NAT (Network Address Translation) session response configuration change method, system, equipment, medium and product

Abstract

The invention relates to the technical field of communication, and discloses an NAT (Network Address Translation) session response configuration change method, system and device, a medium and a product, and the method comprises the following steps: establishing a rule identifier for each created NAT rule; establishing a rule data comparison table based on the NAT rule and the corresponding rule identifier, and updating the rule data comparison table under the condition that the NAT rule is changed; when an NAT session is generated according to the NAT rule, adding a rule identifier corresponding to the NAT rule, and establishing an NAT session table; and judging whether the NAT session is legal based on the rule data comparison table and the NAT session table. According to the method and the device, the NAT session can be updated timely and effectively when the NAT configuration is changed, NAT forwarding is not influenced, the lossless operation of the forwarding thread is ensured, the NAT session is updated timely, and the method and the device are suitable for a ten-million-level or hundred million-level ultra-large-specification NAT session updating scene.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a NAT session response configuration change method, system, equipment, medium and product. Background Art

[0002] Network Address Translation (NAT) technology is a protocol used to convert internal network addresses into external network addresses, including IP conversion and port conversion, that is, a technology that realizes both IP and port conversion at the same time.

[0003] Data plane forwarding is CPU and I / O intensive. In networks with speeds above 10G, the packet generation rate is very high, and its forwarding thread needs to keep running 100% under high load. When the forwarding thread is suspended due to an interruption, the network card may cache the received packets in its memory. If the forwarding thread fails to process and forward these packets quickly, a large number of packets will be lost.

[0004] When a configuration change occurs, such as changing the subnet SNAT address, it is necessary to promptly change the forwarding data associated with this configuration in the forwarding thread. At present, when processing such configuration changes, most of them adopt a synchronous update method, that is, a lock protection method is used to change the forwarding data, that is, the configuration thread locks the NAT session to update the data. If the data update amount is large, this method will cause the forwarding thread to be interrupted due to the inability to access the NAT session in parallel, resulting in a large number of packet losses. In addition, there is also a delayed update method, such as recording invalid configuration data information and regularly checking whether the configuration is valid. Although this method avoids the forwarding suspension caused by synchronous deletion, due to the untimely data update, the message forwarding will inevitably use old invalid data, resulting in data forwarding errors or inconsistencies. Although the optimized NAT session storage method can be used to speed up the access process, it still cannot meet the needs of cloud computing for updating the scale of billions of NAT sessions. Summary of the invention

[0005] In view of this, the present invention provides a NAT session response configuration change method, system, device, medium and product to solve the problem in the prior art that NAT forwarding is affected when NAT configuration changes occur.

[0006] In a first aspect, the present invention provides a method for changing a NAT session response configuration, the method comprising:

[0007] Create a rule identifier for each NAT rule created;

[0008] Based on the NAT rules and the corresponding rule identifiers, a rule data comparison table is established, and when the NAT rules are changed, the rule data comparison table is updated;

[0009] When generating a NAT session according to the NAT rule, a rule identifier corresponding to the NAT rule is added, and a NAT session table is established;

[0010] Based on the rule data comparison table and the NAT session table, determine whether the NAT session is legal.

[0011] The present invention proposes a NAT session response configuration change method, which adopts a loosely coupled implementation method of NAT rules and NAT sessions, and can timely and effectively update NAT sessions when NAT configuration changes, without affecting NAT forwarding. The method not only ensures the lossless operation of the forwarding thread, but also achieves timely update of NAT sessions, and is suitable for NAT session update scenarios of super large specifications of tens of millions or hundreds of millions.

[0012] In an optional implementation, when the NAT rule is changed, updating the rule data comparison table includes:

[0013] In the case of adding a new NAT rule, a new rule identifier is assigned to the new NAT rule, and the new NAT rule and the corresponding rule identifier are added to the rule data comparison table;

[0014] In the case of updating the NAT rule, the NAT rule and the corresponding rule identifier before the update are deleted from the rule data comparison table, and a new rule identifier is reassigned to the updated NAT rule, and the updated NAT rule and the corresponding rule identifier are added to the rule data comparison table;

[0015] When deleting a NAT rule, the corresponding NAT rule and rule identifier in the rule data comparison table are deleted.

