Bypass blocking method and device, medium, electronic equipment and program product

Abstract

The invention discloses a bypass blocking method and device, a medium, electronic equipment and a program product. The method comprises the following steps: responding to a plurality of sub-packets of a client greeting message, analyzing the plurality of sub-packets in sequence according to the sequence of serial numbers until a complete target field is obtained, dividing the client greeting message into the plurality of sub-packets by a client, sending the sub-packets to a server, and in the analysis process, sending the sub-packets to the server; caching a reference field of the last extension field of the currently parsed sub-package as a parsing basis of the next to-be-parsed sub-package; extracting a domain name from the complete target field; and if the domain name belongs to the target type domain name, sending a reset message to the server and / or the client to block communication between the server and the client. Therefore, SNI cross-packet analysis can be efficiently completed, the blocking success rate of the communication connection between the client and the server is improved, and the blocking effect of the public cloud domain name is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a bypass blocking method, device, medium, electronic device and program product. Background Art

[0002] With the continuous development of computer and network technology, network security is of vital importance. Bypass blocking technology can effectively intercept malicious domain names accessed by Hypertext Transfer Protocol Secure (HTTPS). HTTPS bypass blocking usually obtains the Client Hello message of the HTTPS application through a splitter mirror switch, and then parses the Server Name Indication (SNI) information of the Client Hello message, extracts the domain name requested by the client from the SNI, and if the domain name is a malicious domain name, sends a reset message to the client to block the session. The Client Hello message accessing HTTPS through a browser generally has cross-packet problems. In related technologies, SNI cross-packet parsing is achieved by reorganizing each sub-packet, which has a large processing delay, resulting in a delay in the client sending the reset message and a reduced success rate in blocking the communication connection. Summary of the invention

[0003] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] In a first aspect, the present disclosure provides a bypass blocking method, which is applied to a bypass blocking device, and the method comprises: In response to obtaining multiple subpackets of the client hello message, the multiple subpackets are parsed in sequence according to the sequence number until a complete target field is obtained, wherein the client hello message is divided into the multiple subpackets by the client and sent to the server. During the parsing process, a reference field of the last extension field of the currently parsed subpacket is cached as a parsing basis for the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate a domain name requested by the client to the server; extracting the domain name from the complete target field; If the domain name belongs to the target type domain name, a reset message is sent to the server and / or the client to block the communication between the server and the client.

[0005] In a second aspect, the present disclosure provides a bypass blocking device, which is applied to a bypass blocking device, and the device includes: a parsing module, configured to, in response to obtaining multiple subpackets of a client hello message, parse the multiple subpackets in sequence according to the sequence number until a complete target field is obtained, wherein the client hello message is divided into the multiple subpackets by the client and sent to the server, and in the parsing process, cache a reference field of the last extension field of the currently parsed subpacket as a parsing basis for the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate a domain name requested by the client to the server; A domain name extraction module, used to extract the domain name from the complete target field; The blocking module is used to send a reset message to the server and / or the client to block the communication between the server and the client if the domain name belongs to a target type domain name.

[0006] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the bypass blocking method provided in the first aspect of the present disclosure.

[0007] In a fourth aspect, the present disclosure provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the bypass blocking method provided in the first aspect of the present disclosure.

[0008] In a fifth aspect, the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the bypass blocking method provided in the first aspect of the present disclosure.

[0009] In the above technical solution, the bypass blocking device sequentially parses multiple subpackets of the client hello message in the order of the serial number until the complete target field is obtained, wherein the client hello message is divided into multiple subpackets by the client and sent to the server. During the parsing process, the reference field of the last extended field of the currently parsed subpacket is cached as the basis for parsing the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate the domain name requested by the client to the server; then, the domain name is extracted from the complete target field; if the domain name belongs to the target type domain name, a reset message is sent to the server and / or the client to block the communication between the server and the client. When the bypass blocking solution sequentially parses multiple subpackets of the client hello message, it only caches the reference field of the last extended field of the parsed subpacket for parsing the next subpacket to be parsed, without the need for a subpacket reorganization operation, and once the complete target field is obtained, the parsing is stopped, so that the SNI cross-packet parsing can be completed efficiently, the blocking success rate of the communication connection between the client and the server is improved, and the public cloud domain name blocking effect is greatly improved.

[0010] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 The figure is a flow chart of a bypass blocking method according to an exemplary embodiment.

[0012] Figure 2 The present invention is a flowchart showing a method for sequentially parsing multiple sub-packets in the order of serial numbers until a complete target field is obtained according to an exemplary embodiment.

[0013] Figure 3 It is a flowchart of a method for sequentially parsing multiple subpackets in the order of sequence numbers until a complete target field is obtained according to another exemplary embodiment.

[0014] Figure 4 It is a flowchart of a method for sequentially parsing multiple subpackets in the order of sequence numbers until a complete target field is obtained according to yet another exemplary embodiment.

[0015] Figure 5It is a flowchart of a method for sequentially parsing multiple subpackets in the order of sequence numbers until a complete target field is obtained according to yet another exemplary embodiment.

[0016] Figure 6 is a timing diagram showing a bypass blocking process according to an exemplary embodiment.

[0017] Figure 7 It is a block diagram of a bypass blocking device according to an exemplary embodiment.

[0018] Figure 8 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0019] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0020] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0021] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0022] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0023] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0024] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0025] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0026] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0027] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0028] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0029] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0030] Figure 1 is a flow chart of a bypass blocking method according to an exemplary embodiment. The method can bypass the blocking device, such as Figure 1 As shown, the method may include S101~S103.

