Message interception method, device, equipment and readable storage medium

Abstract

The present invention provides a message interception method, device, equipment and readable storage medium. The method comprises: receiving the parameter value passed in by the modified listen function and calling the modified listen function in the operating system, and monitoring the source IP address of the message received by the plug-in server; determining the transmission path of the message according to the source IP address; comparing the transmission path with the transmission path of the message to be intercepted corresponding to the parameter value; if the transmission path is the same, intercepting the message based on the modified listen function in the called operating system. Through the present invention, the message is intercepted without knowing the port number monitored by the process of the plug-in server, which solves the problem in the prior art that if the message is to be intercepted, the relevant port configuration of the third-party software needs to be known first, and if the relevant port configuration of the third-party software is unknown, the message cannot be intercepted.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a message interception method, device, equipment and readable storage medium. Background Art

[0002] Since the third-party software has been started before the wide area network (WAN) connection is started, and the third-party software monitors the 0.0.0.0 address of the local machine, since the 0.0.0.0 address is a special IP address, representing all IP addresses of the local machine, the third-party software can monitor any address of the local machine and the messages received by any address of the local machine, so the third-party software can receive messages transmitted through the wide area network, and can also receive messages transmitted through the local area network. However, since the third-party software generally communicates either through the wide area network or through the local area network, the third-party software only needs to receive messages transmitted through the wide area network or through the local area network. Therefore, if the third-party software only needs to receive messages transmitted through the wide area network, it is necessary to intercept the messages transmitted through the local area network; if the third-party software only needs to receive messages transmitted through the local area network, it is necessary to intercept the messages transmitted through the wide area network. However, in the prior art, if you want to intercept messages, you need to know the relevant port configuration of the third-party software first. If the relevant port configuration of the third-party software is unknown, the message cannot be intercepted. Summary of the invention

[0003] The main purpose of the present invention is to provide a message interception method, device, equipment and readable storage medium, aiming to solve the problem of intercepting messages due to unknown relevant port configuration of third-party software.

[0004] In a first aspect, the present invention provides a message interception method, the message interception method comprising:

[0005] Receive the parameter value passed in by the modified listen function and call the modified listen function in the operating system, and monitor the source IP address of the message received by the plug-in server;

[0006] Determining a transmission path of the message according to the source IP address;

[0007] Comparing the transmission path with the transmission path of the message to be intercepted corresponding to the parameter value;

[0008] If they are the same, the message is intercepted based on the modified listen function in the called operating system.

[0009] Optionally, before the step of receiving the modified parameter value passed in by the listen function, the following steps are included:

[0010] Determine whether the current process is the process of the plug-in server;

[0011] If so, determine the preset value based on the corresponding interception requirements of the plug-in server;

[0012] The preset value is used as the parameter value passed into the modified listen function.

[0013] Optionally, the step of determining the transmission path of the message according to the source IP address includes:

[0014] Determine whether the source IP address and the local address are in the same network segment;

[0015] If yes, determining that the message is transmitted via the local area network;

[0016] If not, it is determined that the message is transmitted through a wide area network.

[0017] Optionally, the message interception method further includes:

[0018] If the transmission path of the message to be intercepted corresponding to the parameter value is intercepting the message transmitted through the local area network or intercepting the message transmitted through the wide area network, the message is intercepted based on the modified listen function in the called operating system.

[0019] Optionally, the step of intercepting the message based on the modified listen function in the called operating system includes:

[0020] Based on the modified listen function in the called operating system, the socket connected to the plug-in server is not inserted into the semi-connected queue, and a reset message is sent to the client to interrupt the TCP three-way handshake between the plug-in server and the client.

[0021] Optionally, after the step of comparing the transmission path with the transmission path of the message to be intercepted corresponding to the parameter value, the method further includes:

[0022] If they are different, the message received by the plug-in server is released.

