Source end information unvarnished transmission method, message processing method, device, equipment and medium

Abstract

The invention provides a source end information transparent transmission method, a message processing method and device, equipment and a medium. The source end information unvarnished transmission method comprises the following steps: analyzing a TCP data message sent by a client to obtain source end information and data main body information of the client; extracting target source end information matched with the source end information transparent transmission parameter from the source end information; setting a client source identifier in a reserved field of a TCP message header of the TCP data message as a target source end identifier corresponding to the source end information unvarnished transmission parameter, and adding target source end information at the ending position of the TCP message header to generate a new target TCP message header; and packaging the target TCP message header and the data main body information into a target TCP data message, sending the target TCP data message to a real server, analyzing the target TCP data message by the real server, extracting target source end information according to a client source identifier in a reserved field of the target TCP message header obtained by analysis, and storing the target source end information.

Description

Technical Field

[0001] The present application relates to the technical field of load balancing, and in particular to a source-end information transparent transmission method, a message processing method, a device, a equipment and a medium. Background Art

[0002] Load balancing technology is a traffic scheduling technology based on LB (Load Balance) devices. In actual production environments, as business traffic grows, a single server cannot bear the business demand. Based on the problem that a single server easily reaches the performance limit, LB technology came into being. LB is essentially a traffic scheduler that uses a load balancing algorithm to evenly distribute the client access traffic to different business servers. Figure 1 As shown in the figure, it is the LB technology networking architecture. When the client wants to access the service server, it first sends the traffic to the LB load balancing device, and then the load balancing device loads the client's traffic to different backend real servers through different load balancing algorithms, achieving high availability of the service and improving the overall performance and scalability of the system. The TCP (Transmission Control Protocol) service traffic interaction process between the client and the real service can be as follows Figure 2 As shown, the client first accesses the external virtual IP (VIP) of the LB to make a three-way handshake request. At this time, the source IP address of the message is the client's source IP, namely CIP, and the destination IP is the virtual IP of the LB, namely VIP. After the reply of the last ack (Acknowledgement) message, the three-way handshake between the client and VIP is successfully established. The client sends a TCP data message. After receiving the TCP data message, the LB selects a real server according to the configured load balancing algorithm and caches the data message. After the real server is selected, a three-way handshake is performed to establish a connection. At this time, the source IP address of the message sent by the LB is the internal network port address of the LB device, that is, Figure 2 The destination address is the real service address RSIP. After the three-way handshake is established, TCP data transmission is performed, and the source IP address is changed to the interface address of LB and resent to LBIP. After receiving the message, the real server replies, changes the source IP to VIP on the LB, and sends it back to the client. Analysis of the entire forwarding process shows that the real server is not clear about the real source information of the client, that is, the real server cannot determine which source IP and source port number the message comes from. This will pose a security threat, and there may be some TCP syn attacks. At the same time, the server side cannot obtain the client's information and cannot analyze the customer's access characteristics. In short, the back-end server cannot obtain the client's real source information for security management, customer log analysis, and security attack prevention.

[0003] The mainstream solution to this problem is that before the LB sends data packets to the actual service, it interacts with the client through a separate protocol, which carries the client's real source IP address. The most typical method is to use the ProxyProtocl protocol to carry the client's real source IP. After the LB establishes a TCP connection with the backend server, before sending the actual application data, it first sends a Proxy Protocol header (including client source IP / port, LBIP / port, etc.). In this way, the backend service can obtain the real client source IP address by parsing the protocol header.

[0004] This method requires LB and real servers to support a new message transmission protocol separately, such as the Proxy protocol mentioned above. However, some existing servers in the enterprise intranet may not be able to support this separate transmission protocol. There are many defects in the interaction of ProxyProtocl protocol alone. For example, the Proxy protocol only supports the carrying of client source information, but there is no strict retransmission and confirmation mechanism to ensure whether this message can be sent to the server. In other words, the separate Proxy protocol is a solution for connectionless and unreliable transmission of source information. The message transmission efficiency of the entire system is reduced, and the separate proxy protocol makes the transmitted messages more complex. The transmission performance of LB is reduced. LB not only needs to process TCP data packets but also needs to process the proxy protocol, which causes additional overhead. Summary of the invention

[0005] The technical problem to be solved by the embodiments of the present application is to provide a source information transparent transmission method, message processing method, device, equipment and medium to achieve transparent transmission of client source information in the LB technology scenario and solve the problem that the back-end real server cannot perceive the real client source information.

[0006] In a first aspect, an embodiment of the present application provides a source-side information transparent transmission method, which is applied to a load balancing device, and the method includes:

[0007] Parse the TCP datagram sent by the client to obtain the source information and data body information of the client;

[0008] Extracting target source information matching the preset source information transparent transmission parameters from the source information;

[0009] The client source identifier in the reserved field of the TCP header of the TCP data message is set to the target source identifier corresponding to the source information transparent transmission parameter, and the target source information is added at the end of the TCP header to generate a new target TCP header;

[0010] The target TCP message header and the data body information are encapsulated into a target TCP data message, and the target TCP data message is sent to the corresponding real server, so that the real server parses the target TCP data message, and extracts the target source end information according to the client source identifier in the reserved field of the target TCP message header obtained by parsing, so as to store the target source end information.

[0011] In a second aspect, an embodiment of the present application provides a message processing method, which is applied to a real server, and the method includes:

[0012] Parsing the target TCP data message sent by the load balancing device to obtain the target TCP message header of the target TCP data message;

[0013] Obtaining a target source end identifier of a client indicated by a client source identifier in a reserved field of the target TCP message header;

[0014] The target source end information corresponding to the target source end identifier is extracted from the end position of the target TCP message header, and the target source end information is stored.

