Single-channel VDI proxy service system and implementation method
Technical Field
The invention relates to the field of VDI (Virtual Desktop Infrastructure), in particular to a single-channel VDI proxy service system and an implementation method.
Background
TCP (Transmission Control Protocol) is a connection-oriented, reliable transport layer communication Protocol based on byte stream, and a group of TCP connections with a target address IP + PORT is called a TCP connection channel, referred to as a channel for short. Local server is a relative concept, referring to tcpserver, which is on the same machine as the client, and is typically accessed through 127.0.0.1 local IP.
At present, a plurality of connection channels generally exist between a VDI (Virtual Desktop Infrastructure) client and a server. Because of the business function implementation method, the client can be connected with at least one basic service and one desktop transmission service, because different clients are connected to different servers according to the actual load condition, the corresponding cloud desktop service IPs distributed by different clients are different, and for each client, a plurality of channels connected to the servers exist. Such client and server connections have applications with multiple sets of connection channels, which are generally inconvenient to proxy or map.
Disclosure of Invention
The invention aims to overcome the defects of the background technology and provides a single-channel VDI proxy service system and a realization method thereof.
The invention provides a single-channel VDI proxy service system, which comprises a client and a Server, wherein the client comprises a virtual desktop infrastructure VDI proxy client and an original VDI client, the Server comprises a VDI proxy Server and a plurality of real servers, a plurality of TCP (transmission control protocol) connecting channels exist between the original VDI client and the real servers, the VDI proxy client and the original VDI client run independently, the VDI proxy client comprises a network hijack module and a data sending and receiving module, the network hijack module uses an unoccupied port to create a local TCP Server group, and each local TCPServer comprises a data mixing unit;
the network hijacking module adopts a network hijacking method, and hijacks and modifies a target IP and a port of the TCP connection aiming at a specified process; respectively starting a plurality of local TCP servers according to the appointed ports; respectively sending uplink data originally sent to a remote Server connection channel to corresponding local TCP servers; each local TCP Server monitors different ports, each port transmits uplink data to a data mixing unit in the local TCP Server after receiving the uplink data, the data mixing unit transmits the uplink data to a data sending and receiving module, and the data sending and receiving module sends the uplink data to a VDI proxy Server;
the VDI proxy server divides the uplink data sent by the data sending and receiving module into packets and glues the packets of the uplink data, analyzes the packet header information of the custom protocol, and distributes the packet header information to the corresponding real server; after receiving downlink data sent by each real server, the VDI proxy server adds custom protocol header information and sends the data to a data sending and receiving module; the data sending and receiving module receives downlink data sent by the VDI proxy server, performs packet-pasting processing on the downlink data, analyzes custom protocol header information, divides the packet into a plurality of groups of data according to the header information, and sends the groups of data to corresponding local TCPServers respectively; and the local TCP Server forwards the downlink data sent by the data sending and receiving module to the original VDI client.
On the basis of the technical scheme, the network hijack module hijacks and modifies a target IP and a port of an original VDI client TCP connection to realize channel redirection; after hijacking, the target IP of the hijacked TCP connection is a fixed value.
On the basis of the technical scheme, the custom protocol packet header comprises a target IP, a target port and socket identity information.
On the basis of the technical scheme, the data mixing unit adds a custom protocol packet header in the received uplink data to obtain new uplink data, transmits the new uplink data to the data sending and receiving module, and the data sending and receiving module sends the new uplink data to the VDI proxy server to convert the requests of the original VDI client for connecting to a plurality of remote TCP connecting channels into the requests for connecting to the VDI proxy server; and the data sending and receiving module is uniformly connected with the VDI proxy server.
