Implementation method and device of virtual switch and electronic equipment

Abstract

The embodiment of the invention provides an implementation method and device of a virtual switch and electronic equipment, and the method comprises the steps: obtaining a message of each flow in the incoming and outgoing flow of the virtual switch, determining whether the message belongs to a first message of the flow, if yes, processing the first message by adopting a lightweight protocol stack frame, and if not, processing the first message by adopting a second protocol stack frame; when it is determined that the connection tracking state of the message of the flow is a complete flow state, flow processing information is generated and stored in a fast path forwarding table; and when the obtained message belongs to a non-first-time message of the flow, searching a fast path forwarding table, and carrying out fast processing according to the service operation of the fast path forwarding table. According to the method, the problems of multiple processing branches and poor performance of the virtual machine in the prior art are solved.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a method for implementing a virtual switch, a device for implementing a virtual switch, and an electronic device. Background Art

[0002] Virtual switch technology is widely used in data center virtualization environments. A number of open source implementations have emerged, such as VPP (Vector Packet Processing) and OpenVSwitch. As an open source virtual switch, OpenVSwitch implements high-performance, scalable network virtualization capabilities and has become the default, preferred standard component in data centers. However, due to the complexity of its design and implementation, and the diversity of functionality it must support, OpenVSwitch has some performance issues. OpenVSwitch uses a large amount of memory, especially for packet buffering and flow table management. Datapath forwarding table management is a very complex process, involving operations such as matching, updating, and deleting flow table rules. OpenVSwitch also supports the OpenFlow (network communication protocol), a large number of match and action operations, and multiple processing branches, resulting in poor performance. Summary of the Invention

[0003] The embodiments of the present invention provide a method, device and electronic device for implementing a virtual switch to solve the problem of multiple virtual machine processing branches and poor performance in the prior art.

[0004] An embodiment of the present invention discloses a method for implementing a virtual switch, comprising:

[0005] Obtain a message of each flow in the inbound and outbound traffic of the virtual switch, determine whether it is the first message of the flow, and if so, use the lightweight protocol stack framework to process the first message, and when it is determined that the connection tracking state of the message of the flow is a complete flow state, generate the flow flow processing information and store it in the fast path forwarding table;

[0006] When the obtained message belongs to a non-first message of the flow, the fast path forwarding table is searched and quickly processed according to the business operations of the fast path forwarding table.

[0007] Optionally, it also includes:

[0008] Track the message status of all flows in real time and update the aging time of the message status according to the entry information in the fast path forwarding table.

[0009] Optionally, using a lightweight protocol stack framework to process the first message includes:

[0010] For the initial request and response packets, the system applies RX QoS packet rate limiting policy, L2 Layer 2 / PKT parse packet parsing, Frag Track fragmentation processing, ConnTrack tracking / ACL access control / NAT address translation, L3 RT Layer 3 routing, ACL access / NAT address translation, L2_lkup Layer 2 lookup / VXLAN network virtualization, flow offload flow downloading, and TXQOS packet rate limiting policy.

[0011] After the first message is processed and forwarded, the processing information of the flow is generated.

[0012] Optionally, the fast path forwarding table includes the following multiple fields: 5tuple, hash, frags, stats source address, aflags identifier, actions service, and aging_time aging time;

[0013] 5tuple includes: source IP address, destination IP address, source port (port), destination port (dport) and protocol;

[0014] The hash field stores the result of hash calculation on the 5tuple;

[0015] frags indicates whether the message is fragmented;

[0016] Statistics include: the number of dropped packets (drop_pktcnt) and the number of dropped packet bytes (drop_pktbytes) when the ACL is set to drop packets or the QoS rate limit policy is used; the number of passed packets (pass_pktcnt) and the number of passed packet bytes (pass_pktbytes) when the flow is matched and forwarded through the flow;

[0017] aflags identifies the service type of action, including L2, L3, SNAT source address translation, DNAT destination address translation, RXQOS packet receiving rate limit policy, TXQOS packet sending rate limit policy, drop discarded packets, and dovxlan for VXLAN tunnel encapsulation services;

[0018] Actions saves the header fields of each layer corresponding to aflags and is used to change the corresponding fields of the message. Aging_time is used to age the flow table entries.

[0019] Optionally, when the obtained message is not the first message of the flow, the fast path forwarding table is searched and quickly processed according to the service operation of the fast path forwarding table, including:

[0020] A hash value is obtained according to the five-tuple information of the message, and the entry structure of the fast path forwarding table is searched according to the hash value, and the business operation of the entry structure of the fast path forwarding table is quickly processed.