[0015] In a third aspect, an embodiment of the present application provides a source-side information transparent transmission device, which is applied to a load balancing device, and the device includes:

[0016] The data packet parsing module is used to parse the TCP data packet sent by the client to obtain the source information and data body information of the client;

[0017] A target source end information extraction module is used to extract target source end information matching the preset source end information transparent transmission parameters from the source end information;

[0018] A target message header generation module, used to set the client source identifier in the reserved field of the TCP message header of the TCP data message to the target source identifier corresponding to the source information transparent transmission parameter, and add the target source information at the end position of the TCP message header to generate a new target TCP message header;

[0019] The target data message sending module is used to encapsulate the target TCP message header and the data body information into a target TCP data message, and send the target TCP data message to the corresponding real server, so that the real server can parse the target TCP data message, and extract the target source end information according to the client source identifier in the reserved field of the target TCP message header obtained by parsing, so as to store the target source end information.

[0020] In a fourth aspect, an embodiment of the present application provides a message processing device, which is applied to a real server, and the device includes:

[0021] A TCP message parsing module, used for parsing a target TCP data message sent by a load balancing device to obtain a target TCP message header of the target TCP data message;

[0022] A target identifier acquisition module, used to acquire a target source end identifier of a client indicated by a client source identifier in a reserved field of the target TCP message header;

[0023] The target source end information acquisition module is used to extract the target source end information corresponding to the target source end identifier from the end position of the target TCP message header, and store the target source end information.

[0024] In a fifth aspect, an embodiment of the present application provides an electronic device, including:

[0025] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the source end information transparent transmission method or the message processing method described above is implemented.

[0026] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the above-mentioned source information transparent transmission methods or the above-mentioned message processing methods.

[0027] Compared with the prior art, the embodiments of the present application have the following advantages:

[0028] In an embodiment of the present application, the source information and data body information of the client are obtained by parsing the TCP data message sent by the client. The target source information that matches the preset source information transparent transmission parameters is extracted from the source information. The client source identifier in the reserved field of the TCP message header of the TCP data message is set to the target source identifier corresponding to the source information transparent transmission parameters, and the target source information is added at the end position of the TCP message header to generate a new target TCP message header. The target TCP message header and the data body information are encapsulated into a target TCP data message, and the target TCP data message is sent to the corresponding real server, so that the real server parses the target TCP data message, and extracts the target source information according to the client source identifier in the reserved field of the target TCP message header obtained by parsing, so as to store the target source information. The embodiment of the present application defines the client source identifier by modifying and applying the reserved fields in the TCP header and adding the option field. The source information of the client (source IP address and / or source port number) is carried in the modified TCP message header, thereby realizing the transparent transmission of the source information of the client in the LB technology scenario and solving the problem that the back-end real server cannot perceive the real client source information. Compared with the existing solutions, it can solve the problem of the actual server perceiving the client source information without introducing a new transmission protocol, simplifying the interaction complexity of the protocol message and not adding additional overhead. At the same time, the reliability and retransmission mechanism of the TCP protocol itself are utilized to ensure the high availability of the transparent transmission of the client source information.

[0029] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of an LB network provided in an embodiment of the present application;

[0031] Figure 2 A schematic diagram of a message interaction process between a client, LB and real server provided in an embodiment of the present application;

[0032] Figure 3 A flowchart of a method for transparently transmitting source information provided by an embodiment of the present application;

[0033] Figure 4 A schematic diagram of a processing flow of a client source-tagged LB protocol stack sending a TCP data message provided in an embodiment of the present application;

[0034] Figure 5 A schematic diagram of a TCP message interaction process for client source transparent transmission provided in an embodiment of the present application;

[0035] Figure 6A flowchart of a message processing method provided in an embodiment of the present application;

[0036] Figure 7 A schematic diagram of a processing flow of a real server protocol stack receiving a TCP data message provided in an embodiment of the present application;

[0037] Figure 8 A schematic diagram of the structure of a source-side information transparent transmission device provided in an embodiment of the present application;

[0038] Fig. 9 A schematic diagram of the structure of a message processing device provided in an embodiment of the present application;

[0039] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0041] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0042] Reference Figure 3 , shows a flow chart of the steps of a source end information transparent transmission method provided by an embodiment of the present application, and the source end information transparent transmission method can be applied to a load balancing device. Figure 3 As shown, the source-end information transparent transmission method may include: step 301, step 302, step 303 and step 304.

[0043] Step 301: parse the TCP data message sent by the client to obtain the source information and data body information of the client.

[0044] The embodiments of the present application can be applied to a load balancing device, that is, the execution subject is a load balancing device. A load balancing device, also known as a load balancer, is a core component of a load balancing service. It is responsible for receiving requests from clients and reasonably allocating these requests to multiple backend servers according to preset rules and algorithms.

[0045] A TCP (Transmission Control Protocol) datagram is a data unit transmitted by the TCP layer, also called a segment. A TCP datagram consists of a header (i.e., a TCP header) and a data portion, of which the header is required and the data portion is optional.

[0046] In a load balancing scenario, the TCP datagram sent by the client can be obtained and parsed to obtain the client's source information and data subject information. The source information may include: source port number, destination port number, source IP (Internet Protocol) address, destination IP address and other information.

[0047] The data part of the TCP message (i.e., the data body information in this embodiment) is located after the TCP message header until the total length of the message (specified by the total length field in the IP header). In a specific implementation, the starting position of the data part can be determined according to the length field (header length) of the TCP header. The content of the data part is read, which can be any form of data, depending on the protocol of the application layer.

