CN113132155B

CN113132155B - Virtual switch distributed escape method and device and storage medium

Info

Publication number: CN113132155B
Application number: CN202110336923.4A
Authority: CN
Inventors: 赵晶晶
Original assignee: New H3C Big Data Technologies Co Ltd
Current assignee: New H3C Big Data Technologies Co Ltd
Priority date: 2021-03-29
Filing date: 2021-03-29
Publication date: 2022-02-22
Anticipated expiration: 2041-03-29
Also published as: CN113132155A

Abstract

The disclosure provides a distributed escape method, a distributed escape device and a distributed escape storage medium for solving the technical problems of gateway resource and performance pressure generated by processing routing request related messages in a centralized way by an exit gateway. In the disclosure, the SDN controller issues the gateway configuration information to the proxy component, the proxy component creates a virtual gateway interface and starts a monitoring daemon, a routing request RS message sent by the virtual machine is sent to the virtual gateway interface through the OVS, and the monitoring daemon assembles a routing advertisement RA message after monitoring the RS message and sends the routing advertisement RA message to the virtual machine through the OVS. In the method, the RS request message is distributed and answered by a local virtual gateway interface, under the condition of control plane failure, the service of the virtual machine in the east-west direction to the IPv6 on the OVS can still be kept normal, the OVS of different manufacturers is supported, the pressure of an exit gateway can be reduced, the reliability of the whole networking is improved, and the occupancy rate of network bandwidth is reduced.

Description

Virtual switch distributed escape method and device and storage medium

Technical Field

The present disclosure relates to the field of communications technologies, and in particular, to a distributed escape method and apparatus for a virtual switch, and a storage medium.

Background

IPv4 addresses are 32 bits (43 hundred million) and IPv6 addresses are 128 bits (43 hundred million) sufficient to allow one address per sand on earth. Due to the limited IPv4 addresses, private and public network inter-access becomes very difficult. The IPv6 addresses are very rich, and each device, automobile and street lamp in the world can have an independent IP address, so that real everything interconnection is realized.

In an IPv6 network in a conventional IT architecture, after the network is deployed and brought online according to service requirements, if the service requirements change, IT is a very tedious matter to modify the configuration of corresponding network devices (routers, switches, firewalls). Software Defined Networking (SDN) may separate the control plane from the data plane of a Network device through the OpenFlow protocol. The control plane is managed by the centralized controller without depending on the underlying network equipment, and the difference from the underlying network equipment is shielded.

In a centralized data center network, three-layer forwarding is performed by using the same network device, namely, a gateway device, and once the gateway device fails, all switch three-layer traffic associated with the gateway device cannot be forwarded. The distributed network has good expandability and strong robustness, and the three-layer flow forwarding in all data centers is realized on the local virtual switch without depending on other equipment. One switch fails and the flow forwarding of other switches cannot be influenced. Therefore, the distributed deployment of the SDN-based IPv6 network has become a future development trend.

When the current controller is docked with an Openflow Virtual Switch (OVS), the processing flow is as follows:

the SDN controller issues configuration to an egress gateway, so that an egress gateway interface can respond to a Neighbor Solicitation (NS) message and a Route Solicitation (RS) message sent by a virtual machine, and notify a remote end of a Route Advertisement (RA) message;

issuing an Openflow flow table (flow table for short) by the SDN controller, wherein the flow table is correspondingly acted as: sending a Neighbor Discovery (ND) message of a virtual machine request gateway to an exit gateway;

3. a neighbor request NS message and a routing request RS message sent by the virtual machine are matched with a flow table issued by the controller in advance, and the messages are sent to an exit gateway;

4. after receiving the message, the egress gateway performs Neighbor Advertisement (NA) or Routing Advertisement (RA) response, and the message reaches the virtual switch OVS through the tunnel and is sent to the corresponding virtual machine in a matching Openflow flow table.

In order to prevent default routing from aging, the egress gateway may also issue a routing advertisement RA message at regular time, and send the message to all OVSs where a Virtual machine with the same Virtual link layer Network (Network for short, corresponding to one VXLAN Network) is located at a remote end or to all OVSs where a Virtual machine with the same VXLAN Network is located through a tunnel of a Virtual eXtensible Local Area Network (VXLAN), and the OVSs forwards the message to the Virtual machine.

The above treatment method has the following technical defects:

(1) because RA configuration is issued based on virtual link layer network addresses, configuration information of all network addresses needs to be issued on an egress gateway under distributed networking, and the resource occupied by the egress network card is large, which may cause the number of network addresses supported by the entire distributed networking to decrease.

