A traffic mirroring method, apparatus and related device

Abstract

The application discloses a traffic mirroring method, which realizes the forwarding of traffic messages between a real user terminal and a real server by deploying a proxy program in a proxy device, and virtually generates a real client and a server by deploying a client program and a server program, so that the forwarding of request traffic and response traffic between the real client and the real server can be realized through the client program and the server program; on the basis, after the traffic messages between the two are copied to obtain mirror traffic, the mirror traffic can be sent to a traffic operating system for relevant traffic processing, at this time, the traffic messages obtained by the traffic operating system are necessarily complete messages between the real client and the real server, so that the matching and arrangement of the traffic messages are not needed to obtain complete messages, and the traffic processing efficiency is effectively improved. The application also discloses a traffic mirroring device, a proxy device and a computer readable storage medium, which have the beneficial effects.

Description

Technical Field

[0001] This application relates to the field of computer product technology, and in particular to a traffic mirroring method, as well as a traffic mirroring device, a proxy device, and a computer-readable storage medium. Background Technology

[0002] For security reasons, client-side traffic requests to servers are typically forwarded through a proxy gateway. This means the proxy gateway forwards client-initiated traffic requests to the server and returns the server's response traffic to the client. The proxy gateway modifies the traffic packets during forwarding, primarily changing the source IP, source port, destination IP, and destination port to ensure front-end and back-end data security. However, traffic management systems (such as traffic auditing systems and traffic detection systems) can only obtain the traffic packets between the client and the proxy gateway, and between the proxy gateway and the server. They cannot obtain the complete packets between the client and the server, leading to difficulties in traffic processing and low efficiency.

[0003] Therefore, how to acquire complete traffic packets and further improve traffic processing efficiency is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this application is to provide a traffic mirroring method that can acquire complete traffic packets, thereby further improving traffic processing efficiency. Another purpose of this application is to provide a traffic mirroring device, a proxy device, and a computer-readable storage medium, all of which have the above-mentioned beneficial effects.

[0005] In a first aspect, this application provides a traffic mirroring method applied to a proxy device. The proxy device deploys a proxy program, a client program, and a server program. The client program is used to simulate a real client based on a real client address, and the server program is used to simulate a real server based on a real server address. The client program and the server program simulate communication between a real client and a real server. The method includes:

[0006] The received request traffic is forwarded to the client program through the proxy program, and the request traffic is application layer proxy traffic or transport layer proxy traffic;

[0007] The client program constructs the request traffic based on the network protocol stack and sends the constructed request traffic to the server program.

[0008] The received response traffic is forwarded to the server program through the proxy program;

[0009] The server program constructs the response traffic based on the network protocol stack and feeds the constructed response traffic back to the client program.

[0010] The constructed request traffic and the constructed response traffic are copied to obtain mirror traffic, and the mirror traffic is sent to the traffic operating system for preset operations.

[0011] Preferably, the proxy program is an HTTPS proxy program;

[0012] Accordingly, the request traffic and the response traffic are data after SSL decryption.

[0013] Preferably, the transport layer of the network protocol stack is a connection-oriented protocol;

[0014] Accordingly, the step of constructing the request traffic based on the network protocol stack through the client program and sending the constructed request traffic to the server program includes:

[0015] The client program establishes a connection channel with the server program based on the real client address and the real server address;

[0016] Based on the pre-established connection channel, the request traffic is constructed, and the constructed request traffic is sent to the server program;

[0017] Accordingly, the step of constructing the response traffic based on the network protocol stack by the server program and feeding back the constructed response traffic to the client program includes:

[0018] The server program determines the target connection channel, constructs the response traffic based on the target connection channel, and feeds back the constructed response traffic to the client program.

[0019] Preferably, the traffic mirroring method further includes:

[0020] The proxy program establishes a first session identifier based on the request traffic; wherein, the first session identifier is used to identify the connection channel corresponding to the request traffic;

[0021] The step of determining the target connection channel through the server program includes:

[0022] The server program obtains the second session identifier corresponding to the response traffic from the proxy program.

[0023] The connection channel corresponding to the first session identifier that matches the second session identifier is taken as the target connection channel.

[0024] Preferably, the real client address includes the IP address of the real client; the real server address includes the IP address of the real server and the port number of the real server.

[0025] Preferably, the step of copying the constructed request traffic and the constructed response traffic to obtain mirrored traffic includes:

[0026] The constructed request traffic and the constructed response traffic are copied using Linux itpables technology to obtain the mirrored traffic.

