A cloud network client source address resolution system and method

Abstract

The application relates to the field of cloud network information technology and discloses a cloud network client source address analysis system and method.The system comprises a client, a cloud gateway end and a server.The client sends an access request, the cloud gateway makes Full NAT on the request, the cloud gateway converts the IP address of the client in the connection tracking session to obtain a MAC address, the MAC address is used for generating an OVS flow table for modifying the source MAC address, the OVS flow table modifies the source MAC address of the request and forwards the request to the server, and the server inversely operates the source MAC address in the request to obtain the IP address of the client.In the embodiment of the application, a large amount of development on the gateway is not needed, development cost is reduced, the server does not need protocol limitation when obtaining the real IP address of the client, and the adaptability of various protocols is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cloud network information technology, and in particular to a cloud network client source address analysis system and method. BACKGROUND

[0002] In related technologies, cloud network exists cloud gateway to perform Full NAT on the access request of the client to the server and forward, and after the client IP is forwarded by the cloud gateway, the server can only see the address of the SNAT pool on the corresponding gateway, and cannot know the real client IP address (source address), but in some business scenarios, the server needs to know the real client IP address accessing the service.

[0003] There are two kinds of current existing technical solutions, the first kind, when the business is a seven-layer http protocol, the client IP is carried by using the x-forward-for mode of the seven-layer load balancing (for example, nginx), but this solution requires that the business must be an http business type, and the XFF scheme depends on the seven-layer load balancer, and the middleware needs to be configured on the server to pass the XFF header, which has high development cost; the second kind, when the business is an IPv4 TCP protocol, TOA can be used, and the corresponding cloud network gateway needs to be developed again to support TOA encapsulation, and the TOA module needs to be loaded on the Linux server to obtain information, which has high development cost.

[0004] The above existing solutions can obtain the real IP address of the client in specific scenarios, but are only applicable to specific protocols (HTTP or TCP), and cannot adapt to the needs of all other protocol business scenarios when obtaining the real IP address of the client at a low development cost. SUMMARY

[0005] Therefore, the present application provides a cloud network client source address analysis system and method to solve how to adapt to the needs of multiple protocol business scenarios when obtaining the real IP address of the client at a low development cost.

[0006] In a first aspect, the present application provides a cloud network client source address analysis system, which comprises a client, a cloud gateway end and a server.

[0007] The client is configured to generate an access request to the server and send it to the cloud gateway end.

[0008] The cloud gateway end is used for receiving an access request sent by the client, performing Full NAT processing based on the access request, and judging whether a target connection tracking session matching the access request exists in a connection tracking session list; wherein the connection tracking session list is used for storing a plurality of connection tracking sessions generated when the client accesses the server end in history; if not, a connection tracking session is generated according to the access request, OVS flow table information is generated according to the connection tracking session, the source MAC address in the access request is modified according to the OVS flow table information, and the access request is forwarded to the server end; wherein the connection tracking session includes the IP address of the client, and the OVS flow table information is generated according to the connection tracking session, specifically including: performing data conversion on the IP address of the client in the connection tracking session according to a preset address identification data conversion rule, obtaining a converted MAC address, matching and storing the converted MAC address to a modified source MAC address field in the OVS flow table, and generating OVS flow table information for modifying the source MAC address; if yes, the generated connection tracking session and OVS flow table information are used, the source MAC address in the access request is modified according to the OVS flow table information, and the access request is forwarded to the server end.

[0009] The server end is used for receiving and analyzing the modified access request, performing inverse operation on the source MAC address in the access request according to a preset analysis rule to obtain the IP address of the client.

[0010] The cloud network client source address analysis system provided by the embodiment of the application creates a connection tracking session based on a client access request at a cloud gateway end, converts the IP address of the client into a MAC address according to a preset address identification data conversion rule to generate an OVS flow table for modifying the source MAC address, modifies the source MAC address in the request by using the OVS flow table and forwards the request to the server end, and then inversely operates the client IP address according to a preset analysis rule at the server end. The technical scheme avoids the technical defects in the related art, i.e., the HTTP protocol needs to be configured with nginx load balancing to transfer XFF header information, and the TCP protocol needs to be developed twice by the gateway and the server end. The flow table information is generated based on the OVS infrastructure at the cloud gateway end, without the need for a large amount of customized development of the gateway, and the server end only needs to inversely operate and analyze the source address according to the preset rule, so that the development cost is greatly reduced. Meanwhile, the server analysis process does not depend on a specific data transmission protocol, and the data in the data packet can be directly analyzed, so that the protocol independence is realized while the low development cost is ensured, and the protocol adaptation capability of the system is significantly improved.

[0011] In a second aspect, the application provides a cloud network client source address analysis method applied to a cloud network client source address analysis system, and applied to a cloud gateway end, and includes the following steps.

