System and method for analyzing source address of cloud network client

Abstract

The invention relates to the technical field of cloud network information, and discloses a system and a method for analyzing a source address of a cloud network client, the system comprises a client, a cloud gateway end and a server, the client sends an access request, the cloud gateway carries out Full NAT on the request, and the client sends the access request to the server; the cloud gateway performs conversion according to the IP address of the client in the connection tracking session to obtain an MAC address for generating an OVS flow table for modifying the source MAC address, the OVS flow table modifies the source MAC address of the request and forwards the modified source MAC address to the server, and the server performs inverse operation on the source MAC address in the request to obtain the IP address of the client. In the embodiment of the invention, the gateway does not need to be developed greatly, the development cost is reduced, protocol limitation is not needed when the server obtains the real IP address of the client, and the suitability of various protocols is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud network information technology, and in particular to a system and method for resolving a source address of a cloud network client. Background Art

[0002] In the related technology, the cloud network has a cloud gateway that performs Full NAT and forwards the access request from the client to the server. After the client IP is forwarded by the cloud gateway, the server can only see the address of the SNAT pool on the corresponding gateway and cannot know the real client IP address (source address). However, in some business scenarios, the server needs to know the real client IP address accessing the service.

[0003] There are two solutions in the current prior art. The first one is that when the service is the seven-layer http protocol, the seven-layer load balancing (such as nginx) is used to carry the client IP in the x-forward-for method. However, this solution requires that the service must be of http service type, and the XFF solution depends on the seven-layer load balancer. The middleware needs to be configured on the server side to pass the XFF header, and the development cost is high. The second one is that when the service is the IPv4TCP protocol, TOA can be used, and the corresponding cloud network gateway needs to be secondary developed to support TOA encapsulation, and the TOA module needs to be loaded on the Linux server side to obtain information, which has a high development cost.

[0004] The above existing solutions can obtain the client's real IP address in specific scenarios, but are only applicable to specific protocols (HTTP or TCP). At a low development cost, they cannot adapt to the needs of all other protocol business scenarios when obtaining the client's real IP address. Summary of the invention

[0005] In view of this, the present invention provides a cloud network client source address resolution system and method to solve the need of effectively adapting to various protocol business scenarios when obtaining the client's real IP address while ensuring low development costs.

[0006] In a first aspect, the present invention provides a cloud network client source address resolution system, the system comprising a client, a cloud gateway, and a server;

[0007] The client is used to generate an access request to the server and send it to the cloud gateway.

[0008] The cloud gateway is used to receive the access request sent by the client, and perform Full NAT processing based on the access request to determine whether there is a target connection tracking session matching the access request in the connection tracking session list; wherein the connection tracking session list is used to store multiple connection tracking sessions that have been generated when the client has historically accessed the server; if not, a connection tracking session is generated according to the access request, and OVS flow table information is generated according to the connection tracking session, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server; wherein the connection tracking session includes the IP address of the client, and the generation of OVS flow table information according to the connection tracking session specifically includes: according to a preset address identification data conversion rule, the IP address of the client in the connection tracking session is converted to obtain the converted MAC address, matching and storing it in the modified source MAC address field in the OVS flow table, and generating OVS flow table information for modifying the source MAC address; if it exists, the generated connection tracking session and OVS flow table information are used, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server;

[0009] The server is used to receive and parse the modified access request, and perform an inverse operation on the source MAC address in the access request according to a preset parsing rule to obtain the IP address of the client.

[0010] The cloud network client source address resolution system provided by the embodiment of the present invention creates a connection tracking session based on the client access request at the cloud gateway end, converts the client IP address into a MAC address according to the preset address identification data conversion rule to generate an OVS flow table for modifying the source MAC address, forwards the source MAC address in the OVS flow table modification request to the server end, and then the server end performs inverse operation according to the preset resolution rule to restore the client IP address. The technical solution avoids the technical defects in the related technology that the HTTP protocol needs to be configured with nginx load balancing to transmit XFF header information, and the TCP protocol requires the gateway and the server end to perform secondary development. It is only necessary to generate flow table information based on the OVS infrastructure at the cloud gateway end, without a large amount of customized development of the gateway, and the server end only needs to perform inverse operation to resolve the source address according to the preset rules, which greatly reduces the development cost. At the same time, since the server resolution process does not depend on the specific data transmission protocol, the data in the data packet can be directly parsed, so while ensuring low development costs, it also achieves protocol independence and significantly improves the system's protocol adaptation capability.

