Ftp packet association method and apparatus, electronic device, and storage medium

Abstract

The present application provides an FTP packet association method and apparatus, an electronic device, and a storage medium. The method comprises: in response to a received FTP data packet, acquiring session information corresponding to the FTP data packet, and mounting the session information in the FTP data packet; performing IP address translation on the FTP data packet by means of NAT-PT, and then acquiring a first negotiation linked list on the basis of the session information, wherein negotiation nodes in the first negotiation linked list respectively correspond to FTP control packets and record negotiation information, used for data transmission negotiation, of the FTP control packets; respectively matching the session information and the negotiation information of the negotiation nodes in the first negotiation linked list to determine a target negotiation node; and associating the FTP control packet corresponding to the target negotiation node with the FTP data packet. Thus, after IP address translation is performed on an FTP packet by means of NAT-PT, a network security device can correctly associate the FTP data packet with an FTP control packet.

Description

FTP message association method, device, electronic device and storage medium Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device, electronic device and storage medium for associating FTP messages. Background Art

[0002] With the promotion of IPv6 (Internet Protocol Version 6), there is a demand for communication between IPv6 and IPv4 networks. The development of NAT-PT (Network Address Translation-Protocol Translation) technology can achieve address translation between IPv6 and IPv4, which enables IPv6 devices to access IPv4 resources.

[0003] However, because NAT-PT introduces address and protocol conversion, network security devices may not be able to accurately identify and associate when processing some protocols that rely on IP address information (such as the FTP protocol). When using the FTP protocol for data transmission, the network device needs to identify and associate the FTP control message with the FTP data message. In the related art, the network device can only identify and associate the FTP control message and the FTP data message between the client and the server when the networks on both ends of the client and the server are the same IP address version (both IPv4 or IPv6). When the IP address versions of the networks on both ends are different, the network device cannot correctly associate the FTP control message and the FTP data message between the two ends.

[0004] Summary of the Invention

[0005] The present application provides a method, device, electronic device and storage medium for associating FTP messages to avoid the problem that FTP data messages cannot be correctly associated with FTP control messages after the FTP messages undergo address conversion.

[0006] In a first aspect of the present application, a method for associating FTP messages is provided, which is applied to a network device configured with NAT-PT, and includes:

[0007] In response to the received FTP data message, obtaining session information corresponding to the FTP data message, and attaching the session information to the FTP data message;

[0008] After performing IP address translation on the FTP data message using the NAT-PT, obtaining a first negotiation linked table based on the session information, wherein each negotiation node in the first negotiation linked table corresponds to an FTP control message and records negotiation information in the FTP control message for negotiating an FTP data channel;

[0009] Matching the session information with the negotiation information recorded by each negotiation node in the first negotiation linked list to determine a target negotiation node;

[0010] The FTP control message corresponding to the target negotiation node is associated with the FTP data message.

[0011] In an exemplary embodiment of the present application, it further includes:

[0012] receiving a first message, and performing IP address translation on the first message using the NAT-PT;

[0013] If it is determined that the first message after the IP address conversion is an FTP control message, and the FTP control message carries a control command for negotiating an FTP data channel, negotiation information for negotiating the FTP data channel in the FTP control message is recorded in a negotiation node of a second negotiation linked table, where the second negotiation linked table is determined by the IP address version in the FTP control message.

[0014] In an exemplary embodiment of the present application, determining that the FTP control message carries a control command for negotiating an FTP data channel includes:

[0015] It is determined whether the FTP control message has a preset negotiation field, and if so, it is determined that the FTP control message carries a control command for negotiating an FTP data channel.

[0016] In an exemplary embodiment of the present application, recording the negotiation information for negotiating the FTP data channel in the FTP control message into the negotiation node of the second negotiation linked table includes:

[0017] Extracting the field value of the preset negotiation field in the FTP control message to obtain the negotiated IP address and the negotiated port number;

[0018] The negotiated IP address and the negotiated port number are recorded as negotiation information in a negotiation node of the second negotiation linked table, where the negotiation node corresponds to the FTP control message.