[0021] The embodiment of the present invention further discloses a device for implementing a virtual switch, comprising:

[0022] The acquisition module is used to obtain the packets of each flow in the inbound and outbound traffic of the virtual switch.

[0023] A lightweight protocol processing module is configured to, when a message belongs to the first message of the flow flow, process the first message using a lightweight protocol stack framework, and when determining that the connection tracking state of the message of the flow flow is a complete flow state, generate flow flow processing information and store it in a fast path forwarding table;

[0024] The fast path forwarding module is used to search the fast path forwarding table and quickly process the obtained message according to the business operation of the fast path forwarding table when the obtained message belongs to a non-first message of the flow.

[0025] Optionally, it also includes:

[0026] The connection tracking module is used to track and record the message status of all flows, and to age the message status recorded in the connection tracking according to the status of the entries in the fast path forwarding table.

[0027] Optionally, the lightweight protocol processing module further includes:

[0028] The first fragment processing submodule is used to check whether the message includes message header information. If it is a fragment message without a message header, the fragment message is processed.

[0029] Optionally, the lightweight protocol processing module and the fast path forwarding module communicate via a flow offload API flow download API interface.

[0030] An embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0031] The memory is used to store computer programs;

[0032] The processor is configured to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0033] The embodiments of the present invention further disclose one or more computer-readable media having instructions stored thereon. When executed by one or more processors, the processors are enabled to perform the method according to the embodiments of the present invention.

[0034] The embodiments of the present invention include the following advantages:

[0035] The embodiment of the present invention provides a method for implementing a virtual switch, which realizes lightweight protocol stack processing and provides datapath acceleration module processing of precise table entries, realizes fast path forwarding, and improves the conversion performance of virtual machine traffic.

[0036] The implementation device of the virtual switch of the embodiment of the present invention uses a lightweight protocol stack framework to improve processing capabilities. The datapath fast path forwarding table of the implemented virtual switch has all table entries as streamlined exact match table entries. Table entry lookup only requires a hash lookup based on the message 5tuple. The actions (services) after the table lookup are also simple and the number of actions is extremely small. This makes the message table lookup process faster and more efficient, effectively reduces the processing time of each message in the virtual switch, and ultimately improves the message forwarding capability, achieving the purpose of optimizing and improving the product. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a flowchart of a method for implementing a virtual switch provided in an embodiment of the present invention;

[0038] Figure 2 A schematic diagram of a method for implementing a virtual switch provided in an embodiment of the present invention;

[0039] Figure 3 It is a schematic diagram of lightweight protocol stack framework processing in a method for implementing a virtual switch provided in an embodiment of the present invention;

[0040] Figure 4 is a schematic diagram of an entry structure in a fast path forwarding table provided in an embodiment of the present invention;

[0041] Figure 5 This is a schematic diagram of fast processing based on entries in a fast path forwarding table provided by an embodiment of the present invention;

[0042] Figure 6 This is a structural block diagram of a device for implementing a virtual switch provided in an embodiment of the present invention;

[0043] Figure 7 is a block diagram of an electronic device provided in an embodiment of the present invention;

[0044] Figure 8 is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0046] A virtual switch is a key component of software-defined networking (SDN) and virtualization technology. It provides similar functionality to a physical switch in a virtual environment, but is implemented entirely in software. A virtual switch manages network communications between virtual machines (VMs) and connections between VMs and external networks.

[0047] An existing virtual switch is a software-implemented network device that runs on one or more physical servers. It forwards packets, manages virtual network interfaces, and provides advanced network features such as VLANs (virtual local area networks), traffic monitoring, and security policies. Virtual switches can be standalone products or integrated into virtualization platforms such as VMware ESXi, Microsoft Hyper-V, and KVM.

[0048] Distributed virtual switch: A virtual switch deployed across multiple physical servers, allowing multiple hosts to share the same network configuration, simplifying management in large data center environments.

[0049] Data center virtualization: In cloud computing environments, virtual switches are widely used to connect cloud servers and provide flexible network resource allocation.

[0050] The advantages of virtual switches are high flexibility, easy management and configuration, and they are becoming increasingly important with the development of cloud computing. With virtual switches, organizations can more easily expand their IT infrastructure while maintaining high levels of security and efficiency.