[0011] In a second aspect, the present invention provides a method for resolving a source address of a cloud network client, which is applied to a cloud gateway end of a system for resolving a source address of a cloud network client, comprising:

[0012] Receive the access request sent by the client, perform Full NAT processing based on the access request, and determine whether there is a target connection tracking session matching the access request in the connection tracking session list; wherein the connection tracking session list is used to store multiple connection tracking sessions that have been generated when the client has historically accessed the server;

[0013] If it does not exist, a connection tracking session is generated according to the access request, and OVS flow table information is generated according to the connection tracking session, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server; wherein the connection tracking session includes the IP address of the client, and generating the OVS flow table information according to the connection tracking session specifically includes: according to a preset address identification data conversion rule, the IP address of the client in the connection tracking session is converted to obtain the converted MAC address, matching and storing it in the modified source MAC address field in the OVS flow table, and generating OVS flow table information for modifying the source MAC address;

[0014] If it exists, the generated connection tracking session and OVS flow table information are used, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server.

[0015] The embodiment of the present invention intelligently avoids the process of repeatedly creating connection sessions by judging whether there is a matching target connection tracking session in the connection tracking session list. When there is no matching session, the system generates a new connection tracking session according to the access request and generates OVS flow table information accordingly, ensuring the accuracy and timeliness of the flow table information; and when there is a matching session, the existing session and the existing OVS flow table information are directly used, which greatly shortens the processing time. In addition, the method modifies the source MAC address of the request in the generated OVS flow table and forwards it to the server, which not only simplifies the gateway development process and reduces the complexity of secondary development, but also gets rid of the dependence on specific communication protocols, greatly reducing development costs. More importantly, since the generation of flow table information is not limited to a specific protocol type, compared with the XFF or TOA solutions of the related technology, the present invention exhibits stronger protocol compatibility and can widely support a variety of business scenarios, thereby effectively improving the protocol adaptability of address resolution at a low development cost.

[0016] In an optional implementation, the connection tracking session also includes a protocol, a source IP address, a destination IP address, source port information, and destination port information, and generating OVS flow table information according to the connection tracking session specifically includes:

[0017] Matching the access protocol information in the connection tracking session with the network protocol field in the OVS flow table, and storing the access protocol information in the network protocol field;

[0018] Matching the source IP address in the connection tracking session with the source network address field in the OVS flow table, and storing the source IP address in the source network address field;

[0019] Match the destination IP address in the connection tracking session with the destination network address field in the OVS flow table, and store the destination IP address in the destination network address field;

[0020] Matching the source port information in the connection tracking session with the source port field in the OVS flow table, and storing the source port information in the source port field;

[0021] The destination port information in the connection tracking session is matched with the destination port field in the OVS flow table, and the destination port information is stored in the destination port field.

[0022] In the embodiment of the present invention, the connection tracking session also includes access protocol, source IP address, destination IP address, source port and destination port information. The various information in the connection tracking session are matched and stored with the corresponding fields in the OVS flow table. A unified data processing method is provided through preset address identification data conversion rules, which reduces the development cost of the data parsing module and ensures the security of the source address data.

[0023] In an optional implementation manner, performing data conversion on the IP address of the client in the connection tracking session according to a preset address identification data conversion rule specifically includes:

[0024] Convert the first base type data in the IP address of the client into a base type to obtain the second binary type data;

[0025] The first binary type data is combined according to the first preset address data combination rule to obtain a converted MAC address, which is matched and stored in the modified source MAC address field in the OVS flow table.

[0026] The embodiment of the present invention converts the first base type data in the IP address of the client into the second binary type data, and combines them according to the first preset address data combination rule, hides the original data through base conversion, and combines them according to the first preset address data combination rule, which can not only ensure data security but also make it easy for the server to parse, thereby greatly reducing the development cost.

[0027] In a third aspect, the present invention provides a method for resolving a source address of a cloud network client, which is applied to a server of a system for resolving a source address of a cloud network client, comprising:

[0028] The modified access request is received and parsed, and the source MAC address in the access request is inversely calculated according to a preset parsing rule to obtain the IP address of the client.

[0029] The embodiment of the present invention receives and parses the request sent by the cloud gateway on the server side, and performs inverse operation on the data storage format of the source network address field in the data packet according to the preset storage rules, thereby achieving accurate restoration of the client source address. Since it does not rely on a specific protocol or module, it reduces the development complexity of the server side, and can also adapt to various business scenario requirements, thereby improving the protocol adaptability of address resolution.

[0030] In an optional implementation, the receiving and parsing the modified access request, and performing an inverse operation on the source MAC address in the access request according to a preset parsing rule to obtain the IP address of the client, specifically includes:

[0031] Extract the binary type data of the source MAC address in the access request;

[0032] The first binary type data is converted into a binary system to obtain a first binary type data, and the first binary type data is combined according to a second preset address data combination rule to obtain the IP address of the client.

