WO2017143807A1 - 一种重启网络服务的方法及系统 - Google Patents

一种重启网络服务的方法及系统 Download PDF

Info

Publication number
WO2017143807A1
WO2017143807A1 PCT/CN2016/106052 CN2016106052W WO2017143807A1 WO 2017143807 A1 WO2017143807 A1 WO 2017143807A1 CN 2016106052 W CN2016106052 W CN 2016106052W WO 2017143807 A1 WO2017143807 A1 WO 2017143807A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
network service
restarting
user space
space
Prior art date
Application number
PCT/CN2016/106052
Other languages
English (en)
French (fr)
Inventor
陈迅
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to EP16891255.8A priority Critical patent/EP3309678A4/en
Priority to US15/557,426 priority patent/US10496415B2/en
Publication of WO2017143807A1 publication Critical patent/WO2017143807A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G06F9/44505—Configuring for program initiating, e.g. using registry, configuration files
    • G06F9/4451—User profiles; Roaming
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/4401—Bootstrapping
    • G06F9/4406—Loading of operating system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4843—Task transfer initiation or dispatching by program, e.g. task dispatcher, supervisor, operating system
    • G06F9/485—Task life-cycle, e.g. stopping, restarting, resuming execution
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2209/00—Indexing scheme relating to G06F9/00
    • G06F2209/48—Indexing scheme relating to G06F9/48
    • G06F2209/482—Application

Definitions

  • the present invention relates to the field of Linux operating system technology, and in particular to the technical field of network communication and system configuration under the Linux operating system, and specifically relates to a method and system for restarting a network service.
  • Some network services must restart the process to complete the reboot or reload the configuration file.
  • a typical example is the HAProxy web service.
  • This network service uses the SO_REUSEPORT option to bind the new process to the same IP address and port as the old process to start listening for new connections, and then signals the old process to close the socket of the listening port.
  • SO_REUSEPORT in the Linux kernel, the first message (SYN message) of the new connection may be assigned to any of the new and old processes. If the SYN message is assigned to the old process, and then the old process's listening socket is closed, according to the TCP protocol, the server sends a TCP RST message to the client to reset the connection.
  • a simple approach is to configure the Iptables rule to discard the newly received SYN packets during the process restart.
  • the client resends the SYN packet after receiving the SYN/ACK packet for a period of time.
  • the shortcoming of this solution is that the client waits for a timeout and resends the SYN message for a long time, generally more than 1 second, and the process restart time usually takes only tens of milliseconds. Although the new connection will not be reset, it will result in a longer delay.
  • Another possible solution is to take advantage of Linux's flow control tools. First use Iptables to mark the newly inbound SYN messages, and then use the flow control tool to temporarily cache these messages. After the process is restarted, these SYN messages are released. Compared to the previous scheme, the delay caused by this scheme is relatively short. However, since the flow control tool can only control the outgoing traffic, the usage scenario is limited.
  • the object of the present invention is to provide a method and system for restarting a network service, which is used to solve the problem that the processing of the pending message is delayed or the processing is restricted when the network service is restarted in the prior art.
  • the problem is to provide a method and system for restarting a network service, which is used to solve the problem that the processing of the pending message is delayed or the processing is restricted when the network service is restarted in the prior art.
  • the present invention provides a method for restarting a network service, including: configuring a packet of an Iptables in a Linux operating system to be processed when receiving a preparation signal for restarting a network service process.
  • the team processes the rules, buffering the pending messages from the kernel space to the user space; restarting the receiving network service process
  • the completion signal is completed, the pending message of the user space buffer is read and the read pending message is released to the kernel space, so that the to-be-processed message and the network service are The new process establishes a connection.
  • the packet enqueue processing rule of the NFQUEUE or QUEUE of the Iptables is configured, and the to-be-processed message is cached from the kernel space to the user space.
  • the pending message of the user space buffer is read and read.
  • the to-be-processed message is released to the kernel space.
  • the message release handler calls the libNetfilter_queue library or the libipq library.
