virtual LANs (VLANs), virtual switch creation information, card addition information, and operation records, as detailed below:

[0036] It supports configuration saving, writing configuration data to a lightweight database to save relevant configurations;

[0037] Supports configuration addition functionality; lightweight database supports data writing.

[0038] Supports configuration deletion function; lightweight database supports data deletion.

[0039] It supports configuration query function, and the lightweight database supports data query function.

[0040] This invention relates to a kernel-mode virtual switch for a domestically developed operating system, which supports Quality of Service (QoS) configuration and management, as detailed below:

[0041] It supports QoS (Quality of Service) configuration, allows the creation of different queues, and enables the setting of queue priorities.

[0042] It supports traffic service quality scheduling, allowing data to be assigned to different queues, thereby implementing rate limiting strategies for different business data;

[0043] It supports traffic rate limiting, allowing you to configure entry rate limiting directly on the network interface;

[0044] It supports congestion management functions to ensure the quality of important business data, and sets queue priorities so that data in high-priority queues are sent first when network congestion occurs.

[0045] It also supports traffic control and monitoring, as well as traffic limiting and mirroring functions, as detailed below:

[0046] Add logic to support traffic classification and limit traffic rate to prevent overload attacks;

[0047] Once the traffic mirroring function is configured, all traffic will be mirrored to a specific port for traffic detection and analysis.

[0048] This invention relates to a kernel-mode virtual switch in a domestically developed operating system, which supports port-based security group functionality to perform rule-based control on incoming and outgoing packets at a port, as detailed below:

[0049] Supports security group whitelist functionality, adds logic, supports configuring to drop or allow all traffic operations, and supports priority configuration;

[0050] Supports Internet Control Message Protocol (ICMP) pass-through and filtering functions, adds logic to support ICMP message identification, and enables the pass-through and drop of ICMP messages;

[0051] Supports TCP / UDP transmission control protocol and filtering functions, adds logic to support TCP / UDP packet recognition, and can identify port numbers to allow or discard packets.

[0052] Supports Internet Protocol (IP) packet rules, adds logic, and supports filtering rules for IP source and destination addresses;

[0053] It supports Address Resolution Protocol (ARP) message rules, supports ARP message recognition, identifies ARP request and response messages, and adds filtering rules based on the messages.

[0054] This invention relates to a kernel-level virtual switch in a domestically developed operating system. It supports Source Network Address Translation (SNAT) for virtual machine or container packets exiting the gateway and Destination Network Address Translation (DNAT) for packets entering the gateway, as detailed below:

[0055] Supports source network address translation (SNAT) for packets, adds processing logic, supports source network address translation (SNAT) for packets leaving the gateway, and records table entries. Return packets support automatic translation.

[0056] Supports destination network address translation (DNAT) for packets, adds processing logic, and allows packets entering the gateway to undergo destination network address translation (DNAT) before being forwarded to virtual machines.

[0057] This invention relates to a kernel-mode virtual switch for a domestically developed operating system, which supports network functions including Internet Protocol Version 6 (IPv6) address configuration and routing forwarding, and supports configuration of related IPv6 protocols, as detailed below:

[0058] Supports Internet Protocol version 6 (IPv6) address configuration, and supports configuring basic attributes including the IPv6 address and the Media Access Control (MAC) address.

[0059] Supports the Internet Protocol version 6 (IPv6) protocol stack and basic functions of IPv6, including routing and Dynamic Host Configuration Protocol (DHCP).

[0060] Supports Internet Protocol version 6 (IPv6) forwarding and IPv6 routing forwarding, forwarding data packets according to the configured routing table entries;

[0061] It supports basic Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) processing functions, and can identify TCP packets and UDP packets for policy processing.

[0062] It supports the neighbor discovery function of Internet Protocol version 6 (IPv6) and can perform learning and discovery.

