A method and device for penetrating NAT to establish a TCP connection supporting MD5 verification

Abstract

The present invention discloses a method and device for penetrating a NAT to establish a TCP connection supporting MD5 verification. The method comprises: creating a NetNS on a controller and adding a VETH virtual network port; then configuring the IP address of a device connected to the NAT firewall on the VETH virtual network port; enabling the IPv4 network forwarding function on the controller's Linux operating system network port and configuring an iptables policy to convert the source IP address of messages from the VETH virtual network port to the actual IP address of the controller; and running the controller's application within the NetNS, using the IP address of the network device connected to the NAT firewall as the source IP address to establish a TCP connection with the device. The method and device provide an MD5 verification option for TCP connections penetrating the NAT firewall, thereby enhancing network connection security. The method and device do not require modification of the application, thus providing technical support for rapid application deployment.

Description

Technical Field

[0001] The present invention relates to the technical field of penetrating a NAT firewall to connect network equipment, in particular to a method and device for penetrating a NAT to establish a TCP connection supporting MD5 verification. Background Art

[0002] Routing control protocols such as BGP do not have an authentication and verification mechanism. To enhance security, the MD5 (message digest algorithm) verification option function for TCP connections is configured to implement connection protection.

[0003] RFC2385 specifies in detail the calculation method of the MD5 checksum option for TCP connections, which is described as follows:

[0004] Every segment sent on a TCP connection to be protected againstspoofing will contain the 16-byte MD5 digest produced by applying the MD5algorithm to these items in the following order:

[0005] 1.the TCP pseudo-header(in the order:source IP address,destination IPaddress,zero-padded protocol number,and segment length)

[0006] 2.the TCP header, excluding options, and assuming a checksum of zero

[0007] 3.the TCP segment data(if any)

[0008] 4.an independently-specified key or password, known to both TCPs and presumably connection-specific

[0009] According to RFC2385, the source IP address and destination IP address in the interactive messages between the two ends are used as parameters for MD5 verification.

[0010] In actual environments, to enhance device security, the controller is deployed in a non-trusted domain and connected to the device through a NAT firewall.

[0011] The current problem is that after passing through the NAT (Network Address Translation) firewall, the source IP address of the message received by the device is changed to the IP address of the network device connected to the NAT firewall, resulting in the inability to use the MD5 verification option function of the TCP connection, which leads to the failure of TCP connection establishment. Summary of the Invention

[0012] In order to solve the above problems in the prior art, the present invention provides a method and device for penetrating a NAT firewall and establishing a TCP connection based on an MD5 check option by using the Linux kernel Netfilter mechanism.

[0013] To achieve the above object, the present invention adopts the following technical solutions:

[0014] In one embodiment of the present invention, a method for penetrating NAT to establish a TCP connection supporting MD5 verification is proposed, the method comprising:

[0015] Create a netns on the controller that uses the MD5 checksum option for TCP connections and add a veth virtual network port. Then configure the IP address of the network device connected to the nat firewall on the veth virtual network port.

[0016] Enable the IPv4 network forwarding function on the controller's Linux operating system network port and configure the iptables policy to convert the source IP address of the message from the veth virtual network port to the actual IP address of the controller;

[0017] The controller's application runs in the netns, uses the ip address of the nat firewall connected to the network device as the source ip address, and establishes a tcp connection with the network device.

[0018] Furthermore, a veth virtual network port pair is created on the controller. One veth virtual network port is in the created netns. The IP address of the nat firewall connected to the network device is configured on the veth virtual network port. The other veth virtual network port is in the default netns of the Linux operating system.

[0019] Furthermore, a gateway IP address is configured on the Veth virtual network port in the default NetNS of the Linux operating system. The gateway IP address is in the same network segment as the IP address of the network device connected to the NAT firewall.

[0020] Furthermore, if the IP address of the network device to which the NAT firewall is connected is not in the same network segment as the IP address of the network device, routing needs to be configured.

[0021] In one embodiment of the present invention, a device for penetrating NAT to establish a TCP connection supporting MD5 verification is also proposed, the device comprising:

[0022] The virtual network port configuration module is used to create a netns on the controller that uses the MD5 checksum option function of the TCP connection and add a veth virtual network port, and then configure the NAT firewall to connect to the IP address of the network device on the veth virtual network port;

[0023] The iptables policy configuration module is used to enable the IPv4 network forwarding function on the controller's Linux operating system network port and configure the iptables policy to convert the source IP address of the message from the veth virtual network port to the actual IP address of the controller;

[0024] Establish a TCP connection module for the controller application to run in the netns, using the ip address of the nat firewall connected to the network device as the source ip address to establish a tcp connection with the network device.

