Port opening method and device, equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of cloud computing, in particular to a port opening method and device, equipment and a storage medium, and aims to improve the port opening efficiency. The method comprises the steps that service software receives a global configuration file, the global configuration file comprises a network address and a port blacklist corresponding to the service software, and all ports in the network address are open ports; the service software sends a forwarding rule corresponding to the global configuration file to a kernel; the service software receives domain name port information corresponding to the newly added port; under the condition that the kernel receives an access request for the newly added port, the access request is verified according to the forwarding rule; under the condition that the kernel passes the verification, the access request is sent to the service software; and the service software returns a corresponding response message under the condition that the access request conforms to the domain name port information.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of cloud computing technology, and more specifically, to a port opening method, device, equipment and storage medium. Background Art

[0002] In the field of Internet edge security, CDN, and cloud computing, when providing content forwarding services or security services to customers, customers often need to open special ports other than 80 (http) and 443 (https). In the existing technology, it is necessary to add the special port in the configuration file, then send it to the service device, let the service software reload the configuration file, and then listen to the special port at the system level. After opening the server firewall, the special port can be used for external services.

[0003] In the prior art, the port opening cycle is long and the opening process is cumbersome. In addition, since it involves the global configuration distribution of the software, it is impossible to enable customers to open the ports by themselves. In the scenario of application acceleration, customers have a stronger demand for special ports, and often need to open tens of thousands of special ports. At this time, if these ports are monitored by the service software, the service software will face great performance problems. Not only can it not realize the customer's self-service opening of special ports, but it may even cause the service software to be abnormal due to performance problems, affecting the customer's user experience. Summary of the invention

[0004] The embodiments of the present application provide a port opening method, apparatus, device and storage medium, aiming to improve the efficiency of port opening.

[0005] A first aspect of an embodiment of the present application provides a port opening method, the method comprising: The service software receives a global configuration file, wherein the global configuration file includes a network address corresponding to the service software and a port blacklist, wherein all ports in the network address are open ports; The service software sends the forwarding rules corresponding to the global configuration file to the kernel; The service software receives the domain name port information corresponding to the newly added port; When receiving an access request for the newly added port, the kernel verifies the access request according to the forwarding rule; When the verification is successful, the kernel sends the access request to the service software; The service software returns a corresponding response message when the access request conforms to the domain name and port information.

[0006] Optionally, the method further comprises: The service software determines the corresponding listening port according to the received listening port setting information; The service software sends the port information corresponding to the monitoring port to the kernel; When receiving an access request for the network address corresponding to the service software, the kernel sends the access request to the listening port.

[0007] Optionally, the method further includes: when the kernel detects that the listening port is closed, deleting relevant information of the listening port.

[0008] Optionally, before the service software receives the global configuration file, the method further includes: The scheduling system specifies the corresponding network address for the service software, and formulates the port blacklist corresponding to the network address; The scheduling system sends the network address and the port blacklist to the global configuration system; The global configuration system generates the global configuration file according to the network address and the port blacklist.

[0009] Optionally, the method further comprises: the client console receiving a request for adding a new port sent by the client; The client console parses the newly added port request to obtain corresponding newly added port information; The client console sends the newly added port information to the port configuration system; The port configuration system generates the domain name port information according to the newly added port information.

[0010] Optionally, the service software sends the forwarding rule corresponding to the global configuration file to the kernel, including: The service software generates the forwarding rule according to the network address and the blacklist port in the global configuration file; The service software sends the forwarding rules to the kernel.

[0011] Optionally, when the kernel receives an access request for the newly added port, verifying the access request according to the forwarding rule includes: The kernel parses the access request to determine the network address and port number corresponding to the access request; The kernel determines whether the network address corresponding to the network request and the port number match the port blacklist; The kernel rejects the access request if the network address and the port number corresponding to the access request match the port blacklist; The kernel determines, when the network address and the port number do not match the port blacklist, whether the network address corresponding to the access request matches the network address specified in the forwarding rule; The kernel determines that the access request passes verification if the network address corresponding to the access request matches the network address specified in the forwarding rule; The kernel determines, if the network address corresponding to the access request does not match the network address specified in the forwarding rule, whether the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule; The kernel determines that the access request passes verification if the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule; The kernel rejects the access request if the combination of the network address and the port number corresponding to the access request does not match the combination of the network address and the port number specified in the forwarding rule.

