Data forwarding method and device

Abstract

The invention provides a data forwarding method and device. The method comprises the steps that a proxy server receives a first data packet from an external IP protocol stack; the proxy server determines the value of a second feature in a second data packet according to the value of the first feature in the first data packet and re-encapsulates the first data packet to obtain a second data packet, the first feature and the second feature are respectively composed of at least one of a source IP, a destination IP, a source port and a destination port, the second feature comprises the source IP and the destination IP, and the source port is connected with the destination port. At least one of the first feature and the second feature comprises a source port or a destination port; and the proxy server forwards the second data packet to the internal IP protocol stack. According to the method and the device, the proxy server can fully utilize the characteristics in the data packets to distinguish the data packets, so that various requirements of upper-layer applications are met.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of proxy server, in particular to a data forwarding method and device. BACKGROUND

[0002] The proxy server is an intermediate server between the client and the target server, which is mainly used for forwarding requests, caching data, security filtering, etc. Due to the need for security isolation, the device uses two IP protocol stacks for external and internal respectively. There is a proxy server program on the external IP protocol stack, which is responsible for forwarding the data from the external IP protocol stack to the internal IP protocol stack, and then forwarding it to the upper layer application by the internal IP protocol stack. Figure 1 .

[0003] The proxy server needs to replace the source IP and destination IP in the data packet from the external IP protocol stack with the internal network IP, and send the re-encapsulated data packet to the internal IP protocol stack. However, the proxy server does not fully utilize the characteristics of the data packet to distinguish the data packet when forwarding the data packet to the internal IP protocol stack, which makes it difficult to meet the diverse needs of the upper layer application. SUMMARY

[0004] The present application provides a data forwarding method and device, which can solve the technical problem that it is difficult to meet the diverse needs of the upper layer application in the prior art.

[0005] In a first aspect, the embodiments of the present application provide a data forwarding method, which comprises: The proxy server receives a first data packet from the external IP protocol stack; The proxy server determines the value of the second feature in the second data packet according to the value of the first feature in the first data packet, and re-encapsulates the first data packet to obtain the second data packet, wherein the first feature and the second feature are composed of at least one of the source IP, the destination IP, the source port and the destination port, the second feature includes the source IP and the destination IP, and at least one of the first feature and the second feature includes the source port or the destination port; The proxy server forwards the second data packet to the internal IP protocol stack.

[0006] Further, in an embodiment, before the step of the proxy server determining the value of the second feature in the second data packet according to the value of the first feature in the first data packet, the method further comprises: The proxy server detects whether there is a first target rule, wherein the proxy server is configured with at least one first forwarding rule, each first forwarding rule defines the first feature and the value of the first feature, and the second feature and the value of the second feature, the first target rule belongs to the first forwarding rule, and the first data packet and the value of the first feature in the first target rule are the same. The step of determining, by the proxy server, the value of the second feature in the second data packet according to the value of the first feature in the first data packet comprises: When the first target rule exists, the proxy server determines that the value of the second feature in the second data packet is the same as the value of the second feature in the first target rule.

[0007] The method further comprises, after the step of forwarding, by the proxy server, the second data packet to the internal IP protocol stack: The internal IP protocol stack forwards the second data packet to the corresponding upper layer application instance according to the value of the third feature in the second data packet, wherein the third feature is composed of at least one of the source IP, the destination IP, the source port and the destination port.

[0008] Further, in an embodiment, the method further comprises, before the step of forwarding, by the internal IP protocol stack, the second data packet to the corresponding upper layer application instance according to the value of the third feature in the second data packet: The internal IP protocol stack detects whether a second target rule exists, wherein the internal IP protocol stack is configured with at least one second forwarding rule, each second forwarding rule defining a third feature and a value of the third feature, and an ID of an upper layer application instance, the second target rule belongs to the second forwarding rule, and the second data packet and the value of the third feature in the second target rule are the same; The step of forwarding, by the internal IP protocol stack, the second data packet to the corresponding upper layer application instance according to the value of the third feature in the second data packet comprises: When the second target rule exists, the internal IP protocol stack forwards the second data packet to the upper layer application instance corresponding to the second target rule.

[0009] Further, in an embodiment, the first feature is the destination IP, the second feature is the source IP, the destination IP and the destination port, and the third feature is the destination port; When the value of the destination IP in the first data packet is equal to any first preset value, the value of the destination port in the second data packet is equal to a second preset value corresponding to the first preset value; When the value of the destination port in the second data packet is equal to any second preset value, the ID of the upper layer application instance is equal to a third preset value corresponding to the second preset value.

