Source-end information transparent transmission method, packet processing method, device, equipment and medium

Abstract

The application provides a source information transparent transmission method, a message processing method, a device, equipment and a medium. The source information transparent transmission method comprises the following steps: analyzing a TCP data message sent by a client to obtain source information of the client and data body information; extracting target source information matched with source information transparent transmission parameters from the source information; setting a client source identifier in a reserved field of a TCP message header of the TCP data message as a target source identifier corresponding to the source information transparent transmission parameters, adding the target source information at a tail position of the TCP message header, and generating a new target TCP message header; encapsulating the target TCP message header and the data body information into a target TCP data message, and sending the target TCP data message to a real server; the real server analyzes the target TCP data message, extracts the target source information according to the client source identifier in the reserved field of the target TCP message header obtained through the analysis, and stores the target source information.

Description

Technical Field

[0001] This application relates to the field of load balancing technology, and in particular to a source-end information transparent transmission method, message processing method, apparatus, equipment and medium. Background Technology

[0002] Load balancing (LB) technology is a traffic scheduling technique based on LB devices. In real-world production environments, as business traffic increases, a single server cannot handle the demand. Because a single server easily reaches its performance limit, LB technology was developed. Essentially, LB is a traffic scheduler that uses load balancing algorithms to distribute client traffic evenly across different service servers. For example... Figure 1 The diagram shows a load balancer (LB) network architecture. When a client wants to access a business server, it first sends its traffic to the LB load balancer. The load balancer then uses different load balancing algorithms to distribute the client's traffic across different backend servers, achieving high availability and improving overall system performance and scalability. The TCP (Transmission Control Protocol) business traffic interaction process between the client and the service can be described as follows: Figure 2 As shown, the client first accesses the LB's external virtual IP (VIP) to initiate a three-way handshake request. At this point, the source IP address of the packet is the client's source IP (CIP), and the destination IP is the LB's virtual IP (VIP). After receiving the final ACK (Acknowledgement) packet, the three-way handshake between the client and the VIP is successfully established. The client then sends a TCP datagram. Upon receiving the TCP datagram, the LB selects a real server based on the configured load balancing algorithm and caches the datagram. After selecting a real server, a three-way handshake is performed to establish a connection. At this point, the source IP address of the packet sent by the LB is the LB device's internal network interface address, which is... Figure 2 The LBIP address in the packet is the destination address, which is the service address (RSIP). After the three-way handshake is established, TCP data transmission occurs, and the source IP address is modified to the LB's interface address and retransmitted via the LBIP. Upon receiving the packet, the service server replies, modifying the source IP to the VIP on the LB before sending it back to the client. Analysis of the entire forwarding process reveals that the service server is unaware of the client's true source information; that is, it cannot determine the source IP and port number of the packet. This poses a security threat, potentially allowing for TCP SYN attacks. Furthermore, the server's inability to obtain client information prevents analysis of client access patterns. In short, the backend server cannot obtain the client's true source information for security control, client log analysis, and security attack prevention.

[0003] The current mainstream approach to solving this problem is for the load balancer (LB) to interact with the actual service via a separate protocol before sending data packets. This protocol carries the client's real source IP address. The most typical method is to use the Proxy Protocol to carry the client's real source IP. After establishing a TCP connection with the backend server, the LB sends a Proxy Protocol header (including client source IP / port, LB IP / port, etc.) before sending the actual application data. This allows the backend service to obtain the real client source IP address by parsing the header.

[0004] This approach requires both the load balancer (LB) and the physical server to support a new message delivery protocol, such as the Proxy protocol mentioned above. However, some existing servers within an enterprise intranet may not be able to support this separate delivery protocol. Using the Proxy Protocol alone has many drawbacks. For example, the Proxy protocol only supports carrying client source information, but there is no strict retransmission or acknowledgment mechanism to guarantee whether the message will actually reach the server. In other words, a standalone Proxy protocol is a solution for connectionless and unreliable transmission of source information. This reduces the overall system's message transmission efficiency, as the separate proxy protocol makes the transmitted messages more complex. It also reduces the load balancer's transmission performance, as the load balancer needs to handle not only TCP data packets but also the proxy protocol, incurring additional overhead. Summary of the Invention

[0005] The technical problem to be solved by the embodiments of this application is to provide a source information transparent transmission method, message processing method, apparatus, device and medium to realize the transparent transmission of client source information in LB technology scenario and solve the problem that the back-end real server cannot perceive the real client source information.

[0006] In a first aspect, embodiments of this application provide a source-end information transparent transmission method, applied to a load balancing device, the method comprising:

[0007] Parse the TCP data packets sent by the client to obtain the source information and data body information of the client;

[0008] Extract the target source information that matches the pre-set source information pass-through parameters from the source information;

[0009] Set the client source identifier in the reserved field of the TCP header of the TCP data packet to the target source identifier corresponding to the source information pass-through parameter, and add the target source information at the end of the TCP header to generate a new target TCP header;

[0010] The target TCP header and the data body information are encapsulated into a target TCP data packet, and the target TCP data packet is sent to the corresponding real server. The real server parses the target TCP data packet and extracts the target source information based on the client source identifier in the reserved field of the parsed target TCP header, and stores the target source information.

[0011] Secondly, embodiments of this application provide a message processing method applied to a real server, the method comprising:

[0012] Parse the target TCP data packet sent by the load balancer to obtain the target TCP header of the target TCP data packet;

[0013] Obtain the target source identifier of the client as indicated by the client source identifier in the reserved field of the target TCP header;

[0014] Extract the target source information corresponding to the target source identifier from the end of the target TCP header, and store the target source information.