The invention also provides a method for realizing the single-channel VDI proxy service system, which comprises the following steps:
a plurality of Transmission Control Protocol (TCP) connecting channels exist between an original Virtual Desktop Infrastructure (VDI) client and a plurality of real servers, a VDI proxy client is added on a computer of the original VDI client, a VDI proxy Server is added on a Server, the VDI proxy client and the original VDI client operate independently, the VDI proxy client comprises a network hijack module and a data sending and receiving module, the network hijack module uses an unoccupied port to create a local TCP Server group, and each local TCP Server comprises a data mixing unit;
the network hijacking module adopts a network hijacking method, and hijacks and modifies a target IP and a port of the TCP connection aiming at a specified process; respectively starting a plurality of local TCP servers according to the appointed ports; respectively sending uplink data originally sent to a remote Server connection channel to corresponding local TCP servers; each local TCP Server monitors different ports, each port transmits uplink data to a data mixing unit in the local TCP Server after receiving the uplink data, the data mixing unit transmits the uplink data to a data sending and receiving module, and the data sending and receiving module sends the uplink data to a VDI proxy Server;
the VDI proxy server divides the uplink data sent by the data sending and receiving module into packets and glues the packets of the uplink data, analyzes the packet header information of the custom protocol, and distributes the packet header information to the corresponding real server; after receiving downlink data sent by each real server, the VDI proxy server adds a custom protocol packet header and sends the data to a data sending and receiving module; the data sending and receiving module receives downlink data sent by the VDI proxy Server, performs packet-pasting processing on the downlink data, analyzes custom protocol packet header information, divides the packet header information into a plurality of groups of data according to the packet header information, and sends the data to corresponding local TCP servers respectively; and the local TCP Server forwards the downlink data sent by the data sending and receiving module to the original VDI client.
On the basis of the technical scheme, the network hijack module hijacks and modifies a target IP and a port of an original VDI client TCP connection to realize channel redirection; after hijacking, the target IP of the hijacked TCP connection is a fixed value.
On the basis of the technical scheme, the custom protocol packet header comprises a target IP, a target port and socket identity information.
On the basis of the technical scheme, the data mixing unit adds a custom protocol packet header in the received uplink data to obtain new uplink data, transmits the new uplink data to the data sending and receiving module, and the data sending and receiving module sends the new uplink data to the VDI proxy server to convert the requests of the original VDI client for connecting to a plurality of remote TCP connecting channels into the requests for connecting to the VDI proxy server; and the data sending and receiving module is uniformly connected with the VDI proxy server.
Compared with the prior art, the invention has the following advantages:
the single-channel VDI proxy service system provided by the invention comprises a client and a Server, wherein the client comprises a VDI proxy client and an original VDI client, the Server comprises a VDI proxy Server and a plurality of real servers, a plurality of TCP (transmission control protocol) connecting channels exist between the original VDI client and the real servers, the VDI proxy client and the original VDI client operate independently, the VDI proxy client comprises a network hijack module and a data sending and receiving module, the network hijack module uses an unoccupied port to establish a local TCP Server group, and each local TCP Server comprises a data mixing unit, wherein: the network hijacking module adopts a network hijacking method, and hijacks and modifies a target IP and a port of the TCP connection aiming at a specified process; respectively starting a plurality of local TCP servers according to the appointed ports; respectively sending data originally sent to a remote Server connection channel to corresponding local TCP servers; each local TCP Server monitors different ports, each port transmits the data to a data mixing unit in the local TCP Server after receiving the data, the data mixing unit transmits uplink data to a data sending and receiving module, and the data sending and receiving module sends the uplink data to a VDI proxy Server; the VDI proxy server divides the uplink data sent by the data sending and receiving module into packets and glues the packets of the uplink data, analyzes the packet header information of the custom protocol, and distributes the packet header information to the corresponding real server; after receiving downlink data sent by each real server, the VDI proxy server adds a custom protocol packet header and sends the data to a data sending and receiving module; the data sending and receiving module carries out packet-binding processing on the downlink data sent by the VDI proxy Server, analyzes custom protocol packet header information, divides the packet header information into a plurality of groups of data according to the packet header information and respectively sends the data to corresponding local TCP servers; and the local TCP Server forwards the data sent by the data sending and receiving module to the original VDI client.
