Domain name interception method of MacOS system, client, computer equipment and product

Abstract

The invention relates to the technical field of domain name interception, and discloses a domain name interception method of a MacOS system, a client, computer equipment and a product, the domain name interception method of the MacOS system comprises the following steps: capturing a DNS request message, and extracting request domain name information of the DNS request message; matching the request domain name information with authorized domain name class resources, and determining a target authorized domain name corresponding to the request domain name information; determining a corresponding target virtual IP based on the target authorized domain name, and disguising to send a DNS response message through an original socket; receiving an application layer request corresponding to the DNS response message; and searching a target authorized domain name based on the target virtual IP, determining a real IP based on the target authorized domain name, and returning a response result of the real IP. According to the invention, the problem that compatibility with a wide domain name scene is not supported can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of domain name interception, and particularly to a domain name interception method, a client, a computer device and a product for MacOS system. Background Art

[0002] In the zero-trust VPN scenario, the conventional solution for domain name hijacking in the MacOS system is to modify the system DNS (Domain Name System) of MacOS, or to use the virtual IP technology to intercept domain names.

[0003] Among them, by modifying the DNS resolution of the system, there are certain impacts on network switching or DNS changes. It is necessary to record the DNS for backhaul in time after the change. In the scenario of software exit or network change, if the compatibility is improper, it will cause the domain name resolution of DNS to fail, which may lead to poor user experience.

[0004] Among them, using the virtual IP technology to intercept domain names requires the combination of local and cloud, maintaining the virtual IP mapping relationship between local and cloud, and the maintenance work is relatively large, which is not friendly to the support of the pan-domain name scenario. Summary of the Invention

[0005] In view of this, the present invention provides a domain name interception method, a client, a computer device and a product for MacOS system to solve the problem of not supporting the compatibility of the pan-domain name scenario.

[0006] In a first aspect, the present invention provides a domain name interception method for MacOS system, which is applied to a client of MacOS system. The domain name interception method for MacOS system includes: capturing a DNS request packet and extracting the requested domain name information of the DNS request packet; matching the requested domain name information with the authorized domain name resources to determine the target authorized domain name corresponding to the requested domain name information; determining the corresponding target virtual IP based on the target authorized domain name, and sending a DNS response packet through the original socket disguise; receiving the application layer request corresponding to the DNS response packet; looking up the target authorized domain name based on the target virtual IP, determining the real IP based on the target authorized domain name, and returning the response result of the real IP.

[0007] In this implementation, by capturing the requested domain name, responding according to the virtual IP allocated by the authorized domain name, mapping the real domain name according to the virtual IP, so as to obtain the real backhaul IP, avoiding the need for the cloud to maintain the mapping relationship between the virtual IP and the real IP, and friendly compatible with the pan-domain name scenario. The process of this application will not modify the DNS of the MacOS system, which can avoid affecting the user environment and ensure the normal Internet access process of unauthorized domain names.

[0008] In an alternative embodiment, before capturing the DNS request packet, it further includes: in response to zero-trust VPN login, pulling the authorized domain name resources and the virtual IP address pool. The authorized domain name resources include an authorized domain name list, where the authorized domain names are the domain names that the user is allowed to access, and the virtual IP address pool includes multiple virtual IPs; setting the libpcap rule, where the libpcap rule is for packets on port 53.

[0009] In an alternative embodiment, capturing the DNS request packet and extracting the requested domain name information of the DNS request packet includes: filtering the request packet data based on the libpcap rule to capture the DNS request packet; parsing the DNS request packet to extract the requested domain name information in the DNS request packet.

[0010] In this implementation, the present application uses the libpcap technology to effectively capture the domain name information of the user's Internet access on the MacOS system, providing a basis for subsequent domain name interception.

[0011] In an alternative embodiment, determining the corresponding target virtual IP based on the target authorized domain name and sending the DNS response packet through the raw socket includes: dynamically allocating the virtual IPs in the virtual IP address pool to the authorized domain names in the authorized domain name resources to generate a persistent mapping relationship; determining the target virtual IP corresponding to the target authorized domain name based on the persistent mapping relationship; sending the DNS response packet by disguising through the raw socket.

