Method and device for accelerating performance optimization of network server

Abstract

The invention provides a method and a device for accelerating performance optimization of a network server. The method comprises the following steps of: writing a target equipment address into a TCP (Transmission Control Protocol) extension SACK (Service Acknowledgement) in a first request data packet sent by a client; the server intercepts the first request data packet, obtains a target device address and a client device address from the first request data packet, modifies the TCP extension SACK into the client device address to form a second request data packet, and then transmits the second request data packet to a target device after transferring the second request data packet; after the target equipment receives the second request data packet, reading and obtaining the address of the client equipment, performing data processing by the target equipment, generating a first feedback data packet, and writing the address of the client equipment into the TCP extension SACK in the first feedback data packet; and the server intercepts the first feedback data packet, deletes the address in the TCP extension SACK in the first feedback data packet to form the second feedback data packet, and then sends the second feedback data packet to the client, so that the operation and maintenance cost is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field, and in particular to a method and device for accelerating network server performance optimization. Background Art

[0002] With the massive increase in cross-border e-commerce companies and cloud office equipment, the scale of cross-border network acceleration services is also growing, and the requirements for performance, stability, and operation and maintenance efficiency are also getting higher and higher.

[0003] Existing cross-border network acceleration services generally consist of the following four parts:

[0004] Client: Generally runs on the user's office device and acts as a local proxy, responsible for forwarding the user's device's network requests and receiving request results.

[0005] Pickup point: Usually a Linux server, the entrance of user traffic, responsible for forwarding traffic between user devices and the drop-off point.

[0006] Drop-off point: Generally, it is a Linux server, the exit of user cross-border traffic, responsible for forwarding traffic between the boarding point and the target device according to the rules configured at the boarding point. The drop-off point and the boarding point are connected through VXLAN (Virtual Extensible LAN), which is provided by a third-party operator. In this system, the drop-off point can be considered equivalent to the boarding point.

[0007] Target device: User traffic export, responsible for user authentication and final export of user traffic, fixing the export IP of user traffic, and meeting strict enterprise security verification.

[0008] The existing solution is based on Linux Netfilter network layer data forwarding. Its biggest advantage is that it does not require development. Only some simple configurations of the Linux command line tool iptables are needed to achieve traffic forwarding between the client and the target device.

[0009] The boarding point needs to configure forwarding rules to bind the target device's IP and port to the IP+port of a boarding point. First, configure the DNAT (destination IP address translation) rule of the fixed port to forward the data actively requested by the user device to the target device. Then configure MASQUERADE (dynamic source IP address translation) to send the target device's response data back to the source user device.

[0010] The specific data processing process is as follows:

[0011] 1. Request data packet arrives: The request data packet of the user device arrives at the designated port of the boarding point, and the data packet contains the source IP address of the user device;

[0012] 2. Matching rules: The kernel checks the DNAT rules and executes subsequent steps;

[0013] 3. Modify the target IP address and port: The kernel replaces the target IP and port of the request data packet with the target device IP and port according to the DNAT rule;

[0014] 4. Modify the source IP address: The kernel replaces the source IP of the request data with the exit IP address of the boarding point;

[0015] 5. Modify connection tracking information: The kernel automatically updates conntrack (connection tracking table) according to the MASQUERADE rule, records the modified user device source IP and maintains the connection status, which is crucial for the subsequent response data packet to be sent back to the user device;

[0016] 6. Forward the request packet: The modified request packet is forwarded to the target device;

[0017] 7. Response packet processing: When the target device response packet arrives, conntrack is checked again to obtain the source IP address of the user device, and the kernel replaces the target IP of the packet with the IP of the user device;

[0018] 8. Forwarding the response data packet: The modified response data packet is forwarded to the user device.

[0019] The above solution is not suitable for large-scale application. The specific problems are as follows:

[0020] Problem 1: A single boarding point is prone to performance bottlenecks:

[0021] When the boarding point processes the response data packet (step 7 above), each response data packet needs to check conntrack to obtain the user device source IP of the data packet.