[0012] A second aspect of an embodiment of the present application provides a port opening device, the device comprising: A file receiving module, used for the service software to receive a global configuration file, wherein the global configuration file includes a network address and a port blacklist corresponding to the service software, and all ports in the network address are open ports; A first sending module, used for the service software to send the forwarding rule corresponding to the global configuration file to the kernel; A port information receiving module, used for the service software to receive domain name port information corresponding to the newly added port; A verification module, configured to verify, when the kernel receives an access request for the newly added port, the access request according to the forwarding rule; A first request forwarding module, configured for sending the access request to the service software when the kernel passes the verification; The message return module is used for the service software to return a corresponding response message when the access request conforms to the domain name and port information.

[0013] Optionally, the device further comprises: A monitoring port determination module, used for the service software to determine the corresponding monitoring port according to the received monitoring port setting information; A second sending module, used for the service software to send the port information corresponding to the listening port to the kernel; The second request forwarding module is used for the kernel to send the access request to the listening port when receiving the access request for the network address corresponding to the service software.

[0014] Optionally, the device further includes: an information deleting module, configured for the kernel to delete relevant information of the listening port when detecting that the listening port is closed.

[0015] Optionally, the device further comprises: An information designation module, used for the scheduling system to designate the corresponding network address for the service software, and to formulate the port blacklist corresponding to the network address; A third sending module, used for the scheduling system to send the network address and the port blacklist to the global configuration system; The file generation module is used for the global configuration system to generate the global configuration file according to the network address and the port blacklist.

[0016] Optionally, the device further comprises: a new request receiving module, configured for the client console to receive a new port request sent by a client; A new request parsing module is used for the client console to parse the new port request to obtain the corresponding new port information; A fourth sending module, used for the client console to send the newly added port information to the port configuration system; The information generation module is used for the port configuration system to generate the domain name port information according to the newly added port information.

[0017] Optionally, the first sending module includes: A forwarding rule generation submodule, used for the service software to generate the forwarding rule according to the network address and the blacklist port in the global configuration file; The rule sending submodule is used for the service software to send the forwarding rule to the kernel.

[0018] Optionally, the request verification module includes: A request parsing submodule, used for the kernel to parse the access request and determine the network address and port number corresponding to the access request; A first verification submodule, used by the kernel to determine whether the network address corresponding to the network request and the port number match the port blacklist; A first rejection submodule, configured for the kernel to reject the access request when the network address and the port number corresponding to the access request match the port blacklist; A second verification submodule, configured for the kernel to determine whether the network address corresponding to the access request matches the network address specified in the forwarding rule when the network address and the port number do not match the port blacklist; A first pass verification submodule, configured for the kernel to determine that the access request passes verification when the network address corresponding to the access request matches the network address specified in the forwarding rule; a third verification submodule, configured for the kernel to determine, if the network address corresponding to the access request does not match the network address specified in the forwarding rule, whether the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule; A second pass verification submodule, configured for the kernel to determine that the access request passes verification if the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule; The second rejection submodule is used for the kernel to reject the access request when the combination of the network address and the port number corresponding to the access request does not match the combination of the network address and the port number specified in the forwarding rule.

[0019] A third aspect of an embodiment of the present application provides a readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps in the method described in the first aspect of the present application are implemented.

[0020] A fourth aspect of an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method described in the first aspect of the present application are implemented.

[0021] Using the port opening method provided by the present application, the service software receives a global configuration file, the global configuration file includes the network address and port blacklist corresponding to the service software, and all ports in the network address are opened ports; the service software sends the forwarding rules corresponding to the global configuration file to the kernel; the service software receives the domain name port information corresponding to the newly added port; when the kernel receives an access request for the newly added port, the access request is verified according to the forwarding rules; when the kernel passes the verification, the access request is sent to the service software; when the access request conforms to the domain name port information, the service software returns a corresponding response message.