[0012] In this implementation, a designated virtual IP is assigned to each authorized domain name, and by using the libpcap technology in combination with the raw socket, the corresponding virtual IP for the designated domain name is effectively provided.

[0013] In an alternative embodiment, sending the DNS response packet by disguising through the raw socket includes: when the protocol type of the DNS request packet is the UDP protocol type, the DNS response packet is the fastest response packet; when the protocol type of the DNS request packet is the TCP protocol type, the DNS response packet is the FIN packet.

[0014] In an alternative embodiment, looking up the target authorized domain name based on the target virtual IP, determining the real IP based on the target authorized domain name, and returning the response result of the real IP includes: looking up the target authorized domain name corresponding to the target virtual IP based on the persistent mapping relationship; obtaining the real IP corresponding to the target authorized domain name through the zero-trust gateway; converting the target virtual IP to the real IP and making a response.

[0015] In this implementation, on the virtual network card of the zero-trust VPN, the real domain name is retrieved by reverse querying the virtual IP, so as to obtain the real IP for returning to the source. Then, the conversion between the virtual IP and the real IP is completed, avoiding the need to maintain the mapping relationship between the virtual IP and the real IP in the cloud, thereby friendly supporting the type of wildcards and dynamically allocating virtual IPs for newly added domain names.

[0016] In a second aspect, the present invention provides a client for a MacOS system. The client for the MacOS system includes: a capturing module for capturing DNS request packets and extracting the requested domain name information of the DNS request packets; a matching module for matching the requested domain name information with authorized domain name resources to determine the target authorized domain name corresponding to the requested domain name information; a sending module for determining the corresponding target virtual IP based on the target authorized domain name and sending a DNS response packet through the original socket disguise; a receiving module for receiving the application layer request corresponding to the DNS response packet; and a response module for looking up the target authorized domain name based on the target virtual IP, determining the real IP based on the target authorized domain name, and returning the response result of the real IP.

[0017] In a third aspect, the present invention provides a computer device, including: a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to execute the domain name interception method for the MacOS system in the first aspect or any corresponding embodiment thereof.

[0018] In a fourth aspect, the present invention provides a computer-readable storage medium, on which computer instructions are stored. The computer instructions are used to cause a computer to execute the domain name interception method for the MacOS system in the first aspect or any corresponding embodiment thereof.

[0019] In a fifth aspect, the present invention provides a computer program product, including computer instructions, which are used to cause a computer to execute the domain name interception method for the MacOS system in the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0021] Figure 1 is a flowchart of a domain name interception method for a MacOS system according to an embodiment of the present invention;

[0022] Figure 2 It is a flowchart of another domain name interception method for the MacOS system according to an embodiment of the present invention;

[0023] Figure 3 It is a structural block diagram of a client of the MacOS system according to an embodiment of the present invention;

[0024] Figure 4 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed implementation manners

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0026] Currently, most solutions for intercepting domain names into virtual IPs require a combination of local and cloud, and need to maintain the relationship between the local and the cloud, which is not friendly to the support of the wild card domain name scenario.

[0027] Therefore, this application proposes a domain name interception method for the MacOS system. By capturing the requested domain name, responding according to the virtual IP assigned by the authorized domain name, and mapping the real domain name from the virtual IP, the real backhaul IP can be obtained, avoiding the need for the cloud to maintain the mapping relationship between the virtual IP and the real IP, and being friendly and compatible with the wild card domain name scenario. The process of this application will not modify the DNS of the MacOS system, can avoid affecting the user environment, and ensure the normal Internet access process for non-authorized domain names.

[0028] According to an embodiment of the present invention, an embodiment of a domain name interception method for the MacOS system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0029] In this embodiment, a domain name interception method for the MacOS system is provided, which can be used for the client of the MacOS system, Figure 1 It is a flowchart of a domain name interception method for the MacOS system according to an embodiment of the present invention. It should be noted that if there are substantially the same results, this embodiment is not limited to Figure 1 the order of the flow shown. As Figure 1 shown, the process includes the following steps:

[0030] Step S101: Capture the DNS request packet and extract the requested domain name information of the DNS request packet.