[0012] receive the access request sent by the client, and perform Full NAT processing based on the access request to determine whether a target connection tracking session matching the access request exists in a connection tracking session list, wherein the connection tracking session list is used to store a plurality of connection tracking sessions generated when the client accesses the server in the past;

[0013] If the target connection tracking session does not exist, a connection tracking session is generated according to the access request, OVS flow table information is generated according to the connection tracking session, the source MAC address in the access request is modified according to the OVS flow table information, and the access request is forwarded to the server; wherein the connection tracking session includes the IP address of the client, and the OVS flow table information is generated according to the connection tracking session, specifically including: converting the IP address of the client in the connection tracking session according to a preset address identification data conversion rule to obtain a converted MAC address, matching and storing the converted MAC address to a modified source MAC address field in the OVS flow table, and generating OVS flow table information for modifying the source MAC address.

[0014] If the target connection tracking session exists, the generated connection tracking session and OVS flow table information are used, the source MAC address in the access request is modified according to the OVS flow table information, and the access request is forwarded to the server.

[0015] The embodiment of the application intelligently avoids the process of repeatedly creating a connection session by determining whether a matching target connection tracking session exists in the connection tracking session list. When there is no matching session, the system generates a new connection tracking session according to the access request and generates OVS flow table information according to the new connection tracking session, thereby ensuring the accuracy and timeliness of the flow table information. When there is a matching session, the existing session and the existing OVS flow table information are directly used, thereby greatly shortening the processing time. In addition, the method modifies the source MAC address of the request using the generated OVS flow table and forwards the request to the server, thereby simplifying the development process of the gateway, reducing the complexity of secondary development, and eliminating the dependence on specific communication protocols, thereby greatly reducing the development cost. More importantly, since the generation of the flow table information is not limited to a specific protocol type, compared with the XFF or TOA scheme of the related art, the application exhibits stronger protocol compatibility and can widely support various business scenarios, thereby effectively improving the protocol adaptability of address resolution under the premise of low development cost.

[0016] In an optional embodiment, the connection tracking session further includes a protocol, a source IP address, a destination IP address, source port information and destination port information, and the generation of the OVS flow table information according to the connection tracking session specifically includes:

[0017] The access protocol information in the connection tracking session is matched with the network protocol field in the OVS flow table, and the access protocol information is stored in the network protocol field.

[0018] matching the source IP address in the connection tracking session with the source network address field in the OVS flow table and storing the source IP address into the source network address field;

[0019] matching the destination IP address in the connection tracking session with the destination network address field in the OVS flow table and storing the destination IP address into the destination network address field;

[0020] matching the source port information in the connection tracking session with the source port field in the OVS flow table and storing the source port information into the source port field;

[0021] matching the destination port information in the connection tracking session with the destination port field in the OVS flow table and storing the destination port information into the destination port field.

[0022] In the embodiment of the present application, the connection tracking session further comprises access protocol, source IP address, destination IP address, source port and destination port information, each item of information in the connection tracking session is matched with the corresponding field in the OVS flow table and stored, a unified data processing mode is provided through the preset address identification data conversion rule, the development cost of the data analysis module is reduced, and the security of the source address data is ensured.

[0023] In an optional implementation, the IP address of the client in the connection tracking session is converted according to the preset address identification data conversion rule, and the conversion specifically comprises:

[0024] performing a conversion between bases on the first base type data in the IP address of the client to obtain second base type data;

[0025] combining the second base type data according to a first preset address data combination rule to obtain a converted MAC address, and matching and storing the converted MAC address into the modified source MAC address field in the OVS flow table.

[0026] In the embodiment of the present application, the first base type data in the IP address of the client is converted into the second base type data, and the second base type data is combined according to the first preset address data combination rule, the original data is hidden through the conversion between bases, and the data security is ensured, and the service end is facilitated to analyze, so that the development cost is greatly reduced.

[0027] In a third aspect, the present application provides a cloud network client source address analysis method applied to a service end of a cloud network client source address analysis system, and the method comprises:

[0028] The modified access request is received and parsed, and a source MAC address in the access request is inversely operated according to a preset parsing rule to obtain an IP address of the client.

[0029] The embodiment of the application realizes accurate restoration of the source address of the client by receiving and parsing the request sent by the cloud gateway end on the service end and inversely operating the data storage format of the source network address field in the data packet according to a preset storage rule.

[0030] In an optional implementation, the receiving and parsing of the modified access request and the inverse operation of the source MAC address in the access request according to the preset parsing rule to obtain the IP address of the client specifically include:

[0031] The second binary type data of the source MAC address in the access request is extracted.

[0032] The second binary type data is converted into first binary type data, and the first binary type data is combined according to a second preset address data combination rule to obtain the IP address of the client.

[0033] The embodiment of the application converts the second binary type data of the source MAC address into the first binary type data and combines the first binary type data according to the second preset address data combination rule, which corresponds to the address conversion process of the cloud gateway end. Regardless of the protocol and the format of the address information, the real IP address of the client can be accurately restored through binary conversion and inverse conversion, thereby avoiding the problem of developing different parsing modules for different protocols in related technologies and improving the adaptability of address parsing.

[0034] In a fourth aspect, the application provides a computer device, which comprises a memory and a processor, the memory and the processor are communicatively connected with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the cloud network client source address parsing method of any one of the implementation manners of the second aspect or the third aspect.

[0035] In a fifth aspect, the application provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to make a computer execute the cloud network client source address parsing method of any one of the implementation manners of the second aspect or the third aspect.

