Method and system for virtual routing using containers

• US 7,738,457 B2
• Filed: 12/20/2006
• Issued: 06/15/2010
• Est. Priority Date: 12/20/2006
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: Nordmark, Erik, Droux, Nicolas G., Tripathi, Sunay
• Primary Examiner(s): Hsu; Alpus H
• Assistant Examiner(s): HASSAN, SAAD K
• Application Number:
  US11/642,756
• Publication Number:
  US 20080151893A1
• Time in Patent Office: 1,273 Days
• Field of Search: 370/389, 370/392, 370/424, 370/401, 370/409, 370/463
• US Class Current: 370/392
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 49/30 Peripheral units, e.g. input or output ports
• CPC Class Codes: H04L 49/70 Virtual switches

Abstract

In general, the invention relates to a method for routing a packet. The method includes receiving the packet in a network interface card (NIC), classifying the packet, placing the packet in a receive ring of the NIC, sending the packet to a virtual NIC associated with the receive ring, sending the packet to a first container associated with the virtual NIC, and routing the packet to a packet destination using the first container.

Claims

1. A method for routing a packet, comprising:

receiving the packet in a network interface card (NIC) from a first network;

classifying the packet on the NIC to identify a receive ring located on the NIC to forward the packet;

placing the packet in the receive ring;

sending the packet to a first virtual NIC of a plurality of virtual NICs based on the first virtual NIC corresponding to the receive ring, wherein the plurality of virtual NICs execute on a host connected to the NIC, wherein each of the plurality of virtual NICs is connected to one of a plurality of containers, wherein each of the plurality of containers corresponds to an isolated execution environment, wherein processes within one of plurality of containers are isolated from processes in the other plurality of containers, and wherein the plurality of containers execute a same shared single instance of an operating system;

sending the packet to a first container of the plurality of containers based on the first container corresponding to the first virtual NIC via a first virtual network stack; and

routing the packet, by a routing module in the first virtual container, to a packet destination,

wherein routing the packet comprises;

identifying a next hop for the packet based on the packet destination;

forwarding the packet to the next hop on a second network, wherein the packet is forwarded via the first virtual network stack.

2. The method of claim 1, wherein the receive ring is a default receive ring of the NIC.

3. The method of claim 1, wherein the second network is an internal virtual network on the host, wherein the first container is operatively connected to a second container of the plurality of containers using a virtual switch, wherein the second container is connected to the internal virtual network, and wherein the next hop is the second container.

4. The method of claim 1,

wherein the routing module in the first container comprises a routing protocol, a routing table, a security protocol, an address resolution utility, and an address translation utility,

wherein the routing table match packet destinations to network paths,

wherein the routing protocol is configured to determine, based on an algorithm, a next hop for each network path stores in the routing table,

wherein the security protocol is configured to authenticate and encrypt packets,

wherein the address resolution utility is configured to identify a hardware address from a network address, and

wherein the address translation utility is configured to modify a network address of the packet, wherein the network address is at least one selected from a group consisting of a source address of a source of the packet and a destination address of the packet destination.

5. The method of claim 1, wherein a routing module in a second virtual container of the plurality of containers is configured to route packets between the second network and a third network.

6. The method of claim 1, wherein the first container is connected via the first virtual network stack to the first virtual NIC and a second virtual NIC, and wherein the first virtual NIC is connected to the first network and the second virtual NIC is connected to the second network.

7. The method of claim 1, wherein the receive ring is implemented as a ring buffer.

8. The method of claim 1, wherein the NIC comprises a plurality of receive rings for a plurality of virtual NICs executing on the host, wherein each virtual NIC has a corresponding receive ring of the plurality of receive rings on the NIC.

9. The method of claim 1, wherein the first virtual network stack implements transmission control protocol and internet protocol processing.