[0015] Thirdly, embodiments of this application provide a source-end information transparent transmission device applied to a load balancing device, the device comprising:

[0016] The data packet parsing module is used to parse the TCP data packets sent by the client to obtain the source information and data body information of the client.

[0017] The target source information extraction module is used to extract target source information that matches the pre-set source information pass-through parameters from the source information.

[0018] The target header generation module is used to set the client source identifier in the reserved field of the TCP header of the TCP data packet to the target source identifier corresponding to the source information pass-through parameter, and add the target source information at the end of the TCP header to generate a new target TCP header.

[0019] The target data packet sending module is used to encapsulate the target TCP packet header and the data body information into a target TCP data packet, and send the target TCP data packet to the corresponding real server, so that the real server can parse the target TCP data packet and extract the target source information according to the client source identifier in the reserved field of the parsed target TCP packet header, and store the target source information.

[0020] Fourthly, embodiments of this application provide a message processing apparatus applied to a real server, the apparatus comprising:

[0021] The TCP packet parsing module is used to parse the target TCP data packet sent by the load balancing device and obtain the target TCP header of the target TCP data packet.

[0022] The target identifier acquisition module is used to acquire the target source identifier of the client indicated by the client source identifier in the reserved field of the target TCP header;

[0023] The target source information acquisition module is used to extract the target source information corresponding to the target source identifier from the end of the target TCP packet header and store the target source information.

[0024] Fifthly, embodiments of this application provide an electronic device, including:

[0025] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the source-end information pass-through method described above, or the message processing method described above.

[0026] Sixthly, embodiments of this application provide a computer-readable storage medium, wherein when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is able to perform the source-end information transparent transmission method or the message processing method described above.

[0027] Compared with the prior art, the embodiments of this application have the following advantages:

[0028] In this embodiment, the client's source information and data body information are obtained by parsing the TCP data packets sent by the client. Target source information matching the pre-set source information pass-through parameters is extracted from the source information. The client source identifier in the reserved field of the TCP header of the TCP data packet is set to the target source identifier corresponding to the source information pass-through parameters, and target source information is added to the end of the TCP header to generate a new target TCP header. The target TCP header and data body information are encapsulated into a target TCP data packet, and the target TCP data packet is sent to the corresponding real server. The real server parses the target TCP data packet and extracts the target source information based on the client source identifier in the reserved field of the parsed target TCP header, storing the target source information. This application's embodiments modify and apply reserved fields in the TCP header, adding option fields to define a client source identifier. The modified TCP header carries the client's source information (source IP address and / or source port number), enabling transparent transmission of client source information in load balancing (LB) scenarios. This solves the problem that the backend server cannot perceive the actual client source information. Compared to existing solutions, this approach addresses the issue of the actual server perceiving client source information without introducing new transport protocols, simplifying protocol message interaction complexity and avoiding additional overhead. Furthermore, it leverages the inherent reliability and retransmission mechanisms of the TCP protocol to ensure high availability of transparent client source information transmission.

[0029] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0030] Figure 1 A schematic diagram of an LB network provided in an embodiment of this application;

[0031] Figure 2 A schematic diagram illustrating a message interaction process between a client, load balancer, and a real server, provided in an embodiment of this application;

[0032] Figure 3 A flowchart illustrating the steps of a source-end information transparent transmission method provided in this application embodiment;

[0033] Figure 4 A schematic diagram illustrating the processing flow of a client-source-marked LB protocol stack sending TCP data packets, provided in an embodiment of this application;

[0034] Figure 5 A schematic diagram of a client-source transparent TCP packet interaction process provided in an embodiment of this application;

[0035] Figure 6A flowchart illustrating the steps of a message processing method provided in this application embodiment;

[0036] Figure 7 This is a schematic diagram illustrating the processing flow of a server-side protocol stack receiving TCP data packets, provided in an embodiment of this application.

[0037] Figure 8 This is a schematic diagram of the structure of a source-end information transparent transmission device provided in an embodiment of this application;

[0038] Figure 9 This is a schematic diagram of the structure of a message processing device provided in an embodiment of this application;

[0039] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0040] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0041] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0042] Reference Figure 3 The diagram illustrates a flowchart of a source-end information pass-through method provided in an embodiment of this application. This source-end information pass-through method can be applied to load balancing devices. Figure 3 As shown, the source-end information transparent transmission method may include steps 301, 302, 303 and 304.

[0043] Step 301: Parse the TCP data packets sent by the client to obtain the source information and data body information of the client.

[0044] This application's embodiments can be applied to load balancing devices, meaning the execution entity is the load balancing device. A load balancing device, also known as a load balancer, is the core component of a load balancing service. It is responsible for receiving requests from clients and distributing these requests appropriately to multiple backend servers according to preset rules and algorithms.

[0045] TCP (Transmission Control Protocol) datagrams are data units transmitted at the TCP layer, also called segments. A TCP datagram consists of a header (the TCP header) and a data portion; the header is mandatory, while the data portion is optional.

[0046] In load balancing scenarios, TCP data packets sent by clients can be captured and parsed to obtain the client's source information and data body information. The source information may include: source port number, destination port number, source IP (Internet Protocol) address, and destination IP address.

[0047] The data portion of a TCP packet (i.e., the data body information in this embodiment) is located after the TCP header, extending to the total packet length (specified by the total length field in the IP header). In a specific implementation, the starting position of the data portion can be determined based on the length field (header length) of the TCP header. The content of the data portion is read; this content can be any form of data, depending on the application layer protocol.

