A network range virtual machine adaptive access method and system

Abstract

The present invention discloses a method and system for adaptive access of virtual machines in a network range, the method comprising: after the access information monitoring agent is started, query and record the current virtual machine IP address and protocol port number, construct and send an agreed type of information synchronization network message, the message load data is the current virtual machine IP address and protocol port number; after the virtual machine access information synchronization agent monitors the information synchronization network message, query the access information of the virtual machine in the network range platform according to the source MAC address, and determine whether it needs to be updated after comparison, construct and reply to the confirmation network message; after the access information monitoring agent monitors the confirmation network message, determine whether the load data is a message of successful synchronization, if so, stop sending the information synchronization network message, otherwise continue to send the information synchronization network message. The present invention can avoid the problem of inaccessibility caused by changes in the virtual machine IP and service monitoring port, and improve the user experience.

Description

Technical Field

[0001] The invention relates to a network range virtual machine adaptive access method and system, belonging to the field of network range. Background Art

[0002] In the network target range platform, a unified gateway is usually used to access the virtual machine. For example, guacamole is used as the unified access gateway. Guacamole supports many access protocols. In order to facilitate users to automatically adjust the access resolution, upload files to the virtual machine, or share the clipboard with the virtual machine, etc., the rdp and ssh protocols are generally used in the network target range platform to access the virtual machine. RDP is used to access the desktop system, and ssh is used to access the server system.

[0003] Both rdp and ssh require the deployment of corresponding server programs inside the virtual machine, and the communication between the access gateway and the internal network of the virtual machine needs to be opened. When using guacamole as an access gateway, you need to first create an access connection in guacamole and configure the virtual machine access protocol, IP address, port number and other information in the access connection.

[0004] In the network range, the IP address of the virtual machine is generally allocated in advance by the network range platform, and then pushed to the virtual machine by services such as DHCP or cloudinit. The port number used by the protocol is also filled in and recorded in the range platform in advance. The access gateway will use this pre-allocated IP address and protocol port to create an access connection later.

[0005] If the user manually modifies the IP address of the virtual machine or the listening port of the service during the use of the virtual machine, the actual IP address or listening port of the virtual machine will be inconsistent with the IP address or listening port recorded in the network target range platform database, ultimately resulting in the user being unable to access the virtual machine for further operations.

[0006] Some images will be configured with static IP addresses in advance when the images are created. If the IP address assigned by the range platform is inconsistent with the static IP address configured in the image, the user will not be able to access the virtual machine for further operations.

[0007] Generally, the listening ports of ssh and rdp are configured in advance when the image is created. If the default port is not used, it is easy for the user to forget or misremember the listening port number after the image is created, which will also cause the user to be unable to access the virtual machine. The image must be started before the service listening port number can be viewed, which increases the user's workload. Summary of the invention

[0008] Purpose of the invention: In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a network target range virtual machine adaptive access method and system, so as to avoid the inaccessibility problem caused by changes in the virtual machine IP and service listening port, and improve the user experience.

[0009] Technical solution: To achieve the above-mentioned invention object, the present invention adopts the following technical solution:

[0010] A network range virtual machine adaptive access method comprises the following steps:

[0011] Step 1: After the access information monitoring agent on the virtual machine is started, query and record the current virtual machine IP address and protocol port number;

[0012] Step 2: The access information monitoring agent constructs and sends an information synchronization network message of a specified type, and the message payload data is the current virtual machine IP address and protocol port number;

[0013] Step 3, the virtual machine access information synchronization agent on the computing node where the virtual machine is located monitors the information synchronization network message of the agreed type on the virtual switch, and parses the source MAC address and load data in the message after receiving the information synchronization network message of the agreed type, queries the access information of the virtual machine in the network target range platform according to the source MAC address, and compares it with the information in the network message. If they are consistent, no operation is performed; if they are inconsistent, the port of the virtual machine access service is called to modify the corresponding virtual machine IP address and protocol port number information in the access connection;

[0014] Step 4: The virtual machine access information synchronization agent constructs and sends a confirmation network message of an agreed type, the target MAC address is the MAC address corresponding to the virtual machine network card, the source MAC address is an agreed MAC address, and the message payload data is a message on whether the synchronization is successful;

[0015] Step 5: After receiving the confirmation network message of the agreed type and agreed source MAC address, the access information monitoring agent determines whether the load data is a message of successful synchronization. If so, it stops sending information synchronization network messages, otherwise repeats steps 2 to 5.

