Reduction in secure protocol overhead when transferring packets between hosts

1. A method of reducing overhead for packet communications between guest elements executing on different hosts, the method comprising:

in a first virtual network interface of a first guest element executing on a first host:

receiving one or more first packets from the first guest element directed to a second guest element executing on a second host;

in response to determining that the first packets will be encapsulated in a secure protocol having a first integrity check procedure provided for by the secure protocol after passing from the first virtual network interface, refraining to perform a transmit-side portion of a second integrity check procedure on the first packets as provided for by a transport protocol; and

passing the first packets to the first host of the first virtual network interface in the transport protocol.

2. The method of claim 1 , further comprising:

in the first host, encapsulating the first packets in the secure protocol and performing a transmit-side portion of the first integrity check procedure.

3. The method of claim 1 , further comprising:

in a second virtual network interface of the second guest element:

receiving the first packets from a second host of the second virtual network interface;

in response to determining that the first packets were encapsulated in the secure protocol, refraining to perform a receiver-side portion of the second integrity check procedure; and

passing the first packets to the second guest element.

4. The method of claim 3 , further comprising:

in the second host, un-encapsulating the first packets and performing the receiver-side portion of the first integrity check procedure; and

passing the first packets to the second virtual network interface when the receiver-side portion of the first integrity check procedure verifies the first packets.

5. The method of claim 3 , wherein refraining to perform a receiver-side portion of the second integrity check procedure comprises:

inserting a non-zero placeholder value into a checksum field of the first packets in the transport protocol; and

indicating to the second guest element that the receiver-side portion of the second integrity check procedure verified the first packets.

6. The method of claim 5 , wherein the second guest element receives the first packets from the second virtual network interface and handles the first packets as packets that were verified by the receiver-side portion of the second integrity check procedure.

7. The method of claim 5 , wherein the second integrity check procedure comprises a Cyclic Redundancy Check (CRC) procedure and the checksum field comprises a field designated for a CRC.

8. The method of claim 1 , further comprising:

in the first virtual network interface:

receiving one or more second packets from the first guest element;

in response to determining that the second packets will not be encapsulated in the secure protocol, performing the transmit-side portion of the second integrity check procedure on the second packets; and

passing the second packets to the first host in the transport protocol.

9. The method of claim 1 , wherein the secure protocol comprises one protocol of a group including Secure Sockets Layer (SSL) and Internet Protocol Security (IPSec).

10. The method of claim 1 , wherein the transport protocol comprises one protocol of a group including Transmission Control Protocol (TCP) and User Datagram Protocol.

11. A system for reducing overhead for packet communications between guest elements executing on different hosts, the system comprising:

one or more computer readable storage media;

a processing system, comprising processing circuitry, coupled with the one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:

provide a first virtual network interface of a first guest element;

provide a first host of the first guest element and the first virtual network interface;

in the first virtual network interface:

receive one or more first packets from the first guest element directed to a second guest element executing on a second host;

in response to determining that the first packets will be encapsulated in a secure protocol having a first integrity check procedure provided for by the secure protocol after passing from the first virtual network interface, refrain to perform a transmit-side portion of a second integrity check procedure on the first packets as provided for by a transport protocol; and

pass the first packets to the first host in the transport protocol.

12. The system of claim 11 , wherein the program instructions further direct the processing system to:

in the first host, encapsulate the first packets in the secure protocol and perform a transmit-side portion of the first integrity check procedure.

13. The system of claim 11 , wherein the program instructions further direct the processing system to:

in the first virtual network interface:

receive one or more second packets from the first guest element;

in response to determining that the second packets will not be encapsulated in the secure protocol, perform the transmit-side portion of the second integrity check procedure on the second packets; and

pass the second packets to the first host in the transport protocol.

14. The system of claim 11 , wherein the secure protocol comprises one protocol of a group including Secure Sockets Layer (SSL) and Internet Protocol Security (IPSec).

15. The system of claim 11 , wherein the transport protocol comprises one protocol of a group including Transmission Control Protocol (TCP) and User Datagram Protocol.

16. A system for reducing overhead for packet communications between guest elements executing on different hosts, the system comprising:

one or more computer readable storage media;

a processing system, comprising processing circuitry, coupled with the one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:

provide a second virtual network interface of a second guest element;

provide a second host of the second guest element and the second virtual network interface;

in the second virtual network interface:

receive one or more first packets from the second host, wherein the first packets were directed from a first guest element executing on a first host to the second guest element;

in response to determining that the first packets were encapsulated in a secure protocol having a first integrity check procedure provided for by the secure protocol before being received from the second host, refrain to perform a receiver-side portion of a second integrity check procedure on the first packets as provided for by a transport protocol; and

passing the first packets to the second guest element.

17. The system of claim 16 , wherein the program instructions further direct the processing system to:

in the second host, un-encapsulate the first packets and perform a receiver-side portion of a first integrity check procedure provided for by the secure protocol; and

pass the first packets to the second virtual network interface when the receiver-side portion of the first integrity check procedure verifies the first packets.

18. The system of claim 16 , wherein to refrain to perform a receiver-side portion of the second integrity check procedure, the program instructions direct the processing system to:

insert a non-zero placeholder value into a checksum field of the first packets in the transport protocol; and

indicate to the second guest element that the receiver-side portion of the second integrity check procedure verified the first packets.

19. The system of claim 18 , wherein the second guest element receives the first packets from the second virtual network interface and handles the first packets as packets that were verified by the receiver-side portion of the second integrity check procedure.

20. The system of claim 18 , wherein the second integrity check procedure comprises a Cyclic Redundancy Check (CRC) procedure and the checksum field comprises a field designated for a CRC.