Domain name resolution request processing method and product
By executing port modification and request forwarding policies in the container cluster management system, bypassing the node network protocol stack, the problem of resolution request failure caused by DNS hijacking attacks is solved, and the security and availability of resolution request processing is improved.
Patent Information
- Application Number
- CN202412000494.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-31
- Publication Date
- 2025-03-28
AI Technical Summary
In the current technology, when defending against DNS hijacking attacks, although malicious programs avoid obtaining request content by encrypting DNS resolution requests, the DNS resolution request failed due to hijacking, and the security of the processing process is low.
By executing a port modification policy in the container cluster management system, modifying the domain name resolution request of the target port to a specified port, and executing a request forwarding policy, the resolution request bypasses the node network protocol stack of the application container and the domain name service container, and finally performs port correction in the domain name service container to restore the target port.
It effectively reduces the risk of DNS hijacking attacks, improves the security of domain name resolution request processing, and ensures the availability of DNS resolution services.
Smart Images
Figure CN119728644A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present application relate to the technical field of data processing, and in particular, to a method and product for processing domain name resolution requests. Background Art
[0002] DNS (Domain Name System) hijacking attack is a common network attack method. It refers to some malware hijacking the DNS request initiated by the application and forwarding it to a forged DNS server. The forged DNS server generates a malicious domain name record and returns it to the application, causing the application to forward the business request to a malicious address based on the returned information, thereby obtaining business-sensitive information or conducting other malicious activities. When building a data center, effective measures need to be taken to defend against DNS hijacking attacks to improve the overall security of the platform.
[0003] In the container cluster management system, the application container needs to resolve the domain name into an IP address (Internet Protocol Address) through the DNS server in the cluster. For DNS hijacking attacks, the current common defense solution is to encrypt the DNS resolution request. When the DNS resolution request is hijacked, it can prevent malicious programs from obtaining the real request content. However, this method will still cause the DNS resolution request to fail due to the hijacking, resulting in a low security in the DNS resolution request processing process. Summary of the invention
[0004] The embodiments of the present application provide a method and product for processing a domain name resolution request, aiming to improve the security of the domain name resolution request processing process.
[0005] In a first aspect, an embodiment of the present application provides a method for processing a domain name resolution request, the method comprising: When a domain name resolution request initiated by any application container in the container cluster management system reaches the container network card corresponding to the application container, a port modification strategy is executed to modify the domain name resolution request with a target port to a target domain name resolution request with a preset designated port, where the target port is the port of the domain name service container; Execute a request forwarding strategy to forward the target domain name resolution request to a container network card corresponding to a domain name service container, wherein the request forwarding strategy is used to make a transmission path of the target domain name resolution request bypass a node network protocol stack of a node corresponding to the application container and a node network protocol stack of a node corresponding to the domain name service container; The domain name service container corresponds to the container network card to execute a port correction strategy to correct the target domain name resolution request with a preset designated port to the domain name resolution request with a target port, and send the domain name resolution request to the domain name service container for processing.
[0006] Optionally, execute a port modification policy, including: The container network card corresponding to any application container detects the destination port carried in any incoming request, and when the destination port is the target port, determines that the request is a domain name resolution request; The domain name resolution request with the target port is modified to a target domain name resolution request with a preset designated port.
[0007] Optionally, execute a request forwarding strategy, including: The container network card corresponding to any application container directly forwards the target domain name resolution request to the physical network card of the node corresponding to the application container, so that the target domain name resolution request bypasses the node network protocol stack of the node corresponding to the application container, and the physical network card is used to send the target domain name resolution request to the physical network card of the node corresponding to the domain name service container; The physical network card of the node corresponding to the domain name service container determines that the request is a target domain name resolution request when detecting that the destination port of any request is a designated port, and forwards the target domain name resolution request to the container network card corresponding to the domain name service container, so that the target domain name resolution request bypasses the node network protocol stack of the node corresponding to the domain name service container.
[0008] Optionally, implement port remediation policies, including: When the domain name service container corresponding to the container network card detects that the destination port of any request is a designated port, the request is determined to be a target domain name resolution request; And the target domain name resolution request with the designated port is modified to be the domain name resolution request whose destination port is the target port.
[0009] Optionally, the method further comprises: The domain name service container sends the generated domain name resolution message corresponding to the domain name resolution request to the container network card corresponding to the domain name service container, where the source port in the domain name resolution message is the target port; The container network card corresponding to the domain name service container modifies the domain name resolution message having the target port into a target domain name resolution message having the designated port, and directly sends the message to the physical network card of the node corresponding to the domain name service container, so that the target domain name resolution message bypasses the node network protocol stack of the node corresponding to the domain name service container; The physical network card of the node corresponding to the domain name service container sends the target domain name resolution message to the physical network card of the node corresponding to the application container that initiates the domain name resolution request; When the physical network card of the node corresponding to the application container detects that the source port of any message is the designated port, the physical network card determines that the message is a target domain name resolution message, and directly sends the target domain name resolution message to the container network card corresponding to the application container, so that the target domain name resolution message bypasses the node network protocol stack of the node corresponding to the application container; The container network card corresponding to the application container, when detecting that the source port of any message is the designated port, determines that the message is a target domain name resolution message, modifies the target domain name resolution message with the designated port into the domain name resolution message with the target port, and sends it to the application container.
