CN104168200B - A kind of method and system that acl feature is realized based on Open vSwitch - Google Patents

Abstract

The invention provides a kind of method that acl feature is realized based on Open vSwitch, this method includes：The new acl rule on certain virtual machine is sent to its network control services end by main frame；Network control services termination is received after acl rule, and the acl rule is converted into used in Open vSwitch into Flow rules, and the external network proxy services end of main frame where the Flow rules are sent into the virtual machine；The Flow rules received are converted into OVS orders by external network proxy services end, and perform the OVS orders on local host, by Flow rule insertion Open vSwitch Flow tables.This method solves the acl feature of virtual machine traffic using Open vSwitch, so as to reach the purpose of control virtual-machine data flow.

Description

A method and system for realizing ACL function based on Open vSwitch

technical field

The invention relates to the technical field of computer networks, in particular to a method and system for realizing ACL functions based on Open vSwitch.

Background technique

Since there may be multiple virtualized systems on a virtual machine, the communication between the systems needs to go through the network, but unlike ordinary physical systems interconnected through physical network devices, the network interface of the virtual system is also virtual, so it cannot be directly connected through A currently popular solution for physical network device interconnection is: virtual switching (Virtual Switching, vSwitch for short) technology. The so-called vSwitch means that the virtual network bridge is completely implemented on the server (terminal) hardware, and does not involve the cooperation of external switches.

Like ordinary server equipment, each virtual machine has its own virtual network card (virtual NIC), and each virtual NIC has its own MAC address and IP address. The vSwitch is equivalent to a virtual Layer 2 switch, which connects the virtual network card and the physical network card, and forwards the data packets on the virtual machine through the physical network port. According to needs, vSwitch can also support Layer 2 forwarding, security control, port mirroring and other functions.

However, in the prior art, using a traditional vSwitch to implement the access control list (Access Control list, ACL for short) function needs to consume CPU resources, which affects the performance of the server.

Contents of the invention

Aiming at the defects of the prior art, the method for realizing the ACL function provided by the present invention adopts Open vSwitch to solve the ACL function of the virtual machine flow, thereby achieving the purpose of controlling the data flow of the virtual machine.

In the first aspect, the present invention provides a method for realizing the ACL function based on Open vSwitch, the method comprising:

S1: The first host sends the set ACL rules about a virtual machine to the network control server of the first host;

S2: After receiving the ACL rule, the network control server converts the ACL rule into the Flow rule used by the open virtual switching standard Open vSwitch, and sends the Flow rule to the network of the second host where the virtual machine is located Proxy server;

S3: The network proxy server converts the received Flow rule into an OVS command, and executes the OVS command on the second host, so as to insert the Flow rule into the Flow table of the Open vSwitch.

Preferably, the method further includes after step S3:

When traffic in the virtual machine enters the Open vSwitch, the Open vSwitch will compare it in the Flow table and execute the action defined by the corresponding Flow rule.

Preferably, the method step S2 also includes:

The network control server saves the received ACL rules into the distributed database.

Preferably, the ACL rule is applicable to a network or a virtual network card.

Preferably, the priorities of the ACL rules from high to low are: non-overlapping Network level, virtual network card level, and overridable Network level.

In a second aspect, the present invention provides a system for realizing the ACL function based on Open vSwitch, the system includes a virtual machine, Open vSwitch, a network proxy server and a network control server;

The network control server is used to convert the received ACL rule into the Flow rule used by Open vSwitch, and send the Flow rule to the network proxy server of the host where the virtual machine is located;

The network proxy server is used to convert the received Flow rule into an OVS command, and execute the OVS command on the local host, and insert the Flow rule into the Flow table in the Open vSwitch;

The Open vSwitch is used to compare the traffic entering the virtual machine in the Open vSwitch in its Flow table, and execute the actions defined by the corresponding Flow rules.

Preferably, the function of the network control server further includes: saving the received ACL rules into a distributed database.

Preferably, the virtual machine, the Open vSwitch and the network proxy service are located on the same host, and the network control server is located on another host.

Preferably, the system further includes a physical switch for connecting different hosts through physical network cards.

It can be seen from the above technical solution that the method and system for realizing the ACL function provided by the present invention solves the ACL function of the virtual machine traffic by using OpenvSwitch and the distributed structure, so as to achieve the purpose of controlling the data traffic of the virtual machine. Since the entire system is distributed Compared with different hosts, the performance of the server is significantly improved.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is the flow chart of the method for realizing ACL function based on Open vSwitch that the embodiment of the present invention provides;

FIG. 2 is a schematic structural diagram of a system for realizing ACL functions based on Open vSwitch provided by an embodiment of the present invention;

Fig. 3 is a schematic flow chart of comparing Open vSwitch in a Flow table according to another embodiment of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Open vSwitch is a kind of software, and Open vSwitch is an open virtual switching standard. As shown in Figure 1, Figure 1 shows the flow chart of the method for realizing the ACL function based on Open vSwitch provided by the present invention, and the method includes:

S1: The first host sends the set ACL rules about a virtual machine to the network control server of the first host;

S2: After receiving the ACL rule, the network control server converts the ACL rule into the Flow rule used by the open virtual switching standard Open vSwitch, and sends the Flow rule to the network of the second host where the virtual machine is located Proxy server;

S3: The network proxy server converts the received Flow rule into an OVS command, and executes the OVS command on the second host, so as to insert the Flow rule into the Flow table of the Open vSwitch.