[0033] The embodiment of the present invention extracts the binary type data of the source MAC address, converts it into the first type data, and combines it according to the second preset address data combination rule, which corresponds to the address conversion process of the cloud gateway. No matter what protocol or format of the address information, the real client IP address can be accurately restored through base conversion and inverse conversion, thereby avoiding the problem of needing to develop different resolution modules for different protocols in the related process and improving the adaptability of address resolution.

[0034] In a fourth aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method for resolving the source address of a cloud network client in the second aspect or the third aspect and any corresponding implementation manner thereof by executing the computer instructions.

[0035] In a fifth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for resolving a cloud network client source address of the second aspect or the third aspect and any corresponding implementation manner thereof.

[0036] In a sixth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the method for resolving a cloud network client source address of the second aspect or the third aspect and any corresponding implementation manner thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 is a structural block diagram of a cloud network client source address resolution system according to an embodiment of the present invention;

[0039] Figure 2 It is a flowchart of a method for resolving a source address of a cloud network client applied to a cloud gateway according to an embodiment of the present invention;

[0040] Figure 3 It is a CTF plug-in session flow transfer representation schematic diagram of a cloud network client source address resolution method according to an embodiment of the present invention;

[0041] Figure 4 It is a flow chart of a method for resolving a source address of a cloud network client applied to a server according to an embodiment of the present invention;

[0042] Figure 5 It is a schematic diagram of a specific application scenario of a cloud network client source address resolution system according to an embodiment of the present invention;

[0043] Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0045] Based on the two address resolution methods mentioned in the background technology, the following two examples are given:

[0046] (1) For the http protocol, use load balancing settings and enable the X-Forwarded-For function in the Nginx configuration so that the transmitted data packets carry the client IP address. However, when the server obtains the client IP, a separate parsing module needs to be developed, and the X-Forwarded-For function is only valid for data transmission of the http protocol.

[0047] (2) Use the TOA (TCP Option Address) solution for the TCP protocol. Enable TOA support on the load balancer side and install the TOA kernel module on the server side. This solution can only be used for the TCP protocol, and the development cost is also high.

[0048] In summary, the above two solutions are only for packets of specific protocols and relatively limited environments, and do not have the ability to obtain the real source IP addresses of all IPv4 business packets.

[0049] Therefore, the embodiment of the present invention provides a cloud network client source address resolution system, which can refer to Figure 1 , including client 1, cloud gateway 2 and server 3;

[0050] Among them, the client 1 is used to generate an access request to the access server and send it to the cloud gateway;

[0051] The cloud gateway 2 is used to receive the access request sent by the client, and perform Full NAT processing based on the access request to determine whether there is a matching target connection tracking session in the connection tracking session list; wherein the connection tracking session list is used to store multiple connection tracking sessions that have been generated when the client has historically accessed the server; if not, a connection tracking session is generated according to the access request, and OVS flow table information is generated according to the connection tracking session; wherein the connection tracking session includes the IP address of the client, and generating the OVS flow table information according to the connection tracking session specifically includes: according to the preset address identification data conversion rule, the IP address of the client in the connection tracking session is converted to obtain the converted MAC address, which is matched and stored in the modified source MAC address field in the OVS flow table, and the OVS flow table information of the modified source MAC address is generated; if it exists, the generated connection tracking session and OVS flow table information are used; the OVS flow table modifies the request source MAC address and forwards it to the server;

[0052] The server 3 is used to receive and parse the request for OVS flow table information processing, and perform inverse operation on the source MAC address in the request according to the preset parsing rules to obtain the IP address of the client.

[0053] It should be noted that the connection tracking session refers to the NAT conntrack session, which is used to record and track the connection status during the network address translation process; the connection tracking session list is used to store the session records generated when the client accesses the server, ensuring that the NAT device can accurately forward data packets; the OVS flow table is a set of rules that control data packet forwarding, which contains multiple flow rules that define matching conditions and corresponding actions; the access request specifically refers to the business data packet of the client accessing the cloud gateway service IP address, such as the data packet of the client 192.168.10.30 accessing the cloud gateway service IP 192.168.10.10 and port 80.

[0054] Specifically, the client can be a terminal device or a user host; the cloud gateway can be a Full-NAT cloud gateway equipped with a CTF plug-in; the server can be a server or a virtual machine VM. The main functions of each entity are: the client generates an access request through the TCP / IP protocol stack; the cloud gateway monitors the NAT conntrack session through the CTF plug-in and converts it into OVS flow table information; the server performs inverse operations through preset mapping rules to achieve source address resolution.