[0025] Furthermore, a veth virtual network port pair is created on the controller. One veth virtual network port is in the created netns. The IP address of the nat firewall connected to the network device is configured on the veth virtual network port. The other veth virtual network port is in the default netns of the Linux operating system.

[0026] Furthermore, a gateway IP address is configured on the Veth virtual network port in the default NetNS of the Linux operating system. The gateway IP address is in the same network segment as the IP address of the network device connected to the NAT firewall.

[0027] Furthermore, if the IP address of the network device to which the NAT firewall is connected is not in the same network segment as the IP address of the network device, routing needs to be configured.

[0028] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for penetrating NAT to establish a TCP connection supporting MD5 verification is implemented.

[0029] In one embodiment of the present invention, a computer-readable storage medium is further provided. The computer-readable storage medium stores a computer program for executing a method for establishing a TCP connection supporting MD5 verification through NAT.

[0030] Beneficial effects:

[0031] 1. The present invention provides an MD5 check option function for TCP connections that penetrate a NAT firewall, thereby enhancing network connection security.

[0032] 2. The present invention does not require modification of the application program and provides technical support means for rapid deployment of applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a networking diagram of the present invention taking the BGP controller as an example;

[0034] Figure 2 This is a flow chart of a method for establishing a TCP connection supporting MD5 verification by penetrating NAT, taking a BGP controller as an example;

[0035] Figure 3 This is a schematic diagram of the structure of a device for penetrating NAT to establish a TCP connection supporting MD5 verification, taking a BGP controller as an example;

[0036] Figure 4 It is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided solely to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0038] Those skilled in the art will appreciate that embodiments of the present invention may be implemented as an apparatus, device, apparatus, method, or computer program product. Therefore, the present disclosure may be implemented in the following forms: entirely in hardware, entirely in software (including firmware, resident software, microcode, etc.), or in a combination of hardware and software.

[0039] According to an embodiment of the present invention, a method and device for establishing a TCP connection that supports MD5 verification through a NAT are proposed, which provides an MD5 verification option function for TCP connections that penetrate a NAT firewall, thereby enhancing the security of network connections; and provides technical support means for rapid deployment of applications without modifying the application program.

[0040] The principles and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0041] The present invention proposes a method for penetrating NAT to establish a TCP connection that supports MD5 verification. Figure 1 As shown, the method includes:

[0042] Create a netns on the BGP controller (this is not limited to the BGP controller, the BGP controller is just an application scenario of the MD5 checksum option function of the TCP connection);

[0043] Create a veth virtual network port pair on the BGP controller. One veth virtual network port is in the created netns. Configure the NAT firewall on the veth virtual network port, that is, the IP address of the NAT gateway connected to the network device in the figure (if the IP address of the NAT firewall connected to the network device is not in the same network segment as the IP address of the network device, you need to configure routing). The other veth virtual network port is in the default netns of the Linux operating system. Configure a gateway IP address on the veth virtual network port. The gateway IP address is in the same network segment as the IP address of the NAT firewall connected to the network device;

[0044] Enable the IPv4 network forwarding function on the Linux operating system network port of the BGP controller, and configure the iptables policy to perform NAT conversion on the packets from the veth virtual network port, and convert its source IP address to the actual IP address of the controller; wherein, NAT conversion is performed on the entire network protocol stack, and source IP address conversion is to modify its source IP address based on the IP / port quadruple of the packet. Figure 1 The container host virtual machine network protocol stack takes effect (for details, see the POSTROUTING chain of the kernel netfilter), and changes the source IP address of the message sent from the container from 10.0.0.204 to 192.168.118.204;

[0045] The BGP controller application (a program that uses the MD5 verification option function of the TCP connection) runs in the netns. When establishing a TCP connection, it uses the IP address of the network device connected to the NAT firewall as the source IP address to establish a TCP connection with the network device. The verification conditions on the network device side are consistent, and the TCP connection establishment is completed.