The invention provides a VDI proxy client and a VDI proxy server on the basis of the original client-server architecture, and realizes the VDI proxy server of a single channel on the basis of not changing the source code of the original system. The unchanged means that: and providing a separate running program and starting a separate process. The original executable program is not changed no matter the client side or the server side. The invention needs to add a VDI agent client on the computer of the original VDI client, and the VDI agent client and the original VDI client run independently. The program or source code of a real server end does not need to be changed, the program or source code of a client end does not need to be modified, the VDI proxy server of the server end only provides one unique IP and port for providing service, single-channel VDI proxy service is realized, proxy, mapping and forwarding are convenient, and the single-channel VDI proxy server is safer.
Drawings
Fig. 1 is a block diagram of an implementation system of a single-channel VDI proxy service system in the embodiment of the present invention.
Detailed Description
The invention is described in further detail below with reference to the figures and the embodiments.
Referring to fig. 1, an embodiment of the present invention provides a single-channel VDI proxy service system, where the system includes a client and a server, the client includes a VDI proxy client and an original VDI client, the server includes a VDI proxy server and multiple real servers, multiple TCP connection channels exist between the original VDI client and the multiple real servers, and the VDI proxy client and the original VDI client operate independently.
The invention also provides a method for realizing the single-channel VDI proxy service system, which comprises the following steps:
a plurality of transmission control protocol TCP connecting channels exist between an original VDI client and a plurality of real servers, a VDI proxy client is added on a computer of the original VDI client, a VDI proxy server is added on a server, and the VDI proxy client and the original VDI client operate independently.
Referring to fig. 1, the VDI proxy client includes a network hijack module and a data sending and receiving module, where the network hijack module determines whether a port to be set is occupied, and if the port is occupied and not a port opened by the system, other unoccupied ports are used to create a local TCP Server group, and each local TCP Server includes a data mixing unit.
The network hijack module adopts a network hijack method, aiming at a specified process, hijacks and modifies a target IP and a port which are connected with an original VDI client TCP, the target IP is modified to be 127.0.0.1, and channel redirection is realized; after hijacking, the target IP of the hijacked TCP connection is fixed to 127.0.0.1; the network hijack module respectively opens a plurality of local TCPServers according to the appointed ports, and one port can only open one local TCP Server; respectively sending uplink data originally sent to a remote Server connection channel to corresponding local TCP servers; each local TCP Server monitors different ports, each port transmits uplink data to a data mixing unit in the local TCP Server after receiving the uplink data, the data mixing unit adds a custom protocol packet header in the received uplink data, the custom protocol packet header comprises but is not limited to target IP, a target port, socket identity information and the like to obtain new uplink data, the new uplink data are transmitted to a data sending and receiving module, the data sending and receiving module sends the new uplink data to a VDI proxy Server, and requests of an original VDI client for connecting to a plurality of remote TCP connection channels are converted into requests for connecting to the VDI proxy Server; and the data sending and receiving module is uniformly connected with the VDI proxy server.
The VDI proxy server divides the uplink data sent by the data sending and receiving module into packets and glues the packets of the uplink data, analyzes the packet header information of the custom protocol, and distributes the packet header information to the corresponding real server; after receiving downlink data sent by each real server, the VDI proxy server adds a custom protocol packet header and sends the data to a data sending and receiving module; the data sending and receiving module carries out sub-packet pasting processing on the downlink data sent by the VDI proxy server, analyzes the packet header information of the custom protocol, and divides the packet header information into a plurality of groups of data; respectively sending the distributed multiple groups of data to corresponding local TCP servers according to the information of the custom protocol packet header; and the local TCP Server forwards the downlink data sent by the data sending and receiving module to the original VDI client.
The single-channel VDI proxy service system only keeps one connection channel between the client and the proxy server, namely only one IP and one port. For the client, the VDI proxy server is a real VDI server, provides cloud desktop service, and encapsulates real logic processing.
