Bastion machine traffic forwarding method, device, computer equipment and storage medium

Abstract

The present application relates to a bastion machine traffic forwarding method, apparatus, computer equipment, storage medium and computer program product. The method comprises: obtaining a component data packet, wherein the component data packet carries a destination address; obtaining a sending path of the component data packet, wherein the sending path comprises a path via a forwarding agent and a path not via a forwarding agent; judging whether the component data packet is a target data packet according to the destination address and the sending path; and when it is determined that the component data packet is a target data packet, forwarding the target data packet to the destination address via the forwarding agent. The use of this method can complete bastion machine traffic forwarding at a low cost while ensuring stability.

Description

Technical Field

[0001] The present application relates to the field of computer application technology, and in particular to a bastion server traffic forwarding method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] As a control platform for operation and maintenance and security audit, the bastion host can centrally manage operation and maintenance permissions and control operation behaviors throughout the process. At present, the deployment location of the bastion host is physically isolated from the user's scattered resources that need to be protected. Therefore, the forwarding of the bastion host traffic needs to be achieved through the proxy gateway deployed at each user's resource. The bastion host sends the user's traffic to the proxy gateway corresponding to the resource, and the proxy gateway then forwards the traffic to the corresponding resource node.

[0003] Therefore, each protocol component of the bastion host needs to support proxy gateway forwarding of traffic. In the case of many protocol components and different programming languages ​​for different components, it is necessary to ensure that all components can implement the logic of proxy gateway forwarding. At the same time, if the proxy gateway protocol or forwarding logic is updated later, each component also needs to be updated and tested accordingly.

[0004] At present, with the development of bastion host related technologies, the demand for the number of bastion host protocol components is increasing. In order to achieve stable traffic forwarding, higher and higher implementation and maintenance costs are required. Summary of the invention

[0005] Based on this, it is necessary to provide a bastion host traffic forwarding method, device, computer equipment, computer-readable storage medium and computer program product that can complete bastion host traffic forwarding at low cost while ensuring stability in response to the above technical problems.

[0006] In a first aspect, the present application provides a bastion machine traffic forwarding method, including:

[0007] Obtaining a component data packet, wherein the component data packet carries a destination address;

[0008] Acquire a sending path of the component data packet, wherein the sending path includes a path passing through a forwarding agent and a path not passing through a forwarding agent;

[0009] Determining whether the component data packet is a target data packet according to the destination address and the sending path;

[0010] When it is determined that the component data packet is a target data packet, the target data packet is forwarded to the destination address via the forwarding agent.

[0011] In one embodiment, the determining whether the component data packet is a target data packet according to the destination address and the sending path includes:

[0012] In the case where the sending path is a path that does not pass through a forwarding agent, determining whether the destination address is a protected resource address;

[0013] In the case where the destination address is a protected resource address, the current component data packet is determined to be a target data packet.

[0014] In one embodiment, forwarding the target data packet to the destination address via the forwarding agent comprises:

[0015] forwarding the target data packet to the listening port of the forwarding agent;

[0016] Query the corresponding destination gateway address according to the destination address;

[0017] The target data packet is sent to the destination gateway address via the forwarding agent.

[0018] In one embodiment, forwarding the target data packet to the listening port of the forwarding agent program includes:

[0019] Routing the target data packet to a local loopback port;

[0020] The listening port of the forwarding agent is controlled to continuously listen to the local loopback port to receive the target data packet.

[0021] In one embodiment, the forward proxy is a transparent proxy.

[0022] In one embodiment, the method further comprises:

[0023] When the data receiving rule corresponding to the target address is updated, the forwarding agent is adjusted according to the updated data receiving rule.

[0024] In a second aspect, the present application also provides a bastion machine traffic forwarding device, including:

[0025] A data acquisition module, used to acquire a component data packet, wherein the component data packet carries a destination address;

[0026] A path identification module, used for obtaining a sending path of the component data packet, wherein the sending path includes a path passing through a forwarding agent and a path not passing through a forwarding agent;

[0027] A path determination module, used for determining whether the component data packet is a target data packet according to the destination address and the sending path;

[0028] The proxy forwarding module is used to forward the target data packet to the destination address via the forwarding proxy program when determining that the component data packet is a target data packet.