10. A system for routing a packet, comprising:

a network interface card (NIC) comprising a receive ring, and wherein the NIC is configured to;

receive the packet from a first network;

classify the packet to identify the receive ring to forward the packet;

place the packet in the receive ring;

send the packet to a virtual NIC of a plurality of virtual NICS based on the virtual NIC corresponding to the receive ring; and

a host operatively connected to the NIC, the host comprising the plurality of virtual NICs and a plurality of containers,

wherein each of the plurality of virtual NICs is connected to one of a plurality of containers,

wherein each of the plurality of containers corresponds to an isolated execution environment,

wherein processes within one of plurality of containers are isolated from processes in the other plurality of containers,

wherein the plurality of containers execute a same shared single instance of an operating system, and

wherein a first container of the plurality of containers comprises a routing module, and

wherein the host is configured to;

receive, by the virtual NIC, the packet from the NIC;

send the packet to the first container corresponding to the virtual NIC via a virtual network stack; and

route the packet, by the routing module in the first virtual container, to a packet destination, wherein routing the packet comprises;

identifying a next hop for the packet based on the packet destination;

forwarding the packet to the next hop on a second network, wherein the packet is forwarded via the first virtual network stack.

11. The system of claim 10, wherein the second network is an internal virtual network on the host, wherein the host further comprises:

a virtual switch connecting the first container to a second container of the plurality of containers, wherein the second container is connected to the internal virtual network, and wherein the next hop is the second container.

12. The system of claim 11, wherein the receive ring is a default receive ring of the NIC.

13. The system of claim 11, wherein the routing module comprises a routing protocol, a routing table, a security protocol, an address resolution utility, and an address translation utility,

wherein the routing table match packet destinations to network paths,

wherein the routing protocol is configured to determine, based on an algorithm, a next hop for each network path stored in the routing table,

wherein the security protocol is configured to authenticate and encrypt packets,

wherein the address resolution utility is configured to identify a hardware address from a network address, and

wherein the address translation utility is configured to modify a network address of the packet, wherein the network address is at least one selected from a group consisting of a source address of a source of the packet and a destination address of the packet destination.

14. A computer readable medium having computer executable program code embodied therein for causing a computer system to execute a method, the method comprising:

receiving, by a virtual network interface card (NIC) of a plurality of virtual NICs executing on the computer system, a packet from a receive ring located on a NIC,

wherein each of the plurality of virtual NICs is connected to one of a plurality of containers,

wherein each of the plurality of containers corresponds to an isolated execution environment,

wherein processes within one of plurality of containers are isolated from processes in the other plurality of containers, and

wherein the plurality of containers execute a same shared single instance of an operating system;

sending the packet to a first container of the plurality of containers based on the first container corresponding to the virtual NIC; and

routing the packet, by a routing module in the first virtual container, to the packet destination, wherein routing the packet comprises;

identifying a next hop for the packet based on the packet destination;

forwarding the packet to the next hop on a second network, wherein the packet is forwarded via the first virtual network stack.

15. The computer readable medium of claim 14, wherein the receive ring is a default receive ring of the NIC.

16. The computer readable medium of claim 14, wherein the second network is an internal virtual network on the host, wherein the first container is operatively connected to a second container of the plurality of containers using a virtual switch, wherein the second container is connected to the internal virtual network, and wherein the next hop is the second container.

17. The computer readable medium of claim 14, wherein the routing module comprises at least one selected from a group consisting of, a routing protocol, a routing table, a security protocol, an address resolution utility, and an address translation utility,

wherein the routing table match packet destinations to network paths,

wherein the routing protocol is configured to determine, based on an algorithm, a next hop for each network path stored in the routing table,

wherein the security protocol is configured to authenticate and encrypt packets,

wherein the address resolution utility is configured to identify a hardware address from a network address, and

wherein the address translation utility is configured to modify a network address of the packet, wherein the network address is at least one selected from a group consisting of a source address of a source of the packet and a destination address of the packet destination.