[0055] Exemplarily, the various interaction processes of a cloud network client source address resolution system are as follows: the client sends an access request → the cloud gateway generates a NAT conntrack session → the CTF plug-in monitors the new session and converts it into an OVS flow table → the data packet modifies the source MAC address through the OVS matching flow table → performs overlay encapsulation and sends it to the server → the server resolves the source MAC address to obtain the real source IP.

[0056] It is understandable that by deploying the CTF plug-in on the cloud gateway, the conversion from the NAT conntrack session to the OVS flow table is realized, and the real IP information of the client is transmitted by modifying the source MAC address of the data packet. This method makes full use of the flexibility of the OVS flow table and the convertible characteristics of the MAC address, and effectively avoids the dependence on the communication protocol in the relevant technical solutions.

[0057] The cloud network client source address resolution system provided by the embodiment of the present invention creates a connection tracking session based on the client access request at the cloud gateway end, converts the client IP address into a MAC address according to the preset address identification data conversion rule and stores it in the OVS flow table, modifies the source MAC address in the request through the OVS flow table, and then the server performs inverse operation according to the preset resolution rule to restore the client IP address. The technical solution avoids the technical defects in the related technology that the HTTP protocol needs to be configured with nginx load balancing to transmit XFF header information, and the TCP protocol requires the gateway and the server to perform secondary development. It is only necessary to generate flow table information based on the OVS infrastructure at the cloud gateway end, without a large amount of customized development of the gateway, and the server only needs to perform inverse operation to resolve the source address according to the preset rules, which greatly reduces the development cost. At the same time, since the server resolution process does not depend on the specific data transmission protocol, the data in the data packet can be directly parsed. Therefore, while ensuring low development costs, it also achieves protocol independence and significantly improves the system's protocol adaptation capability.

[0058] In this embodiment, a method for resolving a cloud network client source address is provided, which can be used for a cloud gateway in the above-mentioned cloud network client source address resolution system. Figure 2 is a flow chart of a method for resolving a source address of a cloud network client according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0059] Step S201: receiving an access request from a client to access a server.

[0060] Step S202, performing Full NAT processing based on the access request, determining whether there is a matching target connection tracking session in the connection tracking session list; wherein the connection tracking session list is used to store multiple connection tracking sessions that have been generated when the client has historically accessed the server.

[0061] Exemplarily, the access request for accessing the server in step S201 may include address information, port information and protocol information, and in step S202, the currently maintained connection tracking session list is traversed to find out whether there is a matching target connection tracking session.

[0062] Specifically, in step S202, two pieces of information need to be compared when matching: (1) comparing whether the address information is the same; (2) comparing whether the protocol information is the same; and (3) comparing whether the port information is the same. Only when all three conditions are met, it is considered that a matching target connection tracking session is found, wherein the status and validity period of the existing session are checked. If the found session has timed out or is in an invalid state, it is determined that no matching session is found.

[0063] Step S203, if it does not exist, generate a connection tracking session according to the access request, generate OVS flow table information according to the connection tracking session, modify the source MAC address in the access request according to the OVS flow table information and forward it to the server; wherein, the connection tracking session includes the IP address of the client, and generating OVS flow table information according to the connection tracking session specifically includes: according to the preset address identification data conversion rule, converting the IP address of the client in the connection tracking session to obtain the converted MAC address, matching and storing it in the modified source MAC address field in the OVS flow table, and generating OVS flow table information for modifying the source MAC address.

[0064] Specifically, when the judgment result is that there is no matching connection tracking session, the cloud gateway will create a new connection tracking session based on the current access request, including: assigning a session ID; recording the session creation time; setting the session timeout; saving the address information, port information and protocol information to initialize the session state, and obtain a session record. After that, the cloud gateway calls the CTF plug-in to convert the newly created connection tracking session information into OVS flow table information.

[0065] Furthermore, according to the preset address identification data conversion rule, the IP address of the client in the connection tracking session is converted into data, specifically including: converting the first base type data in the IP address of the client to obtain the second binary type data; combining the second binary type data according to the first preset address data combination rule to obtain the converted MAC address, matching and storing it in the modified source MAC address field in the OVS flow table.

[0066] Exemplarily, the data of the client's IP address itself is a decimal number, and is transmitted in the form of a binary number during the forwarding process. The 32-bit binary data of the client's IP address is divided into four 8-bit binary fields; the four 8-bit binary fields are converted into corresponding hexadecimal data respectively to obtain 8 hexadecimal numbers; 4 fixed hexadecimal numbers are added before the 8 hexadecimal numbers to obtain 12 hexadecimal numbers; the 12 hexadecimal numbers are separated by colons every two digits to obtain data in the MAC address format as the converted MAC address.

