TCP reverse proxy device, method, equipment, medium and program product

Abstract

The embodiment of the invention provides a TCP reverse proxy device, method and equipment, a medium and a program product. The TCP reverse proxy device comprises an application protocol processing engine and a data plane development suite in a Linux system. A TCP reverse proxy engine and a user mode protocol stack are integrated in the data plane development suite, and the user mode protocol stack is in communication connection with the TCP reverse proxy engine; and the TCP reverse proxy engine is in communication connection with the application protocol processing engine. According to the device and the method, two services of application protocol processing and TCP reverse proxy can be separated, and the effect of bypassing a Linux kernel and a protocol stack is achieved, so that the TCP reverse proxy performance is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a TCP reverse proxy device, method, equipment, medium and program product. Background Art

[0002] Reverse proxy refers to using a proxy server to accept connection requests on the Internet, then forwarding the requests to a server on the internal network, and returning the results obtained from the server to the client requesting the connection on the Internet. At this time, the proxy server appears to the outside world as a reverse proxy server.

[0003] Among them, Nginx, as a commonly used http web server and reverse proxy server architecture, has the advantages of small memory usage, high concurrency, high scalability, high reliability and support for hot deployment. However, in practice, it is found that when there is a bug in the application protocol reverse proxy module integrated in Nginx, it will cause the process to exit abnormally, resulting in the inability to manage the device through the network, which in turn causes serious reliability problems. Summary of the invention

[0004] The purpose of this application is to provide a TCP reverse proxy device, method, equipment, medium and program product, which can separate the application protocol processing and TCP reverse proxy business, achieve the effect of bypassing the Linux kernel and protocol stack, thereby improving the TCP reverse proxy performance.

[0005] In a first aspect, the present application provides a TCP reverse proxy device, comprising:

[0006] The TCP reverse proxy device includes an application protocol processing engine and a data plane development kit in a Linux system;

[0007] The data plane development kit integrates a TCP protocol reverse proxy engine and a user-mode protocol stack, wherein:

[0008] The user state protocol stack is communicatively connected with the TCP protocol reverse proxy engine;

[0009] The TCP protocol reverse proxy engine is communicatively connected with the application protocol processing engine.

[0010] In the above implementation process, the device can build a separate connection between the application protocol processing engine and the input based on the data plane development kit (DPDK, Data Plane Development Kit), so as to reduce the impact of application protocol processing on TCP basic communication. Among them, since the device provides basic TCP communication through the TCP protocol reverse proxy engine, and provides the application protocol engine with connection information, session information, shared memory storage application protocol data, cache information and other basic functions, the device can achieve the effect that the application protocol proxy engine does not pay attention to the details of the TCP connection, thereby avoiding the mutual influence between application protocol processing and TCP basic communication.

[0011] Furthermore, the TCP reverse proxy device also includes a Linux driver and a network card, wherein:

[0012] The network card is communicatively connected to the source program and / or the destination program, and is communicatively connected to the Linux driver;

[0013] The Linux driver is communicatively connected with the user mode protocol stack.

[0014] In the above implementation process, the network card and the Linux driver further improve the TCP reverse proxy device, so that the TCP reverse proxy device can send and receive TCP data packets through the network card and the Linux driver on the basis of having the Linux kernel by default.

[0015] In a second aspect, the present application provides a TCP reverse proxy method, which is applied to the TCP reverse proxy device described in the first aspect, and the TCP reverse proxy method includes:

[0016] The user mode protocol stack obtains a TCP data packet and decapsulates the TCP data packet to obtain application protocol data;

[0017] The user state protocol stack sends the application protocol data to the TCP protocol reverse proxy engine;

[0018] The TCP protocol reverse proxy engine sends the application protocol data to the application protocol processing engine through a communication queue.

[0019] In the above implementation process, the method can receive and process TCP data packets based on the user-mode protocol stack, so that the TCP protocol reverse proxy engine can directly receive the processed application protocol data, avoiding the TCP protocol reverse proxy engine and the application protocol processing engine to transmit and process the data, thereby realizing basic business separation and avoiding the unreliability problems caused by business interference.