[0010] Further, in an embodiment, the first feature is the source IP, the second feature is the source IP, the destination IP and the source port, and the third feature is the source port; When the value of the source IP in the first data packet is equal to any fourth preset value, the value of the source port in the second data packet is equal to a fifth preset value corresponding to the fourth preset value; When the value of the source port in the second data packet is equal to any fifth preset value, the ID of the upper layer application instance is equal to a sixth preset value corresponding to the fifth preset value.

[0011] Further, in an embodiment, the first feature is the destination port, the second feature is the source IP, the destination IP and the destination port, and the third feature is the destination port. The value of the destination port in the second data packet is equal to an eighth preset value when the value of the destination port in the first data packet is equal to any seventh preset value, wherein the seventh preset value is not equal to the eighth preset value. The ID of the upper application instance is equal to a ninth preset value when the value of the source port in the second data packet is equal to the eighth preset value.

[0012] Further, in an embodiment, the first feature is the source IP, the second feature is the source IP, the destination IP and the destination port, and the third feature is the destination port. The value of the destination port in the second data packet is switched between a plurality of tenth preset values when the receiving frequency of the first data packet with the same source IP is greater than a preset frequency. The value of the destination port in the second data packet is equal to one of the fixed tenth preset values when the receiving frequency of the first data packet with the same source IP is less than or equal to the preset frequency. The ID of the upper application instance is equal to an eleventh preset value corresponding to the tenth preset value of the value of the destination port in the second data packet.

[0013] Further, in an embodiment, the data forwarding method is applied to a target server, and the first data packet is from a client.

[0014] Further, in an embodiment, the data forwarding method is applied to a client, and the first data packet is from a target server.

[0015] In a second aspect, the embodiments of the present application further provide a data forwarding device, which comprises a processor, a memory, and a data forwarding program stored in the memory and executable by the processor, wherein the data forwarding program, when executed by the processor, implements the steps of the data forwarding method.

[0016] In the present application, the proxy server receives a first data packet from an external IP protocol stack, determines the value of a second feature in a second data packet according to the value of a first feature in the first data packet, re-encapsulates the first data packet to obtain the second data packet, and forwards the second data packet to an internal IP protocol stack, wherein the first feature and the second feature are respectively constituted by at least one of a source IP, a destination IP, a source port and a destination port, and at least one of the first feature and the second feature comprises the source port or the destination port. Through the present application, the proxy server can fully utilize the features in the data packet to distinguish the data packet, thereby meeting the diverse needs of the upper application. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 This is a schematic diagram of the system architecture of data forwarding methods in related technologies; Figure 2 This is a flowchart illustrating a data forwarding method in one embodiment of this application; Figure 3 This is a schematic diagram of the system architecture of a data forwarding method in one embodiment of this application; Figure 4 This is a schematic diagram of the hardware structure of the data forwarding device involved in the embodiments of this application. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0020] In a first aspect, embodiments of this application provide a data forwarding method.

[0021] Figure 2 A flowchart illustrating a data forwarding method according to an embodiment of this application is shown.

[0022] Reference Figure 2 In one embodiment, the data forwarding method includes the following steps: S1. The proxy server receives the first data packet from the external IP protocol stack.

[0023] Specifically, the source IP and destination IP values ​​in the first data packet are both public IP addresses.

[0024] Optionally, the data forwarding method of this embodiment can be applied to either the target server or the client. When applied to the target server, the first data packet originates from the client; when applied to the client, the first data packet originates from the target server.

[0025] S2. The proxy server determines the value of the second feature in the second data packet based on the value of the first feature in the first data packet, and re-encapsulates the first data packet to obtain the second data packet. The first feature and the second feature are respectively composed of at least one of the source IP, destination IP, source port and destination port. The second feature includes the source IP and the destination IP. At least one of the first feature and the second feature includes the source port or the destination port.

[0026] Specifically, the values of the source IP and the destination IP in the second data packet are both intranet IP. The data payloads of the first data packet and the second data packet are the same, and only the protocol headers are different. In this embodiment, when re-encapsulating the data packet, the proxy server not only replaces the source IP and the destination IP from public network IP to intranet IP, but also distinguishes the data packet according to the value of the first feature in the first data packet, and reflects the distinguishing result through the value of the second feature in the second data packet.

