Micro-virtual machine network configuration and dual stack port forwarding method, apparatus and device

Abstract

The application provides a micro virtual machine network configuration and dual stack port forwarding method, device and equipment, and belongs to the technical field of computer virtualization. The method comprises the following steps: starting a target micro virtual machine; obtaining port listening information corresponding to the target micro virtual machine, wherein the port listening information is used to represent the port listening state of a user process in the target micro virtual machine; obtaining listening address information corresponding to the port listening information; determining a candidate listening instance, a process identifier and a listening port corresponding to the candidate listening instance according to the port listening information; determining connection identification information corresponding to the candidate listening instance according to the listening address information, the process identifier and the listening port, wherein the connection identification information is used to distinguish different listening instances; determining a target listening instance to be subjected to port forwarding according to the connection identification information; and performing port forwarding on the target listening instance. The application can reduce the situation that listening records corresponding to different local addresses are treated as the same record, and improve the completeness and stability of port forwarding.

Description

Technical Field

[0001] This application belongs to the field of computer virtualization technology, specifically relating to a port forwarding method, apparatus, and device for a micro virtual machine (MicroVM). Background Technology

[0002] With the development of cloud-based code execution and sandbox services, lightweight isolation environments based on hardware virtualization are being used to host user programs. To enable network services in the isolated environment to be accessed from the outside, a daemon process typically detects port listening records established by user programs and establishes forwarding processes for the detected port listening records.

[0003] Existing implementations typically maintain forwarding records based on process and port. When the same user program establishes listening records on different local addresses using the same port, multiple port listening records may have the same forwarding record identifier. One port listening record may overwrite another, or be treated as a already processed port listening record and no longer forwarded. As a result, ports corresponding to some local addresses may become inaccessible from the outside, and the forwarding result may be affected by the order in which the system returns port listening records. Summary of the Invention

[0004] This application provides a method, apparatus, and device for microvirtual machine network configuration and dual-stack port forwarding to reduce the occurrence of listening records corresponding to different local addresses being treated as the same record, thereby improving the integrity and stability of port forwarding.

[0005] This application provides a method for configuring a microvirtual machine network and dual-stack port forwarding, including: Start the target microvirtual machine; Obtain the port listening information corresponding to the target micro virtual machine, wherein the port listening information is used to characterize the port listening status of the user process in the target micro virtual machine; Obtain the listening address information corresponding to the port listening information; Based on the port listening information, candidate listening instances, as well as the process identifier and listening port corresponding to the candidate listening instances, are determined. Based on the listening address information, the process identifier, and the listening port, the connection identification information corresponding to the candidate listening instance is determined, and the connection identification information is used to distinguish different listening instances; The target listening instance to be port forwarded is determined based on the connection identification information. Port forwarding is performed on the target listening instance.

[0006] According to the microvirtual machine network configuration and dual-stack port forwarding method provided in this application, the step of determining the connection identification information corresponding to the candidate listening instance based on the listening address information, the process identifier, and the listening port includes: determining the local Internet Protocol (IP) address corresponding to the candidate listening instance based on the listening address information; and determining the connection identification information corresponding to the candidate listening instance based on the process identifier, the listening port, and the local IP address.

[0007] According to the microvirtual machine network configuration and dual-stack port forwarding method provided in this application, obtaining the port listening information corresponding to the target microvirtual machine includes: obtaining multiple network connections in the target microvirtual machine; determining candidate network connections in a listening state from the multiple network connections according to their respective connection states; determining a target network connection that meets a preset listening address condition from the candidate network connections according to the local address corresponding to the candidate network connection, wherein the preset listening address condition is used to indicate that the Internet Protocol Version 6 (IPv6) wildcard address belongs to the range of listening addresses that allow port forwarding; and determining the port listening information based on the target network connection.

[0008] According to the microvirtual machine network configuration and dual-stack port forwarding method provided in this application, the port forwarding of the target listening instance includes: determining the backend address corresponding to the target listening instance and the protocol family used to connect to the target listening instance based on the listening address information; determining the backend connection parameters corresponding to the target listening instance based on the protocol family and the backend address; and forwarding the port of the target listening instance based on the backend connection parameters and the backend address.

[0009] According to the microvirtual machine network configuration and dual-stack port forwarding method provided in this application, the step of determining the backend address corresponding to the target listening instance and the protocol family used to connect to the target listening instance based on the listening address information includes: when the listening address information indicates that the local IP address is an IPv6 wildcard address, determining the protocol family as Internet Protocol Version 4 (IPv4) and determining the backend address as an IPv4 loopback address; when the listening address information indicates that the local IP address is an IPv6 loopback address, determining the protocol family as IPv6 and determining the backend address as a literal address of the IPv6 loopback address; when the listening address information indicates that the local IP address is an IPv4 loopback address, determining the protocol family as IPv4 and determining the backend address as an IPv4 loopback address.

[0010] According to the microvirtual machine network configuration and dual-stack port forwarding method provided in this application, the step of determining the target listening instance to be port forwarded based on the connection identification information includes: obtaining the current port forwarding table, which is used to record the connection identification information corresponding to the listening instance that has been port forwarded; determining whether the connection identification information is recorded in the current port forwarding table; and determining the listening instance corresponding to the connection identification information as the target listening instance if the connection identification information is not recorded in the current port forwarding table.

[0011] According to the microvirtual machine network configuration and dual-stack port forwarding method provided in this application, starting the target microvirtual machine includes: obtaining IPv6 routing capability information of the virtual network interface on the host side corresponding to the target microvirtual machine, wherein the IPv6 routing capability information is used to indicate whether the virtual network interface has IPv6 routing capability; determining the IPv6 protocol stack configuration parameters corresponding to the target microvirtual machine based on the IPv6 routing capability information, wherein the IPv6 protocol stack configuration parameters are used to indicate the enabled status of the IPv6 protocol stack of the target microvirtual machine; and starting the target microvirtual machine based on the IPv6 protocol stack configuration parameters.

[0012] According to the micro-virtual machine network configuration and dual-stack port forwarding method provided in this application, the step of obtaining the IPv6 routing capability information of the host-side virtual network interface corresponding to the target micro-virtual machine includes: obtaining the IPv6 router detection result corresponding to the virtual network interface, wherein the IPv6 router detection result is used to indicate whether there is an IPv6 router capable of providing IPv6 routing capability to the virtual network interface; and determining the IPv6 routing capability information based on the IPv6 router detection result.

