Nginx-based bypass method and device, electronic equipment and storage medium

Abstract

Embodiments of the present disclosure disclose a bypass method and device based on nginx, electronic equipment and storage medium. The nginx is deployed in a network device system, and the bypass method comprises: in response to a first TCP connection initiated by a client, determining whether the first TCP connection needs bypass; when bypass is needed, creating a first object according to the first TCP connection, the first object having a first temporary buffer; reading data sent by the client through the first TCP connection to the first temporary buffer; constructing a false request object, the nginx processing the false request object, and after the processing is completed, the nginx establishing a second TCP connection with a backend server; based on the second TCP connection, the nginx sending data buffered in the first temporary buffer to the backend server; after the nginx receives data returned by the backend server, calling a preset interface of the nginx to realize data transmission between the client and the backend server. The method can improve the bypass processing capability of the network device system.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a bypass method, apparatus, electronic device and storage medium based on nginx. Background Technology

[0002] Nginx (engine x) is a high-performance HTTP and reverse proxy web server. In the field of network security, Nginx can be deployed in network devices such as firewalls to process (e.g., for WAF security checks) and forward requests from clients. When data traffic from clients suddenly increases and exceeds the capacity of network devices, new client connections will not be able to be processed by Nginx, resulting in service interruption.

[0003] Existing technologies primarily involve real-time monitoring of the network device system load. When the system load reaches a certain threshold, newly established client connections are bypassed. In this case, the network device will no longer process the traffic of the newly established connection, but will instead directly forward the request corresponding to the newly established connection to avoid service interruption.

[0004] The inventors discovered that in the above method, nginx requires an HTTP connection to be established and the client's request to be received before the new connection can be bypassed. During this process, data from the client needs to be decrypted by nginx first, and then encrypted again before being forwarded to the backend server. This encryption and decryption process will increase the system load, consume a lot of CPU resources, and reduce the bypass processing capability of the network device system. Summary of the Invention

[0005] In view of this, the present disclosure provides a bypass method, apparatus, electronic device and storage medium based on nginx, which can improve the bypass processing capability of network device systems.

[0006] Firstly, this disclosure provides a bypass method based on nginx, employing the following technical solution: The nginx-based bypass method includes: In response to the first TCP connection initiated by the client, determine whether the first TCP connection needs to be bypassed; When a bypass is needed, a first object is created based on the first TCP connection, and the first object has a first temporary buffer; Read the data sent by the client through the first TCP connection into the first temporary buffer; A fake request object is constructed, and nginx processes the fake request object. After processing, nginx establishes a second TCP connection with the backend server. Based on the second TCP connection, nginx sends the data buffered in the first temporary buffer to the backend server; After nginx receives the data returned by the backend server, it calls the nginx's preset interface to realize data transmission between the client and the backend server.

[0007] Optionally, reading the data sent by the client through the first TCP connection to the first temporary buffer includes: Determine whether the first TCP connection is an SSL connection; If it is an SSL connection, adjust the nginx processing flow, ignore the nginx SSL settings, and directly read the data sent by the client through the first TCP connection into the first temporary buffer; If it is not an SSL connection, the data sent by the client through the first TCP connection is directly read into the first temporary buffer.

[0008] Optionally, the nginx-based bypass method further includes: after reading the data sent by the client through the first TCP connection to the first temporary buffer, Determine whether the amount of data sent by the client is less than the second threshold; If so, the step of constructing a fake request object is paused until the amount of data buffered in the first temporary buffer reaches the third threshold.

[0009] Optionally, the construction of the fake request object and the processing of the fake request object by nginx include: Create a fake request object based on the HTTP request template; The nginx invokes the standard procedure to process the fake request object.

[0010] Optionally, the HTTP request template is a template for an HTTP request that contains only a single request line.

[0011] Optionally, during the process of nginx calling the standard procedure to process the fake request object, a first flag is set for the fake request object. The first flag is used to make the fake request object skip the internal business processing of the network device system.