[0023] Optionally, before the step of receiving the modified parameter value passed in by the listen function, the following steps are included:

[0024] The modified listen function is inserted into the operating system through the init_module function and the system call table is modified so that the modified listen function can be called.

[0025] In a second aspect, the present invention further provides a message interception method device, the message interception method device comprising:

[0026] A receiving monitoring module is used to receive the parameter value passed in by the modified listen function and call the modified listen function in the operating system, and monitor the source IP address of the message received by the plug-in server;

[0027] A determination module, used to determine the transmission path of the message according to the source IP address;

[0028] A comparison module, used for comparing the transmission path with the transmission path of the message to be intercepted corresponding to the parameter value;

[0029] The interception module is used to intercept the message if they are the same.

[0030] In a third aspect, the present invention also provides a message interception device, comprising a processor, a memory, and a message interception program stored in the memory and executable by the processor, wherein when the message interception program is executed by the processor, the steps of the message interception method as described above are implemented.

[0031] In a fourth aspect, the present invention further provides a readable storage medium, on which a message interception program is stored, wherein when the message interception program is executed by a processor, the steps of the message interception method as described above are implemented.

[0032] In the present invention, the parameter value passed in by the modified listen function is received and the modified listen function in the operating system is called, and the source IP address of the message received by the plug-in server is monitored; the transmission path of the message is determined according to the source IP address; the transmission path of the message corresponding to the parameter value and the message to be intercepted is compared; if the transmission path is the same, the message is intercepted. Through the present invention, the transmission path of the message is determined based on the source IP address of the message received by the monitored plug-in server, and if the transmission path of the message is the same as the transmission path of the message corresponding to the parameter value passed in by the modified listen function, the TCP message of the process is intercepted in the kernel, thereby intercepting the message without knowing the port number monitored by the process of the plug-in server, solving the problem in the prior art that if the message is to be intercepted, the relevant port configuration of the third-party software needs to be known first, and if the relevant port configuration of the third-party software is unknown, the message cannot be intercepted. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of the hardware structure of a message interception device involved in an embodiment of the present invention;

[0034] Figure 2 A schematic diagram of a flow chart of a first embodiment of a message interception method of the present invention;

[0035] Figure 3 A schematic diagram of the architecture of an embodiment of a message interception method of the present invention;

[0036] Figure 4 A schematic diagram of a flow chart of communication between a client and a plug-in server in an embodiment of a message interception method of the present invention;

[0037] Figure 5 A schematic diagram of a flow chart of a second embodiment of a message interception method of the present invention;

[0038] Figure 6 It is a schematic diagram of functional modules of an embodiment of a message interception device of the present invention.

[0039] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0040] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0041] In a first aspect, an embodiment of the present invention provides a message interception device, which may be a device having a data processing function, such as a personal computer (PC), a notebook computer, or a server.

[0042] Reference Figure 1 , Figure 1 The hardware structure diagram of the message interception device involved in the embodiment of the present invention. In the embodiment of the present invention, the message interception device may include a processor 1001 (e.g., a central processing unit, CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components; the user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard); the network interface 1004 may optionally include a standard wired interface, a wireless interface (such as a wireless fidelity WIreless-FIdelity, WI-FI interface); the memory 1005 may be a high-speed random access memory (random access memory, RAM), or a stable memory (non-volatile memory), such as a disk storage, and the memory 1005 may optionally be a storage device independent of the aforementioned processor 1001. Those skilled in the art will understand that Figure 1 The hardware structure shown in the figure does not constitute a limitation of the present invention, and may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0043] Continue to refer to Figure 1 , Figure 1 The memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a message interception program. The processor 1001 may call the message interception program stored in the memory 1005 and execute the message interception method provided in the embodiment of the present invention.

[0044] In a second aspect, an embodiment of the present invention provides a message interception method.