[0029] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0030] Obtaining a component data packet, wherein the component data packet carries a destination address;

[0031] Acquire a sending path of the component data packet, wherein the sending path includes a path passing through a forwarding agent and a path not passing through a forwarding agent;

[0032] Determining whether the component data packet is a target data packet according to the destination address and the sending path;

[0033] When it is determined that the component data packet is a target data packet, the target data packet is forwarded to the destination address via the forwarding agent.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0035] Obtaining a component data packet, wherein the component data packet carries a destination address;

[0036] Acquire a sending path of the component data packet, wherein the sending path includes a path passing through a forwarding agent and a path not passing through a forwarding agent;

[0037] Determining whether the component data packet is a target data packet according to the destination address and the sending path;

[0038] When it is determined that the component data packet is a target data packet, the target data packet is forwarded to the destination address via the forwarding agent.

[0039] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0040] Obtaining a component data packet, wherein the component data packet carries a destination address;

[0041] Acquire a sending path of the component data packet, wherein the sending path includes a path passing through a forwarding agent and a path not passing through a forwarding agent;

[0042] Determining whether the component data packet is a target data packet according to the destination address and the sending path;

[0043] When it is determined that the component data packet is a target data packet, the target data packet is forwarded to the destination address via the forwarding agent.

[0044] The above-mentioned bastion host traffic forwarding method, device, computer equipment, storage medium and computer program product use a forwarding proxy program to forward the component data packets generated or sent by each component of the bastion host, and can determine whether the current component data packet has passed through the forwarding proxy program by judging the sending path, thereby avoiding the omission of component data packets that need to pass through the forwarding proxy program. When each component needs to forward traffic, it only needs to pay attention to its own processing logic to ensure that the component data packet has been sent out, and the forwarding proxy program will forward the component data packet that needs to be forwarded. Therefore, when the receiving gateway updates the transmission protocol, processing logic and other aspects of the component data packet, only the forwarding proxy program needs to be updated in a targeted manner, without changing the corresponding settings on the component end, and without retesting, which reduces the development and maintenance costs while ensuring the stability of traffic forwarding. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 This is an application environment diagram of a bastion host traffic forwarding method in an embodiment;

[0047] Figure 2 A schematic diagram of a flow chart of a bastion machine traffic forwarding method in an embodiment;

[0048] Figure 3 This is a flow chart of step S208 of a bastion server traffic forwarding method in an embodiment;

[0049] Figure 4 It is a structural block diagram of a bastion machine traffic forwarding device in one embodiment;

[0050] Figure 5 is an internal structure diagram of a computer device in one embodiment;

[0051] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in another embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] The bastion host traffic forwarding method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network, and the user can update the component library of the forwarding agent service through the terminal 102. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The data storage system can be used to store the mapping relationship between the target address and the corresponding gateway, as well as the operation data related to the traffic forwarding, and can also be used to temporarily store component data packets and other data. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0054] In an exemplary embodiment, Figure 2 As shown, a bastion machine traffic forwarding method is provided, which is applied to Figure 1 The server 104 in the example is used as an example to illustrate the method, which includes the following steps S202 to S208. Among them:

[0055] Step S202, obtaining a component data packet, wherein the component data packet carries a destination address.

[0056] The component data packet refers to the data sent by each component corresponding to the bastion host and needs to be sent to the target gateway. Each component data packet carries a destination address, and illustratively, the destination address includes a protected resource address and an unprotected resource address.

[0057] Exemplarily, the server 104 can control the forwarding agent to directly forward component data packets according to a preset component preset table, while component data packets sent by components that do not exist in the component preset table may not be directly monitored and forwarded by the agent forwarding program. The server 104 can capture component data packets sent by components. These component data packets can be transmitted through the network or sent through other communication channels. Next, the server 104 can parse the content of the component data packets, check the source address, destination address, protocol type and other important metadata information in the component data packets, and the server 104 can also review and filter the captured component data packets to ensure that they comply with security policies and rules, and check the content, protocol header and other key information in the data packets to decide whether to allow the data packets to pass.

[0058] Step S204, obtaining the sending path of the component data packet.

[0059] The sending path includes a path through a forwarding agent and a path not through a forwarding agent. The forwarding agent is used to receive component data packets from multiple components and forward the multiple component data packets to the gateway corresponding to their destination addresses, so that the forwarding of each component traffic is completely decoupled from the proxy gateway.