[0048] The fields in the TCP message header may be shown in Table 1 below;

[0049] Table 1: Structure of the original TCP header

[0050]

[0051]

[0052] In the above Table 1, Source Port identifies the port number of the application or service at the sending end.

[0053] Destination Port identifies the port number of the application or service on the receiving end.

[0054] Sequence Number is used to number each byte in the TCP data stream to ensure orderly transmission of data.

[0055] The Acknowledge Number indicates the sequence number of the next data segment that the receiver expects to receive, and is used to confirm that the data has been received.

[0056] Data Offset indicates the length of the TCP header in units of 4 bytes.

[0057] Reserved: A reserved field in the TCP header that is usually unused for possible future expansion.

[0058] URG (urgent flag): When URG = 1, it indicates that the urgent pointer is valid. The urgent pointer field is used to identify the end position of the urgent data.

[0059] ACK (acknowledgement flag): When ACK = 1, it indicates that the sequence number is confirmed to be valid. The ACK message is used to inform the sender that the data has been successfully received.

[0060] PSH (Push Flag): When PSH=1, the receiving end should immediately request to deliver the data to the application after receiving the data, instead of buffering it until the buffer is full.

[0061] RST (Reset Connection Flag): When RST = 1, it means that the TCP connection needs to be reset. This usually happens when a serious error occurs in the connection.

[0062] SYN (Synchronous Sequence Number Flag): During the TCP connection establishment process, SYN=1 indicates that a new connection is initiated. The SYN message is used by both parties to exchange initial sequence numbers.

[0063] FIN (end connection flag): When FIN = 1, it means releasing a connection. The FIN message is used to end the TCP connection.

[0064] Window Size indicates the size of the buffer at the receiving end and is used for flow control. The sending end can adjust the rate at which data is sent based on this field.

[0065] Checksum: Used to detect errors or damage in the transmission of TCP segments. It is a 16-bit field that is calculated by checking the TCP header and data.

[0066] The Urgent Pointer is valid only when the URG flag is set and is used to mark the end position of the urgent data.

[0067] In the original TCP message header shown in Table 1, the first 4 bytes are the source port and destination port, the 5th to 8th bytes are the sequence number field used to identify the data size statistics sent from the sender to the receiver, the 9th to 12th bytes are the confirmation sequence number used to identify how many bytes of data the receiver has received, the 13th to 16th bytes include the message length used to identify the length of the TCP header, a 6-bit reserved field, 6 common flag bits, a 16-bit window size field, and the 17th to 20th bytes are the checksum and urgent pointer.

[0068] After parsing the TCP data message sent by the client to obtain the client's source information and data body information, step 302 is executed.

[0069] Step 302: extracting target source information matching the preset source information transparent transmission parameters from the source information.

[0070] The source information transparent transmission parameter refers to the parameter pre-set by the load balancing device for transparently transmitting the source information to the backend server. In this example, the source information transparent transmission parameter may include: any one of: IP address transparent transmission parameter, port transparent transmission parameter, and IP and port transparent transmission parameter.

[0071] After obtaining the client's source information, the target source information that matches the preset source information transparent transmission parameters can be extracted from the source information. Specifically, it can be divided into the following three situations:

[0072] 1. When the source information transparent transmission parameter is an IP address transparent transmission parameter, the source IP address of the client is extracted from the source information as the target source information.

[0073] 2. When the source information transparent transmission parameter is a port transparent transmission parameter, the source port number of the client is extracted from the source information as the target source information.

[0074] 3. When the source information transparent transmission parameters are IP and port transparent transmission parameters, the source IP address and source port number of the client are extracted from the source information as the target source information.

[0075] After extracting the target source-end information matching the preset source-end information transparent transmission parameters from the source-end information, step 303 is executed.

[0076] Step 303: Set the client source identifier in the reserved field of the TCP header of the TCP data message to the target source identifier corresponding to the source information transparent transmission parameter, and add the target source information at the end position of the TCP header to generate a new target TCP header.

[0077] After extracting the target source information matching the preset source information transparent transmission parameters from the source information, the client source identifier in the reserved field of the TCP header of the TCP data message can be set to the target source identifier corresponding to the source information transparent transmission parameters.

[0078] In the embodiment of the present application, a client source identifier CFS (Client Source Flag) (i.e., CSF field) is set in a reserved field of the TCP header. The improved TCP header may be as shown in Table 2 below:

[0079] Table 2: Improved TCP header structure

[0080]

[0081] As shown in Table 2 above, in order to realize the customized source information of the client identification during TCP transmission, the first two of the 6-bit reserved fields from bytes 13 to 16 are defined as CSF fields (i.e., the client source identification in this embodiment). The role of CSF is that when the administrator needs to have differentiated transparent transmission requirements for the client's source IP address, source port, source IP address + source port, the administrator's differentiated customized requirements can be passed to the device protocol stack through the CSF identifier.

[0082] The method of setting the client source identifier to the target source identifier corresponding to the source information transparent transmission parameter may include any of the following three methods:

[0083] 1. When the source information transparent transmission parameter is the IP address transparent transmission parameter, the client source identifier in the reserved field of the TCP message header is set to the source IP address identifier.

[0084] 2. When the source information transparent transmission parameter is the port transparent transmission parameter, the client source identifier in the reserved field of the TCP message header is set to the source port identifier.

[0085] 3. When the source information transparent transmission parameters are IP and port transparent transmission parameters, the client source identifier in the reserved field of the TCP message header is set to the source IP and source port identifier.