[0010] Optionally, the method further comprises: Mounting a first kernel processing module at a target location of any container network card of the container cluster management system, wherein the first kernel processing module is configured to modify the target port of any received domain name resolution request or any domain name resolution message to the designated port, and modify the designated port of any received target domain name resolution request or the target domain name resolution message to the target port; The target location of any container network card mounts a second kernel processing module, and the second kernel processing module is configured to directly forward any target domain name resolution request or the target domain name resolution message after the target port is modified to the designated port to the physical network card of the node.
[0011] Optionally, the method further comprises: A third kernel processing module is mounted at a target location of a physical network card of any node of the container cluster management system, and the third kernel processing module is configured to directly forward any received target domain name resolution request or target domain name resolution message to any container network card of the node.
[0012] In a second aspect, an embodiment of the present application provides a device for processing a domain name resolution request, the device comprising: A port modification module, used for executing a port modification strategy when a domain name resolution request initiated by any application container in the container cluster management system reaches the container network card corresponding to the application container, so as to modify the domain name resolution request with a target port to a target domain name resolution request with a preset designated port, wherein the target port is the port of the domain name service container; A request forwarding module, used to execute a request forwarding strategy to forward the target domain name resolution request to a container network card corresponding to a domain name service container, wherein the request forwarding strategy is used to make the transmission path of the target domain name resolution request bypass a node network protocol stack of a node corresponding to the application container and a node network protocol stack of a node corresponding to the domain name service container; The port correction module is used for the domain name service container to execute the port correction strategy on the container network card corresponding to the domain name service container, so as to correct the target domain name resolution request with the preset designated port to the domain name resolution request with the target port, and send the domain name resolution request to the domain name service container for processing.
[0013] In a third aspect, an embodiment of the present application provides a computer device, comprising: at least one processor, and a memory, wherein the memory stores a computer program that can be run on the processor, wherein when the processor executes the computer program, the method for processing domain name resolution requests described in the first aspect of the embodiment is performed.
[0014] In a fourth aspect, an embodiment of the present application provides a non-volatile readable storage medium, wherein the non-volatile readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the method for processing a domain name resolution request described in the first aspect of the embodiment is performed.
[0015] Beneficial effects: In the method, when a domain name resolution request initiated by any application container in the container cluster management system reaches the container network card corresponding to the application container, a port modification strategy is executed to modify the domain name resolution request with a target port into a target domain name resolution request with a preset designated port, where the target port is the port of the domain name service container; then a request forwarding strategy is executed to forward the target domain name resolution request to the container network card corresponding to the domain name service container, where the request forwarding strategy is used to make the transmission path of the target domain name resolution request bypass the node network protocol stack of the node corresponding to the application container and the node network protocol stack of the node corresponding to the domain name service container; the container network card corresponding to the domain name service container executes a port correction strategy to correct the target domain name resolution request with the preset designated port into the domain name resolution request with the target port, and sends the domain name resolution request to the domain name service container for processing.
[0016] That is, in this method, in the process of sending the domain name resolution request from the application container to the domain name service container, the target port of the domain name service container in the domain name resolution request is hidden. By disguising the target port as a designated port, the problem of attackers intercepting the domain name resolution request through the target port is reduced.
[0017] Moreover, because the node network protocol stack of any node is more likely to be attacked by DNS hijacking, in any node, the transmission path of the domain name resolution request is not allowed to pass through the node network protocol stack within the node, thereby further improving the security of the domain name resolution request processing process. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following is a brief introduction to the drawings required for use in the embodiments or related technical descriptions.
[0019] Figure 1 A schematic diagram of the path of DNS resolution request and resolution result in the container cluster management system is shown; Figure 2 A flowchart showing the steps of a method for processing a domain name resolution request provided by an embodiment of the present application is shown; Figure 3 A flowchart showing the steps of a method for processing a domain name resolution request provided by an embodiment of the present application is shown; Figure 4 A schematic diagram of the transmission of a domain name resolution request provided by an embodiment of the present application is shown; Figure 5 A schematic diagram of the transmission of a domain name resolution message provided in an embodiment of the present application is shown; Figure 6 A functional module diagram of a domain name resolution request processing device provided in an embodiment of the present application is shown; Figure 7 A schematic diagram of a computer device provided in an embodiment of the present application is shown; Figure 8 A schematic diagram of a non-volatile readable storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION
[0020] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.
[0021] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, each embodiment of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in each embodiment of the present application, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can also be implemented. The division of the following embodiments is for the convenience of description, and the specific implementation of the present application should not constitute any limitation, and the various embodiments can be combined with each other and referenced to each other without contradiction.