[0012] Optionally, based on the second TCP connection, the step of nginx sending the data buffered in the first temporary buffer to the backend server includes: Determine whether the first TCP connection corresponding to the second TCP connection is an SSL connection; If it is an SSL connection, the processing flow of nginx is adjusted to ignore the SSL settings of nginx, and nginx directly sends the data buffered in the first temporary buffer to the backend server.

[0013] Optionally, the nginx-based bypass method further includes: when the data sent by the client through the first TCP connection exceeds the limit of the first temporary buffer, blocking the read event and setting a second flag for the data; after nginx sends the data buffered in the first temporary buffer to the backend server based on the second TCP connection, continuously sending the unbuffered data as the request_body to the backend server according to the second flag.

[0014] Optionally, the preset interface is the ngx_http_upstream_ugrade interface of nginx.

[0015] Secondly, this disclosure also provides a bypass device based on nginx, which adopts the following technical solution: The nginx-based bypass device includes: The judgment module is used to respond to the first TCP connection initiated by the client and determine whether the first TCP connection needs to be bypassed. A creation module is used to create a first object based on the first TCP connection when a bypass is required, the first object having a first temporary buffer; The reading module is used to read data sent by the client through the first TCP connection into the first temporary buffer; The construction module is used to construct fake request objects. The nginx processes the fake request objects. After processing, the nginx establishes a second TCP connection with the backend server. The sending module is used to send the data buffered in the first temporary buffer to the backend server based on the second TCP connection; The calling module is used to call the preset interface of nginx after nginx receives the data returned by the backend server, so as to realize the data transmission between the client and the backend server.

[0016] Thirdly, this disclosure also provides an electronic device that adopts the following technical solution: The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which enables the at least one processor to perform any of the above-described nginx-based bypass methods.

[0017] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions for causing a computer to execute any of the above-described nginx-based bypass methods.

[0018] This disclosure provides a bypass method, apparatus, electronic device, and storage medium based on Nginx. In this method, in response to a first TCP connection initiated by a client, it is determined whether the first TCP connection needs to be bypassed. If bypass is required, a first object is created based on the first TCP connection. The first object has a first temporary buffer. Data sent by the client through the first TCP connection is then read into the first temporary buffer to construct a spoofed request object. Nginx processes the spoofed request object. After processing, Nginx establishes a second TCP connection with the backend server. Based on the second TCP connection, Nginx sends the data buffered in the first temporary buffer to the backend server. After receiving the data returned by the backend server, Nginx calls a preset interface to realize data transmission between the client and the backend server. In this process, Nginx does not need to establish an HTTP connection first, nor does it need to go through Nginx's encryption / decryption and protocol parsing processes to bypass the newly established first TCP connection. This reduces the overhead of bypassing the connection on the network device system, thereby improving the bypass processing capability of the network device system.

[0019] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A flowchart of the nginx-based bypass method provided in this embodiment of the disclosure; Figure 2 A schematic diagram of the structure of an nginx-based bypass device provided in an embodiment of this disclosure; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0022] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0023] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0024] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0025] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0026] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0027] This disclosure provides a bypass method based on nginx. Nginx is deployed in a network device system, which can be a firewall, switch, router, bridge, hub, gateway, VPN server, etc. Figure 1 As shown, this nginx-based bypass method includes: Step S1: In response to the first TCP connection initiated by the client, determine whether the first TCP connection needs to be bypassed.

[0028] Optionally, after the client initiates the first TCP connection, the load of the network device system is obtained, and it is determined whether the load has reached a first threshold. If it has, the first TCP connection is considered to need to be bypassed; otherwise, it is considered that the first TCP connection does not need to be bypassed. Whether the load has reached the first threshold can be determined based on one or more of the following: CPU usage, number of connections, and number of concurrent connections. The specific first threshold can be set according to the actual situation and is not limited here.

[0029] Optionally, after configuring the HTTP service in the nginx configuration file, the ngx_http_init_connection function is executed when a new connection is established by the client, and nginx creates the first TCP connection in this function.

[0030] Step S2: When a bypass is required, create a first object based on the first TCP connection. The first object has a first temporary buffer.

