Method and system for implementing openstack nat session log

Abstract

The application provides a method and system for realizing an OPENSTACK NAT session log, relates to the technical field of communication, and is applied to an OPENSTACK NAT session log system. The OPENSTACK NAT session log system comprises a kernel part and a user state program. The kernel part is connected with the user state program. The method comprises the following steps: the kernel part converts a NAT address and generates a NAT session log; the kernel part sends the NAT session log to the user state program; and the user state program stores the NAT session log into a corresponding database. The method makes OPENSTACK capable of recording a NAT session log while realizing a NAT function, and facilitates IP tracing, positioning and checking of network security events.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a method, system and electronic device for realizing an OPENSTACK NAT session log. BACKGROUND

[0002] At present, many cloud host / cloud computer network products on the market have network bases based on OPENSTACK or based on OPENSTACK for secondary transformation, and multiple cloud computers of the same (VIRTUAL PRIVATE CLOUD, VPC) generally convert an internal network address into the same public network IP for going online through (NETWORK ADDRESS TRANSLATION, NAT) function (different VPCs have different public network IPs), however, the original OPENSTACK NAT gateway does not have a NAT session log function, and if a network security event occurs, it is inconvenient to trace IP and locate and investigate problems. SUMMARY

[0003] The embodiments of the present application provide a method, system and electronic device for realizing an OPENSTACK NAT session log, so that the OPENSTACK can record the NAT session log while realizing the NAT function, and facilitate IP tracing, locating and investigating network security events.

[0004] To achieve the above-mentioned purpose, the present application adopts the following technical scheme:

[0005] In a first aspect, a method for realizing an OPENSTACK NAT session log is provided, applied to an OPENSTACK NAT session log system, the OPENSTACK NAT session log system comprising a kernel part and a user state program, the kernel part being connected with the user state program, and the method comprising: the kernel part converting a NAT address and generating a NAT session log; the kernel part sending the NAT session log to the user state program; and the user state program storing the NAT session log into a corresponding database.

[0006] In combination with the first aspect, in a possible design scheme, the kernel part converts the NAT address and generates the NAT session log, comprising: the kernel part creating a NAT gateway; converting the NAT address based on the NAT gateway; and generating the NAT session log based on a network namespace corresponding to the NAT gateway.

[0007] In combination with the first aspect, in a possible design scheme, the kernel part converts the NAT address based on the NAT gateway, comprising: converting an IP address based on a NAT rule stored in the NAT gateway, the IP address being a target IP address corresponding to the converted NAT address.

[0008] With reference to the first aspect, in a possible design, before the kernel part sends the NAT session log to the user mode program, the kernel part further includes: identifying a network flow, and recording five-tuple information corresponding to the network flow; if the network flow is converted by a NAT address, updating the five-tuple information corresponding to the network flow as second five-tuple information; and updating the NAT session log based on the second five-tuple information.

[0009] With reference to the first aspect, in a possible design, after the NAT session log is updated based on the second five-tuple information, the kernel part further includes: if the network flow satisfies a specified condition, adding a specified identifier to the second five-tuple information; and updating the NAT session log again based on the second five-tuple information to which the specified identifier is added.

[0010] With reference to the first aspect, in a possible design, the specified condition includes that the network flow is normally ended or timed out.

[0011] With reference to the first aspect, in a possible design, the user mode program stores the NAT session log into a corresponding database, including: the user mode program listens to the NAT session log based on a pre-established NETLINK SOCKET; and if the NAT session log sent by the kernel part is acquired, the NAT session log is stored into a corresponding database.

[0012] With reference to the first aspect, in a possible design, the kernel part and the user mode program are connected through a NETLINK message.

[0013] The second aspect provides a system for implementing an OPENSTACK NAT session log, applied to an OPENSTACK NAT session log system, the OPENSTACK NAT session log system including a kernel part and a user mode program, the kernel part being connected to the user mode program, and the system including: a conversion and generation unit configured to convert a NAT address based on the kernel part and generate a NAT session log; a sending unit configured to send the NAT session log to the user mode program based on the kernel part; and a storage unit configured to store the NAT session log into a corresponding database based on the user mode program.

