A port opening method, device, apparatus and storage medium

Abstract

Embodiments of the present application relate to the technical field of cloud computing, in particular to a port opening method and device, equipment and storage medium, aiming to improve the port opening efficiency. The method comprises: a service software receives a global configuration file, wherein the global configuration file includes a network address corresponding to the service software and a port blacklist, all ports in the network address are open ports; the service software sends a forwarding rule corresponding to the global configuration file to a kernel; the service software receives domain name port information corresponding to an added port; the kernel verifies an access request for the added port according to the forwarding rule; the kernel sends the access request to the service software if the verification is passed; and the service software returns a corresponding response message if the access request meets the domain name port information.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and more specifically, to a port opening method, apparatus, device, and storage medium. Background Technology

[0002] In the fields of internet edge security, CDN, and cloud computing, when providing content forwarding or security services to customers, clients often need to open special ports other than 80 (HTTP) and 443 (HTTPS). Current technology requires adding this special port to a configuration file, then distributing it to the service device, requiring the service software to reload the configuration file, and finally having the system listen on the special port and open the server firewall before the special port can provide external services.

[0003] In existing technologies, port opening cycles are long and the opening process is cumbersome. Furthermore, due to the issue of global software configuration distribution, it is impossible for customers to open ports themselves. In application acceleration scenarios, customers have a stronger demand for special ports, often requiring the opening of tens of thousands of special ports. If these ports are all listened to by the service software, the service software will face significant performance issues. Not only will it be impossible for customers to open special ports themselves, but it may even cause service software malfunctions due to performance problems, affecting the customer's user experience. Summary of the Invention

[0004] This application provides a port opening method, apparatus, device, and storage medium, aiming to improve port opening efficiency.

[0005] A first aspect of this application provides a port opening method, the method comprising:

[0006] The service software receives a global configuration file, which includes the network address and port blacklist corresponding to the service software. All ports in the network address are open ports.

[0007] The service software sends the forwarding rules corresponding to the global configuration file to the kernel;

[0008] The service software receives the domain name and port information corresponding to the newly added port.

[0009] When the kernel receives an access request for the newly added port, it verifies the access request according to the forwarding rules.

[0010] If the verification is successful, the kernel will send the access request to the service software.

[0011] The service software returns a corresponding response message if the access request matches the domain name port information.

[0012] Optionally, the method further comprises:

[0013] The service software determines a corresponding listening port according to the received listening port setting information.

[0014] The service software sends the port information corresponding to the listening port to the kernel.

[0015] The kernel sends an access request to the listening port if the access request is received for the network address corresponding to the service software.

[0016] Optionally, the method further comprises: the kernel deletes the related information of the listening port if it is detected that the listening port is closed.

[0017] Optionally, before the service software receives the global configuration file, the method further comprises:

[0018] The scheduling system specifies a corresponding network address for the service software, and formulates a port blacklist corresponding to the network address.

[0019] The scheduling system sends the network address and the port blacklist to a global configuration system.

[0020] The global configuration system generates the global configuration file according to the network address and the port blacklist.

[0021] Optionally, the method further comprises: a customer console receives an added port request sent by a customer.

[0022] The customer console parses the added port request to obtain corresponding added port information.

[0023] The customer console sends the added port information to a port configuration system.

[0024] The port configuration system generates the domain name port information according to the added port information.

[0025] Optionally, the service software sends a forwarding rule corresponding to the global configuration file to the kernel, comprising:

[0026] The service software generates the forwarding rule according to the network address and the blacklist port in the global configuration file.

[0027] The service software sends the forwarding rule to the kernel.

[0028] Optionally, the kernel verifies the access request according to the forwarding rule in the case of receiving the access request for the new port, including:

[0029] The kernel parses the access request to determine the network address and the port number corresponding to the access request;

[0030] The kernel determines whether the network address and the port number corresponding to the network request match the port blacklist;

[0031] The kernel rejects the access request in the case that the network address and the port number corresponding to the access request match the port blacklist;

[0032] The kernel determines whether the network address corresponding to the access request matches the network address specified in the forwarding rule in the case that the network address and the port number do not match the port blacklist;

[0033] The kernel determines that the access request passes the verification in the case that the network address corresponding to the access request matches the network address specified in the forwarding rule;

[0034] The kernel determines whether the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule in the case that the network address corresponding to the access request does not match the network address specified in the forwarding rule;

[0035] The kernel determines that the access request passes the verification in the case that the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule;

[0036] The kernel rejects the access request in the case that the combination of the network address and the port number corresponding to the access request does not match the combination of the network address and the port number specified in the forwarding rule.