[0019] In an exemplary embodiment of the present application, the session information includes at least the destination IP address, destination port, and IP address version of the FTP data message, and obtaining the first negotiation linked table according to the session information includes:

[0020] The first negotiation chain table is determined according to the IP address version in the session information. If the IP address version in the session information is IPv4, the first negotiation chain table is an IPv4 negotiation chain table. If the IP address version is IPv6, the first negotiation chain table is an IPv6 negotiation chain table.

[0021] In a second aspect of the present application, there is provided an FTP message association device, which is applied to a network device configured with NAT-PT, and includes:

[0022] a first acquiring unit, configured to acquire, in response to a received FTP data message, session information corresponding to the FTP data message, and embed the session information in the FTP data message;

[0023] a second acquiring unit, configured to, after performing IP address translation on the FTP data message using the NAT-PT, acquire a first negotiation linked table according to the session information, wherein each negotiation node in the first negotiation linked table corresponds to an FTP control message and records negotiation information in the FTP control message for negotiating an FTP data channel;

[0024] a matching unit, configured to match the session information with the negotiation information recorded by each negotiation node in the first negotiation linked list to determine a target negotiation node;

[0025] The associating unit is configured to associate the FTP control message corresponding to the target negotiation node with the FTP data message.

[0026] In a third aspect of the present application, an electronic device is provided, comprising a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor is configured to execute the machine-executable instructions to implement any of the methods provided in the first aspect.

[0027] In a fourth aspect of the present application, a machine-readable storage medium is provided, wherein the machine-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed by a processor, any one of the methods provided in the first aspect is implemented.

[0028] In a fifth aspect of the present application, a computer program product is provided, comprising a computer program / instruction, which implements the steps of the method provided in the first aspect when executed by a processor.

[0029] It can be seen from the above technical solution that the present application obtains the session information corresponding to the FTP data message in response to the received FTP data message, and mounts the session information in the FTP data message. After using the NAT-PT to convert the IP address of the FTP data message, a first negotiation linked table is obtained according to the session information. Each negotiation node of the first negotiation linked table corresponds to an FTP control message and records the negotiation information in the FTP control message used to negotiate the FTP data channel. The session information is matched with the negotiation information recorded by each negotiation node in the first negotiation linked table, the target negotiation node is determined, and the FTP control message corresponding to the target negotiation node is associated with the FTP data message. This ensures that after the FTP message is converted into an IP address through NAT-PT, the network device can correctly associate the FTP data message and the FTP control message. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] FIG1 is a flow chart of a method for associating FTP messages provided in an embodiment of the present application;

[0031] FIG2 is a diagram illustrating a NAT46 network configuration according to an embodiment of the present application;

[0032] FIG3 is a schematic diagram of a process for adding a negotiation node according to an embodiment of the present application;

[0033] FIG4 is a schematic diagram of a process of matching negotiation nodes provided in an embodiment of the present application;

[0034] FIG5 is a schematic structural diagram of an FTP message association device provided in an embodiment of the present application;

[0035] FIG6 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. Like reference numerals in the drawings represent like or similar parts, and thus repetitive description thereof will be omitted.

[0037] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner.In the following description, many specific details are provided so as to provide a full understanding of the embodiments of the present application. However, it will be appreciated by those skilled in the art that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps etc. can be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0038] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0039] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, while others may be combined or partially combined. Therefore, the actual execution order may vary depending on the actual situation.

[0040] Those skilled in the art will understand that the drawings are merely schematic diagrams of example embodiments, and the modules or processes in the drawings are not necessarily necessary for implementing the present application, and therefore cannot be used to limit the scope of protection of the present application.