(2) Because the neighbor discovery ND messages of all requesting gateways need to be sent to the egress gateway, the gateway processing pressure is high, and meanwhile, the gateway also needs to broadcast the route announcement RA message to all OVSs at regular time, which occupies a large amount of network bandwidth, thereby possibly causing the normal service to fail to operate.

(3) When the egress gateway fails, all the virtual machine traffic on the OVS will lose packets, which may lead to traffic paralysis.

Disclosure of Invention

In view of this, the present disclosure provides a distributed escape method, device and storage medium for a virtual switch, which are used to solve the technical problem of gateway resource and performance pressure generated by an egress gateway centrally processing a routing request related packet.

Fig. 1 is a flowchart of steps of a distributed escape method for a virtual switch provided by the present disclosure, where the method is applied to a computing node where a virtual switch OVS is located in a software defined network SDN, and the method includes:

step 101, an agent component positioned on a computing node where an OVS is positioned receives gateway configuration information issued by an SDN controller;

the agent component, namely agent, is in communication connection with the SDN controller as an agent of the SDN controller.

The gateway configuration information includes, but is not limited to, configuration information required to be carried in a route advertisement RA message and a neighbor advertisement NA message in the IPv6 protocol.

102, the agent component establishes a virtual gateway interface locally according to the gateway configuration information;

103, starting a monitoring daemon by the agent component, transmitting gateway configuration information transmitted by the controller to the monitoring daemon, and monitoring the virtual gateway interface by the monitoring daemon;

104, after receiving a routing request RS message sent by the virtual machine, the OVS forwards the RS message to the virtual gateway interface based on a flow table issued by the SDN controller;

and after the virtual gateway interface is successfully added to the OVS bridge, the flow table is issued to the OVS by the SDN controller.

And 105, after monitoring that the RS message is received by the virtual gateway interface, the monitoring daemon assembles a Route Advertisement (RA) message according to the gateway configuration information and sends the RA message to the virtual machine through the virtual gateway interface.

Further, after receiving a Neighbor Solicitation (NS) message sent by the virtual machine, the OVS forwards the NS message to the virtual gateway interface based on a flow table issued by the SDN controller, and the virtual gateway interface responds to a Neighbor Advertisement (NA) message and sends the NA message to the virtual machine.

Further, in order to prevent the default route from aging, the monitoring daemon regularly issues a Route Advertisement (RA) message to all virtual ports on the OVS, which are in the same virtual link layer network as the virtual gateway interface, and forwards the RA message to the virtual machine through the virtual ports.

Further, the monitoring daemon is implemented by a route notification daemon RADDD.

Further, the gateway configuration information is issued to the proxy component by an SDN controller through a remote procedure call protocol.

Fig. 2 is a schematic structural diagram of a distributed escape device with a virtual switch according to the present disclosure, and each functional module in the device 200 may be implemented by software, hardware, or a combination of software and hardware. The apparatus relates to a plurality of components or modules, which may be disposed on one hardware device to implement all the steps of the method, or may be disposed on different hardware devices to collectively implement all the steps of the method to achieve the inventive objects of the present disclosure. When the method is implemented by a plurality of hardware devices, since the purpose of mutual cooperation among the hardware devices is to achieve the purpose of the invention together, the action and the processing result of one party determine the execution timing of the action of the other party and the possible obtained result, therefore, the modules can be regarded as having mutual command and control relation with each other. The device 200 is applied to a computing node where a virtual switch OVS is located in a Software Defined Network (SDN), and comprises the following steps:

the proxy component 210 is located on a computing node where the OVS is located, and is configured to receive gateway configuration information issued by an SDN controller and create a virtual gateway interface locally according to the gateway configuration information;

a monitoring daemon 220, which is started by the agent component 210, and is used for receiving the gateway configuration information issued by the agent component 210 and monitoring the virtual gateway interface according to the gateway configuration information; after monitoring that the virtual gateway interface receives a routing Request (RS) message, assembling a Routing Advertisement (RA) message according to the gateway configuration information and sending the RA message to the virtual gateway interface;

a virtual gateway interface 230, configured to receive an RS packet sent by a virtual machine forwarded by the OVS based on a flow table issued by the SDN controller; and after receiving the RA packet generated by the monitoring daemon 220 according to the RS packet, forwarding the RA packet to the virtual machine.

Further, the monitoring daemon 220 is further configured to periodically issue a route advertisement RA packet to all virtual ports on the OVS that are in the same virtual link layer network as the virtual gateway interface 230, and forward the RA packet to the virtual machine through the virtual ports.

