Data packet forwarding method and device based on reverse proxy

Abstract

The invention aims to provide a data packet forwarding method and device based on reverse proxy, and the method comprises the steps: firstly, screening out a configured data packet which needs to be subjected to reverse proxy through a reverse proxy station table for a received data packet, and then querying a corresponding connection state in a connection tracking table; and according to a query result, sending the data packet to the corresponding child nodes for processing respectively. And the sub-node delivers the data packet to a kernel to execute deep detection of the data packet according to a security detection strategy, returns the data packet after the detection is passed, executes corresponding IP and port mapping according to preset reverse proxy configuration information, and forwards the data packet to a corresponding site for response.

Description

Technical Field

[0001] This invention belongs to the field of web firewall packet processing technology, and in particular relates to a packet forwarding method based on a reverse proxy and an apparatus for applying the method. Background Technology

[0002] With the increasing popularity of the Internet, organizations generally need to provide services such as WWW page browsing and HTTP file transfer. The ever-increasing user access demands will lead to a surge in web server traffic. As the data detection and forwarding channel between the web server and users, the Web Firewall (WAF) will become a network bottleneck if its performance is insufficient, negatively impacting the overall network transmission efficiency.

[0003] Reverse proxy is a technology used by web firewalls to protect server sites. The basic principle of a reverse proxy is to map the address of the real server to the reverse proxy server. The proxy server then appears to the outside world as a real server. Since the client is actually accessing the WAF (Web Application Firewall), the WAF does not need to use special handling to intercept the client-server session. When the proxy server receives an HTTP request message, it forwards the request to the corresponding real server. The server receives the request and sends the response to the WAF first, which then sends the response to the client. This mode requires configuring not only the WAF device's own address and routing, but also configuring the mapping relationship between the backend real server's address and the virtual address on the WAF. This complex configuration places higher demands on the efficiency of traffic monitoring and alarm interception, thus necessitating improvements to the data processing efficiency of the web firewall. Summary of the Invention

[0004] Based on the above background, this invention aims to propose a packet forwarding method based on a reverse proxy and a packet forwarding device applying this method. The specific technical solution is as follows: First, the present invention and its embodiments provide a data packet forwarding method, including: Obtain the preset reverse proxy site IP and proxy port, and add them to the reverse proxy site table; In response to a request packet from a site, if the destination IP and port exist in the reverse proxy site table, a reverse proxy tag is added to the corresponding data packet, and the next node index of the data packet is set to the outgoing interface node to bypass the access control list processing.

[0005] Preferably, the above lookup request for whether the reverse proxy site is in the table includes calculating the first hash value of the destination IP of the data packet and the proxy port information, and checking whether the same hash value exists in the table.

[0006] For packets marked as reverse proxies, the packets are sent to the corresponding child nodes for processing according to the connection distribution table, including newly received connections, connections with established sessions, newly sent connections, disconnected connections, and other connections.

[0007] Furthermore, according to the distribution table, the data packet is sent to the corresponding child node for processing, including calculating the second hash value of the data packet's five-tuple information, and checking whether the same hash value exists in the connection distribution table based on the second hash value. If it exists, the corresponding connection exists in the connection tracking table.

[0008] Additionally, the child nodes process the data packets, including sending the packets to the kernel, where the security detection engine determines whether the connected data packets pose a threat based on preset detection rules. If the data packets do not pose a threat, they are sent to the corresponding site server for a response according to the preset reverse proxy configuration; otherwise, the data packets are discarded.

[0009] Preferably, before forwarding the data packet to the site server for a response, it also includes determining whether the data packet is marked as a reverse proxy data packet; if so, the next node index of the data packet is set to the outgoing interface.

[0010] Preferably, the above-mentioned packet forwarding method involves uploading HTTPS and HTTP protocol packets to the Linux kernel. Nginx uses a preloading mechanism to load the VCL dynamic library provided by VPP and creates associations between control messages and data messages of the VCL dynamic library. The control messages include connection establishment, disconnection, and reset, and the data messages include packet sending and receiving. After processing by nginx, the data packets are sent to the VPP connection module for further processing via VCL and shared memory. Once completed, the packets are sent out from the network card through the DPDK interface.

[0011] Furthermore, for requests to HTTPS sites, the SSL data is decrypted before it reaches the kernel for processing.

[0012] On the other hand, the present invention and its embodiments also propose a data packet forwarding device, which includes: The configuration generation module generates nginx configuration files for reverse proxy sites, including reading site configurations from the database, generating configuration files, and loading configurations.

[0013] The packet detection module implements packet detection for reverse proxy sites using nginx, including site identification, packet marking, and ACL bypass.

[0014] The aforementioned packet forwarding device implements a packet forwarding method based on a reverse proxy, including: Obtain the preset reverse proxy site IP and proxy port, and add them to the reverse proxy site table; In response to a request packet from a site, if the destination IP and port exist in the reverse proxy site table, a reverse proxy tag is added to the corresponding data packet, and the next node index of the data packet is set to the outgoing interface node to bypass the access control list processing.