[0063] The beneficial effects of this invention are: the kernel-mode virtual switch of the domestically developed operating system can avoid frequent switching between kernel mode and user mode, thereby improving the performance and stability of the virtual switch, effectively reducing the path of network data flow, improving the processing speed of network data packets, ensuring network bandwidth indicators, providing an efficient solution for cloud vendors to provide high-performance network services, and improving the network user experience of cloud users. Attached Figure Description

[0064] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0065] Appendix Figure 1 This is a schematic diagram of the kernel-mode virtual switch of the domestically developed operating system of the present invention. Detailed Implementation

[0066] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly and completely described below in conjunction with the embodiments of this invention. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0067] This domestically developed operating system kernel-mode virtual switch provides virtual switch services in the form of operating system kernel modules, integrating network data switching and network data routing into the operating system kernel, while also supporting the loading and unloading functions of kernel modules;

[0068] The virtual switch supports the standard Virtual Local Area Network (VLAN) model and Trunk mode, supports Overlay tunneling, MAC forwarding, IP routing, lightweight databases, Quality of Service (QoS) configuration and management, MAC-based load balancing, traffic control and monitoring, security groups, Network Address Translation (NAT), and Internet Protocol version 6 (IPv6).

[0069] This domestically developed operating system kernel-mode virtual switch supports standard VLAN (Virtual Local Area Network) models in Trunk and Access port modes.

[0070] The virtual local area network (VLAN) model conforms to the network communication standard IEEE 802.1Q to achieve tenant isolation based on the VLAN model;

[0071] Supported port trunk mode:

[0072] Upon receiving a message, first determine if the message contains VLAN information: if not, add the VLAN information of the Trunk trunk port and forward it; if it does, determine if the Trunk trunk port allows data from the VLAN model to enter: if allowed, forward the message with the original VLAN tag information; otherwise, discard the message.

[0073] When sending a message, the VLAN information of the trunk port is compared with the VLAN information of the message to be sent: if they are equal, the VLAN information is stripped before the message is sent; otherwise, the message is forwarded with the original VLAN tag information.

[0074] Supported access ports:

[0075] Upon receiving a message, first check if the message contains Virtual LAN (VLAN) information: if not, add the VLAN information of the port and forward it; if it does, discard it.

[0076] When sending a message, the VLAN information of the message is stripped off and sent directly.

[0077] This domestically developed operating system kernel-mode virtual switch supports overlay tunneling, meeting the needs of virtual machines to access the underlying underlay network, including:

[0078] It supports Generic Routing Encapsulation (GRE) tunnels. After configuring a Generic Routing Encapsulation (GRE) tunnel, traffic can be encapsulated and decapsulated according to the tunnel type and configuration.

[0079] It supports Virtual eXtensible Local Area Network (VXLAN) tunnels. After configuring a VXLAN tunnel, it encapsulates and decapsulates packets according to the tunnel type and parameters.

[0080] It supports Internet Protocol Security (IPsec) tunnels. After configuring the IPsec function, it encrypts incoming packets and decrypts received tunnel packets.

[0081] It supports Geneve tunnels for general network virtualization encapsulation. After configuring Geneve tunnels, packets are encapsulated and decapsulated according to the tunnel type and parameters.

[0082] This domestically developed operating system kernel-mode virtual switch supports Layer 2 forwarding rules, performing MAC address forwarding and learning on traffic, including:

[0083] Supports Layer 2 bridging functionality, including the creation and deletion of Layer 2 bridges, and the addition of virtual interfaces to bridges;

[0084] When a virtual machine packet in the same Layer 2 domain receives an Ethernet frame, it first writes the mapping between its source Media Access Control Address (MAC) and the receiving interface into the Media Access Control Address (MAC) table as the basis for subsequent Layer 2 forwarding. The MAC table entries have an aging update mechanism. Entries that have not been refreshed within a user-defined aging time will be deleted. The table also supports querying the Media Access Control Address (MAC) learning process.

[0085] When a virtual machine in the same Layer 2 domain receives an Ethernet frame, it looks up the Media Access Control Address (MAC) table based on the destination MAC address of the Ethernet frame. If no matching entry is found, it forwards the message to all interfaces except the incoming interface (flooding).

[0086] If a matching entry is found, forward the request to the corresponding interface indicated by the entry.

[0087] When the destination Media Access Control (MAC) address is a broadcast address, it is forwarded to all interfaces (except the ingress interface of the packet).