[0041] First, some technical abbreviations involved in this application are explained:

[0042] NAT-PT (Network Address Translation-Protocol Translation) is a technology that enables communication between IPv4 and IPv6 networks by translating addresses and protocols, allowing them to access each other.

[0043] FTP: File Transfer Protocol. FTP is an application layer protocol based on TCP (Transmission Control Protocol). It is used for bidirectional controlled transfer of various file types, such as text, images, and audio, over a network. The two parties interacting over FTP are the FTP client and the FTP server.

[0044] When using the FTP protocol for data transmission, the network device needs to identify and associate FTP control messages with FTP data messages. In the related art, the network device can only identify and associate FTP control messages and FTP data messages between the client and the server when the networks on both ends of the client and the server are the same IP address version (both IPv4 or IPv6). When the IP address versions of the networks on both ends are different, such as in a networking environment where the client is IPv4 and the server is IPv6, the network device receives the FTP control message (IPv4 message) sent by the client. The FTP control message is converted into an IPv6 message after NAT conversion. The network device will record the information obtained by parsing the FTP control message (IPv6 message) in an IPv6 mapping table. The network device receives an FTP data packet (IPv6 packet) from the server. This FTP data packet is actually associated with the FTP control packet mentioned above. However, after NAT, this FTP data packet becomes an IPv4 packet. The network device will determine the IPv4 mapping table based on the Version field in the FTP data packet (IPv4 packet). Obviously, the network device cannot match the FTP control packet associated with this FTP data packet in the IPv4 mapping table.

[0045] In view of this, the present application provides an FTP message association method. Referring to FIG1 , which is a flow chart of an FTP message association method provided in an embodiment of the present application, the FTP message association method is applied to a network device configured with NAT-PT.

[0046] Exemplarily, the above-mentioned network devices can be network security devices such as firewalls and gateways that provide network security services, or they can be any processing devices that are equipped with additional network security functional services on the basis of the original device functional services. The specific device type and deployment form can be relatively flexible in actual operation and can be configured according to actual needs. The embodiments of the present application do not specifically limit this.

[0047] Exemplarily, the network device can monitor all traffic in the target network. For example, if the target network includes the network device, a client, and a server, the network device can receive all traffic sent by the client and server, perform monitoring and NAT-PT on the traffic, and then forward it.

[0048] As shown in FIG1 , the FTP message association method may include the following steps:

[0049] Step 101: In response to a received FTP data message, obtain session information corresponding to the FTP data message, and attach the session information to the FTP data message.

[0050] In an embodiment of the present application, in order to ensure that the network device can correctly associate the FTP data message and the FTP control message after the IP address of the FTP message is converted through NAT-PT, before the IP address of the FTP message is converted through NAT-PT, the session information corresponding to the FTP data message can be obtained in response to the received FTP data message, and the session information can be mounted in the FTP data message.

[0051] In some embodiments, the network device receives all packets in the target network and determines whether the received packets are FTP data packets.

[0052] Specifically, since FTP data messages usually use the fixed port 20 as the source or destination port number, it is possible to determine whether the received message is an FTP data message by checking whether the source or destination port of the message is 20.

[0053] In addition, whether the received message is an FTP data message may also be determined by using a protocol analysis tool, deep packet inspection (DPI), etc., which is not specifically limited in the embodiments of the present application.

[0054] Exemplarily, the above session information includes at least the destination IP, destination port and IP address version of the FTP data message. Of course, the above session information can also include the source IP, source port, session ID, etc. of the FTP data message. The embodiments of the present application do not specifically limit this.

[0055] In some embodiments, a custom session information field can be added to the FTP data message header to store the above session information, or the above session information can be directly added to the data part of the FTP data message, or a custom FTP extended command or an extended field of the FTP protocol can be used to transmit the above session information.

[0056] Step 102: After using the NAT-PT to convert the IP address of the FTP data message, a first negotiation list is obtained according to the session information. Each negotiation node in the first negotiation list corresponds to an FTP control message and records the negotiation information in the FTP control message used to negotiate the FTP data channel.