[0060] Exemplarily, the forwarding proxy can be a transparent proxy. A transparent proxy is a special type of proxy server that can intercept communications without the knowledge of the data receiver and communicate with other servers on behalf of the data sender. Therefore, the data sender does not need to make any configuration or settings for it, and the transparent proxy automatically handles all transmitted data in the background.

[0061] Step S206, judging whether the component data packet is a target data packet according to the destination address and the sending path.

[0062] The target data packet is a component data packet that has not passed through the forwarding agent and whose destination address exists in the protected resource address table. According to the destination address, it can be determined that the component data packet belongs to a data packet that needs to be sent by the forwarding agent to the corresponding gateway.

[0063] Exemplarily, the server 104 can determine whether the destination address is a protected resource address when the sending path is a path that does not pass through the forwarding agent, and determine that the current component data packet is the target data packet when the destination address is a protected resource address. Further, the server 104 can add a forwarding label to the target data packet.

[0064] Step S208: when it is determined that the component data packet is the target data packet, the target data packet is forwarded to the destination address via the forwarding agent.

[0065] Exemplarily, the server 104 can determine whether the current component data packet is the target data packet by identifying the forwarding tag. If the current component data packet is the target data packet, the server 104 can control the forwarding agent to monitor the data transmission port of the target data packet, and can also use other control programs to intercept the target data packet and forward it to the data receiving port of the forwarding agent. Next, the server 104 can parse the target data packet obtained by the forwarding agent to obtain the destination address therein. Finally, the server 104 can forward the target data packet according to the identified destination address.

[0066] In the above-mentioned bastion machine traffic forwarding method, a forwarding proxy is used to forward the component data packets generated or sent by each component of the bastion machine. When each component needs to forward traffic, it only needs to pay attention to its own processing logic to ensure that the component data packet has been sent out. The forwarding proxy will forward the component data packet that needs to be forwarded. Therefore, when the receiving gateway updates the transmission protocol, processing logic, etc. of the component data packet, only the forwarding proxy needs to be updated in a targeted manner. There is no need to change the corresponding settings on each component end, and there is no need to retest. While ensuring the stability of traffic forwarding, the development and maintenance costs are reduced. In addition, by judging the sending path, it can be known whether the current component data packet has passed through the forwarding proxy, thereby avoiding the omission of the component data packet that needs to pass through the forwarding proxy, and by judging the destination address, it can be confirmed whether the current component data packet needs to pass through the forwarding proxy, which can also reduce the risk of unsafe access.

[0067] In an exemplary embodiment, Figure 3 As shown, step S208 includes steps S302 to S306. Among them:

[0068] Step S302, forwarding the target data packet to the listening port of the forwarding agent program.

[0069] The listening port is a specific numeric identifier used by the forwarding proxy to intercept, review, and forward network traffic passing through the port. The forwarding proxy can listen to a specific port on the computer to listen to network traffic passing through the port. The listening port is the entry point for the proxy to communicate with the outside world. When traffic enters the proxy through this port, the proxy will process the traffic according to the pre-set rules and then forward it to the target server or target application.

[0070] For example, the server 104 may route the target data packet to the local loopback port, and then control the listening port of the forwarding agent to continuously listen to the local loopback port to receive the target data packet.

[0071] Step S304: query the corresponding destination gateway address according to the destination address.

[0072] Exemplarily, first, the server 104 can check the destination address in the target data packet to determine the target server or target network it is going to. Next, the server 104 can check the local routing table to see if there is a specific routing item that matches the destination address. If a matching routing item is found, the routing table will indicate which gateway the target data packet needs to be forwarded through. In the case of finding a matching routing item, the server 104 can determine the destination gateway address required for transmitting the data packet to the destination. This destination gateway address is the target of the next hop of the target data packet, which is used to forward the data packet to the next network node or target network.

[0073] Step S306, sending the target data packet to the destination gateway address via the forwarding agent.

[0074] Exemplarily, after determining the destination gateway address, the server 104 can use the address to forward the target data packet to the corresponding gateway device so as to continue to send data to the target address. After receiving the data packet, the destination gateway device will continue to forward the data packet to the next network node according to its own routing table and forwarding rules until the data packet reaches the final destination.