[0014] In a third aspect, an electronic device is provided. The electronic device includes one or more processors; a memory; and one or more application programs stored in the memory and configured to be executed by the one or more processors, the one or more application programs configured to perform the method of the first aspect.

[0015] The method for implementing the OPENSTACK NAT session log provided by the embodiments of the present application enables the OPENSTACK to record the NAT session log while implementing the NAT function, and facilitates IP tracing, positioning of network security events. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 A conversion flowchart of the NAT in the prior art is shown;

[0017] Figure 2 The method for implementing the OPENSTACK NAT session log provided by the embodiments of the present application is shown;

[0018] Figure 3 The structure block diagram of the method for implementing the OPENSTACK NAT session log provided by the embodiments of the present application is shown;

[0019] Figure 4 The system for implementing the OPENSTACK NAT session log provided by the embodiments of the present application is shown;

[0020] Figure 5 The structure block diagram of the electronic device provided by the embodiments of the present application is shown.

[0021] BRIEF DESCRIPTION OF DRAWINGS: the system for implementing the OPENSTACK NAT session log-400; the electronic device-2000; the processor-2001; the memory-2002. DETAILED DESCRIPTION

[0022] The technical solutions in the present application will be described below with reference to the drawings.

[0023] In the embodiments of the present application, the words such as "example", "for example" and the like are used to represent an example, illustration or description. Any embodiment or design scheme described as "example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the word "example" is intended to present the concept in a specific manner. In addition, in the embodiments of the present application, the meaning expressed by "and / or" can be both, or can be either one of the two.

[0024] In the embodiments of the present application, "image" and "picture" can be used interchangeably, and it should be pointed out that the meanings expressed are consistent when the distinction is not emphasized. "OF", "CORRESPONDING" and "RELEVANT" can be used interchangeably, and it should be pointed out that the meanings expressed are consistent when the distinction is not emphasized.

[0025] In the embodiments of the present application, sometimes the subscript such as W1 can be mistakenly used in the form of non-subscript such as W1, and the meanings expressed are consistent when the distinction is not emphasized.

[0026] Please refer to Figure 1 , Figure 1 A conversion flowchart of the prior art NAT is shown. Many cloud host / cloud computer network products on the market have network bases based on OPENSTACK or based on OPENSTACK for secondary modification, and multiple cloud computers of the same VPC generally convert the intranet address into the same public network IP through the NAT function to go online, however, the original OPENSTACK NAT gateway does not have a NAT session log function, and if a network security event occurs, it is not convenient to trace the IP to locate and investigate the problem.

[0027] The above-mentioned OPENSTACK cloud platform NAT gateway refers to a soft NAT gateway, that is, the NAT function is realized by software on the server where it is deployed. The original OPENSTACK supports this by default. The OPENSTACK cloud platform is usually deployed on a LINUX type server, and it is easy to realize NAT on these servers (such as by means of IPTABLES NAT function).

[0028] At present, no effective solution has been proposed for the problem that the original OPENSTACK NAT gateway does not have a NAT session log function. The method for realizing the OPENSTACK NAT session log provided in the present application is used to solve or partially solve the problem.

[0029] Please refer to Figure 2 , Figure 2 A method for realizing the OPENSTACK NAT session log is shown, and specifically includes steps S110 to S130.

[0030] Step S110: The kernel part converts the NAT address and generates a NAT session log.

[0031] Step S120: The kernel part sends the NAT session log to the user state program.

[0032] Step S130: the user mode program stores the NAT session log into the corresponding database.

[0033] In some embodiments, the method for implementing the OPENSTACK NAT session log can be applied to an OPENSTACK NAT session log system, which comprises a kernel part and a user mode program, and the kernel part is connected with the user mode program.

[0034] For some embodiments, please refer to Figure 3 , Figure 3 A structural block diagram of the method for implementing the OPENSTACK NAT session log is shown. The kernel part and the user mode program are connected through a NETLINK message, which is a protocol for communication between the kernel part and the user mode program.

[0035] The kernel part can be responsible for NAT address conversion and generation of the NAT session log, and send the NAT session log to the user mode program through the NETLINK message. When the OPENSTACK creates a NAT gateway, a program is started in the corresponding network namespace, a NETLINK SOCKET is established for listening and receiving messages, and the NAT session log is written into the corresponding database for subsequent search.