[0013] According to the microvirtual machine network configuration and dual-stack port forwarding method provided in this application, the step of determining the IPv6 protocol stack configuration parameters corresponding to the target microvirtual machine based on the IPv6 routing capability information includes: writing the IPv6 routing capability information into the boot options corresponding to the target microvirtual machine; obtaining the IPv6 routing capability information from the boot options when constructing the kernel boot parameters corresponding to the target microvirtual machine; and determining the IPv6 protocol stack configuration parameters based on the IPv6 routing capability information.

[0014] This application also provides a microvirtual machine network configuration and dual-stack port forwarding device, including: The startup unit is used to start the target microvirtual machine; The first acquisition unit is used to acquire port listening information corresponding to the target micro virtual machine, wherein the port listening information is used to characterize the port listening status of the user process in the target micro virtual machine; The second acquisition unit is used to acquire the listening address information corresponding to the port listening information; The first determining unit is used to determine a candidate listening instance and the process identifier and listening port corresponding to the candidate listening instance based on the port listening information. The second determining unit is used to determine the connection identification information corresponding to the candidate listening instance based on the listening address information, the process identifier and the listening port, wherein the connection identification information is used to distinguish different listening instances; The third determining unit is used to determine the target listening instance to be port forwarded based on the connection identification information. The forwarding unit is used to forward the port of the target listening instance.

[0015] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the microvirtual machine network configuration and dual-stack port forwarding method as described above.

[0016] This application also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the microvirtual machine network configuration and dual-stack port forwarding method as described above.

[0017] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the microvirtual machine network configuration and dual-stack port forwarding method as described above.

[0018] According to the microvirtual machine network configuration and dual-stack port forwarding method, apparatus and device provided in this application, by combining port listening information, process identifier, listening port and listening address information to distinguish different listening instances, and then selecting the target listening instance and establishing port forwarding accordingly, the situation where listening records corresponding to different local addresses are treated as the same record can be reduced, thereby improving the integrity and stability of port forwarding. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is one of the flowcharts illustrating a microvirtual machine network configuration and dual-stack port forwarding method provided in this application.

[0021] Figure 2 This is the second flowchart illustrating a microvirtual machine network configuration and dual-stack port forwarding method provided in this application.

[0022] Figure 3 This is a comparative diagram showing the connection identification information conflict resolution before and after a dual-stack service provided in this application embodiment.

[0023] Figure 4 This is a schematic diagram of a process for configuring IPv6 parameters provided in an embodiment of this application.

[0024] Figure 5 This is a block diagram of the functional units of a microvirtual machine network configuration and dual-stack port forwarding device provided in this application.

[0025] Figure 6 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] The terms "first," "second," etc., used in this application's specification are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0028] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0029] Currently, in the port forwarding process of a micro virtual machine sandbox, when the same user process establishes listening on different local addresses using the same port, the existing forwarding records cannot accurately distinguish these port listening records, which may cause some of the port listening records to not establish independent forwarding.

[0030] To address the aforementioned problems, this application provides a method, apparatus, and device for microvirtual machine network configuration and dual-stack port forwarding. The embodiments of this application are described below with reference to the accompanying drawings.

[0031] The method provided in this application can be applied to a microvirtual machine sandbox system. A microvirtual machine sandbox system may include a host machine and one or more microvirtual machines running on the host machine. Microvirtual machines can provide isolated runtime environments for user programs through hardware virtualization, and each microvirtual machine can have an independent Linux network namespace. The target microvirtual machine is a microvirtual machine instance to be started and to undergo port forwarding processing, and can correspond to a sandbox instance.

[0032] The host machine can be a server, workstation, or other electronic device with virtualization capabilities. An orchestrator and a virtualization management component can run on the host machine. The orchestrator is used to create and start the target micro-virtual machine, and the virtualization management component can be the Firecracker micro-virtual machine management component, which is used to create and run the target micro-virtual machine based on hardware virtualization. User processes and daemons can run within the target micro-virtual machine. The user processes can be processes that execute user code in a sandbox and provide network services externally. The daemon process can be the envd daemon process, which is used to obtain the port listening status of the user processes and call the port forwarding program to establish the corresponding forwarding channel. Therefore, different steps in this embodiment can be executed by the orchestrator on the host machine, the daemon process in the target micro-virtual machine, and the port forwarding program. The above division of the execution entities is only one possible implementation method, and this embodiment does not limit the specific allocation method of each step among different processes or devices.

[0033] Please see Figure 1 , Figure 1 This is one of the flowcharts illustrating a microvirtual machine network configuration and dual-stack port forwarding method provided in this application. For example... Figure 1 As shown, the microvirtual machine network configuration and dual-stack port forwarding method includes the following steps.

[0034] S101, Start the target microvirtual machine.

[0035] The target microvirtual machine (VM) can be a VM instance created based on a user-submitted sandbox creation request or task execution request. Starting the target VM may include allocating computing and network resources, loading the corresponding boot configuration and kernel startup parameters, and running the VM's kernel and user space through the virtualization management component. After starting, the target VM can run daemons and user processes carrying user code. The orchestrator on the host machine can create a configuration object for the target VM, write the network configuration allocated to it into the configuration object, and send a startup command to the virtualization management component. The virtualization management component then completes the startup of the target VM based on this configuration object.

[0036] S102, Obtain the port listening information corresponding to the target microvirtual machine.

[0037] The port listening information is used to characterize the port listening status of user processes in the target microvirtual machine. The port listening information may include information corresponding to one or more listening instances currently in a listening state in the target microvirtual machine, and may also include status information used to determine whether a network connection is a listening instance. The daemon process in the target microvirtual machine can call the network connection acquisition interface provided by the system according to a preset scan cycle to obtain network connections established by user processes, and form the port listening information corresponding to the current scan cycle based on the acquisition results.

[0038] S103, obtain the listening address information corresponding to the port listening information.

[0039] The listening address information is used to represent the local network address to which the listening instance is bound. When the port listening information includes multiple listening instances, the listening address information corresponding to each listening instance can be obtained separately, so that the listening address information corresponds one-to-one with the listening instance.

[0040] In practice, the local address field can be read from the connection record returned by the network connection acquisition interface, or the underlying network connection record associated with the port listening information can be queried to obtain the corresponding listening address information. The listening address information can retain the address format returned by the system, or it can be address information represented in a unified format.

[0041] S104, determine the candidate listening instance and the process identifier and listening port corresponding to the candidate listening instance based on the port listening information.

[0042] Candidate listening instances can be listening instances in the port listening information that require port forwarding identification. A listening instance can refer to a network connection record established by a user process and currently in a listening state, or it can refer to the listening socket corresponding to that network connection record. When the port listening information includes multiple listening instances, each listening instance can be identified as a candidate listening instance, and the corresponding process identifier and listening port can be obtained for each candidate listening instance. The process identifier (PID) is used to identify the user process that established the candidate listening instance, and the listening port is used to indicate the port number on which the user process is waiting for a network connection through the candidate listening instance.

