Hypervisor support for network functions virtualization

1. A method, comprising:

receiving, at a hypervisor executing on a host machine, a packet sent by a source node to a destination node separate from a virtual machine running on the hypervisor, the packet intended to be routed via the virtual machine running on the hypervisor to reach the destination node;

causing a packet processing module of the hypervisor to process the packet for transmission to the destination node in view of a first rule, without providing the packet to the virtual machine for routing; and

responsive to determining that a first status of the processing of the packet by the packet processing module indicates that the packet is ready for transmission to the destination node, transmitting the packet to the destination node.

2. The method of claim 1 , further comprising:

receiving, from the packet processing module, an identifier of a virtual network interface card (NIC);

determining the destination node associated with the identifier of the virtual NIC, wherein the virtual machine includes the virtual NIC and the destination node is connected to the virtual NIC; and

responsive to determining that the first status of the processing of the packet by the packet processing module indicates that the packet is ready for transmission to the destination node, transmitting the packet to the destination node.

3. The method of claim 1 , further comprising:

receiving, from the packet processing module, an identifier of a specific network to use for transmitting the packet;

determining a network interface card (NIC) associated with the identifier of the specific network to use for transmitting the packet; and

responsive to determining that the first status of the processing of the packet by the packet processing module indicates that the packet is ready for transmission to the destination node, transmitting the packet over the specific network to the destination node using the NIC.

4. The method of claim 1 , further comprising receiving, from the packet processing module, at least an identifier of the destination node, wherein the destination node comprises at least one of a second host, a second hypervisor, or a second virtual machine.

5. The method of claim 1 , further comprising:

causing the packet processing module of the hypervisor to process the packet for transmission to the virtual machine, instead of the destination node, in view of a second

causing the virtual machine to change an operation mode to an awake mode; and

responsive to determining that a second status of the processing of the packet by the packet processing module indicates that the packet is ready for transmission to the virtual machine, transmitting the packet to the virtual machine.

6. The method of claim 1 , further comprising:

causing the packet processing module of the hypervisor to determine that the packet is to be dropped in view of a second rule; and

responsive to determining that a second status of the processing of the packet by the packet processing module indicates that the packet is to be dropped, dropping the packet.

7. The method of claim 1 , further comprising, prior to causing the packet processing module of the hypervisor to process the packet for transmission, identifying, based on the virtual machine to which the packet is intended to be routed, the packet processing module in a memory associated with the hypervisor.

8. The method of claim 1 , wherein causing the packet processing module of the hypervisor to process the packet for transmission to the destination node in view of the first rule comprises modifying the packet by performing at least one of adding encapsulation headers to the packet, removing encapsulation headers from the packet, encrypting data in the packet, or decrypting data in the packet.

9. The method of claim 1 , wherein the packet processing module is received by the hypervisor from a guest application of the virtual machine or from a guest operating system of the virtual machine.

10. The method of claim 1 , wherein the packet is transmitted to the destination node while the virtual machine remains in a sleep mode of operation.

11. The method of claim 1 , further comprising validating, by the hypervisor, that the packet processing module is secure.

12. A system comprising:

a memory;

a processing device of a memory operatively coupled to the memory, the processing device to execute a hypervisor to:

receive a packet sent by a source node to a destination node, the packet intended to be routed via a virtual machine running on the hypervisor to reach the destination node;

cause a packet processing module of the hypervisor to process the packet for transmission to the destination node in view of a first rule, without providing the packet to the virtual machine for routing; and

responsive to determining that a first status of the processing of the packet by the packet processing module indicates that the packet is ready for transmission to the destination node, transmit the packet to the destination node.

13. The system of claim 12 , wherein the processing device is further to execute the hypervisor to:

receive, from the packet processing module, an identifier of a virtual network interface card (NIC);

determine the destination node associated with the identifier of the virtual NIC, wherein the virtual machine includes the virtual NIC and the destination node is connected to the virtual NIC; and

responsive to determining that the first status of the processing of the packet by the packet processing module indicates that the packet is ready for transmission to the destination node, transmitting the packet to the destination node.

14. The system of claim 12 , wherein the processing device is further to execute the hypervisor to:

receive, from the packet processing module, an identifier of a specific network to use for transmitting the packet;

determine a network interface card (NIC) associated with the identifier of the specific network to use for transmitting the packet; and

responsive to determining that the first status of the processing of the packet by the packet processing module indicates that the packet is ready for transmission to the destination node, transmit the packet over the specific network to the destination node using the NIC.

15. The system of claim 12 , wherein the processing device is further to execute the hypervisor to receive, from the packet processing module, at least an identifier of the destination node, wherein the destination node comprises an identifier of an identifier of a second host, an identifier of a second hypervisor, or an identifier of a second virtual machine.

16. The system of claim 12 , wherein the processing device is further to execute the hypervisor to:

cause the packet processing module of the hypervisor to process the packet for transmission to the virtual machine, instead of the destination node, in view of a second rule;

cause the virtual machine to change an operation mode to an awake mode; and

responsive to determining that a second status of the processing of the packet by the packet processing module indicates that the packet is ready for transmission to the virtual machine, transmitting the packet to the virtual machine.

17. The system of claim 12 , wherein the processing device is further to execute the hypervisor to:

cause the packet processing module of the hypervisor to determine that the packet is to be dropped in view of a second rule; and

responsive to determining that a second status of the processing of the packet by the packet processing module indicates that the packet is to be dropped, drop the packet.

18. One or more tangible, non-transitory computer-readable media storing instructions that, when executed, cause one or more processing devices to execute a virtual machine to:

create a packet processing module in view of one or more rules that at least cause a received packet to be transmitted to a destination other than the virtual machine;

provide the packet processing module to a hypervisor to process packets, intended to be routed to the destination via the virtual machine, for transmission to respective destinations in view of a first rule of the one or more rules; and

change an operation mode of the virtual machine to a sleep mode that is not to be interrupted by the packets.

19. The computer-readable media of claim 18 , wherein the packet processing module is created via a guest application executing on top of a guest operating system of the virtual machine.

20. The computer-readable media of claim 18 , wherein the packet processing module returns a status that causes transmission of the packets to the respective destinations other than the virtual machine.