[0031] After creating the first object (ngx_http_v0_connection), nginx will automatically allocate a temporary buffer for it, giving the first object its own temporary buffer. The size of the first temporary buffer can be several hundred bytes, 1K, or 2K, etc., and is not limited here.

[0032] When the first TCP connection does not require a bypass, nginx can directly execute the standard HTTP processing flow.

[0033] Step S3: Read the data sent by the client through the first TCP connection into the first temporary buffer.

[0034] Optionally, there are two different ways to handle whether the first TCP connection is an SSL connection. First, if the first TCP connection is an SSL connection, adjust the nginx processing flow to ignore nginx's SSL settings and directly read the data sent by the client through the first TCP connection into the first temporary buffer. Second, if the first TCP connection is not an SSL connection, directly read the data sent by the client through the first TCP connection into the first temporary buffer.

[0035] Optionally, when reading data sent by the client through the first TCP connection into the first temporary buffer, an attempt is made to fill the first temporary buffer.

[0036] Optionally, it can be determined whether the first TCP connection is an SSL connection based on which nginx service the first TCP connection connects to and the nginx configuration.

[0037] Step S4: Construct a fake request object. Nginx processes the fake request object. After processing, Nginx establishes a second TCP connection with the backend server.

[0038] Optionally, the above constructs a fake request object, and nginx processes the fake request object, including: creating a fake request object (ngx_http_request_t) based on the HTTP request template; and nginx calling the standard process (calling nginx's ngx_http_process_request) to process the fake request object.

[0039] For example, the HTTP request template is a template containing only a single request line "GET / HTTP" to simplify nginx's processing of dummy request objects as much as possible. Of course, other HTTP request templates can also be used, and those skilled in the art can choose according to their actual needs.

[0040] For example, nginx calls the standard process to process the fake request object, including: initializing the key fields of the fake request object according to the nginx protocol parsing specification, and then calling nginx's ngx_http_process_request to process the fake request object.

[0041] Optionally, during the process of nginx calling the standard procedure to process fake request objects, a first flag is set for the fake request object. The first flag is used to make the fake request object skip the internal business processing of the network device system (such as WAF security detection) to further improve the bypass processing capability of the network device system.

[0042] Optionally, the nginx-based bypass method in this embodiment further includes: after reading the data sent by the client through the first TCP connection to the first temporary buffer, determining whether the amount of data sent by the client is less than a second threshold; if so, pausing the step of constructing a fake request object until the amount of data buffered in the first temporary buffer reaches a third threshold, thereby preventing HTTP slow attacks. The second and third thresholds can be set according to actual needs; for example, the second threshold is 10 bytes and the third threshold is 100 bytes. If the amount of data sent by the client reaches or exceeds the second threshold, the step of constructing a fake request object can be executed normally.

[0043] Step S5: Based on the second TCP connection, nginx sends the data buffered in the first temporary buffer to the backend server.

[0044] Optionally, based on the second TCP connection, nginx sends the data buffered in the first temporary buffer to the backend server, including: determining whether the first TCP connection corresponding to the second TCP connection is an SSL connection; if it is an SSL connection, adjusting the nginx processing flow, ignoring the nginx SSL settings, and nginx directly sending the data buffered in the first temporary buffer to the backend server. Specifically, nginx directly sending the data buffered in the first temporary buffer to the backend server can be as follows: the second TCP connection has a second temporary buffer; nginx replaces the data in the second temporary buffer with the data buffered in the first temporary buffer, and then sends the data from the second temporary buffer to the backend server.

[0045] Optionally, the nginx-based bypass method in this embodiment further includes: when the data sent by the client through the first TCP connection exceeds the limit of the first temporary buffer, blocking the read event and setting a second flag for the data; after nginx sends the data buffered in the first temporary buffer to the backend server based on the second TCP connection, continuously sending the unbuffered data as the request_body to the backend server according to the second flag.

[0046] Step S6: After nginx receives the data returned by the backend server, it calls the default interface of nginx to realize the data transmission between the client and the backend server.

[0047] After nginx receives data from the backend server, it calls nginx's default interface to implement data transmission between the client and the backend server. Then, nginx will forward any data read from the client or backend server unchanged to the other side. Essentially, nginx treats the connection, which would otherwise require complex HTTP business processing, as a TCP proxy. Optionally, the default interface mentioned above is nginx's ngx_http_upstream_ugrade interface.

