CN1476208A - A method of supporting address translation application gateway - Google Patents

Abstract

The invention relates to a method for supporting an address conversion application gateway. Including creating an address translation application gateway registry on the router, each registry entry identifies a kind of application protocol; defining an interface for processing callback functions in the network address translation module (NAT), if NAT needs to support a new application Protocol, according to the above-mentioned special processing callback function interface, establish a corresponding application protocol processing function for the address information that needs to be processed in the message payload of this protocol, and register it in the application gateway registry; during the communication process, when there is a new protocol When it occurs, the application protocol is identified by searching the application gateway registry, and the address translation of the application gateway is realized through the registered application protocol callback function. The invention well solves the problem that address conversion needs to continuously support new application protocols.

Description

A method of supporting address translation application gateway

technical field

The invention relates to the field of data communication, in particular to a method for supporting an address translation application gateway by searching the application gateway registry.

technical background

The rapid popularization of the Internet has led to the increasingly prominent problem of the shortage of IP address resources. To solve this contradiction, the Network Address Translation (NAT Network Address Translation) technology is proposed. Address translation technology allows multiple internal hosts to share the same legal public address to access the Internet, effectively solving the problem of IP address shortage, but it will cause many NAT-sensitive application protocols to fail to work normally.

The Internet Assigned Numbers Organization stipulates that the following three types of network addresses are reserved for private addresses:

10.0.0.0 - 10.255.255.255

172.16.0.0 - 172.31.255.255

192.168.0.0 - 192.168.255.255

As shown in FIG. 1, the internal network is an internal local area network using the above-mentioned "private address". Through address translation technology, all hosts (or some hosts) in this internal LAN can access the Internet.

There are two ways of address translation: one-to-one and PAT (port address tranlation). One-to-one address translation only converts the IP address information in the message. In this mode, each internal host must occupy an IP address in the address pool. When the addresses in the address pool are exhausted, It cannot allow other hosts to access the Internet. Therefore, the NAT mode only allows several hosts to access the Internet at the same time, and the number of hosts that can access the Internet at the same time is limited by the number of legal addresses.

The address translation of the PAT method uses the port information of TCP/UDP, and uses "address + port" to distinguish different connections initiated by the host of the internal LAN. That is, to convert the source address in the data packet, the port information is also converted. Many hosts can share one IP address to access the Internet, which allows more internal hosts to access the Internet at the same time. In actual use, the PAT method is the most important address translation method.

Address translation changes the IP address information of the IP data packet header, which can hide the real IP address of the internal LAN, so it has a certain security protection effect, but it will cause many application protocols sensitive to address translation to fail to work normally.

The so-called NAT-sensitive protocol refers to the address information carried in the payload of some packets of the protocol, which requires special processing by NAT. In addition to changing the address information of the 1P packet header, the address information in the data packet load also needs to be changed. If these IP addresses and port numbers are not converted according to the address conversion rules, it will seriously affect the subsequent protocol interaction. A very typical application is the FTP protocol. The following uses FTP as an example to illustrate.

There are two types of connections in FTP: control connections (sessions) and data connections (transmissions). Among them, the control connection is a TCP connection with port 21 that everyone is familiar with. The data connection is "informed" by the client through the control connection to the server that it has initialized the address and port, and then the FTP server transmits the data to the client through port 20 (by default). When the client notifies the server, it will use the "PORT command", which is in the data of this TCP connection: "PORT 10, 110, 1, 2, 13, 23\D\A" (meaning: Port=13<<8+23, address=10.110.1.2, wherein the address is the IP address of the client in the internal network), so the server can know the address and port of the data connection of the client. Obviously, in the process of address translation, for the PORT command, in addition to changing the IP address and port information, we must also change the data in the corresponding TCP, so as to ensure that the FTP server can send the data to the correct client.

With the development of the Internet, address translation needs to support more and more application protocols, and it must be specially processed for each protocol sensitive to NAT, that is, the address translation application-level gateway that needs to implement these protocols. With the increase of applications, it is required that address translation can easily support new application gateways and have good scalability in the process.

Contents of the invention

Aiming at the shortcomings of the prior art, the present invention proposes a method for supporting address conversion application gateways through registration to solve the problem of supporting protocols after address conversion.