[0031] Perform DNS packet capture from the user access data of the user side, capture the DNS request packet in the network layer, where the DNS request packet contains the domain name requested by the user for access.

[0032] Parse the DNS request packet according to the network protocol stack and extract the domain name information of the domain name requested by the user for access.

[0033] Step S102: Match the requested domain name information with the authorized domain name type resources to determine the target authorized domain name corresponding to the requested domain name information.

[0034] Judge the domain name requested by the user for access. When the domain name requested by the user for access is an allowed access domain name, proceed to the subsequent steps. When the domain name requested by the user for access is a non-allowed access domain name, end this process.

[0035] Specifically, this application sets authorized domain name type resources. The authorized domain name type resources include an authorized domain name list, and there are multiple domain names that users are allowed to access in the authorized domain name list, that is, authorized domain names.

[0036] Match the requested domain name information of the user's requested access with the authorized domain names within the authorized domain name type resources. When the match is successful, determine the target authorized domain name obtained by the match. When the match is unsuccessful, terminate this step.

[0037] Step S103: Determine the corresponding target virtual IP based on the target authorized domain name and send the DNS response packet through raw socket spoofing.

[0038] Among them, the raw socket is a network programming interface different from the standard stream (SOCK_STREAM) and datagram (SOCK_DGRAM) sockets. It allows developers to directly send and receive data packets at the transport layer below the network layer, which means that data packets of protocols such as IP headers, TCP, UDP, and ICMP can be processed.

[0039] Specifically, configure a target virtual IP for each target authorized domain name. When it is determined that the domain name requested by the user for access is the target authorized domain name, determine the corresponding target virtual IP, encapsulate the target virtual IP into a data packet as the DNS response packet, and send the DNS response packet to the requesting user side through the raw socket.

[0040] In one implementation, for different protocol types of DNS packets, different data packets are used for response.

[0041] Step S104: receiving an application layer request corresponding to the DNS response message.

[0042] After the user receives the DNS response message, it initiates an application layer request to the MacOS system client to request the generation of a response result corresponding to the requested IP.

[0043] The client receives the application layer request corresponding to the DNS response message, and the application layer request includes the target virtual IP of the request.

[0044] Step S105, searching for the target authorized domain name based on the target virtual IP, determining the real IP based on the target authorized domain name, and returning a response result of the real IP.

[0045] Under the guidance of the target virtual IP routing, the corresponding target authorized domain name is checked according to the target virtual IP, the real IP information of the authorized domain name is obtained through the gateway, and the response result corresponding to the real IP is realized to ensure the normal logical processing of the business.

[0046] The domain name interception method for the MacOS system provided in this embodiment captures the requested domain name, responds according to the virtual IP assigned by the authorized domain name, maps the real domain name according to the virtual IP, and thus obtains the real back-to-source IP, avoiding the need for the cloud to maintain the mapping relationship between the virtual IP and the real IP, and is friendly and compatible with wildcard domain name scenarios. This application process will not modify the DNS of the MacOS system, which can avoid affecting the user environment and ensure the normal Internet access process of unauthorized domain names.

[0047] In this embodiment, a domain name interception method for a MacOS system is provided, which can be used for a client of a MacOS system. Figure 2 is a flowchart of another domain name interception method for MacOS system according to an embodiment of the present invention. It should be noted that if there are substantially the same results, this embodiment does not use Figure 2 The process sequence shown is limited. Figure 2 As shown, the process includes the following steps:

[0048] Step S201, capture the DNS request message, and extract the request domain name information of the DNS request message.

[0049] The user logs in to the trusted VPN after multi-factor authentication. In response to the user logging in to the zero-trust VPN, authorized domain name resources and virtual IP address pools are pulled from the central platform.

[0050] The authorized domain name resources include an authorized domain name list, where the authorized domain name is a domain name that the user is allowed to access. Specifically, the authorized domain name is a Web service domain name that the user can access, such as *.internal.company.com.