[0016] In this embodiment, when the NAT configuration is deleted or updated, the old rule identifier will be deleted synchronously and deleted from the rule data comparison table, which can ensure that the network traffic is processed according to the new NAT rules to avoid potential conflicts or errors that affect the forwarding of the NAT session.

[0017] In an optional implementation, judging whether the NAT session is legal based on the rule data comparison table and the NAT session table includes:

[0018] When a data packet is received, the NAT session table is searched for a NAT session corresponding to the traffic feature according to the traffic feature in the data packet;

[0019] When a NAT session corresponding to the traffic feature is found in the NAT session table, a rule identifier corresponding to the NAT session is obtained;

[0020] Check whether the obtained rule identifier exists in the rule data comparison table;

[0021] When the obtained rule identifier exists in the rule data comparison table, it is determined that the NAT session is legal.

[0022] In an optional implementation, when the acquired rule identifier does not exist in the rule data comparison table, the NAT session corresponding to the traffic feature in the NAT session table is deleted, and the NAT rule is reselected to generate a new NAT session.

[0023] In an optional implementation, when it is found that there is no NAT session corresponding to the traffic feature in the NAT session table, a new NAT session is created and stored in the NAT session table.

[0024] In this embodiment, a loosely coupled implementation method of NAT rules and NAT sessions is adopted, so that NAT configuration changes do not affect the forwarding of unchanged NAT sessions, and lossless updates of tens of millions of NAT sessions are supported, which not only ensures the continuity of forwarding, but also reduces the possibility of packet loss.

[0025] In an optional implementation, after establishing the NAT session table, the method further includes:

[0026] Traversing the NAT session table based on the preset traversal time and the mark position, extracting the to-be-checked rule identifier corresponding to the NAT session in the NAT session table;

[0027] Determine whether the rule identifier to be checked exists in the rule data comparison table;

[0028] If the rule identifier to be checked does not exist in the rule data comparison table, delete the NAT session corresponding to the rule identifier to be checked in the NAT session table;

[0029] When the preset traversal time ends, the mark position is updated and the traversal is terminated; or when the traversal ends, the traversal is terminated.

[0030] In this embodiment, while ensuring that invalid NAT sessions are continuously deleted, long-term locking of NAT sessions that causes suspension of the NAT forwarding module is avoided, the line speed of the forwarding module is ensured, and active and passive updates of NAT sessions are realized at the same time.

[0031] In a second aspect, the present invention provides a NAT session response configuration change system, the system comprising:

[0032] A rule identification management module is used to establish a rule identification for each created NAT rule; it is also used to establish a rule data comparison table based on the NAT rule and the corresponding rule identification, and update the rule data comparison table when the NAT rule changes;

[0033] The NAT session forwarding module is used to add a rule identifier corresponding to the NAT rule when generating a NAT session according to the NAT rule, and to establish a NAT session table; it is also used to determine whether the NAT session is legal based on the rule data comparison table and the NAT session table.

[0034] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the NAT session response configuration change method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0035] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the NAT session response configuration change method of the first aspect or any corresponding embodiment thereof.

[0036] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the NAT session response configuration change method of the first aspect or any corresponding embodiment thereof.

[0037] It should be noted that, since the NAT session response configuration change system, computer device and computer-readable storage medium provided by the present invention correspond to the above-mentioned NAT session response configuration change method, therefore, for the beneficial effects of the NAT session response configuration change system, computer device and computer-readable storage medium, please refer to the description of the corresponding beneficial effects of the NAT session response configuration change method above, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 It is a flowchart of a method for changing a NAT session response configuration according to an embodiment of the present invention;

[0040] Figure 2 is a schematic diagram of a process of allocating rule identifiers according to an embodiment of the present invention;

[0041] Figure 3 It is a schematic diagram of a process of determining whether a NAT session is legal according to an embodiment of the present invention;

[0042] Figure 4 It is a schematic diagram of a process of actively deleting a NAT session according to an embodiment of the present invention;

[0043] Figure 5 It is a schematic diagram of a process flow of actively deleting a NAT session according to an embodiment of the present invention;

[0044] Figure 6 is a schematic diagram of a processing flow of a NAT session response configuration change system according to an embodiment of the present invention;

[0045] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0047] According to an embodiment of the present invention, an embodiment of a NAT session response configuration change method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0048] In this embodiment, a method for changing a NAT session response configuration is provided, which can be executed by a server, a terminal, a mobile terminal, etc. Figure 1 is a flow chart of a method for changing a NAT session response configuration according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0049] Step S101: Create a rule identifier (also referred to as Rule ID in this embodiment) for each created NAT rule.