[0067] In actual application, the rules of CTF based on the conversion of the IP address of the real client into the MAC address include: the IP address of the client IPv4 address is 32 bits binary, divided into four 8-bit binary fields, each field is converted into the corresponding hexadecimal, that is, 8 hexadecimal numbers are shared. The MAC address is 48 bits binary, divided into 12 hexadecimal numbers, so the IPv4 address and the MAC address differ by 4 numbers in hexadecimal, and the 8 hexadecimal numbers of IPv4 are used as the last 8 hexadecimal numbers of the MAC address. The first 4 hexadecimal numbers of the MAC address are fixed numbers, such as: 88:88, and the hexadecimal numbers are separated by colons. Then, the IPv4 address can be converted into the corresponding MAC address in this way. For example, the IPv4 address 192.168.0.1 is converted into a MAC address in the manner of the fixed first 4 bits of MAC being 88:88, 192 is converted into C0, 168 is converted into A8, 0 is converted into 00, and 1 is converted into 01. The final converted MAC address is 88:88:C0:A8:00:01, which is the modified MAC address.

[0068] The embodiment of the present invention converts the first base type data in the IP address of the client into the second binary type data, and combines them according to the first preset address data combination rule, hides the original data through base conversion, and combines them according to the first preset address data combination rule, which can not only ensure data security but also make it easy for the server to parse, thereby greatly reducing the development cost.

[0069] Step S204: If it exists, use the generated connection tracking session and OVS flow table information, modify the source MAC address in the access request according to the OVS flow table information, and forward it to the server.

[0070] Similarly, the cloud gateway calls the CTF plug-in to convert the target connection tracking session information into OVS flow table information.

[0071] Specifically, the OVS flow table's processing of data packets includes: modifying the source MAC address of the forwarding request packet, adding overlay network encapsulation to the forwarding request packet so that the packet can be correctly transmitted in the overlay network, setting the packet priority and QoS parameters, selecting the target forwarding path according to the network structure, and sending the encapsulated data packet to the server through the target forwarding path.

[0072] The embodiment of the present invention intelligently avoids the process of repeatedly creating connection sessions by judging whether there is a matching target connection tracking session in the connection tracking session list. When there is no matching session, the system generates a new connection tracking session according to the access request and generates OVS flow table information accordingly, ensuring the accuracy and timeliness of the flow table information; and when there is a matching session, the existing session and the existing OVS flow table information are directly used, which greatly shortens the processing time. In addition, the method modifies the source MAC address of the request in the generated OVS flow table and forwards it to the server, which not only simplifies the gateway development process and reduces the complexity of secondary development, but also gets rid of the dependence on specific communication protocols, greatly reducing development costs. More importantly, since the generation of flow table information is not limited to a specific protocol type, compared with the XFF or TOA solutions of the related technology, the present invention exhibits stronger protocol compatibility and can widely support a variety of business scenarios, thereby effectively improving the protocol adaptability of address resolution at a low development cost.

[0073] In this embodiment, a method for resolving a cloud network client source address is provided, which can be used for a cloud gateway in the above-mentioned cloud network client source address resolution system. The process includes the following steps:

[0074] Step S301: Receive an access request sent by a client. Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0075] Step S302: Perform Full NAT processing based on the access request to determine whether there is a matching target connection tracking session in the connection tracking session list; wherein the connection tracking session list is used to store multiple connection tracking sessions that have been generated when the client has historically accessed the server. For details, see Figure 2 Step S202 of the illustrated embodiment will not be described in detail here.

[0076] Step S303: if it does not exist, a connection tracking session is generated according to the access request, and OVS flow table information is generated according to the connection tracking session, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server; wherein, the connection tracking session includes the IP address of the client, and generating the OVS flow table information according to the connection tracking session specifically includes: according to the preset address identification data conversion rule, the IP address of the client in the connection tracking session is converted to obtain the converted MAC address, which is matched and stored in the modified source MAC address field in the OVS flow table, and the OVS flow table information for modifying the source MAC address is generated.

[0077] The connection tracking session also includes the access protocol, source IP address, destination IP address, source port and destination port information, which are all used to characterize the bidirectional channel path information between the client and the server during the request process and the access process.

[0078] It should be noted that the source port and destination port information refer to the source port and destination port used when the client and server communicate, and the bidirectional channel path port information of the client and server in the request process and the access process refers to the source port and destination port information used when the client accesses the server and the server responds to the client. If the directions are different, the port information needs to be swapped.

[0079] Exemplarily, a complete connection tracking session is as follows: tcp 6 95TIME_WAIT src=192.168.10.30, dst=192.168.10.10, sport=35312, dport=80, src=172.16.0.10, dst=10.10.10.23, sport=80, dport=35312, [ASSURED] mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1.