[0051] Reference Figure 1 , shows a flowchart of a method for implementing a virtual switch provided in an embodiment of the present invention, which may specifically include the following steps:

[0052] 101. Obtain a message of each flow in the inbound and outbound traffic of the virtual switch, determine whether it is the first message of the flow, and if so, use the lightweight protocol stack framework to process the first message, and when it is determined that the connection tracking state of the message of the flow is a complete flow state, generate the flow processing information and store it in the fast path forwarding table;

[0053] 102. When the obtained message belongs to a non-first message of the flow, the fast path forwarding table is searched and quickly processed according to the business operation of the fast path forwarding table.

[0054] Compared with other open source technical solutions, the lightweight protocol processing framework in this embodiment implements a lightweight network protocol stack processing framework with simple processing logic and simplified code processing flow, which reduces a lot of time overhead and has better performance under large traffic.

[0055] The streamlined datapath fast-path forwarding table is filled with precise entries. Each packet forwarding requires only one hash calculation and one hash lookup. Actions are efficiently merged when an entry is found, resulting in a minimal number of actions. This makes action execution more streamlined, more precise, and less time-consuming.

[0056] The implementation method of the virtual switch of this embodiment realizes lightweight protocol stack processing, and at the same time provides datapath (fast path) acceleration module processing of accurate table entries, realizes fast path forwarding, and improves the conversion performance of virtual machine traffic.

[0057] In order to ensure network performance and security, this embodiment will use a variety of technologies and strategies to process data packets, such as Figure 2 and Figure 3 The business operations of the slow path are shown in .

[0058] For example, the RX QoS receive rate limit policy ensures fair bandwidth allocation and prevents certain types of traffic from taking up too much bandwidth and impacting other traffic. The receive rate of different types of traffic can be controlled by setting parameters such as the receive queue priority and bandwidth limit.

[0059] L2 layer 2 / pkt parse packet parsing, L2 layer refers to MAC layer processing, mainly including frame encapsulation and decapsulation, pktparse packet parsing, preliminary parsing of data packets, identification of protocol types (such as IPv4 / IPv6, TCP / UDP, etc.), and checksums to verify data integrity.

[0060] Frag track fragmentation processing, in this implementation, no reorganization is required, and fragmentation processing can be performed.

[0061] Conntrack tracking / Acl access control / NAT address translation. Conntrack is used to record and track the status of network connections. ACL is used to define a set of rules to allow or deny specific types of network traffic. NAT includes SNAT (Source Address Translation) and DNAT (Destination Address Translation), which are used to change the source or destination IP address of a data packet and are often used for private networks to access the Internet.

[0062] L3 rt Layer 3 routing is used to determine the best path for data packets based on IP addresses.

[0063] ACL access control / NAT address translation, in the three-layer processing, access control lists and network address translation also need to be considered.

[0064] Layer 2 lookup (L2 lkup) / VXLAN network virtualization. L2 lkup searches for next-hop devices based on MAC addresses. VXLAN is a network virtualization technology that enables network expansion across data centers in a multi-tenant environment by encapsulating Layer 2 frames over UDP. The VXLAN header is used to distinguish different virtual networks.

[0065] The tx qos packet rate limit policy is targeted at the sending direction to ensure that other flows are not affected by excessive speed of a certain flow, and to implement the priority of the sending queue and the maximum sending rate.

[0066] Flow offload is used to transfer packets in complete flow state to the fast path for execution.

[0067] The above business operations together constitute an efficient lightweight protocol stack processing framework, which aims to provide high-performance, low-latency services while also ensuring network security and stability, and reasonably combining them to maximize network efficiency.

[0068] like Figure 2 FIG. 1 is a flowchart showing a method for implementing a virtual switch provided in an embodiment of the present invention, which may specifically include the following steps:

[0069] 101. Obtain the message of each flow flow in the inbound and outbound traffic of the virtual switch, determine whether it is the first message of the flow flow, and if so, use the lightweight protocol stack framework to process the first message, and when it is determined that the connection tracking state of the message of the flow flow is a complete flow state, generate the flow flow processing information and store it in the fast path forwarding table.

[0070] For example, if Figure 3As shown, the request and response packets of the first message are processed with the RX QoS packet receiving rate limit policy, L2 Layer 2 / PKT parse packet parsing, Frag Track fragmentation processing, ConnTrack tracking / ACL access control / NAT address translation, L3 RT Layer 3 routing, ACL access / NAT address translation, L2_LKUP Layer 2 lookup / VXLAN network virtualization, FlowOffload flow downloading, and TX QoS packet sending rate limit policy.

[0071] After the first message is processed and forwarded, the processing information of the flow is generated.

[0072] The lightweight protocol stack framework processing in this embodiment is to add a fragmentation processing function, which enables fast path conversion of fragmented messages in the lightweight protocol stack without the need for reassembly, thereby improving the processing capability of fragmented messages.