[0022] Checking conntrack itself is a complex and time-consuming process. The more user devices connected, the more records there are in conntrack, and the longer it takes to find the source IP of the user device on average. In actual tests, when the number of user devices connected to a boarding point reaches 2,000 and is used simultaneously, the boarding point will consume a lot of CPU resources to check conntrack, and the efficiency of processing response data packets will be greatly reduced, limiting the maximum load of a single boarding point.

[0023] Problem 2: A single boarding point is prone to port resource bottlenecks:

[0024] In order to greatly simplify iptables rules, it is necessary to allocate independent ports to each enterprise, and one port can only serve one enterprise at a time.

[0025] Due to limitations of the operating system, the number of available listening ports for a device is less than 20,000, which also limits the maximum load of a single boarding point.

[0026] Problem 3: Complex configuration and low operation and maintenance efficiency:

[0027] The service backend needs to maintain the correspondence between the boarding point, port, and target device, and write the relationship into the corresponding boarding point iptables rule. When an enterprise user accesses, the boarding point and port need to be allocated. When the enterprise user leaves, the allocated boarding point and port need to be recovered in time.

[0028] Since the load of a single boarding point is limited, in order to improve utilization, only one boarding point plus port is allocated to the same target device. When a single boarding point fails, the iptables rules on the failed node need to be transferred to a new boarding point in batches, and the corresponding users need to be notified to reconnect. However, the global network situation is changeable, and local network nodes are often unavailable due to natural disasters, construction, and hardware failures. Due to the complex configuration, the efficiency of operation and maintenance in responding to emergencies and fault recovery is low. Summary of the invention

[0029] The technical problem to be solved by the present invention is to provide a method and device for accelerating the performance optimization of a network server, thereby solving the performance bottleneck and port resource bottleneck of a boarding point.

[0030] In a first aspect, the present invention provides a method for accelerating performance optimization of a network server, comprising the following steps:

[0031] Step 1: Write the target device address into the TCP extended SACK in the first request data packet sent by the client, wherein the first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address and the destination IP address is the server address;

[0032] Step 2: The server intercepts the first request data packet and obtains the target device address and the client device address from it; modifies the source IP address in the first request data packet to the server address, the destination IP address to the target device address, and the TCP extended SACK to the client device address to form a second request data packet, which is then forwarded and sent to the target device;

[0033] Step 3: After the target device receives the second request data packet, the target device processes the data to generate a first feedback data packet, obtains the client device address from the second request data packet, and writes the client device address into the TCP extended SACK in the first feedback data packet. The source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address.

[0034] Step 4: The server intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

[0035] In a second aspect, the present invention provides a device for accelerating performance optimization of a network server, comprising:

[0036] A data sending module writes the target device address into a TCP extended SACK in a first request data packet sent by the client, wherein the first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address and the destination IP address is the server address;

[0037] The interception and forwarding request data module, the server intercepts the first request data packet and obtains the target device address and the client device address therefrom; the source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extended SACK is modified to the client device address to form a second request data packet, which is then sent to the target device after being transferred;

[0038] A feedback data module, when the target device receives the second request data packet, the target device processes the data to generate a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extended SACK in the first feedback data packet, wherein the source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address;

[0039] Intercept and forward feedback data module, the server intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

[0040] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0041] The present invention no longer relies on the operating system protocol stack, and solves the performance bottleneck and port resource bottleneck of the boarding point. By extending the TCP standard option function and removing the iptables rule configuration, the boarding point service will become stateless, greatly reducing the complexity of the entire system and reducing the operation and maintenance costs.

[0042] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0044] Figure 1 is a flow chart of the method in Embodiment 1 of the present invention;

[0045] Figure 2 It is a schematic diagram of the structure of the device in the second embodiment of the present invention. DETAILED DESCRIPTION

[0046] The embodiments of the present application provide a method and device for accelerating the performance optimization of a network server, which no longer relies on the operating system protocol stack and solves the performance bottleneck and port resource bottleneck of the boarding point.