[0075] In an exemplary embodiment, the method further includes: when the data receiving rule corresponding to the target address is updated, adjusting the forwarding agent program according to the updated data receiving rule.

[0076] Exemplarily, in the case where the data receiving rule corresponding to the target address is updated, the server 104 can update the configuration of the forwarding agent according to the updated data receiving rule, such as updating the rules, policies, filters or other settings of the agent to ensure that it can correctly handle the new transmission logic and protocol. Before implementing any changes, the server 104 can test and verify the updated forwarding agent to ensure that the agent can work as expected and can handle different transmission logic and protocol changes without negatively affecting the normal operation of the system. After the update is fully tested and verified, the server 104 can deploy the updated forwarding agent and ensure that all configurations have been correctly applied, and the agent can seamlessly adapt to the changes in the transmission logic and protocol of the target gateway. Finally, after the update deployment, the server 104 can continuously monitor the performance and working status of the forwarding agent. Optimize and adjust as needed to ensure that the agent can effectively handle various traffic flowing through the network and provide a stable path for traffic forwarding.

[0077] In another exemplary embodiment, first, the operator can pre-set the component preset table using the terminal 102. The server 104 controls the forwarding agent to directly forward the component data packets according to the pre-set component preset table, and these component data packets can be transmitted through the network.

[0078] Next, the server 104 obtains the sending path of each intercepted component data packet to determine whether the current component data packet has passed through the forwarding agent. If the sending path is a path that does not pass through the forwarding agent, it determines whether the destination address is a protected resource address. If the destination address is a protected resource address, it determines that the current component data packet is a target data packet and adds a forwarding label to the target data packet.

[0079] Next, the server 104 parses the content of the component data packet, checks the source address, destination address, protocol type and other important metadata information in the component data packet, and determines whether the current component data packet is the target data packet by identifying the above-mentioned forwarding tag. When the current component data packet is the target data packet, the server 104 routes the target data packet to the local loopback port, and then controls the listening port of the forwarding agent program to continuously listen to the local loopback port to receive the target data packet.

[0080] Finally, the server 104 checks the destination address in the target data packet to determine the target server or target network to which it is directed, and then checks the local routing table to see if there is a specific routing item that matches the destination address. If a matching routing item is found, the routing table will indicate which gateway the target data packet needs to be forwarded through. In the case of a matching routing item, the destination gateway address required for transmitting the data packet to the destination is determined, and the target data packet is sent to the destination gateway address via the forwarding agent.

[0081] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0082] Based on the same inventive concept, the embodiment of the present application also provides a bastion machine traffic forwarding device for implementing the bastion machine traffic forwarding method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more bastion machine traffic forwarding device embodiments provided below can refer to the limitations of the bastion machine traffic forwarding method above, and will not be repeated here.

[0083] In an exemplary embodiment, Figure 4 As shown, a bastion machine traffic forwarding device is provided, including: a data acquisition module 402, a path identification module 404, a path judgment module 406 and a proxy forwarding module 408, wherein:

[0084] The data acquisition module 402 is used to acquire a component data packet, wherein the component data packet carries a destination address;

[0085] A path identification module 404, configured to obtain a sending path of a component data packet, wherein the sending path includes a path passing through a forwarding agent and a path not passing through a forwarding agent;

[0086] A path determination module 406, used to determine whether the component data packet is a target data packet according to the destination address and the sending path;

[0087] The proxy forwarding module 408 is used to forward the target data packet to the destination address via the forwarding proxy program when determining that the component data packet is the target data packet.

[0088] In one embodiment, the path determination module 406 includes:

[0089] An address determination submodule, used to determine whether the destination address is a protected resource address when the sending path is a path that does not pass through a forwarding proxy program;

[0090] The target determination submodule is used to determine that the current component data packet is a target data packet when the destination address is a protected resource address.

[0091] In one embodiment, the proxy forwarding module 408 includes:

[0092] A monitoring submodule, used to forward the target data packet to the monitoring port of the forwarding agent;

[0093] The address determination submodule is used to query the corresponding destination gateway address according to the destination address;

[0094] The data sending submodule is used to send the target data packet to the destination gateway address via the forwarding agent program.

[0095] In one embodiment, the monitoring submodule includes:

[0096] A data loopback unit, used for routing a target data packet to a local loopback port;

[0097] The data receiving unit is used for controlling the listening port of the forwarding agent program to continuously listen to the local loopback port to receive the target data packet.