  • the present invention further provides a system for restarting a network service, comprising: a configuration module, configured to configure a report of the Iptables in the Linux operating system when the preparation signal for preparing for the restart of the network service process is received The enqueue processing rule, the pending message is cached from the kernel space to the user space; the release module is configured to read the pending message of the user space cache when receiving the completion signal of the network service process restart completion And releasing the read to-be-processed message to the kernel space, so that the to-be-processed message is connected to a new process of the network service.
  • the packet enqueue processing rule of the NFQUEUE or QUEUE of the Iptables is configured, and the to-be-processed message is cached from the kernel space to the user space.
  • the release module includes a message release processing program disposed in the user space, and the message release processing program is used to read the completion signal of the network service process when the network service process is completed.
  • the pending message buffered by the user space is released and the read pending message is released to the kernel space.
  • the message release handler calls the libNetfilter_queue library or the libipq library.
  • the present invention utilizes the NFQUEUE or QUEUE target in the Iptables/Netfilter framework, and implements a new method of restarting the network service without packet loss and zero-stop based on the packet buffer technology, and only needs to configure an Iptables command, and a user space program. It can be implemented, with simple configuration and deployment, effective for outgoing incoming connections, and unlimited use scenarios.
  • the message release processing program of the pending packet of the user space processing cache in the present invention is also relatively simple, and the source code of the Linux kernel or the network service program does not need to be modified.
  • FIG. 1 is a schematic flow chart showing a method for restarting a network service according to the present invention.
  • FIG. 2 is a schematic diagram of processing of a message in a method for restarting a network service according to the present invention.
  • FIG. 3 is a block diagram showing the structure of a system for restarting a network service according to the present invention.
  • the purpose of this embodiment is to provide a method and system for restarting a network service, which is used to solve the problem that the delay of processing a new connection message is long or the processing is restricted when the network service is restarted in the prior art.
  • the method and system of the method and system for restarting the network service in this embodiment are described in detail below, so that a method and system for restarting the network service in this embodiment can be understood by those skilled in the art without any creative work.
  • this embodiment provides a method and system for restarting a network service, which is applicable to restarting a network service in a Linux operating system.
  • the method and system for restarting the network service provided in this embodiment utilizes the NFQUEUE/QUEUE mechanism of the Iptables tool to implement a method for restarting the network service with zero shutdown, so that all new connections can be processed normally when the network service is restarted without Will cause the connection to be interrupted.
  • it has the advantages of simple configuration and deployment, effective for outgoing incoming connections, and unlimited use scenarios.
  • the embodiment provides a method for restarting a network service, where the method for restarting a network service includes the following steps.
  • Step S1 When receiving the preparation signal for restarting the network service process, configure the packet enqueue processing rule of the Iptables in the Linux operating system, and cache the to-be-processed message from the kernel space to the user space.
  • Iptables is an IP packet filtering system integrated with the latest 3.5 version of the Linux kernel. That is to say, in the embodiment, the IP packet filtering system is a Netfilter/Iptables IP packet filtering system. If the Linux system is connected to the Internet or a LAN, a server, or a proxy server that connects to the LAN and the Internet, the system facilitates better control over IP packet filtering and firewall configuration on Linux systems.
  • Netfilter/Iptables IP Packet Filtering System is a powerful tool for adding, editing and removing rules then. Although the Netfilter/Iptables IP packet filtering system is called a single entity, it actually consists of two components, Netfilter and Iptables.
  • the Iptables component is a tool, also known as userspace, that makes it easy to insert, modify, and remove rules in a packet filter table.
  • the Netfilter component also known as kernelspace (kernelspace) is part of the kernel and consists of packet filtering tables that contain the set of rules that the kernel uses to control packet filtering.
  • Netfilter is a network-related subsystem in the Linux kernel. As a general, abstract framework, it provides functions such as packet filtering, packet modification, and network address translation.
  • the IP packet filtering system caches the to-be-processed message in the user space in a queue form.
  • the NFQUEUE or QUEUE packet of the Iptables is configured to enter the packet.
  • the team processes the rules and caches the pending messages from the kernel space to the user space.
  • the NFQUEUE or QUEUE is a specific function module of the Netfilter/Iptables.
  • the NFQUEUE or QUEUE function module can implement packet enqueue processing.