[0020] Furthermore, the TCP reverse proxy device includes a Linux driver and a network card, wherein:

[0021] The network card receives a TCP data packet sent by a source program; the TCP data packet is obtained by encapsulating application protocol data based on the TCP protocol by the source program;

[0022] The network card sends the TCP data packet to the Linux driver;

[0023] The Linux driver sends the TCP data packet to the user mode protocol stack.

[0024] In the above implementation process, the method receives external data through the network card, and forwards the external data through Linux driver processing, so that the method can complete the data receiving process and then build a downstream connection for data reception.

[0025] Further, sending the application protocol data to the TCP protocol reverse proxy engine includes:

[0026] The application protocol data is sent to the TCP protocol reverse proxy engine via the Socket interface.

[0027] In the above implementation process, the method can provide efficient, flexible and scalable network communication capabilities through the Socket interface, thereby supporting real-time data interaction and multiple protocols.

[0028] Furthermore, the communication queue is a non-circular queue supporting bidirectional communication, and the communication queue provides multiple shared memory blocks.

[0029] In the above implementation process, the method can achieve the effect of multi-process processing by using a communication queue, thereby solving problems such as low performance.

[0030] Furthermore, the method further comprises:

[0031] The TCP protocol reverse proxy engine applies for a first shared memory block from the communication queue;

[0032] The TCP protocol reverse proxy engine obtains first connection information of a downstream connection established between the user-mode protocol stack and the source-end program, and obtains second connection information of an upstream connection established between the user-mode protocol stack and the destination-end program;

[0033] The TCP protocol reverse proxy engine caches the security proxy policy, the first connection information and the second connection information in the first shared memory block.

[0034] In the above implementation process, the TCP protocol reverse proxy engine synchronizes the security proxy strategy and upstream and downstream connection information with the application protocol processing engine through a shared memory block, thereby avoiding repeated copying of such information, which is beneficial to improving the efficiency of the proxy.

[0035] Further, sending the application protocol data to the application protocol processing engine through the communication queue includes:

[0036] Applying for a second shared memory block from the communication queue;

[0037] Acquire the security proxy policy, the first connection information, and the second connection information cached in the first shared memory block, and store the application protocol data, the security proxy policy, the first connection information, and the second connection information in the second shared memory block;

[0038] The second shared memory block is sent to the application protocol processing engine through the communication queue.

[0039] In the above implementation process, the TCP protocol reverse proxy engine re-applies for a shared memory block for further adding application protocol data and communicates with the application protocol processing engine, so that the TCP protocol reverse proxy engine can perform subsequent secure communication processing based on the content in the original shared memory block to avoid data interference.

[0040] Furthermore, the method further comprises:

[0041] The application protocol processing engine parses and checks the application protocol data based on the security proxy policy to obtain a check result;

[0042] The application protocol processing engine caches the inspection result in a first shared memory block;

[0043] The application protocol processing engine sends the second shared memory block to the TCP protocol reverse proxy engine through a communication queue.

[0044] In the above implementation process, the first shared memory block and the second shared memory block are used to process secure communication and data transmission respectively, thereby ensuring the separation of services and improving the stability of the proxy.

[0045] Furthermore, the method further comprises:

[0046] The TCP protocol reverse proxy engine, upon receiving the second shared memory block sent by the application protocol processing engine, determines whether the inspection result in the first shared memory block is that blocking is required;

[0047] The TCP protocol reverse proxy engine, when the inspection result indicates that blocking is required, closes the downstream connection and the upstream connection, and releases the content of the first memory block and the content of the second memory block;

[0048] The TCP protocol reverse proxy engine sends the application protocol data to the user mode protocol stack when the inspection result shows that blocking is not required.

[0049] In the above implementation process, the TCP protocol reverse proxy engine can decide whether to block the connection and release the memory block content, or continue to send application protocol data to the user mode protocol stack according to the inspection result.

[0050] Furthermore, the method further comprises:

[0051] The user-mode protocol stack, when receiving the application protocol data sent by the TCP protocol reverse proxy engine, encapsulates the application protocol data to obtain the TCP data packet;

[0052] The user mode protocol stack sends the TCP data packet to the Linux driver;

[0053] The Linux driver sends the TCP data packet to the network card;

[0054] The network card sends the TCP data packet to the destination program.