[0016] Furthermore, the network range virtual machine adaptive access method also includes:

[0017] Step 6: After confirming that the access information synchronization is successful, the access information monitoring agent starts a scheduled task to monitor the changes in the current virtual machine IP address and protocol port number;

[0018] Step 7: After the access information monitoring agent detects that the IP address or protocol port number of the current virtual machine has changed, steps 2 to 5 are repeated to synchronize the access information.

[0019] Preferably, in step 2, the target MAC address of the information synchronization network message is a broadcast address; and the virtual machine access information synchronization agent monitors the trunk port of the virtual switch.

[0020] Preferably, the virtual machine is connected to the access port of the virtual switch on the computing node, and in step 3, the virtual machine access information synchronization agent parses the VLAN information carried in the message, and in step 4, the virtual machine access information synchronization agent constructs a confirmation network message with the same VLAN information.

[0021] In some embodiments, the protocol is rdp and / or ssh protocol.

[0022] For the monitoring of RDP protocol ports, there are Windows virtual machines and Linux virtual machines. When the access information monitoring agent is started, it will first query and record the listening port of the current virtual machine's RDP service. The Windows virtual machine determines whether the RDP listening port has changed by periodically detecting the corresponding value in the registry. For the Linux virtual machine, it monitors the modification event of the xrdp.ini configuration file. If the configuration file has been modified, the port number in the configuration file will be read and compared with the previous port number. If they are inconsistent, it will query whether the current system also listens to the port number in the configuration file. If so, it is considered that the port has changed.

[0023] For monitoring of the ssh protocol port, when the access information monitoring agent is started, it will first query and record the listening port number in the ssh configuration file, and monitor the modification events of the sshd_config configuration file. If the sshd_config configuration file is modified, the port number in the configuration file will be read and compared with the previous port number. If they are inconsistent, it will query whether the current system also listens to the port number in the configuration file. If so, it is considered that the port has changed.

[0024] Preferably, the access information monitoring agent is deployed in advance in the virtual machine template and is set as a self-starting service at startup.

[0025] A network range virtual machine adaptive access system includes an access information monitoring agent on the virtual machine and a virtual machine access information synchronization agent on a computing node where the virtual machine is located;

[0026] The access information monitoring agent is used to query and record the current virtual machine IP address and protocol port number after startup; construct and send an information synchronization network message of an agreed type, and the message payload data is the current virtual machine IP address and protocol port number; and after receiving a confirmation network message of an agreed type and an agreed source MAC address, determine whether the payload data is a message of successful synchronization, and if so, stop sending the information synchronization network message, otherwise, repeat sending the information synchronization network message at a fixed time;

[0027] The virtual machine access information synchronization agent is used to monitor the information synchronization network message of the agreed type on the virtual switch, and parse the source MAC address and load data in the message after receiving the information synchronization network message of the agreed type, query the access information of the virtual machine in the network target range platform according to the source MAC address, and compare it with the information in the network message. If they are consistent, no operation is performed. If they are inconsistent, the port of the virtual machine access service is called to modify the corresponding virtual machine IP address and protocol port number information in the access connection; and construct and send a confirmation network message of the agreed type, the target MAC address is the MAC address corresponding to the virtual machine network card, the source MAC address is an agreed MAC address, and the message load data is a message on whether the synchronization is successful.

[0028] Furthermore, the access information monitoring agent is also used to start a scheduled task to monitor changes in the current virtual machine IP address and protocol port number after confirming that the access information synchronization is successful; after detecting that the current virtual machine IP address or protocol port number has changed, construct and send an information synchronization network message again to synchronize the access information.