[0086] In this embodiment, CSF field values ​​corresponding to different transparent transmission parameters may be preset, as shown in Table 3 below:

[0087] Table 3: CSF field values

[0088]

[0089] As shown in Table 3 above, when the administrator needs to transparently transmit the client source IP address, the CSF value is 01. When the administrator needs to transparently transmit the client source port number, the CSF value is 10. When the administrator needs to transparently transmit both the client source IP address and the source port number, the CSF value is 11.

[0090] After setting the client source identifier in the reserved field of the TCP header of the TCP data message to the target source identifier corresponding to the source information transparent transmission parameter, the target source information can be added at the end of the TCP header to generate a new target TCP header. The corresponding method of adding the target source information at the end of the TCP header to generate the target TCP header can include any of the following:

[0091] 1. When the target source information is the source IP address of the client, add a 4-byte option field at the end of the TCP message header, and add the source IP address to the option field to obtain the target TCP message header.

[0092] 2. When the target source information is the source port number of the client, add a 2-byte option field at the end of the TCP message header, and add the source port number to the option field to obtain the target TCP message header.

[0093] 3. When the target source information is the source port number and source IP address of the client, add a 6-byte option field at the end of the TCP message header, and add the source IP address and source port number to the option field to obtain the target TCP message header.

[0094] In this embodiment, differentiated TCP header encapsulation is performed for different CSF values. Different TCP header options are encapsulated through different CSF code tables, that is, different CSF values ​​correspond to different TCP header lengths, which is more flexible and improves network transmission efficiency.

[0095] When the source IP address of the client needs to be monitored, CSF is assigned a value of 01, and a 4-byte option is added to the TCP header to carry the client source IP address information resolved by the LB. The TCP header encapsulated on the LB on the TCP header is shown in Table 4 below:

[0096] Table 4: TCP header structure when CSF value is 01

[0097]

[0098] As shown in Table 4 above, the CSF value in the TCP message header is assigned to 01, and a 4-byte option is added at the end of the message header to add the Client Source Address (client source IP address).

[0099] When the source port number of the client needs to be monitored, CSF is assigned a value of 10, and a 2-byte option is added to the TCP header to carry the client source port number information parsed by the LB. The TCP message header encapsulated on the LB is shown in Table 5 below:

[0100] Table 5: TCP header structure when CSF value is 10

[0101]

[0102] As shown in Table 5 above, the CSF value in the TCP message header is assigned to 10, and a 2-byte option is added at the end of the message header to add the Client Source Port (client source port number).

[0103] When the source IP address and source port number of the client need to be monitored, CSF is assigned a value of 11, and a 6-byte option is added to the TCP header. The first 4 bytes are used to carry the client source IP address information resolved by the LB, and the last 2 bytes are used to carry the client source port number information resolved by the LB. The TCP header encapsulated on the LB is shown in Table 6 below:

[0104] Table 6: TCP header structure when CSF value is 11

[0105]

[0106] As shown in Table 6 above, the CSF value in the TCP message header is assigned to 11, and a 6-byte option is added at the end of the message header. The first 4 bytes are used to add the Client Source Address (client source IP address), and the last 2 bytes are used to add the Client Source Port (client source port number).

[0107] In the embodiment of the present application, in addition to modifying the CSF field value in the TCP message header and adding the target source information, the IP address and port number in the TCP message header also need to be modified. The implementation process can be described in detail in conjunction with the following specific implementation method.

[0108] In a specific implementation of the present application, the above step 303 may include:

[0109] Sub-step S1: Add the target source information at the end of the TCP message header to generate an initial TCP message header.

[0110] In this embodiment, after the client source identifier in the reserved field of the TCP header of the TCP data message is set to the target source identifier corresponding to the source information transparent transmission parameter, the target source information can be added at the end of the TCP header to generate an initial TCP header. The adding process can refer to the description of the above content, and this embodiment will not be repeated here.

[0111] Sub-step S2: Modify the source IP address and source port number in the TCP message header to the IP address and port number of the load balancing device, and modify the destination IP address and destination port number of the TCP message header to the IP address and port number of the real server to generate the target TCP message header.

[0112] Then, the source IP address and source port number in the initial TCP message header can be modified to the IP address and port number of the load balancing device, and the destination IP address and destination port number in the initial TCP message header can be modified to the IP address and port number of the real server to generate a target TCP message header.

[0113] Step 304: Encapsulate the target TCP message header and the data body information into a target TCP data message, and send the target TCP data message to the corresponding real server, so that the real server parses the target TCP data message, and extracts the target source end information according to the client source identifier in the reserved field of the target TCP message header obtained by parsing, so as to store the target source end information.

[0114] A real server (RS) can be a server that is selected from multiple backend servers by a load balancing device using a preset load balancing algorithm to process the client's TCP datagram. In a specific implementation, a load balancing device can use various load balancing algorithms to decide how to distribute requests to backend servers. These algorithms may include polling, weighted polling, minimum number of connections, response time, etc. The backend server is the device that actually processes the client request. The load balancing device selects one or more servers from the server pool to process the request based on the load balancing algorithm.

[0115] After obtaining the target TCP message header, the target TCP message header and the data body can be encapsulated into a target TCP data message, and the target TCP data message can be sent to the corresponding real server, so that the real server can parse the target TCP data message and extract the target source end information according to the client source identifier in the reserved field of the parsed target TCP message header to store the target source end information.