[0080] Among them, tcp 6 95TIME_WAIT indicates the TCP protocol, and the connection is in the TIME_WAIT state. The session information of the request data packet from the client to the cloud gateway includes src=192.168.10.30 indicating the initial source address, dst=192.168.10.10 indicating the initial destination address, sport=35312 indicating the initial source port, and dport=80 indicating the initial destination port. The session information of the return data packet from the server to the cloud gateway (opposite to the direction from the gateway to the server) includes src=172.16.0.10 indicating the destination IP address after NAT translation, dst=10.10.10.23 indicating the source IP address after NAT translation, sport=80 indicating the destination port after NAT translation, and dport=35312 indicating the source port after NAT translation.

[0081] In a specific embodiment, the OVS flow table information generated according to the connection tracking session in step S303 also includes the protocol, source IP address, destination IP address, source port information and destination port information; the OVS flow table information is generated according to the connection tracking session, that is, the access protocol, source IP address, destination IP address, source port and destination port are matched through preset OVS flow table fields to generate the OVS flow table information.

[0082] Specifically, the OVS flow table information is generated by matching the access protocol, source IP address, destination IP address, source port, and destination port through the preset OVS flow table fields, including:

[0083] a1, match the access protocol information in the connection tracking session with the network protocol field in the OVS flow table, and store the access protocol information in the network protocol field;

[0084] a2, match the source IP address in the connection tracking session with the source network address field in the OVS flow table, and store the source IP address in the source network address field;

[0085] a3. Match the destination IP address in the connection tracking session with the destination network address field in the OVS flow table, and store the destination IP address in the destination network address field;

[0086] a4, matching the source port information in the connection tracking session with the source port field in the OVS flow table, and storing the source port information in the source port field;

[0087] a5, match the destination port information in the connection tracking session with the destination port field in the OVS flow table, and store the destination port information in the destination port field.

[0088] In the embodiment of the present invention, the connection tracking session also includes access protocol, source IP address, destination IP address, source port and destination port information. The various information in the connection tracking session are matched and stored with the corresponding fields in the OVS flow table. A unified data processing method is provided through preset address identification data conversion rules, which reduces the development cost of the data parsing module and ensures the security of the source address data.

[0089] For example, see Figure 3, the CTF plug-in converts the newly generated NAT conntrack information into the OVS flow table according to the rules in real time and sends it to OVS for matching the service data packets from the cloud gateway to the server. CTF converts the TCP protocol in NATconntrack into nw_proto=6 in the OVS flow table; CTF generates a MAC address of 88:88:C0:A8:0A:1E based on the original source IP address 192.168.10.30 in NAT conntrack according to the fixed first 4 bits of MAC as 88:88, and the last 8 bits are converted by IPv4 address, and the MAC address is injected into the mod_dl_src:88:88:C0:A8:0A:1E in the generated OVS flow table action to modify the source MAC address in the service data packet; CTF converts the source IP address src=172.16.0.10 in the back-end reverse matching information of NAT conntrack into the destination IP address matching nw_dst=172.16.0.10 in the OVS flow table; CTF is based on NAT The destination IP address dst=10.10.10.23 in the backend reverse matching information in conntrack is converted into the source IP address match nw_src=10.10.10.23 in the OVS flow table; the source port port port=80 in the backend reverse matching information in CTF based on NATconntrack is converted into the destination port match tp_dst=80 in the OVS flow table; the destination port dport=35312 in the backend reverse matching information in NATconntrack is converted into the source port match tp_src=35312 in the OVS flow table.

[0090] For example, a complete OVS flow table information after conversion is as follows: ovs-ofctl add-flow table=0ovs-bridge ip,in_port=1,nw_src=10.10.10.23,nw_dst=172.16.0.10,nw_proto=6,tp_src=35312,tp_dst=80,actions=mod_dl_src:88:88:C0:A8:0A:1E,goto_table=1;

[0091] Among them, ovs-ofctl add-flow table = 0ovs-bridge ip indicates the flow table bridge prefix information, which is a fixed value, in_port = 1 indicates that the data packet enters from port 1, nw_src = 10.10.10.23 indicates that the matching source IP address is 10.10.10.23, nw_dst = 172.16.0.10 indicates that the matching destination IP address is 172.16.0.10, nw_proto = 6 indicates that the TCP protocol is matched (the number corresponding to the protocol is 6), and tp_src = 35312 indicates that the matching source The port is 35312, tp_dst=80 means matching the destination port 80, actions=mod_dl_src:88:88:C0:A8:0A:1E, goto_table=1 means executing the action to modify the source MAC address to 88:88:C0:A8:0A:1E, and then jumping to the table labeled 1 to continue processing. Jumping to the table labeled 1 is for the subsequent adaptive overlay encapsulation of the data packet and then forwarding it to the server.

