A layer 2 virtual gateway based on eBPF and its implementation method

Abstract

The present invention provides a layer 2 virtual gateway based on ebpf and an implementation method thereof, comprising: two architecture designs of a packet sending process and a packet receiving process, a vpc network is connected to the layer 2 gateway, and the network segment of the accessed vpc, the LAN network port, the vni encapsulated with vxlan, the IP of the WAN network port and the broadcast IP are written into the ebpf map; the vni, the IP of the WAN network port and the broadcast IP are read, encapsulated into a data packet, and arrive at the user's network; the data packet is unpacked; the vni is read, and a judgment is made with the VPC network segment; after unpacking, the VPC network is entered to complete the communication with the virtual machine in the VPC. The present invention improves the bandwidth performance, reduces the traffic link, and reduces the CPU resource consumption; is compatible with the existing vxlan solution implemented in linux, and is suitable for popularization and application.

Description

Technical Field

[0001] The present application relates to the field of computer network technology, and in particular to a layer-2 virtual gateway based on eBPF and an implementation method thereof. Background Art

[0002] As cloud technology is changing with each passing day, building a large-scale, high-performance, and highly reliable network on and off the cloud is a prerequisite for facilitating users' access to the cloud.

[0003] By establishing Layer 2 network interconnection between the cloud and the off-cloud through a Layer 2 gateway, users can migrate off-cloud services to the cloud without changing the subnet IP, or perform disaster recovery on-cloud services to the off-cloud. In other words, existing scientific and technological means and methods are used to establish reliable emergency response methods in advance to deal with emergencies, including disaster recovery systems and backup systems placed off-cloud.

[0004] Currently, Linux already supports the vxlan protocol. Through the configuration of the ip link command, vxlan packet encapsulation and decapsulation can be realized, thereby realizing a virtual layer 2 gateway. This solution is the simplest implementation method.

[0005] However, the existing technical architecture has the following design defects, such as:

[0006] ① In scenarios with large traffic volumes, bandwidth will present performance bottlenecks, affecting response speed;

[0007] ② The traffic data link is lengthy, increasing the overall system load;

[0008] ③ Frequent interrupt triggering consumes CPU resources. Summary of the invention

[0009] In order to solve the above technical problems, the present invention provides a layer 2 virtual gateway based on eBPF and an implementation method thereof. Through scientific architecture design, when a data packet enters the network card, the data packet is operated by the eBPF program, bypassing the Linux protocol stack, thereby realizing a high-performance layer 2 gateway, which not only improves the original broadband performance, but also reduces the traffic links and reduces the CPU resource consumption, and is compatible with the original Linux solution.

[0010] In the first aspect, the present application shows a layer-2 virtual gateway based on eBPF, which specifically includes two architectures: a packet sending process and a packet receiving process;

[0011] Framework 1: Contracting process;

[0012] ① The VPC network is connected to the LAN port of the Layer 2 gateway. At the same time, the user-mode Layer 2 gateway agent program records the VPC network segment, LAN port, vni encapsulated with vxlan, IP of the WAN port, and broadcast IP into the ebpf map;

[0013] ②The ebpf program mounted on the LAN port of the Layer 2 gateway reads the IP and broadcast IP of the vni and WAN ports in the ebpf map and encapsulates them into data packets;

[0014] As an example, the data packet refers to: a vxlan packet.

[0015] ③ Redirect the data packet to the WAN port and broadcast it to the external network;

[0016] Architecture 2: Packet receiving process;

[0017] ① The WAN port of the layer 2 gateway receives the data packet from the external network;

[0018] ②The ebpf program on the WAN port unpacks the data packet and makes a judgment based on the vni in the ebpf map and the network segment of the VPC;

[0019] ③Data enters the VPC network from the LAN port and completes communication with the virtual machine in the VPC.

[0020] in,

[0021] ebpf (Extended Berkeley Packet Filter) is a powerful programming framework.

[0022] Safely run sandboxed programs in the Linux kernel without modifying the kernel code.