[0073] 102. When the obtained message belongs to a non-first message of the flow, the fast path forwarding table is searched and quickly processed according to the business operation of the fast path forwarding table.

[0074] For example, when the received message is not the first message of the flow, the fast path forwarding table is searched and quickly processed according to the business operations of the fast path forwarding table, including:

[0075] A hash value is obtained according to the five-tuple information of the message, and the entry structure of the fast path forwarding table is searched according to the hash value, and the business operation of the entry structure of the fast path forwarding table is quickly processed.

[0076] like Figure 4 As shown, the fast path forwarding table includes the following fields: 5tuple, hash, frags, stats, aflags, actions, and aging_time.

[0077] 5tuple includes: source IP address, destination IP address, source port (port), destination port (dport) and protocol;

[0078] The hash field stores the result of hash calculation on the 5tuple;

[0079] frags indicates whether the message is fragmented;

[0080] Statistics include: the number of dropped packets (drop_pktcnt) and the number of dropped packet bytes (drop_pktbytes) when the ACL is set to drop packets or the QoS rate limit policy is used; the number of passed packets (pass_pktcnt) and the number of passed packet bytes (pass_pktbytes) when the flow is matched and forwarded through the flow;

[0081] aflags identifies the service type of action, including L2, L3, SNAT source address translation, DNAT destination address translation, RXQOS packet receiving rate limit policy, TXQOS packet sending rate limit policy, drop discarded packets, and dovxlan for VXLAN tunnel encapsulation services;

[0082] Actions saves the header fields of each layer corresponding to aflags and is used to change the corresponding fields of the message. Aging_time is used to age the flow table entries.

[0083] 103. Track the message status of all flows in real time and update the aging time of the message status according to the entry information in the fast path forwarding table.

[0084] The improved connection tracking module of the virtual switch in this embodiment can automatically track connections for all packets. Only flows with an established (complete) connection tracking status are offloaded to the datapath fast-path forwarding table, accelerating packet conversion. Connection tracking entries are aged based on the fast-path forwarding table entry status, with the aging time updated in real time and the tracking status recorded.

[0085] like Figure 2 As shown, the method of this embodiment includes a module implementing a lightweight protocol stack and a datapath module implementing fast-path forwarding. The lightweight protocol stack module processes the first packets in both the original (request) and reply (response) directions of the same flow, collects flow information, and distributes the flows to the datapath module as needed. Subsequent packets are processed by the datapath fast-path module through table lookup. The datapath fast-path module performs table lookup processing with precise table entries, providing superior processing capabilities compared to the lightweight protocol stack module, thereby improving processing performance.

[0086] like Figure 2 and Figure 3As shown, the business operations that can be implemented by the module implementing the lightweight protocol stack in this embodiment include: rx qos, L2 / pkt parse, frag track, conntrack / acl / nat, L3 rt, acl / nat, L2_lkup / vxlan, flow offload and tx qos, which are used to process each received message; the lightweight protocol stack framework processing in this embodiment belongs to slow path processing, which is a reconstructed processing flow to process the first request message and response message of the TCP flow in the business traffic. The specific processing process can be as follows. The following description uses each module to illustrate, which corresponds to the business operation.

[0087] 1. After the virtual switch receives the first packet of a certain flow, it is processed by the lightweight protocol stack framework, first performing rxqos processing (if qos policy is configured), and then entering the L2 / pkt parse operation to perform L2 vlan header stripping, outer tunnel header processing, and parsing and saving the header fields of each layer of the packet;

[0088] 2. The fragmented message enters the frag track module for processing. Its main function is to obtain the L4 source port and destination port from the first fragment message for non-first fragment messages to be processed in the protocol stack;

[0089] 3. The message enters the conntrack / acl / nat module for connection tracking processing, related nat processing, and acl rule matching. acl rules are configured when adding a port, and acl rules configured on demand are also configured here. This module is divided into two parts and needs to be processed both before and after the L3 rt module.

[0090] 4. L3 rt routing selection module, configured when adding a port, and routing rules can also be configured on demand;

[0091] 5. The L2_lkup / vxlan module is used for packet mac lookup processing and related tunnel (vxlan, etc.) encapsulation processing;

[0092] 6. tx qos module processes and limits the speed according to the configured qos policy;

[0093] 7. If a message in a complete flow state enters the flow offload module, the information collected by the protocol stack pipeline is used to generate flow information and offload it to the datapath fast path module for subsequent message processing.