[0022] Kubernetes, or K8S for short, is a container cluster management system that supports automated deployment, large-scale scalability, and application container management. It can realize automatic scheduling, expansion, and fault recovery of containers. Pod: The smallest management unit for scheduling in K8S, consisting of one or more containers. Containers in the same pod share process and network namespaces. Service: A resource in K8S that can access a specific set of Pods and provide load balancing capabilities; DNS: Domain Name System, which can resolve the corresponding IP address (Internet Protocol Address) through the domain name; coreDNS: A flexible and scalable DNS server, often used as the internal DNS of the k8s cluster, which can resolve the IP address corresponding to the service according to the K8SService name; eBPF: A program written by the user that can run in the Linux kernel. It is essentially a virtual machine running in kernel state, which allows users to load and run custom programs in the kernel. Users and the kernel can exchange data on demand and manage the kernel's behavior at any time.
[0023] DNS hijacking attack is a common network attack method. It refers to some malware hijacking the DNS request initiated by the application and forwarding it to a forged DNS server. The forged DNS server generates a malicious domain name record and returns it to the application, causing the application to forward the business request to a malicious address based on the returned information, thereby obtaining business-sensitive information or conducting other malicious activities. When building a data center, effective measures need to be taken to defend against DNS hijacking attacks in order to improve the overall security of the platform.
[0024] In a container cluster management system, such as a K8S cluster, application containers communicate through Service-based domain names, and the domain names need to be resolved into IP addresses through the DNS server in the cluster (usually CoreDNS). Usually, the normal process of DNS resolution in K8S is that after the application container of any node initiates a DNS resolution request, the operating system obtains the preset domain name server configuration (usually the access address of CoreDNS), and sends the DNS resolution request to the physical network in the node in sequence according to the path of "network protocol stack in application container-application container network card-node network protocol stack-physical network card". At the same time, the node where the DNS server is located receives the DNS resolution request and the processing path is "physical network card-node network protocol stack-CoreDNS container network card-CoreDNS container network protocol stack". After the CoreDNS resolution is completed, the domain name resolution record is returned to the application container according to the original path.
[0025] Reference Figure 1 , showing a schematic diagram of the path of DNS resolution requests and resolution results in the container cluster management system. When the application deployment unit in node A, that is, the application container of the application pod, initiates a domain name resolution request and sends it to the container network card A of the application pod, the domain name resolution request passes through the node network protocol stack of node A and is sent to the physical network card A of node A. According to the destination port of the domain name resolution request, the physical network card A sends the domain name resolution request to the physical network card B of node B that provides the domain name service container (such as the CoreDNS container pod) through the physical network.
[0026] After physical network card B receives the domain name resolution request, it is sent to container network card B corresponding to the domain name resolution domain name service container after passing through the node network protocol stack of node B. Then application network B sends the domain name resolution request to the domain name service container (such as CoreDNS container).
[0027] The propagation path of the domain name resolution message generated by the domain name service container according to the domain name resolution request is the reverse propagation of the above path.
[0028] In the propagation path of the above-mentioned domain name resolution request or domain name resolution message, the application container and the domain name service container CoreDNS container are usually dynamically created by users or K8S management components, so it is not easy to have malware intrusion problems.
[0029] Therefore, DNS hijacking attacks are more likely to occur in: node network protocol stacks and physical network transmission between nodes, such as malicious hijacking of DNS resolution requests or messages against physical network-related devices (such as routers or other intermediate nodes).
[0030] Since the destination port of the DNS resolution request sent to the CoreDNS container is usually port 53 specified by the DNS protocol, which is a fixed port, the malware can resolve the destination port of any request or message in a targeted manner by setting iptables and routing rules. If the destination port is port 53, it is determined that the request or message is a DNS resolution request or message, and then maliciously forwarded to the forged DNS server to complete subsequent malicious operations.
[0031] For DNS hijacking attacks, the current common defense solution is to encrypt DNS resolution requests. When the DNS resolution request is hijacked, it can prevent malicious programs from obtaining the actual request content. However, this method will still cause the DNS resolution request to fail due to the hijacking, resulting in a low security in the DNS resolution request processing process.
[0032] Therefore, there is an urgent need for a method that can avoid DNS hijacking attacks while ensuring the availability of DNS resolution services. Based on this, an embodiment of the present application provides a method for processing domain name resolution requests, which can improve the security of the domain name resolution request processing process.
[0033] Reference Figure 2 , shows a flowchart of a method for processing a domain name resolution request provided by an embodiment of the present application, the method may include the following steps: S101: When a domain name resolution request initiated by any application container in the container cluster management system reaches the container network card corresponding to the application container, a port modification strategy is executed to modify the domain name resolution request with a target port to a target domain name resolution request with a preset designated port, where the target port is a port of a domain name service container.
[0034] The container NIC is a virtual NIC that is shared by application containers in an application pod.