[0023] ebpf map represents a data structure stored in a key / value format in the Linux kernel;

[0024] LAN (local area network) means local area network, local area network, local network;

[0025] VPC (Virtual Private Cloud) stands for Virtual Private Cloud;

[0026] vxlan (Virtual Extensible Local Area Network) means virtual extended local area network;

[0027] vni is the abbreviation of VXLAN (Virtual Extensible LAN) network identifier, which is used to distinguish different VXLAN segments;

[0028] WAN (Wide Area Network) means wide area network;

[0029] UDP stands for User Datagram Protocol;

[0030] IP (Internet Protocol) stands for Internet Protocol;

[0031] agent means intelligent agent;

[0032] tc ingress means tc ingress is a concept in Traffic Control (TC) and is used for Linux network traffic control. TC is a tool in the Linux kernel for network traffic control and QoS (Quality of Service) management;

[0033] vxlan-encap is an encapsulation protocol in VXLAN (Virtual Extensible Local Area Network) technology. VXLAN is a network virtualization technology that encapsulates the data packets sent by the virtual machine in UDP and uses the IP / MAC of the physical network as the outer header for encapsulation, and then transmits it on the IP network. After reaching the destination, the tunnel endpoint decapsulates the data and sends it to the target virtual machine.

[0034] l2gw-agent is a program that manages vxlan encapsulation information in user mode.

[0035] As an example, the Layer 2 Gateway described in the present invention refers to a virtual tunnel gateway that can establish a Layer 2 network between different areas based on a public network or a dedicated network.

[0036] As an example, the vxlan (Virtual eXtensible Local Area Network) described in the present invention is a virtualized tunnel communication method, which is an extension of the traditional VLAN protocol. The function of vxlan is to encapsulate the L2 Ethernet frame into the UDP message and build a virtual layer 2 network through the L3 network.

[0037] As an example, the vni (VXLAN Network Identifier) ​​described in the present invention is the identifier of each VXLAN segment, which occupies 12 bits of space in the Ethernet data frame. Generally, one vni represents a tenant and can support isolation of tens of millions of tenants.

[0038] As an example, the ebpf (Extended Berkeley Packet Filter) described in the present invention is a powerful programming framework that safely runs sandbox programs in the Linux kernel without modifying the kernel code.

[0039] In the second aspect, the present application shows a method for implementing a layer 2 virtual gateway based on eBPF, including:

[0040] Step 1: Contract issuance process;

[0041] Step 11: The vpc network is connected to the layer 2 gateway, and the ebpf program vxlan-encap is mounted on the tc ingress of the LAN network port of the layer 2 gateway;

[0042] Step 12: Write the network segment of the connected vpc, LAN port, vni encapsulated with vxlan, IP of the WAN port and broadcast IP into the ebpf map through the user-state layer 2 gateway agent program; as an example, the agent program specifically adopts: l2gw-agent.

[0043] Step 13: The vpc data packet passes through the LAN port, and the kernel calls the ebpf program vxlan-encap of tc ingress, reads the IP and broadcast IP of the vni and WAN port in the ebpf map, and encapsulates it into a data packet;

[0044] Step 13: The ebpf program directs the encapsulated data packet to the WAN port, and the data packet passes through the external network and reaches the user's network;

[0045] Step 2: Packing process;

[0046] Step 21: Mount the ebpf program vxlan-decap on the tc ingress of the WAN port of the Layer 2 gateway;

[0047] Step 22: The data packet from the external network enters the WAN port, and the kernel calls the ebpf program vxlan-decap of tc ingress to decap the data packet;

[0048] The ebpf program vxlan-decap reads the vni in the ebpf map and compares it with the VPC network segment;

[0049] When the vni does not match the network segment of the VPC, the data packet is discarded;

[0050] If the vni matches the network segment of the VPC, the data packet is redirected to the corresponding LAN network port;

[0051] Step 23: Unpack the data and enter the VPC network from the LAN port to complete the communication with the virtual machine in the VPC.

[0052] In a third aspect, the present invention shows an electronic device, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method described in any one of the above aspects.

[0053] In a fourth aspect, the present application illustrates a non-temporary computer-readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute a method as described in any of the above aspects.

[0054] In a fifth aspect, the present application illustrates a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the method described in any of the above aspects.