[0088] Simultaneously, the data link layer of the communication protocol can modify the Media Access Control Address (MAC) to perform load balancing;

[0089] Adding logic to support data distribution allows for modification of the target Media Access Control (MAC) address without changing the Internet Protocol (IP) address. This ensures that the virtual IP addresses of all machines in the real physical server cluster and the IP addresses of the load balancer are configured to be consistent, achieving the goal of data distribution without modifying the source and destination addresses of data packets.

[0090] This domestically developed operating system kernel-mode virtual switch supports Layer 3 Internet Protocol (IP) routing, as detailed below:

[0091] Supports route configuration functions, including route configuration, viewing, deletion, and forwarding.

[0092] It supports Internet Protocol (IP) routing forwarding rules and forwards routes based on the longest match rule;

[0093] Supports default routing, forwarding packets that do not match the rules according to the default routing rules;

[0094] This domestically developed operating system kernel-mode virtual switch also supports a lightweight database for storing the configuration information of the entire virtual switch, including but not limited to interfaces, switching content, virtual LANs (VLANs), virtual switch creation information, card addition information, and operation records, as detailed below:

[0095] It supports configuration saving, writing configuration data to a lightweight database to save relevant configurations;

[0096] Supports configuration addition functionality; lightweight database supports data writing.

[0097] Supports configuration deletion function; lightweight database supports data deletion.

[0098] It supports configuration query function, and the lightweight database supports data query function.

[0099] This domestically developed operating system kernel-mode virtual switch supports Quality of Service (QoS) configuration and management, as detailed below:

[0100] It supports QoS (Quality of Service) configuration, allows the creation of different queues, and enables the setting of queue priorities.

[0101] It supports traffic service quality scheduling, allowing data to be assigned to different queues, thereby implementing rate limiting strategies for different business data;

[0102] It supports traffic rate limiting, allowing you to configure entry rate limiting directly on the network interface;

[0103] It supports congestion management functions to ensure the quality of important business data, and sets queue priorities so that data in high-priority queues are sent first when network congestion occurs.

[0104] It also supports traffic control and monitoring, as well as traffic limiting and mirroring functions, as detailed below:

[0105] Add logic to support traffic classification and limit traffic rate to prevent overload attacks;

[0106] Once the traffic mirroring function is configured, all traffic will be mirrored to a specific port for traffic detection and analysis.

[0107] This domestically developed operating system kernel-mode virtual switch supports port-based security group functionality, enabling rule-based control of incoming and outgoing packets on a port, as detailed below:

[0108] Supports security group whitelist functionality, adds logic, supports configuring to drop or allow all traffic operations, and supports priority configuration;

[0109] Supports Internet Control Message Protocol (ICMP) pass-through and filtering functions, adds logic to support ICMP message identification, and enables the pass-through and drop of ICMP messages;

[0110] Supports TCP / UDP transmission control protocol and filtering functions, adds logic to support TCP / UDP packet recognition, and can identify port numbers to allow or discard packets.

[0111] Supports Internet Protocol (IP) packet rules, adds logic, and supports filtering rules for IP source and destination addresses;

[0112] It supports Address Resolution Protocol (ARP) message rules, supports ARP message recognition, identifies ARP request and response messages, and adds filtering rules based on the messages.

[0113] This domestically developed operating system kernel-mode virtual switch supports Source Network Address Translation (SNAT) for virtual machine or container packets exiting the gateway and Destination Network Address Translation (DNAT) for packets entering the gateway, as detailed below:

[0114] Supports source network address translation (SNAT) for packets, adds processing logic, supports source network address translation (SNAT) for packets leaving the gateway, and records table entries. Return packets support automatic translation.

[0115] Supports destination network address translation (DNAT) for packets, adds processing logic, and allows packets entering the gateway to undergo destination network address translation (DNAT) before being forwarded to virtual machines.

[0116] This domestically developed operating system kernel-mode virtual switch supports network functions including Internet Protocol version 6 (IPv6) address configuration and routing forwarding, and supports IPv6-related protocol configurations, as detailed below:

[0117] Supports Internet Protocol version 6 (IPv6) address configuration, and supports configuring basic attributes including the IPv6 address and the Media Access Control (MAC) address.

[0118] Supports the Internet Protocol version 6 (IPv6) protocol stack and basic functions of IPv6, including routing and Dynamic Host Configuration Protocol (DHCP).