[0031] In S101, in response to obtaining multiple subpackets of the client hello message, the multiple subpackets are parsed in sequence according to the order of the serial numbers until the complete target field is obtained. During the parsing process, the reference field of the last extension field of the currently parsed subpacket is cached as a basis for parsing the next subpacket to be parsed. The target field is used to indicate the domain name requested by the client to the server.

[0032] In the present disclosure, the Client Hello message is the first message in the Transport Layer Security (TLS) handshake process, sent by the client to the server to start the TLS handshake process. In some cases, the Client Hello message may be divided into multiple packets for transmission by the client because its size exceeds the maximum transmission unit (MTU) of the network, that is, the Client Hello message is divided into multiple packets by the client and sent to the server. Among them, the bypass blocking device can capture multiple packets (belonging to the mirror file) of the Client Hello message of the HTTPS application through the splitter mirror switch.

[0033] The target field is used to indicate the domain name requested by the client to the server, for example, the server name field, the SNI field, etc. The target field belongs to the extension field. Therefore, the present disclosure only caches some key fields of the extension.

[0034] The Client Hello message includes multiple extension fields, which are a very important part of the TLS handshake process. They allow the client and the server to negotiate various additional functions and parameters. These extension fields are usually located at the end of the Client Hello message. When the Client Hello message is sub-packetized, the extension fields are located at the end of each sub-packet.

[0035] In addition, the extension field consists of a type subfield, a length subfield, and a data subfield. For ease of description, the disclosure collectively refers to the type subfield and the length subfield as a reference field, that is, the reference field includes the type subfield and the length subfield. Among them, the type subfield is used to characterize the type of the extension field, the data subfield is used to store the data value of the extension field, and the length subfield is used to characterize the length of the data represented by the data subfield in the extension field.

[0036] In the Transmission Control Protocol (TCP), data transmission is orderly, and each TCP segment (segment, i.e., subpacket) has a sequence number (Sequence Number), which is used to ensure the order and integrity of the data. When the Client Hello message is subpacketized, the sequence numbers of these subpackets are continuous and arranged from small to large in the order of sending. Therefore, when parsing multiple subpackets of the Client Hello message, they can be parsed in order from small to large in sequence. If the complete target field is obtained during the parsing process, the subpacket parsing is stopped. Otherwise, the reference field of the last extended field of the currently parsed subpacket is cached as the basis for parsing the next subpacket to be parsed. After that, the next subpacket is parsed until the complete target field is obtained.

[0037] In S102, the domain name is extracted from the complete target field.

[0038] In S103, if the extracted domain name belongs to the target type domain name, a reset message is sent to the server and / or the client to block the communication between the server and the client.

[0039] In the present disclosure, a target type domain name list can be pre-established, and whether the extracted domain name belongs to the target type domain name can be determined by matching the extracted domain name with the target type domain name list. If the extracted domain name is in the target type domain name list, it is determined that the extracted domain name belongs to the target type domain name; if the extracted domain name is not in the target type domain name list, it is determined that the extracted domain name does not belong to the target type domain name. Among them, the target type domain name can be a malicious domain name.

[0040] When the extracted domain name belongs to the target type domain name, a reset message can be sent to at least one of the server and the client. When the client receives the reset message, it can disconnect its communication connection to the server. Similarly, when the server receives the reset message, it can disconnect its communication connection to the client, thereby blocking the communication link between the server and the client.

[0041] If the extracted domain name does not belong to the target type domain name, no bypass blocking is performed, and the process ends.

[0042] In the above technical solution, the bypass blocking device sequentially parses multiple subpackets of the client hello message in the order of the serial number until the complete target field is obtained, wherein the client hello message is divided into multiple subpackets by the client and sent to the server. During the parsing process, the reference field of the last extended field of the currently parsed subpacket is cached as the basis for parsing the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate the domain name requested by the client to the server; then, the domain name is extracted from the complete target field; if the domain name belongs to the target type domain name, a reset message is sent to the server and / or the client to block the communication between the server and the client. When the bypass blocking solution sequentially parses multiple subpackets of the client hello message, it only caches the reference field of the last extended field of the parsed subpacket for parsing the next subpacket to be parsed, without the need for a subpacket reorganization operation, and once the complete target field is obtained, the parsing is stopped, so that the SNI cross-packet parsing can be completed efficiently, the blocking success rate of the communication connection between the client and the server is improved, and the public cloud domain name blocking effect is greatly improved.

[0043] The following is a detailed description of the specific implementation of the above S101 of sequentially parsing multiple sub-packets in the order of the sequence numbers until the complete target field is obtained. Specifically, it can be implemented through multiple implementations. In one implementation, the above S101 may include Figure 2 S201~S207 shown in.

[0044] In S201, the subpacket with the smallest sequence number is determined as the first subpacket.

[0045] In S202, the first sub-packet is parsed to determine whether a target field exists in the first sub-packet.

[0046] In the present disclosure, each field in the first sub-package can be parsed in sequence according to a preset order until the target field is parsed or all fields in the first sub-package are parsed. For the field currently parsed in the first sub-package, it can be determined whether the field currently parsed is the target field based on the type sub-field in the field. If the field currently parsed belongs to the target field, it indicates that the target field exists in the first sub-package. At this time, the field parsing for the first sub-package can be stopped; if the field currently parsed does not belong to the target field, the next field of the field in the first sub-package can be parsed.

[0047] Specifically, for the currently parsed field, if the field value of the type subfield in the field is the type of the target field, it indicates that the field is the target field; if the field value of the type subfield in the field is not the type of the target field, it indicates that the field does not belong to the target field.

