Data packet transmission method for cloud computing platform accessing third-party network element, and related device

Abstract

Provided in the embodiments of the present disclosure are a data packet transmission method for a cloud computing platform accessing a third-party network element, and a related device. When an application service uses a third-party network element, an access gateway may adaptively adjust, on the basis of data packet size information, a PMTU required for the current transmission, thereby greatly reducing the probability of a data packet sent by the access gateway to the third-party network element being fragmented, improving the transmission efficiency of the data packet, and ensuring the network connectivity and user experience of the application service. Moreover, the adaptive PMTU is provided only for the data packet transmission between the access gateway and the third-party network element. In this way, a non-standard MTU will not be introduced into a cloud computing platform, and PMTU restrictions are lifted for the network traffic of an application client that accesses the third-party network element via the access gateway, thereby improving the usage experience of users on the cloud computing platform.

Description

Data packet transmission methods and related equipment for cloud computing platforms that connect to third-party network elements Technical Field

[0001] This disclosure relates to the field of cloud computing technology, and in particular to a data packet transmission method and related equipment for a cloud computing platform that accesses third-party network elements. Background Technology

[0002] With the development of cloud computing technology, more and more third-party service providers are integrating their third-party network elements into cloud computing platforms. These third-party network elements include, but are not limited to, firewalls, intrusion detection systems, and traffic mirroring services. Users of application services on cloud computing platforms can choose third-party network elements to enhance the functionality or security of their application services. Thus, when a user's application client requests access to the application server, the raw data packets sent by the user's application client must first be processed by the third-party network element before being sent to the application server for a response.

[0003] In practical applications, due to the inherent isolation between the user network and the third-party network element's network, the raw data packets sent by the user's application client are typically sent to the third-party network element for processing via the access gateway. The access gateway usually performs tunnel encapsulation on the raw data packets before sending the encapsulated packets to the third-party network element for processing. However, tunnel encapsulation may cause the data packet size to exceed the PMTU (Path Maximum Transmission Unit) on the path between the access gateway and the third-party network element, necessitating packet fragmentation. Fragmentation not only increases network latency but may also lead to retransmission of the entire data packet due to the loss or corruption of any fragment, thus affecting network connectivity and user experience. Summary of the Invention

[0004] This disclosure provides a data packet transmission method and related equipment for a cloud computing platform that accesses third-party network elements, thereby greatly reducing the probability of data packet fragmentation and ensuring network connectivity and user experience for application services.

[0005] This disclosure provides a data packet transmission method for a cloud computing platform accessing a third-party network element. The method is applied to a first computing node among multiple computing nodes in the cloud computing platform. The first computing node includes a first virtual switch and a first virtual machine that communicate with each other. The first virtual machine has an access gateway deployed on it. The method includes: receiving an original data packet forwarded by the first virtual switch through the access gateway; and encapsulating the original data packet with first encapsulation information indicating that the access gateway accesses a third-party network element to obtain a first data packet. The original data packet is sent by an application client running in a second virtual machine on a second computing node, and the third-party network element is deployed on a third computing node running a third virtual machine. The access gateway determines the PMTU required for this transmission based on the data packet size information of the first data packet, and writes the PMTU required for this transmission into the first data packet. The system encapsulates information to obtain a second data packet and sends it to the first virtual switch. The first virtual switch retrieves the PMTU required for this transmission from the second data packet and determines the first flow table entry in the flow table corresponding to the access gateway's access to the third-party network element. It also updates the current PMTU recorded in the first flow table entry to the PMTU required for this transmission and sends the second data packet to the third virtual machine based on the updated first flow table entry. The third data packet returned by the third virtual machine is then sent to the access gateway. The access gateway decapsulates the third data packet to obtain the target data packet, which is obtained by the third-party network element processing the original data packet in the second data packet. The first virtual switch forwards the target data packet to the application server in the fourth virtual machine running on the fourth computing node for response processing.

[0006] This disclosure also provides a data packet transmission method for a cloud computing platform accessing a third-party network element. The method is applied to a third computing node among multiple computing nodes in the cloud computing platform. The third computing node includes a third virtual switch and a third virtual machine that communicate with each other. The third virtual machine has deployed a third-party network element. The method includes: receiving a second data packet sent by a first virtual switch through the third virtual switch; obtaining the PMTU required for this transmission from the second data packet; determining a second flow table entry in the flow table corresponding to the third virtual switch that is associated with the third-party network element's access gateway; and updating the current PMTU recorded in the second flow table entry to the PMTU required for this transmission. The first virtual switch and the access gateway are deployed on the first computing node, and the second data packet is sent by the access gateway to the first virtual switch. The second data packet is forwarded to the third virtual machine through the third virtual switch, so that the third-party network element in the third virtual machine processes the second data packet to obtain a third data packet. The third virtual switch sends the third data packet to the first virtual switch according to the updated second flow table entry, so that the first virtual switch forwards the third data packet to the access gateway.

[0007] This disclosure also provides a cloud computing platform, including: a first computing node, a second computing node, a third computing node, and a fourth computing node; the first computing node includes a first virtual switch and a first virtual machine that communicate with each other, and the first virtual machine has deployed an access gateway; the second computing node includes a second virtual machine with an application client deployed; the third computing node includes a third virtual switch and a third virtual machine that communicate with each other, and the third virtual machine has deployed access to a third-party network element; the fourth computing node includes a fourth virtual machine with an application server deployed; the second computing node is used to forward raw data packets sent by the application client in the second virtual machine to the first computing node; the first computing node is used to execute steps in the data packet transmission method of the cloud computing platform accessing the third-party network element; the third computing node is used to execute steps in the data packet transmission method of the cloud computing platform accessing the third-party network element; the fourth computing node is used to respond to the target data packet sent by the first computing node through the application server in the fourth virtual machine, the target data packet being obtained by processing the raw data packet through the third-party network element.

[0008] This disclosure also provides a data packet transmission method, including: receiving an original data packet forwarded by a first virtual switch through an access gateway; encapsulating first encapsulation information indicating that the access gateway accesses a target network element on the original data packet to obtain a first data packet; determining the PMTU required for this transmission based on the data packet size information of the first data packet through the access gateway, and writing the PMTU required for this transmission into the first encapsulation information in the first data packet to obtain a second data packet, and sending the second data packet to the first virtual switch; obtaining the PMTU required for this transmission from the second data packet through the first virtual switch, determining a first flow table entry in the flow table corresponding to the access gateway accessing the target network element, updating the current PMTU recorded in the first flow table entry to the PMTU required for this transmission, and sending the second data packet to the target network element according to the updated first flow table entry.

[0009] This disclosure also provides an electronic device, including: a memory and a processor; the memory for storing a computer program; and the processor coupled to the memory for executing the computer program to perform steps in a data packet transmission method for accessing a cloud computing platform of a third-party network element.

[0010] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement the steps in the data packet transmission method for accessing a cloud computing platform of a third-party network element.

[0011] This disclosure also provides a computer program product, including a computer program or instructions, which, when executed by a processor, enable the processor to implement the steps in the data packet transmission method for accessing a cloud computing platform of a third-party network element.

[0012] In this embodiment, after receiving the original data packet sent by the application client forwarded by the virtual switch, the access gateway encapsulates the original data packet with encapsulation information indicating that the access gateway accesses a third-party network element to obtain a first data packet. Based on the size of the first data packet, the access gateway adaptively determines the PMTU required for the current transmission between the access gateway and the third-party network element, and writes the required PMTU into the first data packet to obtain a second data packet. The access gateway forwards the second data packet to the virtual switch. The virtual switch updates the current PMTU in the flow table entry associated with the access gateway accessing the third-party network element to the PMTU required for the current transmission, and sends the second data packet, which does not require fragmentation, to the third-party network element according to the updated flow table entry. The third-party network element processes the original data packet in the second data packet to obtain a target data packet. The target data packet is returned by the access gateway to the application server via the virtual switch for response processing. Therefore, when the application service uses a third-party network element, the access gateway can adaptively adjust the PMTU required for the current transmission based on the size information of the first data packet, greatly reducing the probability of data packets sent by the access gateway to the third-party network element being fragmented, improving data packet transmission efficiency, and ensuring the network connectivity of the application service. In addition, by providing an adaptive PMTU only for data packet transmission between the access gateway and third-party network elements, the cloud computing platform will not have a non-standard MTU, and the PMTU restriction will be opened for network traffic of application clients accessing third-party network elements through the access gateway, thus improving the user experience of the cloud computing platform. Attached Figure Description

[0013] The accompanying drawings, which are included to provide a further understanding of this disclosure and form part of this disclosure, illustrate exemplary embodiments of this disclosure and are used to explain this disclosure, but do not constitute an undue limitation of this disclosure.