[0048] The fields in the TCP header are shown in Table 1 below;

[0049] Table 1: Structure of the raw TCP header

[0050]

[0051]

[0052] In Table 1 above, the Source Port identifies the port number of the application or service sending the application.

[0053] The Destination Port identifies the port number of the application or service on the receiving end.

[0054] The sequence number is used to number each byte in a TCP data stream, ensuring the orderly transmission of data.

[0055] The Acknowledge Number represents the sequence number of the next data segment the receiver expects to receive, used to acknowledge that data has been received.

[0056] Data Offset indicates the length of the TCP header, in units of 4 bytes.

[0057] Reserved fields are reserved fields in the TCP header. They are usually unused and are intended for possible future expansion.

[0058] URG (Urgent Flag): When URG = 1, it indicates that the urgent pointer is valid. The urgent pointer field is used to identify the end position of urgent data.

[0059] ACK (Acknowledgment flag): When ACK=1, it indicates that the acknowledgment sequence number is valid. ACK messages are used to inform the sender that data has been successfully received.

[0060] PSH (Push Flag): When PSH=1, the receiving end should immediately request the data to be delivered to the application after receiving the data, instead of buffering it until the buffer is full.

[0061] RST (Reset Connection Flag): When RST=1, it indicates that the TCP connection needs to be reset. This usually occurs when a serious connection error occurs.

[0062] SYN (Synchronization Sequence Number Flag): During the establishment of a TCP connection, SYN=1 indicates the initiation of a new connection. SYN packets are used by both parties to exchange initial sequence numbers.

[0063] FIN (End Connection Flag): When FIN=1, it indicates that a connection is being released. The FIN message is used to terminate a TCP connection.

[0064] Window Size indicates the size of the receiver's buffer, used for flow control. The sender can use this field to adjust the data transmission rate.

[0065] Checksum: Used to detect errors or corruption in TCP segments during transmission. It is a 16-bit field calculated by performing a checksum on the TCP header and data portions.

[0066] The Urgent Pointer is only valid when the URG flag is set and is used to mark the end of emergency data.

[0067] In the original TCP header shown in Table 1, the first 4 bytes are the source port and destination port, bytes 5 to 8 are the sequence number field used to identify the data size statistics sent from the sender to the receiver, bytes 9 to 12 are the acknowledgment sequence number used to identify how many bytes of data the receiver received, bytes 13 to 16 include the message length used to identify the length of the TCP header, 6 reserved fields, 6 common flags, 16 window size field, and bytes 17 to 20 are the checksum and urgent pointer.

[0068] After parsing the TCP data packets sent by the client to obtain the client's source information and data body information, proceed to step 302.

[0069] Step 302: Extract the target source information from the source information that matches the preset source information pass-through parameters.

[0070] Source information pass-through parameters refer to the parameters pre-configured by the load balancer for passing source information to the backend server. In this example, source information pass-through parameters may include any one of the following: IP address pass-through parameters, port pass-through parameters, or IP and port pass-through parameters.

[0071] After obtaining the source information from the client, the target source information that matches the pre-set source information pass-through parameters can be extracted from the source information. Specifically, this can be divided into the following three cases:

[0072] 1. When the source information pass-through parameter is the IP address pass-through parameter, extract the client's source IP address from the source information and use it as the target source information.

[0073] 2. When the source information pass-through parameter is the port pass-through parameter, extract the client's source port number from the source information to use as the target source information.

[0074] 3. When the source information is passed through with IP and port parameters, extract the client's source IP address and source port number from the source information to use as the target source information.

[0075] After extracting the target source information that matches the pre-set source information pass-through parameters from the source information, step 303 is executed.

[0076] Step 303: Set the client source identifier in the reserved field of the TCP header of the TCP data packet to the target source identifier corresponding to the source information pass-through parameter, and add the target source information at the end of the TCP header to generate a new target TCP header.

[0077] After extracting the target source information that matches the pre-set source information pass-through parameters from the source information, the client source identifier in the reserved field of the TCP header of the TCP datagram can be set to the target source identifier corresponding to the source information pass-through parameters.

[0078] In this embodiment, the Client Source Flag (CFS) is set in a reserved field in the TCO header (i.e., the CSF field). The improved TCP header can be shown in Table 2 below:

[0079] Table 2: Structure of the improved TCP header

[0080]

[0081] As shown in Table 2 above, in order to enable customized identification of the client's source information during TCP transmission, the first two of the six reserved bits in bytes 13 to 16 are defined as the CSF field (i.e., the client source identifier in this embodiment). The purpose of the CSF is that when the administrator needs to have differentiated transparent transmission requirements for the client's source IP address, source port, or source IP address + source port, the administrator's differentiated customization requirements can be passed to the device protocol stack through the CSF identifier.

[0082] Setting the client source identifier to the target source identifier corresponding to the source information pass-through parameter can be done in any of the following three ways:

[0083] 1. When the source information pass-through parameter is the IP address pass-through parameter, set the client source identifier in the reserved field of the TCP header to the source IP address identifier.

[0084] 2. When the source information pass-through parameter is the port pass-through parameter, set the client source identifier in the reserved field of the TCP header to the source port identifier.

[0085] 3. When the source information pass-through parameters are IP and port pass-through parameters, set the client source identifier in the reserved field of the TCP header to the source IP and source port identifier.