[0048] In S203, if the target field does not exist in the first subpacket, a reference field of the last extended field in the first subpacket is cached.

[0049] In the present disclosure, if the target field does not exist in the first subpacket, the next subpacket of the first subpacket needs to be parsed. At this time, the reference field of the last extended field in the first subpacket can be cached as a basis for parsing the next subpacket of the first subpacket.

[0050] In S204, if the length of the reference field of the cached first subpacket does not reach the preset length, the second subpacket is parsed to obtain the reference field in the first extension field of the second subpacket.

[0051] In the present disclosure, the second subpacket is the next subpacket to be parsed after the first subpacket.

[0052] The length of the reference field (i.e., the total length of the type subfield and the length subfield) is usually fixed, for example, 4 bytes. If the length of the reference field of the cached first subpacket does not reach the preset length, it indicates that the reference field in the last extension field of the first subpacket crosses packets, that is, the first half of the reference field is located in the last extension field of the first subpacket, and the second half of the reference field is located in the first extension field of the second subpacket. For example, the type subfield of the reference field is located in the first subpacket, and the length subfield of the reference field is located in the second subpacket, or, a part of the type subfield of the reference field is located in the last extension field of the first subpacket, and the other part of the type subfield and the length subfield of the reference field are both located in the first extension field of the second subpacket.

[0053] In S205, the cached reference field of the first subpacket is concatenated with the acquired reference field of the second subpacket.

[0054] In S206, it is determined whether the first extension field of the second subpacket is a target field according to the type subfield in the reference field obtained after splicing.

[0055] In S207, if the first extension field of the second subpacket is the target field, the cached reference field of the first subpacket is concatenated with the first extension field of the second subpacket to obtain a complete target field.

[0056] When the reference field of the last extension field of the first subpacket crosses packets, it indicates that the first half of the reference field of the last extension field of the first subpacket is located in the last extension field of the first subpacket, and the second half of the reference field is located in the first extension field of the second subpacket. At this time, the cached reference field of the first subpacket can be spliced ​​with the reference field of the acquired second subpacket to obtain a complete reference field, so as to determine whether the first extension field of the second subpacket is the target field according to the type subfield in the complete reference field. If the first extension field of the second subpacket is the target field, it indicates that the target field crosses packets, that is, part of the reference field of the target field is located in the first subpacket, and the other part of the reference field and the data part of the target field are both located in the second subpacket. At this time, the cached reference field of the first subpacket can be spliced ​​with the first extension field of the second subpacket to obtain a complete target field.

[0057] In another embodiment, the above S101 may include Figure 3 S301~S311 shown in.

[0058] In S301, the subpacket with the smallest sequence number is determined as the first subpacket.

[0059] In S302, the first sub-packet is parsed to determine whether a target field exists in the first sub-packet.

[0060] In S303, if the target field does not exist in the first subpacket, a reference field of the last extended field in the first subpacket is cached.

[0061] In S304, it is determined whether the length of the reference field of the cached first subpacket reaches a preset length.

[0062] In the present disclosure, if the length of the reference field of the cached first subpacket does not reach the preset length, it indicates that the reference field of the last extended field of the first subpacket crosses packets. At this time, the following S305~S307 can be executed; if the length of the reference field of the cached first subpacket reaches the preset length, it indicates that the reference field of the last extended field of the first subpacket does not cross packets. At this time, the following S310 can be executed.

[0063] In S305, the second subpacket is parsed to obtain a reference field in a first extension field of the second subpacket.

[0064] In S306, the cached reference field of the first subpacket is concatenated with the obtained reference field of the second subpacket.

[0065] In S307, it is determined whether the first extension field of the second subpacket is a target field according to the type subfield in the reference field obtained after concatenation.

[0066] When the first extension field of the second subpacket is the target field, it indicates that the target field crosses packets, and at this time, the following S308 is executed; if the first extension field of the second subpacket is not the target field, other extension fields in the second subpacket except the first extension field can be further parsed to determine whether there is a target field therein, and at this time, the following S309 can be executed, and then the above S302 is returned. Among them, when the first subpacket is updated to other extension fields in the second subpacket except the first extension field, the next subpacket to be parsed after the updated first subpacket is the next subpacket to be parsed after the second subpacket before the update.

[0067] For example, multiple subpackets include subpacket A1, subpacket A2 and subpacket A3 with increasing serial numbers. If the initial first subpacket is subpacket A1, the updated first subpacket is the other extended fields in subpacket A2 except the first extended field, and the next subpacket to be parsed after the updated first subpacket is subpacket A3.

[0068] In S308, the cached reference field of the first subpacket is concatenated with the first extension field of the second subpacket to obtain a complete target field.

[0069] In S309, the other extended fields in the second subpacket except the first extended field are determined as the first subpacket.

[0070] In S310, it is determined whether the last extension field of the first subpacket is complete.

[0071] In the present disclosure, when the length of the reference field of the cached first subpacket reaches a preset length and the last extension field of the first subpacket is complete, it indicates that the last extension field of the first subpacket does not cross packets. At this time, the second subpacket can continue to be parsed, that is, the second subpacket is determined as the first subpacket, that is, the following S311 is executed, and then the above S302 is returned; when the length of the reference field of the cached first subpacket reaches a preset length and the last extension field of the first subpacket is incomplete, it indicates that the last extension field of the first subpacket crosses packets. At this time, since there is no target field in the first subpacket and the reference field of the first subpacket does not cross packets, it indicates that the first extension field of the second subpacket is not the target field. At this time, the first extension field of the second subpacket can be skipped, and parsing can continue from the second extension field of the second subpacket, that is, the above S309 is executed, and then the above S302 is returned.