[0036] In a sixth aspect, the present application provides a computer program product comprising computer instructions for causing a computer to execute the cloud network client source address resolving method of any one of the second aspect or the third aspect and the corresponding embodiments thereof. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the drawings required to be used in the specific embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0038] Figure 1 is a structural block diagram of a cloud network client source address resolving system according to an embodiment of the present application;

[0039] Figure 2 is a flowchart of a cloud network client source address resolving method applied to a cloud gateway end according to an embodiment of the present application;

[0040] Figure 3 is a CTF plug-in session flow representation intention of a cloud network client source address resolving method according to an embodiment of the present application;

[0041] Figure 4 is a flowchart of a cloud network client source address resolving method applied to a service end according to an embodiment of the present application;

[0042] Figure 5 is a schematic diagram of a specific application scenario of a cloud network client source address resolving system according to an embodiment of the present application;

[0043] Figure 6 is a hardware structure schematic diagram of a computer device of an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0045] Based on the two address resolving methods mentioned in the background art, the following two examples are given:

[0046] (1) For the http protocol, a load balancing setting is used, and the X-Forwarded-For function is enabled in the Nginx configuration, so that the transmitted data packet carries the client IP address, but a separate development analysis module is needed when the server obtains the client IP, and the X-Forwarded-For function is only effective for the data transmission of the http protocol.

[0047] (2) For the TCP protocol, the TOA (TCP Option Address) scheme is used, the TOA support is enabled at the load balancer end, the TOA kernel module is installed at the server end, and only the TCP protocol can adopt this scheme, and the development cost is also higher.

[0048] The above two schemes are only for specific protocol data packets and relatively limited environments, and do not have the ability to obtain the real source IP address for all IPv4 service data packets.

[0049] Therefore, the embodiment of the application provides a cloud network client source address analysis system, which can refer to Figure 1 , comprising a client 1, a cloud gateway end 2 and a server end 3.

[0050] The client 1 is used to generate an access request for accessing the server and send the access request to the cloud gateway end.

[0051] The cloud gateway end 2 is used to receive the access request sent by the client, and perform Full NAT processing based on the access request, and judge whether there is a target connection tracking session matched in the connection tracking session list; wherein the connection tracking session list is used to store a plurality of connection tracking sessions generated when the client accesses the server in the past; if not, a connection tracking session is generated according to the access request, and OVS flow table information is generated according to the connection tracking session; wherein the connection tracking session includes the IP address of the client, and the OVS flow table information is generated according to the connection tracking session, which specifically includes: according to a preset address identification data conversion rule, the IP address of the client in the connection tracking session is converted to obtain a converted MAC address, which is matched and stored in the modified source MAC address field in the OVS flow table, and the OVS flow table information of the modified source MAC address is generated; if there is, the generated connection tracking session and OVS flow table information are used; the request source MAC address is modified by the OVS flow table and forwarded to the server end;

[0052] The server end 3 is used to receive and analyze the request processed by the OVS flow table information, and perform inverse operation on the source MAC address in the request according to a preset analysis rule to obtain the IP address of the client.

[0053] It should be noted that the connection tracking session refers to a NAT conntrack session used for recording and tracking connection status in a network address translation process; the connection tracking session list is used to store session records generated when a client accesses a server, so as to ensure that a NAT device can accurately forward a data packet; the OVS flow table is a rule set for controlling data packet forwarding, and includes multiple flow rules defining matching conditions and corresponding actions; and the access request specifically refers to a service data packet in which a client accesses a cloud gateway service IP address, such as a data packet in which a client 192.168.10.30 accesses a cloud gateway service IP 192.168.10.10 and a port 80.

[0054] Specifically, the client can be a terminal device or a user host; the cloud gateway end can be a Full-NAT cloud gateway equipped with a CTF plug-in; and the server can be a server or a virtual machine VM. Main functions of the entities are as follows: the client generates an access request through a TCP / IP protocol stack; the cloud gateway end monitors a NAT conntrack session through a CTF plug-in and converts the NAT conntrack session into OVS flow table information; and the server performs inverse operation through a preset mapping rule to realize source address resolution.

[0055] Exemplarily, each interaction process of a cloud network client source address resolution system is as follows: the client sends an access request; the cloud gateway generates a NAT conntrack session; the CTF plug-in monitors the new session and converts the new session into OVS flow table information; a data packet is modified in a source MAC address through OVS matching of the flow table; the data packet is sent to a server through overlay encapsulation; and the server resolves the source MAC address to obtain a real source IP.

[0056] It can be understood that by deploying the CTF plug-in in the cloud gateway, conversion from a NAT conntrack session to an OVS flow table is realized, and real IP information of a client is delivered through a method of modifying a source MAC address of a data packet. This method fully utilizes flexibility of the OVS flow table and convertibility of the MAC address, and effectively avoids a dependence restriction on a communication protocol in a related technical solution.