[0086] In this embodiment, the CSF field values ​​corresponding to different pass-through parameters can be preset, as shown in Table 3 below:

[0087] Table 3: CSF Field Values

[0088]

[0089] As shown in Table 3 above, when the administrator needs to pass through the client's source IP address, the CSF value is set to 01. When the administrator needs to pass through the client's source port number, the CSF value is set to 10. When the administrator needs to pass through both the client's source IP address and source port number, the CSF value is set to 11.

[0090] After setting the client source identifier in the reserved field of the TCP header of the TCP datagram to the target source identifier corresponding to the source information pass-through parameter, target source information can be added to the end of the TCP header to generate a new target TCP header. The methods for adding target source information to the end of the TCP header to generate a target TCP header can include any of the following:

[0091] 1. If the target source information is the client's source IP address, add a 4-byte options field to the end of the TCP header and add the source IP address to the options field to obtain the target TCP header.

[0092] 2. If the target source information is the source port number of the client, add a 2-byte option field to the end of the TCP header and add the source port number to the option field to obtain the target TCP header.

[0093] 3. If the target source information is the client's source port number and source IP address, add a 6-byte options field to the end of the TCP header and add the source IP address and source port number to the options field to obtain the target TCP header.

[0094] In this embodiment, differentiated TCP header encapsulation is performed for different CSF values. Different TCP header options are encapsulated using different CSF code tables; that is, different CSF values ​​correspond to different TCP header lengths, making the process more flexible and improving network transmission efficiency.

[0095] When it is necessary to monitor the source IP address of the client, CSF is assigned the value 01, and 4 bytes of option are added to the TCP header to carry the client source IP address information resolved by the LB. The TCP header encapsulated on the LB is shown in Table 4 below:

[0096] Table 4: Structure of TCP header when CSF value is 01

[0097]

[0098] As shown in Table 4 above, the CSF value in the TCP header is set to 01, and a 4-byte option is added at the end of the header to add the Client Source Address.

[0099] When it is necessary to monitor the client's source port number, CSF is set to 10, and a 2-byte option is added to the TCP header to carry the client's source port number information resolved by the LB. The TCP header encapsulated on the LB is shown in Table 5 below:

[0100] Table 5: TCP header structure when CSF value is 10

[0101]

[0102] As shown in Table 5 above, the CSF value in the TCP header is set to 10, and a 2-byte option is added at the end of the header to add the Client Source Port.

[0103] When monitoring the client's source IP address and source port number is required, CSF is set to 11, and 6 bytes of optional information are added to the TCP header. The first 4 bytes are used to carry the client's source IP address information resolved by the LB, and the last 2 bytes are used to carry the client's source port number information resolved by the LB. The TCP header encapsulated on the LB is shown in Table 6 below:

[0104] Table 6: TCP header structure when CSF value is 11

[0105]

[0106] As shown in Table 6 above, the CSF value in the TCP header is set to 11, and 6 bytes of option are added at the end of the header. The first 4 bytes are used to add the Client Source Address, and the last 2 bytes are used to add the Client Source Port.

[0107] In this embodiment, in addition to modifying the CSF field value in the TCP header and adding target source information, it is also necessary to modify the IP address and port number in the TCP header. This implementation process can be described in detail below with reference to the specific implementation method.

[0108] In one specific implementation of this application, step 303 may include:

[0109] Sub-step S1: Add the target source information to the end of the TCP header to generate the initial TCP header.

[0110] In this embodiment, after setting the client source identifier in the reserved field of the TCP header of the TCP datagram to the target source identifier corresponding to the source information pass-through parameter, target source information can be added to the end of the TCP header to generate the initial TCP header. The adding process can be referred to the description above, and will not be repeated here.

[0111] Sub-step S2: Modify the source IP address and source port number in the TCP header to the IP address and port number of the load balancer, and modify the destination IP address and destination port number in the TCP header to the IP address and port number of the real server, thereby generating the target TCP header.

[0112] Then, the source IP address and source port number in the initial TCP header can be modified to the IP address and port number of the load balancer, and the destination IP address and destination port number in the initial TCP header can be modified to the IP address and port number of the real server to generate the target TCP header.

[0113] Step 304: Encapsulate the target TCP header and the data body information into a target TCP data packet, and send the target TCP data packet to the corresponding real server, so that the real server can parse the target TCP data packet, and extract the target source information according to the client source identifier in the reserved field of the parsed target TCP header, and store the target source information.

[0114] A Real Server (RS) is a server selected by a load balancer from multiple backend servers using a pre-configured load balancing algorithm to handle client TCP data packets. In practice, load balancers can use various load balancing algorithms to determine how to distribute requests to backend servers. These algorithms might include round-robin, weighted round-robin, least connections, and response time. Backend servers are the devices that actually process client requests. The load balancer selects one or more servers from a pool of servers to handle requests based on the load balancing algorithm.

[0115] After obtaining the target TCP header, the target TCP header and data body can be encapsulated into a target TCP data packet, and the target TCP data packet can be sent to the corresponding real server. The real server can then parse the target TCP data packet and extract the target source information based on the client source identifier in the reserved field of the parsed target TCP header, and store the target source information.

[0116] This application's embodiments modify and apply reserved fields in the TCP header, adding option fields to define a client source identifier. The modified TCP header carries the client's source information (source IP address and / or source port number), enabling transparent transmission of client source information in load balancing (LB) scenarios. This solves the problem that the backend server cannot perceive the actual client source information. Compared to existing solutions, this approach addresses the issue of the actual server perceiving client source information without introducing new transport protocols, simplifying protocol message interaction complexity and avoiding additional overhead. Furthermore, it leverages the inherent reliability and retransmission mechanisms of the TCP protocol to ensure high availability of transparent client source information transmission.