[0072] In one possible implementation, whether the last extension field of the first subpacket is complete can be determined in the following manner: first, the current length of the data portion of the last extension field in the first subpacket is determined; if the current length is less than the length represented by the length subfield of the last extension field in the first subpacket, it is determined that the last extension field of the first subpacket is incomplete; if the current length is equal to the length represented by the length subfield of the last extension field in the first subpacket, it is determined that the last extension field of the first subpacket is complete.

[0073] In S311, the second sub-packet is determined as the first sub-packet.

[0074] In another embodiment, the above S101 may include Figure 4 S401~S412 shown in.

[0075] In S401, the subpacket with the smallest sequence number is determined as the first subpacket.

[0076] In S402, the first sub-packet is parsed to determine whether a target field exists in the first sub-packet.

[0077] In S403, if the target field does not exist in the first subpacket, a reference field of the last extended field in the first subpacket is cached.

[0078] In S404, if the length of the reference field of the cached first subpacket does not reach the preset length, the second subpacket is parsed to obtain the reference field in the first extension field of the second subpacket.

[0079] In S405, the cached reference field of the first subpacket is concatenated with the acquired reference field of the second subpacket.

[0080] In S406, it is determined whether the first extension field of the second subpacket is a target field according to the type subfield in the reference field obtained after concatenation.

[0081] In S407, if the first extension field of the second subpacket is the target field, the cached reference field of the first subpacket is concatenated with the first extension field of the second subpacket to obtain a complete target field.

[0082] In S408, if the target field exists in the first subpacket, it is determined whether the target field in the first subpacket is complete.

[0083] In the present disclosure, when a target field exists in the first subpacket, if the target field in the first subpacket is complete, the target field in the first subpacket can be directly determined as a complete target field, that is, S412 is executed. If the target field in the first subpacket is incomplete, it indicates that the target field crosses packages, that is, part of the target field is located in the last extension field of the first subpacket, and the other part is located in the first extension field of the second subpacket. At this time, the following S409~S411 can be executed.

[0084] In S409, the target field in the first subpacket is cached.

[0085] In S410, the second subpacket is parsed to obtain a first extension field of the second subpacket.

[0086] In S411, the target field in the cached first subpacket is concatenated with the first extension field of the second subpacket to obtain a complete target field.

[0087] In S412, the target field in the first sub-packet is determined as a complete target field.

[0088] In another embodiment, the above S101 may include Figure 5 S501~S516 shown in.

[0089] In S501, the subpacket with the smallest sequence number is determined as the first subpacket.

[0090] In S502, the first sub-packet is parsed to determine whether a target field exists in the first sub-packet.

[0091] In S503, if the target field does not exist in the first subpacket, a reference field of the last extended field in the first subpacket is cached.

[0092] In S504, it is determined whether the length of the reference field of the cached first subpacket reaches a preset length.

[0093] In the present disclosure, if the length of the reference field of the cached first subpacket does not reach the preset length, it indicates that the reference field of the last extended field of the first subpacket crosses packets. At this time, the following S505~S507 can be executed; if the length of the reference field of the cached first subpacket reaches the preset length, it indicates that the reference field of the last extended field of the first subpacket does not cross packets. At this time, the following S510 can be executed.

[0094] In S505, the second subpacket is parsed to obtain a reference field in a first extension field of the second subpacket.

[0095] In S506, the cached reference field of the first subpacket is concatenated with the obtained reference field of the second subpacket.

[0096] In S507, it is determined whether the first extension field of the second subpacket is a target field according to the type subfield in the reference field obtained after concatenation.

[0097] When the first extension field of the second subpacket is the target field, it indicates that the target field crosses the packet, and at this time, the following S508 is executed; if the first extension field of the second subpacket is not the target field, the other extension fields in the second subpacket except the first extension field can be further parsed to determine whether there is a target field therein, and at this time, the following S509 can be executed, and then the above S502 is returned. Among them, when the first subpacket is updated to other extension fields in the second subpacket except the first extension field, the next subpacket to be parsed after the updated first subpacket is the next subpacket to be parsed after the second subpacket before the update.

[0098] In S508, the cached reference field of the first subpacket is concatenated with the first extension field of the second subpacket to obtain a complete target field.

[0099] In S509, the other extended fields in the second subpacket except the first extended field are determined as the first subpacket.

[0100] In S510, it is determined whether the last extension field of the first subpacket is complete.

[0101] In the present disclosure, when the length of the reference field of the cached first subpacket reaches a preset length and the last extension field of the first subpacket is complete, it indicates that the last extension field of the first subpacket does not cross packets. At this time, the second subpacket can continue to be parsed, that is, the second subpacket is determined as the first subpacket, that is, the following S511 is executed, and then the above S502 is returned; when the length of the reference field of the cached first subpacket reaches a preset length and the last extension field of the first subpacket is incomplete, it indicates that the last extension field of the first subpacket crosses packets. At this time, since there is no target field in the first subpacket and the reference field of the first subpacket does not cross packets, it indicates that the first extension field of the second subpacket is not the target field. At this time, the first extension field of the second subpacket can be skipped, and parsing can continue from the second extension field of the second subpacket, that is, the above S509 is executed, and then the above S502 is returned.

[0102] In S511, the second sub-packet is determined as the first sub-packet.

[0103] In S512, if the target field exists in the first subpacket, it is determined whether the target field in the first subpacket is complete.