[0029] Beneficial effects: The present invention provides a network range virtual machine adaptive access method and system, which constructs a special network message to synchronize the virtual machine IP address and service listening port information by setting an access information monitoring agent and a virtual machine access information synchronization agent. Compared with the prior art, its advantages are: 1. After the IP or listening port is modified inside the virtual machine, the access connection information can be automatically updated, so that users have a better virtual machine access and use experience; 2. Even if the user configures a static IP address in the image, it can still be accessed through the present invention, reducing the requirements for image production; 3. Using the solution of the present invention, users can not record the listening port numbers of protocols such as ssh and rdp, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 The figure is a flow chart of a method according to an embodiment of the present invention.

[0031] Figure 2 It is a deployment diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0033] like Figure 1 As shown, a network range virtual machine adaptive access method disclosed in an embodiment of the present invention includes the following steps:

[0034] Step 1: After the access information monitoring agent on the virtual machine is started, query and record the current virtual machine IP address and protocol port number;

[0035] Step 2: The access information monitoring agent constructs and sends an information synchronization network message of a specified type, and the message payload data is the current virtual machine IP address and protocol port number;

[0036] Step 3, the virtual machine access information synchronization agent on the computing node where the virtual machine is located monitors the information synchronization network message of the agreed type on the virtual switch, and parses the source MAC address and load data in the message after receiving the information synchronization network message of the agreed type, queries the access information of the virtual machine in the network target range platform according to the source MAC address, and compares it with the information in the network message. If they are consistent, no operation is performed; if they are inconsistent, the port of the virtual machine access service is called to modify the corresponding virtual machine IP address and protocol port number information in the access connection;

[0037] Step 4: The virtual machine access information synchronization agent constructs and sends a confirmation network message of an agreed type, the target MAC address is the MAC address corresponding to the virtual machine network card, the source MAC address is an agreed MAC address, and the message payload data is a message on whether the synchronization is successful;

[0038] Step 5: After receiving the confirmation network message of the agreed type and agreed source MAC address, the access information monitoring agent determines whether the load data is a message of successful synchronization. If so, it stops sending information synchronization network messages, otherwise repeats steps 2 to 5.

[0039] The above steps 1 to 5 realize the synchronization of the virtual machine IP address and protocol port at the initial startup. In some embodiments, in order to further prevent the modification of the virtual machine IP address and protocol port during use from causing access failure, the following steps are added:

[0040] Step 6: After confirming that the access information synchronization is successful, the access information monitoring agent starts a scheduled task to monitor the changes in the current virtual machine IP address and protocol port number;

[0041] Step 7: After the access information monitoring agent detects that the IP address or protocol port number of the current virtual machine has changed, steps 2 to 5 are repeated to synchronize the access information.

[0042] like Figure 2 As shown, an embodiment of the present invention discloses a network range virtual machine adaptive access system, which mainly includes two service modules: an access information monitoring agent on the virtual machine and a virtual machine access information synchronization agent on the computing node where the virtual machine is located. The access information monitoring agent is used to query and record the current virtual machine IP address and protocol port number after startup; construct and send an information synchronization network message of an agreed type, and the message payload data is the current virtual machine IP address and protocol port number; and after receiving a confirmation network message of the agreed type and the agreed source MAC address, determine whether the payload data is a message of successful synchronization, if so, stop sending the information synchronization network message, otherwise repeat the information synchronization network message at a fixed time; the virtual machine access information synchronization agent is used to monitor the information synchronization network message of the agreed type on the virtual switch, and when the information synchronization network message of the agreed type is received, parse the source MAC address and payload data in the message, query the virtual machine access information in the network target range platform according to the source MAC address, and compare it with the information in the network message. If they are consistent, no operation is performed. If they are inconsistent, the port of the virtual machine access service is called to modify the corresponding virtual machine IP address and protocol port number information in the access connection; and construct and send a confirmation network message of an agreed type, the target MAC address is the MAC address corresponding to the virtual machine network card, the source MAC address is an agreed MAC address, and the message payload data is a message of whether the synchronization is successful.