[0035] In a feasible implementation, the process of executing the port modification policy includes the following steps: A1: The container network card corresponding to any application container detects the destination port carried in any incoming request, and when the destination port is the target port, determines that the request is a domain name resolution request.
[0036] In the actual implementation process, many requests arrive at the container network card. The container network card resolves the destination port carried in any request. If the destination port is the target port of the domain name service container, that is, port 53, it indicates that the request is a domain name resolution request.
[0037] A2: Modify the domain name resolution request with the target port to a target domain name resolution request with a preset designated port.
[0038] In order to hide and disguise the target port, i.e., port 53, in the domain name resolution request, the container network card modifies the target port into a target domain name resolution request with a specified port, and the specified port may be a special port that is custom-set during the actual implementation process.
[0039] When a DNS hijacking attack captures any domain name resolution request based on the destination port of any request, because the destination port is no longer port 53 in the target domain name resolution request with a specified port, the problem of attackers intercepting the domain name resolution request through the target port is reduced.
[0040] S102: Execute a request forwarding strategy to forward the target domain name resolution request to a container network card corresponding to the domain name service container, wherein the request forwarding strategy is used to enable a transmission path of the target domain name resolution request to bypass a node network protocol stack of a node corresponding to the application container and a node network protocol stack of a node corresponding to the domain name service container.
[0041] Since the node network protocol stack in the node may also be vulnerable to DNS hijacking attacks in the transmission path of the domain name resolution request, in this embodiment, in order to further improve the security of the domain name resolution request processing process, the transmission process of any domain name resolution request in any node bypasses the node network protocol stack of the node.
[0042] In a feasible implementation, the process of executing the request forwarding strategy includes the following steps: B1: The container network card corresponding to any application container directly forwards the target domain name resolution request to the physical network card of the node corresponding to the application container, so that the target domain name resolution request bypasses the node network protocol stack of the node corresponding to the application container. The physical network card is used to send the target domain name resolution request to the physical network card of the node corresponding to the domain name service container.
[0043] That is, after port masquerading, the target domain name resolution request from the container network card no longer passes through the node network protocol stack of the node, but is directly sent from the container network card to the physical network card of the node.
[0044] And in the actual implementation process, the target domain name resolution request of the specified port can be preset to still point to the domain name service container. Therefore, the physical network card can send the target domain name resolution request to the physical network card of the node corresponding to the domain name service container according to the specified port carried by the target domain name resolution request.
[0045] B2: When the physical network card of the node corresponding to the domain name service container detects that the destination port of any request is a designated port, it determines that the request is a target domain name resolution request, and forwards the target domain name resolution request to the container network card corresponding to the domain name service container, so that the target domain name resolution request bypasses the node network protocol stack of the node corresponding to the domain name service container.
[0046] When the physical network card of the node corresponding to the domain name service container receives any request, it parses the destination port carried in the request. If it is detected that the destination port of any request is a designated port, it indicates that the request is a target domain name resolution request, and then determines that the target domain name resolution request needs to be sent directly to the container network card corresponding to the domain name service container, bypassing the node network protocol stack of the node where the domain name service container is located.
[0047] S103: The domain name service container corresponds to the container network card and executes a port correction strategy to correct the target domain name resolution request with a preset designated port to the domain name resolution request with a target port, and sends the domain name resolution request to the domain name service container for processing.
[0048] Specifically, executing the port modification policy includes the following steps: C1: When the container network card corresponding to the domain name service container detects that the destination port of any request is a designated port, the request is determined to be a target domain name resolution request; C2: and modifying the target domain name resolution request with the designated port to the domain name resolution request with the destination port being the target port.
[0049] After the container network card corresponding to the domain name service container receives the target domain name resolution request, it executes the port correction strategy, changes the preset designated port to the target port, i.e. port 53, restores the original domain name resolution request and sends it to the domain name service container, such as the CoreDNS container in K8S. The domain name service container maps the domain name and IP address according to the domain name resolution request and generates a domain name resolution message corresponding to the domain name resolution request.
[0050] In the process of sending any domain name resolution request from any application container to the domain name service container, by disguising the destination port of any domain name resolution request from the target port, i.e. port 53, to the preset designated port, it is possible to reduce the possibility of being captured by DNS hijacking attacks during the propagation process, and avoid the network protocol stack of nodes with weak security in the original transmission path of the domain name resolution request, thereby further improving the security of the domain name resolution request processing process.
[0051] Reference Figure 3, shows a flowchart of the steps of the method for processing a domain name resolution request provided by an embodiment of the present application. After the domain name service container generates a domain name resolution message corresponding to the domain name resolution request according to the domain name resolution request, the process of returning the domain name resolution message to the application container includes the following steps: S201: The domain name service container sends the generated domain name resolution message corresponding to the domain name resolution request to the container network card corresponding to the domain name service container, where the source port in the domain name resolution message is the target port.
[0052] The source port carried in the domain name resolution message generated by the domain name service container is the target port of the domain name service container, that is, port 53. The domain name service container first sends the domain name resolution message of the target port to the container network card corresponding to the domain name service container.