[0043] In practice, port listening information can be generated by the daemon process in the target microvirtual machine based on network connection records returned by the system network connection acquisition interface. For network connections that meet the listening conditions, the listening instance corresponding to that network connection can be identified as a candidate listening instance, and the process ID and listening port can be read from the corresponding network connection record. For example, for a listening instance established by a user process with PID 100 on port 8080, the process ID corresponding to this candidate listening instance can be determined to be 100 and the listening port to be 8080. Thus, process attributes and port attributes can be obtained for further identification of different candidate listening instances.

[0044] S105, determine the connection identification information corresponding to the candidate listening instance based on the listening address information, the process identifier and the listening port.

[0045] Connection identification information is used to distinguish different listening instances. Listening address information represents the local network address bound to a candidate listening instance and can be configured to correspond to that instance. When the same user process binds to different local addresses on the same listening port, each local address corresponds to a different listening instance. Port forwarding refers to establishing a data transmission channel between an external listening endpoint and a backend listening endpoint in the target microvirtual machine to forward data from the external connection to the corresponding user process and return data from the user process to the external connection. Connection identification information can be a string, a structured object, an index value, or a hash value, as long as it can be combined with port listening information and listening address information to distinguish the listening instance to be processed. For multiple listening instances in the port listening information, the corresponding connection identification information can be determined separately.

[0046] In practice, the daemon process can combine or encode the content in the port listening information that identifies the connection to which the listening instance belongs with the listening address information to obtain the corresponding connection identification information. Even if different listening instances have some connection attributes that are the same, as long as their listening addresses are different, the resulting connection identification information can also be different.

[0047] S106, determine the target listening instance to be port forwarded based on the connection identification information.

[0048] The target listening instance can be a listening instance that has not yet established a valid port forwarding. There can be one or more target listening instances. When multiple target listening instances exist, each can be processed separately. The connection identification information obtained this time can be compared with the connection identification information recorded in the current forwarding table. If a connection identification information does not exist in the current forwarding table, the listening instance corresponding to that connection identification information can be identified as the target listening instance. If the connection identification information already exists in the current forwarding table, and the corresponding port forwarding is still valid, the existing port forwarding can be retained without creating a new forwarding process.

[0049] S107, perform port forwarding on the target listening instance.

[0050] Port forwarding for the target listening instance can include creating an external listening endpoint and a backend connection endpoint for the target listening instance, and transmitting data between the external listening endpoint and the backend connection endpoint. The external listening endpoint allows access from outside the target microvirtual machine to initiate a connection, while the backend connection endpoint can connect to the user process corresponding to the target listening instance.

[0051] In practice, a port forwarding process corresponding to the target listening instance can be started, which listens for external connections. Upon receiving an external connection, the port forwarding process establishes a backend connection to the target listening instance and performs bidirectional data forwarding between the external connection and the backend connection. After the port forwarding process starts successfully, the correspondence between connection identification information and port forwarding processes can be written into the forwarding table for subsequent scanning cycles to determine whether the corresponding listening instance has established port forwarding.

[0052] As can be seen, this solution distinguishes different listening instances by combining port listening information and listening address information, and then selects the target listening instance and establishes port forwarding accordingly. This reduces the situation where listening records corresponding to different local addresses are treated as the same record, thereby improving the integrity and stability of port forwarding.

[0053] In one possible embodiment, determining the connection identification information corresponding to the candidate monitoring instance based on the monitoring address information, the process identifier, and the monitoring port includes: determining the local IP address corresponding to the candidate monitoring instance based on the monitoring address information; and determining the connection identification information corresponding to the candidate monitoring instance based on the process identifier, the monitoring port, and the local IP address.

[0054] The local IP address indicates the network address bound to the candidate listening instance within the target microvirtual machine. The PID and listening port can be read from the network connection record corresponding to the candidate listening instance, and the local IP address can be read from the listening address information corresponding to that candidate listening instance. Subsequently, the PID, listening port, and local IP address can be concatenated in a preset order to form a triplet identifier key. This identifier key corresponds to the aforementioned connection identification information. For example, the format of the connection identification information can be "{PID}-{Port}-{LocalIP}", where Port represents the listening port and LocalIP represents the local IP address. For a candidate listening instance with PID 100, listening port 8080, and local IP address 127.0.0.1, the connection identification information can be "100-8080-127.0.0.1"; for a candidate listening instance with PID 100, listening port 8080, and local IP address ::1, the connection identification information can be "100-8080-::1". The connection identification information can also be obtained through structures, arrays, or encoding of the above three items, and is not limited to the above string concatenation forms.

[0055] Please see Figure 2 After the daemon completes the filtering of listening addresses, for each candidate listening instance in the port listening information, the daemon reads the PID, Port, and LocalIP, and generates connection identification information in the form of a triple key of "{PID}-{Port}-{LocalIP}". For example, when the PID is 100, the Port is 8080, and the LocalIP is 127.0.0.1, the connection identification information is "100-8080-127.0.0.1"; when the PID is 100, the Port is 8080, and the LocalIP is ::1, the connection identification information is "100-8080-::1"; when the PID is 42, the Port is 50051, and the LocalIP is ::, the connection identification information is "42-50051-::".

[0056] Please see Figure 3 , Figure 3The diagram illustrates the processing results before and after the resolution of connection identification information conflicts in dual-stack services. Before the resolution, the connection identification information consisted of the PID and the listening port. When process 100 listened to 127.0.0.1:8080, it obtained the connection identification information "100-8080" and started the socat process (IPv4). When the same process listened to ::1:8080, it still obtained the connection identification information "100-8080". Since this connection identification information already existed, the listening record was only marked as processed and the corresponding socat process was no longer started, thus ::1:8080 did not have a corresponding port forwarding. After the resolution, the connection identification information consisted of the PID, the listening port, and the local IP address. When process 100 listened to 127.0.0.1:8080, the corresponding connection identification information was "100-8080-127.0.0.1", and the socat process (IPv4) was started. When the same process listens on ::1:8080, the corresponding connection identification information is "100-8080-::1", and the socat process (IPv6) is started. Since the connection identification information corresponding to the two listening instances is different, the two listening instances can establish independent port forwarding respectively.

[0057] Therefore, by using the process identifier, listening port, and local IP address together to generate connection identification information, listening instances can be distinguished by local IP address even when the process identifier and listening port are the same, reducing the possibility of identifier conflicts between dual-stack listening records.