[0048] Since the original request can be correctly identified by the backend server without modification when using a transparent proxy or without altering the HTTP message content, after steps S1 to S6, for the same connection, subsequent calls to nginx's default interface can directly achieve data transmission between the client and the backend server. For newly initiated connections, steps S1 to S6 need to be executed again.

[0049] This disclosure provides a bypass method, apparatus, electronic device, and storage medium based on Nginx. In this method, in response to a first TCP connection initiated by a client, it is determined whether the first TCP connection needs to be bypassed. If bypass is required, a first object is created based on the first TCP connection. The first object has a first temporary buffer. Data sent by the client through the first TCP connection is then read into the first temporary buffer to construct a spoofed request object. Nginx processes the spoofed request object. After processing, Nginx establishes a second TCP connection with the backend server. Based on the second TCP connection, Nginx sends the data buffered in the first temporary buffer to the backend server. After receiving the data returned by the backend server, Nginx calls a preset interface to realize data transmission between the client and the backend server. In this process, Nginx does not need to establish an HTTP connection first, nor does it need to go through Nginx's encryption / decryption and protocol parsing processes to bypass the newly established first TCP connection. This reduces the overhead of bypassing the connection on the network device system, thereby improving the bypass processing capability of the network device system.

[0050] Furthermore, this disclosure also provides a bypass device based on nginx, such as... Figure 2 As shown, this nginx-based bypass device includes: Module 10 is used to determine whether the first TCP connection needs to be bypassed in response to the first TCP connection initiated by the client. Create module 20 to create a first object based on the first TCP connection when a bypass is required. The first object has a first temporary buffer. Reading module 30 is used to read data sent by the client through the first TCP connection into the first temporary buffer; Module 40 is used to construct fake request objects. Nginx processes the fake request objects. After processing, Nginx establishes a second TCP connection with the backend server. Sending module 50 is used for nginx to send data buffered in the first temporary buffer to the backend server based on the second TCP connection; Module 60 is used to call nginx's preset interface after nginx receives data returned by the backend server, so as to realize data transmission between the client and the backend server.

[0051] Optionally, the nginx-based bypass device further includes a pause module, which, after reading the data sent by the client through the first TCP connection to the first temporary buffer, determines whether the amount of data sent by the client is less than a second threshold. If so, it pauses the step of constructing a fake request object until the amount of data buffered in the first temporary buffer reaches a third threshold.

[0052] Optionally, the nginx-based bypass device further includes: a blocking module, configured to block read events and set a second flag for the data when the data sent by the client through the first TCP connection exceeds the limit of the first temporary buffer; and, after nginx sends the data buffered in the first temporary buffer to the backend server based on the second TCP connection, to continuously send the unbuffered data as the request_body to the backend server according to the second flag.

[0053] It should be noted that the specific details of each step in the nginx-based bypass method also apply to the modules mentioned above, and will not be repeated here.

[0054] An electronic device according to embodiments of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), a hard disk, flash memory, etc.

[0055] The processor may be a central processing unit (CPU) or other processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of this disclosure, the processor is used to execute computer-readable instructions stored in the memory, causing the electronic device to perform all or part of the steps of the nginx-based bypass methods described in the foregoing embodiments of this disclosure.

[0056] Those skilled in the art will understand that, in order to solve the technical problem of how to achieve a good user experience, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included within the protection scope of this disclosure.

[0057] like Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the electronic device in the embodiment of the present disclosure. Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0058] like Figure 3 As shown, an electronic device may include a processor (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) or a program loaded from a storage device into random access memory (RAM). The RAM also stores various programs and data required for the operation of the electronic device. The processor, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0059] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow electronic devices to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 3 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0060] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from ROM. When the computer program is executed by a processor, all or part of the steps of the nginx-based bypass method of embodiments of this disclosure are performed.

[0061] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0062] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When these non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the nginx-based bypass methods described in the foregoing embodiments of the present disclosure are performed.