[0057] In an embodiment of the present application, after the session information corresponding to the FTP data message is attached to the FTP data message in step 101, NAT-PT is used to translate the IP address of the FTP data message. After the FTP data message passes through NAT-PT, its IP address version will change, but the session information attached to the FTP data message will not change and will remain the session information of the FTP data message before NAT-PT.

[0058] In some embodiments, the session information includes at least the destination IP address, destination port, and IP address version of the FTP datagram. The first negotiation chain table can be determined based on the IP address version in the session information. If the IP address version in the session information is IPv4, the first negotiation chain table is an IPv4 negotiation chain table. If the IP address version is IPv6, the first negotiation chain table is an IPv6 negotiation chain table. The IPv4 negotiation chain table and the IPv6 negotiation chain table are two independent negotiation chain tables.

[0059] In some embodiments, the following steps may be used to correspond each negotiation node in the negotiation linked list to an FTP control message and record negotiation information in the FTP control message for negotiating an FTP data channel.

[0060] S1: Receive a first message, and use the NAT-PT to perform IP address translation on the first message.

[0061] In some embodiments, the network device receives a first message, which may be all messages in the target network. After receiving the first message, the network device uses NAT-PT to convert the IP address of the first message.

[0062] S2: If it is determined that the first message after the IP address conversion is an FTP control message, and the FTP control message carries a control command for negotiating an FTP data channel, negotiation information for negotiating the FTP data channel in the FTP control message is recorded in a negotiation node of a second negotiation linked table, where the second negotiation linked table is determined by the IP address version in the FTP control message.

[0063] In some embodiments, since FTP control connections usually use the fixed port 21 as the source or destination port, it is possible to determine whether the message is an FTP control message by checking whether the source or destination port number of the message is 21.

[0064] FTP control messages follow the FTP protocol specifications and are typically transmitted in text format, containing FTP commands and parameters. The FTP commands and parameters in FTP control messages are a core part of the FTP protocol, so you can determine whether a message is an FTP control message by parsing the message content.

[0065] For example, an FTP control message may carry control commands such as authentication, configuration, negotiation, and response. After determining that the first message after IP address conversion is an FTP control message, it is further necessary to determine whether the FTP control message carries a control command for negotiating an FTP data channel. If it is determined that the FTP control message carries a control command for negotiating an FTP data channel, it indicates that the FTP control message carries negotiation information for negotiating the FTP data channel. The FTP control message can be used to add a negotiation node to the negotiation linked list.

[0066] In some embodiments, whether the FTP control message carries a control command for negotiating an FTP data channel can be determined by determining whether the FTP control message contains a preset negotiation field. If the FTP control message contains a preset negotiation field, such as "PORT" or "Entering Passive Mode," it can be determined that the FTP control message carries a control command for negotiating an FTP data channel.

[0067] For example, FTP has two data transmission modes: PORT active mode and PASV passive mode. If the FTP control message contains a preset negotiation field "PORT", such as "PORT(1,0,0,1,8,9)", it can be determined that in PORT active mode, the FTP control message carries a PORT control command for negotiating the FTP data channel.

[0068] If the FTP control message contains a preset negotiation field "Entering Passive Mode", for example, "Entering Passive Mode (227), Entering Passive Mode (1, 0, 0, 2, 8, 5)", it can be determined that in PASV passive mode, the FTP control message carries an Entering Passive Mode response for negotiating the FTP data channel, and the Entering Passive Mode response is a response to the PASV control command.

[0069] In some embodiments, the field value of the negotiation field preset in the above-mentioned FTP control message can be extracted to obtain the negotiated IP address and the negotiated port number, and the above-mentioned negotiated IP address and the above-mentioned negotiated port number can be recorded as negotiation information in the negotiation node of the second negotiation linked table, and the negotiation node corresponds to the FTP control message.