[0117] The process for LB devices that support source information pass-through technology to process TCP packets can be shown in Figure 4.

[0118] like Figure 4 As shown, after the LB (Load Balancer) receives a TCP data packet from the client, it checks whether the LB has enabled the client source pass-through function. If not, it proceeds with the normal processing flow and forwards the packet to the real server. If so, it checks whether the LB has configured the client source IP address marking function.

[0119] If the load balancer is configured with client source IP address marking, the CSF field value in the marked improved TCP header will be 01. At the same time, a 4-byte option field will be added to the TCP header to fill in the source IP address of the client packet before forwarding it to the real server.

[0120] If the load balancer (LB) is not configured to mark the client source IP address, then check if the LB is configured to mark the client source port.

[0121] If the load balancer is configured with client source port marking, the CSF field value in the marked improved TCP header is 10, and a 2-byte option field is added to the TCP header to fill in the source port number of the client packet before forwarding it to the real server.

[0122] If the load balancer (LB) is not configured to mark the client source port, continue to determine whether the LB is configured to mark both the client source IP address and the source port number.

[0123] If the load balancer (LB) is configured to simultaneously mark the client's source IP address and source port number, the CSF field value in the improved TCP header will be 11. Additionally, a 6-byte option field will be added to the TCP header, with the first 4 bytes used to fill in the client's source IP address and the last 2 bytes used to fill in the client's source port number before forwarding to the actual server.

[0124] If the load balancer (LB) is not configured to simultaneously mark the client's source IP address and source port number, it will proceed with the normal processing flow and forward the data to the actual server.

[0125] This application utilizes a reserved field in the TCP header, defining the CSF (ClientSource Flag) field, and also defines a CSF code table (i.e., Table 3 above). The CSF code table can meet the client's need for customized source information; the client can identify only the client's source IP, source port number, or source IP + source port number according to their needs. The client configures the CSF code table on the load balancer. This solves the problem that existing technologies cannot achieve differentiated client source information pass-through.

[0126] For LB technology that supports source information pass-through, the message interaction process can be as follows: Figure 5As shown, the client accesses the LB's VIP (Virtual Internet Protocol Address) (i.e., the virtual IP address provided externally by the LB service) via CIP (Client IP) to perform a TCP three-way handshake. After a successful three-way handshake, the client transmits TCP data packets to the LB. Upon receiving the TCP data packets, the LB parses the packets, records information such as the source IP and source port number, and simultaneously queries the routing algorithm to determine the destination server address to be forwarded, and caches the packets.

[0127] The load balancer (LB) performs a TCP three-way handshake between its internal network interface address (LBIP) and the destination real server address (RSIP). After a successful handshake, it sends the previously cached data packets, modifying the source IP to its own LBIP and the destination IP to the selected real server's RSIP. Simultaneously, it assigns a value to the CSF field according to the network administrator's configuration for transparent source information transmission. It also extracts the original client's source IP address and source port number, filling them into the end of the TCP header as options, and sends it to the real server. Upon receiving the packet, the real server recognizes the CSF field and extracts the corresponding source information (i.e., source IP, source port, and source IP + source port) and records it locally. This completes the real server's awareness and statistics of client source information, enabling it to perform security-related functions such as security control and log statistics.

[0128] The source information pass-through method provided in this application obtains the client's source information and data body information by parsing the TCP data packets sent by the client. Target source information matching the pre-set source information pass-through parameters is extracted from the source information. The client source identifier in the reserved field of the TCP header of the TCP data packet is set to the target source identifier corresponding to the source information pass-through parameters, and target source information is added to the end of the TCP header to generate a new target TCP header. The target TCP header and data body information are encapsulated into a target TCP data packet, and the target TCP data packet is sent to the corresponding real server. The real server parses the target TCP data packet and extracts the target source information based on the client source identifier in the reserved field of the parsed target TCP header, and stores the target source information. This application's embodiments modify and apply reserved fields in the TCP header, adding option fields to define a client source identifier. The modified TCP header carries the client's source information (source IP address and / or source port number), enabling transparent transmission of client source information in load balancing (LB) scenarios. This solves the problem that the backend server cannot perceive the actual client source information. Compared to existing solutions, this approach addresses the issue of the actual server perceiving client source information without introducing new transport protocols, simplifying protocol message interaction complexity and avoiding additional overhead. Furthermore, it leverages the inherent reliability and retransmission mechanisms of the TCP protocol to ensure high availability of transparent client source information transmission.

[0129] Reference Figure 6 This document illustrates a flowchart of a message processing method provided in an embodiment of this application. This message processing method can be applied to a real server. Figure 6 As shown, the message information processing method may include steps 601, 602 and 603.

[0130] Step 601: Parse the target TCP data packet sent by the load balancing device to obtain the target TCP header of the target TCP data packet.

[0131] The embodiments of this application can be applied to real servers, that is, the execution subject is a real server.

[0132] After the server receives the target TCP data packet sent by the load balancer, it can parse the target TCP data packet to obtain the target TCP header of the target TCP data packet.

[0133] After parsing the target TCP data packet sent by the load balancer to obtain the target TCP header, step 602 is executed.

[0134] Step 602: Obtain the target source identifier of the client indicated by the client source identifier in the reserved field of the target TCP header.

[0135] After parsing the target TCP data packet sent by the load balancer to obtain the target TCP header, the target source identifier of the client, indicated by the client source identifier in the reserved field of the target TCP header, can be obtained.