[0092] Step S304: If it exists, use the generated connection tracking session and OVS flow table information, modify the source MAC address in the access request according to the OVS flow table information, and forward it to the server.

[0093] Similarly, step S304 generates OVS flow table information according to the target connection tracking session. Please refer to the specific steps in step S304 and no further details will be given.

[0094] This embodiment provides a method for resolving a cloud network client source address, which is applied to the server of the cloud network client source address resolution system. Figure 4 is a flow chart of a method for resolving a source address of a cloud network client according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps:

[0095] Step S401, receiving and parsing the modified access request.

[0096] Step S402: Perform an inverse operation on the source MAC address in the access request according to a preset parsing rule to obtain the IP address of the client.

[0097] Specifically, step S402 includes:

[0098] Step S4021, extracting the binary type data of the source MAC address in the access request;

[0099] Step S4022, converting the first binary type data into first type data, combining the first type data according to the second preset address data combination rule to obtain the IP address of the client.

[0100] Exemplarily, extract the last 8 hexadecimal digits of the source MAC address of the data packet; convert the last 8 hexadecimal digits into four 8-bit binary fields in groups of two; convert the four 8-bit binary fields into decimal numbers to obtain four decimal numbers; separate the four decimal numbers with periods to obtain the IP address of the client.

[0101] In actual application, the rules for the server to convert the received MAC address back to the IPv4 address include: the received MAC address is 48 bits binary, divided into 12 hexadecimal numbers. The IPv4 address is 32 bits binary, divided into four 8-bit binary fields, each field is converted into the corresponding hexadecimal, that is, 8 hexadecimal numbers are shared. Since the first 4 hexadecimal numbers of the MAC address are fixed, such as 88:88, only the last 8 hexadecimal numbers of the MAC address are extracted for conversion. The last 8 hexadecimal numbers of the source MAC address of the data packet are extracted. For example, assuming that the received MAC address is 88:88:C0:A8:00:01, the last 8 hexadecimal numbers extracted are C0:A8:00:01, and the last 8 hexadecimal numbers are converted into four 8-bit binary fields in groups of two, and the four 8-bit binary fields are converted into decimal numbers. The four decimal numbers are separated by periods to obtain the client's IP address, that is, 192.168.0.1.

[0102] It is understandable that no matter what conversion method is adopted by the cloud gateway, the server only needs to perform analysis using the inverse operation according to the forward conversion process, which simplifies the analysis process on the server side and reduces development costs.

[0103] The embodiment of the present invention receives and parses the request sent by the cloud gateway on the server side, and performs inverse operation on the data storage format of the source network address field in the data packet according to the preset storage rules, thereby achieving accurate restoration of the client source address. Since it does not rely on a specific protocol or module, it reduces the development complexity of the server side, and can also adapt to various business scenario requirements, thereby improving the protocol adaptability of address resolution.

[0104] The embodiment of the present invention extracts the binary type data of the source MAC address, converts it into the first type data, and combines it according to the second preset address data combination rule, which corresponds to the address conversion process of the cloud gateway. No matter what protocol or format of the address information, the real client IP address can be accurately restored through base conversion and inverse conversion, thereby avoiding the problem of needing to develop different resolution modules for different protocols in the related process and improving the adaptability of address resolution.

[0105] In a certain application scenario, you can refer to Figure 5 ,The resolution system of the source address of the cloud network client includes the ,client, gateway physical server (cloud gateway end), and KVM physical server (server end).

[0106] The client 192.168.10.30 accesses the service IP address 192.168.10.10 of the cloud gateway based on Full-NAT in the cloud network. The corresponding NAT Conntrack session information is generated in the process of passing through the cloud gateway of the gateway physical server. The NAT conntrack session information includes the protocol of the current service, the real source / destination IP address and port, the source / destination IP and port after Full-NAT, etc. The plug-in CTF is used to synchronize the newly generated NAT conntrack information in real time and convert it into an OVS flow table according to the rules and send it to OVS for matching the service data packets from the cloud gateway to the server on OVS. Among them, CTF will use NAT The source / destination IP and port after Full-NAT in conntrack, as well as the protocol, are used as the matching conditions of the OVS flow table. At the same time, the client's real source IP address is converted into a MAC address according to certain rules, and the MAC address is used as the source MAC address of the action modification request packet in the generated OVS flow table. Finally, the data packet is encapsulated by OVS for overlay communication and sent to the KVM physical server 172.16.0.10. The VM in the KVM physical server identifies the source MAC address in the data packet and converts the MAC into an IP address to obtain the client's real source IP address.