Wherein, the method also includes after step S3:

When traffic in the virtual machine enters the Open vSwitch, the Open vSwitch will compare it in the Flow table and execute the action defined by the corresponding Flow rule.

Therefore, if the newly set ACL rule does not allow traffic on port 8080 of the TCP protocol to pass, then when the virtual machine traffic is TCP protocol and the port is 8080, the DROP action will be executed.

As shown in Figure 3, Figure 3 shows the Flow table in Open vSwitch, including three Flow tables Table0, Table1, and Table2. It can be seen from the figure that when there is traffic entering Open vSwitch, Open vSwitch compares it in the Flow table The process is:

(1) When there is traffic entering Open vSwitch, Table0 judges that the traffic is all from the virtual machine NIC, if so, add VLAN Tag and jump to Table1;

(2) Table1 judges whether the traffic matches the Flow rules in the non-recoverable Network-level Flows, virtual network card-level Flows, and overridable Network-level Flows according to the priority. If it matches one of the Flow rules, execute The action (action) defined by the Flow rule, and if the action to be executed is a permitted (normal) action, jump to Table2;

(3) Table2 judges whether the traffic is the traffic from the network card of the virtual machine, and if so, removes the VLAN Tag.

Step S2 in the above method also includes:

The network control server saves the received ACL rules into the distributed database.

Optionally, the ACL rule is applicable to the Network or virtual network card. Specifically, they are respectively aimed at a certain network and a virtual network card on a certain virtual machine. After the user sets the ACL for the virtual network card of a virtual machine, the Flow is only delivered to the host where the virtual machine is located. When the user sets an ACL for a virtual network, it will first find out all the virtual network cards belonging to the virtual network, and then find out the virtual machines corresponding to the virtual network card on those hosts, and finally send the Flow to these hosts .

Preferably, the priorities of the ACL rules from high to low are: non-overlapping Network level, virtual network card level, and overridable Network level.

As shown in FIG. 2 , FIG. 2 shows a schematic structural diagram of a system for implementing ACL functions based on Open vSwitch provided by the present invention. The system includes a virtual machine, Open vSwitch, a network proxy server and a network control server.

Specifically, the network control server is used to convert the received ACL rule into the Flow rule used by Open vSwitch, and send the Flow rule to the network proxy server of the host where the virtual machine is located; the network proxy service The end is used for converting the received Flow rule into an OVS command, and executing the OVS command on the local host, and inserting the Flow rule into the Flow table in the Open vSwitch; Open vSwitch is used for according to The traffic entering the virtual machine in Open vSwitch is compared in its Flow table, and the action defined by the corresponding Flow rule is executed.

Moreover, the system further includes a physical switch for connecting different hosts through physical network cards.

Wherein, the virtual machine, the Open vSwitch and the network proxy service are located on the same host B, and the network control server is located on another host A.

Preferably, the function of the network control server further includes: saving the received ACL rules into a distributed database.

It can be seen from the above technical solution that the method and system for realizing the ACL function provided by the present invention solves the ACL function of the virtual machine traffic by using OpenvSwitch and the distributed structure, thereby achieving the purpose of controlling the data traffic of the virtual machine. Since the entire system is distributed Compared with different hosts, the performance of the server is significantly improved.

The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand; Modifications are made to the recorded technical solutions, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (9)

1. A method for realizing the access control list ACL function based on Open vSwitch, characterized in that the method comprises: S1: The first host sends the set ACL rules about a virtual machine to the network control server of the first host; S2: After receiving the ACL rule, the network control server converts the ACL rule into the Flow rule used by the open virtual switching standard OpenvSwitch, and sends the Flow rule to the network proxy of the second host where the virtual machine is located Server; S3: The network proxy server converts the received Flow rule into an OVS command, and executes the OVS command on the second host, so as to insert the Flow rule into the Flow table of the Open vSwitch. 2. The method according to claim 1, characterized in that, after the method step S3, also comprising: When traffic in the virtual machine enters the Open vSwitch, the Open vSwitch will compare it in the Flow table and execute the action defined by the corresponding Flow rule. 3. method according to claim 1, is characterized in that, this method step S2 also comprises: The network control server saves the received ACL rules into the distributed database. 4. The method according to claim 1, wherein the ACL rule is applicable to a network or a virtual network card. 5 . The method according to claim 4 , wherein the priorities of the ACL rules from high to low are: non-overridable network level, virtual network card level, and overridable network level. 6. A system based on Open vSwitch that realizes the access control list ACL function, is characterized in that the system includes a virtual machine, Open vSwitch, network proxy server and network control server; The network control server is used to convert the received ACL rule into the Flow rule used by Open vSwitch, and send the Flow rule to the network proxy server of the host where the virtual machine is located; The network proxy server is used to convert the received Flow rule into an OVS command, and execute the OVS command on the local host, so as to insert the Flow rule into the Flow table in the Open vSwitch; The Open vSwitch is used to compare the traffic entering the virtual machine in the Open vSwitch in its Flow table, and execute the actions defined by the corresponding Flow rules. 7. The system according to claim 6, wherein the function of the network control server further comprises: saving the received ACL rules into a distributed database. 8. system according to claim 6, is characterized in that, described virtual machine, described Open vSwitch and described network agent service end are located at same host computer, and described network control service end is located at another host computer. 9. The system according to claim 6, further comprising a physical switch for connecting different hosts through physical network cards.