[0046] It should be noted that although the operations of the method of the present invention are described in a specific order in the above embodiments and drawings, this does not require or imply that these operations must be performed in this specific order, or that all illustrated operations must be performed to achieve the desired results. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0047] In order to explain more clearly the method of establishing a TCP connection supporting MD5 verification through NAT, a specific embodiment is described below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0048] Implementation example Figure 2 As shown:

[0049] The first step is to create a netns (network namespace) on the controller;

[0050] Reference command:

[0051] ip netns add bgp-md5

[0052] Step 2: Create a veth virtual network port pair on the controller (one veth virtual network port is in the created netns, and the other veth virtual network port is in the default netns of the Linux operating system);

[0053] Reference command:

[0054] ip link add veth-gw type veth peer name veth-md5

[0055] ip link set veth-gw up

[0056] The third step is to configure the NAT firewall on the veth virtual network port in the created netns, that is, the IP address of the NAT gateway connected to the network device in the figure (if the IP address of the NAT firewall connected to the network device is not in the same network segment as the IP address of the network device, routing needs to be configured);

[0057] Reference command:

[0058] ip netns exec bgp-md5 ip addr add 10.0.0.204 / 24dev veth-md5

[0059] Step 4. Configure a fake gateway IP address on the Veth virtual network port in the default NetNS of the Linux operating system (the NAT gateway device side IP address 10.0.0.204 / 24 (the IP address of the NAT firewall connected to the network device) configured on the Veth virtual network port in the created NetNS. To complete the three-layer forwarding, a gateway IP address in the same network segment needs to be configured. Since this network port has no routing forwarding function, it is described as a fake gateway IP address).

[0060] Reference command:

[0061] ip addr add 10.0.0.254 / 24dev veth-gw

[0062] Step 5: Enable the IPv4 network forwarding function on the controller operating system network port;

[0063] Reference command:

[0064] sysctl-w net.ipv4.ip_forward=1

[0065] sysctl -p

[0066] Step 6: Configure the iptables policy on the controller operating system network port to convert the source IP address of the message from the veth virtual network port to the actual IP address of the controller;

[0067] Reference command:

[0068] iptables-t nat-I POSTROUTING-s 10.0.0.204-d 10.0.0.0 / 24-o eth0-jSNAT--to 192.168.118.20

[0069] iptables-I FORWARD-m state--state ESTABLISHED,RELATED-j ACCEPT

[0070] Based on the same inventive concept, the present invention also provides a device for establishing a TCP connection that supports MD5 verification through NAT. The implementation of this device can refer to the implementation of the above-mentioned method, and the repeated parts will not be repeated here. The term "module" used below can refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0071] Figure 3 This is a schematic diagram of the structure of a device for establishing a TCP connection supporting MD5 verification through NAT according to an embodiment of the present invention. Figure 3 As shown, the device includes:

[0072] The virtual network port configuration module 101 is used to create a netns on a controller that uses the tcp connection md5 check option function and add a veth virtual network port, and then configure the ip address of the nat firewall connected to the network device on the veth virtual network port; the details are as follows:

[0073] Create a veth virtual network port pair on the controller. One veth virtual network port is in the created netns. Configure the IP address of the network device connected to the NAT firewall on this veth virtual network port. If the IP address of the network device connected to the NAT firewall is not in the same network segment as the IP address of the network device, you need to configure routing. The other veth virtual network port is in the default netns of the Linux operating system. Configure a gateway IP address on this veth virtual network port. The gateway IP address and the IP address of the network device connected to the NAT firewall are in the same network segment.

[0074] The iptables policy configuration module 102 is used to enable the IPv4 network forwarding function on the Linux operating system network port of the controller and configure the iptables policy to convert the source IP address of the message from the veth virtual network port to the actual IP address of the controller;

[0075] The TCP connection establishment module 103 is used for the application of the controller to run in the netns, use the IP address of the NAT firewall connected to the network device as the source IP address, and establish a TCP connection with the network device.

[0076] It should be noted that although the above detailed description mentions several modules of the apparatus for establishing a TCP connection supporting MD5 verification through NAT, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more modules described above can be embodied in a single module. Conversely, the features and functions of a single module described above can be further divided and embodied by multiple modules.

[0077] Based on the above invention concept, Figure 4 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220 and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the method for penetrating NAT to establish a TCP connection supporting MD5 verification is implemented.