[0027] In the prior art, the proxy server does not pay attention to the port information when re-encapsulating the data packet. In this embodiment, the port information can be used as the basis for distinguishing the data packet in the first data packet, or can carry the result of distinguishing the data packet in the second data packet.

[0028] S3, the proxy server forwards the second data packet to the internal IP protocol stack.

[0029] It can be understood that after the proxy server forwards the second data packet to the internal IP protocol stack, the internal IP protocol stack can distinguish the second data packet according to at least one of the source IP, the destination IP, the source port and the destination port in the second data packet, and forwards the second data packet to the corresponding upper layer application instance. Since the proxy server fully utilizes the features in the data packet to distinguish the data packet, the diverse needs of the upper layer application can be met.

[0030] It should be noted that the proxy server, the external IP protocol stack and the internal IP protocol stack in this embodiment are all software modules, which are usually arranged in the same hardware device, or can be arranged in different hardware devices according to actual needs.

[0031] Figure 3 A system architecture schematic diagram of a data forwarding method in an embodiment of the application is shown.

[0032] Further, in an embodiment, with reference to Figure 3 Before the step of determining the value of the second feature in the second data packet according to the value of the first feature in the first data packet, the method further includes: The proxy server detects whether there is a first target rule, wherein the proxy server is configured with at least one first forwarding rule, each first forwarding rule defines a first feature and a value of the first feature, and a second feature and a value of the second feature, the first target rule belongs to the first forwarding rule, and the value of the first feature in the first data packet is the same as that in the first target rule; The step of determining the value of the second feature in the second data packet according to the value of the first feature in the first data packet includes: When there is the first target rule, the proxy server determines that the value of the second feature in the second data packet is the same as that in the first target rule.

[0033] In the embodiment, the proxy server distinguishes the data packets by means of the first forwarding rules, which can be flexibly configured according to the requirements of the upper-layer applications, and different first forwarding rules can define different first features or second features.

[0034] For example, in some first forwarding rules, the first feature is the destination IP, and the second feature is the source IP, the destination IP, and the destination port. In other forwarding rules, the first feature is the source IP, and the second feature is the source IP, the destination IP, and the source port. For a plurality of first forwarding rules with the same first feature, the values of the first feature are different.

[0035] Further, in an embodiment, after the step of the proxy server forwarding the second data packet to the internal IP protocol stack, the method further comprises: The internal IP protocol stack forwards the second data packet to the corresponding upper-layer application instance according to the value of the third feature in the second data packet, wherein the third feature is composed of at least one of the source IP, the destination IP, the source port, and the destination port.

[0036] It should be noted that in some application scenarios, the values of the source IP and the destination IP in the second data packet can be fixed and cannot play a role in distinguishing data packets. Therefore, the third feature can not include the source IP and the destination IP.

[0037] Further, in an embodiment, with reference to Figure 3 Before the step of the internal IP protocol stack forwarding the second data packet to the corresponding upper-layer application instance according to the value of the third feature in the second data packet, the method further comprises: The internal IP protocol stack detects whether there is a second target rule, wherein the internal IP protocol stack is configured with at least one second forwarding rule, each second forwarding rule defines a third feature and a value of the third feature, and an ID of an upper-layer application instance, the second target rule belongs to the second forwarding rule, and the second data packet and the value of the third feature in the second target rule are the same; The step of the internal IP protocol stack forwarding the second data packet to the corresponding upper-layer application instance according to the value of the third feature in the second data packet comprises: When the second target rule exists, the internal IP protocol stack forwards the second data packet to the upper-layer application instance corresponding to the second target rule.

[0038] In the embodiment, the internal IP protocol stack distinguishes the data packets by means of the second forwarding rules, which can be flexibly configured according to the requirements of the upper-layer applications, and different second forwarding rules can define different third features.

[0039] For example, in some second forwarding rules, the third feature is destination IP. In other forwarding rules, the third feature is destination port. For multiple second forwarding rules with the same third feature, the values of the third feature are different.

[0040] Further, in an embodiment, the first feature is destination IP, the second feature is source IP, destination IP and destination port, and the third feature is destination port. When the value of the destination IP in the first data packet is equal to any first preset value, the value of the destination port in the second data packet is equal to a second preset value corresponding to the first preset value. When the value of the destination port in the second data packet is equal to any second preset value, the ID of the upper application instance is equal to a third preset value corresponding to the second preset value.