[0027] Preferably, the client program and the server program are isolated using Linux network namespace technology; the network namespace of the client program and the network namespace of the server program are connected using Linux virtual network interface technology.

[0028] Secondly, this application also discloses a traffic mirroring device applied to a proxy device. The proxy device deploys a proxy program, a client program, and a server program. The client program is used to simulate a real client based on a real client address, and the server program is used to simulate a real server based on a real server address. The client program and the server program simulate communication between a real client and a real server. The device includes:

[0029] The request traffic forwarding module is used to forward the received request traffic to the client program through the proxy program, wherein the request traffic is application layer proxy traffic or transport layer proxy traffic;

[0030] The request traffic construction module is used to construct the request traffic based on the network protocol stack through the client program, and send the constructed request traffic to the server program.

[0031] The response traffic forwarding module is used to forward the received response traffic to the server program through the proxy program;

[0032] The response traffic construction module is used to construct the response traffic based on the network protocol stack by the server program, and to feed back the constructed response traffic to the client program.

[0033] The traffic mirroring module is used to copy the constructed request traffic and the constructed response traffic to obtain mirror traffic, and send the mirror traffic to the traffic operating system for preset operations.

[0034] Thirdly, this application also discloses an agent device, comprising:

[0035] Memory, used to store computer programs;

[0036] A processor for executing the computer program to implement any of the traffic mirroring methods described above.

[0037] Fourthly, this application also discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the traffic mirroring methods described above.

[0038] This application provides a traffic mirroring method applied to a proxy device. The proxy device deploys a proxy program, a client program, and a server program. The client program simulates a real client based on a real client address, and the server program simulates a real server based on a real server address. The client program and the server program simulate communication between a real client and a real server. The method includes: forwarding received request traffic to the client program through the proxy program; the request traffic being application-layer proxy traffic or transport-layer proxy traffic; constructing the request traffic based on a network protocol stack through the client program and sending the constructed request traffic to the server program; forwarding received response traffic to the server program through the proxy program; constructing the response traffic based on the network protocol stack through the server program and feeding the constructed response traffic back to the client program; copying the constructed request traffic and the constructed response traffic to obtain mirrored traffic, and sending the mirrored traffic to a traffic operating system for preset operations.

[0039] As can be seen, the traffic mirroring method provided in this application forwards traffic packets between the real user client and the real server by deploying a proxy program in the proxy device, and virtualizes the real client and server by deploying client and server programs. Specifically, the client program corresponds to the real client (i.e., the client program uses the real client address, such as an IP address, to virtualize the real client; in this application, the source port may or may not be the same as the real client), and the server program corresponds to the real server (i.e., the server program uses the real server address, such as an IP address, to virtualize the real server; in this application, the destination port may or may not be the same as the real server, but should be as consistent as possible). Therefore, during traffic packet forwarding, request traffic initiated by the real client is first sent to the client program through the proxy program, then processed by the client program before being sent to the server program; response traffic from the real server is first sent to the server program through the proxy program, then processed by the server program before being sent to the client program. As can be seen, the client and server programs enable the forwarding of request and response traffic between the real client and the real server. Based on this, mirrored traffic is obtained by copying the traffic packets between the two, and then sent to the traffic operating system for processing. At this point, the traffic packets obtained by the traffic operating system are guaranteed to be complete packets between the real client and the real server, facilitating related operations such as auditing. Furthermore, the entire process is completed within the proxy device, effectively preventing network attacks and further ensuring traffic security.

[0040] The traffic mirroring device, proxy device, and computer-readable storage medium provided in this application all have the aforementioned beneficial effects, which will not be elaborated further here. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the prior art and the embodiments of this application, the accompanying drawings used in the description of the prior art and the embodiments of this application will be briefly introduced below. Of course, the accompanying drawings described below with respect to the embodiments of this application are only a part of the embodiments in this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort, and such other drawings also fall within the protection scope of this application.

[0042] Figure 1 A schematic diagram of the structure of a flow processing system provided in this application;

[0043] Figure 2 A flowchart illustrating a traffic mirroring method provided in this application;

[0044] Figure 3 A flowchart illustrating another traffic mirroring method provided in this application;

[0045] Figure 4 A scenario diagram illustrating traffic mirroring based on an aTrust proxy gateway provided in this application;

[0046] Figure 5 A scenario diagram illustrating traffic mirroring based on an aTrust controller, provided for the purposes of this application;

[0047] Figure 6 A schematic diagram of a flow mirroring device provided in this application;

[0048] Figure 7 This is a schematic diagram of the structure of an agent device provided in this application. Detailed Implementation

[0049] The core of this application is to provide a traffic mirroring method that can acquire complete traffic packets, thereby further improving traffic processing efficiency. Another core aspect of this application is to provide a traffic mirroring device, a traffic mirroring equipment, and a computer-readable storage medium, which also have the aforementioned beneficial effects.