[0015] The present invention, employing the above technical solution, has at least the following beneficial effects: For received data packets, the reverse proxy site table is first used to filter out the configured data packets requiring reverse proxying. Then, the corresponding connection status is queried from the connection tracking table. Based on the query results, the data packets are sent to the corresponding child nodes for processing. The child nodes hand the data packets to the kernel for deep packet inspection according to the security detection policy. After successful inspection, the data packets are returned, and the corresponding IP and port mapping is performed according to the preset reverse proxy configuration information, forwarding the data packets to the appropriate site for response. This technical solution can improve forwarding efficiency, significantly reduce packet processing latency, effectively ensure the throughput performance of network protection devices, and reduce the impact on network transmission efficiency. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with embodiments.

[0017] The first step is to explain some of the technical terms involved in the technical solution.

[0018] VPP is a highly modular and extensible software framework. Newly developed functional modules can be easily integrated into VPP without affecting the underlying code framework. The VPP platform can be used to build any type of data packet processing application, such as load balancing, firewalls, IDS, or incremental protocol stack infrastructure. Furthermore, application combinations can be created; for example, adding load balancing functionality to vSwitch. VPP runs in user space, meaning that VPP integration does not require changes to the Linux Kernel code.

[0019] DPDK (Data Plane Development Kit) is an open-source data plane development toolkit. It's a user-space library and driver set provided by Intel to address packet processing performance issues in Linux SMP environments. Core technologies of DPDK include EAL (Environment Adaptation Layer), PMD (Polling Mode Driver), RING (Lockless Loop), MEMPOOL (Memory Pool Management), MBUF (Cache Management), KNI (Kernel NIC Interface), and ACL (Access Control Library).

[0020] ACL: Access Control List, is a list of instructions for router and switch interfaces used to control data packets entering and leaving the port; in short, it is used to control data flow.

[0021] SSL: Secure Sockets Layer, is a security protocol that provides security and data integrity for network communication, encrypting network connections at the transport layer.

[0022] A WAF using reverse proxy mode is typically deployed in the user's network environment directly connected to the core switch. The firewall maps public web server IPs to WAF IPs and ports through destination address mapping. Once traffic reaches the WAF, it is matched with the corresponding forwarding server, which load balances the traffic to the various node service servers and provides security protection.

[0023] Example 1

[0024] First, the present invention and its embodiments provide a data packet forwarding method, including: Obtain the preset reverse proxy site IP and proxy port, and add them to the reverse proxy site table; In response to a request packet from a site, if the destination IP and port exist in the reverse proxy site table, a reverse proxy tag is added to the corresponding data packet, and the next node index of the data packet is set to the outgoing interface node to bypass the access control list processing.

[0025] Preferably, the above lookup request for whether the reverse proxy site is in the table includes calculating the first hash value of the destination IP of the data packet and the proxy port information, and checking whether the same hash value exists in the table.

[0026] For packets marked as reverse proxies, the packets are sent to the corresponding child nodes for processing according to the connection distribution table, including newly received connections, connections with established sessions, newly sent connections, disconnected connections, and other connections.

[0027] Furthermore, according to the distribution table, the data packet is sent to the corresponding child node for processing, including calculating the second hash value of the data packet's five-tuple information, and checking whether the same hash value exists in the connection distribution table based on the second hash value. If it exists, the corresponding connection exists in the connection tracking table.

[0028] Additionally, the child nodes process the data packets, including sending the packets to the kernel, where the security detection engine determines whether the connected data packets pose a threat based on preset detection rules. If the data packets do not pose a threat, they are sent to the corresponding site server for a response according to the preset reverse proxy configuration; otherwise, the data packets are discarded.

[0029] Preferably, before forwarding the data packet to the site server for a response, it also includes determining whether the data packet is marked as a reverse proxy data packet; if so, the next node index of the data packet is set to the outgoing interface.

[0030] Preferably, the above-mentioned packet forwarding method involves uploading HTTPS and HTTP protocol packets to the Linux kernel. Nginx uses a preloading mechanism to load the VCL dynamic library provided by VPP and creates associations between control messages and data messages of the VCL dynamic library. The control messages include connection establishment, disconnection, and reset, and the data messages include packet sending and receiving. After processing by nginx, the data packets are sent to the VPP connection module for further processing via VCL and shared memory. Once completed, the packets are sent out from the network card through the DPDK interface.

[0031] Furthermore, for requests to HTTPS sites, the SSL data is decrypted before it reaches the kernel for processing.

[0032] The present invention, employing the above technical solution, has at least the following beneficial effects: For received data packets, the reverse proxy site table is first used to filter out the configured data packets requiring reverse proxying. Then, the corresponding connection status is queried from the connection tracking table. Based on the query results, the data packets are sent to the corresponding child nodes for processing. The child nodes hand the data packets to the kernel for deep packet inspection according to the security detection policy. After successful inspection, the data packets are returned, and the corresponding IP and port mapping is performed according to the preset reverse proxy configuration information, forwarding the data packets to the appropriate site for response. This technical solution can improve forwarding efficiency, significantly reduce packet processing latency, effectively ensure the throughput performance of network protection devices, and reduce the impact on network transmission efficiency.