[0055] The technical solution provided by this application may have the following beneficial effects:

[0056] ① Load the ebpf program in tc to implement vxlan encapsulation and decapsulation of data packets, bypass the kernel protocol stack, and directly redirect them to the corresponding network port, thereby improving bandwidth performance, reducing traffic links, and reducing CPU resource consumption;

[0057] ②At the same time, it is compatible with the existing vxlan solution implemented in Linux, and the overall framework design is scientific and reasonable, suitable for promotion and application. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a schematic diagram of the packet sending process architecture design of a layer 2 virtual gateway based on ebpf in the present invention.

[0059] Figure 2 It is a schematic diagram of the packet receiving process architecture design of a layer 2 virtual gateway based on ebpf in the present invention.

[0060] Figure 3 It is a schematic diagram of the principle of the packet sending process of a working method of a layer 2 virtual gateway based on ebpf of the present invention.

[0061] Figure 4 It is a schematic diagram of the packet receiving process principle of a working method of a layer 2 virtual gateway based on eBPF of the present invention.

[0062] Figure 5 It is a structural block diagram of an electronic device of a layer 2 virtual gateway based on eBPF and a working method thereof according to the present invention.

[0063] Figure 6 It is a non-temporary computer-readable storage medium structure diagram of a layer-2 virtual gateway based on eBPF and a working method thereof of the present invention. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0065] Below, refer to Figures 1 to 6 As shown:

[0066] In the first aspect, the present application shows a layer-2 virtual gateway based on eBPF, which specifically includes two architectures: a packet sending process and a packet receiving process;

[0067] Framework 1: Contracting process;

[0068] ① The VPC network is connected to the LAN port of the Layer 2 gateway. At the same time, the user-mode Layer 2 gateway agent program records the VPC network segment, LAN port, vni encapsulated with vxlan, IP of the WAN port, and broadcast IP into the ebpf map;

[0069] ②The ebpf program mounted on the LAN port of the Layer 2 gateway reads the IP and broadcast IP of the vni and WAN ports in the ebpf map and encapsulates them into data packets;

[0070] As an example, the data packet refers to: a vxlan packet.

[0071] ③ Redirect the data packet to the WAN port and broadcast it to the external network;

[0072] Architecture 2: Packet receiving process;

[0073] ① The WAN port of the layer 2 gateway receives the data packet from the external network;

[0074] ②The ebpf program on the WAN port unpacks the data packet and makes a judgment based on the vni in the ebpf map and the network segment of the VPC;

[0075] ③Data enters the VPC network from the LAN port and completes communication with the virtual machine in the VPC.

[0076] As an example, the Layer 2 Gateway described in the present invention refers to a virtual tunnel gateway that can establish a Layer 2 network between different areas based on a public network or a dedicated network.

[0077] As an example, the vxlan (Virtual eXtensible Local Area Network) described in the present invention is a virtualized tunnel communication method, which is an extension of the traditional VLAN protocol. The function of vxlan is to encapsulate the L2 Ethernet frame into the UDP message and build a virtual layer 2 network through the L3 network.

[0078] As an example, the vni (VXLAN Network Identifier) ​​described in the present invention is the identifier of each VXLAN segment, which occupies 12 bits of space in the Ethernet data frame. Generally, one vni represents a tenant and can support isolation of tens of millions of tenants.

[0079] As an example, the ebpf (Extended Berkeley Packet Filter) described in the present invention is a powerful programming framework that safely runs sandbox programs in the Linux kernel without modifying the kernel code.

[0080] In the second aspect, the present application shows a working method of a layer 2 virtual gateway based on eBPF, including:

[0081] Step 1: Contract issuance process;

[0082] Step 11: The vpc network is connected to the layer 2 gateway, and the ebpf program vxlan-encap is mounted on the tc ingress of the LAN network port of the layer 2 gateway;

[0083] Step 12: Write the network segment of the connected vpc, LAN port, vni encapsulated with vxlan, IP of the WAN port and broadcast IP into the ebpf map through the user-state layer 2 gateway agent program; as an example, the agent program specifically adopts: l2gw-agent.