[0050] NAT rules are rules used to guide conversion, usually including: IP address or network segment before conversion, IP address after conversion; or IP and port before conversion, and IP and port after conversion. The IP or port of the data packet matching the NAT Rule will be replaced, the outgoing traffic will replace the source IP or source port, and the incoming traffic will replace the destination IP and destination port. The process of establishing rule identification can be performed by the rule identification management module in the terminal and other devices. The rule identification management module is responsible for the allocation and uniqueness of rule identification, and assigns a globally unique identification to each NAT rule.

[0051] Step S102: establishing a rule data comparison table based on the NAT rule and the corresponding rule identifier, and updating the rule data comparison table when the NAT rule is changed.

[0052] This process can still be performed by the rule identifier management module, and the assigned rule identifier is recorded in the NAT rule data. At the same time, a rule data comparison table based on the rule identifier as the hash key is established, and the NAT rule can be quickly found through the rule identifier. The bidirectional association relationship between the NAT rule and the rule identifier is maintained through this rule identifier management module, that is, the other party can be quickly found through either party.

[0053] In addition, when the NAT rules are changed, for example, when the NAT rules are added, deleted, or updated, the rule data comparison table also needs to be updated in a timely manner to ensure the accuracy of the mapping relationship in the rule data comparison table.

[0054] Step S103: when a NAT session (also referred to as NAT Session in this embodiment) is generated according to the NAT rule, a rule identifier corresponding to the NAT rule is added, and a NAT session table is established.

[0055] NAT session is used to record the records before and after data flow conversion, such as recording the traffic characteristics before data flow conversion and the traffic characteristics information and other information after conversion, including status, packet count, update time or other attachment information; it is stored in the NAT session data table, and the NAT session can be quickly located using the traffic characteristics before conversion or the traffic characteristics after conversion.

[0056] Specifically, when the first packet of traffic arrives, if it hits the NAT rule, a NAT session will be created for it to record the conversion relationship between the internal and external networks. In this embodiment, when creating a NAT session, the NAT session and the rule identifier are associated. Since a two-way association relationship has been established between the NAT rule and the rule identifier, the rule identifier of the NAT rule can be obtained when the NAT session is created, and it can be recorded in the NAT session. That is, when an internal device initiates traffic, the NAT device will process the traffic according to the applicable NAT rule and create a corresponding NAT session. In this embodiment, while generating a NAT session, a rule identifier field is added to the NAT session to record the rule identifier that the current NAT session depends on. This process can be performed by a NAT session forwarding module in a terminal or other device to establish an association relationship between a NAT session and a rule identifier.

[0057] Step S104: judging whether the NAT session is legal based on the rule data comparison table and the NAT session table.

[0058] This process can still be executed by the NAT session forwarding module, and the legitimacy of the rule identifier is verified when forwarding traffic, which is used to quickly determine whether the traffic hitting the NAT session is legal, and to clear illegal NAT sessions. When the NAT rules change, it is more efficient to terminate invalid NAT sessions in a timely manner, avoiding the performance loss caused by locking and synchronously updating NAT sessions.

[0059] The present invention proposes a method for asynchronously updating a NAT session when a NAT configuration is changed. The NAT session and the NAT configuration are two types of data, but the NAT session is generated according to the NAT configuration, so the NAT session depends on the NAT configuration, such as: NAT configuration: nat44 subnet add in 192.168.1.0 / 24out100.10.127.100vpc 100; when any VM in the subnet 192.168.1.0 / 24 of vpc 100 accesses the Internet, the address 100.10.127.100 will be shared. At this time, a "port" will be allocated at the L4 layer for ICMP / UDP / TCP packets accessing the Internet (ICMP will allocate instance), and an access record will be generated at the same time: NAT Session:192.168.1.10:2028->100.10.127.100:24008; When the NAT configuration changes, such as changing the output address or deleting the NAT configuration, the NAT session needs to be updated immediately to control the inbound and outbound traffic.