Further, the virtual gateway interface 230 is further configured to receive a neighbor solicitation NS message sent by the virtual machine and forwarded by the OVS, and respond to a neighbor advertisement NA message to the virtual machine.

Further, the monitoring daemon 220 is implemented by a route notification daemon RADVD; the gateway configuration information is issued by the SDN controller to the proxy component 210 via a remote procedure call protocol.

In the technical scheme, the SDN controller issues gateway configuration information to the agent component, the agent component creates a virtual gateway interface and starts a monitoring daemon, a routing request RS message sent by the virtual machine is sent to the virtual gateway interface through OVS, and the monitoring daemon assembles a routing advertisement RA message after monitoring the RS message and sends the routing advertisement RA message to the virtual machine through OVS. In the method, the RS request message is distributed and answered by a local virtual gateway interface, under the condition of control plane failure, the service of the virtual machine in the east-west direction to the IPv6 on the OVS can still be kept normal, the OVS of different manufacturers is supported, the pressure of an exit gateway can be reduced, the reliability of the whole networking is improved, and the occupancy rate of network bandwidth is reduced.

Fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure, where the electronic device 300 includes: a processor 310, such as a Central Processing Unit (CPU), a communication bus 320, a communication interface 340, and a storage medium 330. Wherein the processor 310 and the storage medium 330 may communicate with each other through a communication bus 320. The storage medium 330 stores therein a computer program that, when executed by the processor 310, performs the steps of the methods provided by the present disclosure.

The storage medium may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. In addition, the storage medium may be at least one memory device located remotely from the processor. The Processor may be a general-purpose Processor including a Central Processing Unit (CPU), a Network Processor (NP), etc.; but also Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components.

Drawings

In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments of the present disclosure or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present disclosure, and other drawings can be obtained by those skilled in the art according to the drawings of the embodiments of the present disclosure.

Fig. 1 is a flowchart illustrating steps of a distributed escape method for a virtual switch according to the present disclosure;

fig. 2 is a schematic structural diagram of a distributed escape device with a virtual switch according to the present disclosure;

fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the disclosure;

fig. 4 is a schematic network structure diagram of a distributed escape method using a virtual switch under SDN IPv6 networking according to an embodiment of the present disclosure.

Detailed Description

The terminology used in the embodiments of the present disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the embodiments of the present disclosure. As used in the embodiments of the present disclosure, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. The term "and/or" as used in this disclosure is meant to encompass any and all possible combinations of one or more of the associated listed items.

It is to be understood that although the terms first, second, third, etc. may be used herein to describe various information in the embodiments of the present disclosure, such information should not be limited by these terms. These terms are only used to distinguish one type of information from another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of embodiments of the present disclosure. Depending on the context, moreover, the word "if" as used may be interpreted as "at … …" or "when … …" or "in response to a determination".

The disclosure provides a distributed escape method for a virtual switch, which aims to solve the technical problems in the prior art, and the basic idea of the method is as follows: under the SDN distributed networking, an SDN controller issues gateway information to a controller agent installed on a computing node through a Remote Procedure Call (RPC) protocol, such as JSON-RPC, the agent adds a virtual gateway interface to a bridge of an OVS according to configuration information, configures a monitoring virtual gateway interface, performs distributed response on an IPv6 routing request RS message and a neighbor request NS message sent by a virtual machine of the computing node through the virtual gateway interface, and sends a routing notification RA message, so that after the SDN controller is disconnected from the OVS, the IPv6 service of the virtual machine is still normal, the reliability of the whole networking is improved, and the network bandwidth occupation is reduced.

Fig. 4 is a schematic network structure diagram of a distributed escape method using a virtual switch under SDN IPv6 networking according to an embodiment of the present disclosure, where the method can implement that an OVS forwarding plane still maintains normal data forwarding under a control plane fault, and a step flow of the method is as follows:

step 401, the SDN controller issues gateway configuration information related to a routing advertisement RA message to an agent module on the OVS through a JSON-RPC protocol;

the gateway configuration Information in this step includes an Option that can be carried by a route advertisement RA message, such as Prefix Information (Prefix Information), Maximum Transmission Unit (MTU), and the like.

Step 402, the agent creates a virtual gateway interface according to the gateway configuration information;

the virtual gateway interface in this step is created by agent according to the gateway configuration information, and the virtual gateway interface is used for answering NS and RS messages and announcing RA messages.

Step 403, the agent starts a RADD routing notification daemon, issues gateway configuration information issued by the controller to the RADD, and monitors a virtual gateway interface by the RADD;

the monitoring Daemon in this embodiment uses a Router Advertisement Daemon (RADVD) in an open source community, and the present disclosure does not limit the specific form and source of the monitoring Daemon, as long as the monitoring Daemon has a function of achieving the purpose of the present disclosure.