[0055] In the above implementation process, the method can encapsulate the application protocol data into a TCP data packet through the user mode protocol stack, and send it to the destination program through the Linux driver and the network card, thereby realizing the upstream connection.

[0056] Furthermore, the method further comprises:

[0057] The application protocol processing engine detects the integrity of the application protocol data;

[0058] The application protocol processing engine caches the application protocol data in a first shared memory block when the application protocol data is incomplete;

[0059] When receiving the third shared memory block, the application protocol processing engine combines the supplementary protocol data in the third shared memory block with the application protocol data to obtain new application protocol data; the new application protocol data is complete.

[0060] In the above implementation process, the application protocol processing engine can ensure the integrity of the application protocol data, cache incomplete data, and combine it into complete application protocol data after receiving supplementary data. If the application protocol data is still incomplete, the method can loop the process until the application protocol data is complete, thereby ensuring that the secure communication processing is based on complete application protocol data.

[0061] Furthermore, the method further comprises:

[0062] When the remaining space of the first shared memory block is insufficient, the application protocol processing engine applies for a fourth shared memory block from the communication queue, and links the first shared memory block and the fourth shared memory block together through a linked list.

[0063] In the above implementation process, when the space of the first shared memory block is insufficient, the method can apply for a new memory block through the application protocol processing engine, and ensure the continuity of the data cache through a linked list.

[0064] Further, sending the application protocol data to the application protocol processing engine through the communication queue includes:

[0065] The application protocol data is sent to the application protocol processing engine through multiple communication queues.

[0066] In the above implementation process, the method can improve the sending efficiency and processing capacity of application protocol data through parallel processing of multiple communication queues.

[0067] Further, sending the application protocol data to the application protocol processing engine through the communication queue includes:

[0068] The multiple application protocol data are sent to the application protocol processing engine through multiple communication queues, so that the application protocol processing engine processes the multiple application protocol data in parallel; wherein the multiple application protocol data correspond to multiple source end programs.

[0069] In the above implementation process, the method can send multiple application protocol data to the processing engine in parallel through multiple communication queues, so as to realize parallel processing of protocol data from different source end programs, thereby improving processing efficiency.

[0070] In a third aspect, the present application provides an electronic device, comprising a memory and a processor, the memory being used to store a computer program, the processor running the computer program to enable the electronic device to execute the TCP reverse proxy method described in the second aspect of the present application.

[0071] In a fourth aspect, the present application provides a readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the TCP reverse proxy method described in the second aspect of the present application is executed.

[0072] In a fifth aspect, the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it executes the TCP reverse proxy method described in the second aspect of the present application.

[0073] Other features and advantages disclosed in the present application will be described in the following description, or some features and advantages can be inferred or determined without doubt from the description, or can be learned by implementing the above-mentioned technology disclosed in the present application.

[0074] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0076] Figure 1 A schematic diagram of the structure of a TCP reverse proxy device provided in an embodiment of the present application;

[0077] Figure 2 A flowchart of the TCP reverse proxy method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0078] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0079] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0080] Example 1

[0081] Please see Figure 1 , Figure 1 A schematic diagram of the structure of a TCP reverse proxy device provided in this embodiment. Figure 1 As shown, the TCP reverse proxy device includes an application protocol processing engine and a data plane development kit in a Linux system;

[0082] The data plane development kit integrates a TCP protocol reverse proxy engine and a user-mode protocol stack, including:

[0083] User-mode protocol stack, communicating with the TCP protocol reverse proxy engine;

[0084] The TCP protocol reverse proxy engine is connected to the application protocol processing engine for communication.

[0085] In this embodiment, the data plane development kit (DPDK) runs on the Linux system, and the function library and driver set for fast data packet processing can greatly improve data processing performance and throughput, and improve the work efficiency of data plane applications. DPDK uses polling instead of interrupts to process data packets. When receiving a data packet, the network card driver overloaded by DPDK will not notify the CPU through an interrupt, but directly store the data packet in the memory, and the delivery application layer software will directly process it through the interface provided by DPDK, which saves a lot of CPU interrupt time and memory copy time.