[0057] The cloud network client source address resolution system provided by the embodiment of the application creates a connection tracking session based on a client access request at a cloud gateway end, converts a client IP address into a MAC address according to preset address identification data conversion rules, stores the MAC address in an OVS flow table, modifies a source MAC address in a request through the OVS flow table, and then restores the client IP address according to a preset resolution rule by a server, thereby avoiding the technical defects in the related art, such as the need to configure nginx load balancing to deliver XFF header information for the HTTP protocol and the need for secondary development of the gateway and the server for the TCP protocol. The flow table information is only generated based on the OVS infrastructure at the cloud gateway end, without the need for a large amount of customized development of the gateway, and the server only needs to inversely operate and analyze the source address according to the preset rule, thereby greatly reducing the development cost. Meanwhile, the server analysis process does not depend on a specific data transmission protocol, and the data in the data packet can be directly analyzed, so that the protocol independence is realized while the low development cost is ensured, and the protocol adaptation capability of the system is significantly improved.

[0058] In the embodiment, a cloud network client source address resolution method is provided, which can be used in the cloud gateway end of the cloud network client source address resolution system, Figure 2 The flow chart of the cloud network client source address resolution method according to the embodiment of the application is shown in Figure 2 The flow chart of the cloud network client source address resolution method according to the embodiment of the application is shown in

[0059] In step S201, an access request sent by a client to access a server is received.

[0060] In step S202, a Full NAT process is performed based on the access request, and it is determined whether a target connection tracking session matching the access request exists in a connection tracking session list. The connection tracking session list is used to store a plurality of connection tracking sessions generated when the client accesses the server.

[0061] For example, the access request sent to the server in step S201 can include address information, port information and protocol information, and in step S202, the connection tracking session list currently maintained is traversed to determine whether a matching target connection tracking session exists.

[0062] Specifically, in step S202, two pieces of information need to be compared when matching: (1) whether the address information is the same; (2) whether the protocol information is the same; and (3) whether the port information is the same. Only when the above three conditions are met, it is considered that a matching target connection tracking session is found. In addition, the state and validity period of the existing session are checked, and if the found session has expired or is in an invalid state, it is determined that no matching session is found.

[0063] Step S203, if not, generating a connection tracking session according to the access request, and generating OVS flow table information according to the connection tracking session, modifying the source MAC address in the access request according to the OVS flow table information and forwarding to the server; wherein the connection tracking session includes the IP address of the client, and the OVS flow table information is generated according to the connection tracking session, specifically including: converting the IP address of the client in the connection tracking session according to the preset address identification data conversion rule to obtain the converted MAC address, matching and storing to the modified source MAC address field in the OVS flow table, and generating the OVS flow table information for modifying the source MAC address.

[0064] Specifically, when the judgment result is that there is no matching connection tracking session, the cloud gateway end will create a new connection tracking session based on the current access request, including: allocating a session ID; recording the session creation time; setting the session timeout time; saving the address information, port information and protocol information initializing the session state, obtaining a session record, and then the cloud gateway end calls the CTF plug-in to convert the newly created connection tracking session information into OVS flow table information.

[0065] Further, the IP address of the client in the connection tracking session is converted according to the preset address identification data conversion rule, specifically including: converting the first type of data in the IP address of the client into second type of data; combining the second type of data according to the first preset address data combination rule to obtain the converted MAC address, and matching and storing to the modified source MAC address field in the OVS flow table.

[0066] Illustratively, the data of the IP address of the client is a decimal number, which is transmitted in the form of binary number in the forwarding process, and the 32-bit binary data of the IP address of the client is divided into four 8-bit binary fields; the four 8-bit binary fields are respectively converted into corresponding hexadecimal data to obtain eight hexadecimal numbers; four fixed hexadecimal numbers are added before the eight hexadecimal numbers to obtain twelve hexadecimal numbers; the twelve hexadecimal numbers are separated by colons every two bits to obtain data in the format of MAC address as the converted MAC address.

[0067] In actual application, the rule of converting the IP address of the real client into the MAC address by the CTF includes: the IP address IPv4 of the client is 32-bit binary, which is divided into four 8-bit binary fields, each field is converted into corresponding hexadecimal, that is, 8 hexadecimal numbers are used in total. The MAC address is 48-bit binary, which is divided into 12 hexadecimal numbers, then the IPv4 address and the MAC address are different by 4 numbers in hexadecimal, 8 hexadecimal numbers of the IPv4 are used as the last 8 hexadecimal numbers of the MAC address, and the first 4 hexadecimal numbers of the MAC address are fixed numbers, for example, 88:88, the hexadecimal numbers are separated by a colon, then the IPv4 address can be converted into the corresponding MAC address by the above-mentioned way. For example, the IPv4 address 192.168.0.1 is converted into the MAC address by the way that the first 4 hexadecimal numbers of the MAC are fixed as 88:88, 192 is converted into C0, 168 is converted into A8, 0 is converted into 00, and 1 is converted into 01, then the final converted MAC address is 88:88:C0:A8:00:01, which is the modified MAC address.

[0068] In the embodiment of the application, the first type of data in the IP address of the client is converted into the second type of data, and is combined according to the first preset address data combination rule, the original data is hidden through the conversion between different types of data, and the first preset address data combination rule is used for combination, so that the data security is ensured, the server is convenient to analyze, and the development cost is greatly reduced.