[0014] Figure 1 is a schematic diagram of the structure of a cloud computing platform provided in this disclosure embodiment.

[0015] Figure 2 is a flowchart of a data packet transmission method for a cloud computing platform that accesses a third-party network element, provided by an embodiment of this disclosure.

[0016] Figure 3 is a flowchart of another data packet transmission method for accessing a third-party network element cloud computing platform provided in an embodiment of this disclosure.

[0017] Figure 4 is a flowchart of a data packet transmission method provided in an embodiment of this disclosure.

[0018] Figure 5 is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this disclosure clearer, the technical solutions of this disclosure will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0020] In the embodiments of this disclosure, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the access relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone, where A and B can be singular or plural. In the textual description of this disclosure, the character " / " generally indicates that the preceding and following associated objects have an "or" relationship. Furthermore, in the embodiments of this disclosure, "first," "second," "third," etc., are only used to distinguish the content of different objects and have no other special meaning.

[0021] It should be noted that, in the cases involving user information in the embodiments of this disclosure, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse. In addition, the various models involved in this disclosure (including but not limited to language models or large language models) comply with relevant laws and standards.

[0022] The following describes some terms used in the embodiments of this disclosure.

[0023] Maximum Transmission Unit (MTU): This refers to the maximum size of a data packet that a network can transmit, measured in bytes. The MTU determines the maximum number of bytes a sender can transmit at once. If a data packet exceeds the MTU of any network segment in the path, it will be fragmented, i.e., divided into smaller data packets for transmission.

[0024] PMTU (Path Maximum Transmission Unit) refers to the maximum size of a data packet that can be transmitted over a network from a source IP address to a destination IP address. For a transmission path, the PMTU is determined by the minimum value among the MTUs of various network elements along the path, such as virtual machines. Each network element has its own MTU, which defines the size of data packets that the element can handle. By indirectly changing the PMTU value through the MTU, packet fragmentation and reassembly can be effectively avoided, improving network bandwidth utilization.

[0025] Virtual Machine (VM): A software environment created using virtualization technology that simulates a real physical computer. It provides an independent and isolated execution environment for applications. It allows multiple operating system instances to run on the same physical server (also known as a physical machine) while ensuring resource isolation and security between each virtual machine.

[0026] A virtual switch (vSwitch) is a software component running on the host machine that manages and forwards network traffic between virtual machines. It acts as a bridge between virtual machines and the physical network, ensuring that virtual machines can access the external network like physical machines and communicate with other virtual machines. The main functions of a virtual switch include traffic forwarding, virtual network interface card (NIC) management, network isolation and security, performance optimization, and monitoring and management.

[0027] Access gateways are gateway services designed specifically for managing service traffic in cloud-native environments. They can provide various functions such as load balancing, route management, authentication, security protection, monitoring, and logging.

[0028] A cloud computing platform refers to an infrastructure, platform service, or software application that provides cloud computing services. It allows users to access and use computing resources (such as servers, storage, databases, networks, etc.), platform services (such as operating systems, development tools, database management, etc.), and software applications via the Internet without having to own or maintain physical hardware.

[0029] A flow table is a collection of policy entries for a specific flow, responsible for packet lookup and forwarding. A flow table contains a series of flow entries. Flow entries typically include: match fields, counters, and actions. Match fields cover most identifiers at the link layer, network layer, and transport layer; counters are used to collect statistical traffic-related data and can be maintained for each flow table, each data flow, each device port, and each forwarding queue in the switch; action information indicates the next action to be taken for a packet that matches the flow entry.

[0030] The technical solutions of this disclosure and how they solve the aforementioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The technical solutions provided by each embodiment of this disclosure are described in detail below with reference to the accompanying drawings.

[0031] In practical applications, a cloud computing platform can include multiple computing nodes, including but not limited to: physical machines (also known as physical servers), serverless computing, edge nodes, etc. Each computing node can run one or more virtual machines, which communicate over the network via virtual switches. In practice, a cloud computing platform can provide a variety of application services for users, including but not limited to: elastic computing services, object storage services, database services, etc. Furthermore, users can migrate their own application services to the cloud computing platform. Therefore, users can use application services provided by the cloud computing platform or use application services migrated to the cloud computing platform. For users accessing application services on the cloud computing platform, users access the application server through an application client. The application client is the client through which the application service interacts with the user, and the application server is the server that executes the technical logic of the application service. Users initiate requests through the application client, which are transmitted over the network to the application server. The application server responds to the request, executes the corresponding technical logic, and returns the execution result to the application server. In practice, a cloud computing platform can also connect to various third-party network elements provided by third-party service providers. Third-party service providers refer to service providers independent of the cloud computing platform's service providers. Third-party network elements (also known as third-party services) can be understood as application services provided by third-party service providers. Third-party network elements include, but are not limited to, firewalls, intrusion detection systems, or traffic mirroring services.

[0032] For users utilizing application services on a cloud computing platform, they can choose third-party network elements to enhance the functionality or security of the application services they use. When a user's application client requests access to the application server, the raw data packet sent by the user's application client needs to be processed by the third-party network element before being sent to the application server for a response. In practice, due to the inherent isolation between the user's network and the third-party network element's network, the raw data packet sent by the user's application client is typically sent to the third-party network element for processing via an access gateway. The access gateway usually performs tunnel encapsulation on the raw data packet before sending the encapsulated packet to the third-party network element for processing. However, tunnel encapsulation may cause the data packet size to exceed the PMTU on the path between the access gateway and the third-party network element, thus requiring data packet fragmentation. Data packet fragmentation not only increases network latency but may also lead to the retransmission of the entire data packet due to the loss or corruption of any fragment, thereby affecting the network connectivity of the application service and the user experience.

[0033] Specifically, the PMTU on the path between the access gateway and the third-party network element is typically determined by the MTU corresponding to the access gateway and the MTU corresponding to the third-party network element. Generally, the smaller MTU is used as the PMTU on the path between the access gateway and the third-party network element. For ease of management, cloud computing platforms typically allow the MTU of each network element to be set to a fixed value, for example, 1500 bytes. These network elements can be third-party network elements or network elements provided by the cloud computing platform, including but not limited to application clients, application servers, and access gateways. In other words, cloud computing platforms usually do not allow users to adjust the MTU of network elements to avoid too many non-standard MTUs, which could lead to MTU management chaos. Non-standard MTUs can be understood as MTUs outside the fixed value set by the cloud computing platform.

[0034] For ease of understanding and distinction, the data packets sent by the application client are referred to as raw data packets. After receiving the raw data packets from the application client, the access gateway typically needs to encapsulate them using VXLAN (Virtual eXtensible Local Area Network) tunneling. The VXLAN information in the encapsulated data packet usually includes the IP address of the access gateway and the IP address of the third-party network element. Based on the VXLAN information in the encapsulated data packet, the encapsulated data packet can be transmitted from the access gateway to the third-party network element. For example, if the raw data packet size is 1500 bytes and the VXLAN information occupies 200 bytes, the encapsulated data packet size will be 1700 bytes. If the MTU of both the access gateway and the third-party network element is set to 1500 bytes, then the PMTU on the path between the access gateway and the third-party network element will be 1500 bytes. Since the size of the encapsulated data packet (1700 bytes) is larger than the PMTU (1500 bytes), the encapsulated data packet sent by the access gateway needs to be fragmented into smaller data packets, which are then transmitted to the third-party network element. The third-party network element needs to reassemble the received fragmented data packets to obtain the encapsulated data packets, and then process these encapsulated data packets to obtain the processed data packets. If the size of the processed data packets exceeds 1500 bytes, the processed data packets sent by the third-party network element also need to be fragmented to obtain smaller data packets for transmission to the access gateway. The access gateway also needs to reassemble the data packets to obtain the processed data packets from the third-party network element, and then send the processed data packets to the application server for response. At this point, the entire process of the original data packets sent by the application client being processed by the third-party network element and then sent to the application server for response is complete.

[0035] Figure 1 is a schematic diagram of a cloud computing platform provided in this embodiment. For ease of understanding, Figure 1 only shows four computing nodes. Each computing node includes one virtual machine and one virtual switch that communicate with each other. However, in practical applications, the number of computing nodes, the number of virtual machines, and the number of virtual switches are not limited. Referring to Figure 1, the cloud computing platform may include: a first computing node, a second computing node, a third computing node, and a fourth computing node. The first computing node includes a first virtual switch and a first virtual machine that communicate with each other, and the first virtual machine has deployed an access gateway; the second computing node includes a second virtual machine that has deployed application clients; the third computing node includes a third virtual switch and a third virtual machine that communicate with each other, and the third virtual machine has deployed access to a third-party network element; the fourth computing node includes a fourth virtual machine that has deployed an application server.