[0053] S202: The container network card corresponding to the domain name service container modifies the domain name resolution message having the target port into a target domain name resolution message having the designated port, and directly sends the message to the physical network card of the node corresponding to the domain name service container, so that the target domain name resolution message bypasses the node network protocol stack of the node corresponding to the domain name service container.
[0054] After the container network card corresponding to the domain name service container receives any message, when the source port in the message is parsed as the target port, that is, port 53, the message is characterized as a domain name resolution message.
[0055] Then, the container network card corresponding to the domain name service container modifies the domain name resolution message with the target port into a target domain name resolution message with the designated port, thereby disguising the target port in the message and preventing the domain name resolution message from being attacked by DNS hijacking in the return transmission path because it carries the target port.
[0056] And the container network card corresponding to the domain name service container will still send the target domain name resolution message with the specified port directly to the physical network card of the node corresponding to the domain name service container, so that the target domain name resolution message bypasses the node network protocol stack of the node corresponding to the domain name service container.
[0057] S203: The physical network card of the node corresponding to the domain name service container sends the target domain name resolution message to the physical network card of the node corresponding to the application container that initiates the domain name resolution request.
[0058] Since the source port of the target domain name resolution message is a designated port, it is not easily attacked by DNS hijacking during physical network transmission.
[0059] The destination port in the target domain name resolution message is the port of the application container that initiates the domain name resolution request, so the physical network card of the node corresponding to the domain name service container will send the target domain name resolution message to the physical network card corresponding to the node of the application container.
[0060] S204: When the physical network card of the node corresponding to the application container detects that the source port of any message is the designated port, it determines that the message is a target domain name resolution message, and sends the target domain name resolution message directly to the container network card corresponding to the application container, so that the target domain name resolution message bypasses the node network protocol stack of the node corresponding to the application container.
[0061] The physical network card of the node corresponding to the application container parses the source port of the received traffic. When it detects that the source port of any message is a designated port, it determines that the message is a target domain name resolution message, bypasses the node network protocol stack of the node, and sends the target domain name resolution message directly to the container network card corresponding to the application container.
[0062] S205: When the container network card corresponding to the application container detects that the source port of any message is the designated port, it determines that the message is a target domain name resolution message, modifies the target domain name resolution message with the designated port into the domain name resolution message with the target port, and sends it to the application container.
[0063] The container network card corresponding to the application container parses the source port of any traffic received. When it is detected that the source port of any message is the designated port, it is determined that the message is the target domain name resolution message. The disguised designated port needs to be restored to the port of the domain name service container, that is, restored to the target port: port 53, so that the application container can recognize the normal domain name resolution message.
[0064] Finally, the container network card corresponding to the application container sends the domain name resolution message with the source port as the target port to the application container, completing a domain name resolution service.
[0065] In a feasible implementation, taking K8S as the container cluster management system, a first kernel processing module is mounted at the target location of any container network card of K8S, and the first kernel processing module is configured to modify the target port of any received domain name resolution request or any domain name resolution message to the designated port, and to modify the target port of any received target domain name resolution request or the designated port of the target domain name resolution message, that is, the first kernel processing module is used to convert between the target port (port 53) and the designated port.
[0066] The second kernel processing module is mounted at the target location of any container network card, and the second kernel processing module is configured to directly forward any target domain name resolution request or the target domain name resolution message after the target port is modified to the designated port to the physical network card of the node, that is, the second kernel processing module is used to bypass the node network protocol stack of the node of the container network card when the target domain name resolution request or the target domain name resolution message is sent outside the node.
[0067] A third kernel processing module is mounted at a target location of a physical network card of any node, and the third kernel processing module is configured to forward any received target domain name resolution request or target domain name resolution message directly to any container network card of the node, that is, the third kernel processing module is used to bypass the node network protocol stack of the node when the target domain name resolution request or target domain name resolution message is sent to the node.
[0068] In the actual implementation process, the first kernel processing module, the second kernel processing module and the third kernel processing module can be code modules written for the eBPF program; the configuration of the specified port, the forwarding rules of the target domain name resolution request or the target domain name resolution message are configured in the eBPF Map, and the configuration of the specified port includes the port number of the specified port, and the correspondence between the specified port and the domain name service container.
[0069] eBPF (Extended Berkeley Packet Filter) is a virtual machine technology that runs in the Linux kernel. eBPF allows users to extend kernel functionality by loading and executing custom eBPF programs without modifying the kernel source code. It can mount programs written in user mode to multiple specified hook points in the Linux kernel. When traffic reaches these hook points, the data packets can be modified or forwarded according to the program.
[0070] The target location is the TC ingress hook point of any container network card or any physical network card. TC (Traffic Control) is a module in the Linux kernel, which is mainly used to control the sending and receiving of data packets in terms of rate and sequence. It also provides a mount point for the eBPF program, which can forward, discard, and release data packets. Ingress represents the transmission direction as ingress.