[0022] In this method, the corresponding network address and port blacklist are configured for the service software through global configuration. All ports in the network address are open ports. When the service software receives the newly added port information, it can provide the port service to the corresponding customer. When the user accesses the port, as long as the forwarding rule is hit, the service software is accessed through the corresponding port. The forwarding of all ports is realized at the operating system level, providing customers with self-service new port services and improving the efficiency of opening the service software ports. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0024] Figure 1 is a flow chart of a port opening method proposed in an embodiment of the present application; Figure 2 It is a schematic diagram of a port opening system proposed in an embodiment of the present application; Figure 3 This is a schematic diagram of the interaction between the kernel and the service program proposed in an embodiment of the present application; Figure 4 is a request verification flow chart proposed in an embodiment of the present application; Figure 5 This is a schematic diagram of a self-service port activation process proposed in an embodiment of the present application; Figure 6 It is a schematic diagram of a process of accelerating the opening of any multiple ports proposed in an embodiment of the present application; Figure 7 is a schematic diagram of a port opening device proposed in an embodiment of the present application; Figure 8 It is a schematic diagram of an electronic device proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] refer to Figure 1 , Figure 1 FIG. 1 is a flow chart of a port opening method proposed in an embodiment of the present application. Figure 1As shown, the method comprises the following steps: S11: The service software receives a global configuration file, wherein the global configuration file includes a network address corresponding to the service software and a port blacklist, and all ports in the network address are open ports.

[0027] In this embodiment, the service software is software that provides network services to users in the network and is located in the service device. The global configuration file is a file that configures the network addresses and ports available to the service software.

[0028] The Internet Protocol Address is a unique digital identifier assigned to each device on the network, similar to a house number in the real world. It is used to locate and identify specific devices in the network to ensure that data can reach the destination along the correct path. IP addresses are divided into two versions: IPv4 and IPv6. IPv4 uses 32-bit binary numbers, usually expressed in dotted decimal form (such as 192.168.1.1), while IPv6 uses 128-bit binary numbers, expressed in dotted hexadecimal form (such as 2001:0db8:85a3:0000:0000:8a2e:0370:7334). The port number is used to distinguish different applications or services on the same device. The port number ranges from 0 to 65535, of which 0 to 1023 are well-known ports, usually occupied by the operating system or specific applications, while ports above 1024 are dynamic ports or private ports, which can be customized by the user. The main functions of port numbers include service differentiation, session management, and security control, ensuring that data can be correctly delivered to the target application. In network communications, IP addresses and port numbers together constitute the target address in network communications. When a data packet is sent, in addition to the IP address of the target device, it is also necessary to specify the specific application or service on the target device, which relies on the port number. For example, a typical network communication target address may be 192.168.0.1:80, where 192.168.0.1 is the IP address of the target device, and 80 is the HTTP service (port number) running on the target device. The port blacklist is a list of port numbers that the service software denies access to.

[0029] In this embodiment, reference Figure 2 , Figure 2 Schematic diagram of a port opening system proposed in an embodiment of the present application. Figure 2 As shown, the system includes a kernel port forwarding module and a service software module. The kernel port forwarding module includes: a port forwarding rule execution module, a port forwarding rule storage module, and a port forwarding rule control interface.

[0030] In this embodiment, the Linux kernel eBPF sk_lookup technology is used to implement the kernel eBPF program with the following functions: a port forwarding rule execution module runs independently of the service software and needs to be started before the service software is started. The module implements the function of creating a storage module mapping table and executing forwarding rules.

[0031] The kernel eBPF sk_lookup program creates multiple forwarding rule mapping tables, namely the port forwarding rule storage module in the figure above. The module can contain specific port forwarding rules and blacklist rules. The port forwarding rule control interface module implements the initialization / cleanup of the ebpf environment, redirection rule delivery, redirection rule deletion and other functions, and exposes the corresponding API interface to the service software. The module shares the rule data of the port forwarding rule storage module with the port forwarding rule execution module. The module depends on the operation of the port forwarding rule execution module. If the port forwarding rule execution module is not operating, the port forwarding rule control interface module will fail to start.

[0032] The service software module includes the service software configuration management module, the service software port monitoring module, and the port forwarding rule setting module. When the service software starts, it needs to call the initialization interface provided by the kernel port forwarding rule control interface to initialize the Linux ebpf environment. The interface will determine whether the eBPF sk_lookup prog (that is, the kernel forwarding module) has been running. If it has not been running, an error will be returned. The service software will determine whether to fail the entire startup according to the situation. The service software port monitoring module monitors a specific IP:PORT (configurable), such as 127.0.0.1:12345. After monitoring, it obtains the unique FD (port information) of the port from the Linux kernel to handle the connection redirected by the kernel port forwarding execution module.