The difficulty in implementing a VDI proxy server is: the existing client side and server side have a plurality of connecting channels, the IP addresses and ports of partial channels are configurable, the IP addresses and ports of partial channels are dynamically acquired, and the channels have logical association and are not independent. The proxy service program is irrelevant to the application software program, and the realization of the proxy service program is realized without modifying the source code of the original application program. From the viewpoint of cost, it is also troublesome to change the original client and server, and complicated logic processing is involved.
The following is a detailed description by a specific case.
For example, in a windows operating system, hijacking can be realized by various means, including methods such as a network card driver layer, an IP layer, an ndis, a tdi, a wfp, L SP, a hook socket API and the like.
The method comprises the steps that a plurality of TCP connecting channels exist between an original VDI client and a plurality of real servers, a VDI proxy client is added on a computer of the original VDI client, a VDI proxy Server is added on a Server, the VDI proxy client and the original VDI client operate independently, the VDI proxy client comprises a network hijack module and a data sending and receiving module, the network hijack module judges whether a port to be set is occupied, if the port is occupied and not a port opened by the system, other unoccupied ports are used to create a local TCP Server group, and each local TCP Server comprises a data mixing unit.
The present embodiment assumes that the following three connection channels exist between the client and the server:
192.168.0.251:5672;
192.168.0.253:5909;
192.168.0.251:8090;
the network hijacking module adopts a network hijacking method, aiming at a specified process, hijacking and modifying an original VDI client TCP connection target IP and a Port, wherein a remote host address is modified to be 127.0.0.1; before the network hijack module hijacks and modifies a target IP and a port of TCP connection, whether the port to be set is occupied or not is judged, and if the port is occupied and is not the port opened by the system, other unoccupied ports are used.
Assuming that three client ports in the implementation example are 5672, 5909, and 8090, respectively, the network hijacking module starts three local TCP servers, and the original three real channels are as follows:
192.168.0.251:5672->127.0.0.1:5672;
192.168.0.253:5909->127.0.0.1:5909;
192.168.0.251:8090->127.0.0.1:8090;
and the network hijack module respectively sends the uplink data originally sent to the remote Server connection channel to the corresponding local TCP servers. Each local TCP Server monitors different ports, each port transmits uplink data to a data mixing unit in the local TCP Server after receiving the uplink data, the data mixing unit adds a custom protocol packet header in the received uplink data to obtain new uplink data, transmits the new uplink data to a data sending and receiving module, the data sending and receiving module sends the new uplink data to a VDI proxy Server, and converts requests of an original VDI client connected to a plurality of remote TCP connection channels into requests connected to the VDI proxy Server; and the data sending and receiving module is uniformly connected with the VDI proxy server.
The VDI proxy server divides the uplink data sent by the data sending and receiving module into packets and glues the packets of the uplink data, analyzes the packet header information of the custom protocol, and distributes the packet header information to the corresponding real server; after receiving downlink data sent by each real server, the VDI proxy server adds a custom protocol packet header and sends the data to a data sending and receiving module; the data sending and receiving module divides the data sent by the VDI proxy Server into a plurality of groups of data and respectively sends the plurality of groups of divided data to corresponding local TCP servers; and the local TCP Server forwards the downlink data sent by the data sending and receiving module to the original VDI client.
Hardware requirements: the VDI proxy server has higher requirement on the network card, and is generally evaluated according to the number of the actual cloud desktop terminals. If the number of the cloud desktop terminals is large, a network card with ten-million network cards or even a network card with better parameters is generally suggested.
The Server in the embodiment of the present invention is not necessarily a physical (virtual) Server occupied by one service, and generally refers to a TCP Server.
In the present real-time example, only three local TCP servers are listed, and in practical application, a plurality of local tcpservers may be supported.
Various modifications and variations of the embodiments of the present invention may be made by those skilled in the art, and they are also within the scope of the present invention, provided they are within the scope of the claims of the present invention and their equivalents.
What is not described in detail in the specification is prior art that is well known to those skilled in the art.