[0050] To provide a clearer and more complete description of the technical solutions in the embodiments of this application, the technical solutions in the embodiments of this application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0051] This application provides a traffic mirroring method.

[0052] First, please refer to Figure 1 , Figure 1 This is a schematic diagram of a traffic processing system provided in this application. The traffic processing system includes a client, a proxy device, a server, and a traffic operating system (such as an auditing system). The proxy device is equipped with a proxy program, a client program, and a server program. The client program simulates a real client based on a real client address, the server program simulates a real server based on a real server program, and the proxy program forwards traffic packets, including forwarding traffic packets between the real client and the real server.

[0053] The real client address can include the IP address of the real client; the real server address can include the IP address of the real server and the port number of the real server.

[0054] It is understandable that a proxy device is an intermediary device between the client and the server. Its specific type does not affect the implementation of this technical solution; for example, it can be a proxy gateway (such as an aTrust gateway) or a proxy controller. It is conceivable that deploying the proxy program, client program, and server program together within the proxy device, allowing the traffic mirroring process to be completed internally, can effectively avoid network attacks and thus ensure the security of traffic data.

[0055] For further information, please refer to [link / reference]. Figure 2 , Figure 2 This is a flowchart illustrating a traffic mirroring method provided in this application. The traffic mirroring method may include:

[0056] S101: The received request traffic is forwarded to the client program through the proxy program. The request traffic is either application layer proxy traffic or transport layer proxy traffic.

[0057] S102: The client program constructs the request traffic based on the network protocol stack and sends the constructed request traffic to the server program.

[0058] The above steps aim to achieve request traffic forwarding. Specifically, when a client initiates a request to the server, the proxy device first sends the request traffic to the client program through a proxy program. This request traffic can be application-layer proxy traffic or transport-layer proxy traffic. Further, the client program can construct and process the request traffic based on the network protocol stack and forward the processed request traffic to the server program. Thus, the client and server programs simulate a real client sending request traffic to a real server. The network protocol stack refers to the sum of protocols at each layer of the network; it includes various different types of network protocols. By processing the request traffic through the network protocol stack, a constructed request traffic conforming to the corresponding network protocol can be obtained.

[0059] It should be noted that the traffic flow between the various programs within the proxy device is mainly used to achieve subsequent traffic mirroring and is unrelated to the actual business between the client and the server. In other words, after receiving the request traffic sent by the client, the proxy device will also forward it to the server to obtain the response traffic from the server and return it to the client to ensure the normal operation of the user's business.

[0060] As described above, the client program simulates a real client based on the real client address, and the server program simulates a real server based on the real server program. The traffic packets transmitted between the client program and the server program are the same as the traffic packets transmitted between the real client and the real server. Traffic mirroring is performed based on the traffic packets between the client program and the server program. The address information of the client program is the same as that of the real client, and the address information of the server program is the same as that of the real server. Therefore, it is convenient for other traffic operating systems to perform relevant processing on the traffic, such as facilitating auditing.

[0061] In a preferred embodiment, the client program and the server program can be isolated using Linux network namespace technology; the network namespace of the client program and the network namespace of the server program can be connected using Linux virtual network interface technology.

[0062] Specifically, for the client and server programs within the proxy device, Linux network namespace technology can be used to create independent network namespaces for them, thus isolating them and ensuring that the two programs do not interfere with each other during operation. Furthermore, Linux virtual network interface technology is used to connect the network namespaces of the client and server programs to enable traffic packet transmission between the two programs.

[0063] As a preferred embodiment, the aforementioned proxy program can specifically be an HTTP (Hypertext Transfer Protocol) proxy program, an HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) proxy program, or a TCP (Transmission Control Protocol) proxy program.

[0064] This preferred embodiment provides the above-mentioned specific types of proxy programs. Of course, the above types are only a few implementation methods provided by this preferred embodiment, and are not unique. In particular, the technical personnel can select and set them according to actual needs, and this application does not limit them.

[0065] When the proxy is an HTTPS proxy, the request and response traffic can be SSL decrypted data, which facilitates subsequent operations by other traffic operating systems.