A method for supporting an address translation application gateway, characterized in that:

Create an address translation application gateway registry on the router, and each registry entry identifies a kind of application protocol;

Define an interface for processing callback functions in the network address translation module (NAT). If NAT needs to support a new application protocol, according to the above-mentioned special processing callback function interface, address information that needs to be processed in the message load of this protocol Establish the corresponding application protocol processing function and register it in the application gateway registry;

During the communication process, when a new protocol appears, the application protocol is identified by searching the application gateway registry, and the address conversion of the application gateway is realized through the registered application protocol callback function.

The method for supporting an address conversion application gateway further includes using the IP protocol number corresponding to the application protocol, the well-known port number, and the processing callback function pointer of the application protocol as registration parameters.

The application protocol processing function only converts the private address in the payload of the protocol message into a legal public address.

The described method for supporting the address translation application gateway also includes a step of setting an access control list, which is based on the IP packet header and the rules defined in the format of the upper layer protocol packet header carried by it, and judges whether to access the data by the rule. Packet address translation.

The application protocol message is forwarded to a server located on the public network, and different special processing needs to be performed when forwarding to a server in a private network. The application gateway needs to provide special processing application protocol processing functions for servers in different locations. These The processing functions are all registered in the application gateway registry entry, and the address translation process determines which callback function to call according to the location of the forwarding destination server of the message.

The application protocol message is forwarded from the private network to the public network, and requires different special processing than when it is forwarded from the public network to the private network. The application gateway needs to provide special processing application protocol processing functions for the conversion direction and the restoration direction, respectively. These processing functions are all registered in the application gateway registry key, and the address translation process determines which callback function to call according to the forwarding direction of the message.

According to the method of supporting address translation application gateway, the process of forwarding the data message from the private network to the public network is as follows:

After a, the address translation module receives the message that the IP layer transfers, judges according to the access control list whether to carry out address translation to this message, if do not need conversion just directly forward, if need conversion then enter step b;

b. Get the source address information of the message and search the address translation hash table. If not found, create a new address translation hash table according to the configured address translation. Private addresses and legal Internet addresses are recorded in the address translation hash table information;

c. Convert the source address of the message into a legal Internet address according to the information recorded in the address translation hash table;

d, search the application gateway registration form, and determine whether the special processing of the application gateway is required for the message according to the search result, if not, that is, only the address information in the message header needs to be converted, and the address conversion is completed, otherwise enter step e;

e. By calling the application protocol processing function specially processed by this protocol, the address information in the packet payload is converted.

In the method for supporting the address translation application gateway, in step d, for the internal host to access the Internet server, it is only necessary to search for the application gateway registry entry according to the IP protocol number and the destination port.

In the method for supporting an address translation application gateway, the translation process in step c is completed by NAT, and only the IP address in the message header is translated.

In the method for supporting address translation application gateways, the process of forwarding data packets from the public network to the private network is as follows:

a. After the address translation module receives the message transferred from the IP layer, it searches for the address translation record in the address translation hash table according to the destination address and destination port of the message. If there is no corresponding address translation hash table, NAT translation is not performed. , directly forward the message, if the corresponding address translation hash table is found, then go to step b;

b. According to the address translation information recorded in the hash table, the address translation module converts the destination address information in the message header into the address of the private network user;

c. Search the application gateway registration form, and determine whether the special processing of the application gateway is required for the message according to the search result. If not, the address restoration process has ended. If necessary, enter step d;

d. Call the application protocol processing function in the restoring direction to convert the address information in the packet payload. In the step b, only the IP address in the message header is converted.

On the basis of realizing the general address conversion function, the invention provides a perfect address conversion application gateway expansion mechanism through special protocol registration. If address translation is required to support a new application protocol, it is only necessary to develop the address translation application-level gateway of the protocol, and register it with the application gateway registration method of this method, so that the NAT technology can support the protocol without changing the NAT processes and other already supported protocols. The invention is convenient to support new application protocols in flow, and well solves the problem that address conversion needs to continuously support new application protocols.