[0036] In this embodiment, the second computing node forwards the raw data packets sent by the application client in the second virtual machine to the first computing node. In practical applications, the application client in the second virtual machine can be forwarded to the first computing node via the second virtual switch. Referring to ① in Figure 1, after receiving the raw data packet sent by the application client, the second virtual switch can perform tunnel encapsulation on the raw data packet, and the encapsulated raw data packet carries VXLAN information. The VXLAN information may include the IP address of the second computing node (as source address information) and the IP address of the first computing node (as destination address information). The second virtual switch sends the encapsulated raw data packet to the first computing node according to the VXLAN information.

[0037] In this embodiment, the first computing node receives the original data packet forwarded by the first virtual switch through the access gateway, and encapsulates the original data packet with first encapsulation information indicating that the access gateway accesses a third-party network element to obtain a first data packet; wherein, the original data packet is sent by an application client in a second virtual machine running on the second computing node, and the third-party network element is deployed on a third computing node running a third virtual machine; the access gateway determines the PMTU required for this transmission based on the data packet size information of the first data packet, and writes the PMTU required for this transmission into the first encapsulation information of the first data packet to obtain a second data packet, and sends the second data packet to the first virtual switch; the first virtual switch then receives the original data packet from the second virtual switch. The PMTU required for this transmission is obtained from the data packet. The first flow entry in the flow table corresponding to the first virtual switch, which is associated with the access gateway accessing the third-party network element, is determined. The current PMTU recorded in the first flow entry is updated to the PMTU required for this transmission. The second data packet is sent to the third virtual machine according to the updated first flow entry, and the third data packet returned by the third virtual machine is sent to the access gateway. The access gateway decapsulates the third data packet to obtain the target data packet. The target data packet is obtained by the third network element processing the original data packet in the second data packet. The first virtual switch forwards the target data packet to the application server in the fourth virtual machine running on the fourth computing node for response processing.

[0038] In practical applications, access gateways can determine the next-hop address of data packets through their internal routing tables or routing policies. Based on the destination IP address of the data packet, the access gateway will query its routing table or routing policy to determine which third-party network element the data packet should be forwarded to. Of course, when tunneling technology is involved, the access gateway will encapsulate a new header layer around the original data packet. This process is usually transparent, and the selection of the tunnel endpoints is based on preset policies or configurations. The information contained in this new header enables the data packet to be correctly transmitted from one network endpoint to another. The IP addresses at both ends of the tunnel are usually pre-configured before establishing the tunnel connection, and this information is stored in the access gateway's configuration. This means that once the tunnel is established, all data packets that meet specific conditions will be transmitted through this tunnel.

[0039] Specifically, the first virtual switch can receive raw data packets encapsulated with VXLAN information forwarded by the second virtual switch. The first virtual switch decapsulates the raw data packets encapsulated with VXLAN information to obtain the raw data packets sent by the application client. Referring to ② in Figure 1, the first virtual switch sends the raw data packets to the first virtual machine running the access gateway. After receiving the raw data packets forwarded by the first virtual switch, the access gateway encapsulates first encapsulation information on the raw data packets, instructing the access gateway to access a third-party network element, thus obtaining the first data packet. The first encapsulation information includes, but is not limited to: VXLAN protocol information, GRE (Generic Routing Encapsulation) protocol information, GPE (Generic Protocol Extension) protocol information, or NSH (Network Service Header) protocol information. In practical applications, the source address information in the first encapsulation information is the address information of the access gateway (e.g., the IP address information of the access gateway), and the destination address information in the first encapsulation information is the address information of the third-party network element (e.g., the IP address information of the third-party network element). In this way, the first encapsulation information can instruct the access gateway to access the third-party network element.

[0040] In this embodiment, it is also necessary to determine the PMTU required for this transmission based on the data packet size information of the first data packet through the access gateway, and to write the PMTU required for this transmission into the first encapsulation information in the first data packet to obtain the second data packet.

[0041] In practical applications, the size of the first data packet can be directly used as the PMTU required for this transmission, or a correction value can be added to the size of the first data packet to obtain the PMTU required for this transmission. The correction value can be flexibly set as needed, for example, 10 bytes, etc.

[0042] Understandably, the access gateway can adaptively adjust the PMTU required for this transmission based on the size of the first data packet, significantly reducing the probability of data packets being fragmented when sent to third-party network elements, improving data packet transmission efficiency, and ensuring network connectivity for application services. Furthermore, by providing an adaptive PMTU only for data packet transmission between the access gateway and third-party network elements, non-standard MTUs are avoided on the cloud computing platform, while allowing PMTU restrictions to be lifted on network traffic from application clients accessing third-party network elements through the access gateway, thus improving the user experience of the cloud computing platform.

[0043] Optionally, before determining the PMTU required for this transmission based on the packet size information of the first packet through the access gateway, the access gateway determines whether the packet size information of the first packet is greater than a specified PMTU, where the specified PMTU is determined based on the MTU of the first virtual machine and the third virtual machine respectively. If the packet size information of the first packet is greater than the specified PMTU, the step of determining the PMTU required for this transmission based on the packet size information of the first packet through the access gateway is executed; if the packet size information of the first packet is less than or equal to the specified PMTU, the step of determining the PMTU required for this transmission based on the packet size information of the first packet through the access gateway is prohibited.

[0044] In practical applications, cloud computing platforms can set the MTU of the first virtual machine with the deployed access gateway and the MTU of the third virtual machine with the deployed third-party network element. The smaller of the two MTUs is used as the specified PMTU on the path between the access gateway and the third-party network element. Typically, cloud computing platforms allow the MTU of the first virtual machine with the deployed access gateway and the MTU of each of the three virtual machines with the deployed third-party network element to be uniformly managed fixed values, such as 1500 bytes. In this case, the specified PMTU can be 1500 bytes.

[0045] In practical applications, the access gateway determines whether the size of the first data packet exceeds the specified PMTU. If it does, it means the specified PMTU cannot meet the requirement of not fragmenting the first data packet. In this case, it is necessary to set the PMTU for this transmission to be adaptive to the size of the first data packet. If it is greater than or less than the specified PMTU, it means the specified PMTU can meet the requirement of fragmenting the first data packet. In this case, the step of setting the PMTU for this transmission to be adaptive to the size of the first data packet can be skipped to save computing resources and improve data packet transmission efficiency.

[0046] Optionally, if the size of the first data packet is greater than the specified PMTU, the access gateway determines whether the size of the first data packet is greater than the PMTU required for the most recent transmission. If the size of the first data packet is greater than the PMTU required for the most recent transmission, the access gateway determines the PMTU required for this transmission based on the size of the first data packet. If the size of the first data packet is less than or equal to the most recently determined PMTU, the access gateway is prohibited from determining the PMTU required for this transmission based on the size of the first data packet.

[0047] As time progresses, the access gateway may repeatedly transmit data packets to third-party network elements, potentially determining the required PMTU for each transmission based on the packet size information. If the packet size of the first data packet is greater than the specified PMTU, it can be compared to the PMTU required for the most recent transmission, which is the PMTU determined before this transmission. If the packet size of the first data packet is greater than the PMTU required for the most recent transmission, it means the PMTU required for the most recent transmission cannot meet the requirement of not fragmenting the first data packet. In this case, it is necessary to set the PMTU required for this transmission to be adaptive to the packet size information of the first data packet. If the packet size of the first data packet is less than or equal to the most recently determined PMTU, it means the PMTU required for the most recent transmission can meet the requirement of not fragmenting the first data packet. In this case, the step of setting the PMTU required for this transmission to be adaptive to the packet size information of the first data packet can be skipped to save computational resources and improve data packet transmission efficiency.

[0048] In this embodiment, the access gateway determines the PMTU required for this transmission based on the packet size information of the first packet, and writes the required PMTU into the first encapsulation information of the first packet to obtain the second packet, as shown in ③ of Figure 1. The access gateway then sends the second packet to the first virtual switch. Of course, if it is not necessary to perform the step of determining the PMTU required for this transmission based on the packet size information of the first packet, the access gateway can directly send the first packet to the first virtual switch.

[0049] In this embodiment, after the first virtual switch receives the second data packet sent by the access gateway, the first virtual switch can obtain the PMTU required for this transmission from the second data packet, determine the first flow table entry in the flow table corresponding to the access gateway accessing the third-party network element, update the current PMTU recorded in the first flow table entry to the PMTU required for this transmission, and send the second data packet to the third virtual machine according to the updated first flow table entry.