[0066] It's understandable that HTTPS establishes an SSL (Secure Sockets Layer) encryption layer on top of HTTP to encrypt transmitted data, making it a secure version of the HTTP protocol. Therefore, when an HTTPS proxy forwards request traffic to the client program and response traffic to the server program, both the request and response traffic can be SSL-decrypted data. This allows the client and server programs to process the data accordingly, facilitating subsequent operations on the mirrored traffic by the traffic management system (e.g., for auditing purposes).

[0067] S103: Forward the received response traffic to the server program through the proxy program;

[0068] S104: The server program constructs the response traffic based on the network protocol stack and feeds the constructed response traffic back to the client program;

[0069] This step aims to achieve response traffic forwarding. Specifically, when the server sends response traffic to the client, the proxy device first sends the response traffic to the server program through the proxy program. Then, the server program can construct and process the response traffic based on the network protocol stack to obtain response traffic that meets the corresponding network protocol. Then, the constructed and processed response traffic is forwarded to the client program. In this way, the simulation of a real server sending response traffic to a real client is achieved through the client program and the server program.

[0070] As described above, after receiving the request traffic sent by the client, the proxy device also forwards it to the server to obtain the response traffic from the server and returns it to the client to ensure the normal operation of the user's business. Therefore, the response traffic received by the proxy program in S103 refers to the response traffic corresponding to the request traffic received by the proxy program in S101. As a preferred embodiment, the above-mentioned forwarding of the received request traffic to the client program through the proxy program may include: forwarding the request traffic to the client program through Unix socket technology; correspondingly, the above-mentioned forwarding of the received response traffic to the server program through the proxy program may include: sending the response traffic to the server program through Unix socket technology.

[0071] This preferred embodiment provides a method for forwarding traffic packets between internal programs, namely, based on Unix socket technology. Specifically, the proxy program can use Unix socket technology to forward request traffic to the client program and response traffic to the server program. The specific implementation process is the same as that in the prior art and will not be described in detail here.

[0072] S105: Copy the constructed request traffic and the constructed response traffic to obtain mirror traffic, and send the mirror traffic to the traffic operating system for preset operations.

[0073] This step aims to achieve traffic mirroring. Specifically, after the client and server programs complete the transmission of request and response traffic, these traffic segments constitute a complete traffic packet between the client and server. At this point, the constructed request and response traffic are copied to obtain the corresponding mirrored traffic. This mirrored traffic can then be sent to the traffic operating system for processing, i.e., the aforementioned preset operations. These preset operations include, but are not limited to, traffic auditing and traffic detection.

[0074] As a preferred embodiment, the above-described method of copying the constructed request traffic and the constructed response traffic to obtain mirror traffic may include: using Linux itpables technology to copy the constructed request traffic and the constructed response traffic to obtain the mirror traffic.

[0075] This preferred embodiment provides a traffic mirroring method, specifically based on Linux itpables technology. It utilizes Linux itpables technology to copy constructed request traffic and constructed response traffic to obtain corresponding mirrored traffic. iptables is a functional component in the Linux system that processes network packets, acting as a firewall. It can process passing packets, such as filtering and forwarding them. Applying it in this application allows for the implementation of traffic packet replication operations.

[0076] As can be seen, the traffic mirroring method provided in this application achieves the forwarding of traffic packets between the real user client and the real server by deploying a proxy program in the proxy device, and virtualizes the real client and server by deploying client and server programs, i.e., the client program corresponds to the real client, and the server program corresponds to the real server. Therefore, during the traffic packet forwarding process, for request traffic initiated by the real client, it is first sent to the client program through the proxy program, then processed by the client program and sent to the server program; for response traffic from the real server, it is first sent to the server program through the proxy program, then processed by the server program and sent to the client program. Thus, through the client and server programs, the forwarding of request and response traffic between the real client and the real server is achieved (i.e., the addresses in the traffic are consistent with the real client address (e.g., client IP address) and the real server address (e.g., server IP address)). Based on this, after copying the traffic packets between the two to obtain mirrored traffic, it can be sent to the traffic operating system for relevant traffic processing. Furthermore, the above implementation process is all completed within the proxy device, effectively avoiding network attack issues and further ensuring traffic security.

[0077] Based on the above embodiments:

[0078] In a preferred embodiment, the transport layer of the aforementioned network protocol stack can specifically be a connection-oriented protocol (such as the TCP protocol);

[0079] Accordingly, the above-mentioned construction of request traffic by the client program based on the network protocol stack and sending the constructed request traffic to the server program may include: establishing a connection channel between the client program and the server program based on the real client address and the real server address; constructing the request traffic based on the pre-established connection channel and sending the constructed request traffic to the server program.