[0043] In some embodiments, the access protocol uses the ssh or rdp protocol; the access information monitoring agent obtains the IP address of the current virtual machine and the listening port of the ssh and rdp services after the service is started, and then sends the IP address of the virtual machine and the listening port of the ssh and rdp services to the virtual machine access information synchronization agent. At the same time, the access information monitoring agent will also monitor the changes in the IP address of the virtual machine network card and the listening port of the ssh and rdp services in real time. If it is detected that the IP address of the virtual machine network card or the listening port of the ssh and rdp services has changed, the new virtual machine IP and listening port will be sent to the virtual machine access information synchronization agent. After receiving the new IP and listening port of the virtual machine, the virtual machine access information synchronization agent will compare them with the records in the shooting range platform. If they are inconsistent with the IP and listening port recorded in the shooting range platform, the interface of the virtual machine access service is called to modify the IP and port parameters in the current virtual machine access connection of the shooting range platform.

[0044] In a specific range application, the detailed process of applying the network range virtual machine adaptive access method described in the embodiment of the present invention is as follows:

[0045] Step 101: The access information monitoring agent is deployed in advance in the virtual machine template and is set as a self-starting service at startup.

[0046] Step 102: The user builds a scenario topology on the network range platform and starts the scenario topology.

[0047] Step 103, after the scene topology is created, the network range platform will record the basic information and access method of each virtual machine in the database, including the virtual machine UUID, virtual machine MAC address, virtual machine IP address, access protocol, protocol port number, user name, password and other information.

[0048] Step 104, after the scene is started, the access information monitoring agent will first query and record the IP address of the current virtual machine and the port number monitored by the rdp and ssh protocols, and then call the python scapy library to construct a special network message. The target MAC address is the broadcast address ff:ff:ff:ff:ff:ff, the source MAC address is the MAC address corresponding to the current virtual machine network card, and the type field is set to 0x9999. The new IP address and the port number monitored by the rdp and ssh protocols are used as the data of the network message payload. After the network message construction is completed, the network message will be sent from the current virtual machine network card. The network message will be sent regularly until a synchronization success message is received.

[0049] Sample code:

[0050] from scapy.all import Ether, sendp

[0051] access_payload = b"ip_addr: 192.168.1.10, ssh_port: 2022, rdp_port:13389" # Payload data

[0052] ethernet_frame = Ether(

[0053] dst="ff:ff:ff:ff:ff:ff", # broadcast address

[0054] src="fa:16:3e:33:44:55", # Source MAC address

[0055] type=0x9999 # custom type

[0056] ) / access_payload

[0057] sendp(ethernet_frame) # Send network message

[0058] Step 105, the virtual machine access information synchronization agent monitors the network message of type 0x9999 on the virtual switch. When the virtual machine access information synchronization agent receives the network message of this type, the virtual machine access information synchronization agent will parse out the VLAN information, MAC address information and payload data carried by the current message.

[0059] In step 106, the virtual machine access information synchronization agent will query the virtual machine access information in the network range platform according to the source MAC address in the network message (i.e., the MAC address of the virtual machine), and compare the access information recorded in the network range platform with the information in the network message. If the data is consistent, no operation is performed; if the data is inconsistent, the port of the virtual machine access service is called to modify the corresponding virtual machine IP address and protocol port number information in the access connection. Regardless of whether the access information is consistent, step 7 will be executed to send a confirmation message.

[0060] Step 107, after the virtual machine access information synchronization is completed, the virtual machine access information synchronization agent will construct a network message with VLAN, the target MAC address is the MAC address corresponding to the virtual machine network card, the source MAC address is a special MAC address fa:16:3e:00:00:00, the type field is set to 0x9999, the modification success message is used as the data of the network message payload, and the network message is sent to the access information monitoring agent via the virtual switch.