[0051] Among them, the virtual IP address pool includes multiple virtual IPs. The virtual IPs are pre-allocated private IP segments, such as 10.100.20.0 / 24, which are used to isolate the real network IPs.

[0052] Set the libpcap rules. Among them, libpcap is a network packet capture function package, and the libpcap rule is the packet of port 53. Among them, the DNS packet port is 53, and the libpcap rule is used to only listen to the DNS packets and ignore other protocol traffic.

[0053] Furthermore, set the virtual IP address pool to be routed to the virtual network card started by the zero-trust vpn.

[0054] Specifically, the above step S201 includes:

[0055] Step S2011, filter the request packet data based on the libpcap rules to capture the DNS request packets.

[0056] Specifically, use the preset libpcap rules to filter the packets of port 53 and capture the DNS request packets aggregated from the user access data.

[0057] Step S2012, parse the DNS request packets and extract the requested domain name information in the DNS request packets.

[0058] Step S202, match the requested domain name information with the authorized domain name type resources to determine the target authorized domain name corresponding to the requested domain name information.

[0059] Judge the domain name requested by the user for access. When the domain name requested by the user for access is an allowed access domain name, proceed to the subsequent steps. When the domain name requested by the user for access is a non-allowed access domain name, end this process.

[0060] Specifically, this application sets the authorized domain name type resources. The authorized domain name type resources include an authorized domain name list, and there are multiple domain names that users are allowed to access in the authorized domain name list, that is, the authorized domain names.

[0061] Match the requested domain name information requested by the user with the authorized domain names in the authorized domain name type resources. When the match is successful, determine the target authorized domain name obtained by the match. When the match is unsuccessful, terminate this step.

[0062] Step S203, determine the corresponding target virtual IP based on the target authorized domain name and send the DNS response packet through the original socket disguise.

[0063] Specifically, the above step S203 includes:

[0064] Step S2031, dynamically assigning the virtual IP in the virtual IP address pool to the authorized domain name in the authorized domain name class resources, and generating a persistent mapping relationship.

[0065] Dynamically allocate a specified IP to the authorized domain name in the virtual IP address pool and perform a persistent mapping relationship.

[0066] In a possible implementation, virtual IPs are allocated based on policies such as load balancing (round robin / weighted) or geographic location.

[0067] In a possible implementation, a DHCP-like mechanism is used to allocate virtual IPs on demand.

[0068] Step S2032: Determine the target virtual IP corresponding to the target authorized domain name based on the persistent mapping relationship.

[0069] According to the persistent mapping relationship, the target authorized domain name is searched in the virtual IP address pool to obtain the target virtual IP corresponding to the target authorized domain name.

[0070] Step S2033, sending a DNS response message through raw socket masquerade.

[0071] In one implementation, when the protocol type of the DNS request message is the UDP protocol type, the DNS response message is the fastest response data packet; when the protocol type of the DNS request message is the TCP protocol type, the DNS response message is a FIN data packet.

[0072] Among them, for TCP protocol or UDP protocol, the client directly responds to the user terminal first. Further, the / etc / hosts file of the system needs to be dynamically modified to ensure that the hijacking rate is guaranteed.

[0073] Step S204: receiving an application layer request corresponding to the DNS response message.

[0074] After the user receives the DNS response message, it initiates an application layer request to the MacOS system client to request the generation of a response result corresponding to the requested IP.

[0075] The client receives the application layer request corresponding to the DNS response message. Under the guidance of the configured virtual IP routing, the application layer request message will pass through the zero-trust VPN virtual network card. The application layer request includes the target virtual IP of the request.

[0076] Step S205, searching for the target authorized domain name based on the target virtual IP, determining the real IP based on the target authorized domain name, and returning a response result of the real IP.

[0077] Specifically, the above step S205 includes:

[0078] Step S2051: Based on the persistent mapping relationship, search for the target authorized domain name corresponding to the target virtual IP.

[0079] The virtual network card of the client retrieves the information of the target authorized domain name corresponding to the target virtual IP according to the persistent mapping relationship.

[0080] Step S2052: Obtain the real IP corresponding to the target authorized domain name through the zero-trust gateway.