[0045] In one embodiment, referring to Figure 2 , Figure 2 FIG. 1 is a flow chart of the first embodiment of the message interception method of the present invention. Figure 2 As shown, the message interception method includes:

[0046] Step S10, receiving the parameter value passed in by the modified listen function and calling the modified listen function in the operating system, and monitoring the source IP address of the message received by the plug-in server;

[0047] In this embodiment, refer to Figure 3 , Figure 3 FIG. 1 is a schematic diagram of the architecture of an embodiment of a message interception method of the present invention. Figure 3 As shown, the original listen function in the operating system is modified to obtain the modified listen function, that is, the input listen function. Receive the parameter value passed in by the modified listen function, call the modified listen function in the operating system, and monitor the source IP address of the message received by the plug-in server. Among them, the operating system includes a Linux operating system or a Unix operating system. The function of the listen function is to convert the socket file descriptor from active to passive file descriptor, and then use it to passively monitor the connection of the client, that is, the listen function converts an unconnected socket into a passive socket, indicating that the kernel should accept the connection request pointing to the socket. When the TCP server monitors the connection of the client, it uses the "socket file descriptor" returned by the socket to implement it, but this file descriptor is an active file descriptor by default (actively sending data to the other party), so it is necessary to use the listen function to convert it into a passive descriptor (it can only passively wait for others to actively send data and then respond), otherwise it cannot be used to passively monitor the connection of the client.

[0048] Step S20, determining the transmission path of the message according to the source IP address;

[0049] In this embodiment, the transmission path of the message can be determined according to the source IP address of the message received by the plug-in server, wherein the transmission path includes transmission through a local area network or transmission through a wide area network.

[0050] Furthermore, in one embodiment, the step of determining the transmission path of the message according to the source IP address includes:

[0051] Determine whether the source IP address and the local address are in the same network segment;

[0052] If yes, determining that the message is transmitted via the local area network;

[0053] If not, it is determined that the message is transmitted through a wide area network.

[0054] In this embodiment, according to academic definitions, a network segment refers to the part of a computer network that uses the same physical layer for direct communication. All devices in a local area network must be in a unified address segment, and a wide area network is used for cross-segment interconnection of local area networks. Therefore, it is determined whether the source IP address of the message received by the plug-in server is in the same network segment as the local address. If it is the same network segment, it is determined that the message received by the plug-in server is transmitted through the local area network. If it is not the same network segment, it is determined that the message received by the plug-in server is transmitted through the wide area network.

[0055] Step S30, comparing the transmission path with the transmission path of the message to be intercepted corresponding to the parameter value;

[0056] In this embodiment, the transmission path of the message received by the plug-in server is compared with the transmission path of the message to be intercepted corresponding to the parameter value passed into the modified listen function to obtain a comparison result, and based on the comparison result, it is determined whether to intercept the message received by the plug-in server.

[0057] Step S40: If they are the same, intercept the message based on the modified listen function in the called operating system.

[0058] In this embodiment, the parameter value 0 represents releasing the messages transmitted through the local area network and intercepting the messages transmitted through the wide area network; the parameter value 1 represents intercepting the messages transmitted through the local area network and releasing the messages transmitted through the wide area network; the parameter value 2 represents intercepting the messages transmitted through the local area network and intercepting the messages transmitted through the wide area network; the parameter value 3 is to maintain the original state without making any judgment.

[0059] If the parameter value passed in to the modified listen function is 0, because the parameter value 0 represents releasing the messages transmitted through the LAN and intercepting the messages transmitted through the WAN, so, if the transmission path of the message received by the plug-in server is through the WAN, then the transmission path of the message received by the plug-in server is the same as the transmission path of the message that needs to be intercepted corresponding to the parameter value passed in to the modified listen function, then the message received by the plug-in server is intercepted based on the modified listen function in the called operating system.