[0080] Accordingly, the above-mentioned construction of response traffic by the server program based on the network protocol stack and feeding back the constructed response traffic to the client program may include: determining the target connection channel by the server program, constructing the response traffic based on the target connection channel, and feeding back the constructed response traffic to the client program.

[0081] This preferred embodiment provides a method for traffic transmission between a client program and a server program, namely, by creating a connection channel between the two. As described above, the client program is used to simulate a real client based on a real client address, and the server program is used to simulate a real server based on a real server program. Based on this, the client program can establish a connection channel with the server program according to the real client address and the real server address, thereby using the connection channel to construct request traffic and forward the constructed request traffic.

[0082] It is understandable that during the transmission of traffic packets between the client program and the server program, different sessions can be transmitted through different connection channels. That is, different connection channels are established between the client program and the server program (e.g., multiple TCP connection channels, each corresponding to an HTTP session (consisting of an HTTP request and an HTTP response)) to transmit the corresponding traffic packets. Furthermore, for each connection channel between the client program and the server program, the transmitted request and response traffic are mutually corresponding. Of course, how the client program and the server program communicate, and how many HTTP sessions correspond to one TCP connection, can be determined according to the actual situation, and this application does not limit this. If multiple different connection channels are established, then after receiving the response traffic sent by the proxy program, the server program can determine the connection channel corresponding to the response traffic from all the connection channels, i.e., the aforementioned target connection channel, and thus use this target connection channel to construct the response traffic and forward the constructed response traffic.

[0083] In a preferred embodiment, the traffic mirroring method may further include establishing a first session identifier through a proxy program based on the request traffic; wherein the first session identifier is used to identify the connection channel corresponding to the request traffic;

[0084] The above-mentioned determination of the target connection channel through the server program may include: obtaining the second session identifier corresponding to the response traffic from the proxy program through the server program; and taking the connection channel corresponding to the first session identifier that matches the second session identifier as the target connection channel.

[0085] This preferred embodiment provides a method for confirming a target connection channel, namely, based on session identifier matching. It is understood that a connection channel between a real client and a real server can maintain multiple sessions, with each session consisting of a request traffic and a corresponding response traffic. However, if a connection channel between a client program and a server program is only used to maintain one session, then a session identifier can be created to uniquely identify each connection channel between the client program and the server program. Of course, the specific number of request and response traffic corresponding to each connection channel can be determined according to actual development needs.

[0086] In the specific implementation process, firstly, after receiving the request traffic sent by the client, the proxy program can establish a first session identifier based on the request traffic. After the client program establishes a connection channel with the server program based on the request traffic, it uses the first session identifier to mark the connection channel. That is, each connection channel between the client program and the server program is assigned a unique identifier. Furthermore, after intercepting the response traffic from the real server to the real client, the proxy program determines a second session identifier and sends it to the server program when forwarding it. Thus, when the server program obtains the response traffic from the proxy program, it can simultaneously obtain the second session identifier. It then matches the second session identifier with the first session identifiers of each connection channel until a matching first session identifier is determined. The connection channel corresponding to this first session identifier is the target connection channel.

[0087] The specific content of the aforementioned session identifier does not affect the implementation of this technical solution; it only needs to determine the target connection channel and can be set by technical personnel according to the actual situation. For example, the specific content of the session identifier can consist of the real client source IP information, the real client source port information, the real server destination IP information, the real server destination port information, and a random number. For the proxy program, after receiving the request traffic, it can parse it to obtain the source IP information, source port information, destination IP information, and destination port information. Adding a random number corresponds to one session. The real client source IP and source port, the real server destination IP and destination port, plus the random number can be sent to the client program as the first session identifier. Based on this, after the client program establishes a connection channel with the server program, the aforementioned first session identifier can be used to mark the connection channel (for example, real client source IP1 source PORT1, real server destination IP2 destination PORT2, and the random number RandomX to identify a connection channel, which is: IP1+PORT_M---IP2+PORT2). After the proxy device sends the request traffic to the server, the server returns response traffic to the proxy device. The proxy device sends the source IP2 and source port PORT2 of the real server, the destination IP1 and destination port PORT1 of the real client, and the random number RandomX corresponding to the session to the server program as the second session identifier. The server program then uses the second session identifier to match and determine the target connection channel IP1+PORT_M--IP2+PORT2.

[0088] Furthermore, those skilled in the art will know that the first session identifier can be obtained by calculating the real client source IP1 source PORT1, the real server destination IP2 destination PORT2, and the random number RandomX using a certain algorithm. Similarly, the second session identifier can also be calculated using the same algorithm.