[0081] Step S2053: Convert the target virtual IP to a real IP and make a response.

[0082] On the virtual network card, convert the target virtual IP to a real IP to achieve the response result corresponding to the real IP, and ensure the normal logical processing of the service.

[0083] The domain name interception method for the MacOS system provided in this embodiment adopts the method of combining the libpcap library and the raw socket, and does not modify the configuration of the user system environment. Libpcap can effectively capture the domain name information of MacOS users surfing the Internet. Based on obtaining the domain name information of users surfing the Internet, then based on the virtual IP of the zero-trust application layer dynamically allocated authorized domain names, combined with the raw socket solution, return the virtual IP through the raw socket. The application layer maintains the mapping relationship between the virtual IP and the domain name, routes the traffic of the virtual IP to the virtual network card, and then converts it into a real IP through the virtual network card, so as to realize the closed loop of the virtual IP, effectively complete the interception of specific domain names, and thus realize the interception of MacOS authorized domain names. It does not interfere with the user system environment and is not affected by the DNS change of the user environment, and can effectively be compatible with the wild-card domain name scenario.

[0084] In a specific implementation, after logging in to the zero-trust VPN, it will pull the authorized domain name resources and the virtual IP address pool from the central platform, set the libpcap rules and start libpcap to capture DNS packets, and at the same time set the virtual IP address pool to be routed to the virtual network card started by the zero-trust vpn. Through the DNS packets captured by libpcap, the application layer program further analyzes the libpcap packets, extracts the domain name information in the packets, and matches the authorized domain name list.

[0085] The present invention dynamically allocates a specified IP to an authorized domain name within a virtual IP address pool and persists the mapping relationship. After the application layer captures the authorized domain name through libpcap, it searches the virtual IP address pool and then obtains the corresponding virtual IP. Finally, it sends an encapsulated DNS response packet through a raw socket; for DNS packets of the UDP protocol type, the packet with the fastest response will be preferentially used, and then for DNS packets of the TCP protocol type, it will be disguised as a FIN packet through the raw socket and responded to the DNS requester. Therefore, whether it is the TCP or UDP protocol, the local direct response will preferentially respond to the user. Of course, in order to ensure the hijacking rate, it can be assisted by dynamically modifying the / etc / hosts file of the system.

[0086] When the user receives the DNS response, an application layer request will be initiated. Under the guidance of the configured virtual IP routing, the relevant request packets will pass through the zero-trust VPN virtual network card. The virtual network card can effectively back-check the specific corresponding domain name information according to the mapping relationship between the virtual IP and the domain name, and then obtain the real IP information of the authorized domain name through the zero-trust gateway according to the domain name information, and realize the conversion of the virtual IP to the real IP on the virtual network card, so as to ensure the normal logical processing of the service.

[0087] In summary, the present invention mainly aims at the zero-trust VPN domain name hijacking scenario of the MacOS platform, and combines the user-mode virtual network card to realize the mapping relationship between the virtual IP and the domain name, and effectively realizes the interception of the authorized domain name.

[0088] In the MacOS computer environment, the present invention uses the libpcap technology in combination with the raw socket method to effectively respond with the corresponding virtual IP to the specified domain name; and on the virtual network card of the zero-trust VPN, the real domain name is back-checked through the virtual IP, so as to obtain the real IP for returning to the source, and then complete the conversion between the virtual IP and the real IP, avoiding maintaining the mapping relationship between the virtual IP and the real IP in the cloud.

[0089] In this embodiment, a client for the MacOS system is also provided. This client is used to implement the above-mentioned embodiments and preferred implementation manners, and those that have been described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that can achieve a predetermined function. Although the client described in the following embodiments is preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.

[0090] This embodiment provides a client for the MacOS system, as Figure 3 shown, including:

[0091] A capture module 301, which is used to capture DNS request packets and extract the request domain name information of the DNS request packets.

[0092] A matching module 302, configured to match the requested domain name information with the authorized domain name class resources to determine the target authorized domain name corresponding to the requested domain name information.

[0093] A sending module 303, configured to determine the corresponding target virtual IP based on the target authorized domain name, and send a DNS response message through the original socket disguise.