[0086] In this embodiment, the user-mode protocol stack is an open source high-performance network framework based on DPDK, which has ultra-high network performance. The network card can achieve 10 million concurrent connections under full load, providing a complete network protocol stack function, greatly improving network performance. It can support mature applications such as Nginx and Redis, and is easy to expand through a multi-process architecture.

[0087] As an optional implementation, the TCP reverse proxy device further includes a Linux driver and a network card, wherein:

[0088] A network card, communicating with the source program and / or the destination program, and communicating with the Linux driver;

[0089] Linux driver, communicating with the user mode protocol stack.

[0090] In this embodiment, the Linux driver is a Linux Driver.

[0091] In this embodiment, the reverse proxy device has a built-in Linux kernel by default.

[0092] It can be seen that the implementation of the TCP reverse proxy device described in this embodiment can separate the application protocol processing and TCP reverse proxy services, thereby achieving the effect of bypassing the Linux kernel and protocol stack, thereby improving the TCP reverse proxy performance.

[0093] Example 2

[0094] Please see Figure 2 , Figure 2 A flowchart of a TCP reverse proxy method provided in this embodiment. The TCP reverse proxy method is applied to the TCP reverse proxy device in embodiment 1, and the method includes:

[0095] S101, network card, receives the TCP data packet sent by the source program.

[0096] In this embodiment, the TCP data packet is obtained by encapsulating the application protocol data by the source program based on the TCP protocol.

[0097] In this embodiment, when the source program and the destination program perform TCP communication, they must be forwarded and security checked by the reverse proxy system to meet the security check requirements.

[0098] In this embodiment, the application protocol data sent by the source program is encapsulated into a TCP data packet through the TCP protocol, and enters the DPDK through the network card and the driver.

[0099] S102, network card, sends TCP data packet to Linux driver.

[0100] S201, Linux driver, sends TCP data packet to user mode protocol stack.

[0101] S301, the user mode protocol stack obtains a TCP data packet, and decapsulates the TCP data packet to obtain application protocol data.

[0102] In this embodiment, the TCP data packet reaches the TCP protocol reverse proxy engine through the user mode protocol stack and Socket.

[0103] S302, the user mode protocol stack sends the application protocol data to the TCP protocol reverse proxy engine through the Socket interface.

[0104] S401. The TCP protocol reverse proxy engine applies for a first shared memory block from a communication queue.

[0105] In this embodiment, after the TCP protocol reverse proxy engine obtains the application protocol data, it sends it to the application protocol proxy engine via the communication queue.

[0106] In this embodiment, the TCP protocol reverse proxy engine establishes downstream and upstream connections with the source program and the destination program respectively based on the user-mode protocol stack Socket. Two pieces of connection information (IP, port, etc.) and policy information (such as security proxy policy) are stored in a connection session. The engine applies for a shared memory (referred to as the cache block) from the communication queue to cache temporary data. The cache block information is stored in the connection information. At the same time, the cache block also stores connection, session information, policy, inspection results, inspection process data and other information.

[0107] S402, the TCP protocol reverse proxy engine obtains first connection information of a downstream connection established with a source program via a user-mode protocol stack, and obtains second connection information of an upstream connection established with a destination program via a user-mode protocol stack.

[0108] S403: The TCP protocol reverse proxy engine caches the security proxy policy, the first connection information, and the second connection information into the first shared memory block.

[0109] S404: The TCP protocol reverse proxy engine applies for a second shared memory block from the communication queue.

[0110] S405. The TCP protocol reverse proxy engine obtains the security proxy policy, the first connection information, and the second connection information cached in the first shared memory block, and stores the application protocol data, the security proxy policy, the first connection information, and the second connection information in the second shared memory block.

[0111] S406: The TCP protocol reverse proxy engine sends the second shared memory block to the application protocol processing engine through the communication queue.

[0112] In this embodiment, the TCP protocol reverse proxy engine reads the application protocol data of the downstream connection and stores it in a shared memory block requested from the communication queue, and sends the memory block to the application protocol engine via the communication queue, so that the application protocol data is sent back to the engine via the communication queue after security check, and then sent to the upstream connection according to the connection information in the memory block. The process of forwarding application protocol data from the upstream connection to the downstream connection is the same as the process of forwarding application protocol data from the downstream to the upstream connection.