[0033] In this embodiment, the service software configuration management module configures the redirection rule (the rule for forwarding data). The key of the redirection rule is the destination IP address (IPv4 / IPv6), and the value is the listening IP:POR configured in 2. The value needs to be converted by the gateway to the corresponding listening socket fd. The redirection rules are divided into whitelist and blacklist. The whitelisted ones are forwarded according to the rules, and the blacklisted ones are directly rejected.

[0034] In this embodiment, the service software port forwarding rule setting module reads the forwarding rule data of the service software configuration management module and the FD of the service software port listening module, and then needs to call the interface provided by the kernel port forwarding rule control interface to send the redirection rule to the port forwarding rule execution module. The timing of sending is after the listen() system call, which can be: 1) when the service software is started or the configuration is reloaded. 2) During the operation, use the command to add separately.

[0035] In this embodiment, the service software first receives a global configuration file, which includes network addresses that the service software can use and a port blacklist corresponding to the service software, which includes port numbers that are denied access.

[0036] refer to Figure 3 , Figure 3 is a schematic diagram of the interaction between the kernel and the service program proposed in an embodiment of the present application, such as Figure 3 As shown, the port forwarding program in the kernel sends data to the FD of the listening port, the business service program receives the global configuration file sent by the rule setting structure, calls the kernel forwarding rule control interface to issue forwarding rules, and the port forwarding program also obtains forwarding rules from the port forwarding rule storage interface.

[0037] For example, the global configuration file defines that all or part of the ports of the network address 1.1.1.1 are available, and the blacklist stipulates that ports 21 and 22 of the network address 2.2.2.2 are unavailable.

[0038] S12: The service software sends the forwarding rules corresponding to the global configuration file to the kernel.

[0039] In this embodiment, the service software reads the global configuration file and determines the forwarding rules, that is, determines which ports are open ports and which ports are blacklisted ports, and then calls the port forwarding rule control interface in the kernel to send the forwarding rules to the port forwarding rule storage module in the kernel.

[0040] In this embodiment, the specific steps of the service software sending the forwarding rule corresponding to the global configuration file to the kernel include: S12-1: The service software generates the forwarding rule according to the network address and the blacklist port in the global configuration file.

[0041] In this embodiment, the service software generates corresponding forwarding rules based on the network address and port blacklist in the global configuration file. In the forwarding rules, it is stipulated that the network address of the access request must conform to the network address in the rule. If the access request accesses a port number in the port blacklist, the request is rejected.

[0042] For example, the port forwarding rules specify which IPs' full ports or partial ports are forwarded to the corresponding service software's FD; the blacklist rules specify certain IPs or certain IPs+ports to directly deny services. For example, the rule defines that all ports of IP 1.1.1.1 are forwarded to FD1 corresponding to port 12345 of service software 1. Ports 5000~6000 and port 8888 of IP 2.2.2.2 are forwarded to FD2 corresponding to port 2345 of service software 2. Ports 21 and 22 of IP 3.3.3.3 are blacklisted. When a user accesses the port, the kernel directly refuses access.

[0043] S12-2: The service software sends the forwarding rule to the kernel.

[0044] In this embodiment, the service software calls the port forwarding rule control interface to send the forwarding rule to the port forwarding rule storage module.

[0045] S13: The service software receives the domain name port information corresponding to the newly added port.

[0046] In this embodiment, the newly added port is a port added by a customer of the service software on the service software, and the domain name port information is the port number of the domain name of the service provided by the service software to the customer.

[0047] In this embodiment, the customer can add a special port by himself on the customer console, and the customer console generates the domain name port information corresponding to the port through the domain name configuration system.

[0048] In this embodiment, after obtaining the global configuration file, the service software can determine the network address that can provide services. All ports in the network address can be used. When a user accesses a port in the network address, if the access request is resolved to be the address and port corresponding to the client, it will respond normally. If it is a port corresponding to another client, an exception message will be returned.

[0049] S14: When the kernel receives the access request for the newly added port, the kernel verifies the access request according to the forwarding rule.

[0050] In this embodiment, when the kernel receives an access request for a newly added port, it verifies the access request through forwarding rules to determine whether the network address and port corresponding to the access request are the usable network address and port provided by the service software to the customer.