[0037] The second aspect of the embodiments of the present application provides a port opening device, the device comprising:

[0038] A file receiving module is configured to receive a global configuration file by the service software, wherein the global configuration file comprises a network address corresponding to the service software and a port blacklist, and all the ports in the network address are open ports;

[0039] A first sending module is configured to send a forwarding rule corresponding to the global configuration file to the kernel by the service software;

[0040] The port information receiving module is configured to receive domain name port information corresponding to the added port by the service software.

[0041] The verification module is configured to verify the access request according to the forwarding rule when the kernel receives the access request for the added port.

[0042] The first request forwarding module is configured to send the access request to the service software when the verification is passed.

[0043] The message returning module is configured to return a corresponding response message when the access request meets the domain name port information.

[0044] Optionally, the apparatus further comprises:

[0045] The listening port determining module is configured to determine a corresponding listening port according to the received listening port setting information by the service software.

[0046] The second sending module is configured to send port information corresponding to the listening port to the kernel by the service software.

[0047] The second request forwarding module is configured to send the access request to the listening port when the kernel receives an access request for the network address corresponding to the service software.

[0048] Optionally, the apparatus further comprises an information deleting module configured to delete related information of the listening port when the kernel detects that the listening port is closed.

[0049] Optionally, the apparatus further comprises:

[0050] The information specifying module is configured to specify the network address corresponding to the service software and the port blacklist corresponding to the network address by the scheduling system.

[0051] The third sending module is configured to send the network address and the port blacklist to a global configuration system by the scheduling system.

[0052] The file generating module is configured to generate the global configuration file according to the network address and the port blacklist by the global configuration system.

[0053] Optionally, the apparatus further comprises an added request receiving module configured to receive an added port request sent by a client by a client console.

[0054] The added request analyzing module is configured to analyze the added port request to obtain corresponding added port information by the client console.

[0055] a fourth sending module, configured to send, by the client console, the added port information to a port configuration system;

[0056] an information generating module, configured to generate, by the port configuration system, the domain name port information according to the added port information.

[0057] Optionally, the first sending module comprises:

[0058] a forwarding rule generating submodule, configured to generate, by the service software, the forwarding rule according to the network address in the global configuration file and the blacklisted port;

[0059] a rule sending submodule, configured to send, by the service software, the forwarding rule to the kernel.

[0060] Optionally, the request verifying module comprises:

[0061] a request analyzing submodule, configured to analyze, by the kernel, the access request to determine a network address and a port number corresponding to the access request;

[0062] a first verifying submodule, configured to determine, by the kernel, whether the network address and the port number corresponding to the network request match the port blacklist;

[0063] a first rejecting submodule, configured to reject, by the kernel, the access request in a case where the network address and the port number corresponding to the access request match the port blacklist;

[0064] a second verifying submodule, configured to determine, by the kernel, whether the network address corresponding to the access request matches a network address specified in the forwarding rule in a case where the network address and the port number do not match the port blacklist;

[0065] a first passing verifying submodule, configured to determine, by the kernel, that the access request passes verification in a case where the network address corresponding to the access request matches the network address specified in the forwarding rule;

[0066] a third verifying submodule, configured to determine, by the kernel, whether a combination of the network address and the port number corresponding to the access request matches a combination of the network address and the port number specified in the forwarding rule in a case where the network address corresponding to the access request does not match the network address specified in the forwarding rule;

[0067] a second passing verifying submodule, configured to determine, by the kernel, that the access request passes verification in a case where the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule.

[0068] The second rejection submodule is configured to reject the access request in a case where the combination of the network address and the port number corresponding to the access request does not match the combination of the network address and the port number specified in the forwarding rule.

[0069] The third aspect of the embodiments of the present application provides a readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps in the method according to the first aspect of the present application.

[0070] The fourth aspect of the embodiments of the present application provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to the first aspect of the present application when executing the computer program.

[0071] The port opening method provided by the present application is adopted, the service software receives a global configuration file, the global configuration file includes a network address corresponding to the service software and a port blacklist, all the ports in the network address are open ports; the service software sends a forwarding rule corresponding to the global configuration file to a kernel; the service software receives domain name port information corresponding to an added port; the kernel, in a case where an access request for the added port is received, verifies the access request according to the forwarding rule; the kernel, in a case where the verification is passed, sends the access request to the service software; and the service software, in a case where the access request meets the domain name port information, returns a corresponding response message.