[0104] In the present disclosure, when a target field exists in the first subpacket, if the target field in the first subpacket is complete, the target field in the first subpacket can be directly determined as a complete target field, that is, S516 is executed. If the target field in the first subpacket is incomplete, it indicates that the target field crosses packages, that is, part of the target field is located in the last extension field of the first subpacket, and the other part is located in the first extension field of the second subpacket. At this time, the following S513~S515 can be executed.

[0105] In S513, the target field in the first subpacket is cached.

[0106] In S514, the second subpacket is parsed to obtain the first extension field of the second subpacket.

[0107] In S515, the target field in the cached first subpacket is concatenated with the first extension field of the second subpacket to obtain a complete target field.

[0108] In S516, the target field in the first subpacket is determined as a complete target field.

[0109] The following is a detailed description of the specific implementation of determining whether the target field in the first sub-packet is complete in the above S408 and S512. Specifically, it can be implemented by the following steps (1) to (6).

[0110] Step (1): Determine whether the target field belongs to the last extension field of the first subpacket.

[0111] If the target field belongs to the last extension field in the first sub-packet, execute the following step (2); if the target field does not belong to the last extension field in the first sub-packet, determine that the target field in the first sub-packet is complete, that is, execute the following step (5).

[0112] Step (2): Determine whether the length of the reference field of the last extended field in the first subpacket reaches a preset length.

[0113] If the target field belongs to the last extension field in the first subpacket, and the length of the reference field of the last extension field in the first subpacket does not reach the preset length, it indicates that the reference field of the last extension field in the first subpacket crosses packets, that is, the target field in the first subpacket is incomplete, and the following steps (6) are executed; if the target field belongs to the last extension field in the first subpacket, and the length of the reference field of the last extension field in the first subpacket reaches the preset length, the following steps (3) and (4) are executed.

[0114] Step (3): Determine the current length of the data portion of the last extension field in the first subpacket.

[0115] Step (4): Determine whether the current length of the data portion of the last extension field in the first subpacket is less than the length represented by the length subfield of the last extension field in the first subpacket.

[0116] If the current length is equal to the length represented by the length subfield of the last extension field in the first subpacket, it is determined that the target field in the first subpacket is complete, and the following step (5) is executed; if the current length is less than the length represented by the length subfield of the last extension field in the first subpacket, it is determined that the target field in the first subpacket is incomplete, and the following step (6) is executed.

[0117] Step (5): Determine whether the target field in the first sub-packet is complete.

[0118] Step (6): Determine that the target field in the first sub-packet is incomplete.

[0119] The specific implementation of sending a reset message to the server and / or client in the above S103 is described in detail below. Specifically, the above S103 may include: Sending a reset message to the client, wherein the sequence number of the reset message sent to the client is the confirmation number of the subpacket with the largest sequence number; and / or A reset message is sent to the server, wherein the sequence number in the reset message sent to the server is the sum of a maximum value among the sequence numbers of multiple subpackets and a data length of the subpacket with the largest sequence number.

[0120] In the present disclosure, when the bypass blocking device sends a reset message to the client, in order to enable the client to respond to the reset message, the reset message can be disguised as the message that the client expects to receive, that is, the confirmation message of the subpacket with the largest sequence number. Therefore, the sequence number of the reset message can be set to the confirmation number of the subpacket with the largest sequence number to ensure that the sequence number of the reset message sent by the bypass blocking device to the client is the sequence number of the message that the client expects to receive.

[0121] When the bypass blocking device sends a reset message to the server, in order to enable the server to respond to the reset message, the reset message can be disguised as a message that the server expects to receive, that is, the next message of the current Client Hello message. Therefore, the sequence number in the reset message is set to the sum of the maximum value of the sequence numbers of multiple subpackets and the data length of the subpacket with the largest sequence number, which can ensure that the sequence number of the reset message sent by the bypass blocking device to the server is the sequence number of the next message of the current Client Hello message.

[0122] For example, Figure 6As shown, the sequence number of the subpacket with the largest sequence number in the Client Hello message is x, the confirmation number is y, and the data length is z; the sequence number of the reset message sent by the bypass blocking device to the client is the confirmation number of the subpacket with the largest sequence number, that is, y, and the confirmation number of the reset message is 0; the sequence number of the reset message sent by the bypass blocking device to the server is the sum of the maximum value x among the sequence numbers of multiple subpackets and the data length z of the subpacket with the largest sequence number, that is, x+z, and the confirmation number of the reset message is 0.

[0123] Preferably, a reset message can be sent to the client and the server at the same time, so that as long as one party receives the reset message, the effect of blocking the session can be achieved, and the session can be blocked more stably.

[0124] Figure 7 1 is a block diagram of a bypass blocking device according to an exemplary embodiment. The bypass blocking device 100 can be applied to bypass blocking equipment, such as Figure 7 As shown, the bypass blocking device 100 includes: The parsing module 10 is used to, in response to obtaining multiple subpackets of the client hello message, parse the multiple subpackets in sequence according to the order of the sequence numbers until a complete target field is obtained, wherein the client hello message is divided into the multiple subpackets by the client and sent to the server. During the parsing process, a reference field of the last extension field of the currently parsed subpacket is cached as a parsing basis for the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate the domain name requested by the client to the server; A domain name extraction module 20, configured to extract the domain name from the complete target field; The blocking module 30 is configured to send a reset message to the server and / or the client to block the communication between the server and the client if the domain name belongs to a target type domain name.