[0069] In step S204, if the generated connection tracking session and the OVS flow table information exist, the source MAC address in the access request is modified and forwarded to the server according to the OVS flow table information.

[0070] Similarly, the cloud gateway end calls the CTF plug-in, and converts the target connection tracking session information into the OVS flow table information.

[0071] Specifically, the processing process of the OVS flow table on the data packet includes: modifying the source MAC address of the forwarding request data packet, adding the overlay network encapsulation to the data packet of the forwarding request, so that the data packet can be correctly transmitted in the overlay network, setting the priority and QoS parameter of the data packet, selecting the target forwarding path according to the network structure, and sending the encapsulated data packet to the server through the target forwarding path.

[0072] The embodiment of the present application intelligently avoids the repeated creation of connection sessions by judging whether there is a matching target connection tracking session in the connection tracking session list. When there is no matching session, the system generates a new connection tracking session according to the access request and generates OVS flow table information according to the connection tracking session, thereby ensuring the accuracy and timeliness of the flow table information. When there is a matching session, the existing session and the existing OVS flow table information are directly used, thereby greatly shortening the processing time. In addition, the method modifies the source MAC address of the generated OVS flow table to the request and forwards it to the server, thereby simplifying the development process of the gateway, reducing the complexity of secondary development, and eliminating the dependence on specific communication protocols, thereby greatly reducing the development cost. More importantly, since the generation of the flow table information is not limited to a specific protocol type, compared with the XFF or TOA scheme of the related art, the present application has stronger protocol compatibility and can widely support various business scenarios, thereby effectively improving the protocol adaptability of address resolution under the premise of low development cost.

[0073] In the present embodiment, a cloud network client source address resolution method is provided, which can be used in the cloud gateway of the cloud network client source address resolution system described above. The flow includes the following steps:

[0074] In step S301, an access request sent by a client is received. For details, please refer to step S201 of the embodiment shown in Figure 2 The step S201 of the embodiment shown in the foregoing is not repeated here.

[0075] In step S302, a Full NAT process is performed based on the access request, and it is judged whether there is a target connection tracking session matching the access request in the connection tracking session list. The connection tracking session list is used to store a plurality of connection tracking sessions generated when the client accesses the server. For details, please refer to step S202 of the embodiment shown in Figure 2 The step S202 of the embodiment shown in the foregoing is not repeated here.

[0076] In step S303, if there is no matching session, a connection tracking session is generated according to the access request, and OVS flow table information is generated according to the connection tracking session. The source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server. The connection tracking session includes the IP address of the client. The OVS flow table information is generated according to the connection tracking session, which specifically includes: converting the IP address of the client in the connection tracking session according to a preset address identification data conversion rule to obtain a converted MAC address, matching and storing the converted MAC address to the modified source MAC address field in the OVS flow table, and generating OVS flow table information for modifying the source MAC address.

[0077] The connection tracking session also includes access protocol, source IP address, destination IP address, source port and destination port information, all of which are used to characterize the bidirectional channel path information of the client and server during the request and access processes.

[0078] It should be noted that the source port and destination port information refer to the source port and destination port used when the client and server communicate. The bidirectional channel path port information between the client and server during the request and access processes refers to the source port and destination port information used when the client accesses the server and the server responds to the client. When the directions are different, the port information needs to be swapped.

[0079] For example, a complete connection tracing session is as follows: tcp 6 95TIME_WAIT src=192.168.10.30,dst=192.168.10.10,sport=35312,dport=80,src=172.16.0.10,dst=10.10.10.23,sport=80,dport=35312,[ASSURED]mark=0secctx=system_u:object_r:unlabeled_t:s0 use=1.

[0080] In this context, tcp 6 95TIME_WAIT indicates that the TCP protocol is in the TIME_WAIT state. The session information for request packets from the client to the cloud gateway includes src=192.168.10.30 (initial source address), dst=192.168.10.10 (initial destination address), sport=35312 (initial source port), and dport=80 (initial destination port). The session information for return packets from the server to the cloud gateway (opposite to the gateway to the server) includes src=172.16.0.10 (NAT-translated destination IP address), dst=10.10.10.23 (NAT-translated source IP address), sport=80 (NAT-translated destination port), and dport=35312 (NAT-translated source port).

[0081] In one specific embodiment, step S303, which generates OVS flow table information based on the connection tracking session, further includes the protocol, source IP address, destination IP address, source port information, and destination port information. Generating OVS flow table information based on the connection tracking session means matching the access protocol, source IP address, destination IP address, source port, and destination port using preset OVS flow table fields to generate OVS flow table information.

[0082] Specifically, according to the access protocol, the source IP address, the destination IP address, the source port and the destination port, the OVS flow table fields are matched by a preset manner, and the OVS flow table information is generated, including:

[0083] a1, the access protocol information in the connection tracking session is matched with the network protocol field in the OVS flow table, and the access protocol information is stored in the network protocol field;

[0084] a2, the source IP address in the connection tracking session is matched with the source network address field in the OVS flow table, and the source IP address is stored in the source network address field;

[0085] a3, the destination IP address in the connection tracking session is matched with the destination network address field in the OVS flow table, and the destination IP address is stored in the destination network address field;

[0086] a4, the source port information in the connection tracking session is matched with the source port field in the OVS flow table, and the source port information is stored in the source port field;

[0087] a5, the target port information in the connection tracking session is matched with the target port field in the OVS flow table, and the target port information is stored in the target port field.