[0060] Furthermore, in one embodiment, the step of intercepting the message based on the modified listen function in the called operating system includes:

[0061] By calling the modified listen function in the operating system, the socket connected to the plug-in server is not inserted into the semi-connected queue, and a reset message is sent to the client to interrupt the TCP three-way handshake between the plug-in server and the client.

[0062] In this embodiment, since the establishment of the TCP connection is completed through a three-way handshake, and the normal release of the TCP connection is completed through four handshakes, in some cases, some unexpected situations may occur during the TCP interaction process, resulting in TCP being unable to release the connection according to the normal four handshakes. If the TCP connection is not released by other means at this time, the TCP connection will always exist and occupy part of the system resources. In this case, we need a mechanism to release the TCP connection. This mechanism is the TCP reset message. The reset message refers to the message at the reset position in the flag field of the TCP header.

[0063] Reference Figure 4 , Figure 4 FIG. 1 is a flow chart of communication between a client and a plug-in server in an embodiment of a message interception method of the present invention. Figure 4 As shown, the plug-in server uses the Bind() method of the socket connection to bind the EndPoint object established with the specified port number and IP, and uses the listen() method of the socket connection to start listening. Client: Establish a Socket connection, establish an EndPoint object with the specified port number and server IP, and use the Connect() method of the socket connection to send a connection request to the plug-in server with the EndPoint object established above as a parameter.

[0064] In the three-way handshake, the first handshake: the client sends a SYN message to the plug-in server, and enters the SYN_SENT state, waiting for the plug-in server to confirm (the socket connected to the plug-in server is inserted into the semi-connected queue); the second handshake: the plug-in server receives the SYN message, confirms the client's SYN message, and also sends a SYN+ACK message. At this time, the plug-in server enters the SYN_RECV state; the third handshake: the client receives the SYN+ACK message from the plug-in server, and sends a reply ACK message to the plug-in server. After this message is sent, the client and the plug-in server enter the ESTABLISHED state and complete the three-way handshake (the connection is removed from the semi-connected queue and moved into the full-connected queue). When the plug-in server calls the accept() function, it will take the connection out of the full-connected queue. Further, the write() method of the socket connection is used to send the data message PSH_ACK. After this message is sent, the client and the plug-in server enter the ESTABLISHED state, and the plug-in server uses the read() method of the socket connection to receive the data message PSH_ACK sent by the client.

[0065] After the client receives the SYN message sent by the client to the server, the plug-in server also sends a SYN message to the client, that is, a SYN+ACK message for the second handshake. Therefore, when the transmission path of the message received by the plug-in server is the same as the transmission path of the message that needs to be intercepted corresponding to the parameter value passed in by the modified listen function, the socket connected to the plug-in server is not inserted into the semi-connected queue by calling the modified listen function in the operating system, and a reset message is sent to the client. Since the plug-in server does not send a SYN+ACK message to the client, the client will not reply to the ACK message, so the TCP three-way handshake between the plug-in server and the client is interrupted, so the TCP connection cannot be established, and the subsequent server accept socket will not be established. Since data reception and transmission are based on the accept socket, subsequent data cannot be transmitted, thereby realizing message interception.

[0066] In this embodiment, the parameter value passed in by the modified listen function is received and the modified listen function in the operating system is called, and the source IP address of the message received by the plug-in server is monitored; the transmission path of the message is determined according to the source IP address; the transmission path of the message is compared with the transmission path of the message that needs to be intercepted corresponding to the parameter value; if the transmission path of the message is the same as the transmission path of the message that needs to be intercepted corresponding to the parameter value passed in by the modified listen function, the TCP message of the process is intercepted in the kernel, thereby intercepting the message without knowing the port number that the process of the plug-in server listens to, solving the problem in the prior art that if you want to intercept a message, you need to know the relevant port configuration of the third-party software first, and if the relevant port configuration of the third-party software is unknown, you cannot intercept the message.