The compute node in fig. 4 refers to a local physical server. One server can simultaneously bear a plurality of components such as OVS, virtual machine, Hypervisor, agent, RADDD and the like, and a plurality of local servers can also respectively bear different components, and the disclosure is not particularly limited.

Step 404, after sensing that the virtual gateway interface created by the agent for the OVS is successfully added to the OVS bridge, the SDN controller issues a flow table to the OVS, where the flow table is used to forward a routing request RS message sent by the virtual machine to the added virtual gateway interface;

in this step, after the virtual gateway interface is added to the OVS bridge, the OVS reports a port state status message to the SDN controller through an Openflow protocol, and the SDN controller learns an Openflow port number (i.e., location information) corresponding to the virtual gateway interface through the message, and then issues a flow table for forwarding a routing request RS packet sent by the virtual machine to the added virtual gateway interface.

Step 405, after the virtual machine connected with the OVS is started, the virtual machine sends a routing request RS message to the OVS, after the RS message is matched with the flow table, the RS message is sent to a virtual gateway interface, and after the RADDD monitors that the virtual gateway interface receives the RS message, the RAVD assembles a routing announcement RA message according to gateway configuration information issued by an SDN controller through an agent component agent and responds the RA message to the virtual machine sending the RS message through the virtual gateway interface.

Step 406, after receiving a routing advertisement RA message sent by the RADD, the virtual machine configures an IP address, a default route and a neighbor discovery ND table item of the gateway of the virtual machine;

and 407, directly searching an ND table item of the gateway according to the next hop of the default route for the three-layer flow sent by the virtual machine, encapsulating the MAC address of the virtual gateway, sending the message to the OVS virtual switch, then carrying out three-layer forwarding by the OVS based on the flow table, and sending the message to the target virtual machine.

In an embodiment of the present disclosure, in order to prevent the ND entry of the gateway from aging, the virtual machine may perform neighbor detection at regular time, and send a neighbor solicitation NS message to the gateway, where the message is also sent to the local virtual gateway interface of the OVS through the flow table, and the virtual gateway interface responds to the neighbor advertisement NA message and sends the message to the virtual machine sending the NS message.

In an embodiment of the present disclosure, in order to prevent default routing from aging, the RADVD may also issue a route advertisement RA message to all virtual ports on the OVS, which are in the same virtual link layer network or the same VXLAN as the virtual gateway interface, through the virtual gateway interface at regular time, and forward the RA message to the virtual machine through the virtual port.

The technical scheme provided by the disclosure has the following technical effects:

firstly, the technical scheme of the present disclosure does not need to perform private extension on the OVS, and can maintain the standardization and independence of the OVS, so that OVSs of different manufacturers and open source OVSs can be simultaneously supported.

Secondly, in the technical scheme of the present disclosure, the RS and NS request messages are distributed and answered by the local virtual gateway interface, so that even if the communication connection between the SDN controller and the OVS is disconnected due to a fault, the technical scheme of the present disclosure can still ensure that the service of the virtual machine IPv6 is still normal.

Thirdly, when the exit gateway fails, the service of the virtual machine in the east-west direction IPv6 on the OVS still keeps normal.

Fourthly, because the distributed answer mechanism is adopted in the method, the agent fault on one OVS only affects the IPv6 service of the virtual machine on the OVS, and the IPv6 services of the virtual machines on other OVSs are still normal, so that the reliability of the whole networking can be improved.

Fifth, in the technical scheme provided by the present disclosure, the route advertisement RA message is only issued to all virtual ports on the OVS that are in the same virtual two-layer network, i.e., the same VXLAN, as the virtual gateway interface, and is not flooded to other OVS or egress gateways, so that the network bandwidth occupation can be reduced.

It should be recognized that embodiments of the present disclosure can be realized and implemented by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory memory. The method may be implemented in a computer program using standard programming techniques, including a non-transitory storage medium configured with the computer program, where the storage medium so configured causes a computer to operate in a specific and predefined manner. Each program may be implemented in a high level procedural or object oriented programming language to communicate with a computer system. However, the program(s) can be implemented in assembly or machine language, if desired. In any case, the language may be a compiled or interpreted language. Furthermore, the program can be run on a programmed application specific integrated circuit for this purpose. Further, operations of processes described by the present disclosure may be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The processes described in this disclosure (or variations and/or combinations thereof) may be performed under the control of one or more computer systems configured with executable instructions and may be implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) executing collectively on one or more processors, by hardware, or combinations thereof. The computer program includes a plurality of instructions executable by one or more processors.