[0072] In the method, the corresponding network address and the port blacklist are configured for the service software by global configuration, all the ports in the network address are open ports, when the service software receives the added port information, the corresponding customer can be provided with the port service, and when the user accesses the port, as long as the forwarding rule is hit, the corresponding port is used to access the service software, the forwarding of all the ports is implemented at the operating system level, the self-service of adding the port is provided for the customer, and the efficiency of opening the port of the service software is improved. BRIEF DESCRIPTION OF DRAWINGS

[0073] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0074] Figure 1 is a flowchart of the port opening method according to an embodiment of the present application;

[0075] Figure 2 is a port opening system schematic diagram proposed by an embodiment of the present application;

[0076] Figure 3 is a kernel and service program interaction schematic diagram proposed by an embodiment of the present application;

[0077] Figure 4 is a request verification flowchart proposed by an embodiment of the present application;

[0078] Figure 5 is a port self-service opening flowchart schematic diagram proposed by an embodiment of the present application;

[0079] Figure 6 is a flowchart schematic diagram of accelerating opening of any multiple ports proposed by an embodiment of the present application;

[0080] Figure 7 is a port opening device schematic diagram proposed by an embodiment of the present application;

[0081] Figure 8 is an electronic device schematic diagram proposed by an embodiment of the present application. DETAILED DESCRIPTION

[0082] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by those of ordinary skill in the art without any creative work fall within the scope of protection of the present application.

[0083] Reference Figure 1 , Figure 1 is a flowchart of a port opening method proposed by an embodiment of the present application. As shown in Figure 1 , the method comprises the following steps:

[0084] S11: The service software receives a global configuration file, wherein the global configuration file comprises a network address corresponding to the service software and a port blacklist, and all the ports in the network address are open ports.

[0085] In the embodiment, the service software is software for providing network service for users in the network, and is located in a service device. The global configuration file is a file for configuring the network address and ports available to the service software.

[0086] A network address (Internet Protocol address) is a unique numerical identifier assigned to every device on a network, similar to a house number in the real world. It is used to locate and identify specific devices on the network, ensuring that data reaches its destination along the correct path. IP addresses come in two versions: IPv4 and IPv6. IPv4 uses 32-bit binary numbers, typically represented in dotted decimal notation (e.g., 192.168.1.1), while IPv6 uses 128-bit binary numbers, represented in colon-hexadecimal notation (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334). A port number is used to distinguish different applications or services on the same device. Port numbers range from 0 to 65535, with 0-1023 being well-known ports, usually occupied by the operating system or specific applications, while ports above 1024 are dynamic or private ports that can be user-defined. The primary functions of port numbers include service differentiation, session management, and security control, ensuring that data is delivered correctly to the target application. In network communication, IP addresses and port numbers together constitute the destination address. When a data packet is sent, in addition to containing the IP address of the target device, it also needs to specify the specific application or service on the target device, which relies on the port number. For example, a typical network communication destination address might be 192.168.0.1:80, where 192.168.0.1 is the IP address of the target device, and 80 is the HTTP service (port number) running on the target device. A port blacklist is a list of port numbers that service software denies access to.

[0087] In this embodiment, reference Figure 2 , Figure 2 This is a schematic diagram of a port opening system proposed in an embodiment of this application, as shown below. Figure 2 As shown, the system includes a kernel port forwarding module and a service software module. The kernel port forwarding module includes: a port forwarding rule execution module, a port forwarding rule storage module, and a port forwarding rule control interface.

[0088] In this embodiment, the Linux kernel eBPF program, implemented using the eBPF sk_lookup technology, performs the following functions: a port forwarding rule execution module, which runs independently of the service software and needs to be started before the service software starts. The module creates a storage module mapping table and executes forwarding rules.

[0089] The kernel eBPF sk_lookup program creates a plurality of forwarding rule mapping tables, i.e., the port forwarding rule storage module in the above figure, which can contain specific port forwarding rules and blacklist rules. The port forwarding rule control interface module implements initialization / cleanup of the ebpf environment, redirection rule issuing, redirection rule deleting, and the like, and exposes corresponding API interfaces to service software. The module shares rule data of the port forwarding rule storage module with the port forwarding rule execution module, and depends on the operation of the port forwarding rule execution module. If the port forwarding rule execution module is not operating, the port forwarding rule control interface module will fail to start.

[0090] The service software module includes a service software configuration management module, a service software port listening module, and a port forwarding rule setting module. When the service software starts, an initialization interface provided by the kernel port forwarding rule control interface needs to be called to initialize the Linux ebpf environment. The interface will determine whether the eBPF sk_lookup prog (i.e., the kernel forwarding module) has been running. If not, an error will be returned. The service software determines whether to start completely according to the situation. The service software port listening module listens to a specific IP:PORT (configurable), such as 127.0.0.1:12345. After listening, the unique FD (port information) of the port is obtained from the Linux kernel to process the connection redirected by the kernel port forwarding execution module.

[0091] In this embodiment, the service software configuration management module configures redirection rules (rules for forwarding data). The key of the redirection rule is the destination IP address (IPv4 / IPv6), and the value is the IP:PORT configured in item 2. The value needs to be converted into the fd of the corresponding listening socket by the gateway. The redirection rule is divided into a whitelist and a blacklist. The hit whitelist is forwarded according to the rule, and the hit blacklist is directly rejected.