[0060] The usual practice is to synchronously scan all related NAT sessions and actively update them when the NAT configuration changes; or to check whether the NAT configuration has changed and passively update it during forwarding. The former will lock the forwarding data and reduce the forwarding performance, while the latter will not be updated in time and is less efficient due to the reliance on configuration.

[0061] Based on the latter idea, the present invention proposes a method for updating a NAT session response configuration change, which is specifically as follows:

[0062] When a NAT configuration is created or updated, a globally unique rule identifier is generated for it and associated with the rule data comparison table. The incremental method can be used, such as:

[0063] nat44 subnet add in 192.168.1.0 / 24out 100.10.127.100vpc 100<->RuleID:1;

[0064] nat44 subnet add in 192.168.2.0 / 24out 100.10.127.200vpc 200<->RuleID:2;

[0065] When a subnet VM matching the above NAT configuration accesses the Internet for the first time, a rule identification field is added to the NAT session while a NAT session is generated to record the current NAT session dependency rule representation:

[0066] NAT Session:192.168.1.10:2028->100.10.127.100:24008,1;

[0067] When the same traffic accesses the Internet again (or the return traffic from the Internet), the conversion relationship can be directly obtained according to the NAT session. At this time, the present invention adds a new check logic, that is, to check whether the rule identifier recorded in the NAT session table exists. Since the rule data comparison table association has been established for the rule identifier and the NAT configuration in the above, the result can be quickly obtained by searching the rule data comparison table. If the rule identifier does not exist, the NAT session is deleted and the NAT rule is reselected. If the rule identifier exists to determine that the NAT session is legal, the data packet forwarding operation continues.

[0068] The present invention proposes a NAT session response configuration change method, which adopts a loosely coupled implementation method of NAT rules and NAT sessions, and can timely and effectively update NAT sessions when NAT configuration changes, without affecting NAT forwarding. The method not only ensures the lossless operation of the forwarding thread, but also achieves timely update of NAT sessions, and is suitable for NAT session update scenarios of super large specifications of tens of millions or hundreds of millions.

[0069] In some optional implementations, when the NAT rule is changed, updating the rule data comparison table includes:

[0070] When a new NAT rule is added, a new rule identifier is assigned to the new NAT rule, and the new NAT rule and the corresponding rule identifier are added to the rule data comparison table. At the same time, the rule identifier is also recorded in the NAT rule data.

[0071] When updating the NAT rules, delete the NAT rules and corresponding rule identifiers before the update in the rule data comparison table, reallocate new rule identifiers for the updated NAT rules, and add the updated NAT rules and corresponding rule identifiers to the rule data comparison table to update the rule identifiers in the rule data comparison table.

[0072] When deleting a NAT rule, the corresponding NAT rule and rule identifier in the rule data comparison table are deleted.

[0073] This process can still be executed by the rule identification management module, which is used to generate rule identifications for NAT rules and create a rule data comparison table, through which the NAT rules can be quickly located.

[0074] When creating a NAT rule, assign a rule ID to the NAT rule and maintain the global uniqueness of the rule ID. At the same time, add a record to the rule data comparison table, with the rule ID as the hash key and the NAT rule as the hash value. For rule ID assignment, see Figure 2 As shown, the identification number Ra can be stored in U64, and the initial value is set to 0. Specifically, the device generates a globally unique value Ra for the rule identification when it is powered on, and the initial value is 1. When creating or creating a new NAT rule, Ra is obtained as the rule identification, and Ra is incremented by 1, that is, Ra=Ra+1.

[0075] When updating the NAT rule, the rule identifier is reassigned to the NAT rule, and the rule identifier in the original rule data comparison table is deleted, and the new rule identifier is added to the rule data comparison table. That is, when the NAT identifier is updated, a globally unique rule identifier is assigned again and the original rule identifier is replaced.

[0076] When deleting a NAT rule, the rule identifier in the rule data comparison table is deleted. When deleting a NAT rule, the rule identifier is retained (equivalent to the rule identifier being permanently occupied by the rule).

[0077] When all NAT rules are cleared, reset Ra to the boot process (that is, initialize Ra to 1). According to the number of bits supported by the device CPU operation (32 / 64), Ra can be defined as the maximum number of bits supported.