  • the NFQUEUE or QUEUE function module is used to enroll the packets into the queue.
  • the processing rule can be configured according to the principle of the packet enqueue processing and the required configuration parameter options according to the NFQUEUE or QUEUE function module.
  • this embodiment uses NFQUEUE or QUEUE to enqueue packets into the user space, and then a pre-prepared user space program to further process and determine the destination of these messages (accept, discard or further) Processing, etc.). If the incoming packets are not processed by the user space process, they will be temporarily cached in the queue. Therefore, Netfilter's NFQUEUE or QUEUE function actually provides a way to cache messages.
  • Step S2 when receiving the completion signal of the restart of the network service process, reading the pending message of the user space buffer and releasing the read pending message to the kernel space, so that the The pending message establishes a connection with the new process of the network service.
  • the handover of the new and old processes is completed, the pending message of the user space buffer is read, and the read pending message is released to the Kernel space to establish a connection between the to-be-processed message and a new process of the network service.
  • the user space cache is read. Processing the message and releasing the read pending message to the kernel space.
  • the message release processing program calls the libNetfilter_queue library or the libipq library.
  • the message release processing program runs in the user space, and can be written using a library including but not limited to the libNetfilter_queue and libipq libraries.
  • the message release handler only needs to wait for the restart script of the network service process to complete. After the new and old processes are replaced, the packets in the queue are released to the kernel space. At this time, since the old process has exited, only the new process is in the listening state, and all the previously cached SYN messages will all establish a connection with the new process.
  • the NFQUEUE or QUEUE of the Iptables is used to buffer the newly received SYN message to the user space during the time when the new and old processes are handed over, waiting for the handover of the new and old processes.
  • a user space program is used to accept the cached SYN packets, so that the SYN packets re-enter the kernel space and establish a connection with the new process.
  • the embodiment further provides a system for restarting the network service.
  • the system for restarting the network service includes: configuring a module and releasing Module.
  • the configuration module is configured to configure a packet enqueue processing rule of the Iptables in the Linux operating system when the preparation signal for preparing for the restart of the network service process is received, and the to-be-processed packet is to be processed. Kernel space is cached into user space. Since the system for restarting the network service in this embodiment has the same principle as the method for restarting the network service, the description of the Iptables and the Netfilter will not be repeated here.
  • the packet enqueue processing rule of the NFQUEUE or QUEUE of the Iptables is configured, and the to-be-processed message is cached from the kernel space to the user space.
  • the NFQUEUE or QUEUE is a specific function module of the Netfilter/Iptables.
  • the NFQUEUE or QUEUE function module can implement packet enqueue processing.
  • the NFQUEUE or QUEUE function module is used to enroll the packets into the queue.
  • the processing rule can be configured according to the principle of the packet enqueue processing and the required configuration parameter options according to the NFQUEUE or QUEUE function module.
  • the release module is configured to read the pending message of the user space buffer and release the read pending message to the completion signal of the network service process restart completion.
  • the kernel space is configured to establish a connection between the to-be-processed message and a new process of the network service.
  • the handover of the new and old processes is completed, the pending message of the user space buffer is read, and the read pending message is released to the Kernel space to establish a connection between the to-be-processed message and a new process of the network service.
  • the release module includes a message release processing program disposed in the user space, and the message release processing program is used to complete the completion of the reloading of the network service process.
  • the message release processing program is used to complete the completion of the reloading of the network service process.
  • the message release processing program calls the libNetfilter_queue library or the libipq library.
  • the message release processing program runs in the user space, and can be written using a library including but not limited to the libNetfilter_queue and libipq libraries.
  • the message release handler only needs to wait for the restart script of the network service process to complete. After the new and old processes are replaced, the packets in the queue are released to the kernel space. At this time, since the old process has exited, only the new process is in the listening state, and all the previously cached SYN messages will all establish a connection with the new process.