[0051] In this embodiment, when the kernel receives an access request for the newly added port, the specific steps of verifying the access request according to the forwarding rule include: S14-1: The kernel parses the access request to determine the network address and port number corresponding to the access request.

[0052] In this embodiment, reference Figure 4 , Figure 4 is a request verification flow chart proposed in an embodiment of the present application, such as Figure 4 As shown, the kernel parses the access request and determines the network address and port number (vip:port) corresponding to the access request.

[0053] S14-2: The kernel determines whether the network address corresponding to the network request and the port number match the port blacklist.

[0054] In this embodiment, Figure 4 As shown, the kernel determines whether the network address and port number corresponding to the network request are in the port blacklist.

[0055] S14-3: The kernel rejects the access request when the network address and the port number corresponding to the access request match the port blacklist.

[0056] In this embodiment, Figure 4 As shown, when the network address and port number are in the port blacklist, access is directly denied and reset information is returned.

[0057] S14-4: When the network address and the port number do not match the port blacklist, the kernel determines whether the network address corresponding to the access request matches the network address specified in the forwarding rule.

[0058] In this embodiment, Figure 4 As shown, when the network address and the port number are not in the port blacklist, it is determined whether the network address is in the forwarding rule.

[0059] S14-5: The kernel determines that the access request passes the verification when the network address corresponding to the access request matches the network address specified in the forwarding rule.

[0060] In this embodiment, Figure 4 As shown, if the network address is within the forwarding rule, the access request is forwarded to the service software.

[0061] S14-6: When the network address corresponding to the access request does not match the network address specified in the forwarding rule, the kernel determines whether the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule.

[0062] In this embodiment, Figure 4 As shown, the forwarding rules are set in a hierarchical manner. You can set it to filter information only by network address, or you can set it to filter information by a combination of network address and port number. For example, set 1.1.1.1 as the address in the rule, and set 2.2.2.2:1234 as the combination of network address and port number in the rule. Therefore, when the network address in the access request does not match the forwarding rule, it is also necessary to verify whether the combination of network address and port number in the access request matches the forwarding rule. When the network address corresponding to the access request does not match the network address specified in the forwarding rule, the kernel determines whether the combination of network address and port number corresponding to the access request matches the combination of network address and port number specified in the forwarding rule.

[0063] S14-7: The kernel determines that the access request passes the verification if the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule.

[0064] In this embodiment, Figure 4 As shown, the kernel forwards the access request to the service software when the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule.

[0065] S14-8: The kernel rejects the access request if the combination of the network address and the port number corresponding to the access request does not match the combination of the network address and the port number specified in the forwarding rule.

[0066] In this embodiment, Figure 4 As shown, when the combination of network address and port number corresponding to the access request does not match the combination of network address and port number specified in the forwarding rule, the kernel directly bypasses the request and denies access.

[0067] S15: When the verification is successful, the kernel sends the access request to the service software.

[0068] In this embodiment, when the verification is passed, the kernel sends the access request to the service software.

[0069] S16: When the access request matches the domain name and port information, the service software returns a corresponding response message.

[0070] In this embodiment, the service software returns a corresponding response message when the access request conforms to the domain name and port information.

[0071] In this embodiment, the service software needs to determine that the access request is a request sent by the user corresponding to the client, and the port accessed is supported by the client, that is, the access request conforms to the domain name port information, and then returns the corresponding response message.

[0072] For example, refer to Figure 5 , Figure 5 : is a schematic diagram of a self-service port activation process proposed in an embodiment of the present application, such as Figure 5 As shown in the figure, the scheduling planning system plans 1.1.1.1IP as a full-port self-service VIP, and all port requests of this IP are forwarded to the service software. At the same time, ports 21 and 22 of this IP are planned as blacklist ports. The global configuration management system generates a global configuration file based on the planning information in step 1 and sends it to the service software. The service software reads the global configuration file, calls the kernel forwarding program interface, and sets the forwarding rules. At this point, the initial environment is ready and can accept the customer's self-service added port. The customer adds a special port 5678 in the console and specifies the port for https service. The console gives the port information to the configuration system. Based on the information in the previous step, the configuration system generates the customer's domain name port information 5678:https and sends it to the service software. At this point, the customer successfully adds a self-service port. The user visits https: / / 1.1.1.1:5678, and the kernel forwarding program forwards the request to the service program according to the forwarding rules set in step 3. The service program checks that the port exists in the customer configuration and the protocol is compliant, and responds to the request.