[0116] The embodiment of the present application defines the client source identifier by modifying and applying the reserved fields in the TCP header and adding the option field. The source information of the client (source IP address and / or source port number) is carried in the modified TCP message header, thereby realizing the transparent transmission of the source information of the client in the LB technology scenario and solving the problem that the back-end real server cannot perceive the real client source information. Compared with the existing solutions, it can solve the problem of the actual server perceiving the client source information without introducing a new transmission protocol, simplifying the interaction complexity of the protocol message and not adding additional overhead. At the same time, the reliability and retransmission mechanism of the TCP protocol itself are utilized to ensure the high availability of the transparent transmission of the client source information.

[0117] The process of processing TCP packets by the LB device supporting source information transparent transmission technology can be shown in Figure 4.

[0118] like Figure 4 As shown, after the LB (load balancing device) receives the TCP datagram from the client, it checks whether the LB has enabled the client source transparent transmission function. If not, it will forward it to the real server through the normal processing flow. If yes, it will determine whether the LB is configured with the client source IP address marking function.

[0119] If the LB is configured with the client source IP address marking function, the CSF field value in the improved TCP header is marked as 01, and a 4-byte option field is added to the TCP header to fill in the source IP address of the client message before forwarding it to the real server.

[0120] If the LB is not configured with the client source IP address marking function, continue to determine whether the LB is configured with the client source port marking function.

[0121] If the LB is configured with the client source port marking function, the CSF field value in the improved TCP header is marked as 10, and a 2-byte option field is added to the TCP header to fill in the source port number of the client message before forwarding it to the real server.

[0122] If the LB is not configured with the client source port marking function, continue to determine whether the LB is configured with the client source IP address and source port number marking function.

[0123] If the LB is configured with the function of marking the client source IP address and source port number at the same time, the CSF field value in the improved TCP header is marked as 11, and a 6-byte option field is added to the TCP header. The first 4 bytes are used to fill in the source IP address of the client message, and the last 2 bytes are used to fill in the source port number of the client message, and then forwarded to the real server.

[0124] If the LB is not configured with the function of marking the client source IP address and source port number at the same time, the packet is forwarded to the real server using the normal processing flow.

[0125] The embodiment of the present application utilizes the reserved field of the TCP header, defines the CSF (Client Source Flag) field, and defines the CSF code table (i.e., Table 3 above). The CSF code table can meet the customer's need for customized source information. The customer can only identify the customer's source IP or source port number or source IP + source port number according to their own needs. The assignment of the CSF code table is realized through the customer's configuration on the LB. This solves the problem that the prior art cannot realize differentiated client source information transparent transmission.

[0126] The message interaction process for LB technology that supports source information transparent transmission can be as follows Figure 5As shown. The client accesses the VIP (Virtual Internet Protocol Address) (i.e., the virtual IP address provided to the outside in the LB service) of the LB through the CIP (Client IP) to perform a TCP three-way handshake. After the three-way handshake is successful, the client transmits a TCP data message to the LB. After receiving the TCP data message, the LB parses the message, records the source IP, source port number and other information of the source message, and at the same time checks the route query load balancing algorithm to determine the destination real server address to be forwarded, and caches the message.

[0127] LB performs a TCP three-way handshake through the intranet port address LBIP and the destination real service address RSIP. After the handshake is successful, the previously cached data message is sent, the source IP is modified to its own LBIP, the destination IP is the selected real server RSIP, and the CSF field is assigned a value according to the network administrator's configuration of source information transparent transmission. At the same time, the source IP address and source port number corresponding to the original client are extracted and filled into the end of the TCP header in the form of option options, and sent to the real server. After receiving it, the real server identifies the CSF field and extracts the corresponding source information (i.e. source IP, source port, source IP + source port) and records it locally. At this point, the real server can complete the perception and statistics of the client source information, so that these client source information can be used for corresponding security functions such as security control and log statistics.

[0128] The source information transparent transmission method provided in the embodiment of the present application obtains the source information and data body information of the client by parsing the TCP data message sent by the client. The target source information that matches the preset source information transparent transmission parameters is extracted from the source information. The client source identifier in the reserved field of the TCP message header of the TCP data message is set to the target source identifier corresponding to the source information transparent transmission parameters, and the target source information is added at the end position of the TCP message header to generate a new target TCP message header. The target TCP message header and the data body information are encapsulated into a target TCP data message, and the target TCP data message is sent to the corresponding real server, so that the real server parses the target TCP data message, and extracts the target source information according to the client source identifier in the reserved field of the target TCP message header obtained by parsing, so as to store the target source information. The embodiment of the present application defines the client source identifier by modifying and applying the reserved fields in the TCP header and adding the option field. The source information of the client (source IP address and / or source port number) is carried in the modified TCP message header, thereby realizing the transparent transmission of the source information of the client in the LB technology scenario and solving the problem that the back-end real server cannot perceive the real client source information. Compared with the existing solutions, it can solve the problem of the actual server perceiving the client source information without introducing a new transmission protocol, simplifying the interaction complexity of the protocol message and not adding additional overhead. At the same time, the reliability and retransmission mechanism of the TCP protocol itself are utilized to ensure the high availability of the transparent transmission of the client source information.

[0129] Reference Figure 6 , shows a flow chart of the steps of a message processing method provided by an embodiment of the present application, and the message processing method can be applied to a real server. Figure 6 As shown, the message information processing method may include: step 601, step 602 and step 603.

[0130] Step 601: Parse the target TCP data message sent by the load balancing device to obtain the target TCP message header of the target TCP data message.

[0131] The embodiments of the present application can be applied to a real server, that is, the execution subject is a real server.