[0036] Specifically, when step S110 is performed, it can further include: the kernel part creates a NAT gateway; converts a NAT address based on the NAT gateway; and generates a NAT session log based on the network namespace corresponding to the NAT gateway.

[0037] The NAT gateway can be created for the NEUTRON network component of the OPENSTACK. The NAT gateway is actually a NETWORK NAMASPACE network namespace (which can be understood as a container, and the container has specific NAT rules for IP address conversion); each NAT gateway has a network namespace; and a program APP is started in each network namespace for accepting and storing the NAT session log.

[0038] Therefore, the NAT gateway can be created; the NAT address can be converted based on the NAT gateway; and the NAT session log can be generated based on the network namespace corresponding to the NAT gateway.

[0039] Optionally, the converting the NAT address based on the NAT gateway can further include: converting an IP address based on the NAT rule stored in the NAT gateway, the IP address being a target IP address corresponding to the converted NAT address.

[0040] The NAT rule stored in the NAT gateway can be a NAT rule pre-stored in a NETWORK NAMASPACE network namespace.

[0041] In some embodiments, before performing step S120, the method can further include: identifying a network flow FLOW, and recording five-tuple information corresponding to the network flow FLOW at this time; if the network flow FLOW is converted by a NAT address, updating the five-tuple information corresponding to the network flow FLOW as second five-tuple information; and updating the NAT session log based on the second five-tuple information.

[0042] Specifically, the network flow FLOW can be identified by a CONNTRACK link tracking module of a network subsystem in a LINUX kernel, and five-tuple information of the network flow FLOW at this time can be recorded. In an example, the five-tuple information can include a source IP, a source port, a protocol, a destination IP, a destination port, and a start timestamp.

[0043] If the network flow FLOW is converted by a NAT, the five-tuple information corresponding to the network flow FLOW at this time can be modified and recorded as second five-tuple information. The second five-tuple information can include a source IP, a source port, a protocol, a NATed source IP, a NATed source port, a destination IP, a destination port, and a start timestamp. Thus, the second five-tuple of a packet seen by a website / server where the destination IP is located is: a NATed source IP, a NATed source port, a protocol, a destination IP, and a destination port. The encapsulated packet is sent to a user mode program by a NETLINK.

[0044] Optionally, after updating the NAT session log based on the second five-tuple information, the method can further include: if the network flow FLOW satisfies a specified condition, adding a specified identifier to the second five-tuple information; and updating the NAT session log again based on the second five-tuple information with the added specified identifier.

[0045] Wherein, the network flow FLOW satisfies the specified condition, which can include the network flow FLOW normal end or timeout. Therefore, if the network flow FLOW is normally ended or the flow is timed out, the kernel module adds the specified identifier to the second five-tuple information. In some embodiments, an end timestamp can be added to the second five-tuple information, so as to obtain the second five-tuple information with the specified identifier. For example, the specified identifier can include an end timestamp, so that the second five-tuple information with the specified identifier can include a source IP, a source port, a protocol, a NATed source IP, a NATed source port, a destination IP, a destination port, a start timestamp, and an end timestamp. Thus, a complete NAT session log record of a flow is obtained. Wherein, the encapsulated packet can be sent to the user mode program through NETLINK.

[0046] For some embodiments, when performing step S130, the user mode program can also include: listening to the NAT session log based on a pre-established NETLINK SOCKET; and storing the NAT session log into a corresponding database if the NAT session log sent by the kernel part is obtained.

[0047] Wherein, the user mode program can establish a NETLINK SOCKET to listen to the NAT session log event, and receive a message to store the NAT session log to a database (such as ELASTICSEARCH) for subsequent tracing query. If the session state is "START", the database is directly stored; if the state is "FINISH", the state of the session and the end timestamp of the session are found and updated.

[0048] An exemplary embodiment is assumed that the IP address of the NAT gateway is 125.94.XX.197, wherein XX can be any combination of required numbers, which is not limited here. The IP address of a certain cloud computer in the VPC is 192.168.1.100, and the homepage of a certain website HTTPS: / / WWW.YYYYY.COM (assuming the IP address is 220.181.38.149) is accessed through a webpage. The HTTPS service port is 443 by default, and the source port of the cloud computer in this session is assumed to be 65432.