[0047] The overall idea of ​​the technical solution in the embodiments of this application is as follows:

[0048] By extending the capabilities of TCP protocol standard items, DNAT is supported on the protocol, thereby removing iptables rules and no longer relying on the operating system network protocol stack; the present invention uses the TCP protocol idle standard item TCP extension SACK to send DNAT extension rules.

[0049] The client supports TCP to implement DNAT extension rules through PCAP (Package Capture, a development library for network data packets).

[0050] The boarding point supports TCP to implement DNAT extension rules through eBPF (Extended Berkeley Packer Filter, Linux kernel virtual machine).

[0051] The target device provides application proxy services through Xary-core (application proxy development library) and supports TCP to implement DNAT extension rules.

[0052] Embodiment 1

[0053] like Figure 1 As shown, this embodiment provides a method for accelerating network server performance optimization, comprising the following steps:

[0054] Step 1: Write the target device address into the TCP extended SACK in the first request data packet sent by the client, wherein the first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address and the destination IP address is the server address;

[0055] Step 2: The server intercepts the first request data packet, obtains the target device address and the client device address, and caches the client device address in the first request data packet; modifies the source IP address in the first request data packet to the server address, the destination IP address to the target device address, and the TCP extended SACK to the client device address to form a second request data packet, which is then sent to the target device after being relayed;

[0056] Step 3: After the target device receives the second request data packet, the target device processes the data, generates a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extended SACK in the first feedback data packet. The source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address. The target device reads the client device address from the second request data packet through the Xray-core technology, and then writes the client device address into the TCP extended SACK in the first feedback data packet.

[0057] Step 4: The server intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

[0058] In this embodiment, preferably, the step 1 is specifically: by using a data capture and analysis tool, the target device address is written into the TCP extended SACK in the first request data packet sent by the client, wherein the first request data packet includes a source IP address and a destination IP address, the source IP address is the client device address, and the destination IP address is the server address; the data capture and analysis tool is PCAP.

[0059] In this embodiment, preferably, step 2 is specifically as follows: the server intercepts the first request data packet through eBPF technology, obtains the target device address and the client device address therefrom, and caches the client device address in the first request data packet; modifies the source IP address in the first request data packet to the server address, modifies the destination IP address to the target device address, modifies the TCP extended SACK to the client device address, forms a second request data packet, and then sends it to the target device after transit.

[0060] In this embodiment, preferably, step 4 is specifically as follows: the server intercepts the first feedback data packet through eBPF technology, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

[0061] Based on the same inventive concept, the present application also provides a device corresponding to the method in Example 1, see Example 2 for details.

[0062] Embodiment 2

[0063] like Figure 2 As shown, in this embodiment, a device for accelerating network server performance optimization is provided, including:

[0064] A data sending module writes the target device address into a TCP extended SACK in a first request data packet sent by the client, wherein the first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address and the destination IP address is the server address;

[0065] The interception and forwarding request data module, the server intercepts the first request data packet, obtains the target device address and the client device address therefrom, and caches the client device address in the first request data packet; modifies the source IP address in the first request data packet to the server address, the destination IP address to the target device address, and the TCP extended SACK to the client device address to form a second request data packet, which is then sent to the target device after being transferred;

[0066] Feedback data module, when the target device receives the second request data packet, the target device processes the data, generates a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extended SACK in the first feedback data packet, wherein the source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address; the target device reads the client device address from the second request data packet through the Xray-core technology, and then writes the client device address into the TCP extended SACK in the first feedback data packet;

[0067] Intercept and forward feedback data module, the server intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

[0068] In this embodiment, preferably, the data sending module is specifically: by using a data capture and analysis tool to write the target device address into the TCP extended SACK in the first request data packet sent by the client, the first request data packet includes a source IP address and a destination IP address, the source IP address is the client device address, and the destination IP address is the server address; the data capture and analysis tool is PCAP.