[0071] Reference Figure 4, showing a transmission diagram of a domain name resolution request provided in an embodiment of the present application. Specifically, node A in K8S is deployed with an application deployment unit A, namely, application pod A, wherein application pod A includes application container 1, and node B in K8S is deployed with a domain name service deployment unit, namely, a domain name service pod, wherein the domain name service pod includes a domain name service container, such as a CoreDNS container.
[0072] First, application container 1 initiates a domain name resolution request. The source port in the domain name resolution request is the port of application container 1, and the destination port is the target port, that is, port 53.
[0073] Then, the domain name resolution request is transmitted from application container 1 to container network card A of application pod A. The first kernel processing module and the second kernel processing module based on the eBPF program are mounted on the TC ingress hook point inside container network card A. The first kernel processing module captures any request flowing through the hook point of container network card A. When the destination port in the request is port 53, the destination port is modified to the specified port to obtain the target domain name resolution request. Then, the second kernel processing module forwards the target domain name resolution request directly to the physical network card A of node A through the bpf_redirect method of eBPF, so that the target domain name resolution request bypasses the node network protocol stack of node A.
[0074] According to the configuration of the specified port, physical network card A transmits the target domain name resolution request to physical network card B of node B. The third kernel processing module is mounted on the TC ingress hook point inside physical network card B. The third kernel processing module captures the target domain name resolution request with the specified port at the hook point, and forwards the target domain name resolution request directly to container network card B corresponding to the domain name service pod of node B, namely, the CoreDNS container network card.
[0075] The first kernel processing module is deployed on the TC ingress hook point inside the container network card B. The first kernel processing module captures any request flowing through the hook point of the container network card B. When the destination port in the request is a specified port, the specified port is modified to the target port, that is, port 53. After obtaining the domain name resolution request, it is forwarded to the domain name service container for domain name resolution.
[0076] Reference Figure 5 , shows a transmission schematic diagram of the domain name resolution message provided in an embodiment of the present application. Specifically, after the domain name service container performs domain name resolution, a domain name resolution message is obtained. The source port of the domain name resolution message is port 53, and the destination port is the port of application container 1. The domain name service container sends the domain name resolution message to container network card B.
[0077] Since the first kernel processing module and the second kernel processing module are mounted on the TC ingress hook point inside the container network card B, the first kernel processing module captures any message flowing through the hook point of the container network card B. When the source port in the message is port 53, the source port is modified to the specified port to obtain the target domain name resolution message. Then, the second kernel processing module forwards the target domain name resolution message directly to the physical network card B of node B through the bpf_redirect method of eBPF, so that the target domain name resolution message bypasses the node network protocol stack of node B.
[0078] According to the destination port of the target domain name resolution message, physical network card B sends the target domain name resolution message to physical network card A of node A corresponding to application container 1.
[0079] A third kernel processing module is mounted on the TC ingress hook point inside the physical network card A. The third kernel processing module captures the target domain name resolution message whose source port is the specified port at the hook point, and directly forwards the target domain name resolution message to the container network card A of node A.
[0080] The first kernel processing module deployed on the TC ingress hook point inside container NIC A captures any message flowing through the hook point of container NIC A. When the source port in the message is a designated port, the designated port is modified to the target port, that is, port 53. After obtaining the domain name resolution message, it is forwarded to application container 1.
[0081] In a feasible implementation, based on the eBPF program, encryption rules can also be pre-configured in the eBPFMap of the first kernel processing module. After modifying the target port of any domain name resolution request or domain name resolution message, that is, port 53, to the designated port, in the process of sending it outside the node, the first kernel processing module deployed in the container gateway calls the encryption rules in the eBPF Map to encrypt the target domain name resolution request or target domain name resolution message that modifies the target port; when sending it to the node, the first kernel processing module deployed in the container gateway calls the encryption rules in the eBPF Map, decrypts the received target domain name resolution request or target domain name resolution message, and then restores the designated port to the target port.
[0082] In the method for processing domain name resolution requests provided in this embodiment, the transmission path of any DNS resolution request always bypasses the node network protocol stack within the node, and uses a designated port (not port 53) to disguise the DNS resolution request or port 53 in the DNS resolution message, thereby reducing the risk of DNS hijacking attacks and not affecting the normal processing of the DNS resolution request and the normal return of the DNS resolution message, that is, not affecting the availability of the DNS service. Traffic capture is achieved through programs such as eBPF, and then port masquerading and traffic forwarding are performed. The container cluster management system does not need to be modified, and has the effect of being unaware of the application container.
[0083] Reference Figure 6 , shows a functional module diagram of a domain name resolution request processing device provided in an embodiment of the present application, the device comprising: The port modification module 100 is used to execute a port modification strategy when a domain name resolution request initiated by any application container in the container cluster management system reaches the container network card corresponding to the application container, so as to modify the domain name resolution request with a target port to a target domain name resolution request with a preset designated port, wherein the target port is the port of the domain name service container; A request forwarding module 200, configured to execute a request forwarding strategy to forward the target domain name resolution request to a container network card corresponding to a domain name service container, wherein the request forwarding strategy is configured to enable a transmission path of the target domain name resolution request to bypass a node network protocol stack of a node corresponding to the application container and a node network protocol stack of a node corresponding to the domain name service container; The port correction module 300 is used for the domain name service container to execute the port correction strategy for the container network card corresponding to the domain name service container to correct the target domain name resolution request with a preset designated port to the domain name resolution request with a target port, and send the domain name resolution request to the domain name service container for processing.