[0067] Furthermore, in one embodiment, the message interception method further includes:

[0068] If the transmission path of the message to be intercepted corresponding to the parameter value is intercepting the message transmitted through the local area network or intercepting the message transmitted through the wide area network, the message is intercepted based on the modified listen function in the called operating system.

[0069] In this embodiment, if the parameter value passed into the modified listen function is 2, because the parameter value 2 represents intercepting messages transmitted through the local area network and intercepting messages transmitted through the wide area network, no matter whether the messages received by the plug-in server are transmitted through the local area network or the wide area network, the messages received by the plug-in server will be intercepted based on the modified listen function in the called operating system.

[0070] Furthermore, if the parameter value passed into the modified listen function is 3, the parameter value passed into the modified listen function does not correspond to the transmission path of the message that needs to be intercepted, and the message received by the plug-in server is not processed.

[0071] Furthermore, in one embodiment, after step S30, the following steps are included:

[0072] If they are different, the message received by the plug-in server is released.

[0073] In this embodiment, if the transmission path of the message received by the plug-in server is through the local area network, and the transmission path of the message received by the plug-in server is different from the transmission path of the message that needs to be intercepted corresponding to the parameter value passed in by the modified listen function, then the message received by the plug-in server is released, that is, the message received by the plug-in server is not intercepted.

[0074] Further, in one embodiment, referring to Figure 5 , Figure 5 FIG. 2 is a flow chart of the second embodiment of the message interception method of the present invention. Figure 5 As shown, before the step of receiving the parameter value passed in by the modified listen function, the following steps are included:

[0075] Step S001, determining whether the current process is a plug-in server process;

[0076] Step S002: If yes, determine the preset value according to the corresponding interception requirement of the plug-in server;

[0077] Step S003: Using the preset value as the parameter value passed into the modified listen function.

[0078] In this embodiment, continue to refer to Figure 3 , obtain customized requirements, wherein the customized requirements include process names of multiple plug-in servers and interception requirements corresponding to multiple plug-in servers, manage the obtained customized requirements, that is, set the configuration file according to the process names of multiple plug-in servers and the interception requirements corresponding to multiple plug-in servers. Obtain the current process name, and determine whether the current process name exists in the process names of multiple plug-in servers in the configuration file or in the process names of multiple non-plug-in servers through a judgment module.

[0079] If the current process name exists in the process names of multiple plug-in servers in the configuration file, the judgment result is that the current process is a plug-in server process, then the interception requirement corresponding to the current plug-in server is obtained from the configuration file, and the preset value is determined according to the interception requirement corresponding to the plug-in server. Specifically, the preset value 0 represents releasing the message transmitted through the local area network and intercepting the message transmitted through the wide area network; the preset value 1 represents intercepting the message transmitted through the local area network and releasing the message transmitted through the wide area network; the preset value 2 represents intercepting the message transmitted through the local area network and intercepting the message transmitted through the wide area network; the preset value 3 is to keep the original state without making a judgment. If the interception requirement corresponding to the plug-in server is to intercept the message transmitted through the local area network and release the message transmitted through the wide area network, the preset value 1 is used as the parameter value passed in to the modified listen function. If the interception requirement corresponding to the plug-in server is to intercept the message transmitted through the local area network and intercept the message transmitted through the wide area network, the preset value 2 is used as the parameter value passed in to the modified listen function. If the plug-in server does not have a corresponding interception requirement, the preset value 3 is used as the parameter value passed into the modified listen function.

[0080] If the current process name exists in the process names of multiple non-plug-in servers, when the client accesses the plug-in server process, the client sends a TCP sync packet to the listen function of the plug-in server process. After the kernel listen function receives the TCP sync packet from the client, the plug-in server process inserts the currently connected socket into the TCP semi-connected queue list, and then the listen function of the plug-in server process replies to the client with a TCP SYN ACK packet. When the listen function of the plug-in server process receives the ACK message replied by the client, it deletes the socket from the TCP semi-connected queue list and inserts it into the full-connection queue. The subsequent accept establishes a new ACCPET socket based on this socket, and the subsequent data is transmitted based on the new ACCPET sock.