[0078] In this embodiment, when the NAT configuration is deleted or updated, the old rule identifier will be deleted synchronously and deleted from the rule data comparison table, which can ensure that the network traffic is processed according to the new NAT rules to avoid potential conflicts or errors that affect the forwarding of the NAT session.

[0079] In some optional implementations, judging whether the NAT session is legal based on the rule data comparison table and the NAT session table includes:

[0080] When a data packet is received, a search is performed based on the traffic characteristics in the data packet to determine whether there is a NAT session corresponding to the traffic characteristics in the NAT session table.

[0081] When a NAT session corresponding to the traffic feature is found in the NAT session table, a rule identifier corresponding to the NAT session is obtained.

[0082] Check whether the obtained rule identifier exists in the rule data comparison table.

[0083] When the obtained rule identifier exists in the rule data comparison table, it is determined that the NAT session is legal.

[0084] In some optional implementations, when the acquired rule identifier does not exist in the rule data comparison table, the NAT session corresponding to the traffic feature in the NAT session table is deleted, and the NAT rule is reselected to generate a new NAT session.

[0085] In some optional implementations, when it is found that there is no NAT session corresponding to the traffic feature in the NAT session table, a new NAT session is created and stored in the NAT session table.

[0086] The NAT session forwarding module is used to establish the relationship between the NAT session and the rule identifier, and check whether the relationship between the two is legal. Illegal sessions will be deleted. For specific processing, refer to Figure 3 shown.

[0087] When a data packet, i.e., traffic, arrives, the NAT session table is searched based on the traffic characteristics (protocol number + source IP + source port + destination IP + destination port). If there is no record in the NAT session table, this traffic is the first packet traffic, and a NAT session record needs to be created for it and the record rule identification is added to the NAT session.

[0088] If a record is found in the NAT session table, the stored rule identifier is obtained and the rule identifier is used to search in the rule data comparison table. If the rule identifier exists in the rule data comparison table, the NAT session is proven to be legal; otherwise, the record will be deleted from the NAT session.

[0089] In this embodiment, after the first packet is forwarded, subsequent messages can be quickly forwarded based on the NAT session. The present invention focuses on verifying the legitimacy of the NAT session, that is, when the NAT rule is deleted or updated, the NAT session is updated losslessly, that is, when the traffic reaches the NAT session forwarding module, the NAT session mapped by the traffic is searched to check whether the rule identifier recorded therein exists. If the rule identifier is not found, the NAT session needs to be deleted immediately, and then the NAT rule is reselected to generate a new NAT session.

[0090] In this embodiment, the traffic characteristics of the first packet are extracted: such as the five-tuple of protocol number, source IP, source Port, destination IP, and destination Port, and used as hash keys to create a NAT session table, and establish a mapping relationship of hash key 1->hash value 1, where hash key 1 is a five-tuple and hash value 1 is the additional conversion information of the flow. When the NAT session table is created, the converted source IP and source Port addresses are assigned to this traffic and recorded in hash value 1. Therefore, in addition to being forwarded normally through NAT, the first packet also creates a NAT rule comparison table entry synchronously. When a non-first packet arrives, the traffic characteristics are extracted from the non-first packet message again to form hash key 2 (because it is the same flow, hash key 2 == hash value 1), and hash key 2 is used to search in the NAT session table to obtain a hash key 1 table entry equivalent to hash key 2, from which hash value 1 is obtained. According to the conversion relationship recorded in hash value 1, the non-first packet is NAT converted and sent out.

[0091] In this embodiment, a loosely coupled implementation method of NAT rules and NAT sessions is adopted, so that NAT configuration changes do not affect the forwarding of unchanged NAT sessions, and lossless updates of tens of millions of NAT sessions are supported, which not only ensures the continuity of forwarding, but also reduces the possibility of packet loss.

[0092] In some optional implementations, after establishing the NAT session table, the method further includes:

[0093] The NAT session table is traversed based on the preset traversal time and the mark position, and a to-be-checked rule identifier corresponding to the NAT session in the NAT session table is extracted.

[0094] Determine whether the rule identifier to be checked exists in the rule data comparison table.

[0095] When the rule identifier to be checked does not exist in the rule data comparison table, the NAT session corresponding to the rule identifier to be checked in the NAT session table is deleted.