[0041] In this embodiment, when the upper application wants different instances to process data received by the proxy server through different public IP respectively, it is not necessary to set a one-to-one corresponding internal IP as the destination IP of the second data packet in the internal IP protocol stack, but the packet distinguishing operation based on destination IP is equivalently realized based on destination port, thereby expanding the application scope.

[0042] Further, in an embodiment, the first feature is source IP, the second feature is source IP, destination IP and source port, and the third feature is source port. When the value of the source IP in the first data packet is equal to any fourth preset value, the value of the source port in the second data packet is equal to a fifth preset value corresponding to the fourth preset value. When the value of the source port in the second data packet is equal to any fifth preset value, the ID of the upper application instance is equal to a sixth preset value corresponding to the fifth preset value.

[0043] In this embodiment, when the upper application wants different instances to process data from different public IP respectively, it is not necessary to set a one-to-one corresponding internal IP as the source IP of the second data packet in the proxy server, but the packet distinguishing operation based on source IP is equivalently realized based on source port, thereby expanding the application scope.

[0044] Further, in an embodiment, the first feature is destination port, the second feature is source IP, destination IP and destination port, and the third feature is destination port. When the value of the destination port in the first data packet is equal to any seventh preset value, the value of the destination port in the second data packet is equal to an eighth preset value, wherein the seventh preset value is not equal to the eighth preset value. When the value of the source port in the second data packet is equal to the eighth preset value, the ID of the upper application instance is equal to a ninth preset value.

[0045] In this embodiment, when the upper-layer application does not want to expose a specific port (such as the TCP 80 port used by default in the HTTP protocol), the proxy server can modify the value of the destination port to forward data packets received from other specified ports exposed to the internally exposed specific port, thereby improving security.

[0046] Furthermore, in one embodiment, the first feature is the source IP, the second feature is the source IP, the destination IP, and the destination port, and the third feature is the destination port; When the receiving frequency of the first data packet with the same source IP is greater than the preset frequency, the value of the destination port in the second data packet switches between multiple tenth preset values; When the receiving frequency of the first data packet with the same source IP is less than or equal to the preset frequency, the value of the destination port in the second data packet is equal to one of the fixed tenth preset values; When the value of the destination port in the second data packet is equal to any tenth preset value, the ID of the upper-layer application instance is equal to the eleventh preset value corresponding to that tenth preset value.

[0047] In this embodiment, when an upper-layer application wants different instances to handle burst traffic from the same public IP, the proxy server counts the reception frequency of the first data packet with the same source IP. When the frequency exceeds a threshold, it sets different destination port values ​​in the corresponding second data packet, so that the data flows to different upper-layer application instances, thereby achieving precise traffic distribution to individuals.

[0048] Secondly, embodiments of this application provide a data forwarding device.

[0049] Figure 4 A schematic diagram of the hardware structure of the data forwarding device involved in the embodiment of this application is shown.

[0050] Reference Figure 4 In this embodiment of the application, the data forwarding device may include a processor, a memory, a communication interface, and a communication bus.

[0051] The communication bus can be of any type and is used to interconnect the processor, memory, and communication interface.

[0052] Communication interfaces include input / output (I / O) interfaces, physical interfaces, and logical interfaces used for interconnecting devices within the data forwarding device, as well as interfaces used for interconnecting the data forwarding device with other devices (such as other computing devices or user equipment). Physical interfaces can be Ethernet interfaces, fiber optic interfaces, ATM interfaces, etc.; user equipment can be displays, keyboards, etc.

[0053] Memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0054] The processor can be a general-purpose processor, which can call a data forwarding program stored in memory and execute the data forwarding method provided in the embodiments of this application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed when the data forwarding program is called can be referred to in the various embodiments of the data forwarding method of this application, and will not be repeated here.

[0055] Those skilled in the art will understand that Figure 4 The hardware structure shown does not constitute a limitation of this application and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0056] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0057] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus. The terms "first," "second," and "third," etc., are used to distinguish different objects, etc., and do not indicate a sequence, nor do they limit "first," "second," and "third" to different types.

[0058] In the description of the embodiments of this application, terms such as "exemplary," "for example," or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a concrete manner.

[0059] In the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0060] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.

[0061] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, Flash) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0062] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A data forwarding method, characterized by, The data forwarding method comprises: The proxy server receives a first data packet from an external IP protocol stack; The proxy server determines a value of a second feature in a second data packet according to a value of a first feature in the first data packet, and re-encapsulates the first data packet to obtain the second data packet, wherein the first feature and the second feature are respectively constituted by at least one of a source IP, a destination IP, a source port and a destination port, the second feature comprises the source IP and the destination IP, and at least one of the first feature and the second feature comprises the source port or the destination port; The proxy server forwards the second data packet to an internal IP protocol stack.