[0132] After the real server receives the target TCP data message sent by the load balancing device, it can parse the target TCP data message to obtain the target TCP message header of the target TCP data packet message.

[0133] After parsing the target TCP data message sent by the load balancing device to obtain the target TCP message header of the target TCP data message, step 602 is executed.

[0134] Step 602: Obtain the target source end identifier of the client indicated by the client source identifier in the reserved field of the target TCP message header.

[0135] After parsing the target TCP data message sent by the load balancing device to obtain the target TCP message header of the target TCP data message, the target source end identifier of the client indicated by the client source identifier in the reserved field of the target TCP message header can be obtained.

[0136] After obtaining the target source end identifier of the client indicated by the client source identifier in the reserved field of the target TCP packet header, step 603 is executed.

[0137] Step 603: extract the target source information corresponding to the target source identifier from the end position of the target TCP message header, and store the target source information.

[0138] After obtaining the target source identifier of the client indicated by the client source identifier in the reserved field of the target TCP message header, the target source information corresponding to the target source identifier can be extracted from the end position of the target TCP message header and stored.

[0139] The embodiments of the present application can be applied to source-end monitoring scenarios. For example, taking a bank as an example, it only allows access from certain clients. Then, through the transparent transmission of source-end information from the client, the bank server can block access from some non-authenticated clients, thereby improving the security of server resources.

[0140] The embodiment of the present application defines the client source identifier by modifying and applying the reserved fields in the TCP header and adding the option field. The source information of the client (source IP address and / or source port number) is carried in the modified TCP message header, thereby realizing the transparent transmission of the source information of the client in the LB technology scenario and solving the problem that the back-end real server cannot perceive the real client source information. Compared with the existing solutions, it can solve the problem of the actual server perceiving the client source information without introducing a new transmission protocol, simplifying the interaction complexity of the protocol message and not adding additional overhead. At the same time, the reliability and retransmission mechanism of the TCP protocol itself are utilized to ensure the high availability of the transparent transmission of the client source information.

[0141] Next, combine Figure 7 The process of processing TCP messages by a real server supporting source information transparent transmission technology is described in detail.

[0142] like Figure 7 As shown, the real server receives the TCP data packet from the LB and checks whether the CSF field in the TCP header is empty.

[0143] If the CSF field is empty, the normal processing flow is followed and forwarded to the corresponding business module for processing.

[0144] If the CSF field is not empty, continue to determine whether the CSF value is 01.

[0145] If the CSF value is 01, the value in the option field of the TCP header of the message is extracted, and the value is recorded as the client source IP address and then forwarded to the corresponding service module for processing.

[0146] If the CSF value is not 01, continue to determine whether the CSF value is 10.

[0147] If the CSF value is 10, extract the value in the option field of the TCP header of the message, record the value as the client source port address, and forward it to the corresponding service module for processing.

[0148] If the CSF value is not 10, continue to determine whether the CSF value is 11.

[0149] If the CSF value is 11, the value in the option field of the TCP header of the message is extracted, where the first 4 bytes record the value as the client source IP address, and the last 2 bytes are the client source port address, which is then forwarded to the corresponding service module for processing.

[0150] If the CSF value is not 11, it is directly forwarded to the corresponding service module for processing.

[0151] The message processing method provided in the embodiment of the present application obtains the target TCP message header of the target TCP data message by parsing the target TCP data message sent by the load balancing device. The target source end identifier of the client indicated by the client source identifier in the reserved field of the target TCP message header is obtained. The target source end information corresponding to the target source end identifier is extracted from the end position of the target TCP message header, and the target source end information is stored. The embodiment of the present application defines the client source identifier by modifying and applying the reserved field in the TCP header, and adding the option field. The source end information (source IP address and / or source port number) of the client is carried by the modified TCP message header, so as to realize the transparent transmission of the source end information of the client in the LB technology scenario, and solve the problem that the back-end real server cannot perceive the real client source information. Compared with the existing solution, it can solve the problem of the actual server perceiving the client source information without introducing a new transmission protocol, simplifying the interaction complexity of the protocol message, and not adding additional overhead. At the same time, the reliability and retransmission mechanism of the TCP protocol itself are utilized to ensure the high availability of the transparent transmission of the client source information.

[0152] Reference Figure 8, shows a schematic diagram of the structure of a source-side information transparent transmission device provided in an embodiment of the present application, and the source-side information transparent transmission device can be applied to a load balancing device. Figure 8 As shown, the source end information transparent transmission device 800 may include the following modules:

[0153] The data packet parsing module 810 is used to parse the TCP data packet sent by the client to obtain the source information and data body information of the client;

[0154] The target source information extraction module 820 is used to extract the target source information matching the preset source information transparent transmission parameters from the source information;

[0155] The target message header generation module 830 is used to set the client source identifier in the reserved field of the TCP message header of the TCP data message to the target source identifier corresponding to the source information transparent transmission parameter, and add the target source information at the end position of the TCP message header to generate a new target TCP message header;

[0156] The target data message sending module 840 is used to encapsulate the target TCP message header and the data body information into a target TCP data message, and send the target TCP data message to the corresponding real server, so that the real server can parse the target TCP data message and extract the target source end information according to the client source identifier in the reserved field of the target TCP message header obtained by parsing, so as to store the target source end information.

[0157] Optionally, the target source end information extraction module includes:

[0158] A first source end information acquisition unit is used to extract the source IP address of the client from the source end information as the target source end information when the source end information transparent transmission parameter is an IP address transparent transmission parameter;

[0159] A second source end information acquisition unit is used to extract the source port number of the client from the source end information as the target source end information when the source end information transparent transmission parameter is a port transparent transmission parameter;

[0160] The third source end information acquisition unit is used to extract the source IP address and source port number of the client from the source end information as the target source end information when the source end information transparent transmission parameters are IP and port transparent transmission parameters.