[0049] When the session starts, the NETLINK sends a message from the kernel to the user mode, which can be shown in Table 1 as follows.

[0050] Table 1

[0051]

[0052] When the session ends, the NETLINK sends a message from the kernel to the user mode, which can be shown in Table 2 as follows.

[0053] Table 2

[0054]

[0055] The user mode program processes to merge the same session into one record and update the record in the database. A complete NAT session log session record is shown in Table 3.

[0056] Table 3

[0057]

[0058] The method for implementing the OPENSTACK NAT session log provided by the embodiment of the application greatly reduces the log amount by flow identification. Only one NAT session log is generated for one data flow regardless of how many data packets are transmitted. The method has less code changes and fast deployment. In the field of cloud computing, OPENSTACK is used more frequently, and the NAT function is a very common function, but there is a lack of NAT log. The method makes up for the lack of this capability. Furthermore, the method can be widely applied to various systems that need the OPENSTACK NAT session log.

[0059] Based on Figure 2 and 3 The method for implementing the OPENSTACK NAT session log provided by the embodiment of the application is described in detail, and the system for implementing the OPENSTACK NAT session log provided by the embodiment of the application is described in detail.

[0060] As shown in Figure 4 , the system 400 for implementing the OPENSTACK NAT session log includes a conversion and generation unit 410, a sending unit 420, and a storage unit 430.

[0061] For ease of illustration, Figure 4 only the main components of the system 400 for implementing the OPENSTACK NAT session log are shown.

[0062] The conversion and generation unit 410 is configured to convert a NAT address and generate a NAT session log based on the kernel part. The kernel part is connected to the user mode program through a NETLINK message.

[0063] Further, the conversion and generation unit 410 can also be configured to create a NAT gateway by the kernel part, convert a NAT address based on the NAT gateway, and generate a NAT session log based on a network namespace corresponding to the NAT gateway.

[0064] Further, the converting and generating unit 410 can also be configured to convert an IP address based on the NAT rule stored in the NAT gateway, the IP address being a target IP address corresponding to the converted NAT address.

[0065] The sending unit 420 is configured to send the NAT session log to the user mode program based on the kernel part.

[0066] Further, the sending unit 420 can also be configured to identify a network flow FLOW, and record five-tuple information corresponding to the network flow FLOW at this time; if the network flow FLOW passes through a converted NAT address, update the five-tuple information corresponding to the network flow FLOW as second five-tuple information; and update the NAT session log based on the second five-tuple information.

[0067] Further, the sending unit 420 can also be configured to add a specified identifier to the second five-tuple information if the network flow FLOW meets a specified condition; and update the NAT session log again based on the second five-tuple information with the added specified identifier. The specified condition includes that the network flow FLOW normally ends or times out.

[0068] The storage unit 430 is configured to store the NAT session log into a corresponding database based on the user mode program.

[0069] Further, the storage unit 430 can also be configured to enable the user mode program to listen to the NAT session log based on a pre-established NETLINKSOCKET; and if the NAT session log sent by the kernel part is acquired, store the NAT session log into a corresponding database.

[0070] In addition, the technical effects of the system 400 for implementing the OPENSTACK NAT session log can refer to the technical effects of any of the foregoing methods, which will not be repeated here.

[0071] Optionally, the embodiments of the present application also provide a computer readable storage medium, which includes a computer program or instructions, when the computer program or instructions are run on a computer, the method provided by any of the embodiments of the present application is executed.

[0072] Optionally, the embodiments of the present application also provide an electronic device for executing the method provided by any of the embodiments of the present application.

[0073] As shown in Figure 5 The electronic device 2000 can include a processor 2001.

[0074] Optionally, the electronic device 2000 can also include a memory 2002.

[0075] The processor 2001 is coupled with the memory 2002, for example, through a communication bus.

[0076] The following will be described in detail Figure 5 The various components of the electronic device 2000 will be described in detail:

[0077] The processor 2001 is the control center of the electronic device 2000, which can be one processor or a plurality of processing elements. For example, the processor 2001 is one or more central processing units (CPU), which can also be an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present application, such as one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA).

[0078] Optionally, the processor 2001 can execute various functions of the electronic device 2000 by running or executing software programs stored in the memory 2002 and calling data stored in the memory 2002.