[0050] Specifically, the first virtual switch can obtain the PMTU required for this transmission from the first encapsulation information in the second data packet. Then, it determines the first flow table entry in the flow table corresponding to the first virtual switch that is associated with the access gateway accessing the third-party network element. This first flow table entry is the flow table entry associated with the access gateway accessing the third-party network element among the multiple flow table entries included in the flow table. Optionally, to accurately find the flow table entry associated with the access gateway accessing the third-party network element, the source address information in the first encapsulation information is the address information of the access gateway, and the destination address information in the first encapsulation information is the address information of the third-party network element. Correspondingly, the method for determining the first flow table entry associated with the access gateway accessing the third-party network element in the flow table corresponding to the first virtual switch is as follows: Based on the first encapsulation information in the second data packet, the flow table corresponding to the first virtual switch is searched, and the flow table entry that matches the source address information and destination address information in the first encapsulation information is taken as the first flow table entry associated with the access gateway accessing the third-party network element.

[0051] Typically, the matching fields of a flow table entry are 5-tuples, which include, but are not limited to, source IP address, destination IP address, source port, destination port, and protocol. Therefore, a flow table entry whose matching fields match the first encapsulation information can be designated as the first flow table entry. Specifically, if the source address information in the first encapsulation information is the address information of the access gateway (e.g., the IP address of the access gateway), and the destination address information in the first encapsulation information is the address information of a third-party network element (e.g., the IP address of the third-party network element), then the source IP address in the matching fields of the first flow table entry will be the address information of the access gateway, and the destination IP address in the matching fields of the first flow table entry will be the address information of the third-party network element.

[0052] In this embodiment, if the first virtual switch updates the current PMTU recorded in the first flow entry to the PMTU required for this transmission, it can control data packet transmission according to the latest PMTU in the first flow entry. For example, the current PMTU recorded in the action information of the first flow entry can be updated to the PMTU required for this transmission. The first virtual switch determines that the data packet size information of the second data packet matches the latest PMTU in the first flow entry, and determines that there is no need to fragment the second data packet, and directly sends the second data packet to the third virtual machine that has deployed third-party network elements.

[0053] Optionally, if the second data packet is the first data packet (i.e., the first packet) transmitted by the access gateway to a third-party network element, the current PMTU recorded in the first flow entry can be the specified PMTU.

[0054] For example, the source IP address in the 5-tuple information of the first-flow entry is 1.1.1.1:1, and the destination IP address in the 5-tuple information of the first-flow entry is 4.4.4.4:3. The action table information of the first-flow entry is "VXLAN encapsulation: 9.9.9.9:9->31.31.31.31:31, ACL passed, rate limit 10Mbps, PMTU:1700". This first-flow entry indicates that traffic from IP address 1.1.1.1:1 to IP address 4.4.4.4:3 will be encapsulated in the VXLAN tunnel from 9.9.9.9:9 to 31.31.31.31:31, and will be checked by ACL (Access Control List), with a rate limit of 10Mbps and a PMTU of 1700 bytes. The first-flow entry indicates that "traffic from IP address 1.1.1.1:1 to IP address 4.4.4.4:3 will be encapsulated in a VXLAN tunnel from IP address 9.9.9.9:9 to IP address 31.31.31.31:31, and will be rate-limited to 10 Mbps and PMTU to 1700 bytes by ACL checks".

[0055] In practical applications, a second encapsulation information for accessing a third-party network element can be encapsulated on the second data packet by a first virtual switch, as shown in ④ of Figure 1. The first virtual switch sends the second data packet encapsulated with the second encapsulation information to the third computing node where the third virtual machine is deployed. The second encapsulation information can be VXLAN information. The second encapsulation information may include: the IP address information of the first computing node (as source address information) and the IP address information of the third computing node (as source address information). This second encapsulation information indicates access to a third-party network element.

[0056] Optionally, the implementation of sending the second data packet to the third virtual machine through the first virtual switch according to the updated first flow table entry is as follows: the first virtual switch encapsulates the second data packet with second encapsulation information for accessing third-party network elements, the second encapsulation information including the PMTU required for this transmission; the first virtual switch then sends the second data packet encapsulated with the second encapsulation information to the third virtual machine according to the updated first flow table entry. In practical applications, the protocol of the second encapsulation information is not restricted. Optionally, the second encapsulation information is the encapsulation information of the VXLAN protocol. Optionally, the reserved field (reserve field) information in the VXLAN protocol encapsulation information contains the PMTU required for this transmission. By writing the PMTU required for this transmission into the reserved field in the VXLAN protocol encapsulation information, the PMTU required for this transmission can be determined quickly and accurately. Of course, it is not limited to writing the PMTU required for this transmission into the reserved field.

[0057] It is worth noting that writing the PMTU required for this transmission into the second encapsulation information of the encapsulated second data packet can facilitate the subsequent third computing node to quickly and accurately determine the PMTU required for this transmission of the second data packet.

[0058] It is worth noting that if the access gateway sends the first data packet without the PMTU required for this transmission to the first virtual switch, the first virtual switch also needs to determine the first flow table entry in the flow table corresponding to the access gateway accessing the third-party network element, and send the second data packet to the third virtual machine according to the first flow table entry.

[0059] If the access gateway directly sends the first data packet to the first virtual switch, the first virtual switch also needs to determine the first flow table entry in the flow table corresponding to the access gateway accessing the third-party network element, and send the first data packet to the third virtual machine according to the first flow table entry.

[0060] In this embodiment, the third computing node is used to receive the second data packet sent by the first virtual switch of the first computing node, process the second data packet through a third-party network element on the third virtual machine to obtain the third data packet, and return it to the first computing node.

[0061] Referring to ④ in Figure 1, the first virtual switch of the first computing node can send the second data packet encapsulated with the second encapsulation information to the third virtual switch of the third computing node. Referring to ⑤ in Figure 1, the third virtual switch decapsulates the second data packet encapsulated with the second encapsulation information to obtain the second data packet, and sends the second data packet to the third virtual machine. The third virtual machine can obtain the original data packet from the second data packet, process the original data packet to obtain the target data packet, and obtain the third data packet based on the target data packet. Optionally, the third network element in the third virtual machine processes the second data packet to obtain the third data packet in the following way: the third network element obtains the address information of the access gateway and the address information of the third network element from the first encapsulation information included in the second data packet; the third network element processes the original data packet in the second data packet to obtain the target data packet; the third network element encapsulates the target data packet with the third encapsulation information to obtain the third data packet, wherein the source address information of the third encapsulation information is the address information of the third network element, and the destination address information of the third encapsulation information is the address information of the access gateway. Referring to ⑥ in Figure 1, the third virtual machine returns the third data packet including the third encapsulation information and the target data packet to the third virtual switch.

[0062] In this embodiment, the third virtual switch can encapsulate VXLAN information onto the third data packet. The VXLAN information includes the IP address information of the third computing node (source address information) and the IP address information of the second computing node (destination address information). Referring to ⑦ in Figure 1, the third virtual switch sends the encapsulated third data packet to the first virtual switch based on the VXLAN information in the encapsulated third data packet. Referring to ⑧ in Figure 1, the first virtual switch decapsulates the encapsulated third data packet to obtain the third data packet and sends it to the access gateway. Referring to ⑨ in Figure 1, the access gateway decapsulates the third data packet to obtain the target data packet and sends it to the first virtual switch. Referring to ⑩ in Figure 1, the first virtual switch can encapsulate VXLAN information onto the target data packet. The VXLAN information includes the IP address information of the first computing node (source address information) and the IP address information of the fourth computing node (destination address information). The first virtual switch sends the encapsulated target data packet to the fourth virtual switch according to the VXLAN information in the encapsulated target data packet. Referring to Figure 1... As shown, the fourth virtual switch decapsulates the encapsulated target data packet to obtain the target data packet, and sends the target data packet to the application server for response processing. Thus, the entire process of the original data packet sent from the application client, being processed by a third-party network element to obtain the target data packet, and then being sent to the application server for response is completed.

[0063] In this embodiment, the fourth computing node is used to respond to the target data packet sent by the first computing node through the application server in the fourth virtual machine. The target data packet is obtained by processing the original data packet through a third-party network element.