[0081] Furthermore, in one embodiment, before the step of receiving the modified parameter value passed in by the listen function, the following steps are included:

[0082] The modified listen function is inserted into the operating system through the init_module function and the system call table is modified so that the modified listen function can be called.

[0083] In this embodiment, continue to refer to Figure 3, a kernel module includes at least two functions, init_module function and cleanup_module function. The init_module function is used when the module is inserted into the kernel; the cleanup_module function is used when the module is deleted. Generally, the init_module function either registers a handler in the kernel or replaces a function with its own code. The cleanup_module function clears everything done by the init_module function, and the module can be safely uninstalled. Although Linux is a "monolithic" operating system-that is, the entire system kernel runs in a separate protection domain, the Linux kernel is modular, which allows the kernel to dynamically insert or delete code into or from it at runtime. These codes (including related subthreads, data, function entry and function exit) are combined in a single binary image, the so-called loadable kernel module, or simply called module. Therefore, after obtaining the modified listen function, it is necessary to insert the modified listen function into the operating system kernel through the init_module function. Although the module is part of the kernel, it is not compiled into the kernel. They are compiled and linked separately into a set of target files, which can be inserted into or removed from the running kernel. Since the kernel module is part of the kernel, it can access all kernel resources.

[0084] The system call table (sys_call_table) stores the processing address of the system call. The system call program system_call will look up the system call table to obtain the system call corresponding to the system call number and execute it. Therefore, before calling the modified listen function, it is necessary to modify the system call table, that is, add an item to the system call table so that the pointer in the item points to the modified listen function so that the modified listen function can be called.

[0085] In a third aspect, an embodiment of the present invention further provides a message interception device.

[0086] In one embodiment, referring to Figure 6 , Figure 6 Schematic diagram of the functional modules of an embodiment of the message interception device of the present invention. Figure 6 As shown, the message interception device includes:

[0087] The receiving monitoring module 10 is used to receive the parameter value passed in by the modified listen function and call the modified listen function in the operating system, and monitor the source IP address of the message received by the plug-in server;

[0088] A determination module 20, configured to determine a transmission path of the message according to the source IP address;

[0089] A comparison module 30, for comparing the transmission path with the transmission path of the message to be intercepted corresponding to the parameter value;

[0090] The interception module 40 is used to intercept the message based on the modified listen function in the called operating system if they are the same.

[0091] Furthermore, in one embodiment, the message interception method device further includes a judgment module, which is used to:

[0092] Determine whether the current process is the process of the plug-in server;

[0093] If so, determine the preset value based on the corresponding interception requirements of the plug-in server;

[0094] The preset value is used as the parameter value passed into the modified listen function.

[0095] Furthermore, in one embodiment, the determination module 20 is used to:

[0096] Determine whether the source IP address and the local address are in the same network segment;

[0097] If yes, determining that the message is transmitted via the local area network;

[0098] If not, it is determined that the message is transmitted through a wide area network.

[0099] Furthermore, in one embodiment, the interception module 40 is used to:

[0100] If the transmission path of the message to be intercepted corresponding to the parameter value is intercepting the message transmitted through the local area network or intercepting the message transmitted through the wide area network, the message is intercepted based on the modified listen function in the called operating system.

[0101] Furthermore, in one embodiment, the interception module 40 is further configured to:

[0102] Based on the modified listen function in the called operating system, the socket connected to the plug-in server is not inserted into the semi-connected queue and a reset message is sent to the client to interrupt the TCP three-way handshake between the plug-in server and the client.

[0103] Furthermore, in one embodiment, the message interception method device further includes a release module, which is used to:

[0104] If they are different, the message received by the plug-in server is released.