[0161] Optionally, the target message header generation module includes:

[0162] A first identifier setting unit, configured to set the client source identifier in the reserved field of the TCP message header to a source IP address identifier when the source end information transparent transmission parameter is an IP address transparent transmission parameter;

[0163] A second identifier setting unit is used to set the client source identifier in the reserved field of the TCP message header as a source port identifier when the source end information transparent transmission parameter is a port transparent transmission parameter;

[0164] The third identifier setting unit is used to set the client source identifier in the reserved field of the TCP message header to the source IP and source port identifier when the source end information transparent transmission parameters are IP and port transparent transmission parameters.

[0165] Optionally, the target message header generation module includes:

[0166] A first message header generating unit, configured to, when the target source end information is the source IP address of the client, add a 4-byte option field at the end of the TCP message header, and add the source IP address to the option field to obtain the target TCP message header;

[0167] A second message header generating unit is used to add a 2-byte option field at the end of the TCP message header when the target source end information is the source port number of the client, and add the source port number to the option field to obtain the target TCP message header;

[0168] The third message header generation unit is used to add a 6-byte option field at the end of the TCP message header when the target source end information is the source port number and source IP address of the client, and add the source IP address and the source port number to the option field to obtain the target TCP message header.

[0169] Optionally, the target message header generation module includes:

[0170] A source end new adding unit, used for adding the target source end information at the end position of the TCP message header to generate an initial TCP message header;

[0171] The fourth message header generation unit is used to modify the source IP address and source port number in the initial TCP message header to the IP address and port number of the load balancing device, and modify the destination IP address and destination port number of the initial TCP message header to the IP address and port number of the real server, and generate the target TCP message header.

[0172] The source information transparent transmission device provided in the embodiment of the present application obtains the source information and data body information of the client by parsing the TCP data message sent by the client. The target source information matching the preset source information transparent transmission parameters is extracted from the source information. The client source identifier in the reserved field of the TCP message header of the TCP data message is set to the target source identifier corresponding to the source information transparent transmission parameters, and the target source information is added at the end position of the TCP message header to generate a new target TCP message header. The target TCP message header and the data body information are encapsulated into a target TCP data message, and the target TCP data message is sent to the corresponding real server, so that the real server parses the target TCP data message, and extracts the target source information according to the client source identifier in the reserved field of the target TCP message header obtained by parsing, so as to store the target source information. The embodiment of the present application defines the client source identifier by modifying and applying the reserved fields in the TCP header and adding the option field. The source information of the client (source IP address and / or source port number) is carried in the modified TCP message header, thereby realizing the transparent transmission of the source information of the client in the LB technology scenario and solving the problem that the back-end real server cannot perceive the real client source information. Compared with the existing solutions, it can solve the problem of the actual server perceiving the client source information without introducing a new transmission protocol, simplifying the interaction complexity of the protocol message and not adding additional overhead. At the same time, the reliability and retransmission mechanism of the TCP protocol itself are utilized to ensure the high availability of the transparent transmission of the client source information.

[0173] Reference Fig. 9 , shows a schematic diagram of the structure of a message processing device provided in an embodiment of the present application, and the message processing device can be applied to a real server. Fig. 9 As shown, the message processing device 900 may include the following modules:

[0174] The TCP message parsing module 910 is used to parse the target TCP data message sent by the load balancing device to obtain the target TCP message header of the target TCP data message;

[0175] A target identifier acquisition module 920 is used to acquire a target source end identifier of the client indicated by the client source identifier in the reserved field of the target TCP message header;

[0176] The target source end information acquisition module 930 is used to extract the target source end information corresponding to the target source end identifier from the end position of the target TCP message header, and store the target source end information.

[0177] The message processing device provided in the embodiment of the present application obtains the target TCP message header of the target TCP data message by parsing the target TCP data message sent by the load balancing device. The target source end identifier of the client indicated by the client source identifier in the reserved field of the target TCP message header is obtained. The target source end information corresponding to the target source end identifier is extracted from the end position of the target TCP message header, and the target source end information is stored. The embodiment of the present application defines the client source identifier by modifying and applying the reserved field in the TCP header, and adding the option field. The source end information (source IP address and / or source port number) of the client is carried by the modified TCP message header, so as to realize the transparent transmission of the source end information of the client in the LB technology scenario, and solve the problem that the back-end real server cannot perceive the real client source information. Compared with the existing solution, it can solve the problem of the actual server perceiving the client source information without introducing a new transmission protocol, simplifying the interaction complexity of the protocol message, and not adding additional overhead. At the same time, the reliability and retransmission mechanism of the TCP protocol itself are utilized to ensure the high availability of the transparent transmission of the client source information.

[0178] An embodiment of the present application also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the above-mentioned source end information transparent transmission method or the above-mentioned message processing method when executed by the processor.

