Methods and systems to offload overlay network packet encapsulation to hardware
A method for offloading packet encapsulation for an overlay network is provided. The method, at a virtualization software of a host, sends a mapping table of the overlay network to a physical network interface controller (NIC) associated with the host. The mapping table maps the identification of each of a set of virtual machine (VM) of a tenant on the host to an identification of a tunnel on the overlay network. The method, at the virtualization software, receives a packet from a VM of the tenant. The method sends the packet to the physical NIC. The method, at the physical NIC, encapsulates the packet for transmission over the overlay network by using the mapping table. The method of claim also tags the packet by the virtualization software as a packet that requires encapsulation for transmission in the overlay network prior to sending the packet to the physical NIC.
1. A physical network interface controller (PNIC) for a host computer, the PNIC comprising at least one processing unit and a non-transitory machine readable medium storing a program for performing packet decapsulation for an overlay network when executed by the processing unit, the program comprising sets of instructions for:
receiving, from a hypervisor executing on the host computer and through a virtual NIC emulator, a mapping table associating each virtual machine (VM) in a set of two or more VMs executing on the host computer with one tunnel endpoint;
decapsulating an encapsulated packet, to provide a decapsulated packet, received from the overlay network and destined for a particular VM operating on the hypervisor executing on the host computer, by removing an overlay network encapsulation header from the encapsulated packet, the encapsulation header comprising a particular tunnel endpoint address; and
based on a determination that the particular tunnel endpoint address in the overlay network encapsulation header matches a tunnel endpoint address associated in the mapping table with a particular VM address in the decapsulated packet, forwarding the decapsulated packet to the particular VM.
2. The PNIC of claim 1 , wherein at least two VMs operating on the hypervisor are associated with a first tunnel endpoint while another VM operating on the hypervisor is associated with a second tunnel endpoint.
3. The PNIC of claim 1 , wherein
the particular tunnel endpoint address is a destination tunnel endpoint address,
the particular VM address is a destination VM address,
the determination comprises a determination that the destination tunnel endpoint address corresponds in the mapping table to the destination VM address, and
the destination VM address is the address of the particular VM.
4. The PNIC of claim 1 , wherein the received encapsulated packet is a first packet, wherein the overlay network encapsulation header is a first overlay network encapsulation header, wherein the particular tunnel endpoint address is a first tunnel endpoint address, wherein the particular VM address is a first VM address, wherein the program further comprises sets of instructions for:
removing, from an encapsulated second packet received from the overlay network, a second overlay network encapsulation header comprising a second tunnel endpoint address;
based on a determination that the second tunnel endpoint address in the overlay network encapsulation header does not match any tunnel endpoint addresses associated in the mapping table with a second VM address in the second decapsulated packet, dropping the packet.
5. The PNIC of claim 1 , wherein the overlay network encapsulation header further comprises a first checksum value, wherein the program further comprises sets of instructions for:
calculating a second checksum value based on the decapsulated packet;
determining that the first checksum value matches the second checksum value;
removing, from an encapsulated second packet received from the overlay network, a second overlay network encapsulation header comprising a third checksum value;
calculating a fourth checksum value based on the decapsulated second packet;
determining that the third checksum value does not match the fourth checksum value; and
based on the determination, dropping the decapsulated second packet.
6. The PNIC of claim 1 , wherein the program further comprises sets of instructions for:
determining that a destination address associated with the decapsulated packet is a multicast address, wherein the particular VM is a member of a multicast group associated with the multicast address comprising at least one other VM in the set of VMs; and
forwarding the decapsulated packet to the at least one other VM in the multicast group.
7. The PNIC of claim 1 , wherein the mapping table further associates an overlay network identifier with each VM in the set of VMs, wherein the overlay network encapsulation header further comprises a particular overlay network identifier, wherein the program further comprises a set of instructions for determining that the particular overlay network identifier corresponds in the mapping table to the particular VM address.
8. The PNIC of claim 1 , wherein the particular VM is a first VM, wherein the received encapsulated packet is a first packet, wherein the overlay network encapsulation header is a first overlay network encapsulation header, wherein the program further comprises sets of instructions for:
identifying a source VM address and a destination VM address in a non-encapsulated second packet received from a second VM in the set of VMs and destined for the overlay network;
identifying a source tunnel endpoint address that corresponds in the mapping table to the source VM address;
identifying a destination tunnel endpoint address that corresponds in the mapping table to the destination VM address; and
adding to the second packet a second overlay network encapsulation header comprising the identified source and destination tunnel endpoint addresses, for transmitting the encapsulated second packet to the overlay network.
9. The PNIC of claim 8 , wherein the mapping table further associates a gateway address with each VM in the set of VMs, wherein the source VM address is a first source VM address, wherein the destination VM address is a first destination VM address, wherein the source tunnel endpoint address is a first source tunnel endpoint address, wherein the program further comprises sets of instructions for:
identifying a second source VM address and a second destination VM address from a non-encapsulated third packet received from a third VM in the set of VMs and destined for the overlay network;
identifying a second source tunnel endpoint address that corresponds in the mapping table to the source VM address;
based on a determination that the second destination VM address does not correspond in the mapping table to any tunnel endpoint addresses, identifying a particular gateway address that correspond in the mapping table to the third VM;
adding to the third packet a third overlay network encapsulation header comprising the identified second source tunnel endpoint address and the identified particular gateway address, for transmitting the encapsulated third packet to the overlay network.