[0073] In this embodiment, a full port forwarding device is implemented through eBPF technology at the operating system kernel level, and a device that interacts with the device in step 1 is implemented at the user state level of the operating system, which can perform fine-grained control over ports and IPs. A set of interfaces that can interact with service software on the device is implemented at the user state level of the operating system. The service software can guide specific traffic to its own service through the interface, thereby enabling customers to open ports by themselves and improving the speed of port opening.

[0074] In another embodiment of the present application, the method further includes: S21: The service software determines a corresponding listening port according to the received listening port setting information.

[0075] In this embodiment, the monitoring port setting information is set by the user to set the port to be monitored.

[0076] In this embodiment, a port to be monitored may be set in the service software, and the service software determines the port to be monitored according to the received monitoring port setting information.

[0077] S22: The service software sends the port information corresponding to the monitoring port to the kernel.

[0078] In this embodiment, after determining the listening port, the service software sends the corresponding port information to the kernel, including information such as the port number.

[0079] S23: When the kernel receives an access request for the network address corresponding to the service software, the kernel sends the access request to the listening port.

[0080] In summary, in this embodiment, when the kernel receives an access request for the network address corresponding to the service software, it sends the access request to the listening port. All access requests to the network address are forwarded to the same listening port. In this way, only one port needs to be listened to, and there is no need to listen to each port.

[0081] In this embodiment, the service software can provide services to the corresponding special port without reloading at the configuration level, and the service software only needs to listen to one specific port.

[0082] For example, refer to Figure 6 , Figure 6 FIG. 1 is a flow chart of accelerating the opening of any number of ports proposed in an embodiment of the present application. Figure 6 As shown in the figure, the planning system plans the 1.1.1.1 IP for the customer to use. The customer can specify the port corresponding to the IP and set different response logic. The listening port set by the service software is 127.0.0.1:12345, which transmits the FD information to the kernel forwarding program. When the user accesses any port of 1.1.1.1, the kernel forwarding program can forward the request to the service software without the service software having to monitor all ports by itself.

[0083] In this embodiment, the method further includes: S24: when the kernel detects that the listening port is closed, deleting the relevant information of the listening port.

[0084] In this embodiment, when the kernel detects that the listening port is closed, it deletes the relevant rules and information of the listening port and no longer forwards the access request to the listening port.

[0085] Similarly, if a particular port is closed, the service software needs to call the deletion interface provided by the kernel port forwarding rule control interface to delete the relevant rules.

[0086] In this embodiment, when the service software reloads the configuration, if the port is re-monitored, after the new port monitoring is created, the redirection rules need to be updated. To update the rules in the port forwarding rule storage module to the fd of the new monitoring port, the new monitoring rules need to be loaded first, and then the old monitoring rules need to be deleted, otherwise the redirection rules will be empty for a period of time.

[0087] In another embodiment of the present application, before the service software receives the global configuration file, the method further includes: S31: The scheduling system specifies the corresponding network address for the service software, and formulates the port blacklist corresponding to the network address.

[0088] In this embodiment, the scheduling system is a system that specifies a network address for the service software on the server side.

[0089] In this embodiment, the scheduling system specifies a corresponding network address for the service software, and customizes a port blacklist corresponding to the network address.

[0090] S32: The scheduling system sends the network address and the port blacklist to the global configuration system.

[0091] In this embodiment, the global configuration system is a system for globally configuring services provided by the service device.

[0092] In this embodiment, the scheduling system sends the network address and the port blacklist to the global configuration system.

[0093] S33: The global configuration system generates the global configuration file according to the network address and the port blacklist.

[0094] In this embodiment, the global configuration system generates a global configuration file according to the received network address and blacklist.

[0095] In this embodiment, the method further includes: S34: the client console receives a request for adding a new port sent by the client.

[0096] In this embodiment, the client console is a platform for clients to operate the service software.

[0097] In this embodiment, the client console receives a request for adding a new port from a client, and the request includes the number of the port to be added.

[0098] S35: The client console parses the newly added port request to obtain corresponding newly added port information.

[0099] In this embodiment, the client console parses the newly added port request to obtain corresponding newly added port information, which includes the port number, the services supported by the port, and other information.