[0125] In the above technical solution, the bypass blocking device sequentially parses multiple subpackets of the client hello message in the order of the serial number until the complete target field is obtained, wherein the client hello message is divided into multiple subpackets by the client and sent to the server. During the parsing process, the reference field of the last extended field of the currently parsed subpacket is cached as the basis for parsing the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate the domain name requested by the client to the server; then, the domain name is extracted from the complete target field; if the domain name belongs to the target type domain name, a reset message is sent to the server and / or the client to block the communication between the server and the client. When the bypass blocking solution sequentially parses multiple subpackets of the client hello message, it only caches the reference field of the last extended field of the parsed subpacket for parsing the next subpacket to be parsed, without the need for a subpacket reorganization operation, and once the complete target field is obtained, the parsing is stopped, so that the SNI cross-packet parsing can be completed efficiently, the blocking success rate of the communication connection between the client and the server is improved, and the public cloud domain name blocking effect is greatly improved.

[0126] Optionally, the parsing module 10 includes: A first determining submodule, used to determine the subpacket with the smallest sequence number as the first subpacket; A parsing submodule, configured to parse the first sub-packet to determine whether the target field exists in the first sub-packet; a cache submodule, configured to cache the reference field of the last extended field in the first subpacket if the target field does not exist in the first subpacket; The parsing submodule is further configured to parse the second subpacket to obtain the reference field in the first extension field of the second subpacket if the length of the reference field of the cached first subpacket does not reach the preset length, and to concatenate the cached reference field of the first subpacket with the obtained reference field of the second subpacket, wherein the multiple subpackets are parsed in ascending order of the sequence numbers, and the second subpacket is the next subpacket to be parsed after the first subpacket; The first splicing submodule is used to splice the cached reference field of the first subpacket with the first extension field of the second subpacket to obtain the complete target field if it is determined that the first extension field of the second subpacket is the target field based on the type subfield in the reference field obtained after splicing.

[0127] Optionally, the parsing module 10 further includes: A second determination submodule, configured to determine the other extension fields in the second subpacket except the first extension field as the first subpacket if it is determined according to the type subfield in the reference field obtained after the splicing that the first extension field of the second subpacket is not the target field, or the length reaches the preset length and the last extension field of the first subpacket is incomplete; The first triggering submodule is used to trigger the parsing submodule to parse the first subpacket to determine whether the target field exists in the first subpacket.

[0128] Optionally, the parsing module 10 further includes: A third determination submodule, configured to determine the second subpacket as the first subpacket if the length reaches the preset length and the last extension field of the first subpacket is complete; The second triggering submodule is used to trigger the parsing submodule to parse the first subpacket to determine whether the target field exists in the first subpacket.

[0129] Optionally, the parsing module 10 further includes: a fourth determination submodule, configured to determine whether the target field in the first subpacket is complete if the target field exists in the first subpacket; The cache submodule is further configured to cache the target field in the first subpacket if the target field in the first subpacket is incomplete; The parsing submodule is further used to parse the second subpacket to obtain the first extension field of the second subpacket; The second splicing submodule is used to splice the target field in the cached first subpacket with the first extension field in the second subpacket to obtain the complete target field.

[0130] Optionally, the parsing module 10 further includes: The fifth determining submodule is configured to determine the target field in the first subpacket as the complete target field if the target field in the first subpacket is complete.

[0131] Optionally, the fourth determining submodule includes: a sixth determination submodule, configured to determine whether the length of the reference field of the last extension field in the first subpacket reaches a preset length if the target field belongs to the last extension field in the first subpacket; The seventh determination submodule is configured to determine that the target field in the first subpacket is incomplete if the length of the reference field of the last extended field in the first subpacket does not reach the preset length.

[0132] Optionally, the fourth determining submodule further includes: an eighth determination submodule, configured to determine a current length of a data portion of a last extension field in the first subpacket if the length of the reference field of the last extension field in the first subpacket reaches the preset length; a ninth determination submodule, configured to determine that a target field in the first subpacket is complete if the current length is equal to a length represented by the length subfield of the last extension field in the first subpacket; The tenth determination submodule is configured to determine that the target field in the first subpacket is incomplete if the current length is less than the length represented by the length subfield of the last extension field in the first subpacket.

[0133] Optionally, the fourth determining submodule further includes: The eleventh determination submodule is configured to determine that the target field in the first subpacket is complete if the target field does not belong to the last extension field in the first subpacket.

[0134] Optionally, the blocking module 30 includes: A first blocking submodule is used to send a reset message to the client, wherein the sequence number of the reset message sent to the client is the confirmation number of the subpacket with the largest sequence number; and / or The second blocking submodule is used to send a reset message to the server, wherein the sequence number in the reset message sent to the server is the sum of the maximum value of the sequence numbers of the multiple subpackets and the data length of the subpacket with the largest sequence number.

[0135] The present disclosure also provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processing device, the steps of the bypass blocking method provided by the present disclosure are implemented.

[0136] The present disclosure also provides a computer program product, including a computer program, which implements the steps of the bypass blocking method provided by the present disclosure when the computer program is executed by a processor.

[0137] Reference below Figure 8 , which shows a schematic diagram of the structure of an electronic device (such as a terminal device or a server) 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0138] like Figure 8 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0139] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 8 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0140] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0141] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0142] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0143] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0144] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: in response to obtaining multiple subpackets of a client hello message, parse the multiple subpackets in sequence according to the order of the serial numbers until a complete target field is obtained, wherein the client hello message is divided into the multiple subpackets by the client and sent to the server. During the parsing process, a reference field of the last extended field of the subpacket currently parsed is cached as a basis for parsing the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate the domain name requested by the client to the server; the domain name is extracted from the complete target field; if the domain name belongs to a target type domain name, a reset message is sent to the server and / or the client to block the communication between the server and the client.

[0145] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0146] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0147] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a module does not limit the module itself in some cases. For example, a domain name extraction module may also be described as a "module for extracting the domain name from the complete target field".