[0113] In this embodiment, the communication queue is a non-locking circular queue supporting bidirectional communication, and the communication queue provides multiple shared memory blocks. Specifically, the communication queue is implemented by a lock-free circular queue, which is used to transmit the address of the shared memory block, and the shared memory block stores application protocol data and connection information. The communication queue supports bidirectional communication, and a shared memory pool is provided in the communication queue, which is composed of multiple shared memory blocks, and provides interfaces such as applying for and releasing memory blocks for the caller to use.

[0114] In this embodiment, the application protocol proxy engine supports multiple processes, the TCP protocol reverse proxy engine is integrated in the DPDK process, and the DPDK process supports multiple processes. Among them, one TCP protocol reverse proxy engine provides reverse proxy services for multiple application protocol proxy engines through multiple communication queues, and each application protocol proxy engine process communicates with the TCP protocol reverse proxy engine through a communication queue.

[0115] As an optional implementation, sending the second shared memory block to the application protocol processing engine through the communication queue includes:

[0116] The second shared memory block is sent to the application protocol processing engine through multiple communication queues.

[0117] In this embodiment, in a scenario where a TCP protocol reverse proxy engine is used for multiple application protocol proxy engines, the TCP protocol reverse proxy engine provides a connection-based load balancing function to achieve the diversion of different connections to different application protocol proxy engine processes.

[0118] As an optional implementation, sending the second shared memory block to the application protocol processing engine through the communication queue includes:

[0119] Multiple second shared memory blocks are sent to the application protocol processing engine through multiple communication queues, so that the application protocol processing engine processes multiple second shared memory blocks in parallel; wherein the multiple second shared memory blocks correspond to multiple source end programs.

[0120] S501. The application protocol processing engine parses and checks the application protocol data based on the security proxy policy to obtain a check result.

[0121] In this embodiment, the application protocol engine processes application protocol data and checks data security.

[0122] In this embodiment, the application protocol engine polls the communication queue, reads the shared memory block, obtains the connection information, session information, policy information, and cache block information in the shared memory block, and then checks the application protocol data based on this information. After the check is completed, the check results and process data are cached in the cache block, and finally the shared memory block is returned to the TCP protocol reverse proxy engine via the communication queue.

[0123] As an optional implementation, the method further includes:

[0124] Application protocol processing engine, detects the integrity of application protocol data;

[0125] The application protocol processing engine caches the application protocol data in the first shared memory block when the application protocol data is incomplete;

[0126] When receiving the third shared memory block, the application protocol processing engine combines the supplementary protocol data in the third shared memory block with the application protocol data to obtain new application protocol data; the new application protocol data is complete.

[0127] As an optional implementation, the application protocol processing engine applies for a fourth shared memory block from the communication queue when the remaining space of the first shared memory block is insufficient, and links the first shared memory block and the fourth shared memory block together through a linked list.

[0128] In this embodiment, when the cache block space is insufficient, the method may apply for a shared memory block from the communication queue again, and link multiple cache blocks through a linked list.

[0129] S502: The application protocol processing engine caches the inspection result in the first shared memory block.

[0130] S503: The application protocol processing engine sends the second shared memory block to the TCP protocol reverse proxy engine through the communication queue.

[0131] S407. When receiving the second shared memory block sent by the application protocol processing engine, the TCP protocol reverse proxy engine determines whether the inspection result in the first shared memory block needs to be blocked, and executes step S408 or S409.

[0132] In this embodiment, secure application protocol data reaches the TCP protocol reverse proxy engine via the communication queue.

[0133] S408. When the check result shows that blocking is required, the TCP protocol reverse proxy engine closes the downstream connection and the upstream connection, releases the content of the first memory block and the content of the second memory block, and ends the process.

[0134] S409. When the inspection result shows that blocking is not required, the TCP protocol reverse proxy engine sends the application protocol data to the user mode protocol stack.

[0135] S303. When receiving the application protocol data sent by the TCP protocol reverse proxy engine, the user mode protocol stack encapsulates the application protocol data to obtain a TCP data packet.