[0061] Sample code:

[0062] from scapy.all import Ether, Dot1Q, sendp

[0063] result_payload = b"success:1,message:ok" # Returned result data

[0064] ethernet_frame = Ether(

[0065] dst=" fa:16:3e:33:44:55", # The target MAC address is the MAC address of the virtual machine

[0066] src=" fa:16:3e:00:00:00", # The source MAC address is a fixed MAC address

[0067] ) / Dot1Q(vlan=10, type=0x9999) / result_payload # vlan is the VLAN parsed in step 5

[0068] sendp(ethernet_frame) # Send network message

[0069] Step 108, after receiving the network message of type 0x9999 and source MAC address fa:16:3e:00:00:00, the access information monitoring agent will parse the payload data therein. If it is a message of successful modification, it will stop sending the network message of synchronous access information, otherwise repeat steps 104-step 108 and try to send the information synchronization network message again.

[0070] Step 109, after confirming that the access information synchronization is successful, the access information monitoring agent will start the scheduled task to detect and monitor the changes in the IP address of the current virtual machine or the port number monitored by the rdp and ssh protocols.

[0071] Regarding monitoring of the IP address of the virtual machine, when the virtual machine is started, the access information monitoring agent will first query and record the IP address of the current virtual machine, and start a scheduled detection task to periodically detect the current IP address of the virtual machine. If the current IP address is inconsistent with the previously recorded one, the following step 112 will be triggered;

[0072] For the monitoring of the rdp protocol port, it is divided into windows virtual machines and linux virtual machines. When the virtual machine starts, the access information monitoring agent will first query and record the listening port of the current virtual machine rdp service. Among them, the windows virtual machine determines whether the rdp listening port has changed by periodically detecting the corresponding value in the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber). If it is inconsistent with the previously recorded rdp service port, the following step 12 will be triggered; for the linux virtual machine, the rdp service is provided by xrdp. The service port that xrdp monitors is configured through the xrdp.ini configuration file. The access information monitoring agent will monitor the modification event of the xrdp.ini configuration file. If the configuration file is modified, the port number in the configuration file will be read and compared with the previous port number. If it is inconsistent, the python socket library will be used to query whether the current system is also listening to the port number. If it is also listening to the port, the following step 112 will be triggered;

[0073] For monitoring of the ssh protocol port, when the virtual machine starts, the access information monitoring agent will first query and record the listening port number in the ssh configuration file, and the access information monitoring agent will monitor the modification event of the sshd_config configuration file. If the sshd_config configuration file is modified, the access information monitoring agent will retrieve the port number configured in the configuration file. If the port number in the configuration file is consistent with the previous port number, no processing will be performed. If they are inconsistent, the Python socket library will be used to query whether the current system also listens to the port number. If it also listens to the port, the following step 112 will be triggered.

[0074] Step 110, the user selects the virtual machine to be accessed on the web interface of the network range platform, clicks the access button in the access panel, and accesses the virtual machine.

[0075] Step 111: During the operation, the user manually modifies the IP address of the virtual machine or the port number monitored by the rdp or ssh protocol.

[0076] Step 112: If the access information monitoring agent detects that the IP address of the current virtual machine or the port number monitored by the rdp or ssh protocol has changed, steps 104 to 108 are repeated to synchronize the access information.

Claims

1. A network range virtual machine adaptive access method, characterized in that: The steps include: Step 1: After the access information monitoring agent on the virtual machine is started, query and record the current virtual machine IP address and protocol port number; Step 2: The access information monitoring agent constructs and sends an information synchronization network message of a specified type, and the message payload data is the current virtual machine IP address and protocol port number; Step 3, the virtual machine access information synchronization agent on the computing node where the virtual machine is located monitors the information synchronization network message of the agreed type on the virtual switch, and parses the source MAC address and load data in the message after receiving the information synchronization network message of the agreed type, queries the access information of the virtual machine in the network target range platform according to the source MAC address, and compares it with the information in the network message. If they are consistent, no operation is performed; if they are inconsistent, the port of the virtual machine access service is called to modify the corresponding virtual machine IP address and protocol port number information in the access connection; Step 4: The virtual machine access information synchronization agent constructs and sends a confirmation network message of an agreed type, where the target MAC address is the MAC address corresponding to the virtual machine network card, the source MAC address is an agreed MAC address, and the message payload data is a message on whether the synchronization is successful; Step 5: After receiving the confirmation network message of the agreed type and agreed source MAC address, the access information monitoring agent determines whether the load data is a message of successful synchronization. If so, it stops sending information synchronization network messages, otherwise repeats steps 2 to 5.