[0148] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0149] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0150] According to one or more embodiments of the present disclosure, Example 1 provides a bypass blocking method, which is applied to a bypass blocking device, and the method includes: In response to obtaining multiple subpackets of the client hello message, the multiple subpackets are parsed in sequence according to the sequence number until a complete target field is obtained, wherein the client hello message is divided into the multiple subpackets by the client and sent to the server. During the parsing process, a reference field of the last extension field of the currently parsed subpacket is cached as a parsing basis for the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate a domain name requested by the client to the server; extracting the domain name from the complete target field; If the domain name belongs to the target type domain name, a reset message is sent to the server and / or the client to block the communication between the server and the client.

[0151] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein the step of sequentially parsing the multiple subpackets in the order of the sequence numbers until the complete target field is obtained includes: Determine the sub-packet with the smallest sequence number as the first sub-packet; Parsing the first sub-packet to determine whether the target field exists in the first sub-packet; If the target field does not exist in the first subpacket, caching the reference field of the last extension field in the first subpacket; If the length of the reference field of the cached first subpacket does not reach the preset length, the second subpacket is parsed to obtain the reference field in the first extension field of the second subpacket, and the cached reference field of the first subpacket is concatenated with the obtained reference field of the second subpacket, wherein the multiple subpackets are parsed in ascending order of the sequence numbers, and the second subpacket is the next subpacket to be parsed after the first subpacket; If the first extension field of the second subpacket is determined to be the target field based on the type subfield in the reference field obtained after splicing, the cached reference field of the first subpacket is spliced ​​with the first extension field of the second subpacket to obtain the complete target field.

[0152] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 2, wherein the step of sequentially parsing the multiple subpackets in the order of the sequence numbers until the complete target field is obtained further includes: If it is determined according to the type subfield in the reference field obtained after the splicing that the first extension field of the second subpacket is not the target field, or the length reaches the preset length and the last extension field of the first subpacket is incomplete, then the other extension fields in the second subpacket except the first extension field are determined as the first subpacket; Return to the step of parsing the first sub-packet to determine whether the target field exists in the first sub-packet.

[0153] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 2, wherein the step of sequentially parsing the multiple subpackets in the order of the sequence numbers until the complete target field is obtained further includes: If the length reaches the preset length and the last extension field of the first subpacket is complete, the second subpacket is determined as the first subpacket; Return to the step of parsing the first sub-packet to determine whether the target field exists in the first sub-packet.

[0154] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 2, wherein the step of sequentially parsing the multiple subpackets in the order of the sequence numbers until the complete target field is obtained further includes: If the target field exists in the first sub-packet, determining whether the target field in the first sub-packet is complete; If the target field in the first subpacket is incomplete, caching the target field in the first subpacket; Parsing the second subpacket to obtain a first extension field of the second subpacket; The target field in the cached first subpacket is concatenated with the first extension field in the second subpacket to obtain the complete target field.

[0155] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 5, wherein the step of sequentially parsing the multiple subpackets in the order of the sequence numbers until the complete target field is obtained further includes: If the target field in the first sub-packet is complete, the target field in the first sub-packet is determined as the complete target field.

[0156] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 5, wherein determining whether the target field in the first sub-packet is complete includes: If the target field belongs to the last extension field in the first subpacket, determining whether the length of the reference field of the last extension field in the first subpacket reaches a preset length; If the length of the reference field of the last extended field in the first subpacket does not reach the preset length, it is determined that the target field in the first subpacket is incomplete.

[0157] According to one or more embodiments of the present disclosure, Example 8 provides the method of Example 7, wherein determining whether the target field in the first sub-packet is complete further includes: If the length of the reference field of the last extension field in the first subpacket reaches the preset length, determining the current length of the data portion of the last extension field in the first subpacket; If the current length is equal to the length represented by the length subfield of the last extension field in the first subpacket, it is determined that the target field in the first subpacket is complete; If the current length is less than the length represented by the length subfield of the last extension field in the first subpacket, it is determined that the target field in the first subpacket is incomplete.

[0158] According to one or more embodiments of the present disclosure, Example 9 provides the method of Example 7, wherein determining whether the target field in the first sub-packet is complete further includes: If the target field does not belong to the last extension field in the first subpacket, it is determined that the target field in the first subpacket is complete.

[0159] According to one or more embodiments of the present disclosure, Example 10 provides the method described in any one of Examples 1-9, wherein sending a reset message to the server and / or the client includes: Sending a reset message to the client, wherein the sequence number of the reset message sent to the client is the confirmation number of the subpacket with the largest sequence number; and / or A reset message is sent to the server, wherein the sequence number in the reset message sent to the server is the sum of a maximum value among the sequence numbers of the multiple subpackets and a data length of the subpacket with the largest sequence number.

[0160] According to one or more embodiments of the present disclosure, Example 11 provides a bypass blocking device, which is applied to a bypass blocking device, and the device includes: a parsing module, configured to, in response to obtaining multiple subpackets of a client hello message, parse the multiple subpackets in sequence according to the sequence number until a complete target field is obtained, wherein the client hello message is divided into the multiple subpackets by the client and sent to the server, and in the parsing process, cache a reference field of the last extension field of the currently parsed subpacket as a parsing basis for the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate a domain name requested by the client to the server; A domain name extraction module, used to extract the domain name from the complete target field; The blocking module is used to send a reset message to the server and / or the client to block the communication between the server and the client if the domain name belongs to a target type domain name.

[0161] According to one or more embodiments of the present disclosure, Example 12 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-10 when executed by a processing device.