[0094] A receiving module 304, configured to receive the application layer request corresponding to the DNS response message.

[0095] A response module 305, configured to find the target authorized domain name based on the target virtual IP, determine the real IP based on the target authorized domain name, and return the response result of the real IP.

[0096] In some alternative embodiments, the scraping module 301 includes:

[0097] A pulling unit, configured to pull the authorized domain name class resources and the virtual IP address pool in response to the zero-trust VPN login. The authorized domain name class resources include an authorized domain name list, and the authorized domain name is the domain name that the user is allowed to access.

[0098] A setting unit, configured to set the libpcap rule, and the libpcap rule is the message of port 53.

[0099] In some alternative embodiments, the scraping module 301 includes:

[0100] A capturing unit, configured to filter the request message data based on the libpcap rule and capture the DNS request message.

[0101] A parsing unit, configured to parse the DNS request message and extract the requested domain name information in the DNS request message.

[0102] In some alternative embodiments, the sending module 303 includes:

[0103] An allocation unit, configured to dynamically allocate the virtual IPs in the virtual IP address pool to the authorized domain names in the authorized domain name class resources to generate a persistent mapping relationship.

[0104] A determining unit, configured to determine the target virtual IP corresponding to the target authorized domain name based on the persistent mapping relationship.

[0105] A sending unit, configured to send the DNS response message through the original socket disguise.

[0106] In some alternative embodiments, the response module 305 includes:

[0107] A searching unit, configured to search for the target authorized domain name corresponding to the target virtual IP based on the persistent mapping relationship.

[0108] An acquisition unit, configured to obtain the real IP corresponding to the target authorized domain name through a zero-trust gateway.

[0109] A conversion unit, configured to convert the target virtual IP into a real IP and perform a response.

[0110] The further function descriptions of the above-mentioned various modules and units are the same as those in the corresponding embodiments above, and will not be elaborated here.

[0111] The client of the MacOS system in this embodiment is presented in the form of functional units. Here, the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and a memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0112] An embodiment of the present invention further provides a computer device having the above-mentioned Figure 3 client of the MacOS system shown.

[0113] Please refer to Figure 4 , Figure 4 which is a schematic structural diagram of a computer device provided by an optional embodiment of the present invention. As shown in Figure 4 , the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including a high-speed interface and a low-speed interface. Each component communicates with each other using different buses and can be installed on a common motherboard or installed in other ways as needed. The processor can process instructions executed within the computer device, including instructions stored in the memory or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a set of blade servers, or a multi-processor system). Figure 4 In

[0114] Processor 10 can be a central processing unit, a network processor, or a combination thereof. Among them, processor 10 can further include a hardware chip. The above-mentioned hardware chip can be an application specific integrated circuit, a programmable logic device, or a combination thereof. The above-mentioned programmable logic device can be a complex programmable logic device, a field programmable gate array, a general array logic, or any combination thereof.

[0115] Among them, the memory 20 stores instructions that can be executed by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiments.

[0116] The memory 20 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system and application programs required for at least one function; the data storage area can store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some alternative embodiments, the memory 20 may optionally include a memory remotely disposed relative to the processor 10, and these remote memories can be connected to the computer device through a network. Examples of the above network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0117] The memory 20 may include a volatile memory, for example, a random access memory; the memory may also include a non-volatile memory, for example, a flash memory, a hard disk, or a solid-state drive; the memory 20 may also include a combination of the above types of memories.

[0118] The computer device further includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30, and the output device 40 may be connected through a bus or other means. Figure 4 Taking connection through a bus as an example.

[0119] The input device 30 can receive input digital or character information, and generate key signal inputs related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a trackpad, a touchpad, a pointing stick, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (for example, an LED), and a haptic feedback device (for example, a vibration motor), etc. The above display device includes but is not limited to a liquid crystal display, a light-emitting diode, a display, and a plasma display. In some alternative embodiments, the display device may be a touch screen.