[0092] In this embodiment, the service software port forwarding rule setting module reads the forwarding rule data of the service software configuration management module and the FD of the service software port listening module, and then needs to call the interface provided by the kernel port forwarding rule control interface to issue the redirection rule to the port forwarding rule execution module. The timing of issuing is after the listen() system call, which can be: 1) when the service software starts or the configuration is reloaded. 2) in the running process, use the command to add separately.

[0093] In this embodiment, the service software first receives a global configuration file, which includes network addresses that can be used by the service software and a port blacklist corresponding to the service software, including port numbers that are refused to access.

[0094] Reference Figure 3 , Figure 3 is a schematic diagram of interaction between the kernel and the service program according to an embodiment of the present application, as shown in the figure, the port forwarding program in the kernel sends data to the FD of the listening port, the service program receives the global configuration file sent by the rule setting structure, calls the kernel forwarding rule control interface to issue the forwarding rule, and the port forwarding program also obtains the forwarding rule from the port forwarding rule storage interface. Figure 3

[0095] For example, the global configuration file defines that all or part of the ports of the network address 1.1.1.1 are available, and the blacklist specifies that the ports 21 and 22 in the network address 2.2.2.2 are not available.

[0096] S12: The service software sends the forwarding rule corresponding to the global configuration file to the kernel.

[0097] In this embodiment, the service software reads the global configuration file, and then determines the forwarding rule, that is, determines which ports are open ports and which ports are blacklist ports, and then calls the port forwarding rule control interface in the kernel to send the forwarding rule to the port forwarding rule storage module in the kernel.

[0098] In this embodiment, the specific steps in which the service software sends the forwarding rule corresponding to the global configuration file to the kernel include:

[0099] S12-1: The service software generates the forwarding rule according to the network address in the global configuration file and the blacklist port.

[0100] In this embodiment, the service software generates the corresponding forwarding rule according to the network address in the global configuration file and the port blacklist. In the forwarding rule, it is specified that the network address of the access request needs to comply with the network address in the rule, and if the access request accesses the port number in the port blacklist, the request is rejected.

[0101] For example, the port forwarding rule is specifically that the full port and part of the port of which IP is forwarded to the FD of the corresponding service software; the blacklist rule specifies that some IP or some IP+port is directly rejected. For example, the rule defines that all the ports of the IP 1.1.1.1 are forwarded to the FD1 corresponding to the port 12345 of the service software 1, the ports 5000~6000 and 8888 of the IP 2.2.2.2 are forwarded to the FD2 corresponding to the port 2345 of the service software 2, and the ports 21 and 22 of the IP 3.3.3.3 are blacklisted. When a user accesses the port, the kernel directly rejects it.

[0102] ​S12-2: The service software sends the forwarding rule to the kernel.

[0103] In this embodiment, the service software invokes the port forwarding rule control interface to issue the forwarding rule to the domain forwarding rule storage module.

[0104] S13: The service software receives domain name port information corresponding to the new port.

[0105] In this embodiment, the new port is a port added by a client of the service software on the service software, and the domain name port information is a port number of a domain name provided by the service software to the client.

[0106] In this embodiment, the client can add a special port on the client console by himself, and the client console generates domain name port information corresponding to the port through the domain name configuration system.

[0107] In this embodiment, after obtaining the global configuration file, the service software can determine a network address that can provide services, and all ports in the network address can be used. When a user accesses a port in the network address, if the access request is parsed as an address and a port corresponding to the client, a normal response is returned, and if it is a port corresponding to another client, an exception information is returned.

[0108] S14: The kernel verifies the access request according to the forwarding rule when receiving the access request for the new port.

[0109] In this embodiment, the kernel verifies the access request according to the forwarding rule when receiving the access request for the new port, and determines whether the network address and the port corresponding to the access request are the network address and the port provided by the service software for the client.

[0110] In this embodiment, when the kernel receives the access request for the new port, the specific steps of verifying the access request according to the forwarding rule include:

[0111] S14-1: The kernel parses the access request to determine the network address and the port number corresponding to the access request.

[0112] In this embodiment, reference is made to Figure 4 , Figure 4 is a request verification flowchart proposed by an embodiment of the present application, as shown in Figure 4 , the kernel parses the access request to determine the network address and the port number (vip:port) corresponding to the access request.

[0113] S14-2: The kernel determines whether the network address corresponding to the network request and the port number match the port blacklist.

[0114] In this embodiment, as shown in Figure 4 The kernel determines whether the network address corresponding to the network request and the port number are in the port blacklist.