[0088] In the embodiment of the application, the connection tracking session further includes access protocol, source IP address, destination IP address, source port and destination port information, each item of information in the connection tracking session is matched and stored with the corresponding field in the OVS flow table, a unified data processing mode is provided by the preset address identification data conversion rule, the development cost of the data analysis module is reduced, and the security of the source address data is ensured.

[0089] For example, refer to Figure 3, the CTF plug-in converts the newly generated NAT conntrack information into OVS flow table according to the rules in real time and sends it to OVS for matching the service data packet from the cloud gateway to the server. CTF converts the TCP protocol in the NAT conntrack into nw proto = 6 in the OVS flow table; CTF converts the original source IP address 192.168.10.30 in the NAT conntrack into a MAC address with the first 4 bits as a fixed 88:88 and the last 8 bits as a MAC address generated by the IPv4 address conversion method, that is, 88:88:C0:A8:0A:1E, and injects the MAC address into the mod_dl_src:88:88:C0:A8:0A:1E in the generated OVS flow table action for modifying the source MAC address in the service data packet; CTF converts the source IP address src = 172.16.0.10 in the backend reverse matching information in the NAT conntrack into the destination IP address matching nw_dst = 172.16.0.10 in the OVS flow table; CTF converts the destination IP address dst = 10.10.10.23 in the backend reverse matching information in the NAT conntrack into the source IP address matching nw_src = 10.10.10.23 in the OVS flow table; CTF converts the source port sport = 80 in the backend reverse matching information in the NAT conntrack into the destination port matching tp_dst = 80 in the OVS flow table; and CTF converts the destination port dport = 35312 in the backend reverse matching information in the NAT conntrack into the source port matching tp_src = 35312 in the OVS flow table.

[0090] For example, the converted complete OVS flow table information is as follows: ovs-ofctl add-flow table = 0 ovs-bridge ip, in_port = 1, nw_src = 10.10.10.23, nw_dst = 172.16.0.10, nw_proto = 6, tp_src = 35312, tp_dst = 80, actions = mod_dl_src:88:88:C0:A8:0A:1E, goto_table = 1;

[0091] ovs-ofctl add-flow table=0ovs-bridge ip indicates the flow table bridge prefix information, which is a fixed value, in_port=1 indicates that the data packet enters from port 1, nw_src=10.10.10.23 indicates that the source IP address is matched as 10.10.10.23, nw_dst=172.16.0.10 indicates that the destination IP address is matched as 172.16.0.10, nw_proto=6 indicates that the TCP protocol is matched (the protocol corresponds to the label 6), tp_src=35312 indicates that the source port is matched as 35312, tp_dst=80 indicates that the destination port is matched as 80, actions=mod_dl_src:88:88:C0:A8:0A:1E,goto_table=1 indicates that the action of modifying the source MAC address to 88:88:C0:A8:0A:1E is executed, and then jumping to the table with the label 1 for further processing, and the table with the label 1 is used to adaptively encapsulate the data packet as an overlay and then forward it to the server.

[0092] In step S304, if the generated connection tracking session and the OVS flow table information exist, the source MAC address in the access request is modified according to the OVS flow table information, and the access request is forwarded to the server.

[0093] Similarly, in step S304, the OVS flow table information is generated according to the target connection tracking session. For details, refer to the specific steps in step S304, which will not be repeated here.

[0094] In this embodiment, a cloud network client source address resolution method is provided, which is applied to the service end of the cloud network client source address resolution system. Figure 4 The cloud network client source address resolution method according to the embodiment of the present application is shown in the flowchart as shown in FIG. 4, which includes the following steps: Figure 4

[0095] In step S401, the modified access request is received and parsed.

[0096] In step S402, the source MAC address in the access request is inversely operated according to a preset resolution rule to obtain the IP address of the client.

[0097] Specifically, in step S402, the following steps are included:

[0098] In step S4021, the second binary type data of the source MAC address in the access request is extracted.

[0099] ​In step S4022, the second-radix-type data is converted into first-radix-type data, and the first-radix-type data is combined according to a second preset address combination rule to obtain the IP address of the client.

[0100] For example, the last 8 hexadecimal numbers of the source MAC address of the data packet are extracted, two hexadecimal numbers are grouped into a group every time to convert into four 8-bit binary fields, the four 8-bit binary fields are converted into four decimal numbers, and the four decimal numbers are separated by a dot to obtain the IP address of the client.

[0101] In actual application, the rule of converting the received MAC address back to the IPv4 address by the server includes that the received MAC address is 48-bit binary and is divided into 12 hexadecimal numbers, the IPv4 address is 32-bit binary and is divided into four 8-bit binary fields, each field is converted into corresponding hexadecimal, and a total of 8 hexadecimal numbers are used. Since the first 4 hexadecimal numbers of the MAC address are fixed, such as 88:88, only the last 8 hexadecimal numbers of the MAC address are extracted for conversion. For example, assuming that the received MAC address is 88:88:C0:A8:00:01, the last 8 hexadecimal numbers C0:A8:00:01 are extracted, two hexadecimal numbers are grouped into a group every time to convert into four 8-bit binary fields, the four 8-bit binary fields are converted into decimal numbers, and the four decimal numbers are separated by a dot to obtain the IP address of the client, that is, 192.168.0.1.