10. The PNIC of claim 1 , wherein the mapping table is received after the hypervisor determines that a control event has occurred.
11. The PNIC of claim 10 , wherein the control event comprises a tunnel endpoint being created for the host computer.
12. The PNIC of claim 10 , wherein the control event comprises at least one of (i) a VM, operating on the hypervisor executing on the host computer, joining the overlay network, and (ii) a VM, operating on the hypervisor executing on the host computer, leaving the overlay network.
13. The PNIC of claim 10 , wherein the control event comprises a VM, operating on the hypervisor executing on the host computer, migrating to or from the host computer.
14. A method for performing packet decapsulation for an overlay network, the method comprising:
receiving, from a hypervisor executing on the host computer and through a virtual NIC emulator, a mapping table associating at least one tunnel endpoint of the overlay network with virtual machines (VMs) in a set of two or more VMs executing on the host computer;
removing, from an encapsulated packet received from the overlay network and destined for a particular VM operating on the hypervisor executing on the host computer to provide a decapsulated packet, an overlay network encapsulation header comprising a particular tunnel endpoint address; and
based on a determination that the particular tunnel endpoint address in the overlay network encapsulation header matches a tunnel endpoint address associated in the mapping table with a particular VM address in the decapsulated packet, forwarding the decapsulated packet to the particular VM.
15. The method of claim 14 , wherein
the particular tunnel endpoint address is a destination tunnel endpoint address,
the particular VM address is a destination VM address,
the determination comprises a determination that the destination tunnel endpoint address corresponds in the mapping table to the destination VM address, and
the destination VM address is the address of the particular VM.
16. The method of claim 14 , wherein the received encapsulated packet is a first packet, wherein the overlay network encapsulation header is a first overlay network encapsulation header, wherein the particular tunnel endpoint address is a first tunnel endpoint address, wherein the particular VM address is a first VM address, wherein the method further comprises:
removing, from an encapsulated second packet received from the overlay network, a second overlay network encapsulation header comprising a second tunnel endpoint address;
based on a determination that the second tunnel endpoint address in the overlay network encapsulation header does not match any tunnel endpoint addresses associated in the mapping table with a second VM address in the second decapsulated packet, dropping the packet.
17. The method of claim 14 , wherein the overlay network encapsulation header further comprises a first checksum value, wherein the method further comprises:
calculating a second checksum value based on the decapsulated packet;
determining that the first checksum value matches the second checksum value;
removing, from an encapsulated second packet received from the overlay network, a second overlay network encapsulation header comprising a third checksum value;
calculating a fourth checksum value based on the decapsulated second packet;
determining that the third checksum value does not match the fourth checksum value; and
based on the determination, dropping the decapsulated second packet.
18. The method of claim 14 , wherein the method further comprises:
determining that a destination address associated with the decapsulated packet is a multicast address, wherein the particular VM is a member of a multicast group associated with the multicast address comprising at least one other VM in the set of VMs; and
forwarding the decapsulated packet to the at least one other VM in the multicast group.
19. The method of claim 14 , wherein the mapping table further associates an overlay network identifier with each VM in the set of VMs, wherein the overlay network encapsulation header further comprises a particular overlay network identifier, wherein the method further comprises:
determining that the particular overlay network identifier corresponds in the mapping table to the particular VM address.
20. The method of claim 14 , wherein the particular VM is a first VM, wherein the received encapsulated packet is a first packet, wherein the overlay network encapsulation header is a first overlay network encapsulation header, wherein the method further comprises:
identifying a source VM address and a destination VM address in a non-encapsulated second packet received from a second VM in the set of VMs and destined for the overlay network;
identifying a source tunnel endpoint address that corresponds in the mapping table to the source VM address;
identifying a destination tunnel endpoint address that corresponds in the mapping table to the destination VM address; and
adding to the second packet a second overlay network encapsulation header comprising the identified source and destination tunnel endpoint addresses, for transmitting the encapsulated second packet to the overlay network.
21. The method of claim 20 , wherein the mapping table further associates a gateway address with each VM in the set of VMs, wherein the source VM address is a first source VM address, wherein the destination VM address is a first destination VM address, wherein the source tunnel endpoint address is a first source tunnel endpoint address, wherein the method further comprises:
identifying a second source VM address and a second destination VM address from a non-encapsulated third packet received from a third VM in the set of VMs and destined for the overlay network;
identifying a second source tunnel endpoint address that corresponds in the mapping table to the source VM address;
based on a determination that the second destination VM address does not correspond in the mapping table to any tunnel endpoint addresses, identifying a particular gateway address that correspond in the mapping table to the third VM;
adding to the third packet a third overlay network encapsulation header comprising the identified second source tunnel endpoint address and the identified particular gateway address, for transmitting the encapsulated third packet to the overlay network.