[0084] Step 13: The vpc data packet passes through the LAN port, and the kernel calls the ebpf program vxlan-encap of tc ingress, reads the IP and broadcast IP of the vni and WAN port in the ebpf map, and encapsulates it into a data packet;

[0085] Step 14: The ebpf program directs the encapsulated data packet to the WAN port, and the data packet passes through the external network and reaches the user's network;

[0086] Step 2: Packing process;

[0087] Step 21: Mount the ebpf program vxlan-decap on the tc ingress of the WAN port of the Layer 2 gateway;

[0088] Step 22: The data packet from the external network enters the WAN port, and the kernel calls the ebpf program vxlan-decap of tc ingress to decap the data packet;

[0089] The ebpf program vxlan-decap reads the vni in the ebpf map and compares it with the VPC network segment;

[0090] When the vni does not match the network segment of the VPC, the data packet is discarded;

[0091] If the vni matches the network segment of the VPC, the data packet is redirected to the corresponding LAN network port;

[0092] Step 23: Unpack the data and enter the VPC network from the LAN port to complete the communication with the virtual machine in the VPC.

[0093] In a third aspect, the present invention shows an electronic device, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method described in any one of the above aspects.

[0094] In a fourth aspect, the present application illustrates a non-temporary computer-readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute a method as described in any of the above aspects.

[0095] In a fifth aspect, the present application illustrates a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the method described in any of the above aspects.

[0096] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by the present application.

[0097] Reference Figure 1 and Figure 2 , showing a schematic diagram of the structure of a layer 2 virtual gateway based on ebpf of the present invention, the architecture includes: two architectures of the packet sending process and the packet receiving process;

[0098] As for the specific implementation of the architecture, since it corresponds one by one with the technical solution of the method, that is, the implementation of each step of the method is based on the unit structure design of each architecture, the two are basically similar, so it is easier to understand the following embodiments by combining the architecture and the method to obtain the design ideas of the present invention.

[0099] Embodiment 1:

[0100] First, the vpc network is connected to the layer 2 gateway, and the ebpf program vxlan-encap is mounted on the tc ingress of the LAN network port of the layer 2 gateway; the network segment of the connected vpc, the LAN network port, the vni encapsulated with vxlan, the IP of the WAN network port and the broadcast IP are written into the ebpf map through the user-state layer 2 gateway l2gw-agent program; the pc data packet passes through the LAN port, and the kernel calls the ebpf program vxlan-encap of tc ingress, reads the vni, the IP of the WAN network port and the broadcast IP in the ebpf map, and encapsulates it into a vxlan packet;

[0101] Secondly, the ebpf program directs the encapsulated data packet to the WAN port, and the vxlan packet passes through the external network to the user's network;

[0102] Then, the ebpf program vxlan-decap is mounted on the tc ingress of the WAN port of the Layer 2 gateway; the vxlan packet of the external network enters the WAN port, and the kernel calls the ebpf program vxlan-decap of tc ingress to unpack the data packet; the ebpf program vxlan-decap reads the vni in the ebpf map and judges it with the VPC network segment; when the vni does not match the network segment of the VPC, the vxlan packet is discarded; if the vni matches the network segment of the VPC, the vxlan packet is redirected to the corresponding LAN port;

[0103] Finally, the data after the unpacking operation enters the VPC network from the LAN port, and the communication with the virtual machine in the VPC can be completed.

[0104] As an example, the present invention is based on a method for connecting the two-layer networks on and off the cloud, and can also be used for disaster recovery and service migration services on and off the cloud; it can provide a two-layer virtual gateway with higher performance and lower CPU loss.

[0105] In order to better illustrate the hardware concept of the electronic device of the present invention, two specific structural embodiments of the electronic devices are now described as follows:

[0106] Optionally, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0107] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0108] FIG5 is a block diagram of an electronic device 800 shown in the present application. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0109] Reference Figure 5 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0110] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0111] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, images, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0112] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0113] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0114] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0115] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0116] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the electronic device 800, and the sensor assembly 814 can also detect the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of contact between the user and the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0117] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast operation information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0118] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0119] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by a processor 820 of an electronic device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0120] Figure 6 19 is a block diagram of a non-transitory computer-readable storage medium 1900 shown in the present application. For example, the storage medium 1900 may be provided as a server.