[0063] The aforementioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or portable hard drive), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0064] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0065] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0066] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0067] Additionally, as used herein, the “or” used in a list of items beginning with “at least one” indicates a separate list, such that a list of, for example, “at least one of A, B, or C” means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word “exemplary” does not imply that the described example is preferred or better than other examples.

[0068] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0069] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0070] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0071] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A bypass method based on nginx, wherein nginx is deployed in a network device system, characterized in that, include: In response to the first TCP connection initiated by the client, determine whether the first TCP connection needs to be bypassed; When a bypass is needed, a first object is created based on the first TCP connection, and the first object has a first temporary buffer; Read the data sent by the client through the first TCP connection into the first temporary buffer; A fake request object is constructed, and nginx processes the fake request object. After processing, nginx establishes a second TCP connection with the backend server. Based on the second TCP connection, nginx sends the data buffered in the first temporary buffer to the backend server; After nginx receives the data returned by the backend server, it calls the nginx's preset interface to realize data transmission between the client and the backend server.

2. The bypass method based on nginx according to claim 1, characterized in that, The step of reading the data sent by the client through the first TCP connection to the first temporary buffer includes: Determine whether the first TCP connection is an SSL connection; If it is an SSL connection, adjust the nginx processing flow, ignore the nginx SSL settings, and directly read the data sent by the client through the first TCP connection into the first temporary buffer; If it is not an SSL connection, the data sent by the client through the first TCP connection is directly read into the first temporary buffer.

3. The bypass method based on nginx according to claim 1, characterized in that, Also includes: After reading the data sent by the client through the first TCP connection into the first temporary buffer. Determine whether the amount of data sent by the client is less than the second threshold; If so, the step of constructing a fake request object is paused until the amount of data buffered in the first temporary buffer reaches the third threshold.

4. The bypass method based on nginx according to claim 1, characterized in that, The construction of the fake request object and the processing of the fake request object by nginx include: Create a fake request object based on the HTTP request template; The nginx invokes the standard procedure to process the fake request object.

5. The bypass method based on nginx according to claim 4, characterized in that, The HTTP request template is a template for an HTTP request that contains only a single request line.

6. The bypass method based on nginx according to claim 4 or 5, characterized in that, During the process of nginx calling the standard procedure to process the fake request object, a first flag is set for the fake request object. The first flag is used to make the fake request object skip the internal business processing of the network device system.

7. The bypass method based on nginx according to claim 1, characterized in that, Based on the second TCP connection, the nginx sends the data buffered in the first temporary buffer to the backend server, including: Determine whether the first TCP connection corresponding to the second TCP connection is an SSL connection; If it is an SSL connection, the processing flow of nginx is adjusted to ignore the SSL settings of nginx, and nginx directly sends the data buffered in the first temporary buffer to the backend server.

8. The bypass method based on nginx according to claim 1, characterized in that, Also includes: When the data sent by the client through the first TCP connection exceeds the limit of the first temporary buffer, the read event is blocked and a second flag is set for the data; after the nginx sends the data buffered in the first temporary buffer to the backend server based on the second TCP connection, the unbuffered data is continuously sent to the backend server as the request_body according to the second flag.

9. The bypass method based on nginx according to claim 1, characterized in that, The preset interface is the ngx_http_upstream_ugrade interface of nginx.

10. A bypass device based on nginx, characterized in that, include: The judgment module is used to respond to the first TCP connection initiated by the client and determine whether the first TCP connection needs to be bypassed. A creation module is used to create a first object based on the first TCP connection when a bypass is required, the first object having a first temporary buffer; The reading module is used to read data sent by the client through the first TCP connection into the first temporary buffer; The construction module is used to construct fake request objects. The nginx processes the fake request objects. After processing, the nginx establishes a second TCP connection with the backend server. The sending module is used to send the data buffered in the first temporary buffer to the backend server based on the second TCP connection; The calling module is used to call the preset interface of nginx after nginx receives the data returned by the backend server, so as to realize the data transmission between the client and the backend server.

11. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the nginx-based bypass method according to any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the nginx-based bypass method as described in any one of claims 1-9.

Images