[0064] In some optional embodiments, in addition to the second virtual switch in the second compute node dynamically updating flow table entries, the second virtual switch in the third compute node can also dynamically update flow table entries, thereby ensuring that the target data packet can be transmitted from the third serving network element to the access gateway without fragmentation. Based on this, the third compute node is used to receive the second data packet sent by the first virtual switch through the third virtual switch, obtain the PMTU required for this transmission from the second data packet, determine the second flow table entry in the flow table corresponding to the third virtual switch that is associated with the access gateway for the third-party network element, and update the current PMTU recorded in the second flow table entry to the PMTU required for this transmission; wherein, the first virtual switch and the access gateway are deployed on the first compute node, and the second data packet is sent from the access gateway to the first virtual switch; the second data packet is forwarded to the third virtual machine through the third virtual switch, so that the third-party network element in the third virtual machine can process the second data packet to obtain the third data packet; the third virtual switch sends the third data packet to the first virtual switch according to the updated second flow table entry, so that the first virtual switch forwards the third data packet to the access gateway.

[0065] Optionally, the PMTU required for this transmission can be obtained from the second data packet via the third virtual switch by obtaining the second encapsulation information for accessing the third-party network element from the second data packet via the third virtual switch, and obtaining the PMTU required for this transmission from the second encapsulation information.

[0066] In practical applications, the third virtual switch can obtain the address information of the access gateway and the third-party network element from the first encapsulation information in the second data packet. It then retrieves the flow table entry in the corresponding flow table that matches the source address information of the third-party network element and the destination address information of the access gateway, and uses this entry as the second flow table entry associated with the third-party network element's access to the access gateway. The current PMTU recorded in the second flow table entry is updated to the PMTU required for this transmission. In this way, the third data packet obtained after the third-party network element processes the second data packet can be returned to the access gateway without fragmentation.

[0067] It is worth noting that if the second data packet received by the third virtual switch does not contain the PMTU required for this transmission, the third virtual switch can forward the second data packet to the third virtual machine. Alternatively, if the third virtual switch receives the first data packet sent by the first virtual switch, the third virtual switch can forward the first data packet to the third virtual machine.

[0068] The cloud computing platform provided in this embodiment of the present disclosure, after receiving the original data packet sent by the application client forwarded by the virtual switch, encapsulates the original data packet with encapsulation information indicating that the access gateway accesses a third-party network element to obtain a first data packet. Based on the size of the first data packet, the access gateway adaptively determines the PMTU required for the current transmission between the access gateway and the third-party network element, and writes the required PMTU into the first data packet to obtain a second data packet. The access gateway forwards the second data packet to the virtual switch. The virtual switch updates the current PMTU in the flow table entry associated with the access gateway accessing the third-party network element to the PMTU required for the current transmission, and sends the second data packet, which does not require fragmentation, to the third-party network element according to the updated flow table entry. The third-party network element processes the original data packet in the second data packet to obtain a target data packet. The target data packet is returned by the access gateway to the application server for response processing via the virtual switch. Therefore, when the application service uses a third-party network element, the access gateway can adaptively adjust the PMTU required for the current transmission based on the size information of the first data packet, greatly reducing the probability of data packets sent by the access gateway to the third-party network element being fragmented, improving data packet transmission efficiency, and ensuring the network connectivity of the application service. In addition, by providing an adaptive PMTU only for data packet transmission between the access gateway and third-party network elements, the cloud computing platform will not have a non-standard MTU, and the PMTU restriction will be opened for network traffic of application clients accessing third-party network elements through the access gateway, thus improving the user experience of the cloud computing platform.

[0069] To better understand the technical solution of this disclosure, the following describes a specific process of an application client accessing an application server, with reference to Figure 1. Specifically, the process of an application client accessing an application server may include the following steps.

[0070] S1. The second virtual switch receives raw data packets sent by application clients in the second virtual machine.

[0071] S2. The second virtual switch encapsulates the first VXLAN information into the original data packet. The first VXLAN information includes: the IP address information of the second computing node (as source address information) and the IP address information of the first computing node (as destination address information).

[0072] S3. The second virtual switch sends a raw data packet encapsulated with the first VXLAN information to the first virtual switch, as shown in ① of Figure 1. This raw data packet encapsulated with the first VXLAN information can be denoted as "IP address information of the second computing node -> IP address information of the first computing node | raw data packet". Here, -> indicates the direction of data packet transmission. "IP address information of the second computing node -> IP address information of the first computing node" represents the first VXLAN information.

[0073] S4. The first virtual switch decapsulates the original data packet containing the first VXLAN information to obtain the original data packet; the first virtual switch sends the original data packet to the access gateway in the first virtual machine, as shown in ② in Figure 1.

[0074] S5. The access gateway in the first virtual machine encapsulates the first encapsulation information into the original data packet to obtain the first data packet; it determines the PMTU required for this transmission based on the data packet size information of the first data packet, and writes the PMTU required for this transmission into the first encapsulation information of the first data packet to obtain the second data packet.

[0075] In the first encapsulation information, the source address information is the IP address of the access gateway, and the destination address information is the IP address of the third-party network element. The first encapsulation information also records the PMTU required for this transmission. The second data packet can be represented as "IP address of access gateway -> IP address of third-party network element (with an added field in the protocol header recording the PMTU required for this transmission) | Original data packet," where "IP address of access gateway -> IP address of third-party network element" represents the first encapsulation information.

[0076] S6. The access gateway in the first virtual machine sends the second data packet to the first virtual switch, as shown in ③ of Figure 1.

[0077] S7. The first virtual switch encapsulates second VXLAN information in the second data packet. The second VXLAN information includes: the IP address information of the first computing node (as source address information) and the IP address information of the third computing node (as destination address information). The second data packet encapsulating the second VXLAN information is sent to the third virtual switch, as shown in ④ of Figure 1.

[0078] The second data packet encapsulating the second VXLAN information can be denoted as "IP address information of the first computing node -> IP address information of the third computing node | IP address information of the access gateway -> IP address information of the third-party network element (an additional field is added to the protocol header to record the PMTU required for this transmission) | Original data packet". "IP address information of the first computing node -> IP address information of the third computing node" represents the second VXLAN information.

[0079] S8. The third virtual switch decapsulates the second data packet containing the encapsulated second VXLAN information to obtain the second data packet; and the third virtual switch sends the second data packet to the third-party network element in the third virtual machine, as shown in ⑤ in Figure 1.

[0080] S9. The third-party network element in the third virtual machine decapsulates the second data packet to obtain the original data packet. The third-party network element processes the original data packet to obtain the target data packet. The third-party network element generates third encapsulation information without recording PTMU information based on the first encapsulation information that records PTMU information in the second data packet, and encapsulates the third encapsulation information on the target data packet. The encapsulated target data packet (which can be called the third data packet) is denoted as "IP address information of the third-party network element -> IP address information of the access gateway (the protocol header does not record the PMTU required for this transmission) | target data packet". The third virtual machine sends the third data packet to the third virtual switch, as shown in ⑥ of Figure 1.

[0081] S10. The third virtual switch encapsulates the third VXLAN information in the third data packet and sends the third data packet containing the third VXLAN information to the first virtual switch, as shown in ⑦ in Figure 1.

[0082] The third data packet encapsulating the third VXLAN information can be denoted as "IP address information of the third computing node -> IP address information of the first computing node | IP address information of the third-party network element -> IP address information of the access gateway (the protocol header does not record the PMTU required for this transmission) | target data packet". The third VXLAN information is represented as "IP address information of the third computing node -> IP address information of the first computing node".

[0083] S11. The first virtual switch decapsulates the third data packet encapsulating the third VXLAN information to obtain the third data packet, and sends the third data packet to the access gateway in the first virtual machine, as shown in ⑧ in Figure 1.

[0084] S12. The access gateway in the second virtual machine decapsulates the third data packet, obtains the target data packet, and sends it to the first virtual switch, as shown in Figure 1, ⑨.

[0085] S13. The first virtual switch encapsulates the fourth VXLAN information in the target data packet and sends the target data packet encapsulated with the fourth VXLAN information to the fourth virtual switch, as shown in ⑩ in Figure 1.

[0086] The target data packet encapsulating the fourth VXLAN information is denoted as "IP address information of the first computing node -> IP address information of the fourth computing node | target data packet". "IP address information of the first computing node -> IP address information of the fourth computing node" can be represented as the fourth VXLAN information.

[0087] S14. The fourth virtual switch decapsulates the target data packet encapsulating the fourth VXLAN information, obtains the target data packet, and sends the target data packet to the application server in the fourth virtual machine for response processing, as shown in Figure 1. As shown.

[0088] Figure 2 is a flowchart of a data packet transmission method for a cloud computing platform accessing a third-party network element according to an embodiment of this disclosure. The method is applied to a first computing node among multiple computing nodes in the cloud computing platform. The first computing node includes a first virtual switch and a first virtual machine that communicate with each other. The first virtual machine has an access gateway deployed on it. Referring to Figure 2, the method may include the following steps.