[0120] Embodiments of the present invention also provide a computer-readable storage medium. The method according to the embodiments of the present invention can be implemented in hardware, firmware, or be implemented as computer code that can be recorded on a storage medium, or be implemented as computer code that is originally stored in a remote storage medium or a non-transitory machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid-state drive, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by the computer, the processor, or the hardware, the method shown in the above embodiments is implemented.

[0121] A part of the present invention can be applied as a computer program product, for example, computer program instructions. When executed by a computer, through the operation of the computer, the method and / or technical solution according to the present invention can be called or provided. Those skilled in the art should be able to understand that the forms of existence of computer program instructions in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Herein, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible by the computer.

[0122] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for intercepting domain names in a MacOS system, characterized in that, A client applied to the MacOS system, the method includes: Capture a DNS request packet and extract the requested domain name information of the DNS request packet; Match the requested domain name information with authorized domain name resources to determine the target authorized domain name corresponding to the requested domain name information; Determine the corresponding target virtual IP based on the target authorized domain name and send a DNS response packet through raw socket spoofing; Receive the application layer request corresponding to the DNS response packet; Search for the target authorized domain name based on the target virtual IP, determine the real IP based on the target authorized domain name, and return the response result of the real IP.

2. The domain name interception method for the MacOS system according to claim 1, wherein, Before capturing the DNS request packet, it further includes: In response to zero-trust VPN login, pull the authorized domain name resources and the virtual IP address pool. The authorized domain name resources include an authorized domain name list, and the authorized domain name is the domain name that the user is allowed to access. The virtual IP address pool includes multiple virtual IPs; Set the libpcap rule, and the libpcap rule is the packet of port 53.

3. The domain name interception method for the MacOS system according to claim 2, wherein The capturing the DNS request packet and extracting the requested domain name information of the DNS request packet includes: Filter the request packet data based on the libpcap rule to capture the DNS request packet; Parse the DNS request packet and extract the requested domain name information in the DNS request packet.

4. The method for intercepting domain names of the MacOS system according to claim 2, wherein, The determining the corresponding target virtual IP based on the target authorized domain name and sending a DNS response packet through raw socket includes: Dynamically allocate the virtual IPs in the virtual IP address pool to the authorized domain names in the authorized domain name resources to generate a persistent mapping relationship; Based on the persistent mapping relationship, determine the target virtual IP corresponding to the target authorized domain name; Send a DNS response packet through raw socket spoofing.

5. The method for intercepting domain names of the MacOS system according to claim 4, wherein The sending a DNS response packet through raw socket spoofing includes: When the protocol type of the DNS request packet is the UDP protocol type, the DNS response packet is the fastest response data packet; When the protocol type of the DNS request packet is the TCP protocol type, the DNS response packet is a FIN data packet.

6. The domain name interception method for the MacOS system according to claim 4, wherein The searching for the target authorized domain name based on the target virtual IP, determining the real IP based on the target authorized domain name, and returning the response result of the real IP includes: Search for the target authorized domain name corresponding to the target virtual IP based on the persistent mapping relationship; Obtain the real IP corresponding to the target authorized domain name through the zero-trust gateway; Convert the target virtual IP to the real IP and make a response.

7. A client for the MacOS system, characterized in that, The client includes: A capturing module for capturing a DNS request packet and extracting the requested domain name information of the DNS request packet; A matching module for matching the requested domain name information with authorized domain name resources to determine the target authorized domain name corresponding to the requested domain name information; A sending module for determining the corresponding target virtual IP based on the target authorized domain name and sending a DNS response packet through raw socket spoofing; A receiving module configured to receive an application layer request corresponding to the DNS response message. A response module configured to find the target authorized domain name based on the target virtual IP, determine the real IP based on the target authorized domain name, and return a response result of the real IP.

8. A computer device, characterized in that, Comprising: A memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to perform the domain name interception method of the MacOS system according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Computer instructions are stored on the computer-readable storage medium, and the computer instructions are used to cause a computer to perform the domain name interception method of the MacOS system according to any one of claims 1 to 6.

10. A computer program product, characterized in that, Comprising computer instructions, and the computer instructions are used to cause a computer to perform the domain name interception method of the MacOS system according to any one of claims 1 to 6.

Images