[0094] The lightweight protocol framework of this embodiment has better message processing performance: compared with other open source solutions, the lightweight protocol stack processing framework has less processing logic, faster processing, and less time overhead for each message.

[0095] In this embodiment, the lightweight protocol processing module and the fast path forwarding module communicate via the flow offload API. That is, after the slow path processes the message, it can communicate with the fast path via the flow offload API to download the flow processing information.

[0096] The datapath module of the fast path includes the forwarding table and the actios processing module; the protocol stack module and the datapath module communicate through the flow offload API.

[0097] like Figure 4 As shown, Figure 4 The fast path forwarding table structure is shown, and the table entries are managed in a hash table manner.

[0098] The table entry is mainly composed of 5tuple, hash, frags, stats, aflags, actions and aging_time. The 5tuple is the source IP, destination IP, source port port, destination port dport and protocol protocol. The hash field saves the result of the 5tuple calculation. Frags indicates whether the message is fragmented. Stats includes the number of packet loss drop_pktcnt and the number of packet loss bytes drop_pktbytes when acl is drop or qos, the number of pass packets pass_pktcnt and the number of pass packet bytes pass_pktbytes when matching flow and forwarding through flow; aflags marks the type of action, mainly including L2, L3, snat, dnat, rxqos, txqos, drop and dovxlan types; actions save the header fields of each layer corresponding to aflags, which are used to change the corresponding fields of the message. Aging_time is used to age the flow table entry.

[0099] like Figure 5 As shown in the figure, the logic diagram of the actions operation of the improved virtual switch datapath fast path table entry is shown. The packet receiving processing flow is illustrated as follows:

[0100] 1. Check whether there is an rx qos action in the actions operation of the table entry. If there is, execute the rx qos action. If it exceeds the qos threshold, drop the packet; otherwise, continue with the subsequent actions operation.

[0101] 2. Determine whether there is a drop action in the actions operation of the table item. If so, drop the packet and terminate the action processing.

[0102] 3. Determine whether there is L3, L3_snat, or L3_dnat in the actions operation of the table entry. If yes, refer to Figure 5 In the order in which the packet is executed, the source IP or destination IP field of the L3 layer header, and the source port port or destination port dport of the L4 layer header are updated according to the sip_v4 / src_v6, dip_v4 / dst_v6, port, and dport fields in the actions. If the actions operation contains tunnel-related operations, the operation at this time updates the inner L3 and L4 layer fields of the packet.

[0103] The L3, L3_snat, and L3_dnat processing here corresponds to the processing in the slow path. That is, if these business operations exist in the table structure, they are implemented in the same way as the slow path business operations.

[0104] 4. Determine whether there is an L2 operation in the actions operation of the table entry, and then update the L2 layer header of the message according to the L2hdr header in the actions. If the actions operation contains tunnel-related operations, the operation at this time updates the inner L2 layer field of the message.

[0105] 5. Determine whether there is a tunnel encap operation in the actions operation of the table entry. If so, update the outer header of the message according to the tunnel_info in the actions.

[0106] 6. Finally, find the outgoing interface based on the outport field, send the message, and the actions operation is completed.

[0107] In this embodiment, the fast path processing needs to be processed according to the actions operation existing in the entry structure of the hash lookup, and the specific processing of each action operation corresponds to the specific processing process of the slow path.

[0108] In this embodiment, the actions portion of the datapath fast path table entry is more effectively merged and organized according to the header structure of each layer of the message. During operation, only direct copying is required, which ultimately improves efficiency.

[0109] In fast-path processing, efficiently merged actions have a more compact structure and lower processing overhead: Accurate and streamlined datapath fast-path forwarding table lookup: Forwarding table entries use a single hash calculation and lookup process. Efficiently merged actions result in minimal action operations, and more streamlined table entries occupy less memory.

[0110] In this embodiment, the virtual machine switch also optimizes the connection tracking processing process. The changes in the connection tracking processing are as follows: only the flow that completes connection tracking will be offloaded to the fast path, simplifying the processing logic. At the same time, the connection tracking CT aging will actively query the fast path table entry, eliminating the connection tracking processing action on the fast path table entry.

[0111] In this embodiment, a fragmentation processing function is added to the lightweight protocol stack framework and fast path processing, that is, the fragmentation processing is optimized: the newly added fragmentation processing enables non-first fragment messages to obtain L4 port information, which facilitates non-first fragment messages to be processed in the protocol framework and fast path without the need for reassembly.