[0089] Understandably, when the traffic operating system is specifically a traffic auditing system, decryption can be performed first, because existing traffic auditing systems usually cannot audit encrypted HTTP traffic. On this basis, when the traffic packets transmitted between the client and the server are HTTPS packets, a TCP connection channel can be established between the client program and the server program. That is, the transmission of decrypted HTTP traffic packets is achieved through the TCP connection channel, avoiding the execution of decryption operations and further improving traffic mirroring efficiency.

[0090] Based on the above embodiments, this application provides another traffic mirroring method.

[0091] Please refer to Figure 3 , Figure 3This is a flowchart illustrating another traffic mirroring method provided in this application. It should be noted that the specific implementation of this method is completed within the proxy device (such as an aTrust proxy gateway or an aTrust controller). Figure 4 and Figure 5 As shown ( Figure 4 This application provides a scenario diagram for implementing traffic mirroring based on an aTrust proxy gateway. Figure 5 The scenario diagram provided in this application for traffic mirroring based on an aTrust controller can effectively avoid network attack problems. Furthermore, the specific implementation process of this traffic mirroring method is as follows:

[0092] First, during program deployment, Linux network namespace technology is used to isolate the client program and the server program to prevent them from interfering with each other. Then, Linux virtual network interface technology is used to connect the network namespaces of the client program and the server program to enable traffic transmission between the programs.

[0093] Furthermore, during program execution:

[0094] (1) HTTPS proxy:

[0095] When the HTTPS proxy receives HTTPS request traffic from a real client, it determines the source IP and source port of the real client, and the destination IP and destination port of the real server based on the HTTPS request traffic. Simultaneously, it generates a random number and constructs a first session identifier based on this information. The first session identifier, the source IP and source port of the real client, the destination IP and destination port of the real server, and the decrypted application-layer HTTP message are sent to the client program. The client program establishes a TCP connection based on the client's source IP, the server's destination IP, and the destination port, and sends the decrypted HTTP message to the server program corresponding to this TCP connection. When the HTTPS proxy receives HTTPS response traffic from the real server, it generates a second session identifier based on the source IP and source port of the real server, the destination IP and destination port of the real client, and the random number mentioned above. The second session identifier, the destination IP and destination port of the real client, the source IP and source port of the real server, and the decrypted application-layer HTTP response message are sent to the client program. The client program uses the second identifier to locate the TCP connection and sends the decrypted HTTP response message to the client program corresponding to that TCP connection.

[0096] (2) Client program:

[0097] The client program uses Unix socket technology to receive HTTP request traffic from the HTTPS proxy program, and initiates a TCP connection to the server program based on the HTTP request traffic. At the same time, it marks the TCP connection using the first session identifier mentioned above. Finally, it receives the HTTP response traffic corresponding to the HTTP request traffic sent by the server program through the TCP connection.

[0098] (3) Server-side program:

[0099] The server program uses Unix socket technology to receive the HTTP response traffic sent by the HTTPS proxy program and the second session identifier returned by the proxy program; further, it determines the target TCP connection by matching the second session identifier, and sends the HTTP response traffic to the client program through the target TCP connection.

[0100] The method described above for identifying the TCP connection channels of the client program and the server program by generating random numbers is typically applicable in scenarios where the TCP connection channel between the client program and the server program can only transmit one HTTP session (i.e., the client program and the server program use the HTTP 1.0 protocol). However, this application does not limit the type of HTTP protocol between the client program and the server program; the above is merely an example and does not constitute a limitation on the scope of protection.

[0101] Finally, during the traffic mirroring process:

[0102] The Linux itpables technology is used to copy the TCP traffic passing through the virtual network card and send it to the traffic operating system for traffic processing.

[0103] As can be seen, the traffic mirroring method provided in this application forwards traffic packets between the real user client and the real server by deploying a proxy program in the proxy device, and virtualizes the real client and server by deploying client and server programs, i.e., the client program corresponds to the real client and the server program corresponds to the real server. Therefore, during traffic packet forwarding, for request traffic initiated by the real client, it is first sent to the client program through the proxy program, then processed by the client program and sent to the server program; for response traffic from the real server, it is first sent to the server program through the proxy program, then processed by the server program and sent to the client program. Thus, the client and server programs achieve the forwarding of request and response traffic between the real client and the real server. Based on this, after copying the traffic packets between the two to obtain mirrored traffic, it can be sent to the traffic operating system for relevant traffic processing, facilitating subsequent operations by the traffic operating system. Furthermore, the above implementation process is all completed within the proxy device, effectively avoiding network attack issues and further ensuring traffic security.