[0089] 201. The access gateway receives the original data packet forwarded by the first virtual switch and encapsulates the original data packet with first encapsulation information indicating that the access gateway accesses the third-party network element to obtain the first data packet; wherein the original data packet is sent by the application client in the second virtual machine running on the second computing node, and the third-party network element is deployed on the third computing node running the third virtual machine.

[0090] 202. The access gateway determines the PMTU required for this transmission based on the data packet size information of the first data packet, and writes the PMTU required for this transmission into the first encapsulation information of the first data packet to obtain the second data packet, and sends the second data packet to the first virtual switch.

[0091] 203. Obtain the PMTU required for this transmission from the second data packet through the first virtual switch, determine the first flow table entry in the flow table corresponding to the access gateway accessing the third-party network element, update the current PMTU recorded in the first flow table entry to the PMTU required for this transmission, send the second data packet to the third virtual machine according to the updated first flow table entry, and send the third data packet returned by the third virtual machine to the access gateway.

[0092] 204. The third data packet is decapsulated through the access gateway to obtain the target data packet. The target data packet is obtained by the third-party network element processing the original data packet in the second data packet. The target data packet is then forwarded through the first virtual switch to the application server in the fourth virtual machine running on the fourth computing node for response processing.

[0093] Optionally, before determining the PMTU required for this transmission based on the packet size information of the first packet through the access gateway, the above method further includes: determining whether the packet size information of the first packet is greater than a specified PMTU through the access gateway, wherein the specified PMTU is determined based on the MTU of the first virtual machine and the third virtual machine respectively; if the packet size information of the first packet is greater than the specified PMTU, then the step of determining the PMTU required for this transmission based on the packet size information of the first packet through the access gateway is executed; if the packet size information of the first packet is less than or equal to the specified PMTU, then the step of determining the PMTU required for this transmission based on the packet size information of the first packet through the access gateway is prohibited.

[0094] Optionally, if the size information of the first data packet is greater than the specified PMTU, then the step of determining the PMTU required for this transmission based on the size information of the first data packet by the access gateway is executed, including: if the size information of the first data packet is greater than the specified PMTU, determining by the access gateway whether the size information of the first data packet is greater than the PMTU required for the most recent transmission; if the size information of the first data packet is greater than the PMTU required for the most recent transmission, then the step of determining the PMTU required for this transmission based on the size information of the first data packet by the access gateway is executed; if the size information of the first data packet is less than or equal to the most recently determined PMTU, then the step of determining the PMTU required for this transmission based on the size information of the first data packet by the access gateway is prohibited.

[0095] Optionally, the first virtual switch sends a second data packet to the third virtual machine according to the updated first flow table entry, including: encapsulating the second data packet with second encapsulation information for accessing third-party network elements, the second encapsulation information including the PMTU required for this transmission; and sending the second data packet encapsulated with the second encapsulation information to the third virtual machine according to the updated first flow table entry.

[0096] Optionally, the second encapsulation information is the encapsulation information of the VXLAN protocol, and the field information of the reserved fields in the VXLAN protocol encapsulation information is the PMTU required for this transmission.

[0097] Optionally, the source address information in the first encapsulation information is the address information of the access gateway, and the destination address information in the first encapsulation information is the address information of the third-party network element; accordingly, determining the first flow table entry in the flow table corresponding to the first virtual switch that is associated with the access gateway accessing the third-party network element includes: searching the flow table corresponding to the first virtual switch based on the first encapsulation information in the second data packet, and taking the flow table entry that matches the source address information and destination address information in the first encapsulation information as the first flow table entry associated with the access gateway accessing the third-party network element.

[0098] Figure 3 is a flowchart of another data packet transmission method for a cloud computing platform accessing a third-party network element provided by an embodiment of this disclosure. The method is applied to a third computing node among multiple computing nodes included in the cloud computing platform. The third computing node includes a third virtual switch and a third virtual machine that communicate with each other. The third virtual machine has deployed a third-party network element. Referring to Figure 3, the method may include the following steps.

[0099] 301. Receive the second data packet sent by the first virtual switch through the third virtual switch, obtain the PMTU required for this transmission from the second data packet, determine the second flow table entry in the flow table corresponding to the third virtual switch that is associated with the access gateway of the third-party network element, and update the current PMTU recorded in the second flow table entry to the PMTU required for this transmission; wherein, the first virtual switch and the access gateway are deployed on the first computing node, and the second data packet is sent by the access gateway to the first virtual switch.

[0100] 302. The second data packet is forwarded to the third virtual machine through the third virtual switch, so that the third network element in the third virtual machine can process the second data packet to obtain the third data packet.

[0101] 303. The third virtual switch sends a third data packet to the first virtual switch according to the updated second flow table entry, so that the first virtual switch forwards the third data packet to the access gateway.

[0102] Optionally, the PMTU required for this transmission can be obtained from the second data packet via a third virtual switch, including: obtaining the second encapsulation information for accessing a third-party network element from the second data packet via the third virtual switch; and obtaining the PMTU required for this transmission from the second encapsulation information.

[0103] Optionally, the third-party network element in the third virtual machine processes the second data packet to obtain the third data packet by: obtaining the address information of the access gateway and the address information of the third-party network element from the first encapsulation information included in the second data packet through the third-party network element; processing the original data packet in the second data packet through the third-party network element to obtain the target data packet; and encapsulating the target data packet with third encapsulation information through the third-party network element to obtain the third data packet, wherein the source address information of the third encapsulation information is the address information of the third-party network element, and the destination address information of the third encapsulation information is the address information of the access gateway.

[0104] Optionally, third-party network elements include any of the following: firewall, intrusion detection system, or traffic mirroring service.

[0105] The detailed implementation methods and beneficial effects of each step in the method shown in Figure 2 or Figure 3 have been described in detail in the foregoing embodiments, and will not be elaborated here.

[0106] In practical applications, after receiving the raw data packets forwarded through a virtual switch, the access gateway typically encapsulates the raw data packets using tunneling before sending the encapsulated packets to other network elements for processing. These other network elements can be third-party network elements or network elements provided by the cloud computing platform itself. However, tunneling encapsulation may cause the data packet size to exceed the PMTU (Path Maximum Transmission Unit) on the path between the access gateway and other network elements. This necessitates data packet fragmentation. Fragmentation not only increases network latency but may also lead to retransmission of the entire data packet due to the loss or corruption of any fragment, resulting in low reliability and efficiency in data packet transmission.

[0107] Figure 4 is a flowchart of a data packet transmission method provided in an embodiment of this disclosure. Referring to Figure 4, the method may include the following steps.

[0108] 401. Receive the original data packet forwarded by the first virtual switch through the access gateway; and encapsulate the original data packet with first encapsulation information indicating that the access gateway accesses the target network element to obtain the first data packet.

[0109] Among them, the target network element and other network elements can be third-party network elements or various application services provided by the cloud computing platform itself, and there are no restrictions on this.

[0110] In this configuration, the first virtual switch and the access gateway are deployed on the same compute node. The original data packets forwarded by the first virtual switch are data packets sent by application services on other compute nodes, which are different from the compute node where the first virtual switch is located.

[0111] After receiving the original data packet forwarded by the first virtual switch, the access gateway encapsulates the original data packet with first encapsulation information instructing the access gateway to access the target network element, thus obtaining the first data packet. The first encapsulation information includes, but is not limited to, VXLAN protocol information, GRE (Generic Routing Encapsulation) protocol information, GPE (Generic Protocol Extension) protocol information, or NSH (Network Service Header) protocol information. In practical applications, the source address information in the first encapsulation information is the address information of the access gateway (e.g., the IP address of the access gateway), and the destination address information is the address information of the target network element (e.g., the IP address of the target network element). In this way, the first encapsulation information can instruct the access gateway to access the target network element.

[0112] 402. The access gateway determines the PMTU required for this transmission based on the data packet size information of the first data packet, and writes the PMTU required for this transmission into the first encapsulation information of the first data packet to obtain the second data packet, and sends the second data packet to the first virtual switch.

[0113] In practical applications, the size of the first data packet can be directly used as the PMTU required for this transmission, or a correction value can be added to the size of the first data packet to obtain the PMTU required for this transmission. The correction value can be flexibly set as needed, for example, 10 bytes, etc.

[0114] Understandably, the access gateway can adaptively adjust the PMTU required for this transmission based on the packet size information of the first packet, which greatly reduces the probability of the packet being fragmented when the access gateway sends it to the target network element, and improves the transmission efficiency of the packet.