[0136] After obtaining the client's target source identifier as indicated by the client source identifier in the reserved field of the target TCP header, proceed to step 603.

[0137] Step 603: Extract the target source information corresponding to the target source identifier from the end of the target TCP header and store the target source information.

[0138] After obtaining the client's target source identifier as indicated by the client source identifier in the reserved field of the target TCP header, the target source information corresponding to the target source identifier can be extracted from the end of the target TCP header and stored.

[0139] The embodiments of this application can be applied to source-end monitoring scenarios. For example, in a bank, which only allows access from certain clients, the bank server can block access from some unauthenticated clients by passing through the source-end information of the clients, thereby improving the security of server resources.

[0140] This application's embodiments modify and apply reserved fields in the TCP header, adding option fields to define a client source identifier. The modified TCP header carries the client's source information (source IP address and / or source port number), enabling transparent transmission of client source information in load balancing (LB) scenarios. This solves the problem that the backend server cannot perceive the actual client source information. Compared to existing solutions, this approach addresses the issue of the actual server perceiving client source information without introducing new transport protocols, simplifying protocol message interaction complexity and avoiding additional overhead. Furthermore, it leverages the inherent reliability and retransmission mechanisms of the TCP protocol to ensure high availability of transparent client source information transmission.

[0141] Next, combined Figure 7 This document provides a detailed description of the process by which a real server that supports source information pass-through technology processes TCP packets.

[0142] like Figure 7 As shown, when the server receives the TCP data packet from the load balancer, it checks whether the CSF field in the TCP header is empty.

[0143] If the CSF field is empty, the normal processing flow will be followed, and the data will be forwarded to the corresponding business module for processing.

[0144] If the CSF field is not empty, then continue to check if the CSF value is 01.

[0145] If the CSF value is 01, then the value of the option field in the TCP header of the packet is extracted, the client's source IP address is recorded, and the packet is forwarded to the corresponding business module for processing.

[0146] If the CSF value is not 01, continue to check if the CSF value is 10.

[0147] If the CSF value is 10, then the value of the option field in the TCP header of the packet is extracted, the client's source port address is recorded, and the packet is forwarded to the corresponding business module for processing.

[0148] If the CSF value is not 10, continue to check if the CSF value is 11.

[0149] If the CSF value is 11, the value of the option field in the TCP header of the packet is extracted. The first 4 bytes record the client's source IP address, and the last 2 bytes record the client's source port address. The packet is then forwarded to the corresponding business module for processing.

[0150] If the CSF value is also not 11, it will be directly forwarded to the corresponding business module for processing.

[0151] The message processing method provided in this application provides a method to obtain the target TCP header of the target TCP data packet sent by the load balancing device by parsing the target TCP data packet. The method then obtains the client's target source identifier, indicated by the client source identifier in the reserved fields of the target TCP header. Finally, it extracts and stores the target source information corresponding to the target source identifier from the end of the target TCP header. This application, by modifying and applying the reserved fields in the TCP header and adding an option field, defines the client source identifier. The modified TCP header carries the client's source information (source IP address and / or source port number), achieving transparent transmission of the client's source information in the LB technology scenario and solving the problem that the backend server cannot perceive the actual client source information. Compared to existing solutions, this method solves the problem of the actual server perceiving the client source information without introducing a new transmission protocol, simplifying the interaction complexity of protocol messages and avoiding additional overhead. It also utilizes the reliability and retransmission mechanism of the TCP protocol itself to ensure high availability of the transparent transmission of client source information.

[0152] Reference Figure 8The diagram illustrates a source-end information pass-through device according to an embodiment of this application, which can be applied to load balancing equipment. Figure 8 As shown, the source-end information transparent transmission device 800 may include the following modules:

[0153] The data packet parsing module 810 is used to parse the TCP data packets sent by the client to obtain the source information and data body information of the client.

[0154] The target source information extraction module 820 is used to extract target source information that matches the preset source information pass-through parameters from the source information.

[0155] The target header generation module 830 is used to set the client source identifier in the reserved field of the TCP header of the TCP data packet to the target source identifier corresponding to the source information pass-through parameter, and add the target source information at the end of the TCP header to generate a new target TCP header.

[0156] The target data packet sending module 840 is used to encapsulate the target TCP packet header and the data body information into a target TCP data packet, and send the target TCP data packet to the corresponding real server, so that the real server can parse the target TCP data packet and extract the target source information according to the client source identifier in the reserved field of the parsed target TCP packet header, and store the target source information.

[0157] Optionally, the target source information extraction module includes:

[0158] The first source information acquisition unit is used to extract the source IP address of the client from the source information when the source information pass-through parameter is an IP address pass-through parameter, and use it as the target source information.

[0159] The second source information acquisition unit is used to extract the source port number of the client from the source information when the source information pass-through parameter is a port pass-through parameter, so as to use it as the target source information.

[0160] The third source information acquisition unit is used to extract the source IP address and source port number of the client from the source information when the source information pass-through parameters are IP and port pass-through parameters, so as to use them as the target source information.

[0161] Optionally, the target header generation module includes:

[0162] The first identifier setting unit is used to set the client source identifier in the reserved field of the TCP header to the source IP address identifier when the source information pass-through parameter is the IP address pass-through parameter.

[0163] The second identifier setting unit is used to set the client source identifier in the reserved field of the TCP header to the source port identifier when the source information pass-through parameter is a port pass-through parameter.

[0164] The third identifier setting unit is used to set the client source identifier in the reserved field of the TCP header to the source IP and source port identifier when the source information pass-through parameters are IP and port pass-through parameters.

