External data source redirection in segmented virtual machine
Interacting with an external environment of a segmented virtual machine is disclosed. An indication that a communication with an external environment is desired is received. It is determined whether the communication can be initiated directly from a core virtual machine of the segmented virtual machine without initiating the communication from a shell virtual machine of the segmented virtual machine. An attempt to initiate the communication is made based as at least in part on the determination.
1. A method of interacting with an external environment of a segmented virtual machine, comprising:
receiving an indication that a communication with the external environment is desired;
determining, based at least in part on a specified network connection identifier associated with a network connection, whether the communication is allowed to be initiated directly from a core virtual machine of the segmented virtual machine without initiating the communication from a shell virtual machine of the segmented virtual machine, wherein the shell virtual machine and the core virtual machine cooperate to function as a single virtual machine;
wherein the core virtual machine supports internal execution functionality of the segmented virtual machine and a portion of external communication while the shell virtual machine supports another portion of the external communication; and
attempting to initiate the communication based as at least in part on the determination including:
in the event that it is determined, based on the specified network connection identifier wherein the specified network connection identifier is based at least in part on an inclusion list that specifies one or more identifiers of one or more network connections, that the communication is allowed to be initiated directly from the core virtual machine without initiating the network connection from the shell virtual machine, initiating the network connection to the external environment directly through the core virtual machine; and
in the event that it is determined, based on the specified network connection identifier wherein the specified network connection identifier is not listed in the inclusion list, that the communication is not allowed to be initiated directly from the core virtual machine, initiating the network connection through the shell virtual machine.
2. The method as recited in claim 1 , wherein if initiating the network connection to the external environment directly through the core virtual machine is not successful, the network connection is initiated from the shell virtual machine.
3. The method as recited in claim 1 , wherein the indication is received from an application executing in the segmented virtual machine.
4. The method as recited in claim 3 , wherein receiving the indication includes intercepting on the core virtual machine a request by the application for the external environment communication.
5. The method as recited in claim 1 , wherein attempting to initiate the communication includes attempting to open a network communication channel.
6. The method as recited in claim 1 , wherein the inclusion list of one or more identifiers includes at least a portion of one or more of the following: a network address identifier, a network socket identifier, and a network port identifier.
7. The method as recited in claim 1 , wherein the inclusion list of one or more identifiers includes one or more of the following: an Internet Protocol address range, a port number range, and a MAC address range.
8. The method as recited in claim 1 , wherein the inclusion list of one or more identifiers includes at least a portion of one or more of the following: an application identifier, a device identifier, and an I/O identifier.
9. The method as recited in claim 1 , wherein the determination is made at least in part by using an exclusion list that specifies one or more identifiers of a network connection that cannot be initiated directly from the core virtual machine without initiating the network connection from the shell virtual machine.
10. The method as recited in claim 1 , wherein if it determined the communication is allowed to be initiated directly from the core virtual machine, attempting to initiate the communication includes performing a cross-memory communication within a device running the core virtual machine.
11. The method as recited in claim 1 , wherein if it is determined the communication is allowed to be initiated directly from the core virtual machine, attempting to initiate the communication includes opening a core virtual machine network socket and initiating the communication using the core virtual machine network socket.
12. The method as recited in claim 11 , wherein if the attempt to initiate the communication through the core virtual machine is not successful, the core virtual machine network socket is closed, a shell virtual machine network socket is opened, and the communication is initiated using the shell virtual machine network socket.
13. The method as recited in claim 1 , wherein attempting to initiate the communication includes performing one or more of the following: a system call, a networking call, a file input/output call, a remote procedure call, and a native interface call.
14. The method as recited in claim 1 , wherein the core virtual machine cannot initiate the communication because the external environment requires an authentication using the shell virtual machine.
15. The method as recited in claim 14 , wherein the authentication uses a network address associated with the shell virtual machine to authenticate the communication.
16. The method as recited in claim 1 , wherein the external environment includes one or more of the following: a web service, a web server, a messaging engine, a journaling facility, a load distributor, a network storage device, and a database.
17. The method as recited in claim 1 , wherein attempting to initiate the communication includes specifying to an application a network identifier of a successfully initiated communication.
18. The method as recited in claim 1 , wherein the core virtual machine is able to directly accept an incoming external environment communication.
19. The method as recited in claim 18 , wherein the core virtual machine accepts the incoming communication at least in part by listening for the incoming communication on a specified network identifier.
20. The method as recited in claim 1 , wherein the segmented virtual machine appears to the external environment as a virtual machine addressable using a plurality of network addresses.
21. The method as recited in claim 1 , wherein the shell virtual machine and the core virtual machine are physically located on different devices.
22. The method as recited in claim 1 , wherein the shell virtual machine does not execute virtual machine instructions.
23. The method as recited in claim 1 , wherein the shell virtual machine is transparent to the external environment.
24. The method as recited in claim 1 , wherein there exists a plurality of core virtual machines associated with the shell virtual machine.
25. The method as recited in claim 1 , wherein the core virtual machine supports an application invoked from the shell virtual machine.