[0115] Optionally, before determining the PMTU required for this transmission based on the packet size information of the first packet through the access gateway, the access gateway determines whether the packet size information of the first packet is greater than a specified PMTU, where the specified PMTU is determined based on the MTU of the access gateway and the target network element. If the packet size information of the first packet is greater than the specified PMTU, the step of determining the PMTU required for this transmission based on the packet size information of the first packet through the access gateway is executed. If the packet size information of the first packet is less than or equal to the specified PMTU, the step of determining the PMTU required for this transmission based on the packet size information of the first packet through the access gateway is prohibited.

[0116] Optionally, if the size information of the first data packet is greater than the specified PMTU, then the step of determining the PMTU required for this transmission based on the size information of the first data packet by the access gateway is executed, including: if the size information of the first data packet is greater than the specified PMTU, determining by the access gateway whether the size information of the first data packet is greater than the PMTU required for the most recent transmission; if the size information of the first data packet is greater than the PMTU required for the most recent transmission, then the step of determining the PMTU required for this transmission based on the size information of the first data packet by the access gateway is executed; if the size information of the first data packet is less than or equal to the most recently determined PMTU, then the step of determining the PMTU required for this transmission based on the size information of the first data packet by the access gateway is prohibited.

[0117] 403. Obtain the PMTU required for this transmission from the second data packet through the first virtual switch, determine the first flow table entry in the flow table corresponding to the access gateway accessing the target network element, update the current PMTU recorded in the first flow table entry to the PMTU required for this transmission, and send the second data packet to the target network element according to the updated first flow table entry.

[0118] Optionally, sending the second data packet to the target network element via the first virtual switch according to the updated first flow table entry includes: encapsulating the second data packet with second encapsulation information for accessing the target network element via the first virtual switch, the second encapsulation information including the PMTU required for this transmission; and sending the second data packet encapsulated with the second encapsulation information to the target network element via the first virtual switch according to the updated first flow table entry. Optionally, the second encapsulation information is VXLAN protocol encapsulation information, and the reserved field information in the VXLAN protocol encapsulation information is the PMTU required for this transmission. Optionally, the source address information in the first encapsulation information is the address information of the access gateway, and the destination address information in the first encapsulation information is the address information of the target network element; correspondingly, determining the first flow table entry in the flow table corresponding to the first virtual switch that is associated with the access gateway accessing the target network element includes: searching the flow table corresponding to the first virtual switch based on the first encapsulation information in the second data packet, and taking the flow table entry that matches the source address information and destination address information in the first encapsulation information as the first flow table entry associated with the access gateway accessing the target network element.

[0119] The technical solution provided in this disclosure allows the access gateway to adaptively adjust the PMTU required for this transmission based on the data packet size information, which greatly reduces the probability of data packets sent by the access gateway to other network elements being fragmented, and improves the transmission efficiency and reliability of data packets.

[0120] The implementation of each step in the method embodiment shown in Figure 4 is similar to that of the relevant steps in the foregoing embodiments, and will not be repeated here.

[0121] It should be noted that the execution subject of each step in the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 301 to 303 can be device A; or the execution subject of steps 301 and 302 can be device A, and the execution subject of step 303 can be device B; and so on. Furthermore, some processes described in the above embodiments and figures include multiple operations appearing in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear in this document, or may be executed in parallel. The operation numbers, such as 301, 302, etc., are merely used to distinguish different operations, and the numbers themselves do not represent any execution order. Additionally, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first" and "second" in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to different types.

[0122] Figure 5 is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. As shown in Figure 5, in practice, this electronic device includes a memory 51 and a processor 52.

[0123] Memory 51 is used to store computer programs and can be configured to store various other data to support operation on the electronic device. Examples of this data include instructions for any application or method used to operate on the electronic device, data structures, contact data, phone book data, messages, pictures, videos, etc.

[0124] The processor 52, coupled to the memory 51, is used to execute the computer program in the memory 51 for: executing steps in the data packet transmission method of the cloud computing platform accessing a third-party network element, or executing steps in the data packet transmission method.

[0125] Optionally, as shown in Figure 5, the electronic device may also include other components such as a communication component 53, a display 54, a power supply component 55, and an audio component 56. Figure 5 only schematically shows some components and does not imply that the electronic device only includes the components shown in Figure 5. Furthermore, the components within the dashed boxes in Figure 5 are optional, not mandatory, and their specific inclusion depends on the product form of the working node. The working node in this embodiment can be a terminal device such as a desktop computer, laptop computer, smartphone, or IoT device, or a server-side device such as a conventional server, cloud server, or server array. If the working node in this embodiment is implemented as a terminal device such as a desktop computer, laptop computer, or smartphone, it may include the components within the dashed boxes in Figure 5; if the working node in this embodiment is implemented as a server-side device such as a conventional server, cloud server, or server array, it may not include the components within the dashed boxes in Figure 5.

[0126] The aforementioned memory can be implemented using any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The aforementioned communication component is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as 2G, 3G, 4G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. The aforementioned display includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a Touch Panel, the screen can be implemented as a touchscreen to receive input signals from a user. The Touch Panel includes one or more touch sensors to sense touches, swipes, and gestures on the Touch Panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation. The aforementioned power supply component provides power to various components of the device in which the power supply component resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply component resides. The aforementioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device in which the audio component resides is in an operating mode, such as a call mode, recording mode, or voice recognition mode. The received audio signals may be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0127] Accordingly, this disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement the steps in the above-described method embodiments. The computer-readable storage medium includes volatile or non-volatile or a combination thereof, and may be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium.

[0128] Accordingly, this disclosure also provides a computer program product, which includes a computer program or instructions that, when executed by a processor, cause the processor to implement the steps in the above-described method embodiments. It should be understood that each step or combination of steps in the above-described method flow can be implemented by the computer program or instructions. Furthermore, these computer programs or instructions can be applied to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device, enabling the processor of the general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to function as an apparatus for implementing the corresponding functions in the above-described method embodiments.

[0129] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. The above are merely embodiments of this disclosure and are not intended to limit this disclosure. Various modifications and variations can be made to this disclosure by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of the claims of this disclosure.

Claims

1. A data packet transmission method for a cloud computing platform accessing a third-party network element, applied to a first computing node among multiple computing nodes included in the cloud computing platform, the first computing node including a first virtual switch and a first virtual machine communicating with each other, the first virtual machine having an access gateway deployed; the method includes: The access gateway receives the original data packet forwarded by the first virtual switch and encapsulates the original data packet with first encapsulation information indicating that the access gateway accesses a third-party network element to obtain a first data packet; wherein the original data packet is sent by an application client running in a second virtual machine on a second computing node, and the third-party network element is deployed on a third computing node running a third virtual machine; The access gateway determines the PMTU required for this transmission based on the packet size information of the first packet, and writes the PMTU required for this transmission into the first encapsulation information of the first packet to obtain the second packet, and sends the second packet to the first virtual switch. The first virtual switch obtains the PMTU required for this transmission from the second data packet, determines the first flow table entry in the flow table corresponding to the access gateway accessing the third-party network element, updates the current PMTU recorded in the first flow table entry to the PMTU required for this transmission, sends the second data packet to the third virtual machine according to the updated first flow table entry, and sends the third data packet returned by the third virtual machine to the access gateway. The access gateway decapsulates the third data packet to obtain the target data packet, which is obtained by the third-party network element processing the original data packet in the second data packet. The target data packet is then forwarded by the first virtual switch to the application server in the fourth virtual machine running on the fourth computing node for response processing.

2. The method according to claim 1, wherein, Before the access gateway determines the PMTU required for this transmission based on the packet size information of the first packet, the process further includes: The access gateway determines whether the size of the first data packet is greater than a specified PMTU, which is determined based on the MTU of the first virtual machine and the third virtual machine. If the size of the first data packet is greater than the specified PMTU, then the step of determining the PMTU required for this transmission based on the size of the first data packet by the access gateway is executed. If the packet size information of the first packet is less than or equal to the specified PMTU, the step of determining the PMTU required for this transmission by the access gateway based on the packet size information of the first packet is prohibited.

3. The method according to claim 2, wherein, If the size of the first data packet is greater than the specified PMTU, then the step of determining the PMTU required for this transmission based on the size of the first data packet by the access gateway is performed, including: If the size of the first data packet is greater than the specified PMTU, the access gateway determines whether the size of the first data packet is greater than the PMTU required for the most recent transmission. If the size of the first data packet is greater than the PMTU required for the most recent transmission, then the step of determining the PMTU required for the current transmission based on the size of the first data packet by the access gateway is executed. If the packet size information of the first packet is less than or equal to the most recently determined PMTU, then the step of determining the PMTU required for this transmission based on the packet size information of the first packet by the access gateway is prohibited.