[0104] Of course, during the communication between the proxy device and the traffic operating system, a key that is negotiated between the two parties can be used to improve security.

[0105] To address the aforementioned technical problems, this application also provides a traffic mirroring device, please refer to... Figure 6 , Figure 6 This is a schematic diagram of a traffic mirroring device provided in this application. The traffic mirroring device is applied to a proxy device, which deploys a proxy program, a client program, and a server program. The client program is used to simulate a real client based on a real client address, and the server program is used to simulate a real server based on a real server address. The client program and the server program simulate communication between a real client and a real server. The traffic mirroring device may include:

[0106] The request traffic forwarding module 1 is used to forward the received request traffic to the client program through the proxy program, wherein the request traffic is application layer proxy traffic or transport layer proxy traffic.

[0107] Request traffic construction module 2 is used to construct the request traffic based on the network protocol stack through the client program, and send the constructed request traffic to the server program;

[0108] The response traffic forwarding module 3 is used to forward the received response traffic to the server program through the proxy program;

[0109] The response traffic construction module 4 is used to construct the response traffic based on the network protocol stack by the server program, and to feed back the constructed response traffic to the client program.

[0110] Traffic mirroring module 5 is used to copy the constructed request traffic and the constructed response traffic to obtain mirror traffic, and send the mirror traffic to the traffic operating system for preset operations.

[0111] As can be seen, the traffic mirroring device provided in this application embodiment forwards traffic packets between the real user client and the real server by deploying a proxy program in the proxy device, and virtualizes the real client and server by deploying client and server programs, i.e., the client program corresponds to the real client, and the server program corresponds to the real server. Therefore, during traffic packet forwarding, for request traffic initiated by the real client, it is first sent to the client program through the proxy program, then processed by the client program and sent to the server program; for response traffic from the real server, it is first sent to the server program through the proxy program, then processed by the server program and sent to the client program. Thus, the forwarding of request and response traffic between the real client and the real server is achieved through the client and server programs. Based on this, after copying the traffic packets between the two to obtain mirrored traffic, it can be sent to the traffic operating system for relevant traffic processing, thereby facilitating subsequent operations of the traffic operating system. Furthermore, the above implementation process is all completed within the proxy device, effectively avoiding network attack issues and further ensuring traffic security.

[0112] As a preferred embodiment, the aforementioned proxy program can specifically be an HTTPS proxy program; correspondingly, the request traffic and response traffic can be data decrypted by SSL.

[0113] In a preferred embodiment, the transport layer of the aforementioned network protocol stack can specifically be a connection-oriented protocol;

[0114] Accordingly, the above-mentioned request traffic construction module 2 can be specifically used to establish a connection channel between the client program and the server program based on the real client address and the real server address; construct the request traffic based on the pre-established connection channel; and send the constructed request traffic to the server program.

[0115] Accordingly, the above-mentioned response traffic construction module 4 can be specifically used to determine the target connection channel through the server program, construct the response traffic based on the target connection channel, and feed back the constructed response traffic to the client program.

[0116] In a preferred embodiment, the traffic mirroring device may further include an identifier establishment module, used to establish a first session identifier based on the request traffic through the proxy program; wherein, the first session identifier is used to identify the connection channel corresponding to the request traffic; then the above-mentioned response traffic construction module 4 may be specifically used to obtain a second session identifier corresponding to the response traffic from the proxy program through the server program; and take the connection channel corresponding to the first session identifier that matches the second session identifier as the target connection channel.

[0117] In a preferred embodiment, the aforementioned real client address may include the IP address of the real client; the aforementioned real server address may include the IP address of the real server and the port number of the real server.

[0118] In a preferred embodiment, the traffic mirroring module 5 described above can be specifically used to copy the constructed request traffic and the constructed response traffic using Linux itpables technology to obtain the mirrored traffic.

[0119] In a preferred embodiment, the client program and the server program can be isolated using Linux network namespace technology; the network namespaces of the client program and the server program can be connected using Linux virtual network interface technology.

[0120] For a description of the device provided in this application, please refer to the above method embodiments; further details will not be provided here.

[0121] To address the aforementioned technical problems, this application also provides an agent device, please refer to... Figure 7 , Figure 7 This application provides a schematic diagram of the structure of a proxy device. The proxy device deploys a proxy program, a client program, and a server program. The client program simulates a real client based on a real client address, and the server program simulates a real server based on a real server address. The client program and the server program simulate communication between a real client and a real server. The proxy device may include:

[0122] Memory 10 is used to store computer programs;

[0123] The processor 20 is configured to execute computer programs to implement the steps of any of the traffic mirroring methods described above.