  • the present invention utilizes the NFQUEUE or QUEUE target in the Netfilter framework to implement a new method for restarting network services without packet loss and zero-stop based on the packet caching technology, and only needs to configure one Iptables command and one user space program. It can be realized, has the advantages of simple configuration and deployment, effective for outgoing incoming connections, and unrestricted use scenarios; the program for processing the cached pending messages in the user space of the present invention is also relatively simple, and does not need to modify the Linux kernel or The source code of the web service program. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供一种重启网络服务的方法及系统，所述方法包括：在接收到准备进行网络服务进程重启的准备信号时，配置Linux操作系统中Iptables的报文入队处理规则，将待处理报文从内核空间缓存到用户空间；通过于用户空间内设置一报文释放处理程序来实现在接收到网络服务进程重启完成的完成信号时，将用户空间缓存的待处理报文释放到内核空间，以使待处理报文与所述网络服务的新进程建立连接；所述IP信息包过滤系统利用NFQUEUE或者QUEUE将待处理报文缓存到用户空间。本发明只需要配置一条Iptables命令，以及一个用户空间程序即可实现，具有配置部署简单，对传出传入的连接都有效，使用场景不受限制等优点。

Description

一种重启网络服务的方法及系统 技术领域
本发明涉及Linux操作系统技术领域，特别是涉及Linux操作系统下的网络通讯和系统配置技术领域，具体为一种重启网络服务的方法及系统。
背景技术
某些网络服务必须重新启动进程才能完成重启或者重新载入配置文件。典型的例子是HAProxy网络服务。此网络服务通过使用SO_REUSEPORT选项，将新进程绑定到与旧进程完全相同的IP地址和端口开始监听新的连接，再发送信号通知老进程关闭监听端口的套接字(socket)。但是，当新老两个进程都绑定到同一个IP和端口，并且老进程的监听套接字还未关闭的短暂时间间隙中，新的连接可能会到来。根据Linux内核中SO_REUSEPORT的实现，新连接的第一个报文(SYN报文)可能会被分配给新老进程中的任意一个。如果这个SYN报文被分配给老进程，而紧接着老进程的监听套接字又被关闭，根据TCP协议，服务端会发送一个TCP RST报文给客户端重置这条连接。
针对这一问题，目前有一些解决方案。一种简单的做法是在进程重启期间配置Iptables规则丢弃掉新收到的SYN报文。根据TCP协议，客户端在没有收到SYN/ACK报文一段时间后会重新发送SYN报文。这一方案的不足之处在于，客户端等待超时并且重新发送SYN报文的时间很长，一般在1秒种以上，而进程重启的时间往往只需要几十毫秒。虽然新连接不会被重置，但却带来了较长时间的延时。
另一个可行的方案是利用Linux的流量控制工具。先使用Iptables标记新流入的SYN报文，再用流量控制工具暂时缓存这些报文。在进程完成重启之后，再释放这些SYN报文。相比于上一方案，这一方案所引起的时延相对较短。但是，由于流量控制工具只能控制流出的流量，因而使用场景受到了一定的限制。
发明内容
鉴于以上所述现有技术的缺点，本发明的目的在于提供一种重启网络服务的方法及系统，用于解决现有技术中重启网络服务时处理待处理报文延时较长或处理受到限制的问题。
为实现上述目的及其他相关目的，本发明提供一种重启网络服务的方法，包括：在接收到准备进行网络服务进程重启的准备信号时，待处理报文配置Linux操作系统中Iptables的报文入队处理规则，将待处理报文从内核空间缓存到用户空间；在接收到网络服务进程重启 完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间，以使所述待处理报文与所述网络服务的新进程建立连接。