[0105] Furthermore, in one embodiment, the message interception method device further includes an insertion modification module, which is used to:

[0106] The modified listen function is inserted into the operating system through the init_module function and the system call table is modified so that the modified listen function can be called.

[0107] Among them, the functional implementation of each module in the above-mentioned message interception device corresponds to the various steps in the above-mentioned message interception method embodiment, and its functions and implementation processes are no longer repeated here one by one.

[0108] In a fourth aspect, an embodiment of the present invention further provides a readable storage medium.

[0109] The readable storage medium of the present invention stores a message interception program, wherein when the message interception program is executed by a processor, the steps of the message interception method as described above are implemented.

[0110] Among them, the method implemented when the message interception program is executed can refer to the various embodiments of the message interception method of the present invention, and will not be repeated here.

[0111] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0112] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0113] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present invention.

[0114] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A message interception method, characterized in that: The message interception method comprises: Receive the parameter value passed in by the modified listen function and call the modified listen function in the operating system, and monitor the source IP address of the message received by the plug-in server; Determining a transmission path of the message according to the source IP address; Comparing the transmission path with the transmission path of the message to be intercepted corresponding to the parameter value; If they are the same, intercepting the message based on the modified listen function in the called operating system; The step of intercepting the message based on the modified listen function in the called operating system includes: Based on the modified listen function in the called operating system, the socket connected to the plug-in server is not inserted into the semi-connected queue, and a reset message is sent to the client to interrupt the TCP three-way handshake between the plug-in server and the client.

2. The message interception method according to claim 1, characterized in that: Before the step of receiving the modified parameter value passed in by the listen function, the method includes: Determine whether the current process is the process of the plug-in server; If so, determine the preset value based on the corresponding interception requirements of the plug-in server; The preset value is used as the parameter value passed into the modified listen function.

3. The message interception method according to claim 1, characterized in that: The step of determining the transmission path of the message according to the source IP address comprises: Determine whether the source IP address and the local address are in the same network segment; If yes, determining that the message is transmitted via the local area network; If not, it is determined that the message is transmitted through a wide area network.

4. The message interception method according to claim 3, characterized in that: The message interception method also includes: If the transmission path of the message to be intercepted corresponding to the parameter value is intercepting the message transmitted through the local area network or intercepting the message transmitted through the wide area network, the message is intercepted based on the modified listen function in the called operating system.

5. The message interception method according to claim 1, characterized in that: After the step of comparing the transmission path with the transmission path of the message to be intercepted corresponding to the parameter value, the method further comprises: If they are different, the message received by the plug-in server is released.

6. The message interception method according to claim 1, characterized in that: Before the step of receiving the modified parameter value passed in by the listen function, the method includes: The modified listen function is inserted into the operating system through the init_module function and the system call table is modified so that the modified listen function can be called.

7. A message interception method and device, characterized in that: The message interception method device comprises: A receiving monitoring module is used to receive the parameter value passed in by the modified listen function and call the modified listen function in the operating system, and monitor the source IP address of the message received by the plug-in server; A determination module, used to determine the transmission path of the message according to the source IP address; A comparison module, used for comparing the transmission path with the transmission path of the message to be intercepted corresponding to the parameter value; An interception module, used for intercepting the message based on a modified listen function in the called operating system if the two messages are the same; The interception module is also used to not insert the socket connected to the plug-in server into the semi-connected queue based on the modified listen function in the called operating system, and send a reset message to the client to interrupt the TCP three-way handshake between the plug-in server and the client.

8. A message interception device, characterized in that: The message interception device includes a processor, a memory, and a message interception program stored in the memory and executable by the processor, wherein when the message interception program is executed by the processor, the steps of the message interception method according to any one of claims 1 to 6 are implemented.

9. A readable storage medium, characterized in that: The readable storage medium stores a message interception program, wherein when the message interception program is executed by a processor, the steps of the message interception method according to any one of claims 1 to 6 are implemented.

Images