[0136] In this embodiment, secure application protocol data is encapsulated into a data packet, a driver, and a network card via a communication queue, a user-mode protocol stack, and a TCP protocol to reach a destination program.

[0137] S304, the user mode protocol stack sends a TCP data packet to the Linux driver.

[0138] S202, Linux driver, sends TCP data packet to the network card.

[0139] S103, the network card sends a TCP data packet to the destination program.

[0140] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0141] It can be seen that the TCP reverse proxy method described in this embodiment can bypass the Linux kernel and protocol stack through the application protocol proxy engine and the TCP protocol reverse proxy engine to achieve high-speed TCP reverse proxy performance; at the same time, since the application protocol proxy engine is not responsible for the specific details of the TCP connection management and focuses on the application protocol processing, it is conducive to reducing the difficulty of application protocol program writing and improving writing efficiency. In addition, the use of the application protocol proxy engine and the TCP protocol reverse proxy engine can divert the TCP protocol processing and the application protocol and data processing business to different processes, achieving high performance of TCP protocol processing, application protocol processing and security inspection of one TCP connection; further, the method can realize multiple diversion methods between the application protocol engine and the TCP protocol reverse proxy engine, parent-child connection management and other functions, thereby reflecting the flexibility of high expansion. Finally, since the TCP protocol reverse proxy engine is not affected by the changes in the application protocol module, the method can improve stability and reliability.

[0142] Example 3

[0143] This embodiment provides a specific example process of a TCP reverse proxy method, which is also applied to the TCP reverse proxy device in Example 1, wherein the method includes:

[0144] S1. Initialization process

[0145] (1) The TCP protocol reverse proxy engine reads the strategy (including the IP and port that the engine listens on, the IP, port, and strategy of the destination program, etc.), creates two communication queues (called channel queue Q1 and channel queue Q2 for short), and initializes each communication queue and shared memory pool.

[0146] In this example, only one TCP protocol reverse proxy engine (called TCP protocol reverse proxy engine TP1) is started.

[0147] (2) The application protocol proxy engine reads the policy and starts two processes (called process AP1 and process AP2). Process AP1 opens channel queue Q1 and process AP2 opens channel queue Q2.

[0148] S2. Establish downstream and upstream connections

[0149] When the source program establishes a TCP connection to the destination program, the TCP protocol reverse proxy engine TP1 establishes a downstream connection with the source program via the user-mode protocol stack and Socket, and establishes an upstream connection with the destination program. The connection information is stored in the connection table, and a shared memory block is applied for as a cache block (referred to as C1). The cache block information is stored in the connection information. At the same time, the connection information, session information, and policy information (such as policy ID) are cached in the cache block.

[0150] S3, data forwarding and inspection

[0151] (1) Apply for a shared memory block S1 from the communication queue, store the information cached by C1 in S1, read the application protocol data of the downstream connection and store it in the remaining space of S1, and send it to process AP1 through channel queue Q1.

[0152] (2) Process AP1 reads channel queue Q1, reads S1, obtains C1 and application protocol data in turn, reads the connection information, session information, and policy information in C1, searches for the policy information corresponding to the process according to the policy ID (such as the blacklist keyword in the policy), parses the application protocol, and then checks the application protocol data according to the blacklist keyword, and caches the check result in C1.

[0153] If the application protocol data is incomplete (for example, the application protocol data only includes part of the application protocol features), the incomplete part is copied to C1, waiting to be combined with the application protocol data in the next shared inner block, and then the protocol is parsed and the data is checked.

[0154] If the remaining space of the cache block is insufficient, process AP1 applies for a shared memory block from channel queue Q1 again as a cache block (referred to as C2) and links C1 and C2 together through a linked list.

[0155] (3) After checking the application protocol data, process AP1 sends S1 to TCP protocol reverse proxy engine TP1 via channel queue Q1. After reading it, TCP protocol reverse proxy engine TP1 obtains C1 and determines the inspection result. If it is blocked, it will close the upstream and downstream connections, release C1 (or C2), S1, etc.; if it is allowed, it will search the upstream connection in the connection table according to the connection information stored in C1, and send the application data to the upstream connection. Finally, the forwarding of application protocol data from the source program to the destination program is realized.