[0115] S14-3: The kernel rejects the access request if the network address corresponding to the access request and the port number match the port blacklist.

[0116] In this embodiment, as shown in Figure 4 When the network address and the port number are in the port blacklist, the access is directly rejected, and reset information is returned.

[0117] S14-4: The kernel determines whether the network address corresponding to the access request matches the network address specified in the forwarding rule if the network address and the port number do not match the port blacklist.

[0118] In this embodiment, as shown in Figure 4 When the network address and the port number are not in the port blacklist, it is determined whether the network address is in the forwarding rule.

[0119] S14-5: The kernel determines that the access request is verified if the network address corresponding to the access request matches the network address specified in the forwarding rule.

[0120] In this embodiment, as shown in Figure 4 If the network address is in the forwarding rule, the access request is forwarded to the service software.

[0121] S14-6: The kernel determines whether the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule if the network address corresponding to the access request does not match the network address specified in the forwarding rule.

[0122] In this embodiment, as shown in Figure 4As shown, the forwarding rule is hierarchically set, and can be set to filter information through network address only, or set to filter information through combination of network address and port number, for example, set 1.1.1.1 as address in the rule, and set 2.2.2.2:1234 as combination of network address and port number in the rule. Therefore, when the network address in the access request does not match the forwarding rule, it is also needed to verify whether the combination of network address and port number in the access request matches the forwarding rule. The kernel determines whether the combination of network address and port number in the access request matches the combination of network address and port number specified in the forwarding rule in case that the network address in the access request does not match the network address specified in the forwarding rule.

[0123] S14-7: The kernel determines that the access request passes the verification in case that the combination of network address and port number in the access request matches the combination of network address and port number specified in the forwarding rule.

[0124] In this embodiment, as shown in Figure 4 In this embodiment, as shown in

[0125] S14-8: The kernel rejects the access request in case that the combination of network address and port number in the access request does not match the combination of network address and port number specified in the forwarding rule.

[0126] In this embodiment, as shown in Figure 5 In this embodiment, as shown in

[0127] S15: The kernel sends the access request to the service software in case that the verification passes.

[0128] In this embodiment, the kernel sends the access request to the service software in case that the verification passes.

[0129] S16: The service software returns corresponding response message in case that the access request matches the domain name port information.

[0130] In this embodiment, the service software returns corresponding response message in case that the access request matches the domain name port information.

[0131] In this embodiment, the service software needs to determine that the access request is a request sent by the user corresponding to the customer, and the access is to the port supported by the customer, that is, the access request conforms to the domain name port information, at this time, the corresponding response message is returned.

[0132] For example, with reference to Figure 5 , Figure 5 is a port self-service opening process diagram proposed in an embodiment of the present application, as shown in Figure 6 The dispatch planning system plans 1.1.1.1 IP as a full-port self-service opening VIP, and requests forwarding of all ports of the IP to the service software, and plans 21 and 22 ports of the IP as blacklisted ports. The global configuration management system generates a global configuration file according to the planning information of step 1, and distributes it to the service software. The service software reads the global configuration file, calls a kernel forwarding program interface, sets a forwarding rule, and here, the initial environment is prepared, and the customer can accept self-service addition of ports. The customer adds a special port 5678 on the console, specifies the port for https service, and the console gives the port information to the configuration system. The configuration system generates domain name port information 5678: https of the customer according to the information of the previous step, and distributes it to the service software. Here, the customer successfully adds the self-service port. The user accesses https: / / 1.1.1.1:5678, and the kernel forwarding program forwards the request to the service program according to the forwarding rule set in step 3. The service program checks that the port is in the customer configuration and the protocol is correct, and responds to the request.

[0133] In this embodiment, a full-port forwarding device is realized through ebpf technology at the operating system kernel level, a device interacting with the device in step 1 is realized at the user state level of the operating system, the port and IP can be finely controlled, an interface that can interact with the service software on the device is realized at the user state level of the operating system, and the service software can guide specific traffic to its own service through the interface, realizes customer self-service opening of the port, and improves the port opening speed.

[0134] In another embodiment of the present application, the method further includes:

[0135] S21: The service software determines the corresponding listening port according to the received listening port setting information.

[0136] In this embodiment, the listening port setting information is set by the user to the port that needs to be listened to.

[0137] In this embodiment, a port that needs to be listened to can be set in the service software, and the service software determines the port that needs to be listened to according to the received listening port setting information.

[0138] S22: The service software sends the port information corresponding to the listening port to the kernel.

[0139] In this embodiment, the service software sends the corresponding port information to the kernel after determining the listening port, including the port number and other information.

[0140] S23: The kernel sends the access request to the listening port in the case that the access request is received for the network address corresponding to the service software.