2. The data forwarding method of claim 1, wherein, Before the step of determining the value of the second feature in the second data packet according to the value of the first feature in the first data packet, the method further comprises: The proxy server detects whether a first target rule exists, wherein the proxy server is configured with at least one first forwarding rule, each first forwarding rule defines the first feature and the value of the first feature, and the second feature and the value of the second feature, and the first target rule belongs to the first forwarding rule, and the first data packet and the value of the first feature in the first target rule are the same; The step of determining the value of the second feature in the second data packet according to the value of the first feature in the first data packet comprises: When the first target rule exists, the proxy server determines that the value of the second feature in the second data packet is the same as the value of the second feature in the first target rule.

3. The data forwarding method of claim 1, wherein, After the step of forwarding the second data packet to the internal IP protocol stack, the method further comprises: The internal IP protocol stack forwards the second data packet to a corresponding upper-layer application instance according to a value of a third feature in the second data packet, wherein the third feature is constituted by at least one of the source IP, the destination IP, the source port and the destination port.

4. The data forwarding method of claim 3, wherein, Before the step of forwarding the second data packet to the corresponding upper-layer application instance according to the value of the third feature in the second data packet, the method further comprises: The internal IP protocol stack detects whether a second target rule exists, wherein the internal IP protocol stack is configured with at least one second forwarding rule, each second forwarding rule defines the third feature and the value of the third feature, and an ID of the upper-layer application instance, and the second target rule belongs to the second forwarding rule, and the value of the third feature in the second data packet and the second target rule is the same; The step of forwarding the second data packet to the corresponding upper-layer application instance according to the value of the third feature in the second data packet comprises: When the second target rule exists, the internal IP protocol stack forwards the second data packet to the upper-layer application instance corresponding to the second target rule.

5. The data forwarding method of claim 3, wherein, The first feature is the destination IP, the second feature is the source IP, the destination IP and the destination port, and the third feature is the destination port; When the value of the destination IP in the first data packet is equal to any first preset value, the value of the destination port in the second data packet is equal to a second preset value corresponding to the first preset value; When the value of the destination port in the second data packet is equal to any second preset value, the ID of the upper-layer application instance is equal to a third preset value corresponding to the second preset value.

6. The data forwarding method of claim 3, wherein, The first feature is the source IP, the second feature is the source IP, the destination IP and the source port, and the third feature is the source port. The value of the source IP in the first data packet is equal to any fourth preset value, and the value of the source port in the second data packet is equal to a fifth preset value corresponding to the fourth preset value. The value of the source port in the second data packet is equal to any fifth preset value, and the ID of the upper application instance is equal to a sixth preset value corresponding to the fifth preset value.

7. The data forwarding method of claim 3, wherein, The first feature is a destination port, the second feature is a source IP, a destination IP and a destination port, and the third feature is a destination port. The value of the destination port in the first data packet is equal to any seventh preset value, and the value of the destination port in the second data packet is equal to an eighth preset value, wherein the seventh preset value is not equal to the eighth preset value. The value of the source port in the second data packet is equal to the eighth preset value, and the ID of the upper application instance is equal to a ninth preset value.

8. The data forwarding method of claim 3, wherein, The first feature is a source IP, the second feature is a source IP, a destination IP and a destination port, and the third feature is a destination port. When the receiving frequency of the first data packet with the same source IP is greater than a preset frequency, the value of the destination port in the second data packet is switched between a plurality of tenth preset values. When the receiving frequency of the first data packet with the same source IP is less than or equal to the preset frequency, the value of the destination port in the second data packet is equal to one of the fixed tenth preset values. The value of the destination port in the second data packet is equal to any tenth preset value, and the ID of the upper application instance is equal to an eleventh preset value corresponding to the tenth preset value.

9. The data forwarding method of claim 1, wherein, The data forwarding method is applied to a target server, and the first data packet is from a client.

10. The data forwarding method of claim 1, wherein, The data forwarding method is applied to a client, and the first data packet is from a target server.

11. A data forwarding device, characterized by The data forwarding device comprises a processor, a memory, and a data forwarding program stored in the memory and executable by the processor, wherein when the data forwarding program is executed by the processor, the steps of the data forwarding method according to any one of claims 1 to 10 are implemented.

Images