[0119] Supports Internet Protocol version 6 (IPv6) forwarding and IPv6 routing forwarding, forwarding data packets according to the configured routing table entries;

[0120] It supports basic Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) processing functions, and can identify TCP packets and UDP packets for policy processing.

[0121] It supports the neighbor discovery function of Internet Protocol version 6 (IPv6) and can perform learning and discovery.

[0122] The embodiments described above are merely one specific implementation of the present invention. Ordinary changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included within the protection scope of the present invention.

Claims

1. A kernel-mode virtual switch for a domestically developed operating system, characterized in that: The virtual switch service is provided in the form of an operating system kernel module, which integrates network data exchange and network data routing into the operating system kernel, and supports the loading and unloading of kernel modules. The virtual switch supports the standard VLAN model and Trunk mode, supports Overlay tunneling, supports MAC forwarding, supports IP routing, supports lightweight databases, supports QoS configuration and management, supports MAC load balancing mode, supports traffic control and monitoring, supports security groups, supports NAT, and supports Internet Protocol version 6 (IPv6). The switch supports modifying the Media Access Control Address (MAC address) at the data link layer of the communication protocol for load balancing. When adding logic to support data distribution, the Internet Protocol (IP) address can be modified without modifying the target Media Access Control (MAC) address. The virtual IP addresses of all machines in the real physical server cluster and the IP addresses of the load balancer server are configured to be consistent, so as to achieve the purpose of data distribution without modifying the source and destination addresses of the data packets. The switch supports a lightweight database to store the configuration information of the entire virtual switch, including but not limited to interfaces, switching content, virtual LAN VLANs, virtual switch creation and card addition information, and operation records, as detailed below: It supports configuration saving, writing configuration data to a lightweight database to save relevant configurations; Supports configuration addition functionality; lightweight database supports data writing. Supports configuration deletion function; lightweight database supports data deletion. It supports configuration query function, and the lightweight database supports data query function.

2. The kernel-mode virtual switch of the domestically developed operating system according to claim 1, characterized in that: It supports standard Virtual LAN (VLAN) model trunk and access port modes, as detailed below: The virtual local area network (VLAN) model conforms to the network communication standard IEEE 802.1Q to achieve tenant isolation based on the VLAN model; The machine supports Trunk relay mode for the port: Upon receiving a message, first determine if the message contains VLAN information: if not, add the VLAN information of the Trunk trunk port and forward it; if it does, determine if the Trunk trunk port allows data from the VLAN model to enter: if allowed, forward the message with the original VLAN tag information; otherwise, discard the message. When sending a message, the VLAN information of the trunk port is compared with the VLAN information of the message to be sent: if they are equal, the VLAN information is stripped before the message is sent; otherwise, the message is forwarded with the original VLAN tag information. The machine supports access ports: Upon receiving a message, first check if the message contains Virtual LAN (VLAN) information: if not, add the VLAN information of the port and forward it; if it does, discard it directly. When sending a message, the VLAN information of the message is stripped off and sent directly.

3. The kernel-mode virtual switch of the domestically developed operating system according to claim 1, characterized in that: Supports overlay tunneling functionality to meet the needs of virtual machines accessing the underlying underlay network, including: It supports general route encapsulation of GRE tunnels. After configuring general route encapsulation of GRE tunnels, traffic can be encapsulated and decapsulated according to the tunnel type and configuration. It supports Virtual Extended Local Area Network (VXLAN) tunnels. After configuring a VXLAN tunnel, it encapsulates and decapsulates packets according to the tunnel type and parameters. It supports IPsec tunnels. After configuring the IPsec function, it encrypts incoming packets and decrypts received tunnel packets. It supports Geneve tunnels for general network virtualization encapsulation. After configuring Geneve tunnels, packets are encapsulated and decapsulated according to the tunnel type and parameters.