[0058] In one possible embodiment, obtaining the port listening information corresponding to the target microvirtual machine includes: obtaining multiple network connections in the target microvirtual machine; determining candidate network connections in a listening state from the multiple network connections according to their respective connection states; determining a target network connection that meets a preset listening address condition from the candidate network connections according to the local address corresponding to the candidate network connection, wherein the preset listening address condition is used to indicate that the IPv6 wildcard address belongs to the range of listening addresses that allow port forwarding; and determining the port listening information based on the target network connection.

[0059] The daemon process can call the system network connection enumeration interface and read the ` / proc / net / tcp` and ` / proc / net / tcp6` files in the target microvirtual machine to obtain a list of network connections using the Transmission Control Protocol (TCP). Each network connection in the list can include its connection status and local address. The daemon process can determine whether the connection status of each network connection is `LISTEN` and identify network connections with a `LISTEN` status as candidate network connections.

[0060] An IPv4 loopback address can be represented as 127.0.0.1, an IPv6 loopback address as ::1, and an IPv6 wildcard address as ::. IPv6 wildcard addresses are used to indicate that the listening socket is not limited to a specific IPv6 address. In dual-stack kernels, some user processes can be bound to IPv6 wildcard addresses by default. For example, some network services using the gRPC (gRPC Remote Procedure Calls) framework, the Node.js runtime, or the Go standard library can bind to this IPv6 wildcard address.

[0061] The preset listening address conditions allow you to set the local addresses 127.0.0.1, localhost, ::1, and :: as allowed listening addresses for port forwarding. For each candidate network connection, if its local address falls within the allowed range, it is identified as the target network connection; otherwise, it is not included in the current port listening information. Here, localhost can be a system-returned or formatted local hostname. The preset listening address conditions must at least include the IPv6 wildcard address :: within the allowed range to ensure that network connections bound to that address can enter the subsequent port forwarding process.

[0062] Please see Figure 2 , Figure 2 The processing flow shown can begin with "periodic scan triggering". When the scan cycle arrives, the daemon enumerates all TCP connections in the target micro-virtual machine, for example, reading / proc / net / tcp and / proc / net / tcp6 to obtain multiple network connections in the target micro-virtual machine. Then, it filters from these multiple network connections to target network connections with a connection status of LISTEN and a LocalIP belonging to {127.0.0.1, localhost, ::1, ::}. For the filtered target network connections, port listening information can be formed based on the corresponding network connection records. Thus, Figure 2 The filtering process shown includes IPv6 wildcard addresses (::) in the range of listening addresses that are allowed to be port forwarded.

[0063] As can be seen, this embodiment includes IPv6 wildcard addresses in the range of listening addresses that are allowed to perform port forwarding, so that user processes that are bound to IPv6 wildcard addresses by default can be discovered by port scanning, thereby improving the coverage of port listening information on the dual-stack listening state.

[0064] In one possible embodiment, port forwarding of the target monitoring instance includes: determining the backend address corresponding to the target monitoring instance and the protocol family used to connect to the target monitoring instance based on the monitoring address information; determining the backend connection parameters corresponding to the target monitoring instance based on the protocol family and the backend address; and performing port forwarding of the target monitoring instance based on the backend connection parameters and the backend address.

[0065] The backend address indicates the destination address used by the port forwarding process when connecting to a user process inside the target microvirtual machine. The protocol family indicates whether IPv4 or IPv6 is used when establishing the backend connection, and can be represented by the values ​​4 and 6 or the corresponding system protocol family identifier. Backend connection parameters may include the backend connection type, the target port, and other calling parameters required by the port forwarding program.

[0066] In practice, a matching protocol family can be selected based on the listening address type of the target listening instance, and the backend address that can connect to the target listening instance can be determined. Subsequently, the protocol family is written into the backend connection type, and the listening port of the target listening instance is written into the backend connection parameters. The port forwarding program constructs a backend connection endpoint based on the backend connection parameters, the backend address, and the listening port, and connects to this backend connection endpoint when an external connection arrives.

[0067] The port forwarding program can be socat, which is used for bidirectional data forwarding between two data stream endpoints. The socat process can use "TCP4-LISTEN:{Port},bind={host external IP},reuseaddr,fork" as the external listening endpoint and "TCP{family}:{backend address}:{Port}" as the backend connection endpoint. Here, `family` represents the protocol family, `Port` represents the listening port of the target listening instance, `bind` specifies the host external IP address to which the external listening endpoint is bound, `reuseaddr` allows address reuse, and `fork` creates a corresponding processing process for the received connection. The above command form is one possible implementation; port forwarding can also be implemented by other programs with the same data forwarding functionality.

[0068] like Figure 2As shown, after determining the protocol family and backend address, the backend connection parameters are determined based on the protocol family and backend address. The socat process is then started based on these parameters, and the corresponding connection identification information is written to the forwarding table. The command format for starting the socat process can be "socat TCP4-LISTEN:{Port},bind={host external IP},reuseaddr,forkTCP{family}:{backend address}:{Port}". The first part of the command establishes an external listening endpoint for external access to the target microvirtual machine, and the second part establishes a backend connection endpoint for connecting to the target listening instance. After the socat process starts successfully, the daemon writes the mapping between connection identification information and the socat process into the forwarding table, enabling connections received by the external listening endpoint to be forwarded to the target listening instance according to the determined backend connection parameters. After completing the port forwarding processing for this round of scanning, connection identification information not found in this round can be cleaned up. Specifically, for connection identification information that exists in the forwarding table but is not found in the connection identification information obtained in this round of scanning, the corresponding socat process is terminated and the corresponding connection identification information is deleted from the forwarding table. This allows the forwarding table to be updated according to changes in the user process's listening state.

[0069] As can be seen, this embodiment determines the protocol family, backend address, and backend connection parameters according to the listening address information, so that the port forwarding process adopts a backend connection method that matches the target listening instance, which can reduce connection failures caused by mismatch between the backend connection method and the listening address.

[0070] In one possible embodiment, determining the backend address corresponding to the target monitoring instance and the protocol family for connecting to the target monitoring instance based on the monitoring address information includes: when the monitoring address information indicates that the local IP address is an IPv6 wildcard address, determining the protocol family as IPv4 and the backend address as an IPv4 loopback address; when the monitoring address information indicates that the local IP address is an IPv6 loopback address, determining the protocol family as IPv6 and the backend address as a literal address of the IPv6 loopback address; when the monitoring address information indicates that the local IP address is an IPv4 loopback address, determining the protocol family as IPv4 and the backend address as an IPv4 loopback address.