[0098] In one embodiment, the forward proxy is a transparent proxy.

[0099] In one embodiment, the device further comprises:

[0100] The rule updating unit is used to adjust the forwarding agent program according to the updated data receiving rule when the data receiving rule corresponding to the target address is updated.

[0101] Each module in the above-mentioned bastion host traffic forwarding device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0102] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the mapping relationship between the target address and the corresponding gateway, as well as the operation data related to traffic forwarding, and is also used to temporarily store component data packets and other data. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a bastion machine traffic forwarding method is implemented.

[0103] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a bastion machine traffic forwarding method is implemented.

[0104] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0105] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: obtaining a component data packet, wherein the component data packet carries a destination address; obtaining a sending path of the component data packet, wherein the sending path includes a path via a forwarding agent and a path not via a forwarding agent; determining whether the component data packet is a target data packet based on the destination address and the sending path; and forwarding the target data packet to the destination address via the forwarding agent when it is determined that the component data packet is the target data packet.

[0106] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the sending path is a path that does not pass through the forwarding agent program, determine whether the destination address is a protected resource address; when the destination address is a protected resource address, determine that the current component data packet is the target data packet.

[0107] In one embodiment, when the processor executes the computer program, the following steps are also implemented: forwarding the target data packet to the listening port of the forwarding agent program; querying the corresponding destination gateway address according to the destination address; sending the target data packet to the destination gateway address via the forwarding agent program.

[0108] In one embodiment, when the processor executes the computer program, the following steps are further implemented: routing the target data packet to the local loopback port; and controlling the listening port of the forwarding agent program to continuously listen to the local loopback port to receive the target data packet.

[0109] In one embodiment, when the processor executes the computer program, the following steps are further implemented: when the data receiving rule corresponding to the target address is updated, the forwarding agent program is adjusted according to the updated data receiving rule.

[0110] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0111] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0112] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0113] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0114] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A bastion machine traffic forwarding method, characterized in that: The method comprises: Obtaining a component data packet, wherein the component data packet carries a destination address; Acquire a sending path of the component data packet, wherein the sending path includes a path passing through a forwarding agent and a path not passing through a forwarding agent; In the case where the sending path is a path that does not pass through a forwarding agent, determining whether the destination address is a protected resource address; In the case where the destination address is a protected resource address, determining that the current component data packet is a target data packet; When it is determined that the component data packet is a target data packet, the target data packet is forwarded to the destination address via the forwarding agent.

2. The method according to claim 1, characterized in that The forwarding of the target data packet to the destination address via the forwarding agent program comprises: forwarding the target data packet to the listening port of the forwarding agent; Query the corresponding destination gateway address according to the destination address; The target data packet is sent to the destination gateway address via the forwarding agent.

3. The method according to claim 2, characterized in that The step of forwarding the target data packet to the listening port of the forwarding agent program includes: Routing the target data packet to a local loopback port; The listening port of the forwarding agent is controlled to continuously listen to the local loopback port to receive the target data packet.

4. The method according to any one of claims 1 to 3, characterized in that: The forward proxy is a transparent proxy.

5. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: In the case where the data receiving rule corresponding to the destination address is updated, the forwarding agent is adjusted according to the updated data receiving rule.

6. A bastion machine traffic forwarding device, characterized in that: The device comprises: A data acquisition module, used to acquire a component data packet, wherein the component data packet carries a destination address; A path identification module, used for obtaining a sending path of the component data packet, wherein the sending path includes a path passing through a forwarding agent and a path not passing through a forwarding agent; a path determination module, configured to determine whether the destination address is a protected resource address if the sending path is a path that does not pass through a forwarding agent; and to determine that the current component data packet is a target data packet if the destination address is a protected resource address; The proxy forwarding module is used to forward the target data packet to the destination address via the forwarding proxy program when determining that the component data packet is a target data packet.

7. The device according to claim 6, characterized in that The proxy forwarding module includes: A monitoring submodule, used for forwarding the target data packet to the monitoring port of the forwarding agent program; An address determination submodule, used to query the corresponding destination gateway address according to the destination address; The data sending submodule is used to send the target data packet to the destination gateway address via the forwarding agent program.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images