26. A system for interacting with an external environment of a segmented virtual machine, comprising:
a processor configured to:
receive an indication that a communication with an external environment is desired;
determine, based at least in part on a specified network connection identifier associated with a network connection, whether the communication is allowed to be initiated directly from a core virtual machine of the segmented virtual machine without initiating the communication from a shell virtual machine of the segmented virtual machine, and attempt to initiate the communication based as at least in part on the determination, wherein the shell virtual machine and the core virtual machine cooperate to function as a single virtual machine;
wherein the core virtual machine supports internal execution functionality of the segmented virtual machine and a portion of external communication while the shell virtual machine supports another portion of the external communication; and
attempt to initiate the communication based as at least in part on the determination, including:
in the event that it is determined, based on the specified network connection identifier wherein the specified network connection identifier is based at least in part on an inclusion list that specifies one or more identifiers of one or more network connections, that the communication is allowed to be initiated directly from the core virtual machine without initiating the network connection from the shell virtual machine, initiate the network connection to the external environment directly through the core virtual machine; and
in the event that it is determined, based on the specified network connection identifier wherein the specified network connection identifier is not listed in the inclusion list, that the communication is not allowed to be initiated directly from the core virtual machine, initiate the network connection through the shell virtual machine; and
a communication interface coupled with the processor.
27. A computer program product for interacting with an external environment of a segmented virtual machine, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving an indication that a communication with an external environment is desired;
determining, based at least in part on a specified network connection identifier associated with a network connection, whether the communication is allowed to be initiated directly from a core virtual machine of the segmented virtual machine without initiating the communication from a shell virtual machine of the segmented virtual machine, wherein the shell virtual machine and the core virtual machine cooperate to function as a single virtual machine;
wherein the core virtual machine supports internal execution functionality of the segmented virtual machine and a portion of external communication while the shell virtual machine supports another portion of the external communication; and
attempting to initiate the communication based as at least in part on the determination including:
in the event that it is determined, based on the specified network connection identifier wherein the specified network connection identifier is based at least in part on an inclusion list that specifies one or more identifiers of one or more network connections, that the communication is allowed to be initiated directly from the core virtual machine without initiating the network connection from the shell virtual machine, initiating the network connection to the external environment directly through the core virtual machine; and
in the event that it is determined, based on the specified network connection identifier wherein the specified network connection identifier is not listed in the inclusion list, that the communication is not allowed to be initiated directly from the core virtual machine, initiating the network connection through the shell virtual machine.
28. The system as recited in claim 26 , wherein if initiating the network connection to the external environment directly through the core virtual machine is not successful, the network connection is initiated from the shell virtual machine.
29. The system as recited in claim 26 , wherein the indication is received from an application executing in the segmented virtual machine.
30. The system as recited in claim 29 , wherein the processors is configured to receive the indication, including to intercept on the core virtual machine a request by the application for the external environment communication.
31. The system as recited in claim 26 , wherein the processor is configured to attempt to initiate the communication, including to attempt to open a network communication channel.
32. The system as recited in claim 26 , wherein the inclusion list of one or more identifiers includes at least a portion of one or more of the following: a network address identifier, a network socket identifier, and a network port identifier.
33. The system as recited in claim 26 , wherein the inclusion list of one or more identifiers includes one or more of the following: an Internet Protocol address range, a port number range, and a MAC address range.
34. The system as recited in claim 26 , wherein the inclusion list of one or more identifiers includes at least a portion of one or more of the following: an application identifier, a device identifier, and an I/O identifier.
35. The system as recited in claim 26 , wherein the determination is made at least in part by using an exclusion list that specifies one or more identifiers of a network connection that cannot be initiated directly from the core virtual machine without initiating the network connection from the shell virtual machine.
36. The system as recited in claim 26 , wherein if it determined the communication is allowed to be initiated directly from the core virtual machine, the processor is configured to attempt to initiate the communication, including to perform cross-memory communication within a device running the core virtual machine.
37. The system as recited in claim 26 , wherein if it is determined the communication is allowed to be initiated directly from the core virtual machine, the processor is configured to attempt to initiate the communication, including to open a core virtual machine network socket and initiating the communication using the core virtual machine network socket.
38. The system as recited in claim 37 , wherein if the attempt to initiate the network socket is closed, a shell virtual machine network socket is opened, and the communication is initiated using the shell virtual machine network socket.
39. The system as recited in claim 26 , wherein the processor is configured to attempt to initiate the communication, including to perform one or more of the following: a system call, a networking call, a file input/output call, a remote procedure call, and a native interface call.
40. The system as recited in claim 26 , wherein the core virtual machine cannot initiate the communication because the external environment requires an authentication using the shell virtual machine.
41. The system as recited in claim 40 , wherein the authentication uses a network address associated with the shell virtual machine to authenticate the communication.
42. The system as recited in claim 26 , wherein the external environment includes one or more of the following: a web service, a web server, a messging engine, a journaling facility, a load distributor, a network storage device, and a database.
43. The system as recited in claim 26 , wherein the processor is configured to attempt to initiate the communication, including to specify to an application a network identifier of a successfully initiated communication.
44. The system as recited in claim 26 , wherein the core virtual machine is able to directly accept an incoming external environment communication.
45. The system as recited in claim 44 , wherein the core virtul machine accepts the incoming communication at least in part by listening for the incoming communication on a specified network identifier.
46. The system as recited in claim 26 , wherein the segmented virtual machine appears to the external environment as a virtual machine addressable using a plurality of network addresses.
47. The system as recited in claim 26 , wherein the shell virtual machine and the core virtual machine are physically located on different devices.
48. The system as recited in claim 26 , wherein the shell virtual machine does not execute virtual machine instructions.
49. The system as recited in claim 26 , wherein the shell virtual machine is transparent to the external environment.
50. The system as recited in claim 26 , wherein there exists a plurality of core virtual machines associated with the shell virtual machine.
51. The system as recited in claim 26 , wherein the core virtual machine supports an application invoked from the shell virtual machine.