Description of drawings

Fig. 1 is a typical networking diagram of NAT in the prior art;

Fig. 2 is the address translation flowchart that IP message of the present invention is sent to Internet by internal private network;

Fig. 3 is the address conversion flow chart of the present invention that the IP message is sent from the Internet to the internal private network.

Detailed ways

The specific implementation manners of the present invention will be described below in conjunction with the accompanying drawings.

The core idea of the present invention is to expand NAT to support new application gateways by means of registration, to identify application protocols by searching registration entries of application gateways, and to realize the address conversion process of application gateways through registered callback functions.

The present invention will first create an address conversion application gateway registry on the router, which includes the special processing callback function pointer of the application gateway, and also includes the corresponding IP protocol number and well-known port number of the protocol. In this way, each registry item It identifies a special application protocol;

Define a special processing callback function interface in NAT. The definition method of this interface may be different according to different developers, but the main function is the function of a function pointer. When NAT needs to support a new application protocol, the developer develops a corresponding application protocol processing function for the address information that needs to be processed in the message load of this protocol according to the above-mentioned special processing callback function interface, and uses this function Register in the application gateway registry as a registration parameter. The application protocol processing function only needs to convert the private address in the payload of the protocol message into a legal public address without processing the address information in the message header.

Since application protocol messages are forwarded from the private network to the public network and forwarded from the public network to the private network, different processing methods may be required, so the developed application protocol processing functions may be the same or different, so different applications can be developed The protocol processing function is divided into the application protocol processing function of the conversion direction and the restoration direction, which should be determined according to the actual situation.

Similarly, since application protocol packets are forwarded to servers located on the public network, different special processing is required when forwarding to servers in the private network. The application gateway needs to provide special processing application protocol processing functions for servers in different locations. The processing functions are all registered in the application gateway registry entry, and the address translation process determines which callback function to call according to the location of the forwarding destination server of the message.

Finally, use the IP protocol number corresponding to the application protocol, the well-known port number, and the processing callback function pointer of the application protocol as registration parameters, create a new application gateway registry entry, and add this entry to the previously formed application gateway registry . The new application gateway is implemented by means of the registration means of the NAT basic function module, without any modification to the NAT basic function module and other application gateways.

When a new protocol appears, identify the application protocol by searching the application gateway registry formed above, and realize the address conversion of the application gateway through the registered application protocol processing function.

When in use, you can set the access control list, which is actually a judgment rule, which defines the rules based on the format of the IP packet header and the upper-layer protocol packet header it carries, and can indicate that certain features are allowed or prohibited ( The packet header data can be described), and this rule determines whether to perform address translation on the incoming and outgoing data packets. If address translation is required, the application protocol is identified by searching the application gateway registry, and the address translation of the application gateway is realized through the registered application protocol processing function.

As shown in Figure 2, it is in the present invention, the flow process that a data message is forwarded from private network to public network, specifically comprises the following steps:

After a, the address translation module receives the message that IP layer transfers, judges according to the access control list of definition whether to carry out address translation to this message, just forward directly if not needing conversion; If need conversion, continue step b;

b. Get the source address (port) information of the message to search the address translation hash table. If not found, a new hash table is created according to the configured address translation. Private addresses (ports) and legal addresses are recorded in the hash table Internet address (port) information, information such as the source address, source port, protocol, time, converted address and port of each NAT conversion is recorded in the hash table, and the implementation methods of each developer may vary due to different algorithms different;

c. Convert the source address of the message into a legal Internet address according to the information recorded in the address translation hash table;

The above conversion process is completed by the basic function of NAT. In fact, only the IP address (port) in the packet header is converted. All packets that require address translation need to go through the above conversion process, regardless of whether the packet belongs to a special application protocol. , the above steps are actually consistent with the existing NAT address translation.

d. Search the application gateway registry through the address translation process: For the application of internal host access to the Internet server, because the destination port is a well-known port, only need to find the application gateway registry entry according to the IP protocol number and destination port; the address translation process is based on the search As a result, it is determined whether the special processing of the application gateway is required for the message. If not, only the address (port) information in the message header needs to be converted, and the address conversion has ended; if special processing is required for the message, then enter the step e;

e. The address conversion process directly calls the application protocol processing function of this protocol through a special processing callback function pointer, and converts the address information in the message payload. Since the pointer of the special processing callback function has been registered in advance in the application gateway registry entry, the address conversion process can directly call the callback function through the function pointer to convert the address information in the packet payload.