[0156] (4) The processing flow of reading the upstream connection application protocol data is the same as the process of reading the downstream connection application protocol data, but in the opposite direction, and ultimately realizes the forwarding of the destination program to the source program application protocol data.

[0157] S3.1. Diversion

[0158] When the TCP protocol reverse proxy engine TP1 processes multiple parallel connections, it distributes the application protocol data of different TCP connections to channel queue Q1 or channel queue Q2 in an equal manner, so that process AP1 and process AP2 can process the application protocol data of different connections respectively. It also forwards all the data of a connection to a relatively idle queue, and can also design a variety of diversion methods to achieve diversion according to business needs.

[0159] S3.2、Multiple demand expansion

[0160] The TCP protocol reverse proxy engine TP1, process AP1 or process AP2 can be extended with various designs according to different requirements, including the following:

[0161] 1) The TCP protocol reverse proxy engine TP1 can distribute application data to process AP1 or process AP2 according to the protocol type, thereby distributing data streams according to the application type.

[0162] 2) When process AP1 or process AP2 has a sub-link, the sub-connection information can be cached in C1 as a result, and an instruction information is extended to notify the TCP protocol reverse proxy engine TP1 to establish a sub-link and associate the parent connection information with the sub-connection information.

[0163] S4. Close connection process

[0164] When the source program or the destination program terminates data transmission, the TCP connection will be closed, and the TCP protocol reverse proxy engine TP1 will close the upstream and downstream connections, release C1 (or C2), etc. Process AP1 or process AP2 does not need to pay attention to information such as connection status.

[0165] Based on the above content, it can be seen that this application focuses on the design of combining the TCP protocol reverse proxy engine, the application protocol proxy engine, and the communication queue. The key technical points involved include:

[0166] (1) The TCP protocol reverse proxy engine provides basic TCP communication and provides the application protocol engine with basic functions such as connection information, session information, shared memory storage of application protocol data, cache information, etc., so that the application protocol proxy engine does not need to pay attention to the management of TCP connection details and avoids repeated copying of memory between the two engines.

[0167] (2) The design of two engines, multiple processes and communication queues is used to implement multiple diversion methods, which is also conducive to the expansion of new diversion methods.

[0168] (3) The design of two engines, multiple processes, communication queues and shared memory blocks facilitates flexible expansion of functions according to business needs.

[0169] An embodiment of the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the TCP reverse proxy method described in Embodiment 2 or Embodiment 3 of the present application.

[0170] An embodiment of the present application provides a readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the TCP reverse proxy method described in Embodiment 2 or Embodiment 3 of the present application is executed.

[0171] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the TCP reverse proxy method described in Embodiment 2 or Embodiment 3 of the present application is executed.

[0172] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0173] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0174] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0175] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0176] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0177] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Claims

1. A TCP reverse proxy device, characterized in that: The TCP reverse proxy device includes an application protocol processing engine and a data plane development kit in a Linux system; The data plane development kit integrates a TCP protocol reverse proxy engine and a user-mode protocol stack, wherein: The user state protocol stack is communicatively connected with the TCP protocol reverse proxy engine; The TCP protocol reverse proxy engine is communicatively connected with the application protocol processing engine.

2. The TCP reverse proxy device according to claim 1, characterized in that: The TCP reverse proxy device also includes a Linux driver and a network card, wherein: The network card is communicatively connected to the source program and / or the destination program, and is communicatively connected to the Linux driver; The Linux driver is communicatively connected with the user mode protocol stack.

3. A TCP reverse proxy method, applied to the TCP reverse proxy device according to claim 1 or 2, characterized in that: The TCP reverse proxy method comprises: The user mode protocol stack obtains a TCP data packet and decapsulates the TCP data packet to obtain application protocol data; The user state protocol stack sends the application protocol data to the TCP protocol reverse proxy engine; The TCP protocol reverse proxy engine sends the application protocol data to the application protocol processing engine through a communication queue.

4. The TCP reverse proxy method according to claim 3, characterized in that: The TCP reverse proxy device includes a Linux driver and a network card, wherein: The network card receives a TCP data packet sent by a source program; the TCP data packet is obtained by encapsulating application protocol data based on the TCP protocol by the source program; The network card sends the TCP data packet to the Linux driver; The Linux driver sends the TCP data packet to the user mode protocol stack.