[0141] In this embodiment, the kernel sends the access request to the listening port in the case that the access request is received for the network address corresponding to the service software, and all the access requests for the network address are forwarded to the same listening port, so that only one port needs to be listened to, and each port does not need to be listened to.

[0142] In this embodiment, the service software does not need to be reloaded at the configuration level to serve the corresponding special port, and the service software only needs to listen to one specific port.

[0143] For example, referring to Figure 6 , Figure 6 is a flowchart of accelerating opening of any multiple ports according to an embodiment of the present application, as shown in Figure 7 The planning system plans 1.1.1.1 IP for a customer to use, and the customer can specify different response logics for the ports corresponding to the IP. The listening port set by the service software is 127.0.0.1:12345, and the FD information is transmitted to the kernel forwarding program. The user accesses any port of 1.1.1.1, and the kernel forwarding program can forward the request to the service software, without the service software itself listening to all the ports.

[0144] In this embodiment, the method further includes: S24: The kernel deletes the related information of the listening port in the case that the listening port is detected to be closed.

[0145] In this embodiment, the kernel deletes the related rules and information of the listening port in the case that the listening port is detected to be closed, and no longer forwards the access request to the listening port.

[0146] Similarly, if a special port is closed, the service software needs to call the delete interface provided by the kernel port forwarding rule control interface to delete the related rules.

[0147] In this embodiment, when the service software is reloaded, if port re-listening occurs, the redirection rule needs to be updated after a new port is created. The rule in the port forwarding rule storage module needs to be updated to the fd of the new listening port. The new listening rule needs to be loaded first, and then the old listening rule needs to be deleted, otherwise the redirection rule will be empty for a period of time.

[0148] In another embodiment of the present application, before the service software receives the global configuration file, the method further comprises:

[0149] S31: The scheduling system specifies the corresponding network address for the service software, and formulates the port blacklist corresponding to the network address.

[0150] In this embodiment, the scheduling system is a system for specifying the network address for the service software of the service end.

[0151] In this embodiment, the scheduling system specifies the corresponding network address for the service software, and formulates the port blacklist corresponding to the network address.

[0152] S32: The scheduling system sends the network address and the port blacklist to the global configuration system.

[0153] In this embodiment, the global configuration system is a system for globally configuring the services provided by the service device.

[0154] In this embodiment, the scheduling system sends the network address and the port blacklist to the global configuration system.

[0155] S33: The global configuration system generates the global configuration file according to the network address and the port blacklist.

[0156] In this embodiment, the global configuration system generates the global configuration file according to the received network address and the blacklist.

[0157] In this embodiment, the method further comprises: S34: The customer console receives the new port request sent by the customer.

[0158] In this embodiment, the customer console is a platform for the customer to operate the service software.

[0159] In this embodiment, the customer console receives the new port request sent by the customer. The request includes the number of the port to be added.

[0160] S35: The customer console analyzes the new port request to obtain the corresponding new port information.

[0161] In this embodiment, the client console parses the new port request to obtain corresponding new port information, which includes the number of the port, the services supported by the port, and the like.

[0162] S36: The client console sends the new port information to the port configuration system.

[0163] In this embodiment, the configuration system is configured to configure the corresponding domain name for the new port.

[0164] In this embodiment, the client console sends the new port information to the port configuration system.

[0165] S37: The port configuration system generates the domain name port information according to the new port information.

[0166] In this embodiment, the port configuration system determines the port number and the https service of the port according to the new port information, and then generates the corresponding domain name port information, such as 5678: https, and then sends it to the service software.

[0167] In the above embodiments of the application, by setting the listening port, full port listening of a specific network address is realized, the consumption of server resources is reduced, the request corresponding to a specific network address or the request of a specific network address + port can be forwarded to the service software in full, and the kernel quadruple obtained by the service software is the original quadruple. The service software only needs to perform a small amount of adaptation. The specific ip port on the server is opened to the client, in the application acceleration scenario, the client can select the required port for use without global configuration reading and reloading by the service software. The service software only needs to read the specific configuration of the specific client when needed. The client self-service port opening is realized, and the port opening speed is improved.

[0168] Based on the same inventive concept, an embodiment of the application provides a port opening device. Referring to Figure 7 , Figure 7 is a schematic diagram of the port opening device 700 provided by an embodiment of the application. As shown in the figure, the device includes: Figure 8

[0169] The file receiving module 701 is configured to receive a global configuration file by the service software, the global configuration file including a network address corresponding to the service software and a port blacklist, all ports in the network address being open ports.

[0170] The first sending module 702 is configured to send a forwarding rule corresponding to the global configuration file to the kernel by the service software.

[0171] ​The port information receiving module 703 is configured to receive domain name port information corresponding to the added port by the service software.