After steps d and e, the private address in the message payload has been converted into a legal Internet address, so that the subsequent interaction process of the application protocol can be completed normally.

As shown in Figure 3, it is the internal private network address translation flow chart that the IP message of the present invention is sent to by the Internet, as can be seen from the figure, the message is sent to the internal private network by the Internet, and the process of address translation restoration is similar to this , the difference is that the address restoration process only searches the existing hash table, and converts the destination address information of the message into the address information of the internal private network. The process is as follows:

a. After the address translation module receives the message transferred from the IP layer, it searches for the address translation record in the address translation hash table according to the destination address and destination port of the message. If there is no corresponding address translation hash table, NAT translation is not performed. , directly forward the message, if the corresponding address translation hash table is found, then go to step b;

B, according to the address translation information recorded in the hash table, the address translation module converts the destination address (port) information in the message header into the address of the private network user;

The above conversion process is also completed by the basic function of NAT, in fact, only the IP address in the packet header is converted.

c. The address restoration process searches the application gateway registry, and determines whether the message requires special processing by the application gateway according to the search result. If not, the address restoration process is over. If necessary, go to step d;

d. The address restoration process calls the application protocol processing function in the restoration direction to convert the address information in the packet payload.

On the basis of realizing the general address conversion function, the invention provides a perfect address conversion application gateway expansion mechanism through special protocol registration. If address translation is required to support a new application protocol, it is only necessary to develop the address translation application-level gateway of the protocol, and register it with the application gateway registration method of this method, so that the NAT technology can support the protocol without changing the NAT processes and other already supported protocols. The invention is convenient to support new application protocols in flow, and well solves the problem that address conversion needs to continuously support new application protocols.

Let's take the FTP protocol mentioned above as an example to illustrate.

To enable NAT to support the FTP protocol and allow internal private network users to access FTP sites on the Internet, it is necessary to determine which FTP packets need to be specially converted and what processing needs to be performed. When a private network user GETs a file or executes a LIST command, the command "PORT 10, 110, 1, 2, 13, 23\D\A" will be sent in the FTP control message (indicates: port=13<<8+ 23, address=10.110.1.2), where the address is the private network IP address of the user, and the FTP server on the Internet will send a data connection to the port specified by the PORT command. Obviously, if the PORT command is not specially treated, the establishment of a data connection will fail. It is necessary to convert the private address carried by the PORT command into a legal Internet address, and create an address translation hash table based on the address and port used by the data connection to allow FTP The server can actively initiate a data connection to the host of the private network user.

Developers develop corresponding FTP protocol processing functions according to the special processing callback function interface defined by NAT. This processing function is responsible for converting the private address carried by the FTP PORT command into a legal Internet address, and creating an address conversion hash table according to the port and address specified by the PORT command, so as to allow the FTP server to actively initiate an FTP data connection to the private network user host . This processing function only needs to process the content of the FTP control message load, without converting the address in the IP header and the port number in the TCP header. The address in the IP header and the port number in the TCP header are in charge of the NAT basic function module Convert to public address.

Finally, register the processing function of the FTP PORT command in the application gateway registry. The FTP control connection uses the well-known TCP port 21. You only need to use the TCP protocol, the well-known port 21, and the FTP PORT command processing function as registration parameters to create an application gateway registry entry. When the router starts, call the corresponding registration function to add to the application in the gateway registry. This enables NAT to support the FTP protocol.

The detailed process of NAT converting the FTP PORT message has been described above and will not be described here.

From the above example, it can be seen that to support the new application gateway with the help of the registration method of the NAT basic function module, it is only necessary to develop the corresponding special processing function of the application protocol and register it, without any need for the NAT basic function module and other application gateways. Revise.