[0096] When the preset traversal time ends, the mark position is updated and the traversal is terminated; or when the traversal ends, the traversal is terminated.

[0097] The above process can be executed by the NAT session timeout module in the server and other devices, which is responsible for regularly clearing invalid NAT sessions. The NAT session forwarding module actively clears invalid sessions based on traffic, that is, it requires traffic input as a trigger condition; it is triggered when the NAT rule identifier changes, and will scan all NAT session rule identifiers to see if they are valid. If they are invalid, they will be deleted.

[0098] The NAT session timeout module is also used to actively delete some invalid NAT sessions.

[0099] Reference Figure 4 As shown in the figure, since the NAT session will not be deleted actively when the NAT rule is deleted or updated, the loose coupling between the NAT rule and the NAT session is realized. The NAT session timeout module will conditionally trigger the clearing of invalid NAT sessions. The processing method is as follows Figure 5 shown.

[0100] Traverse the NAT session table from the marked position and read each NAT session data one by one; take out the rule identifier of the NAT session data record, check whether the rule identifier is in the rule data comparison table, if not, delete the current NAT session; if it exists, update the marked position. If the traversal time reaches the preset traversal time (such as 100us), terminate the traversal and add the timeout module to the scheduling list; if the traversal is completed, terminate the timeout module scheduling.

[0101] In the present embodiment, the NAT session timeout module adopts the segment scanning technology, while ensuring that the invalid NAT session is continuously deleted, it avoids the long-term locking of the NAT session and causes the NAT forwarding module to pause, thereby ensuring the line speed of the forwarding module. In addition, in the present embodiment, in order to ensure the rapid deletion of the NAT session, the present invention adds a rule identification checking mechanism to the original NAT session timeout timer, and when the NAT session times out, or the rule identification does not exist, the session can be deleted. That is, the NAT session active update and passive update mode are realized, wherein the active update ensures that the NAT session is not over-forwarded (the flow is terminated in time), and the passive update clears the invalid memory occupation, thereby ensuring the health of the system.

[0102] In this embodiment, a loose coupling relationship between NAT rules and NAT sessions is achieved, so that when NAT rules are changed, there is no need to synchronously delete NAT sessions, ensuring stable updates of NAT rules in the scenario of networking with tens of millions of NAT sessions. In addition, the NAT configuration delivery time is not affected by the scale of NAT sessions, supporting rapid configuration changes, and no blocking of configuration interfaces or control planes.

[0103] In this embodiment, a NAT session response configuration change system is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0104] This embodiment provides a NAT session response configuration change system. The processing flow of the system is as follows: Figure 6 As shown, the system includes:

[0105] The rule identifier management module is used to establish a rule identifier for each created NAT rule; it is also used to establish a rule data comparison table based on the NAT rules and the corresponding rule identifiers, and to update the rule data comparison table when the NAT rules are changed. This includes: in the case of adding a new NAT rule, assigning a new rule identifier to the newly added NAT rule, and adding the newly added NAT rule and the corresponding rule identifier to the rule data comparison table; in the case of updating the NAT rule, deleting the NAT rule and the corresponding rule identifier before the update in the rule data comparison table, and reallocating a new rule identifier to the updated NAT rule, and adding the updated NAT rule and the corresponding rule identifier to the rule data comparison table; in the case of deleting the NAT rule, deleting the corresponding NAT rule and rule identifier in the rule data comparison table.

[0106] The NAT session forwarding module is used to add a rule identifier corresponding to the NAT rule when generating a NAT session according to the NAT rule, and to establish a NAT session table; it is also used to determine whether the NAT session is legal based on the rule data comparison table and the NAT session table. This includes: when a data packet is received, according to the traffic characteristics in the data packet, searching whether there is a NAT session corresponding to the traffic characteristics in the NAT session table; when a NAT session corresponding to the traffic characteristics is found in the NAT session table, obtaining the rule identifier corresponding to the NAT session; searching whether there is an obtained rule identifier in the rule data comparison table; when the obtained rule identifier exists in the rule data comparison table, determining that the NAT session is legal. When the obtained rule identifier does not exist in the rule data comparison table, deleting the NAT session corresponding to the traffic characteristics in the NAT session table, and reselecting the NAT rule to generate a new NAT session. When it is found that there is no NAT session corresponding to the traffic characteristics in the NAT session table, creating a new NAT session and storing it in the NAT session table.