[0112] It should be noted that for the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0113] Reference Figure 6 , shows a structural block diagram of an implementation device of a virtual switch provided in an embodiment of the present invention, which may specifically include the following modules:

[0114] The acquisition module is used to obtain the packets of each flow in the inbound and outbound traffic of the virtual switch.

[0115] A lightweight protocol processing module is configured to, when a message belongs to the first message of the flow flow, process the first message using a lightweight protocol stack framework, and when determining that the connection tracking state of the message of the flow flow is a complete flow state, generate flow flow processing information and store it in a fast path forwarding table;

[0116] The fast path forwarding module is used to search the fast path forwarding table and quickly process the obtained message according to the business operation of the fast path forwarding table when the obtained message belongs to a non-first message of the flow flow.

[0117] In practical applications, the implementation device of the virtual switch of this embodiment further includes:

[0118] The connection tracking module is used to track and record the message status of all flows, and to age the message status recorded in the connection tracking according to the status of the entries in the fast path forwarding table.

[0119] In actual processing, the above-mentioned lightweight protocol processing module also includes:

[0120] The first fragment processing submodule is used to check whether the message includes message header information. If it is a fragment message without a message header, the fragment message is processed.

[0121] The lightweight protocol processing module and the fast path forwarding module in this embodiment communicate through the flowoffload API flow download API interface.

[0122] The implementation device of the virtual switch of this embodiment uses a lightweight protocol stack framework to improve processing capabilities. The datapath fast path forwarding table of the implemented virtual switch has all table entries as streamlined exact match table entries. Table entry lookup only requires a hash lookup based on the message 5tuple. The actions (services) after the table lookup are also simple, with a very small number of actions. This makes the message table lookup process faster and more efficient, effectively reducing the processing time of each message in the virtual switch, ultimately improving the message forwarding capability and achieving the purpose of optimizing and improving the product.

[0123] like Figure 2 and Figure 3 As shown, the service submodules that can be implemented by the lightweight protocol processing module that implements the lightweight protocol stack in this embodiment include: rx qos, L2 / pkt parse, frag track, conntrack / acl / nat, L3 rt, acl / nat, L2_lkup / vxlan, flow offload and tx qos submodules, which are used to process each received message; the lightweight protocol stack framework processing in this embodiment belongs to slow path processing, which is a reconstructed processing flow for processing the first request message and response message of the TCP flow in the service traffic. The specific processing process is as follows:

[0124] 1. After the virtual switch receives the first packet of a certain flow, it is processed by the lightweight protocol stack framework, first performing rxqos processing (if qos policy is configured), and then entering the L2 / pkt parse operation to perform L2 vlan header stripping, outer tunnel header processing, and parsing and saving the header fields of each layer of the packet;

[0125] 2. The fragmented message enters the frag track module for processing. Its main function is to obtain the L4 source port and destination port from the first fragment message for non-first fragment messages to be processed in the protocol stack;

[0126] 3. The message enters the conntrack / acl / nat module for connection tracking processing, related nat processing, and acl rule matching. acl rules are configured when adding a port, and acl rules configured on demand are also configured here. This module is divided into two parts and needs to be processed both before and after the L3 rt module.

[0127] 4. L3 rt routing selection module, configured when adding a port, and routing rules can also be configured on demand;

[0128] 5. The L2_lkup / vxlan module is used for packet mac lookup processing and related tunnel (vxlan, etc.) encapsulation processing;

[0129] 6. tx qos module processes and limits the speed according to the configured qos policy;

[0130] 7. If a message in a complete flow state enters the flow offload module, the information collected by the protocol stack pipeline is used to generate flow information and offload it to the datapath fast path module for subsequent message processing.

[0131] The lightweight protocol framework of this embodiment has better message processing performance: compared with other open source solutions, the lightweight protocol stack processing framework has less processing logic, faster processing, and less time overhead for each message.

[0132] The fast path forwarding module includes a forwarding table and an actios processing submodule; the lightweight protocol processing module and the fast path forwarding module communicate through the flow offload API.

[0133] like Figure 4 As shown, Figure 4 The fast path forwarding table structure is shown, and the table entries are managed in a hash table manner.

[0134] The table entry is mainly composed of 5tuple, hash, frags, stats, aflags, actions and aging_time. The 5tuple is the source IP, destination IP, source port port, destination port dport and protocol protocol. The hash field saves the result of the 5tuple calculation. Frags indicates whether the message is fragmented. Stats includes the number of packet loss drop_pktcnt and the number of packet loss bytes drop_pktbytes when acl is drop or qos, the number of pass packets pass_pktcnt and the number of pass packet bytes pass_pktbytes when matching flow and forwarding through flow; aflags marks the type of action, mainly including L2, L3, snat, dnat, rxqos, txqos, drop and dovxlan types; actions save the header fields of each layer corresponding to aflags, which are used to change the corresponding fields of the message. Aging_time is used to age the flow table entry.