[0071] When the local IP address is an IPv6 wildcard address (::), the family value of the protocol family can be normalized to 4, and the backend address can be set to 127.0.0.1. In the dual-stack listening configuration used in this embodiment, the user process bound to :: can receive connections arriving via the IPv4 loopback address, so the port forwarding process can use "TCP4:127.0.0.1:{Port}" to connect to the backend. When the local IP address is an IPv6 loopback address (::1), the family value can be set to 6, and the backend address can be set to the literal address [::1]. Square brackets are used to delimit the IPv6 literal address, distinguishing the colon in the IPv6 address from the port separator following the address. The port forwarding process can use "TCP6:[::1]:{Port}" to connect to the backend. When the local IP address is the IPv4 loopback address 127.0.0.1, the family value can be set to 4, and the backend address can be set to 127.0.0.1. If the local address is represented as localhost, it can be normalized to an IPv4 loopback address first, and then processed according to the branch corresponding to the IPv4 loopback address.

[0072] For example Figure 2 As shown, for connection identification information not recorded in the forwarding table, the protocol family and backend address can be determined sequentially based on the corresponding LocalIP. First, it checks if the LocalIP is ::. If yes, then set family=4 and backend address=127.0.0.1; otherwise, it checks if the LocalIP is ::1. If the LocalIP is ::1, then set family=6 and backend address=[::1]; if the LocalIP is not ::1, then set family=4 and backend address=127.0.0.1. Subsequently, the backend connection parameters are determined based on the identified protocol family and backend address, and the socat process is started to write the corresponding connection identification information into the forwarding table.

[0073] Each of the above branches uses the literal IP address directly as the backend connection target, instead of using localhost as the backend hostname. Therefore, the IPv6 loopback connection does not depend on whether the target microvirtual machine's / etc / hosts file has a "::1localhost" entry configured. Even in streamlined base images such as Alpine Linux where this IPv6 hostname mapping entry is missing, the backend connection can still be established directly using the IPv6 literal address.

[0074] Therefore, this embodiment standardizes the backend protocol family and backend address based on the local IP address, and uses the literal form of the loopback address to construct the backend connection, which can enable different address types to have a definite backend connection method and reduce the impact of hostname configuration in the simplified system image on port forwarding.

[0075] In one possible embodiment, determining the target listening instance to be port forwarded based on the connection identification information includes: obtaining a current port forwarding table, which records connection identification information corresponding to listening instances that have been port forwarded; determining whether the connection identification information is recorded in the current port forwarding table; and, if the connection identification information is not recorded in the current port forwarding table, determining the listening instance corresponding to the connection identification information as the target listening instance.

[0076] The current port forwarding table stores connection identification information for listening instances with established port forwarding relationships, reflecting the listening instances that have already undergone port forwarding. After obtaining the current port forwarding table, the connection identification information of the currently detected listening instance is compared with the connection identification information recorded in the current port forwarding table to determine whether the listening instance has established a port forwarding relationship. If the connection identification information is not recorded in the current port forwarding table, it indicates that the listening instance corresponding to that connection identification information has not yet performed port forwarding, and therefore, this listening instance can be identified as the target listening instance for port forwarding. If the connection identification information is already recorded in the current port forwarding table, it indicates that the corresponding listening instance has already performed port forwarding, and this listening instance will not be identified as the target listening instance in this process.

[0077] For example Figure 2 As shown, after periodically scanning to obtain the current listening connection and generating the corresponding connection identification information {PID}-{Port}-{LocalIP}, it can be determined whether this connection identification information already exists in the current port forwarding table. If the connection identification information is already in the forwarding table, the corresponding connection identification information is marked as FORWARD, and the existing port forwarding is retained. If the connection identification information is not in the forwarding table, the listening instance corresponding to the connection identification information is identified as the target listening instance, and the protocol family and backend address are further determined based on the corresponding LocalIP to establish the corresponding port forwarding.

[0078] As can be seen, this solution compares the currently acquired connection identification information with the current port forwarding table and only identifies the listening instances that have not yet been recorded in the current port forwarding table as target listening instances. This reduces the need for repeated forwarding of listening instances with established port forwarding relationships and improves the execution efficiency of port forwarding.

[0079] In one possible embodiment, starting the target microvirtual machine includes: obtaining IPv6 routing capability information of the host-side virtual network interface corresponding to the target microvirtual machine, wherein the IPv6 routing capability information is used to indicate whether the virtual network interface has IPv6 routing capability; determining IPv6 protocol stack configuration parameters corresponding to the target microvirtual machine based on the IPv6 routing capability information, wherein the IPv6 protocol stack configuration parameters are used to indicate the enabled status of the IPv6 protocol stack of the target microvirtual machine; and starting the target microvirtual machine based on the IPv6 protocol stack configuration parameters.

[0080] The host-side virtual network interface can be a tap device allocated to the target microvirtual machine, used to transmit network data between the target microvirtual machine's virtual network interface and the host network. IPv6 routing capability refers to the host-side virtual network interface's ability to access routable IPv6 networks via a corresponding IPv6 router. IPv6 routing capability information can be represented using Boolean values, status codes, or other status information.

[0081] In practice, the host orchestrator can obtain IPv6 routing capability information of the host-side virtual network interface before building the boot configuration of the target microvirtual machine. When this information indicates that the host-side virtual network interface has IPv6 routing capability, the IPv6 protocol stack of the target microvirtual machine can be configured to be enabled. When this information indicates that the host-side virtual network interface does not have IPv6 routing capability, the IPv6 protocol stack of the target microvirtual machine can be configured to be disabled. Subsequently, the orchestrator can generate IPv6 protocol stack configuration parameters according to the determined enabled state and use these parameters to start the target microvirtual machine.

[0082] If the IPv6 protocol stack of the target microvirtual machine is always enabled even when the virtual network interface on the host machine lacks IPv6 routing capabilities, the address obtained by the target microvirtual machine through Stateless Address Autoconfiguration (SLAAC) may only be a link-local address in the fe80:: network segment. When a user process initiates a network connection based on the domain name resolution result, it may first attempt an unroutable IPv6 connection and then fall back to an IPv4 connection after the connection fails or times out. This connection selection and fallback process can be a Happy Eyeballs mechanism, and each fallback may introduce a wait of approximately 250 milliseconds. In scenarios where tools such as pip, npm, cargo, or apt install packages in batches and establish many network connections, the above wait may accumulate. Setting the protocol stack of the target microvirtual machine to be enabled according to the IPv6 routing capabilities of the virtual network interface on the host machine can reduce the above invalid connection attempts.