[0107] In an optional implementation, the real source IP address resolved by the server is compared with the stored client IP address to see if they are the same. If the addresses are the same, it means that the CTF plug-in on the cloud gateway is deployed successfully. If the addresses are different, it is necessary to check on the cloud gateway whether the corresponding NAT Conntrack session and the corresponding OVS flow table are correctly delivered, or to redeploy the CTF plug-in on the cloud gateway.

[0108] The embodiment of the present invention also provides a computer device having the above Figure 1Any of the client, cloud gateway and server in the cloud network client source address resolution system shown.

[0109] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0110] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0111] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0112] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0113] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0114] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0115] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0116] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0117] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the defined scope.

Claims

1. A cloud network client source address resolution system, characterized in that: The system includes a client, a cloud gateway and a server; The client is used to generate an access request to the server and send it to the cloud gateway. The cloud gateway is used to receive the access request sent by the client, and perform FullNAT processing based on the access request to determine whether there is a target connection tracking session matching the access request in the connection tracking session list; wherein the connection tracking session list is used to store multiple connection tracking sessions that have been generated when the client has historically accessed the server; if not, a connection tracking session is generated according to the access request, and OVS flow table information is generated according to the connection tracking session, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server; wherein the connection tracking session includes the IP address of the client, and the generation of OVS flow table information according to the connection tracking session specifically includes: according to a preset address identification data conversion rule, the IP address of the client in the connection tracking session is converted to obtain the converted MAC address, matching and storing it in the modified source MAC address field in the OVS flow table, and generating OVS flow table information for modifying the source MAC address; if it exists, the generated connection tracking session and OVS flow table information are used, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server; The server is used to receive and parse the modified access request, and perform an inverse operation on the source MAC address in the access request according to a preset parsing rule to obtain the IP address of the client.

2. A method for resolving a source address of a cloud network client, characterized in that: The cloud gateway side of the resolution system for the source address of the cloud network client includes: Receive the access request sent by the client, perform Full NAT processing based on the access request, and determine whether there is a target connection tracking session matching the access request in the connection tracking session list; wherein the connection tracking session list is used to store multiple connection tracking sessions that have been generated when the client has historically accessed the server; If it does not exist, a connection tracking session is generated according to the access request, and OVS flow table information is generated according to the connection tracking session, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server; wherein the connection tracking session includes the IP address of the client, and generating the OVS flow table information according to the connection tracking session specifically includes: according to a preset address identification data conversion rule, the IP address of the client in the connection tracking session is converted to obtain the converted MAC address, matching and storing it in the modified source MAC address field in the OVS flow table, and generating OVS flow table information for modifying the source MAC address; If it exists, the generated connection tracking session and OVS flow table information are used, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server.

3. The method according to claim 2, characterized in that The connection tracking session also includes a protocol, a source IP address, a destination IP address, source port information, and destination port information. The generating of OVS flow table information according to the connection tracking session specifically includes: Matching the access protocol information in the connection tracking session with the network protocol field in the OVS flow table, and storing the access protocol information in the network protocol field; Matching the source IP address in the connection tracking session with the source network address field in the OVS flow table, and storing the source IP address in the source network address field; Match the destination IP address in the connection tracking session with the destination network address field in the OVS flow table, and store the destination IP address in the destination network address field; Matching the source port information in the connection tracking session with the source port field in the OVS flow table, and storing the source port information in the source port field; The destination port information in the connection tracking session is matched with the destination port field in the OVS flow table, and the destination port information is stored in the destination port field.

4. The method according to claim 2, characterized in that: The step of converting the IP address of the client in the connection tracking session according to a preset address identification data conversion rule specifically includes: Convert the first base type data in the IP address of the client into a base type to obtain the second binary type data; The first binary type data is combined according to the first preset address data combination rule to obtain a converted MAC address, which is matched and stored in the modified source MAC address field in the OVS flow table.

5. A method for resolving a source address of a cloud network client, characterized in that: The server side of the source address resolution system for cloud network clients includes: The modified access request is received and parsed, and the source MAC address in the access request is inversely calculated according to a preset parsing rule to obtain the IP address of the client.

6. The method according to claim 5, characterized in that The receiving and parsing the modified access request, and performing an inverse operation on the source MAC address in the access request according to a preset parsing rule to obtain the IP address of the client, specifically includes: Extract the binary type data of the source MAC address in the access request; The first binary type data is converted into a binary system to obtain a first binary type data, and the first binary type data is combined according to a second preset address data combination rule to obtain the IP address of the client.

7. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for resolving the source address of a cloud network client according to any one of claims 2-4 or claims 5-6 by executing the computer instructions.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for resolving the cloud network client source address according to any one of claims 2-4 or claims 5-6.

9. A computer program product, characterized in that It includes computer instructions, and the computer instructions are used to enable a computer to execute the cloud network client source address resolution method described in any one of claims 2-4 or claims 5-6.

Images