[0121] Reference Figure 6 , the storage medium 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0122] The storage medium 1900 may also include a power supply component 1926 configured to perform power management of the storage medium 1900, a wired or wireless network interface 1950 configured to connect the storage medium 1900 to a network, and an input / output (I / O) interface 1958. The storage medium 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0123] The present invention loads the ebpf program in tc to implement vxlan packaging and unpacking of data packets, bypasses the kernel's protocol stack, and directly redirects them to the corresponding network port, thereby improving bandwidth performance, reducing traffic links, and reducing CPU resource consumption; at the same time, it is compatible with the existing vxlan solution implemented in linux, and the overall framework design is scientific and reasonable, which is suitable for promotion and application.

[0124] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0125] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0126] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0127] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0128] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0129] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0130] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0131] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0132] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0133] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A layer 2 virtual gateway based on ebpf, characterized in that: include: Package issuance process: The VPC network is connected to the LAN port of the Layer 2 gateway. At the same time, the user-mode Layer 2 gateway agent program records the VPC network segment, LAN port, vni encapsulated with vxlan, IP address of the WAN port, and broadcast IP address into the ebpf map. The ebpf program mounted on the LAN port of the Layer 2 gateway reads the IP and broadcast IP of the vni and WAN ports in the ebpf map and encapsulates them into data packets; the data packets refer to: vxlan packets; Redirect the data packet to the WAN port and broadcast it to the external network; Packet receiving process: The WAN port of the layer 2 gateway receives the data packet from the external network; The ebpf program on the WAN port unpacks the data packet and determines the network segment of the VPC based on the vni in the ebpf map. The data that is judged to be matched enters the VPC network from the LAN port to complete the communication with the virtual machine in the VPC.

2. According to claim 1, a layer 2 virtual gateway based on ebpf is characterized in that: If the result of the judgment with the network segment of the VPC is mismatch, the data packet is discarded.

3. According to the eBPF-based layer 2 virtual gateway according to claim 1, it is characterized in that: The layer 2 gateway is a virtual tunnel gateway, which can establish a layer 2 network between different areas based on the public network or dedicated network.

4. According to the eBPF-based layer 2 virtual gateway according to claim 1, it is characterized in that: The vxlan is a virtualized tunnel communication method, which is an extension of the traditional VLAN protocol. The function of vxlan is to encapsulate the L2 Ethernet frame into the UDP message and build a virtual Layer 2 network through the L3 network.

5. According to the eBPF-based layer 2 virtual gateway according to claim 1, it is characterized in that: The vni described in the present invention is the identifier of each VXLAN segment, which occupies 12 bits of space in the Ethernet data frame. One vni represents a tenant and can support isolation of tens of millions of tenants.

6. A layer 2 virtual gateway based on ebpf according to claim 1, characterized in that: The eBPF is a programming framework that safely runs sandboxed programs in the Linux kernel without modifying the kernel code.

7. A working method of a layer 2 virtual gateway based on ebpf, characterized in that: include: Package issuance process: Step 11: The vpc network is connected to the layer 2 gateway, and the ebpf program vxlan-encap is mounted on the tc ingress of the LAN network port of the layer 2 gateway; Step 12: Use the user-mode Layer 2 gateway agent program to write the network segment of the connected vpc, LAN port, vni encapsulated with vxlan, IP of the WAN port, and broadcast IP into the ebpf map; Step 13: The vpc data packet passes through the LAN port, and the kernel calls the ebpf program vxlan-encap of tc ingress, reads the IP and broadcast IP of the vni and WAN port in the ebpf map, and encapsulates it into a data packet; Step 14: The ebpf program directs the encapsulated data packet to the WAN port, and the data packet passes through the external network and reaches the user's network; Packet receiving process: Step 21: Mount the ebpf program vxlan-decap on the tc ingress of the WAN port of the Layer 2 gateway; Step 22: The data packet from the external network enters the WAN port, and the kernel calls the ebpf program vxlan-decap of tc ingress to decap the data packet; The ebpf program vxlan-decap reads the vni in the ebpf map and compares it with the VPC network segment; When the vni does not match the network segment of the VPC, the data packet is discarded; If the vni matches the network segment of the VPC, the data packet is redirected to the corresponding LAN network port; Step 23: Unpack the data and enter the VPC network from the LAN port to complete the communication with the virtual machine in the VPC.

8. According to claim 7, a method for operating a layer 2 virtual gateway based on ebpf is characterized in that: The agent program specifically adopts: l2gw-agent.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the method according to claim 7 or 8 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to claim 7 or 8 is implemented.

Images