[0083] Please see Figure 4 Before starting the target microvirtual machine, the host orchestrator checks the IPv6 routing status of the tap interface and, based on the presence of an IPv6 router capable of providing IPv6 routing, proceeds to either enable or disable the branch. Both branches, after forming the corresponding IPv6 protocol stack configuration, merge into the process of writing the Firecracker boot configuration, and then Firecracker starts the target microvirtual machine.

[0084] As can be seen, this solution senses the IPv6 routing capability of the virtual network interface on the host side and configures the IPv6 protocol stack of the target microvirtual machine accordingly, so that the IPv6 protocol stack configuration matches the actual network capability of the host machine. This reduces the connection delay caused by the fallback to IPv4 after IPv6 connection failure when there is no available IPv6 route, thereby improving network connection efficiency.

[0085] In one possible embodiment, obtaining the IPv6 routing capability information of the host-side virtual network interface corresponding to the target microvirtual machine includes: obtaining the IPv6 router detection result corresponding to the virtual network interface, wherein the IPv6 router detection result is used to indicate whether there is an IPv6 router capable of providing IPv6 routing capability to the virtual network interface; and determining the IPv6 routing capability information based on the IPv6 router detection result.

[0086] The virtual network interface can be the aforementioned host-side virtual network interface, and an IPv6 router detection interface can be set in the host's network slot object. The network slot object can be a Slot object, used to manage network resources allocated to a micro-virtual machine sandbox. The IPv6 router detection interface can be the Slot.HasIPv6Router() method. It can encapsulate the actual IPv6 routing configuration state of the host-side tap interface. When the tap interface is configured with an IPv6 router capable of providing IPv6 routing to that interface—for example, the IPv6 router can send route advertisements to the tap interface and allocate routable IPv6 prefixes—the IPv6 router detection result can be true. When no IPv6 router capable of providing IPv6 routing capabilities is detected, the IPv6 router detection result can be false. The host orchestrator can directly use this detection result as IPv6 routing capability information, or it can convert the detection result into the corresponding status code and use it as IPv6 routing capability information.

[0087] like Figure 4As shown, the host orchestrator calls `Slot.HasIPv6Router()` to obtain the IPv6 router detection result corresponding to the tap interface, and determines whether there is an IPv6 router capable of providing IPv6 routing capabilities based on the IPv6 router detection result. When `Slot.HasIPv6Router()` returns `true`, the judgment result is yes, and the IPv6 routing capability information indicates that IPv6 routing capability exists. When `Slot.HasIPv6Router()` returns `false`, the judgment result is no, and the determined IPv6 routing capability information indicates that the tap interface does not have IPv6 routing capability.

[0088] When the rules for determining IPv6 routing capabilities on the host side change, the implementation logic of Slot.HasIPv6Router() can be adjusted, while the processing of passing detection results through boot options and constructing kernel boot parameters based on the detection results does not need to be changed.

[0089] As can be seen, this solution determines IPv6 routing capability information by detecting whether there is an IPv6 router that can provide IPv6 routing capabilities on the virtual network interface. This can provide a basis for configuring the IPv6 protocol stack of the target micro virtual machine according to the actual IPv6 network capabilities, thereby improving the matching degree between the IPv6 protocol stack configuration and the host network status.

[0090] In one possible embodiment, determining the IPv6 protocol stack configuration parameters corresponding to the target microvirtual machine based on the IPv6 routing capability information includes: writing the IPv6 routing capability information into the boot options corresponding to the target microvirtual machine; obtaining the IPv6 routing capability information from the boot options when constructing the kernel boot parameters corresponding to the target microvirtual machine; and determining the IPv6 protocol stack configuration parameters based on the IPv6 routing capability information.

[0091] Specifically, a boolean field, IPv6RouterConfigured, representing the IPv6 routing configuration status, can be set in the boot options structure of the target microvirtual machine. After the host orchestrator calls Slot.HasIPv6Router(), it assigns the obtained IPv6 routing capability information to the IPv6RouterConfigured field. Thus, the network slot object responsible for network status detection only needs to pass the detection result to the boot options, while the module responsible for building kernel boot parameters can read the detection result from the boot options without directly accessing the network slot object.

[0092] When constructing the kernel boot parameters for the target microvirtual machine, the kernel parameter construction module reads the IPv6RouterConfigured field. When this field is true, it indicates that the host-side virtual network interface has IPv6 routing capabilities, and "ipv6.disable=0" can be generated as the IPv6 protocol stack configuration parameter to enable the IPv6 protocol stack in the target microvirtual machine. Here, ipv6.disable is a kernel boot parameter used to control the start / stop status of the IPv6 protocol stack in the target microvirtual machine. When this field is false, it indicates that the host-side virtual network interface does not have IPv6 routing capabilities, and "ipv6.disable=1" can be generated as the IPv6 protocol stack configuration parameter to disable the IPv6 protocol stack in the target microvirtual machine. The kernel parameter construction module can serialize the generated IPv6 protocol stack configuration parameter along with other kernel boot parameters into a kernel command-line string, and then write this string into the Firecracker boot configuration.

[0093] like Figure 4 As shown, if the Slot.HasIPv6Router() detection result indicates the existence of IPv6 routing capability, IPv6RouterConfigured is set to true, and ipv6.disable=0 is further set; if the result is negative, IPv6RouterConfigured is set to false, and ipv6.disable=1 is further set. The two branches then merge, and the generated kernel boot parameters are written to the Firecracker boot configuration. Firecracker then starts the target microvirtual machine according to this boot configuration. Thus, Figure 4 The host orchestrator, Slot.HasIPv6Router(), tap interface IPv6 route status detection, route judgment, boot option fields, kernel parameters, boot configuration writing, and micro-virtual machine startup all form a continuous boot process chain.

[0094] For example, if `Slot.HasIPv6Router()` returns false, the host orchestrator writes `false` to the `IPv6RouterConfigured` field of the target microvirtual machine's boot options structure. The kernel parameter building module reads this field and writes `ipv6.disable=1` into the parameter table. The kernel parameter building module can combine `ipv6.disable=1` with other kernel boot parameters corresponding to the target microvirtual machine to form a kernel command-line string, and write this kernel command-line string into the Firecracker boot configuration to start the target microvirtual machine with the IPv6 protocol stack disabled. If `Slot.HasIPv6Router()` returns true, the host orchestrator sets `IPv6RouterConfigured` to true, the kernel parameter building module generates `ipv6.disable=0` accordingly, writes it into the Firecracker boot configuration in the same way, and then starts the target microvirtual machine. Therefore, when the host-side tap interface does not have IPv6 routing capabilities, the target microvirtual machine does not enable the IPv6 protocol stack. When the host-side tap interface has IPv6 routing capabilities, the target microvirtual machine enables the IPv6 protocol stack.