Further, the method may be implemented in any type of computing platform operatively connected to a suitable interface, including but not limited to a personal computer, mini computer, mainframe, workstation, networked or distributed computing environment, separate or integrated computer platform, or in communication with a charged particle tool or other imaging device, and the like. Aspects of the disclosure may be embodied in machine-readable code stored on a non-transitory storage medium or device, whether removable or integrated into a computing platform, such as a hard disk, optically read and/or write storage medium, RAM, ROM, or the like, such that it may be read by a programmable computer, which when read by the storage medium or device, is operative to configure and operate the computer to perform the procedures described herein. Further, the machine-readable code, or portions thereof, may be transmitted over a wired or wireless network. The invention described in this disclosure includes these and other different types of non-transitory computer-readable storage media when such media include instructions or programs that implement the steps described above in conjunction with a microprocessor or other data processor. The disclosure also includes the computer itself when programmed according to the methods and techniques described in this disclosure.

The above description is only an example of the present disclosure and is not intended to limit the present disclosure. Various modifications and variations of this disclosure will be apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure should be included in the protection scope of the present disclosure.

Claims

1. A virtual switch distributed escape method is applied to a computing node where a virtual switch OVS is located in a Software Defined Network (SDN), and comprises the following steps:

an agent component positioned on a computing node where an OVS is positioned receives gateway configuration information issued by an SDN controller;

the proxy component establishes a virtual gateway interface locally according to the gateway configuration information;

the agent component starts a monitoring daemon process, and transmits gateway configuration information transmitted by the controller to the monitoring daemon process, and the monitoring daemon process monitors the virtual gateway interface;

after receiving a routing request RS message sent by a virtual machine, the OVS forwards the RS message to the virtual gateway interface based on a flow table issued by an SDN controller;

and after monitoring that the virtual gateway interface receives the RS message, the monitoring daemon assembles a route announcement RA message according to the gateway configuration information and sends the RA message to the virtual machine through the virtual gateway interface.

2. The method of claim 1, further comprising:

and after receiving a Neighbor Solicitation (NS) message sent by the virtual machine, the OVS forwards the NS message to the virtual gateway interface based on a flow table issued by the SDN controller, and the virtual gateway interface responds to a Neighbor Advertisement (NA) message and sends the NA message to the virtual machine.

3. The method of claim 1, further comprising:

and the monitoring daemon regularly issues a Routing Advertisement (RA) message to all virtual ports on the OVS, which are in the same virtual link layer network with the virtual gateway interface, and forwards the RA message to the virtual machine through the virtual ports.

4. The method of claim 1,

and the gateway configuration information is issued to the proxy component by an SDN controller through a remote procedure call protocol.

5. The method of claim 1,

the monitoring daemon is realized by a RADDD (radio frequency identification device) daemon.

6. A virtual switch distributed escape device is applied to a computing node where a virtual switch OVS is located in a Software Defined Network (SDN), and comprises the following components:

the proxy component is positioned on a computing node where the OVS is positioned and used for receiving gateway configuration information issued by the SDN controller and creating a virtual gateway interface locally according to the gateway configuration information;

the monitoring daemon is started by the agent component and is used for receiving the gateway configuration information issued by the agent component and monitoring the virtual gateway interface according to the gateway configuration information; after monitoring that the virtual gateway interface receives a routing Request (RS) message, assembling a Routing Advertisement (RA) message according to the gateway configuration information and sending the RA message to the virtual gateway interface;

the virtual gateway interface is used for receiving an RS message sent by a virtual machine forwarded by the OVS based on a flow table issued by the SDN controller; and after receiving an RA message generated by the monitoring daemon according to the RS message, forwarding the RA message to the virtual machine.

7. The apparatus of claim 6,

the monitoring daemon is also used for regularly issuing a routing advertisement RA message to all virtual ports on the OVS, wherein the virtual ports and the virtual gateway interface of the OVS are in the same virtual link layer network or the same virtual expanded local area network VXLAN, and the RA message is forwarded to the virtual machine through the virtual ports.

8. The apparatus of claim 6,

the virtual gateway interface is also used for receiving a neighbor solicitation NS message which is transmitted by the virtual machine and is forwarded by the OVS, and responding to a neighbor advertisement NA message to the virtual machine.

9. The apparatus of claim 6,

the monitoring daemon is realized by a RADDD (radio distance disk device) daemon; and the gateway configuration information is issued to the proxy component by an SDN controller through a remote procedure call protocol.

10. A storage medium on which a computer program is stored which, when being executed by a processor, carries out the method steps of any one of claims 1 to 5.