[0084] Optionally, the port modification module includes a port modification unit, configured to: The container network card corresponding to any application container detects the destination port carried in any incoming request, and when the destination port is the target port, determines that the request is a domain name resolution request; The domain name resolution request with the target port is modified to a target domain name resolution request with a preset designated port.
[0085] Optionally, the request forwarding module includes: A first request forwarding unit, used for a container network card corresponding to any application container, forwarding the target domain name resolution request directly to a physical network card of a node corresponding to the application container, so that the target domain name resolution request bypasses the node network protocol stack of the node corresponding to the application container, and the physical network card is used to send the target domain name resolution request to the physical network card of the node corresponding to the domain name service container; The second request forwarding unit is used for the physical network card of the node corresponding to the domain name service container. When detecting that the destination port of any request is a designated port, it determines that the request is a target domain name resolution request, and forwards the target domain name resolution request to the container network card corresponding to the domain name service container, so that the target domain name resolution request bypasses the node network protocol stack of the node corresponding to the domain name service container.
[0086] Optionally, the port correction module includes a port correction unit, configured to: When the domain name service container corresponding to the container network card detects that the destination port of any request is a designated port, the request is determined to be a target domain name resolution request; And the target domain name resolution request with the designated port is modified to be the domain name resolution request whose destination port is the target port.
[0087] Optionally, the device further comprises: The first unit is used for the domain name service container to send the domain name resolution message corresponding to the generated domain name resolution request to the container network card corresponding to the domain name service container, where the source port in the domain name resolution message is the target port; The second unit is used for the container network card corresponding to the domain name service container to modify the domain name resolution message with the target port into a target domain name resolution message with the designated port, and directly send it to the physical network card of the node corresponding to the domain name service container, so that the target domain name resolution message bypasses the node network protocol stack of the node corresponding to the domain name service container; The third unit is used for the physical network card of the node corresponding to the domain name service container, sending the target domain name resolution message to the physical network card of the node corresponding to the application container that initiates the domain name resolution request; The fourth unit is used for a physical network card of a node corresponding to the application container, and when detecting that a source port of any message is the designated port, determines that the message is a target domain name resolution message, and directly sends the target domain name resolution message to the container network card corresponding to the application container, so that the target domain name resolution message bypasses the node network protocol stack of the node corresponding to the application container; The fifth unit is used for the container network card corresponding to the application container. When detecting that the source port of any message is the designated port, it determines that the message is a target domain name resolution message, and modifies the target domain name resolution message with the designated port to the domain name resolution message with the target port, and sends it to the application container.
[0088] Optionally, the device further comprises: A first deployment module is used to mount a first kernel processing module at a target location of any container network card of the container cluster management system, wherein the first kernel processing module is configured to modify the target port of any received domain name resolution request or any domain name resolution message to the designated port, and to modify the designated port of any received target domain name resolution request or the target domain name resolution message to the target port; The second deployment module is used to mount the second kernel processing module at the target location of any container network card, and the second kernel processing module is configured to directly forward any target domain name resolution request or the target domain name resolution message after the target port is modified to the designated port to the physical network card of the node.
[0089] Optionally, the device further comprises: The third deployment module is used to mount the third kernel processing module at the target location of the physical network card of any node of the container cluster management system, and the third kernel processing module is configured to forward any received target domain name resolution request or target domain name resolution message directly to any container network card of the node.
[0090] Reference Figure 7 , shows a schematic diagram of a computer device provided in an embodiment of the present application, including: at least one processor 701, and a memory 702, wherein the memory 702 stores a computer program that can be run on the processor 701, wherein the processor 701 executes the method for processing the domain name resolution request described in the embodiment when executing the computer program.
[0091] Reference Figure 8 , shows a schematic diagram of a non-volatile readable storage medium provided in an embodiment of the present application, wherein the non-volatile readable storage medium 800 stores a computer program 801, wherein the computer program 801, when executed by a processor, executes the method for processing a domain name resolution request described in the embodiment.
[0092] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.
[0093] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0094] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0095] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0096] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0097] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.
[0098] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.
[0099] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.
Claims
1. A method for processing a domain name resolution request, characterized in that: The method comprises: When a domain name resolution request initiated by any application container in the container cluster management system reaches the container network card corresponding to the application container, a port modification strategy is executed to modify the domain name resolution request with a target port to a target domain name resolution request with a preset designated port, where the target port is the port of the domain name service container; Execute a request forwarding strategy to forward the target domain name resolution request to a container network card corresponding to a domain name service container, wherein the request forwarding strategy is used to make a transmission path of the target domain name resolution request bypass a node network protocol stack of a node corresponding to the application container and a node network protocol stack of a node corresponding to the domain name service container; The domain name service container corresponds to the container network card to execute a port correction strategy to correct the target domain name resolution request with a preset designated port to the domain name resolution request with a target port, and send the domain name resolution request to the domain name service container for processing.