[0100] S36: The customer console sends the newly added port information to the port configuration system.

[0101] In this embodiment, the configuration system is used to configure a corresponding domain name for a newly added port.

[0102] In this embodiment, the client console sends the newly added port information to the port configuration system.

[0103] S37: The port configuration system generates the domain name port information according to the newly added port information.

[0104] In this embodiment, the port configuration system determines the port number and the port is used for https service according to the newly added port information, and then generates corresponding domain name port information, such as 5678:https, and then sends it to the service software.

[0105] In the above embodiments of the present application, by setting the listening port, full port listening of a specific network address is realized, the consumption of server resources is reduced, and the request corresponding to the specific network address or the request of the specific network address + port can be forwarded to the service software in full, and there is no processing in the middle. The kernel four-tuple obtained by the service software is the original four-tuple, and the service software only needs to perform a small amount of adaptation. It is realized that all specific IP ports on the server are open to customers for use. In the scenario of application acceleration, customers can arbitrarily select the required ports for use without the need for the service software to read and reload the global configuration. The service software only needs to read the specific configuration of a specific customer when needed. It realizes the self-service opening of the client port, which improves the port opening speed.

[0106] Based on the same inventive concept, an embodiment of the present application provides a port opening device. Figure 7 , Figure 7 FIG. 7 is a schematic diagram of a port opening device 700 proposed in an embodiment of the present application. Figure 7 As shown, the device comprises: The file receiving module 701 is used for the service software to receive a global configuration file, wherein the global configuration file includes a network address and a port blacklist corresponding to the service software, and all ports in the network address are open ports; A first sending module 702, configured for the service software to send the forwarding rule corresponding to the global configuration file to the kernel; The port information receiving module 703 is used for the service software to receive the domain name port information corresponding to the newly added port; A verification module 704, configured for the kernel to verify the access request for the newly added port according to the forwarding rule when the kernel receives the access request; A first request forwarding module 705, configured for the kernel to send the access request to the service software if the verification is successful; The message returning module 706 is used for the service software to return a corresponding response message when the access request conforms to the domain name and port information.

[0107] Optionally, the device further comprises: A monitoring port determination module, used for the service software to determine the corresponding monitoring port according to the received monitoring port setting information; A second sending module, used for the service software to send the port information corresponding to the listening port to the kernel; The second request forwarding module is used for the kernel to send the access request to the listening port when receiving the access request for the network address corresponding to the service software.

[0108] Optionally, the device further includes: an information deleting module, configured for the kernel to delete relevant information of the listening port when detecting that the listening port is closed.

[0109] Optionally, the device further comprises: An information designation module, used for the scheduling system to designate the corresponding network address for the service software, and to formulate the port blacklist corresponding to the network address; A third sending module, used for the scheduling system to send the network address and the port blacklist to the global configuration system; The file generation module is used for the global configuration system to generate the global configuration file according to the network address and the port blacklist.

[0110] Optionally, the device further comprises: a new request receiving module, configured for the client console to receive a new port request sent by a client; A new request parsing module is used for the client console to parse the new port request to obtain the corresponding new port information; A fourth sending module, used for the client console to send the newly added port information to the port configuration system; The information generation module is used for the port configuration system to generate the domain name port information according to the newly added port information.

[0111] Optionally, the first sending module includes: A forwarding rule generation submodule, used for the service software to generate the forwarding rule according to the network address and the blacklist port in the global configuration file; The rule sending submodule is used for the service software to send the forwarding rule to the kernel.

[0112] Optionally, the request verification module includes: A request parsing submodule, used for the kernel to parse the access request and determine the network address and port number corresponding to the access request; A first verification submodule, used by the kernel to determine whether the network address corresponding to the network request and the port number match the port blacklist; A first rejection submodule, configured for the kernel to reject the access request when the network address and the port number corresponding to the access request match the port blacklist; A second verification submodule, configured for the kernel to determine whether the network address corresponding to the access request matches the network address specified in the forwarding rule when the network address and the port number do not match the port blacklist; A first pass verification submodule, configured for the kernel to determine that the access request passes verification when the network address corresponding to the access request matches the network address specified in the forwarding rule; a third verification submodule, configured for the kernel to determine, if the network address corresponding to the access request does not match the network address specified in the forwarding rule, whether the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule; A second pass verification submodule, configured for the kernel to determine that the access request passes verification if the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule; The second rejection submodule is used for the kernel to reject the access request when the combination of the network address and the port number corresponding to the access request does not match the combination of the network address and the port number specified in the forwarding rule.