优选地，配置Iptables的NFQUEUE或者QUEUE的报文入队处理规则，将待处理报文从所述内核空间缓存到所述用户空间。
优选地，通过在所述用户空间内设置一报文释放处理程序来实现在接收到所述网络服务进程重载完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间。
优选地，所述报文释放处理程序调用libNetfilter_queue程序库或libipq程序库。
为实现上述目的，本发明还提供一种重启网络服务的系统，包括：配置模块，用于在接收到准备进行网络服务进程重启的准备信号时，待处理报文配置Linux操作系统中Iptables的报文入队处理规则，将待处理报文从内核空间缓存到用户空间；释放模块，用于在接收到网络服务进程重启完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间，以使所述待处理报文与所述网络服务的新进程建立连接。
优选地，配置Iptables的NFQUEUE或者QUEUE的报文入队处理规则，将待处理报文从所述内核空间缓存到所述用户空间。
优选地，所述释放模块包括设置于所述用户空间内的一报文释放处理程序，利用所述报文释放处理程序在接收到所述网络服务进程重载完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间。
优选地，所述报文释放处理程序调用libNetfilter_queue程序库或libipq程序库。
如上所述，本发明的一种重启网络服务的方法及系统，具有以下有益效果：
1、本发明利用Iptables/Netfilter框架中的NFQUEUE或QUEUE目标，基于包缓存技术实现了一种新的无丢包零停机重启网络服务的方法，只需要配置一条Iptables命令，以及一个用户空间程序即可实现，具有配置部署简单，对传出传入的连接都有效，使用场景不受限制等优点。
2、本发明中用户空间处理缓存的待处理报文的报文释放处理程序实现也较为简单，无需修改Linux内核或者网络服务程序的源代码。
附图说明
图1显示为本发明的重启网络服务的方法的流程示意图。
图2显示为本发明的重启网络服务的方法中报文的处理示意图。
图3显示为本发明的重启网络服务的系统的结构框图。
元件标号说明
1      重启网络服务的系统
11     配置模块
12     释放模块
S1～S2 步骤
具体实施方式
以下通过特定的具体实例说明本发明的实施方式，本领域技术人员可由本说明书所揭露的内容轻易地了解本发明的其他优点与功效。本发明还可以通过另外不同的具体实施方式加以实施或应用，本说明书中的各项细节也可以基于不同观点与应用，在没有背离本发明的精神下进行各种修饰或改变。
本实施例的目的在于提供一种重启网络服务的方法及系统，用于解决现有技术中重启网络服务时处理新连接的报文延时较长或处理受到限制的问题。以下将详细阐述本实施例的一种重启网络服务的方法及系统的原理及实施方式，使本领域技术人员不需要创造性劳动即可理解本实施例的一种重启网络服务的方法及系统。
如图1至图3所示，本实施例提供一种重启网络服务的方法及系统，适用于Linux操作系统中重启网络服务。本实施例提供的一种重启网络服务的方法及系统中利用Iptables工具的NFQUEUE/QUEUE机制，实现了一种零停机重启网络服务的方法，使重启网络服务时能正常处理所有的新连接而不会造成连接中断。相比于现有的其它方法，具有配置部署简单，对传出传入的连接都有效，使用场景不受限制等优点。
具体地，如图1所示，本实施例提供一种重启网络服务的方法，所述重启网络服务的方法包括以下步骤。
步骤S1，在接收到准备进行网络服务进程重启的准备信号时，配置Linux操作系统中Iptables的报文入队处理规则，将待处理报文从内核空间缓存到用户空间。
于本实施例中，Iptables是与最新的3.5版本Linux内核集成的IP信息包过滤系统。也就是说，于本实施例中，IP信息包过滤系统即为Netfilter/Iptables IP信息包过滤系统。如果Linux系统连接到因特网或LAN、服务器或连接LAN和因特网的代理服务器，则该系统有利于在Linux系统上更好地控制IP信息包过滤和防火墙配置。
Netfilter/Iptables IP信息包过滤系统是一款功能强大的工具，可用于添加、编辑和移除规 则。虽然Netfilter/Iptables IP信息包过滤系统被称为单个实体，但它实际上由两个组件Netfilter和Iptables组成。
Iptables组件是一种工具，也称为用户空间(userspace)，它使插入、修改和除去信息包过滤表中的规则变得容易。