[0107] The NAT session timeout module is used to traverse the NAT session table based on the preset traversal time and the mark position, extract the to-be-checked rule identifier corresponding to the NAT session in the NAT session table; determine whether the to-be-checked rule identifier exists in the rule data comparison table; if the to-be-checked rule identifier does not exist in the rule data comparison table, delete the NAT session corresponding to the to-be-checked rule identifier in the NAT session table; when the preset traversal time ends, update the mark position and terminate the traversal; or terminate the traversal when the traversal ends.

[0108] The NAT session response configuration change system in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0109] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0110] The embodiment of the present invention further provides a computer device having the above-mentioned NAT session response configuration change system.

[0111] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the computer device includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other, and can be installed on a common mainboard or installed in other ways as required. The processor can process the instructions executed in the computer device, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output system (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0112] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0113] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0114] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0115] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0116] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0117] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0118] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0119] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for changing a NAT session response configuration, characterized in that: The method comprises: Create a rule identifier for each NAT rule created; Based on the NAT rule and the corresponding rule identifier, establish a rule data comparison table, and update the rule data comparison table when the NAT rule changes; When generating a NAT session according to the NAT rule, adding the rule identifier corresponding to the NAT rule, and establishing a NAT session table; Based on the rule data comparison table and the NAT session table, it is determined whether the NAT session is legal.

2. The method according to claim 1, characterized in that When the NAT rule is changed, updating the rule data comparison table includes: In the case of adding a new NAT rule, assigning a new rule identifier to the newly added NAT rule, and adding the newly added NAT rule and the corresponding rule identifier to the rule data comparison table; In the case of updating the NAT rule, deleting the NAT rule and the corresponding rule identifier before the update in the rule data comparison table, reallocating a new rule identifier for the updated NAT rule, and adding the updated NAT rule and the corresponding rule identifier to the rule data comparison table; When deleting a NAT rule, the corresponding NAT rule and rule identifier in the rule data comparison table are deleted.

3. The method according to claim 1, characterized in that The determining whether the NAT session is legal based on the rule data comparison table and the NAT session table includes: When a data packet is received, searching the NAT session table for a NAT session corresponding to the traffic feature according to the traffic feature in the data packet; In the case where a NAT session corresponding to the traffic feature is found in the NAT session table, obtaining a rule identifier corresponding to the NAT session; Searching whether the rule identifier obtained exists in the rule data comparison table; When the obtained rule identifier exists in the rule data comparison table, it is determined that the NAT session is legal.

4. The method according to claim 3, characterized in that In the case that the obtained rule identifier does not exist in the rule data comparison table, the NAT session corresponding to the traffic feature in the NAT session table is deleted, and a NAT rule is reselected to generate a new NAT session.

5. The method according to claim 3, characterized in that: When it is found that there is no NAT session corresponding to the traffic feature in the NAT session table, a new NAT session is created and stored in the NAT session table.

6. The method according to claim 1, characterized in that After the NAT session table is established, the method further includes: Traversing the NAT session table based on a preset traversal time and a mark position, extracting a to-be-checked rule identifier corresponding to the NAT session in the NAT session table; Determine whether the to-be-checked rule identifier exists in the rule data comparison table; In the case where the to-be-checked rule identifier does not exist in the rule data comparison table, deleting the NAT session corresponding to the to-be-checked rule identifier in the NAT session table; When the preset traversal time ends, the mark position is updated and the traversal is terminated; or when the traversal ends, the traversal is terminated.

7. A NAT session response configuration change system, characterized in that: The system comprises: A rule identifier management module, used to establish a rule identifier for each created NAT rule; and also used to establish a rule data comparison table based on the NAT rule and the corresponding rule identifier, and update the rule data comparison table when the NAT rule changes; The NAT session forwarding module is used to add the rule identifier corresponding to the NAT rule when generating a NAT session according to the NAT rule, and establish a NAT session table; it is also used to determine whether the NAT session is legal based on the rule data comparison table and the NAT session table.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the NAT session response configuration change method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the NAT session response configuration change method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the NAT session response configuration changing method according to any one of claims 1 to 6.

Images