[0095] As can be seen, this solution improves the matching degree between IPv6 protocol stack configuration and host network capabilities by writing IPv6 routing capability information into the boot options and reading this information when building kernel boot parameters to determine IPv6 protocol stack configuration parameters. This allows network capability detection results to be passed to the kernel parameter building process, thereby reducing the impact of changes in network capability detection logic on the kernel parameter building process.

[0096] The microvirtual machine network configuration and dual-stack port forwarding device provided in this application are described below. The microvirtual machine network configuration and dual-stack port forwarding device described below corresponds to the microvirtual machine network configuration and dual-stack port forwarding method described above.

[0097] Please see Figure 5The microvirtual machine network configuration and dual-stack port forwarding device 500 includes: a startup unit 501 for starting a target microvirtual machine; a first acquisition unit 502 for acquiring port listening information corresponding to the target microvirtual machine, wherein the port listening information is used to characterize the port listening status of user processes in the target microvirtual machine; a second acquisition unit 503 for acquiring listening address information corresponding to the port listening information; a first determination unit 504 for determining candidate listening instances and the process identifier and listening port corresponding to the candidate listening instances based on the port listening information; a second determination unit 505 for determining connection identification information corresponding to the candidate listening instances based on the listening address information, the process identifier, and the listening port, wherein the connection identification information is used to distinguish different listening instances; a third determination unit 506 for determining the target listening instance to be port forwarded based on the connection identification information; and a forwarding unit 507 for performing port forwarding on the target listening instance.

[0098] In one possible embodiment, in determining the connection identification information corresponding to the candidate monitoring instance based on the monitoring address information, the process identifier, and the monitoring port, the second determining unit 505 is specifically configured to: determine the local IP address corresponding to the candidate monitoring instance based on the monitoring address information; and determine the connection identification information corresponding to the candidate monitoring instance based on the process identifier, the monitoring port, and the local IP address.

[0099] In one possible embodiment, regarding the acquisition of port listening information corresponding to the target microvirtual machine, the first acquisition unit 502 is specifically configured to: acquire multiple network connections in the target microvirtual machine; determine candidate network connections in a listening state from the multiple network connections according to the connection states corresponding to the multiple network connections respectively; determine a target network connection that meets a preset listening address condition from the candidate network connections according to the local address corresponding to the candidate network connection, wherein the preset listening address condition is used to indicate that the IPv6 wildcard address belongs to the listening address range that allows port forwarding; and determine the port listening information based on the target network connection.

[0100] In one possible embodiment, in terms of port forwarding the target listening instance, the forwarding unit 507 is specifically configured to: determine the backend address corresponding to the target listening instance and the protocol family for connecting to the target listening instance based on the listening address information; determine the backend connection parameters corresponding to the target listening instance based on the protocol family and the backend address; and perform port forwarding on the target listening instance based on the backend connection parameters and the backend address.

[0101] In one possible embodiment, regarding the determination of the backend address corresponding to the target monitoring instance and the protocol family for connecting to the target monitoring instance based on the monitoring address information, the forwarding unit 507 is specifically configured to: determine the protocol family as IPv4 and the backend address as an IPv4 loopback address when the monitoring address information indicates that the local IP address is an IPv6 wildcard address; determine the protocol family as IPv6 and the backend address as a literal address of the IPv6 loopback address when the monitoring address information indicates that the local IP address is an IPv6 loopback address; and determine the protocol family as IPv4 and the backend address as an IPv4 loopback address when the monitoring address information indicates that the local IP address is an IPv4 loopback address.

[0102] In one possible embodiment, in determining the target listening instance to be port forwarded based on the connection identification information, the third determining unit 506 is specifically configured to: obtain a current port forwarding table, the current port forwarding table being used to record connection identification information corresponding to listening instances that have been port forwarded; determine whether the connection identification information is recorded in the current port forwarding table; and, if the connection identification information is not recorded in the current port forwarding table, determine the listening instance corresponding to the connection identification information as the target listening instance.

[0103] In one possible embodiment, regarding the startup of the target microvirtual machine, the startup unit 501 is specifically configured to: obtain IPv6 routing capability information of the host-side virtual network interface corresponding to the target microvirtual machine, wherein the IPv6 routing capability information is used to indicate whether the virtual network interface has IPv6 routing capability; determine IPv6 protocol stack configuration parameters corresponding to the target microvirtual machine based on the IPv6 routing capability information, wherein the IPv6 protocol stack configuration parameters are used to indicate the enabled status of the IPv6 protocol stack of the target microvirtual machine; and start the target microvirtual machine based on the IPv6 protocol stack configuration parameters.

[0104] In one possible embodiment, in obtaining the IPv6 routing capability information of the host-side virtual network interface corresponding to the target microvirtual machine, the startup unit 501 is specifically used to: obtain the IPv6 router detection result corresponding to the virtual network interface, wherein the IPv6 router detection result is used to indicate whether there is an IPv6 router capable of providing IPv6 routing capability to the virtual network interface; and determine the IPv6 routing capability information based on the IPv6 router detection result.

[0105] In one possible embodiment, in determining the IPv6 protocol stack configuration parameters corresponding to the target microvirtual machine based on the IPv6 routing capability information, the startup unit 501 is specifically configured to: write the IPv6 routing capability information into the startup options corresponding to the target microvirtual machine; when constructing the kernel startup parameters corresponding to the target microvirtual machine, obtain the IPv6 routing capability information from the startup options; and determine the IPv6 protocol stack configuration parameters based on the IPv6 routing capability information.

[0106] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of the electronic device provided in this application. For example... Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute a microvirtual machine network configuration and dual-stack port forwarding method. This method includes: starting a target microvirtual machine; obtaining port listening information corresponding to the target microvirtual machine, the port listening information being used to characterize the port listening state of user processes in the target microvirtual machine; obtaining listening address information corresponding to the port listening information; determining candidate listening instances and their corresponding process identifiers and listening ports based on the port listening information; determining connection identification information corresponding to the candidate listening instances based on the listening address information, the process identifier, and the listening port, the connection identification information being used to distinguish different listening instances; determining a target listening instance to be port forwarded based on the connection identification information; and performing port forwarding on the target listening instance.

[0107] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0108] On the other hand, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the microvirtual machine network configuration and dual-stack port forwarding method provided by the above methods. The method includes: starting a target microvirtual machine; obtaining port listening information corresponding to the target microvirtual machine, wherein the port listening information is used to characterize the port listening state of a user process in the target microvirtual machine; obtaining listening address information corresponding to the port listening information; determining candidate listening instances and the process identifier and listening port corresponding to the candidate listening instances based on the port listening information; determining connection identification information corresponding to the candidate listening instances based on the listening address information, the process identifier, and the listening port, wherein the connection identification information is used to distinguish different listening instances; determining a target listening instance to be port forwarded based on the connection identification information; and performing port forwarding on the target listening instance.