5. The TCP reverse proxy method according to claim 3, characterized in that: The sending of the application protocol data to the TCP protocol reverse proxy engine includes: The application protocol data is sent to the TCP protocol reverse proxy engine via the Socket interface.

6. The TCP reverse proxy method according to claim 3, characterized in that: The communication queue is a non-circular queue supporting bidirectional communication, and the communication queue provides multiple shared memory blocks.

7. The TCP reverse proxy method according to claim 6, characterized in that: The method further comprises: The TCP protocol reverse proxy engine applies for a first shared memory block from the communication queue; The TCP protocol reverse proxy engine obtains first connection information of a downstream connection established between the user-mode protocol stack and the source-end program, and obtains second connection information of an upstream connection established between the user-mode protocol stack and the destination-end program; The TCP protocol reverse proxy engine caches the security proxy policy, the first connection information and the second connection information in the first shared memory block.

8. The TCP reverse proxy method according to claim 7, characterized in that: The sending the application protocol data to the application protocol processing engine through the communication queue includes: Applying for a second shared memory block from the communication queue; Acquire the security proxy policy, the first connection information, and the second connection information cached in the first shared memory block, and store the application protocol data, the security proxy policy, the first connection information, and the second connection information in the second shared memory block; The second shared memory block is sent to the application protocol processing engine through the communication queue.

9. The TCP reverse proxy method according to claim 8, characterized in that: The method further comprises: The application protocol processing engine parses and checks the application protocol data based on the security proxy policy to obtain a check result; The application protocol processing engine caches the inspection result in a first shared memory block; The application protocol processing engine sends the second shared memory block to the TCP protocol reverse proxy engine through a communication queue.

10. The TCP reverse proxy method according to claim 9, characterized in that: The method further comprises: The TCP protocol reverse proxy engine, upon receiving the second shared memory block sent by the application protocol processing engine, determines whether the inspection result in the first shared memory block is that blocking is required; The TCP protocol reverse proxy engine, when the inspection result indicates that blocking is required, closes the downstream connection and the upstream connection, and releases the content of the first memory block and the content of the second memory block; The TCP protocol reverse proxy engine sends the application protocol data to the user mode protocol stack when the inspection result shows that blocking is not required.

11. The TCP reverse proxy method according to claim 4, characterized in that: The method further comprises: The user-mode protocol stack, when receiving the application protocol data sent by the TCP protocol reverse proxy engine, encapsulates the application protocol data to obtain the TCP data packet; The user mode protocol stack sends the TCP data packet to the Linux driver; The Linux driver sends the TCP data packet to the network card; The network card sends the TCP data packet to the destination program.

12. The TCP reverse proxy method according to claim 9, characterized in that: The method further comprises: The application protocol processing engine detects the integrity of the application protocol data; The application protocol processing engine caches the application protocol data in a first shared memory block when the application protocol data is incomplete; When receiving the third shared memory block, the application protocol processing engine combines the supplementary protocol data in the third shared memory block with the application protocol data to obtain new application protocol data; the new application protocol data is complete.

13. The TCP reverse proxy method according to claim 10, characterized in that: The method further comprises: When the remaining space of the first shared memory block is insufficient, the application protocol processing engine applies for a fourth shared memory block from the communication queue, and links the first shared memory block and the fourth shared memory block together through a linked list.

14. The TCP reverse proxy method according to claim 3, characterized in that: The sending the application protocol data to the application protocol processing engine through the communication queue includes: The application protocol data is sent to the application protocol processing engine through multiple communication queues.

15. The TCP reverse proxy method according to claim 3, characterized in that: The sending the application protocol data to the application protocol processing engine through the communication queue includes: The multiple application protocol data are sent to the application protocol processing engine through multiple communication queues, so that the application protocol processing engine processes the multiple application protocol data in parallel; wherein the multiple application protocol data correspond to multiple source end programs.

16. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the TCP reverse proxy method according to any one of claims 3 to 15.

17. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the TCP reverse proxy method according to any one of claims 3 to 15 is executed.

18. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the TCP reverse proxy method according to any one of claims 3 to 15 is executed.

Images