[0124] For a description of the equipment provided in this application, please refer to the above method embodiments; further details will not be provided here.

[0125] To address the aforementioned issues, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of any of the traffic mirroring methods described above.

[0126] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0127] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0128] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0129] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0130] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0131] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A traffic mirroring method, characterized in that, The method is applied to a proxy device, which deploys a proxy program, a client program, and a server program. The client program simulates a real client based on a real client address, and the server program simulates a real server based on a real server address. The client program and the server program simulate communication between a real client and a real server. The proxy program forwards the received request traffic to the client program. The request traffic is either application layer proxy traffic or transport layer proxy traffic. The request traffic is traffic initiated by the real client to the real server. The client program constructs the request traffic based on the network protocol stack and sends the constructed request traffic to the server program. The proxy program forwards the received response traffic to the server program; the response traffic is the traffic fed back from the real server to the real client and corresponds to the request traffic. The server program constructs the response traffic based on the network protocol stack and feeds the constructed response traffic back to the client program. The constructed request traffic and the constructed response traffic are copied to obtain mirror traffic, and the mirror traffic is sent to the traffic operating system for preset operations; the traffic operating system is a traffic auditing system or a traffic detection system.

2. The method according to claim 1, characterized in that, The proxy program is specifically an HTTPS proxy program; Accordingly, the request traffic and the response traffic are data after SSL decryption.

3. The method according to claim 1, characterized in that, The transport layer of the network protocol stack is a connection-oriented protocol; Accordingly, the step of constructing the request traffic based on the network protocol stack through the client program and sending the constructed request traffic to the server program includes: The client program establishes a connection channel with the server program based on the real client address and the real server address; Based on the pre-established connection channel, the request traffic is constructed, and the constructed request traffic is sent to the server program; Accordingly, the step of constructing the response traffic based on the network protocol stack by the server program and feeding back the constructed response traffic to the client program includes: The server program determines the target connection channel, constructs the response traffic based on the target connection channel, and feeds back the constructed response traffic to the client program.

4. The method according to claim 3, characterized in that, Also includes: The proxy program establishes a first session identifier based on the request traffic; wherein, the first session identifier is used to identify the connection channel corresponding to the request traffic; The step of determining the target connection channel through the server program includes: The server program obtains the second session identifier corresponding to the response traffic from the proxy program. The connection channel corresponding to the first session identifier that matches the second session identifier is taken as the target connection channel.

5. The method according to any one of claims 1 to 4, characterized in that, The real client address includes the IP address of the real client; the real server address includes the IP address of the real server and the port number of the real server.

6. The method according to any one of claims 1 to 4, characterized in that, The step of copying the constructed request traffic and the constructed response traffic to obtain mirror traffic includes: The constructed request traffic and the constructed response traffic are copied using Linux itpables technology to obtain the mirrored traffic.

7. The method according to any one of claims 1 to 4, characterized in that, The client program and the server program are isolated using Linux network namespace technology; the network namespaces of the client program and the server program are connected using Linux virtual network interface technology.

8. A flow mirroring device, characterized in that, This is applied to a proxy device, which is equipped with a proxy program, a client program, and a server program. The client program is used to simulate a real client based on a real client address, and the server program is used to simulate a real server based on a real server address. The client program and the server program simulate communication between a real client and a real server. The device includes: The request traffic forwarding module is used to forward the received request traffic to the client program through the proxy program. The request traffic is application layer proxy traffic or transport layer proxy traffic. The request traffic is traffic initiated by the real client to the real server. The request traffic construction module is used to construct the request traffic based on the network protocol stack through the client program, and send the constructed request traffic to the server program. The response traffic forwarding module is used to forward the received response traffic to the server program through the proxy program; the response traffic is the traffic fed back from the real server to the real client and corresponds to the request traffic; The response traffic construction module is used to construct the response traffic based on the network protocol stack by the server program, and to feed back the constructed response traffic to the client program. The traffic mirroring module is used to copy the constructed request traffic and the constructed response traffic to obtain mirror traffic, and send the mirror traffic to the traffic operating system for preset operations; the traffic operating system is a traffic auditing system or a traffic detection system.

9. An agent device, characterized in that, The proxy device is deployed with a proxy program, a client program, and a server program. The client program is used to simulate a real client based on a real client address, and the server program is used to simulate a real server based on a real server address. The client program and the server program simulate communication between a real client and a real server, including: Memory, used to store computer programs; A processor, configured to implement the steps of the traffic mirroring method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the traffic mirroring method as described in any one of claims 1 to 7.

Images