[0172] The verification module 704 is configured to verify the access request according to the forwarding rule when the kernel receives the access request for the added port.

[0173] The first request forwarding module 705 is configured to send the access request to the service software when the verification is passed.

[0174] The message returning module 706 is configured to return a corresponding response message when the access request meets the domain name port information.

[0175] Optionally, the apparatus further comprises:

[0176] The listening port determining module is configured to determine a corresponding listening port according to received listening port setting information by the service software.

[0177] The second sending module is configured to send port information corresponding to the listening port to the kernel by the service software.

[0178] The second request forwarding module is configured to send the access request to the listening port when the kernel receives an access request for the network address corresponding to the service software.

[0179] Optionally, the apparatus further comprises an information deleting module configured to delete related information of the listening port when the kernel detects that the listening port is closed.

[0180] Optionally, the apparatus further comprises:

[0181] The information specifying module is configured to specify the network address corresponding to the service software and the port blacklist corresponding to the network address by the scheduling system.

[0182] The third sending module is configured to send the network address and the port blacklist to a global configuration system by the scheduling system.

[0183] The file generating module is configured to generate the global configuration file according to the network address and the port blacklist by the global configuration system.

[0184] Optionally, the apparatus further comprises an added request receiving module configured to receive an added port request sent by a client by a client console.

[0185] The added request analyzing module is configured to analyze the added port request to obtain corresponding added port information by the client console.

[0186] a fourth sending module, configured to send, by the client console, the added port information to a port configuration system;

[0187] an information generating module, configured to generate, by the port configuration system, the domain name port information according to the added port information.

[0188] Optionally, the first sending module comprises:

[0189] a forwarding rule generating submodule, configured to generate, by the service software, the forwarding rule according to the network address in the global configuration file and the blacklisted port;

[0190] a rule sending submodule, configured to send, by the service software, the forwarding rule to the kernel.

[0191] Optionally, the request verifying module comprises:

[0192] a request analyzing submodule, configured to analyze, by the kernel, the access request to determine the network address and the port number corresponding to the access request;

[0193] a first verifying submodule, configured to determine, by the kernel, whether the network address and the port number corresponding to the network request match the port blacklist;

[0194] a first rejecting submodule, configured to reject, by the kernel, the access request in a case where the network address and the port number corresponding to the access request match the port blacklist;

[0195] a second verifying submodule, configured to determine, by the kernel, whether the network address corresponding to the access request matches the network address specified in the forwarding rule in a case where the network address and the port number do not match the port blacklist;

[0196] a first passing verifying submodule, configured to determine, by the kernel, that the access request passes the verification in a case where the network address corresponding to the access request matches the network address specified in the forwarding rule;

[0197] a third verifying submodule, configured to determine, by the kernel, whether the combination of the network address and the port number corresponding to the access request matches the combination of the network address and the port number specified in the forwarding rule in a case where the network address corresponding to the access request does not match the network address specified in the forwarding rule;

[0198] The second passing verification submodule is configured to determine that the access request passes verification when the network address and port number combination corresponding to the access request matches the network address and port number combination specified in the forwarding rule.

[0199] The second rejecting submodule is configured to reject the access request when the network address and port number combination corresponding to the access request does not match the network address and port number combination specified in the forwarding rule.

[0200] Based on the same inventive concept, another embodiment of the present application provides a readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the steps in the port opening method according to any one of the above embodiments of the present application.

[0201] Based on the same inventive concept, another embodiment of the present application provides an electronic device, Figure 1 FIG. 8 is a schematic diagram of an electronic device 800 according to an embodiment of the present application, which comprises a memory 801, a processor 802, and a computer program stored in the memory and executable on the processor, and the processor is configured to implement the steps in the port opening method according to any one of the above embodiments of the present application when executed.

[0202] For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts are described in the part of the method embodiment.

[0203] Each of the embodiments in the present specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments, and the same and similar parts between the embodiments can be referred to each other.

[0204] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, device, or computer program product. Therefore, the embodiments of the present application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0205] The embodiments of the present application are described with reference to the flowchart illustrations and / or block diagrams of the methods, terminal devices (systems) and computer program products according to the embodiments of the present application. It is understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal devices to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal devices, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0206] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal devices to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0207] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal devices, such that a series of operational steps are performed on the computer or other programmable terminal devices to create a computer implemented process so that the instructions executed on the computer or other programmable terminal devices provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. ​ one or more functions specified in the flowchart illustrations and / or block diagrams.

[0208] Although preferred embodiments of the present application have been described, those skilled in the art will be able to make additional modifications and variations to these embodiments without departing from the basic inventive concepts disclosed. Accordingly, it is intended to be covered in the appended claims all such modifications and variations as fall within the scope of the embodiments of the present application.