[0109] In another aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the above-described microvirtual machine network configuration and dual-stack port forwarding methods. The method includes: starting a target microvirtual machine; obtaining port listening information corresponding to the target microvirtual machine, the port listening information being used to characterize the port listening state of a user process in the target microvirtual machine; obtaining listening address information corresponding to the port listening information; determining candidate listening instances and their corresponding process identifiers and listening ports based on the port listening information; determining connection identification information corresponding to the candidate listening instances based on the listening address information, the process identifier, and the listening port, the connection identification information being used to distinguish different listening instances; determining a target listening instance to be port forwarded based on the connection identification information; and performing port forwarding on the target listening instance.

[0110] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0111] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for configuring a microvirtual machine network and dual-stack port forwarding, characterized in that, include: Start the target microvirtual machine; Obtain the port listening information corresponding to the target micro virtual machine, wherein the port listening information is used to characterize the port listening status of the user process in the target micro virtual machine; Obtain the listening address information corresponding to the port listening information; Based on the port listening information, candidate listening instances, as well as the process identifier and listening port corresponding to the candidate listening instances, are determined. Based on the listening address information, the process identifier, and the listening port, the connection identification information corresponding to the candidate listening instance is determined, and the connection identification information is used to distinguish different listening instances; The target listening instance to be port forwarded is determined based on the connection identification information. Port forwarding is performed on the target listening instance.

2. The method according to claim 1, characterized in that, The step of determining the connection identification information corresponding to the candidate listening instance based on the listening address information, the process identifier, and the listening port includes: The local IP address corresponding to the candidate monitoring instance is determined based on the monitoring address information; The connection identification information corresponding to the candidate listening instance is determined based on the process identifier, the listening port, and the local IP address.

3. The method according to claim 1, characterized in that, The step of obtaining the port listening information corresponding to the target microvirtual machine includes: Obtain multiple network connections in the target microvirtual machine; Based on the connection status corresponding to the plurality of network connections, candidate network connections in the listening state are determined from the plurality of network connections; Based on the local address corresponding to the candidate network connection, a target network connection that meets the preset listening address condition is determined from the candidate network connections. The preset listening address condition is used to indicate that the IPv6 wildcard address belongs to the listening address range that allows port forwarding. The port listening information is determined based on the target network connection.

4. The method according to claim 1, characterized in that, The port forwarding of the target listening instance includes: The backend address corresponding to the target monitoring instance and the protocol family used to connect to the target monitoring instance are determined based on the monitoring address information. The backend connection parameters corresponding to the target listening instance are determined based on the protocol family and the backend address; Port forwarding is performed on the target listening instance based on the backend connection parameters and the backend address.

5. The method according to claim 4, characterized in that, The step of determining the backend address corresponding to the target monitoring instance and the protocol family used to connect to the target monitoring instance based on the monitoring address information includes: When the listening address information indicates that the local IP address is an IPv6 wildcard address, the protocol family is determined to be IPv4, and the backend address is determined to be an IPv4 loopback address; When the listening address information indicates that the local IP address is an IPv6 loopback address, the protocol family is determined to be IPv6, and the backend address is determined to be the literal address of the IPv6 loopback address; If the listening address information indicates that the local IP address is an IPv4 loopback address, the protocol family is determined to be IPv4, and the backend address is determined to be an IPv4 loopback address.

6. The method according to claim 1, characterized in that, The step of determining the target listening instance to be port forwarded based on the connection identification information includes: Obtain the current port forwarding table, which is used to record the connection identification information corresponding to the listening instance that has performed port forwarding; Determine whether the connection identification information is recorded in the current port forwarding table; If the connection identification information is not recorded in the current port forwarding table, the listening instance corresponding to the connection identification information is identified as the target listening instance.

7. The method according to any one of claims 1-6, characterized in that, The startup of the target microvirtual machine includes: Obtain the IPv6 routing capability information of the host-side virtual network interface corresponding to the target microvirtual machine. The IPv6 routing capability information is used to indicate whether the virtual network interface has IPv6 routing capability. The IPv6 protocol stack configuration parameters corresponding to the target microvirtual machine are determined based on the IPv6 routing capability information. The IPv6 protocol stack configuration parameters are used to indicate the enabled status of the IPv6 protocol stack of the target microvirtual machine. The target microvirtual machine is started according to the IPv6 protocol stack configuration parameters.

8. The method according to claim 7, characterized in that, The step of obtaining the IPv6 routing capability information of the host-side virtual network interface corresponding to the target microvirtual machine includes: Obtain the IPv6 router detection result corresponding to the virtual network interface. The IPv6 router detection result is used to indicate whether there is an IPv6 router that can provide IPv6 routing capability to the virtual network interface. The IPv6 routing capability information is determined based on the IPv6 router detection results.

9. The method according to claim 7, characterized in that, The step of determining the IPv6 protocol stack configuration parameters corresponding to the target microvirtual machine based on the IPv6 routing capability information includes: Write the IPv6 routing capability information into the startup options corresponding to the target microvirtual machine; When constructing the kernel boot parameters corresponding to the target microvirtual machine, the IPv6 routing capability information is obtained from the boot options; The IPv6 protocol stack configuration parameters are determined based on the IPv6 routing capability information.

10. A microvirtual machine network configuration and dual-stack port forwarding device, characterized in that, include: The startup unit is used to start the target microvirtual machine; The first acquisition unit is used to acquire port listening information corresponding to the target micro virtual machine, wherein the port listening information is used to characterize the port listening status of the user process in the target micro virtual machine; The second acquisition unit is used to acquire the listening address information corresponding to the port listening information; The first determining unit is used to determine a candidate listening instance and the process identifier and listening port corresponding to the candidate listening instance based on the port listening information. The second determining unit is used to determine the connection identification information corresponding to the candidate listening instance based on the listening address information, the process identifier and the listening port, wherein the connection identification information is used to distinguish different listening instances; The third determining unit is used to determine the target listening instance to be port forwarded based on the connection identification information. The forwarding unit is used to forward the port of the target listening instance.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the microvirtual machine network configuration and dual-stack port forwarding method as described in any one of claims 1 to 9.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the microvirtual machine network configuration and dual-stack port forwarding method as described in any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the microvirtual machine network configuration and dual-stack port forwarding method as described in any one of claims 1 to 9.

Images