2. According to claim 1, a network range virtual machine adaptive access method is characterized in that: Also includes: Step 6: After confirming that the access information synchronization is successful, the access information monitoring agent starts a scheduled task to monitor the changes in the current virtual machine IP address and protocol port number; Step 7: After the access information monitoring agent detects that the IP address or protocol port number of the current virtual machine has changed, steps 2 to 5 are repeated to synchronize the access information.

3. According to claim 1, a network range virtual machine adaptive access method is characterized in that: In the step 2, the target MAC address of the information synchronization network message is a broadcast address; the virtual machine access information synchronization agent monitors the trunk port of the virtual switch.

4. A network range virtual machine adaptive access method according to claim 1, characterized in that: The virtual machine is connected to the access port of the virtual switch on the computing node. In step 3, the virtual machine access information synchronization agent parses the VLAN information carried in the message. In step 4, the virtual machine access information synchronization agent constructs a confirmation network message with the same VLAN information.

5. A network range virtual machine adaptive access method according to claim 1, characterized in that: The protocol is rdp and / or ssh protocol.

6. A network range virtual machine adaptive access method according to claim 5, characterized in that: For the monitoring of RDP protocol ports, there are Windows virtual machines and Linux virtual machines. When the access information monitoring agent is started, it will first query and record the listening port of the current virtual machine's RDP service. The Windows virtual machine determines whether the RDP listening port has changed by periodically detecting the corresponding value in the registry. For the Linux virtual machine, it monitors the modification event of the xrdp.ini configuration file. If the configuration file has been modified, the port number in the configuration file will be read and compared with the previous port number. If they are inconsistent, it will query whether the current system also listens to the port number in the configuration file. If so, it is considered that the port has changed.

7. A network range virtual machine adaptive access method according to claim 5, characterized in that: For monitoring of the ssh protocol port, when the access information monitoring agent is started, it will first query and record the listening port number in the ssh configuration file, and monitor the modification events of the sshd_config configuration file. If the sshd_config configuration file is modified, the port number in the configuration file will be read and compared with the previous port number. If they are inconsistent, it will query whether the current system also listens to the port number in the configuration file. If so, it is considered that the port has changed.

8. A network range virtual machine adaptive access method according to claim 1, characterized in that: The access information monitoring agent is deployed in advance in the virtual machine template and is set as a self-starting service at startup.

9. A network range virtual machine adaptive access system, characterized in that: It includes an access information monitoring agent on the virtual machine and a virtual machine access information synchronization agent on the computing node where the virtual machine is located; The access information monitoring agent is used to query and record the current virtual machine IP address and protocol port number after startup; construct and send an information synchronization network message of an agreed type, and the message payload data is the current virtual machine IP address and protocol port number; and after receiving a confirmation network message of an agreed type and an agreed source MAC address, determine whether the payload data is a message of successful synchronization, and if so, stop sending the information synchronization network message, otherwise, repeat sending the information synchronization network message at a fixed time; The virtual machine access information synchronization agent is used to monitor the information synchronization network message of the agreed type on the virtual switch, and parse the source MAC address and load data in the message after receiving the information synchronization network message of the agreed type, query the access information of the virtual machine in the network target range platform according to the source MAC address, and compare it with the information in the network message. If they are consistent, no operation is performed; if they are inconsistent, the port of the virtual machine access service is called to modify the corresponding virtual machine IP address and protocol port number information in the access connection; And construct and send a confirmation network message of an agreed type, the target MAC address is the MAC address corresponding to the virtual machine network card, the source MAC address is an agreed MAC address, and the message payload data is a message indicating whether the synchronization is successful.

10. A network range virtual machine adaptive access system according to claim 9, characterized in that: The access information monitoring agent is also used to start a scheduled task to monitor changes in the current virtual machine IP address and protocol port number after confirming that the access information synchronization is successful; after detecting that the current virtual machine IP address or protocol port number has changed, construct and send an information synchronization network message again to synchronize the access information.

Images