[0165] Optionally, the target header generation module includes:

[0166] The first header generation unit is configured to add a 4-byte option field to the end of the TCP header when the target source information is the source IP address of the client, and add the source IP address to the option field to obtain the target TCP header;

[0167] The second header generation unit is used to add a 2-byte option field to the end of the TCP header when the target source information is the source port number of the client, and add the source port number to the option field to obtain the target TCP header;

[0168] The third header generation unit is used to add a 6-byte option field to the end of the TCP header when the target source information is the source port number and source IP address of the client, and add the source IP address and the source port number to the option field to obtain the target TCP header.

[0169] Optionally, the target header generation module includes:

[0170] A new source-end addition unit is used to add the target source-end information at the end of the TCP header to generate the initial TCP header;

[0171] The fourth header generation unit is used to modify the source IP address and source port number in the initial TCP header to the IP address and port number of the load balancing device, and to modify the destination IP address and destination port number in the initial TCP header to the IP address and port number of the real server, thereby generating the target TCP header.

[0172] The source information transparent transmission device provided in this application provides a method to obtain the client's source information and data body information by parsing the TCP data packets sent by the client. It extracts target source information that matches pre-set source information transparent transmission parameters from the source information. The client source identifier in the reserved field of the TCP header of the TCP data packet is set to the target source identifier corresponding to the source information transparent transmission parameters, and target source information is added to the end of the TCP header to generate a new target TCP header. The target TCP header and data body information are encapsulated into a target TCP data packet, and the target TCP data packet is sent to the corresponding real server. The real server parses the target TCP data packet and extracts the target source information based on the client source identifier in the reserved field of the parsed target TCP header, storing the target source information. This application's embodiments modify and apply reserved fields in the TCP header, adding option fields to define a client source identifier. The modified TCP header carries the client's source information (source IP address and / or source port number), enabling transparent transmission of client source information in load balancing (LB) scenarios. This solves the problem that the backend server cannot perceive the actual client source information. Compared to existing solutions, this approach addresses the issue of the actual server perceiving client source information without introducing new transport protocols, simplifying protocol message interaction complexity and avoiding additional overhead. Furthermore, it leverages the inherent reliability and retransmission mechanisms of the TCP protocol to ensure high availability of transparent client source information transmission.

[0173] Reference Figure 9 This illustration shows a schematic diagram of a message processing apparatus provided in an embodiment of this application. This message processing apparatus can be applied to a real server. Figure 9 As shown, the message processing device 900 may include the following modules:

[0174] TCP packet parsing module 910 is used to parse the target TCP data packet sent by the load balancing device and obtain the target TCP packet header of the target TCP data packet;

[0175] The target identifier acquisition module 920 is used to acquire the target source identifier of the client indicated by the client source identifier in the reserved field of the target TCP header;

[0176] The target source information acquisition module 930 is used to extract the target source information corresponding to the target source identifier from the end of the target TCP packet header and store the target source information.

[0177] The message processing apparatus provided in this application provides a target TCP header for the target TCP data packet sent by the load balancer. It obtains the client's target source identifier from the reserved fields in the target TCP header. The target source information corresponding to the target source identifier is extracted from the end of the target TCP header and stored. This application, by modifying and applying the reserved fields in the TCP header and adding option fields, defines the client source identifier. The modified TCP header carries the client's source information (source IP address and / or source port number), achieving transparent transmission of client source information in LB technology scenarios and solving the problem that the backend server cannot perceive the actual client source information. Compared to existing solutions, this approach solves the problem of the actual server perceiving client source information without introducing new transmission protocols, simplifying the interaction complexity of protocol messages and avoiding additional overhead. It also utilizes the reliability and retransmission mechanism of the TCP protocol itself to ensure high availability of transparent transmission of client source information.

[0178] This application also provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the above-described source-end information transparent transmission method or the above-described message processing method.

[0179] Figure 10 A schematic diagram of the structure of an electronic device 1000 according to an embodiment of the present invention is shown. Figure 10 As shown, the electronic device 1000 includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) 1002 or loaded from storage unit 1008 into random access memory (RAM) 1003. The RAM 1003 may also store various programs and data required for the operation of the electronic device 1000. The CPU 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. An input / output (I / O) interface 1005 is also connected to bus 1004.

[0180] Multiple components in electronic device 1000 are connected to I / O interface 1005, including: input unit 1006, such as keyboard, mouse, microphone, etc.; output unit 1007, such as various types of monitors, speakers, etc.; storage unit 1008, such as disk, optical disk, etc.; and communication unit 1009, such as network card, modem, wireless transceiver, etc. Communication unit 1009 allows electronic device 1000 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0181] The various processes and handling described above can be executed by processing unit 1001. For example, the methods of any of the above embodiments can be implemented as computer software programs tangibly contained in a computer-readable medium, such as storage unit 1008. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 1000 via ROM 1002 and / or communication unit 1009. When the computer program is loaded into RAM 1003 and executed by CPU 1001, one or more actions of the methods described above can be performed.

[0182] Additionally, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned source-end information transparent transmission method or the aforementioned message processing method.

[0183] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0184] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal that includes said element.