[0069] In this embodiment, preferably, the interception and forwarding request data module is specifically as follows: the server intercepts the first request data packet through the eBPF technology, obtains the target device address and the client device address therefrom, and caches the client device address in the first request data packet; modifies the source IP address in the first request data packet to the server address, modifies the destination IP address to the target device address, modifies the TCP extended SACK to the client device address, forms a second request data packet, and then sends it to the target device after transit.

[0070] In this embodiment, preferably, the interception and forwarding feedback data module is specifically: the server intercepts the first feedback data packet through eBPF technology, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

[0071] Since the device introduced in the second embodiment of the present invention is a device used to implement the method of the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the device based on the method introduced in the first embodiment of the present invention, so it is not described here in detail. All devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0072] The advantages of the above embodiment are: no longer dependent on the operating system protocol stack, solving the performance bottleneck and port resource bottleneck of the boarding point. By extending the TCP standard option function and removing the iptables rule configuration, the boarding point service will become stateless, greatly reducing the complexity of the entire system and reducing the operation and maintenance costs.

[0073]

[0074]

[0075] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for accelerating network server performance optimization, characterized in that: The steps include: Step 1: Write the target device address into the TCP extended SACK in the first request data packet sent by the client, wherein the first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address and the destination IP address is the server address; Step 2: The server intercepts the first request data packet and obtains the target device address and the client device address from it; modifies the source IP address in the first request data packet to the server address, the destination IP address to the target device address, and the TCP extended SACK to the client device address to form a second request data packet, which is then forwarded and sent to the target device; Step 3: After the target device receives the second request data packet, the target device processes the data to generate a first feedback data packet, obtains the client device address from the second request data packet, and writes the client device address into the TCP extended SACK in the first feedback data packet. The source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address. Step 4: The server intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

2. A method for accelerating network server performance optimization according to claim 1, characterized in that: The step 1 specifically includes: writing the target device address into the TCP extended SACK in the first request data packet sent by the client by using a data capture and analysis tool, wherein the first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address, and the destination IP address is the server address; the data capture and analysis tool is PCAP.

3. A method for accelerating network server performance optimization according to claim 1, characterized in that: The specific steps of step 2 are as follows: the server intercepts the first request data packet through the eBPF technology, and obtains the target device address and the client device address therefrom; the source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extended SACK is modified to the client device address to form a second request data packet, which is then sent to the target device after being transferred.

4. The method for accelerating network server performance optimization according to claim 1, characterized in that: Specifically, step 4 is as follows: the server intercepts the first feedback data packet through eBPF technology, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

5. A device for accelerating network server performance optimization, characterized in that: include: A data sending module writes the target device address into a TCP extended SACK in a first request data packet sent by the client, wherein the first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address and the destination IP address is the server address; The interception and forwarding request data module, the server intercepts the first request data packet and obtains the target device address and the client device address therefrom; the source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extended SACK is modified to the client device address to form a second request data packet, which is then sent to the target device after being transferred; A feedback data module, when the target device receives the second request data packet, the target device processes the data to generate a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extended SACK in the first feedback data packet, wherein the source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address; Intercept and forward feedback data module, the server intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

6. The device for accelerating network server performance optimization according to claim 5, characterized in that: The data sending module specifically includes: writing the target device address into the TCP extended SACK in the first request data packet sent by the client by using a data capture and analysis tool, wherein the first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address, and the destination IP address is the server address; the data capture and analysis tool is PCAP.

7. The device for accelerating network server performance optimization according to claim 5, characterized in that: The interception and forwarding request data module is specifically as follows: the server intercepts the first request data packet through the eBPF technology, and obtains the target device address and the client device address therefrom; the source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extended SACK is modified to the client device address to form a second request data packet, which is then sent to the target device after transit.

8. The device for accelerating network server performance optimization according to claim 5, characterized in that: The interception and forwarding feedback data module is specifically as follows: the server intercepts the first feedback data packet through eBPF technology, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extended SACK to form a second feedback data packet, and then sends the second feedback data packet to the client.

Images