[0102] It can be understood that no matter what conversion mode is used by the cloud gateway end, the server end only needs to use inverse operation according to the forward conversion process for analysis, which simplifies the analysis process of the server end and reduces the development cost.

[0103] The embodiment of the application realizes accurate restoration of the source address of the client by receiving and analyzing the request sent by the cloud gateway end on the server end and performing inverse operation on the data storage format of the source network address field in the data packet according to the preset storage rule, reduces the development complexity of the server end, and is suitable for various business scenarios, and improves the protocol adaptability of address analysis.

[0104] The embodiment of the application extracts the second base type data of the source MAC address, converts the second base type data into first base type data, and combines the first base type data according to a second preset address combination rule, which corresponds to the address conversion process of the cloud gateway end. No matter what protocol and format of address information, the real IP address of the client can be accurately restored through base conversion and reverse conversion, thereby avoiding the problem that different parsing modules need to be developed for different protocols in the related art, and improving the adaptability of address resolution.

[0105] In a certain application scenario, the cloud network client source address resolution system can comprise a client, a gateway physical server (cloud gateway end), and a KVM physical server (server end). Figure 5

[0106] The client 192.168.10.30 accesses the service IP address 192.168.10.10 of the cloud gateway based on Full-NAT in the cloud network, and a corresponding NAT Conntrack session information is generated in the process of the cloud gateway of the gateway physical server, wherein the NAT conntrack session information comprises the protocol of the current service, the real source / desination IP address and port, the Full-NAT source / desination IP and port, and the like. The newly generated NAT conntrack information is converted into an OVS flow table according to a rule by using a plug-in CTF, and is delivered to the OVS for matching the service data packet from the cloud gateway to the server end on the OVS, wherein the CTF uses the Full-NAT source / desination IP and port in the NAT conntrack and the protocol as the matching condition of the OVS flow table, and converts the real source IP address of the client into a MAC address according to a certain rule, and uses the MAC address as the source MAC address of the action modification request data packet in the generated OVS flow table. Finally, the data packet is sent to the KVM physical server 172.16.0.10 through the OVS for overlay communication encapsulation, the VM in the KVM physical server identifies the source MAC address in the data packet, and converts the MAC address into an IP address to obtain the real source IP address of the client.

[0107] In an optional embodiment, the real source IP address resolved by the server end is compared with the stored client IP address, if the addresses are the same, it is indicated that the CTF plug-in deployed on the cloud gateway is successful, if the addresses are different, it is necessary to check whether the corresponding NAT Conntrack session and the corresponding OVS flow table are correctly delivered on the cloud gateway, or the CTF plug-in is deployed again on the cloud gateway.

[0108] The embodiment of the application further provides a computer device having the above Figure 1 ​Any one of the client in the cloud network client source address resolution system, the cloud gateway end and the server end shown.

[0109] Please refer to Figure 6 , Figure 6 is a computer device structure schematic diagram provided by an optional embodiment of the application, as Figure 6 shown, the computer device includes one or more processors 10, a memory 20, and an interface for connecting components, including a high-speed interface and a low-speed interface. Various components are communicatively connected to each other using different buses, and can be installed on a common motherboard or in other ways as needed. The processor can process instructions executed within the computer device, including instructions stored in the memory or on the memory to display a GUI on an external input / output device, such as a display device coupled to the interface. In some optional embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memories, if necessary. Similarly, multiple computer devices can be connected, each providing part of the necessary operations (e.g., as a server array, a group of blade servers, or a multi-processor system). Figure 6 In the above description, the processor 10 is taken as an example.

[0110] The processor 10 can be a central processor, a network processor, or a combination thereof. The processor 10 can further include a hardware chip. The hardware chip can be an application specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device can be a complex programmable logic device, a field programmable logic gate array, a general array logic, or any combination thereof.

[0111] The memory 20 stores instructions executable by the at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0112] The memory 20 can include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required by at least one function; the data storage area can store data created according to the use of the computer device, etc. In addition, the memory 20 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some optional embodiments, the memory 20 can optionally include a memory remotely arranged with respect to the processor 10, which can be connected to the computer device through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0113] The memory 20 can include a volatile memory, such as a random access memory, and / or a non-volatile memory, such as a flash memory, a hard disk or a solid state disk. The memory 20 can also include a combination of the above-mentioned types of memories.

[0114] The computer device also comprises a communication interface 30 for communicating with other devices or communication networks.

[0115] The embodiments of the present application also provide a computer readable storage medium, and the method according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or stored in a remote storage medium or a non-transitory machine readable storage medium and downloaded to a local storage medium through network, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor or programmable or special purpose hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk or a solid state disk, etc. Further, the storage medium can also include a combination of the above-mentioned types of memories. It can be understood that the computer, processor, microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, processor or hardware, the method shown in the above embodiments is implemented.