[0185] The above provides a detailed description of the source-end information transparent transmission method, message processing method, apparatus, device, and medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A source-end information transparent transmission method, applied to load balancing equipment, characterized in that, The method includes: Parse the TCP data packets sent by the client to obtain the source information and data body information of the client; Extract the target source information that matches the pre-set source information pass-through parameters from the source information; Set the client source identifier in the reserved field of the TCP header of the TCP data packet to the target source identifier corresponding to the source information pass-through parameter, and add the target source information at the end of the TCP header to generate a new target TCP header; The target TCP header and the data body information are encapsulated into a target TCP data packet, and the target TCP data packet is sent to the corresponding real server. The real server parses the target TCP data packet and extracts the target source information based on the client source identifier in the reserved field of the parsed target TCP header, and stores the target source information. The step of extracting target source information that matches the pre-set source information pass-through parameters from the source information includes: When the source information pass-through parameter is an IP address pass-through parameter, the source IP address of the client is extracted from the source information and used as the target source information. When the source information pass-through parameter is a port pass-through parameter, the source port number of the client is extracted from the source information and used as the target source information. When the source information pass-through parameters are IP and port pass-through parameters, the source IP address and source port number of the client are extracted from the source information and used as the target source information.

2. The method according to claim 1, characterized in that, Setting the client source identifier in the reserved field of the TCP header of the TCP data packet to the target source identifier corresponding to the source information pass-through parameter includes: When the source information pass-through parameter is an IP address pass-through parameter, the client source identifier in the reserved field of the TCP header is set to the source IP address identifier; When the source information pass-through parameter is a port pass-through parameter, the client source identifier in the reserved field of the TCP header is set to the source port identifier; When the source information pass-through parameters are IP and port pass-through parameters, the client source identifier in the reserved field of the TCP header is set to the source IP and source port identifier.

3. The method according to claim 1, characterized in that, The step of adding the target source information to the end of the TCP header to generate a new target TCP header includes: If the target source information is the source IP address of the client, add a 4-byte option field to the end of the TCP header and add the source IP address to the option field to obtain the target TCP header; If the target source information is the source port number of the client, add a 2-byte option field to the end of the TCP header and add the source port number to the option field to obtain the target TCP header; If the target source information is the source port number and source IP address of the client, add a 6-byte option field to the end of the TCP header, and add the source IP address and the source port number to the option field to obtain the target TCP header.

4. The method according to claim 1, characterized in that, The step of adding the target source information to the end of the TCP header to generate a new target TCP header includes: Add the target source information to the end of the TCP header to generate the initial TCP header; The source IP address and source port number in the initial TCP header are modified to the IP address and port number of the load balancer, and the destination IP address and destination port number in the initial TCP header are modified to the IP address and port number of the real server, thereby generating the target TCP header.

5. A message processing method, applied to a real server, characterized in that, The method includes: Parse the target TCP data packet sent by the load balancer to obtain the target TCP header of the target TCP data packet; Obtain the target source identifier of the client as indicated by the client source identifier in the reserved field of the target TCP header; Extract the target source information corresponding to the target source identifier from the end of the target TCP header, and store the target source information; The step of extracting target source information that matches the pre-set source information pass-through parameters from the source information includes: When the source information pass-through parameter is an IP address pass-through parameter, the source IP address of the client is extracted from the source information and used as the target source information. When the source information pass-through parameter is a port pass-through parameter, the source port number of the client is extracted from the source information and used as the target source information. When the source information pass-through parameters are IP and port pass-through parameters, the source IP address and source port number of the client are extracted from the source information to be used as the target source information.

6. A source-end information transparent transmission device, applied to load balancing equipment, characterized in that, The device includes: The data packet parsing module is used to parse the TCP data packets sent by the client to obtain the source information and data body information of the client. The target source information extraction module is used to extract target source information that matches the pre-set source information pass-through parameters from the source information. The target header generation module is used to set the client source identifier in the reserved field of the TCP header of the TCP data packet to the target source identifier corresponding to the source information pass-through parameter, and add the target source information at the end of the TCP header to generate a new target TCP header. The target data packet sending module is used to encapsulate the target TCP packet header and the data body information into a target TCP data packet, and send the target TCP data packet to the corresponding real server, so that the real server can parse the target TCP data packet and extract the target source information according to the client source identifier in the reserved field of the parsed target TCP packet header, and store the target source information; The target source information extraction module includes: The first source information acquisition unit is used to extract the source IP address of the client from the source information when the source information pass-through parameter is an IP address pass-through parameter, and use it as the target source information. The second source information acquisition unit is used to extract the source port number of the client from the source information when the source information pass-through parameter is a port pass-through parameter, so as to use it as the target source information. The third source information acquisition unit is used to extract the source IP address and source port number of the client from the source information when the source information pass-through parameters are IP and port pass-through parameters, so as to use them as the target source information.

7. A message processing device, applied to a real server, characterized in that, The device includes: The TCP packet parsing module is used to parse the target TCP data packet sent by the load balancing device and obtain the target TCP header of the target TCP data packet. The target identifier acquisition module is used to acquire the target source identifier of the client indicated by the client source identifier in the reserved field of the target TCP header; The target source information acquisition module is used to extract the target source information corresponding to the target source identifier from the end of the target TCP packet header and store the target source information. The device is further configured to extract the source IP address of the client from the source information when the source information pass-through parameter is an IP address pass-through parameter, and use it as the target source information. When the source information pass-through parameter is a port pass-through parameter, the source port number of the client is extracted from the source information and used as the target source information. When the source information pass-through parameters are IP and port pass-through parameters, the source IP address and source port number of the client are extracted from the source information and used as the target source information.

8. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the source-end information pass-through method of any one of claims 1 to 4, or the message processing method of claim 5.

9. A computer-readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor of the electronic device, the electronic device is able to perform the source information pass-through method of any one of claims 1 to 4, or the message processing method of claim 5.

Images