[0070] If the FTP control message contains a preset negotiation field "PORT", for example, "PORT(h1,h2,h3,h4,p1,p2)", the field value of the "PORT" negotiation field can be extracted to obtain the negotiated IP address and negotiated port number. Specifically, the negotiated IP address is "h1.h2.h3.h4", and the negotiated port number is "p1*256+p2".

[0071] Similarly, if the FTP control message contains the preset negotiation field "Entering Passive Mode", for example, "Entering Passive Mode (h1, h2, h3, h4, p1, p2)", you can extract the value of the "Entering Passive Mode" negotiation field to obtain the negotiated IP address and negotiated port number.

[0072] The negotiated IP address and negotiated port number are the negotiation information in the FTP control message used to negotiate the FTP data channel.

[0073] In some embodiments, after obtaining the above-mentioned negotiation information, the second negotiation list can be determined based on the IP address version in the above-mentioned FTP control message. If the IP address version in the above-mentioned FTP control message is IPv4, then the above-mentioned second negotiation list is an IPv4 negotiation list. If the above-mentioned IP address version is IPv6, then the above-mentioned second negotiation list is an IPv6 negotiation list.

[0074] After determining the second negotiation linked table, the negotiated IP address and the negotiated port number may be recorded as negotiation information in a negotiation node of the second negotiation linked table, and the negotiation node may also record the corresponding relationship with the FTP control message.

[0075] In an embodiment of the present application, in a NAT-PT network, by identifying an FTP control message that carries a control command for negotiating an FTP data channel, and recording the negotiation information for negotiating the FTP data channel in the FTP control message into a negotiation node in a second negotiation list, a negotiation node is added to an IPv4 negotiation list or an IPv6 negotiation list, so that the network device can associate the FTP control message with the FTP data message in the NAT-PT network by matching the session information and the negotiation node.

[0076] Step 103: Match the session information with the negotiation information recorded by each negotiation node in the first negotiation linked table to determine a target negotiation node.

[0077] In some embodiments, after obtaining the first negotiation list in step 102, the destination IP and destination port recorded in the above session information can be matched with the negotiation IP address and negotiation port number recorded by each negotiation node in the first negotiation list.

[0078] If the negotiation IP address recorded by a negotiation node in the first negotiation linked list is the same as the destination IP address recorded in the above session information, and the negotiation port number recorded by the negotiation node is the same as the destination port number recorded in the above session information, then the negotiation node is determined to be the target negotiation node.

[0079] Step 104: Associating the FTP control message corresponding to the target negotiation node with the FTP data message.

[0080] In some embodiments, as mentioned above, when the negotiated IP address and the negotiated port number are recorded as negotiation information in the negotiation node of the second negotiation linked table, the negotiation node can also record the correspondence between the above-mentioned FTP control message, so that the FTP control message corresponding to the above-mentioned target negotiation node can be associated with the FTP data message.

[0081] In an embodiment of the present application, in a NAT-PT network, the association between FTP control messages and FTP data messages is achieved by mounting session information in FTP data messages, thereby avoiding the problem that FTP data messages cannot be correctly associated with FTP control messages after the FTP messages undergo address translation.

[0082] Figure 2 shows an example of a NAT46 network configuration provided by an embodiment of the present application. Taking a networking environment where client 201 is IPv4 and server 203 is IPv6 (referred to as NAT46) as an example, the following describes the FTP message association process in active FTP mode. The FTP message association process in passive FTP mode is similar to that in active FTP mode.

[0083] Referring to Figure 3, which illustrates a process for adding a negotiation node according to an embodiment of the present application, in FTP active mode, client 201 sends an FTP control message to server 203, carrying a PORT command. The PORT command carries the temporary port number used by client 201 to negotiate the FTP data channel and informs server 203 that this is an active connection. Therefore, in FTP active mode, the process of adding a negotiation node occurs in the direction from client 201 to server 203.