[0033] Example 2

[0034] On the other hand, the present invention and its embodiments also propose a data packet forwarding device, which includes: The configuration generation module generates nginx configuration files for reverse proxy sites, including reading site configurations from the database, generating configuration files, and loading configurations.

[0035] The packet detection module implements packet detection for reverse proxy sites using nginx, including site identification, packet marking, and ACL bypass.

[0036] The aforementioned packet forwarding device implements a packet forwarding method based on a reverse proxy, including: Obtain the preset reverse proxy site IP and proxy port, and add them to the reverse proxy site table; In response to a request packet from a site, if the destination IP and port exist in the reverse proxy site table, a reverse proxy tag is added to the corresponding data packet, and the next node index of the data packet is set to the outgoing interface node to bypass the access control list processing.

[0037] The present invention, employing the above technical solution, has at least the following beneficial effects: For received data packets, the reverse proxy site table is first used to filter out the configured data packets requiring reverse proxying. Then, the corresponding connection status is queried from the connection tracking table. Based on the query results, the data packets are sent to the corresponding child nodes for processing. The child nodes hand the data packets to the kernel for deep packet inspection according to the security detection policy. After successful inspection, the data packets are returned, and the corresponding IP and port mapping is performed according to the preset reverse proxy configuration information, forwarding the data packets to the appropriate site for response. This technical solution can improve forwarding efficiency, significantly reduce packet processing latency, effectively ensure the throughput performance of network protection devices, and reduce the impact on network transmission efficiency.

[0038] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc.

[0039] The description of the disclosed embodiments above enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles disclosed herein.

Claims

1. A packet forwarding method based on a reverse proxy, characterized in that, include: Obtain the preset reverse proxy site IP and proxy port, and add them to the reverse proxy site table; In response to a request packet from a site, if the destination IP and port exist in the reverse proxy site table, a reverse proxy tag is added to the corresponding data packet, and the next node index of the data packet is set to the outgoing interface node to bypass the access control list processing.

2. The data packet forwarding method according to claim 1, characterized in that, The process of checking whether a request is in the reverse proxy site table includes calculating a first hash value of the destination IP address and proxy port information of the data packet, and checking if the same hash value exists in the table.

3. The data packet forwarding method according to claim 1, characterized in that, For packets marked as reverse proxies, the packets are sent to the corresponding child nodes for processing according to the connection distribution table, including newly received connections, connections with established sessions, newly sent connections, disconnected connections, and other connections.

4. The data packet forwarding method according to claim 3, characterized in that, The process of sending data packets to the corresponding child nodes according to the distribution table includes calculating the second hash value of the data packet's five-tuple information, and checking whether there is a matching hash value in the connection distribution table based on the second hash value. If there is, then there is a corresponding connection in the connection tracking table.

5. The data packet forwarding method according to claim 3, characterized in that, The child node processes the data packets, including sending the data packets to the kernel, where the security detection engine determines whether the connected data packets are threatening according to preset detection rules. If the data packets are not threatening, they are sent to the corresponding site server for response according to the preset reverse proxy configuration; otherwise, the data packets are discarded.

6. The data packet forwarding method according to claim 5, characterized in that, Before the data packet is forwarded to the site server for a response, it also includes determining whether the data packet is marked as a reverse proxy data packet. If so, the next node index of the data packet is set to the outgoing interface.

7. The data packet forwarding method according to any one of claims 1-6, characterized in that, HTTPS and HTTP protocol data packets are uploaded to the Linux kernel. Nginx uses a preloading mechanism to load the VCL dynamic library provided by VPP and creates associations between the control messages and data messages of the VCL dynamic library. The control messages include connection establishment, disconnection and reset, and the data messages include data packet sending and receiving. After processing by nginx, the data packets are sent to the VPP connection module for further processing via VCL and shared memory. Once completed, the packets are sent out from the network card through the DPDK interface.

8. The data packet forwarding method according to claim 7, characterized in that, For requests to HTTPS sites, the SSL data also needs to be decrypted before it reaches the kernel for processing.

9. A data packet forwarding device, characterized in that, The device includes: The configuration generation module generates nginx configuration files for reverse proxy sites, including reading site configurations from the database, generating configuration files, and loading configurations. The packet detection module implements packet detection for reverse proxy sites using nginx, including site identification, packet marking, and ACL bypass.

10. The data packet forwarding apparatus according to claim 9, characterized in that, This device implements a packet forwarding method based on a reverse proxy, including: Obtain the preset reverse proxy site IP and proxy port, and add them to the reverse proxy site table; In response to a request packet from a site, if the destination IP and port exist in the reverse proxy site table, a reverse proxy tag is added to the corresponding data packet, and the next node index of the data packet is set to the outgoing interface node to bypass the access control list processing.