4. The kernel-mode virtual switch of the domestically developed operating system according to claim 1, characterized in that: Supports Layer 2 forwarding rules, performing MAC address forwarding and learning on traffic for media access control addresses, including: Supports Layer 2 bridging functionality, including the creation and deletion of Layer 2 bridges, and the addition of virtual interfaces to bridges; When a virtual machine packet in the same Layer 2 domain receives an Ethernet frame, it first writes the mapping between its source Media Access Control Address (MAC) and the receiving interface into the Media Access Control Address (MAC) table as the basis for subsequent Layer 2 forwarding. The MAC table entries have an aging update mechanism. Entries that have not been refreshed within a user-defined aging time will be deleted. The table also supports querying the Media Access Control Address (MAC) learning process. When a virtual machine message in the same Layer 2 domain receives an Ethernet frame, it looks up the Media Access Control Address (MAC) table based on the destination MAC address of the Ethernet frame. If no matching entry is found, it forwards the message to all interfaces except the incoming interface. If a matching entry is found, forward the request to the corresponding interface indicated by the entry. When the destination Media Access Control (MAC) address is a broadcast address, the message is forwarded to all interfaces except the ingress interface.

5. The kernel-mode virtual switch of the domestically developed operating system according to claim 1, characterized in that: Supports Layer 3 Internet Protocol (IP) routing, as detailed below: Supports route configuration, including route configuration, viewing, deletion, and forwarding functions; It supports Internet Protocol (IP) routing forwarding rules and forwards routes based on the longest match rule; It supports default routing, which forwards packets that do not match the rules according to the default routing rules. It also supports Quality of Service (QoS) configuration and management, as detailed below: It supports QoS (Quality of Service) configuration, allows the creation of different queues, and enables the setting of queue priorities. It supports traffic service quality scheduling, allowing data to be assigned to different queues, thereby implementing rate limiting strategies for different business data; It supports traffic rate limiting, allowing you to configure entry rate limiting directly on the network interface; It supports congestion management, allowing you to set queue priorities and prioritize sending data from high-priority queues. It also supports traffic control and monitoring, as well as traffic limiting and mirroring functions, as detailed below: Add logic to support traffic classification and limit traffic rate to prevent overload attacks; Once the traffic mirroring function is configured, all traffic will be mirrored to a specific port for traffic detection and analysis.

6. The kernel-mode virtual switch of the domestically developed operating system according to claim 1, characterized in that: Supports port-based security group functionality, allowing for rule-based control of incoming and outgoing packets on a port, as detailed below: Supports security group whitelist functionality, adds logic, supports configuring to drop or allow all traffic operations, and supports priority configuration; Supports Internet Control Message Protocol (ICMP) pass-through and filtering functions, adds logic to support ICMP protocol message identification, and can pass through and drop ICMP messages. Supports TCP / UDP packet passing and filtering functions, adds logic to support TCP / UDP packet recognition, and can identify port numbers to pass or drop packets; Supports Internet Protocol (IP) packet rules, adds logic, and supports filtering rules for IP source and destination addresses; It supports Address Resolution Protocol (ARP) packet rules, ARP packet recognition, and the ability to identify ARP request and response packets and add filtering rules based on the packets.

7. The kernel-mode virtual switch of the domestically developed operating system according to claim 1, characterized in that: Supports source network address translation (SNAT) for virtual machine or container packets leaving the gateway and destination network address translation (DNAT) for packets entering the gateway, as detailed below: Supports source network address translation (SNAT) for packets, adds processing logic, supports source network address translation (SNAT) for packets leaving the gateway, and records table entries. Return packets support automatic translation. Supports destination network address translation (DNAT) for packets, adds processing logic, and allows packets entering the gateway to undergo destination network address translation (DNAT) before being forwarded to virtual machines.

8. The kernel-mode virtual switch of the domestically developed operating system according to claim 1 or 5, characterized in that: Supports network functions including Internet Protocol version 6 (IPv6) address configuration and routing forwarding, and supports configuration of related protocols such as IPv6, as detailed below: Supports Internet Protocol version 6 (IPv6) address configuration, and supports configuring basic attributes including the IPv6 address and the Media Access Control (MAC) address. Supports the Internet Protocol version 6 (IPv6) protocol stack and basic functions of IPv6, including routing and Dynamic Host Configuration Protocol (DHCP). Supports Internet Protocol version 6 (IPv6) forwarding and IPv6 routing forwarding, forwarding data packets according to the configured routing table entries; It supports basic Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) processing functions, and can identify TCP packets and UDP packets for policy processing. It supports the neighbor discovery function of Internet Protocol version 6 (IPv6) and can perform learning and discovery.

Images