[0135] like Figure 5 As shown in the figure, the logic diagram of the actions operation of the improved virtual switch datapath fast path table entry is shown. The packet receiving processing flow is illustrated as follows:

[0136] 1. Check whether there is an RX QoS action in the actions operation of the table entry. If yes, the packet is dropped if the threshold is exceeded. Otherwise, the packet continues to the subsequent actions operation;

[0137] 2. Check whether there is a drop action in the actions operation of the table item. If yes, drop the packet and terminate the action processing;

[0138] 3. Determine whether the actions operation of the table entry contains L3, L3_snat, L3_dnat. If so, update the corresponding L3 layer header source IP or destination IP field, L4 layer header source port port or destination port dport according to the sip_v4 / src_v6, dip_v4 / dst_v6, port, dport fields in the actions; if the actions operation contains tunnel-related operations, the operation at this time updates the inner layer L3 and L4 layer fields of the message;

[0139] 4. Check whether there is an L2 operation in the actions operation of the table entry, and then update the L2 layer header of the message according to the L2hdr header in the actions. If the actions operation contains tunnel-related operations, the operation at this time updates the inner L2 layer field of the message;

[0140] 5. Determine whether there is a tunnel encap operation in the actions operation of the table entry. If yes, update the outer header of the message according to the tunnel_info in the actions;

[0141] 6. Finally, find the outgoing interface based on the outport field, send the message, and the actions operation is completed.

[0142] In this embodiment, the actions portion of the datapath fast path table entry is more effectively merged and organized according to the header structure of each layer of the message. During operation, only direct copying is required, which ultimately improves efficiency.

[0143] In fast-path processing, efficiently merged actions have a more compact structure and lower processing overhead: Accurate and streamlined datapath fast-path forwarding table lookup: Forwarding table entries use a single hash calculation and lookup process. Efficiently merged actions result in minimal action operations, and more streamlined table entries occupy less memory.

[0144] In this embodiment, the virtual machine switch also optimizes the connection tracking processing process. The changes in the connection tracking processing are as follows: only the flow that completes connection tracking will be offloaded to the fast path, simplifying the processing logic. At the same time, the connection tracking CT aging will actively query the fast path table entry, eliminating the connection tracking processing action on the fast path table entry.

[0145] In this embodiment, a fragmentation processing function is added to the lightweight protocol stack framework and fast path processing, that is, the fragmentation processing is optimized: the newly added fragmentation processing enables non-first fragment messages to obtain L4 port information, which facilitates non-first fragment messages to be processed in the protocol framework and fast path without the need for reassembly.

[0146] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0147] In addition, an embodiment of the present invention further provides an electronic device, such as Figure 7 As shown, it includes a processor 1301, a communication interface 1302, a memory 1303 and a communication bus 1304, wherein the processor 1301, the communication interface 1302, and the memory 1303 communicate with each other through the communication bus 1304.

[0148] Memory 1303, used for storing computer programs;

[0149] The processor 1301 is configured to execute the program stored in the memory 1303 to implement the following steps:

[0150] Obtain a message of each flow in the inbound and outbound traffic of the virtual switch, determine whether it is the first message of the flow, and if so, use the lightweight protocol stack framework to process the first message, and when it is determined that the connection tracking state of the message of the flow is a complete flow state, generate the flow flow processing information and store it in the fast path forwarding table;

[0151] When the obtained message belongs to a non-first message of the flow, the fast path forwarding table is searched and quickly processed according to the business operations of the fast path forwarding table.

[0152] Furthermore, it also includes:

[0153] Track the message status of all flows in real time and update the aging time of the message status according to the entry information in the fast path forwarding table.

[0154] Specifically, the lightweight protocol stack framework is used to process the first message, including:

[0155] For the initial request and response packets, the system applies RX QoS packet rate limiting policy, L2 Layer 2 / PKT parse packet parsing, Frag Track fragmentation processing, ConnTrack tracking / ACL access control / NAT address translation, L3 RT Layer 3 routing, ACL access / NAT address translation, L2_lkup Layer 2 lookup / VXLAN network virtualization, flow offload flow downloading, and TXQOS packet rate limiting policy.

[0156] After the first message is processed and forwarded, the processing information of the flow is generated.