[0209] Finally, it is to be understood that the phraseology or terminology such as "comprising", "including", "containing", or "consisting of" etc., is to be construed in its most expansive form, namely, it is to be construed to include the possibility of comprising, consisting of, containing or consisting essentially of the elements or steps listed thereafter, in addition to the elements or steps already present. In other words, the term "comprising" should not be understood to be limited to the recitation of elements or steps already present in the process, method, article, or apparatus, but to the possibility that the process, method, article, or apparatus might include additional elements or steps, in addition to those already present.

[0210] The port opening method, device, equipment and storage medium provided by the present application are described in detail above, the principle and implementation mode of the present application are described by applying specific examples in the present article, the above example is only used for helping to understand the method and core idea of the present application; meanwhile, for the general skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed, and the above description should not be understood as the limitation of the present application.

Claims

1. A method for opening a port, characterized in that, The method includes: The service software receives a global configuration file, which includes the network address and port blacklist corresponding to the service software. All ports in the network address are open ports, which are ports that users can open themselves. The service software sends the forwarding rules corresponding to the global configuration file to the kernel; The service software receives the domain name and port information corresponding to the newly added port, where the newly added port is a port added by the client of the service software on the service software. When the kernel receives an access request for the newly added port, it verifies the access request according to the forwarding rules, including: Determine whether the network address and port corresponding to the access request are usable network addresses and ports provided by the service software to the customer; If the verification is successful, the kernel will send the access request to the service software. If the access request matches the domain name and port information, the service software returns a corresponding response message.

2. The port activation method according to claim 1, characterized in that, The method further includes: The service software determines the corresponding listening port based on the received listening port setting information; The service software sends the port information corresponding to the listening port to the kernel; When the kernel receives an access request for the network address corresponding to the service software, it sends the access request to the listening port.

3. The port activation method according to claim 2, characterized in that, The method further includes: when the kernel detects that the listening port is closed, deleting the relevant information of the listening port.

4. The port activation method according to claim 1, characterized in that, Before the service software receives the global configuration file, the method further includes: The scheduling system assigns the corresponding network address to the service software and creates a port blacklist corresponding to the network address; The scheduling system sends the network address and the port blacklist to the global configuration system; The global configuration system generates the global configuration file based on the network address and the port blacklist.

5. The port activation method according to claim 4, characterized in that, The method further includes: the client console receiving a request to add a port sent by the client; The client console parses the request to add a port and obtains the corresponding information about the new port. The client console sends the newly added port information to the port configuration system; The port configuration system generates the domain name port information based on the newly added port information.

6. The port activation method according to claim 1, characterized in that, The service software sends the forwarding rules corresponding to the global configuration file to the kernel, including: The service software generates the forwarding rules based on the network address and the blacklisted ports in the global configuration file; The service software sends the forwarding rules to the kernel.

7. The port activation method according to claim 1, characterized in that, When the kernel receives an access request for the newly added port, it verifies the access request according to the forwarding rules, including: The kernel parses the access request and determines the network address and port number corresponding to the access request; The kernel determines whether the network address and port number corresponding to the network request match the port blacklist. If the network address and port number corresponding to the access request match the port blacklist, the kernel will reject the access request. If the network address and the port number do not match the port blacklist, the kernel determines whether the network address corresponding to the access request matches the network address specified in the forwarding rule. If the network address corresponding to the access request matches the network address specified in the forwarding rule, the kernel determines that the access request passes verification. If the network address corresponding to the access request does not match the network address specified in the forwarding rule, the kernel determines whether the combination of the network address and port number corresponding to the access request matches the combination of the network address and port number specified in the forwarding rule. If the combination of network address and port number corresponding to the access request matches the combination of network address and port number specified in the forwarding rule, the kernel determines that the access request has passed verification. If the combination of network address and port number corresponding to the access request does not match the combination of network address and port number specified in the forwarding rule, the kernel rejects the access request.

8. A port activation device, characterized in that, The device includes: The file receiving module is used for the service software to receive a global configuration file. The global configuration file includes the network address and port blacklist corresponding to the service software. All ports in the network address are open ports, which are ports that can be opened by the user. The rule sending module is used by the service software to send the forwarding rules corresponding to the global configuration file to the kernel; The port information receiving module is used for the service software to receive the domain name port information corresponding to the newly added port, wherein the newly added port is a port added by the client of the service software on the service software. The verification module is used by the kernel to verify the access request according to the forwarding rules when it receives an access request for the newly added port, including: Determine whether the network address and port corresponding to the access request are usable network addresses and ports provided by the service software to the customer; A request forwarding module is used by the kernel to send the access request to the service software if the verification is successful. The message return module is used by the service software to return a corresponding response message when the access request matches the domain name and port information.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 7.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 7.

Images