[0116] Part of the present application can be applied as a computer program product, for example, computer program instructions, when executed by a computer, through the operation of the computer, the method and / or technical solutions according to the present application can be invoked or provided. Those skilled in the art should understand that the form of computer program instructions in computer readable medium includes but is not limited to source file, executable file, installation package file, etc. Correspondingly, the way of computer program instructions executed by computer includes but is not limited to: the computer directly executes the instructions, or the computer compiles the instructions and then executes the corresponding compiled program, or the computer reads and executes the instructions, or the computer reads and installs the instructions and then executes the corresponding installed program. Here, the computer readable medium can be any available computer readable storage medium or communication medium accessible to the computer.

[0117] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the defined scope.

Claims

1. A system for resolving the source address of a cloud network client, characterized in that, The system includes a client, a cloud gateway, and a server. The client is used to generate an access request to the server and send it to the cloud gateway. The cloud gateway is configured to receive access requests sent by the client, perform FullNAT processing based on the access requests, and determine whether a matching target connection tracking session exists in the connection tracking session list. The connection tracking session list stores multiple connection tracking sessions generated during the client's historical access to the server. If no such session exists, a connection tracking session is generated based on the access request, and OVS flow table information is generated based on the connection tracking session. The source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server. The connection tracking session includes the client's IP address. Generating OVS flow table information based on the connection tracking session specifically includes: converting the client's IP address in the connection tracking session according to a preset address identifier data conversion rule to obtain a converted MAC address; matching and storing the modified source MAC address field in the OVS flow table; and generating OVS flow table information for modifying the source MAC address. If a target MAC address exists, the generated connection tracking session and OVS flow table information are used, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server. The server is used to receive and parse the modified access request, and perform inverse operation on the source MAC address in the access request according to the preset parsing rules to obtain the IP address of the client.

2. A method for resolving the source address of a cloud network client, characterized in that, The cloud gateway end of the system used for resolving source addresses of cloud network clients includes: The system receives an access request sent by the client, performs Full NAT processing based on the access request, and determines whether there is a matching target connection tracking session in the connection tracking session list; wherein, the connection tracking session list is used to store multiple connection tracking sessions generated when the client accesses the server in the past. If it does not exist, a connection tracking session is generated based on the access request, and OVS flow table information is generated based on the connection tracking session. The source MAC address in the access request is modified based on the OVS flow table information and forwarded to the server. The connection tracking session includes the client's IP address. Generating OVS flow table information based on the connection tracking session specifically includes: converting the client's IP address in the connection tracking session according to a preset address identification data conversion rule to obtain the converted MAC address, matching and storing it in the modified source MAC address field of the OVS flow table, and generating OVS flow table information for modifying the source MAC address. If it exists, the generated connection tracking session and OVS flow table information are used, and the source MAC address in the access request is modified according to the OVS flow table information and forwarded to the server.

3. The method according to claim 2, characterized in that, The connection tracing session also includes the protocol, source IP address, destination IP address, source port information, and destination port information. The generation of OVS flow table information based on the connection tracing session specifically includes: The access protocol information in the connection tracking session is matched with the network protocol field in the OVS flow table, and the access protocol information is stored in the network protocol field; The source IP address in the connection tracking session is matched with the source network address field in the OVS flow table, and the source IP address is stored in the source network address field; The destination IP address in the connection tracking session is matched with the destination network address field in the OVS flow table, and the destination IP address is stored in the destination network address field; The source port information in the connection tracking session is matched with the source port field in the OVS flow table, and the source port information is stored in the source port field; The target port information in the connection tracking session is matched with the target port field in the OVS flow table, and the target port information is stored in the target port field.

4. The method according to claim 2, characterized in that, The step of converting the IP address of the client in the connection tracking session according to a preset address identification data conversion rule specifically includes: Convert the first base type data in the client's IP address to the second base type data; The binary data is combined according to the first preset address data combination rule to obtain the converted MAC address, which is then matched and stored in the modified source MAC address field of the OVS flow table.

5. A method for resolving the source address of a cloud network client, characterized in that, The server-side component of the cloud network client source address resolution system described in claim 1 includes: The system receives and parses the modified access request, and performs inverse operation on the source MAC address in the access request according to the preset parsing rules to obtain the IP address of the client.

6. The method according to claim 5, characterized in that, The process of receiving and parsing the modified access request, and performing an inverse operation on the source MAC address in the access request according to a preset parsing rule to obtain the client's IP address, specifically includes: Extract the binary data of the source MAC address from the access request; The binary data is converted to a first base data, and the first base data is combined according to the second preset address data combination rule to obtain the client's IP address.

7. A computer device, characterized in that, include: A memory and a processor are interconnected, the memory stores computer instructions, and the processor executes the computer instructions to perform the cloud network client source address resolution method according to any one of claims 2-4 or 5-6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the cloud network client source address resolution method according to any one of claims 2-4 or 5-6.

9. A computer program product, characterized in that, Includes computer instructions, which are used to cause a computer to execute the method for resolving the source address of a cloud network client as described in any one of claims 2-4 or 5-6.

Images