2. The method according to claim 1, characterized in that Execute port modification policies, including: The container network card corresponding to any application container detects a destination port carried in any incoming request, and when the destination port is the target port, determines that the request is a domain name resolution request; The domain name resolution request with the target port is modified to a target domain name resolution request with a preset designated port.
3. The method according to claim 1, characterized in that Execute request forwarding strategies, including: The container network card corresponding to any application container directly forwards the target domain name resolution request to the physical network card of the node corresponding to the application container, so that the target domain name resolution request bypasses the node network protocol stack of the node corresponding to the application container, and the physical network card is used to send the target domain name resolution request to the physical network card of the node corresponding to the domain name service container; The physical network card of the node corresponding to the domain name service container determines that the request is a target domain name resolution request when detecting that the destination port of any request is a designated port, and forwards the target domain name resolution request to the container network card corresponding to the domain name service container, so that the target domain name resolution request bypasses the node network protocol stack of the node corresponding to the domain name service container.
4. The method according to claim 1, characterized in that Enforce port remediation policies, including: When the domain name service container corresponding to the container network card detects that the destination port of any request is a designated port, the request is determined to be a target domain name resolution request; And the target domain name resolution request with the designated port is modified to be the domain name resolution request whose destination port is the target port.
5. The method according to claim 1, characterized in that The method further comprises: The domain name service container sends the generated domain name resolution message corresponding to the domain name resolution request to the container network card corresponding to the domain name service container, where the source port in the domain name resolution message is the target port; The container network card corresponding to the domain name service container modifies the domain name resolution message having the target port into a target domain name resolution message having the designated port, and directly sends the message to the physical network card of the node corresponding to the domain name service container, so that the target domain name resolution message bypasses the node network protocol stack of the node corresponding to the domain name service container; The physical network card of the node corresponding to the domain name service container sends the target domain name resolution message to the physical network card of the node corresponding to the application container that initiates the domain name resolution request; When the physical network card of the node corresponding to the application container detects that the source port of any message is the designated port, the physical network card determines that the message is a target domain name resolution message, and directly sends the target domain name resolution message to the container network card corresponding to the application container, so that the target domain name resolution message bypasses the node network protocol stack of the node corresponding to the application container; The container network card corresponding to the application container, when detecting that the source port of any message is the designated port, determines that the message is a target domain name resolution message, modifies the target domain name resolution message with the designated port into the domain name resolution message with the target port, and sends it to the application container.
6. The method according to claim 5, characterized in that The method further comprises: Mounting a first kernel processing module at a target location of any container network card of the container cluster management system, wherein the first kernel processing module is configured to modify the target port of any received domain name resolution request or any domain name resolution message to the designated port, and modify the designated port of any received target domain name resolution request or the target domain name resolution message to the target port; The target location of any container network card mounts a second kernel processing module, and the second kernel processing module is configured to directly forward any target domain name resolution request or the target domain name resolution message after the target port is modified to the designated port to the physical network card of the node.
7. The method according to claim 6, characterized in that The method further comprises: A third kernel processing module is mounted at a target location of a physical network card of any node of the container cluster management system, and the third kernel processing module is configured to directly forward any received target domain name resolution request or target domain name resolution message to any container network card of the node.
8. A device for processing a domain name resolution request, characterized in that: The device comprises: A port modification module, used for executing a port modification strategy when a domain name resolution request initiated by any application container in the container cluster management system reaches the container network card corresponding to the application container, so as to modify the domain name resolution request with a target port to a target domain name resolution request with a preset designated port, wherein the target port is the port of the domain name service container; A request forwarding module, used to execute a request forwarding strategy to forward the target domain name resolution request to a container network card corresponding to a domain name service container, wherein the request forwarding strategy is used to make the transmission path of the target domain name resolution request bypass a node network protocol stack of a node corresponding to the application container and a node network protocol stack of a node corresponding to the domain name service container; The port correction module is used for the domain name service container to execute the port correction strategy on the container network card corresponding to the domain name service container, so as to correct the target domain name resolution request with the preset designated port to the domain name resolution request with the target port, and send the domain name resolution request to the domain name service container for processing.
9. A computer device, characterized in that: include: At least one processor, and a memory, wherein the memory stores a computer program that can be run on the processor, wherein when the processor executes the computer program, the method for processing a domain name resolution request according to any one of claims 1 to 7 is executed.
10. A non-volatile readable storage medium, characterized in that: The non-volatile readable storage medium stores a computer program, wherein the computer program, when executed by a processor, executes the method for processing a domain name resolution request according to any one of claims 1 to 7.