[0162] According to one or more embodiments of the present disclosure, Example 13 provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the method described in any one of Examples 1-10.

[0163] According to one or more embodiments of the present disclosure, Example 14 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-10 when executed by a processor.

[0164] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0165] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0166] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A bypass blocking method, characterized in that: Applied to a bypass blocking device, the method comprises: In response to obtaining multiple subpackets of the client hello message, the multiple subpackets are parsed in sequence according to the sequence number until a complete target field is obtained, wherein the client hello message is divided into the multiple subpackets by the client and sent to the server. During the parsing process, a reference field of the last extension field of the currently parsed subpacket is cached as a parsing basis for the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate a domain name requested by the client to the server; extracting the domain name from the complete target field; If the domain name belongs to the target type domain name, a reset message is sent to the server and / or the client to block the communication between the server and the client.

2. The method according to claim 1, characterized in that The step of sequentially parsing the multiple sub-packets in the order of the serial numbers until the complete target field is obtained includes: Determine the sub-packet with the smallest sequence number as the first sub-packet; Parsing the first sub-packet to determine whether the target field exists in the first sub-packet; If the target field does not exist in the first subpacket, caching the reference field of the last extension field in the first subpacket; If the length of the reference field of the cached first subpacket does not reach the preset length, the second subpacket is parsed to obtain the reference field in the first extension field of the second subpacket, and the cached reference field of the first subpacket is concatenated with the obtained reference field of the second subpacket, wherein the multiple subpackets are parsed in ascending order of the sequence numbers, and the second subpacket is the next subpacket to be parsed after the first subpacket; If the first extension field of the second subpacket is determined to be the target field based on the type subfield in the reference field obtained after splicing, the cached reference field of the first subpacket is spliced ​​with the first extension field of the second subpacket to obtain the complete target field.

3. The method according to claim 2, characterized in that The step of sequentially parsing the multiple sub-packets in the order of the serial numbers until the complete target field is obtained further includes: If it is determined according to the type subfield in the reference field obtained after the splicing that the first extension field of the second subpacket is not the target field, or the length reaches the preset length and the last extension field of the first subpacket is incomplete, then the other extension fields in the second subpacket except the first extension field are determined as the first subpacket; Return to the step of parsing the first sub-packet to determine whether the target field exists in the first sub-packet.

4. The method according to claim 2, characterized in that: The step of sequentially parsing the multiple sub-packets in the order of the serial numbers until the complete target field is obtained further includes: If the length reaches the preset length and the last extension field of the first subpacket is complete, the second subpacket is determined as the first subpacket; Return to the step of parsing the first sub-packet to determine whether the target field exists in the first sub-packet.

5. The method according to claim 2, characterized in that: The step of sequentially parsing the multiple sub-packets in the order of the serial numbers until the complete target field is obtained further includes: If the target field exists in the first sub-packet, determining whether the target field in the first sub-packet is complete; If the target field in the first subpacket is incomplete, caching the target field in the first subpacket; Parsing the second subpacket to obtain a first extension field of the second subpacket; The target field in the cached first subpacket is concatenated with the first extension field in the second subpacket to obtain the complete target field.

6. The method according to claim 5, characterized in that The step of sequentially parsing the multiple sub-packets in the order of the serial numbers until the complete target field is obtained further includes: If the target field in the first sub-packet is complete, the target field in the first sub-packet is determined as the complete target field.

7. The method according to claim 5, characterized in that The determining whether the target field in the first sub-packet is complete includes: If the target field belongs to the last extension field in the first subpacket, determining whether the length of the reference field of the last extension field in the first subpacket reaches a preset length; If the length of the reference field of the last extended field in the first subpacket does not reach the preset length, it is determined that the target field in the first subpacket is incomplete.

8. The method according to claim 7, characterized in that The determining whether the target field in the first sub-packet is complete further includes: If the length of the reference field of the last extension field in the first subpacket reaches the preset length, determining the current length of the data portion of the last extension field in the first subpacket; If the current length is equal to the length represented by the length subfield of the last extension field in the first subpacket, it is determined that the target field in the first subpacket is complete; If the current length is less than the length represented by the length subfield of the last extension field in the first subpacket, it is determined that the target field in the first subpacket is incomplete.

9. The method according to claim 7, characterized in that: The determining whether the target field in the first sub-packet is complete further includes: If the target field does not belong to the last extension field in the first subpacket, it is determined that the target field in the first subpacket is complete.

10. The method according to any one of claims 1 to 9, characterized in that The sending a reset message to the server and / or the client includes: Sending a reset message to the client, wherein the sequence number of the reset message sent to the client is the confirmation number of the subpacket with the largest sequence number; and / or A reset message is sent to the server, wherein the sequence number in the reset message sent to the server is the sum of a maximum value among the sequence numbers of the multiple subpackets and a data length of the subpacket with the largest sequence number.

11. A bypass blocking device, characterized in that: Applied to bypass blocking equipment, the device comprises: a parsing module, configured to, in response to obtaining multiple subpackets of a client hello message, parse the multiple subpackets in sequence according to the sequence number until a complete target field is obtained, wherein the client hello message is divided into the multiple subpackets by the client and sent to the server, and in the parsing process, cache a reference field of the last extension field of the currently parsed subpacket as a parsing basis for the next subpacket to be parsed, the reference field includes a type subfield and a length subfield, and the target field is used to indicate a domain name requested by the client to the server; A domain name extraction module, used to extract the domain name from the complete target field; The blocking module is used to send a reset message to the server and / or the client to block the communication between the server and the client if the domain name belongs to a target type domain name.

12. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 10 are implemented.

13. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 10.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images