[0084] Step 301: The message passes through NAT-PT and the IP address is converted.

[0085] In some embodiments, the network device 202 receives all messages (IPv4 addresses) sent from the client 201 to the server 203. The network device 202 is configured with NAT-PT. After the messages pass through NAT-PT, the messages become IPv6 addresses.

[0086] For example, network device 202 receives a PORT message from client 201 to server 203. The message is an IPv4 message with a source IP address of "6.6.6.2," a destination IP address of "6.6.6.9," a random source port such as "2056," and a destination port of "21." After NAT-PT, the message becomes an IPv6 address with a source IP address of "fe00::ac08," a destination IP address of "fe00::b," a random source port such as "2056," and a destination port of "21."

[0087] Step 302: FTP protocol identification processing.

[0088] In some embodiments, the network device 202 can identify and determine whether the message is an FTP control message through the fixed port 21.

[0089] In some embodiments, the network device 202 may determine whether the message is an IPv6 message or an IPv4 message by using the Version field of the IP protocol in the message.

[0090] Taking the example in step 301 as an example, the network device 202 identifies that the message is an FTP control message through the destination port "21" of the PORT message, and identifies that the message is an IPv6 message through the Version field of the IP protocol in the PORT message.

[0091] Step 303: If the PORT feature is found in the message, the negotiated IP address and negotiated port used for negotiating the FTP data channel in the message are added to the corresponding negotiation linked list.

[0092] In some embodiments, whether the PORT feature can be found in the message may be determined by judging whether the message contains a preset negotiation field "PORT".

[0093] Taking the example in step 301, the message is a PORT message. The negotiated IP address "fe00::ac08" and the negotiated port "2057" used to negotiate the FTP data channel in the message can be added to the IPv6 negotiation list. After completing the above steps, the PORT message will be sent to the server 203.

[0094] In an embodiment of the present application, in a NAT46 network, by identifying an FTP control message carrying a PORT control command and adding the negotiation IP address and negotiation port used to negotiate the FTP data channel in the FTP control message to the corresponding negotiation linked table, a negotiation node is added to the IPv6 negotiation linked table, so that the network device can associate the FTP control message with the FTP data message in the NAT46 network by matching the session information and the negotiation node.

[0095] Referring to Figure 4, which illustrates a process flow for matching negotiation nodes according to an embodiment of the present application, in FTP active mode, after receiving the PORT message, server 203 initiates a data connection to client 201 based on the negotiated IP address "fe00::ac08" and the negotiated port "2057" used to negotiate the FTP data channel in the message. Therefore, the process of matching negotiation nodes in FTP active mode occurs in the direction from server 203 to client 201.

[0096] Step 401: Record session information.

[0097] In some embodiments, the network device 202 receives all messages (IPv6 addresses) sent from the server 203 to the client 201. If the received message is determined to be an FTP data message, the network device 202 obtains the session information corresponding to the message and embeds the session information in the message.

[0098] Exemplarily, the above session information includes at least the destination IP, destination port and IP address version of the message.

[0099] For example, the server 203 initiates a data connection request to the client 201. The message is an IPv6 message. The source IP in the message is "fe00::b", the destination IP is "fe00::ac08", the source port is "20", and the destination port is the negotiated port "2057" indicated in the client PORT message. The network device records the session information, including the destination IP "fe00::ac08", the destination port "2057", and the IP address version "IPv6", and mounts the session information in the message.

[0100] Step 402: The message passes through NAT-PT and the IP address is converted.

[0101] The network device 202 is configured with NAT-PT. After the message carrying the session information passes through NAT-PT, the message becomes an IPv4 address.

[0102] Taking step 401 as an example, after the packet passes through NAT-PT, its IPv4 address becomes: the source IP address is "6.6.6.9," the destination IP address is "6.6.6.2," the source port is "20," and the destination port is "2057." After NAT-PT, the IP address version of the packet changes, but the session information carried in the packet remains unchanged. It remains the same session information as before NAT-PT, including the destination IP address "fe00::ac08," the destination port "2057," and the IP address version "IPv6."