[0157] The communication bus mentioned in the terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0158] The communication interface is used for communication between the above terminal and other devices.

[0159] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage. Alternatively, the memory may be at least one storage device located away from the processor.

[0160] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0161] like Figure 8 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 1401 is further provided, in which instructions are stored. When the computer-readable storage medium 1401 is run on a computer, the computer executes the implementation method of the virtual switch described in the above embodiment.

[0162] In another embodiment of the present invention, a computer program product including instructions is provided. When the computer program product is run on a computer, the computer executes the method for implementing the virtual switch described in the above embodiment.

[0163] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0164] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0165] Each embodiment in this specification is described in a related manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiment is generally similar to the method embodiment, so the description is relatively simple. For related parts, refer to the description of the method embodiment.

[0166] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention are included in the scope of protection of the present invention.

Claims

1. A method for implementing a virtual switch, characterized in that: include: Obtain the message of each flow flow in the inbound and outbound traffic of the virtual switch, determine whether it is the first message of the flow flow, and if so, use the lightweight protocol stack framework to process the first message, and when it is determined that the connection tracking state of the message of the flow flow is a complete flow state, generate the flow flow processing information and store it in the fast path forwarding table; When the obtained message is not the first message of the flow, the fast path forwarding table is searched and quickly processed according to the business operation of the fast path forwarding table.

2. The method according to claim 1, characterized in that: Also includes: Track the message status of all flows in real time and update the aging time of the message status according to the entry information of the fast path forwarding table.

3. The method according to claim 1, characterized in that The first message is processed using a lightweight protocol stack framework, including: For the request and response messages of the first message, rx qos packet receiving speed limit policy, L2 layer 2 / pkt parse packet parsing, frag track fragmentation processing, conntrack tracking / acl access control / nat address translation, L3 rt layer 3 routing, acl access / nat address translation, L2_lkup layer 2 lookup / vxlan network virtualization, flow offload flow download and tx qos packet sending speed limit policy processing are performed; After the first message is processed and forwarded, the processing information of the flow is generated.

4. The method according to claim 1, characterized in that: The fast path forwarding table includes the following fields: 5tuple, hash, frags, stats, aflags, actions, and aging_time. 5tuple includes: source IP address, destination IP address, source port sport, destination port dport and protocol protocol; The hash field is used to store the result of hash calculation of 5tuple; frags indicates whether the message is fragmented; Stats include: the number of dropped packets drop_pktcnt and the number of dropped packet bytes drop_pktbytes when the acl is drop or the qos rate limit policy, the number of pass packets pass_pktcnt and the number of pass packet bytes pass_pktbytes when matching the flow and forwarding through the flow; aflags identifies the service type of action, including L2, L3, snat source address translation, dnat destination address translation, rxqos packet receiving rate limit policy, txqos packet sending rate limit policy, drop discard message and dovxlan for vxlan tunnel encapsulation service; Actions save the header fields of each layer corresponding to aflags and are used to change the corresponding fields of the message. Aging_time is used to age the flow table entries.

5. The method according to claim 1, characterized in that When the obtained message is not the first message of the flow, the fast path forwarding table is searched and quickly processed according to the business operations of the fast path forwarding table, including: A hash value is obtained according to the five-tuple information of the message, and the entry structure of the fast path forwarding table is searched according to the hash value, and the business operation of the entry structure of the fast path forwarding table is quickly processed.

6. A device for implementing a virtual switch, characterized in that: include: The acquisition module is used to obtain the packets of each flow in the inbound and outbound traffic of the virtual switch. A lightweight protocol processing module, configured to, when a message belongs to the first message of the flow flow, use a lightweight protocol stack framework to process the first message, and when determining that the connection tracking state of the message of the flow flow is a complete flow state, generate the flow flow processing information and store it in a fast path forwarding table; The fast path forwarding module is used to search the fast path forwarding table and quickly process the acquired message according to the business operation of the fast path forwarding table when the acquired message belongs to a non-first message of the flow.

7. The device according to claim 6, characterized in that Also includes: The connection tracking module is used to track and record the message status of all flow flows, and to age the message status of the connection tracking record according to the status of the table entry in the fast path forwarding table.

8. The device according to claim 6, characterized in that The lightweight protocol processing module further includes: The first fragment processing submodule is used to check whether the message includes message header information. If it is a fragment message without message header information, the fragment message is processed.

9. The device according to claim 6, characterized in that The lightweight protocol processing module and the fast path forwarding module communicate via a flow offload API flow download API interface.

10. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 5 when executing the program stored in the memory.

Images