It is not difficult to see from the above embodiments that the present invention is simple to implement, does not need to add new hardware devices, and does not have any restrictions on the existing intelligent network system, but it can greatly facilitate users.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (11)

1, a kind of method of supporting address convertion applied gateway is characterized in that:

Create the address convertion applied gateway registration table on router, each registry key identifies a kind of application protocol;

Interface of handling call back function of (NAT) definition in network address conversion module, if NAT need support a kind of new application protocol, according to above-mentioned special processing call back function interface, the address information that needs in the message load at this agreement to handle is set up application corresponding protocol processes function, and is registered to the application gateway registration table;

In communication process, when new agreement occurs, discern this application protocol by searching the application gateway registration table, realize the address transition of application gateway by the application protocol call back function of registration.

2, the method for support address convertion applied gateway as claimed in claim 1 is characterized in that also comprising that processing call back function pointer with IP protocol number, well-known port number and the application protocol of this application protocol correspondence is as the registration parameter.

3, the method for support address convertion applied gateway as claimed in claim 2 is characterized in that described application protocol processing function, only the privately owned address in this protocol massages load is converted to legal publicly-owned address.

4, the method for support address convertion applied gateway as claimed in claim 3, it is characterized in that also comprising one the Access Control List (ACL) step is set, this tabulation be according to IP packet header with and the rule of the formal definition of the upper-layer protocol data packet head that carried, whether the data message is carried out address transition by this rule judgment.

5, the method for support address convertion applied gateway as claimed in claim 4, it is characterized in that described application protocol message is to the server forwards that is positioned on the public network, need carry out different special processings during with server forwards in private network, application gateway need provide the application protocol of special processing to handle function for the server of diverse location respectively, these are handled function and all are registered in the application gateway registry key, and which call back function is the address transition flow process call according to the decision of message forwarding destination server position.

6, the method for support address convertion applied gateway as claimed in claim 5, it is characterized in that described application protocol message transmitted to public network by private network, with when private network is transmitted, need carry out different special processings from public network, application gateway need be handled function for conversion direction and reduction direction provide the application protocol of special processing respectively, these are handled function and all are registered in the application gateway registry key, and which call back function is the address transition flow process determine to call according to the message forwarding direction.

7, the method for support address convertion applied gateway as claimed in claim 6 is characterized in that the flow process that data message is transmitted to public network by private network is:

A, address conversion module judge whether and will carry out address transition to this message that if do not need conversion just directly to transmit, conversion then entering step b if desired according to Access Control List (ACL) after receiving the message that the IP layer transfers;

B, the source address information of getting message are searched the address transition hash table, if do not find, just create a new address transition hash table according to the address transition of configuration, have write down privately owned address and legal Internet address information in this address transition hash table;

C, according to the information of address transition hash table record, the source address of message is converted to legal Internet address;

D, search the application gateway registration table, determine the whether special processing of needs application gateway of this message if do not need, is promptly only needed the address information in the conversion heading according to lookup result, address transition finishes, otherwise enters step e;

E, handle function by the application protocol that calls this agreement special processing, the address information in the conversion message load.

8, the method for support address convertion applied gateway as claimed in claim 7 is characterized in that in the steps d, for inside host access Internet server, only need search the application gateway registry key according to IP protocol number and destination interface.

9, the method for support address convertion applied gateway as claimed in claim 7 is characterized in that the transfer process among the step c is finished by NAT, has only changed the IP address in the heading.

10, the method for support address convertion applied gateway as claimed in claim 6 is characterized in that when the flow process that data message is transmitted to private network by public network being:

After a, address conversion module are received the message that the IP layer transfers, destination address, destination interface according to message are searched the address transition record to address transition hash table the inside, if there is not corresponding address transition hash table, then do not carry out the NAT conversion, message is directly transmitted, if found corresponding address transition hash table, then entered step b;

B, according to the information of address conversion that writes down in the hash table, address conversion module converts the destination address information in the heading to the address of private user;

C, search the application gateway registration table, determine that according to lookup result if do not need, address reduction flow process finishes, if desired, enters steps d to the whether special processing of needs application gateway of this message;

D, the application protocol that calls the reduction direction are handled function, the address information in the conversion message load.

11, the method for support address convertion applied gateway as claimed in claim 10 is characterized in that among the described step b, has only changed the IP address in the heading.

Images