[0103] Step 403: Match the session information with the negotiation information recorded by each negotiation node in the corresponding negotiation chain table, and associate the FTP control flow.

[0104] In some embodiments, the corresponding negotiation list can be determined based on the IP address version in the above session information. Taking the example in step 402, if the IP address version in the above session information is "IPv6", it is determined that the above session information is matched with the negotiation information recorded by each negotiation node in the IPv6 negotiation list.

[0105] In some embodiments, the destination IP and destination port recorded in the above session information may be matched with the negotiation IP address and negotiation port number recorded by each negotiation node in the IPv6 negotiation list.

[0106] If the negotiation IP address recorded by a negotiation node in the IPv6 negotiation linked table is the same as the destination IP address recorded in the above session information, and the negotiation port number recorded by the negotiation node is the same as the destination port number recorded in the above session information, then the negotiation node is determined to be the target negotiation node, and the FTP control message corresponding to the target negotiation node is associated with the FTP data message.

[0107] In step 303, the negotiated IP address "fe00::ac08" and port "2057" used to negotiate the FTP data channel in the PORT message are added to the IPv6 negotiation list. The session information recorded in step 401 includes the destination IP address "fe00::ac08," the destination port "2057," and the IP address version "IPv6." Therefore, the FTP control message can be accurately associated with the FTP data message.

[0108] In an embodiment of the present application, in a NAT46 network, the association between FTP control messages and FTP data messages is achieved by mounting session information in FTP data messages, thereby avoiding the problem that FTP data messages cannot be correctly associated with FTP control messages after the FTP messages undergo address conversion.

[0109] The above content describes the method provided by this application. The following describes the device provided by this application:

[0110] Please refer to Figure 5, which is a structural diagram of an FTP message association device provided in an embodiment of the present application.

[0111] As shown in FIG5 , the apparatus may include:

[0112] The first acquiring unit 501 is configured to acquire, in response to a received FTP data message, session information corresponding to the FTP data message, and embed the session information in the FTP data message.

[0113] The second acquisition unit 502 is configured to, after performing IP address translation on the FTP data message using the NAT-PT, obtain a first negotiation linked table according to the session information, wherein each negotiation node in the first negotiation linked table corresponds to an FTP control message and records negotiation information in the FTP control message for negotiating an FTP data channel.

[0114] The matching unit 503 is configured to match the session information with the negotiation information recorded by each negotiation node in the first negotiation linked table to determine a target negotiation node.

[0115] The associating unit 504 is configured to associate the FTP control message corresponding to the target negotiation node with the FTP data message.

[0116] In some embodiments, the device is also used to: receive a first message, and use the NAT-PT to convert the IP address of the first message; if it is determined that the first message after the IP address conversion is an FTP control message, and the FTP control message carries a control command for negotiating an FTP data channel, then the negotiation information used to negotiate the FTP data channel in the FTP control message is recorded in the negotiation node of the second negotiation linked table, and the second negotiation linked table is determined by the IP address version in the FTP control message.

[0117] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0118] The present application also provides a hardware structure. See Figure 6, which illustrates a block diagram of an electronic device provided in an embodiment of the present application. As shown in Figure 6, the hardware structure may include a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor. The processor is configured to execute the machine-executable instructions to implement the method disclosed in the above examples of the present application.

[0119] Based on the same application concept as the above method, an embodiment of the present application also provides a machine-readable storage medium, on which a number of computer instructions are stored. When the computer instructions are executed by a processor, the method disclosed in the above example of the present application can be implemented.