[0078] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium storing a computer program for executing the aforementioned method for penetrating NAT to establish a TCP connection supporting MD5 verification.

[0079] The method and device proposed by the present invention for penetrating NAT to establish a TCP connection supporting MD5 verification provide an MD5 verification option function for the TCP connection penetrating the NAT firewall, thereby enhancing the security of the network connection; and provide technical support means for rapid deployment of applications without modifying the application program.

[0080] The professional terms involved above are explained as follows:

[0081] Iptables:

[0082] IPTABLES is an IP packet filtering system integrated with the latest 3.5 version of the Linux kernel.

[0083] Firewalls follow a set of rules when making packet filtering decisions. These rules are stored in dedicated packet filter tables integrated into the Linux kernel. Within the packet filter tables, rules are grouped into chains. The netfilter / iptables IP packet filtering system is a powerful tool for adding, editing, and removing rules.

[0084] Although the netfilter / iptables IP packet filtering system is referred to as a single entity, it actually consists of two components, netfilter and iptables.

[0085] The netfilter component, also known as kernel space, is part of the kernel and consists of a number of packet filtering tables that contain the rule sets used by the kernel to control packet filtering processing.

[0086] The iptables component is a tool, also known as userspace, that makes it easy to insert, modify, and remove rules from packet filtering tables.

[0087] Although the spirit and principles of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the specific embodiments disclosed, and the division into various aspects does not mean that the features of these aspects cannot be combined to benefit. Such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

[0088] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for penetrating NAT to establish a TCP connection that supports MD5 verification, characterized in that: The method includes: Create a netns on the controller that uses the MD5 checksum option for TCP connections and add a veth virtual network port. Then configure the IP address of the network device connected to the nat firewall on the veth virtual network port. Enable the IPv4 network forwarding function on the controller's Linux operating system network port and configure the iptables policy to convert the source IP address of the message from the veth virtual network port to the actual IP address of the controller; The controller's application runs in the netns, uses the ip address of the nat firewall connected to the network device as the source ip address, and establishes a tcp connection with the network device.

2. The method for establishing a TCP connection supporting MD5 verification through NAT according to claim 1, characterized in that: Create a veth virtual network port pair on the controller. One veth virtual network port is in the created netns. Configure the IP address of the NAT firewall connected to the network device on the veth virtual network port. The other veth virtual network port is in the default netns of the Linux operating system.

3. The method for establishing a TCP connection supporting MD5 verification through NAT according to claim 2, characterized in that: Configure a gateway IP address on the Veth virtual network port in the default NetNS of the Linux operating system. The gateway IP address is in the same network segment as the IP address of the network device connected to the NAT firewall.

4. The method for establishing a TCP connection supporting MD5 verification through NAT according to claim 1, characterized in that: If the IP address of the network device connected to the NAT firewall is not in the same network segment as the IP address of the network device, you need to configure routing.

5. A device for penetrating NAT to establish a TCP connection supporting MD5 verification, characterized in that: The device includes: The virtual network port configuration module is used to create a netns on the controller that uses the MD5 checksum option function of the TCP connection and add a veth virtual network port, and then configure the NAT firewall to connect to the IP address of the network device on the veth virtual network port; The iptables policy configuration module is used to enable the IPv4 network forwarding function on the controller's Linux operating system network port and configure the iptables policy to convert the source IP address of the message from the veth virtual network port to the actual IP address of the controller; Establish a TCP connection module for the controller application to run in the netns, using the ip address of the nat firewall connected to the network device as the source ip address to establish a tcp connection with the network device.

6. The device for establishing a TCP connection supporting MD5 verification through NAT according to claim 5, characterized in that: Create a veth virtual network port pair on the controller. One veth virtual network port is in the created netns. Configure the IP address of the NAT firewall connected to the network device on the veth virtual network port. The other veth virtual network port is in the default netns of the Linux operating system.

7. The device for establishing a TCP connection supporting MD5 verification through NAT according to claim 6, characterized in that: Configure a gateway IP address on the Veth virtual network port in the default NetNS of the Linux operating system. The gateway IP address is in the same network segment as the IP address of the network device connected to the NAT firewall.

8. The device for establishing a TCP connection supporting MD5 verification through NAT according to claim 5, characterized in that: If the IP address of the network device connected to the NAT firewall is not in the same network segment as the IP address of the network device, you need to configure routing.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 4.

Images