4. The method according to claim 1, wherein, The second data packet is sent to the third virtual machine through the first virtual switch according to the updated first flow table entry, including: The first virtual switch encapsulates second encapsulation information for accessing the third-party network element onto the second data packet, and the second encapsulation information includes the PMTU required for this transmission. The first virtual switch sends a second data packet containing the second encapsulation information to the third virtual machine according to the updated first flow table entry.

5. The method according to claim 4, wherein, The second encapsulation information is the encapsulation information of the VXLAN protocol, and the field information of the reserved field in the encapsulation information of the VXLAN protocol is the PMTU required for this transmission.

6. The method according to any one of claims 1-5, wherein, The source address information in the first encapsulation information is the address information of the access gateway, and the destination address information in the first encapsulation information is the address information of the third-party network element; Determining the first flow table entry in the flow table corresponding to the first virtual switch that is associated with the access gateway accessing the third-party network element includes: Based on the first encapsulation information in the second data packet, the flow table corresponding to the first virtual switch is searched, and the flow table entry that matches the source address information and destination address information in the first encapsulation information is taken as the first flow table entry associated with the access gateway accessing the third-party network element.

7. A data packet transmission method for a cloud computing platform accessing a third-party network element, applied to a third computing node among multiple computing nodes included in the cloud computing platform, wherein the third computing node includes a third virtual switch and a third virtual machine communicating with each other, and the third virtual machine has deployed a third-party network element; the method includes: The third virtual switch receives a second data packet sent by the first virtual switch, obtains the PMTU required for this transmission from the second data packet, determines the second flow table entry in the flow table corresponding to the third virtual switch that is associated with the third-party network element access gateway, and updates the current PMTU recorded in the second flow table entry to the PMTU required for this transmission; wherein, the first virtual switch and the access gateway are deployed on the first computing node, and the second data packet is sent by the access gateway to the first virtual switch; The second data packet is forwarded to the third virtual machine via the third virtual switch, so that the third-party network element in the third virtual machine can process the second data packet to obtain the third data packet; The third virtual switch sends the third data packet to the first virtual switch according to the updated second flow table entry, so that the first virtual switch forwards the third data packet to the access gateway.

8. The method according to claim 7, wherein, The PMTU required for this transmission is obtained from the second data packet via the third virtual switch, including: The third virtual switch obtains the second encapsulation information for accessing the third-party network element from the second data packet; and obtains the PMTU required for this transmission from the second encapsulation information.

9. The method according to claim 7, wherein, The third-party network element in the third virtual machine processes the second data packet to obtain a third data packet, which includes: The address information of the access gateway and the address information of the third-party network element are obtained from the first encapsulation information included in the second data packet through the third-party network element; The target data packet is obtained by processing the original data packet in the second data packet through the third-party network element; The third data packet is obtained by encapsulating the target data packet with third encapsulation information by the third network element, wherein the source address information of the third encapsulation information is the address information of the third network element, and the destination address information of the third encapsulation information is the address information of the access gateway.

10. The method according to any one of claims 7-9, wherein, The third-party network element includes any one of the following: firewall, intrusion detection system, or traffic mirroring service.

11. A cloud computing platform, comprising: First computing node, second computing node, third computing node, and fourth computing node; The first computing node includes a first virtual switch and a first virtual machine that communicate with each other, and the first virtual machine has been deployed with an access gateway; the second computing node includes a second virtual machine that has been deployed with an application client; the third computing node includes a third virtual switch and a third virtual machine that communicate with each other, and the third virtual machine has been deployed with an access third-party network element. The fourth computing node includes a fourth virtual machine with an application server already deployed; The second computing node is used to forward the raw data packets sent by the application client in the second virtual machine to the first computing node; The first computing node is configured to execute the steps of the method according to any one of claims 1-6; The third computing node is used to execute the steps in the method according to any one of claims 7-10; The fourth computing node is used to respond to the target data packet sent by the first computing node through the application server in the fourth virtual machine. The target data packet is obtained by processing the original data packet through the third-party network element.

12. A data packet transmission method, comprising: The gateway receives the raw data packets forwarded by the first virtual switch. And by encapsulating the original data packet with first encapsulation information indicating that the access gateway accesses the target network element, a first data packet is obtained; The access gateway determines the PMTU required for this transmission based on the packet size information of the first packet, and writes the PMTU required for this transmission into the first encapsulation information of the first packet to obtain the second packet, and sends the second packet to the first virtual switch. The first virtual switch obtains the PMTU required for this transmission from the second data packet, determines the first flow table entry in the flow table corresponding to the access gateway accessing the target network element, updates the current PMTU recorded in the first flow table entry to the PMTU required for this transmission, and sends the second data packet to the target network element according to the updated first flow table entry.

13. An electronic device, comprising: A memory and a processor; wherein the memory is used to store a computer program; and the processor is coupled to the memory for executing the computer program to perform the following operations: The access gateway receives the original data packet forwarded by the first virtual switch, and encapsulates the original data packet with first encapsulation information indicating that the access gateway accesses a third-party network element to obtain a first data packet; wherein the original data packet is sent by an application client in a second virtual machine running on a second computing node, and the third-party network element is deployed on a third computing node running a third virtual machine; wherein the first virtual switch is included in the first computing node, and the first computing node also includes a first virtual machine communicating with the first virtual switch, and the access gateway has been deployed on the first virtual machine; The access gateway determines the PMTU required for this transmission based on the packet size information of the first packet, and writes the PMTU required for this transmission into the first encapsulation information of the first packet to obtain the second packet, and sends the second packet to the first virtual switch. The first virtual switch obtains the PMTU required for this transmission from the second data packet, determines the first flow table entry in the flow table corresponding to the access gateway accessing the third-party network element, updates the current PMTU recorded in the first flow table entry to the PMTU required for this transmission, sends the second data packet to the third virtual machine according to the updated first flow table entry, and sends the third data packet returned by the third virtual machine to the access gateway. The access gateway decapsulates the third data packet to obtain the target data packet, which is obtained by the third-party network element processing the original data packet in the second data packet. The target data packet is then forwarded by the first virtual switch to the application server in the fourth virtual machine running on the fourth computing node for response processing.

14. The electronic device according to claim 13, wherein, Before the access gateway determines the PMTU required for this transmission based on the packet size information of the first packet, the process further includes: The access gateway determines whether the size of the first data packet is greater than a specified PMTU, which is determined based on the MTU of the first virtual machine and the third virtual machine. If the size of the first data packet is greater than the specified PMTU, then the step of determining the PMTU required for this transmission based on the size of the first data packet by the access gateway is executed. If the packet size information of the first packet is less than or equal to the specified PMTU, the step of determining the PMTU required for this transmission by the access gateway based on the packet size information of the first packet is prohibited.

15. The electronic device according to claim 14, wherein, If the size of the first data packet is greater than the specified PMTU, then the step of determining the PMTU required for this transmission based on the size of the first data packet by the access gateway is performed, including: If the size of the first data packet is greater than the specified PMTU, the access gateway determines whether the size of the first data packet is greater than the PMTU required for the most recent transmission. If the size of the first data packet is greater than the PMTU required for the most recent transmission, then the step of determining the PMTU required for the current transmission based on the size of the first data packet by the access gateway is executed. If the packet size information of the first packet is less than or equal to the most recently determined PMTU, then the step of determining the PMTU required for this transmission based on the packet size information of the first packet by the access gateway is prohibited.

16. The electronic device according to claim 13, wherein, The second data packet is sent to the third virtual machine through the first virtual switch according to the updated first flow table entry, including: The first virtual switch encapsulates second encapsulation information for accessing the third-party network element onto the second data packet, and the second encapsulation information includes the PMTU required for this transmission. The first virtual switch sends a second data packet containing the second encapsulation information to the third virtual machine according to the updated first flow table entry.

17. The electronic device according to claim 16, wherein, The second encapsulation information is the encapsulation information of the VXLAN protocol, and the field information of the reserved field in the encapsulation information of the VXLAN protocol is the PMTU required for this transmission.

18. An electronic device comprising: A memory and a processor; wherein the memory is used to store a computer program; and the processor is coupled to the memory for executing the computer program to perform the steps of the method according to any one of claims 7-10 or 12.

19. A computer-readable storage medium storing a computer program, wherein, When the computer program is executed by a processor, it causes the processor to perform the steps of the method according to any one of claims 1-10 or 12.

20. A computer program product comprising a computer program or instructions, wherein, When the computer program or the instructions are executed by the processor, the processor is able to perform the steps of the method according to any one of claims 1-10 or 12.

Images