[0120] Exemplarily, the machine-readable storage medium may be any electronic, magnetic, optical, or other physical storage device that may contain or store information, such as executable instructions, data, and the like. For example, the machine-readable storage medium may be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, a storage drive (such as a hard disk drive), a solid-state drive, any type of storage disk (such as a CD, DVD, etc.), or similar storage media, or a combination thereof.

[0121] It should be noted that, in this document, relational terms such as target and objective are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0122] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for associating FTP messages, characterized in that: Applied to a network device configured with NAT-PT, the method comprises: In response to the received FTP data message, obtaining session information corresponding to the FTP data message, and attaching the session information to the FTP data message; After performing IP address translation on the FTP data message using the NAT-PT, obtaining a first negotiation linked table based on the session information, wherein each negotiation node in the first negotiation linked table corresponds to an FTP control message and records negotiation information in the FTP control message for negotiating an FTP data channel; Matching the session information with the negotiation information recorded by each negotiation node in the first negotiation linked list to determine a target negotiation node; The FTP control message corresponding to the target negotiation node is associated with the FTP data message.

2. The method according to claim 1, characterized in that The method further includes: receiving a first message, and performing IP address translation on the first message using the NAT-PT; If it is determined that the first message after the IP address conversion is an FTP control message, and the FTP control message carries a control command for negotiating an FTP data channel, negotiation information for negotiating the FTP data channel in the FTP control message is recorded in a negotiation node of a second negotiation linked table, where the second negotiation linked table is determined by the IP address version in the FTP control message.

3. The method according to claim 2, characterized in that The determining that the FTP control message carries a control command for negotiating an FTP data channel includes: It is determined whether the FTP control message has a preset negotiation field, and if so, it is determined that the FTP control message carries a control command for negotiating an FTP data channel.

4. The method according to claim 3, characterized in that The step of recording the negotiation information for negotiating the FTP data channel in the FTP control message into the negotiation node of the second negotiation linked table includes: Extracting the field value of the preset negotiation field in the FTP control message to obtain the negotiated IP address and the negotiated port number; The negotiated IP address and the negotiated port number are recorded as negotiation information in a negotiation node of the second negotiation linked table, where the negotiation node corresponds to the FTP control message.

5. The method according to claim 1, wherein The session information includes at least a destination IP address, a destination port, and an IP address version of the FTP data message, and obtaining the first negotiation linked list according to the session information includes: The first negotiation chain table is determined according to the IP address version in the session information. If the IP address version in the session information is IPv4, the first negotiation chain table is an IPv4 negotiation chain table. If the IP address version is IPv6, the first negotiation chain table is an IPv6 negotiation chain table.

6. A device for associating FTP messages, characterized in that: Applied to a network device configured with NAT-PT, the apparatus comprises: a first acquiring unit, configured to acquire, in response to a received FTP data message, session information corresponding to the FTP data message, and embed the session information in the FTP data message; a second acquiring unit, configured to, after performing IP address translation on the FTP data message using the NAT-PT, acquire a first negotiation linked table according to the session information, wherein each negotiation node in the first negotiation linked table corresponds to an FTP control message and records negotiation information in the FTP control message for negotiating an FTP data channel; a matching unit, configured to match the session information with the negotiation information recorded by each negotiation node in the first negotiation linked list to determine a target negotiation node; The associating unit is configured to associate the FTP control message corresponding to the target negotiation node with the FTP data message.

7. The device according to claim 6, characterized in that The device is also used to: receiving a first message, and performing IP address translation on the first message using the NAT-PT; If it is determined that the first message after the IP address conversion is an FTP control message, and the FTP control message carries a control command for negotiating an FTP data channel, negotiation information for negotiating the FTP data channel in the FTP control message is recorded in a negotiation node of a second negotiation linked table, where the second negotiation linked table is determined by the IP address version in the FTP control message.

8. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor is configured to execute the machine-executable instructions to implement the method according to any one of claims 1 to 5.

9. A machine-readable storage medium, characterized in that The machine-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 are implemented.

Images