[0113] Based on the same inventive concept, another embodiment of the present application provides a readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the port opening method described in any of the above embodiments of the present application are implemented.

[0114] Based on the same inventive concept, another embodiment of the present application provides an electronic device, Figure 8 It is a schematic diagram of an electronic device 800 proposed in an embodiment of the present application, including a memory 801, a processor 802 and a computer program stored in the memory and executable on the processor, and when the processor executes, the steps in the port opening method described in any of the above embodiments of the present application are implemented.

[0115] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0116] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0117] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0118] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0119] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0120] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0121] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0122] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0123] The port opening method, device, equipment and storage medium provided by the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A port opening method, characterized in that: The method comprises: The service software receives a global configuration file, wherein the global configuration file includes a network address corresponding to the service software and a port blacklist, wherein all ports in the network address are open ports; The service software sends the forwarding rules corresponding to the global configuration file to the kernel; The service software receives the domain name port information corresponding to the newly added port; When receiving an access request for the newly added port, the kernel verifies the access request according to the forwarding rule; When the verification is successful, the kernel sends the access request to the service software; The service software returns a corresponding response message when the access request conforms to the domain name and port information.

2. The port opening method according to claim 1, characterized in that: The method further comprises: The service software determines the corresponding listening port according to the received listening port setting information; The service software sends the port information corresponding to the monitoring port to the kernel; When receiving an access request for the network address corresponding to the service software, the kernel sends the access request to the listening port.

3. The port opening method according to claim 2, characterized in that: The method further includes: when the kernel detects that the listening port is closed, deleting the relevant information of the listening port.

4. The port opening method according to claim 1, characterized in that: Before the service software receives the global configuration file, the method further includes: The scheduling system specifies the corresponding network address for the service software, and formulates the port blacklist corresponding to the network address; The scheduling system sends the network address and the port blacklist to the global configuration system; The global configuration system generates the global configuration file according to the network address and the port blacklist.

5. The port opening method according to claim 4, characterized in that: The method further comprises: the client console receiving a request for adding a new port sent by the client; The client console parses the newly added port request to obtain corresponding newly added port information; The client console sends the newly added port information to the port configuration system; The port configuration system generates the domain name port information according to the newly added port information.

6. The port opening method according to claim 1, characterized in that: The service software sends the forwarding rules corresponding to the global configuration file to the kernel, including: The service software generates the forwarding rule according to the network address and the blacklist port in the global configuration file; The service software sends the forwarding rules to the kernel.

7. The port opening method according to claim 1, characterized in that: When receiving the access request for the newly added port, the kernel verifies the access request according to the forwarding rule, including: The kernel parses the access request to determine the network address and port number corresponding to the access request; The kernel determines whether the network address corresponding to the network request and the port number match the port blacklist; The kernel rejects the access request if the network address and the port number corresponding to the access request match the port blacklist; The kernel determines, when the network address and the port number do not match the port blacklist, whether the network address corresponding to the access request matches the network address specified in the forwarding rule; The kernel determines that the access request passes verification if the network address corresponding to the access request matches the network address specified in the forwarding rule; The kernel determines, if the network address corresponding to the access request does not match the network address specified in the forwarding rule, whether the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule; The kernel determines that the access request passes verification if the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule; The kernel rejects the access request if the combination of the network address and the port number corresponding to the access request does not match the combination of the network address and the port number specified in the forwarding rule.

8. A port opening device, characterized in that: The device comprises: A file receiving module, used for the service software to receive a global configuration file, wherein the global configuration file includes a network address and a port blacklist corresponding to the service software, and all ports in the network address are open ports; A rule sending module, used for the service software to send the forwarding rules corresponding to the global configuration file to the kernel; A port information receiving module, used for the service software to receive domain name port information corresponding to the newly added port; A verification module, configured to verify, when the kernel receives an access request for the newly added port, the access request according to the forwarding rule; A request forwarding module, used for the kernel to send the access request to the service software when the verification is passed; The message return module is used for the service software to return a corresponding response message when the access request conforms to the domain name and port information.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps in the method according to any one of claims 1 to 7 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images