[0079] In a specific implementation, as an embodiment, the processor 2001 can include one or more CPUs, such as the CPU0 and CPU1 shown in FIG. Figure 5

[0080] The memory 2002 is used to store software programs for implementing the schemes of the present application, and is controlled by the processor 2001 to execute, and the specific implementation can refer to the above method embodiments, which will not be described here.

[0081] ​Optionally, the memory 2002 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions; a random access memory (RAM), or other type of dynamic storage device that can store information and instructions; an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage or other magnetic storage devices, or any other medium capable of storing instructions or data that can be accessed by a computer, but not limited to. The memory 2002 can be integrated with the processor 2001 or exist independently, and be coupled with the processor 2001 through an interface circuit (not shown in the figure) of the electronic device 2000, and the embodiments of the present application do not make specific limitations thereon. Figure 5

[0082] It should be noted that the structure of the electronic device 2000 shown in the figure does not constitute a limitation on the electronic device, and the actual electronic device can include more or fewer components than shown, or combine certain components, or different component arrangements. Figure 5

[0083] In addition, the technical effects of the electronic device 2000 can refer to the technical effects of the methods described in the above method embodiments, which will not be described here.

[0084] It should be understood that in various embodiments of the present application, the size of the sequence number of each process described above does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0085] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0086] ​​Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, system and unit can refer to the corresponding process in the foregoing method embodiment, and will not be repeated here.

[0087] In several embodiments provided by the present application, it should be understood that the disclosed system, device and method can be implemented by other ways. For example, the system embodiments described above are merely schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division mode, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, systems or units, and can be electrical, mechanical or other forms.

[0088] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0089] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit.

[0090] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for implementing OpenStack NAT session logging, characterized in that, The method, applied to the OpenStack NAT session logging system, which includes a kernel portion and a user-space program, wherein the kernel portion is connected to the user-space program, comprises: The kernel part translates NAT addresses and generates NAT session logs, wherein the kernel part creates a NAT gateway; Based on the NAT gateway, NAT addresses are translated; Generate NAT session logs based on the network namespace corresponding to the NAT gateway; The kernel portion sends the NAT session log to the user-space program; The user-space program stores the NAT session logs into the corresponding database.

2. The method according to claim 1, characterized in that, The process of translating NAT addresses based on the NAT gateway includes: Based on the NAT rules stored in the NAT gateway, the IP address is translated, and the IP address is the target IP address corresponding to the translated NAT address.

3. The method according to claim 1, characterized in that, Before the kernel portion sends the NAT session log to the user-space program, it also includes: Identify the network flow FLOW and record the quintuple information corresponding to the network flow FLOW at this time; If the network flow FLOW undergoes NAT address translation, then the 5-tuple information corresponding to the network flow FLOW is updated as the second 5-tuple information; The NAT session log is updated based on the second quintuple information.

4. The method according to claim 3, characterized in that, After updating the NAT session log based on the second 5-tuple information, the method further includes: If the network flow FLOW meets the specified conditions, then a specified identifier is added to the second quintuple information; The NAT session log is then updated again based on the second quintuple information with the specified identifier added.

5. The method according to claim 4, characterized in that, The specified conditions include the normal termination or timeout of the network flow FLOW.

6. The method according to claim 1, characterized in that, The user-space program stores the NAT session logs into the corresponding database, including: The user-space program listens to the NAT session logs based on a pre-established NETLINK SOCKET; If the NAT session log sent by the kernel is obtained, the NAT session log is stored in the corresponding database.

7. The method according to claim 1, characterized in that, The kernel portion is connected to the user-space program via NETLINK messages.

8. A system for implementing OpenStack NAT session logging, characterized in that, An application is provided in the OpenStack NAT session logging system, which includes a kernel portion and a user-space program, wherein the kernel portion is connected to the user-space program, and the system includes: A conversion and generation unit is used to convert NAT addresses and generate NAT session logs based on the kernel portion; A sending unit is configured to send the NAT session log to the user-space program based on the kernel portion; A storage unit is used to store the NAT session logs into the corresponding database based on the user-space program.

9. An electronic device, characterized in that, include: One or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, the one or more applications being configured to perform the method as described in any one of claims 1-7.

Images