[0179] Fig.10 FIG. 1 is a schematic diagram showing the structure of an electronic device 1000 according to an embodiment of the present invention. Fig.10 As shown, the electronic device 1000 includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 1002 or computer program instructions loaded from a storage unit 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the electronic device 1000 can also be stored. The CPU 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0180] Multiple components in the electronic device 1000 are connected to the I / O interface 1005, including: an input unit 1006, such as a keyboard, a mouse, a microphone, etc.; an output unit 1007, such as various types of displays, speakers, etc.; a storage unit 1008, such as a disk, an optical disk, etc.; and a communication unit 1009, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 1009 allows the electronic device 1000 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0181] The various processes and processing described above may be performed by the processing unit 1001. For example, the method of any of the above embodiments may be implemented as a computer software program, which is tangibly contained in a computer-readable medium, such as the storage unit 1008. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 1000 via the ROM 1002 and / or the communication unit 1009. When the computer program is loaded into the RAM 1003 and executed by the CPU 1001, one or more actions in the method described above may be performed.

[0182] In addition, an embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned source end information transparent transmission method or the above-mentioned message processing method is implemented.

[0183] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0184] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or terminal including the elements.

[0185] The above is a detailed introduction to a source-end information transparent transmission method, message processing method, device, equipment and medium provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A source end information transparent transmission method, applied to a load balancing device, characterized in that: The method comprises: Parse the TCP datagram sent by the client to obtain the source information and data body information of the client; Extracting target source information matching the preset source information transparent transmission parameters from the source information; The client source identifier in the reserved field of the TCP header of the TCP data message is set to the target source identifier corresponding to the source information transparent transmission parameter, and the target source information is added at the end of the TCP header to generate a new target TCP header; The target TCP message header and the data body information are encapsulated into a target TCP data message, and the target TCP data message is sent to the corresponding real server, so that the real server parses the target TCP data message, and extracts the target source end information according to the client source identifier in the reserved field of the target TCP message header obtained by parsing, so as to store the target source end information.

2. The method according to claim 1, characterized in that The extracting target source information matching the preset source information transparent transmission parameter from the source information includes: In the case where the source end information transparent transmission parameter is an IP address transparent transmission parameter, extracting the source IP address of the client from the source end information as the target source end information; In the case where the source end information transparent transmission parameter is a port transparent transmission parameter, extracting the source port number of the client from the source end information as the target source end information; In the case where the source end information transparent transmission parameters are IP and port transparent transmission parameters, the source IP address and source port number of the client are extracted from the source end information to serve as the target source end information.

3. The method according to claim 1, characterized in that The step of setting the client source identifier in the reserved field of the TCP header of the TCP data message to the target source identifier corresponding to the source information transparent transmission parameter includes: When the source information transparent transmission parameter is an IP address transparent transmission parameter, setting the client source identifier in the reserved field of the TCP message header to the source IP address identifier; When the source information transparent transmission parameter is a port transparent transmission parameter, setting the client source identifier in the reserved field of the TCP message header to a source port identifier; When the source information transparent transmission parameters are IP and port transparent transmission parameters, the client source identifier in the reserved field of the TCP message header is set to the source IP and source port identifier.

4. The method according to claim 1, characterized in that: The step of adding the target source end information at the end of the TCP message header to generate a new target TCP message header includes: In the case where the target source information is the source IP address of the client, a 4-byte option field is added at the end of the TCP message header, and the source IP address is added to the option field to obtain the target TCP message header; In the case where the target source information is the source port number of the client, a 2-byte option field is added at the end of the TCP message header, and the source port number is added to the option field to obtain the target TCP message header; When the target source information is the source port number and source IP address of the client, a 6-byte option field is added to the end of the TCP message header, and the source IP address and the source port number are added to the option field to obtain the target TCP message header.

5. The method according to claim 1, characterized in that: The step of adding the target source end information at the end of the TCP message header to generate a new target TCP message header includes: Add the target source end information at the end position of the TCP message header to generate an initial TCP message header; The source IP address and source port number in the initial TCP message header are modified to the IP address and port number of the load balancing device, and the destination IP address and destination port number of the initial TCP message header are modified to the IP address and port number of the real server to generate the target TCP message header.

6. A message processing method, applied to a real server, characterized in that: The method comprises: Parsing the target TCP data message sent by the load balancing device to obtain the target TCP message header of the target TCP data message; Obtaining a target source end identifier of a client indicated by a client source identifier in a reserved field of the target TCP message header; The target source end information corresponding to the target source end identifier is extracted from the end position of the target TCP message header, and the target source end information is stored.

7. A source end information transparent transmission device, applied to a load balancing device, characterized in that: The device comprises: The data packet parsing module is used to parse the TCP data packet sent by the client to obtain the source information and data body information of the client; A target source end information extraction module is used to extract target source end information matching the preset source end information transparent transmission parameters from the source end information; A target message header generation module, used to set the client source identifier in the reserved field of the TCP message header of the TCP data message to the target source identifier corresponding to the source information transparent transmission parameter, and add the target source information at the end position of the TCP message header to generate a new target TCP message header; The target data message sending module is used to encapsulate the target TCP message header and the data body information into a target TCP data message, and send the target TCP data message to the corresponding real server, so that the real server can parse the target TCP data message, and extract the target source end information according to the client source identifier in the reserved field of the target TCP message header obtained by parsing, so as to store the target source end information.

8. A message processing device, applied to a real server, characterized in that: The device comprises: A TCP message parsing module, used for parsing a target TCP data message sent by a load balancing device to obtain a target TCP message header of the target TCP data message; A target identifier acquisition module, used to acquire a target source end identifier of a client indicated by a client source identifier in a reserved field of the target TCP message header; The target source end information acquisition module is used to extract the target source end information corresponding to the target source end identifier from the end position of the target TCP message header, and store the target source end information.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the source information transparent transmission method described in any one of claims 1 to 5 or the message processing method described in claim 6 is implemented.

10. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the source information transparent transmission method described in any one of claims 1 to 5, or the message processing method described in claim 6.

Images