Netfilter组件也称为内核空间(kernelspace)，是内核的一部分，由一些信息包过滤表组成，这些表包含内核用来控制信息包过滤处理的规则集。Netfilter是Linux内核中的一个与网络功能相关的子系统。它作为一个通用的、抽象的框架，提供了数据包过滤、数据包修改、网络地址转换等功能。
具体地，于本实施例中，所述IP信息包过滤系统以队列形式将所述待处理报文缓存到用户空间，进一步来说，本实施例中，配置Iptables的NFQUEUE或者QUEUE的报文入队处理规则，将待处理报文从所述内核空间缓存到所述用户空间。其中，NFQUEUE或者QUEUE为Netfilter/Iptables自身具备的一个具体功能模块，该NFQUEUE或者QUEUE功能模块可以实现报文入队处理，其中NFQUEUE或者QUEUE功能模块用于实现报文入队处理的报文入队处理规则可以根据NFQUEUE或者QUEUE功能模块实现报文入队处理的原理和所要求的配置参数选项进行配置。
具体地，在本实施例中，如图2所示，准备进行进程重启时，添加一条Iptables配置，将服务进程所监听的端口接收到的TCP SYN报文利用Netfilter的NFQUEUE或者QUEUE目标缓存到用户空间。添加这一配置后，由于新的TCP SYN报文被缓存到用户空间，所以暂时不会与新老服务进程中的任何一个建立连接。
在Netfilter提供的众多功能中，本实施例利用NFQUEUE或者QUEUE将报文入队到用户空间，再由一个预先准备好的用户空间程序来进一步处理并决定这些报文的去向(接受、丢弃或者进一步处理，等等)。如果入队的报文没有马上被用户空间的进程处理，这些报文将被暂时缓存在队列中。所以，Netfilter的NFQUEUE或者QUEUE功能事实上提供了一种缓存报文的方法。
步骤S2，在接收到网络服务进程重启完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间，以使所述待处理报文与所述网络服务的新进程建立连接。
如图2所示，在执行网络服务的进程重启脚本，完成新旧进程的交接替换后，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间，以使所述待处理报文与所述网络服务的新进程建立连接。
具体地，于本实施例中，通过在所述用户空间内设置一报文释放处理程序来实现在接收到所述网络服务进程重载完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间。
优选地，于本实施例中，所述报文释放处理程序调用libNetfilter_queue程序库或libipq程序库。
也就是说，于本实施例中，所述报文释放处理程序运行在用户空间，并可以使用包括但不仅限于libNetfilter_queue及libipq库的程序库来编写实现。此报文释放处理程序只需要等待网络服务进程的重启脚本执行完成，新旧进程完成替换后，释放队列中的报文到内核空间即可。此时，由于老进程已经退出，只有新进程处于监听状态，这些先前被缓存的SYN报文将全部与新进程建立连接。
根据本实施例提供的重启网络服务的方法，只需要在新老进程发生交接的这段时间内，利用Iptables的NFQUEUE或者QUEUE，将新接收到的SYN报文缓存到用户空间，等待新旧进程交接替换完成，再使用一个用户空间程序接受这些缓存的SYN报文，使这些SYN报文重新进入内核空间，并与新进程建立连接即可。
为实现本实施例中的一种重启网络服务的方法，本实施例还提供一种重启网络服务的系统，具体地，如图3所示，所述重启网络服务的系统包括：配置模块和释放模块。
于本实施例中，所述配置模块用于在接收到准备进行网络服务进程重启的准备信号时，待处理报文配置Linux操作系统中Iptables的报文入队处理规则，将待处理报文从内核空间缓存到用户空间。由于本实施例中的重启网络服务的系统与重启网络服务的方法的原理相同，故对Iptables和Netfilter的说明在此不再重复赘述。
具体地，于本实施例中，配置Iptables的NFQUEUE或者QUEUE的报文入队处理规则，将待处理报文从所述内核空间缓存到所述用户空间。其中，NFQUEUE或者QUEUE为Netfilter/Iptables自身具备的一个具体功能模块，该NFQUEUE或者QUEUE功能模块可以实现报文入队处理，其中NFQUEUE或者QUEUE功能模块用于实现报文入队处理的报文入队处理规则可以根据NFQUEUE或者QUEUE功能模块实现报文入队处理的原理和所要求的配置参数选项进行配置。
具体地，在本实施例中，如图2所示，准备进行进程重启时，添加一条Iptables配置，将服务进程所监听的端口接收到的TCP SYN报文利用Netfilter的NFQUEUE或者QUEUE目标缓存到用户空间。添加这一配置后，由于新的TCP SYN报文被缓存到用户空间，所以暂时不会与新老服务进程中的任何一个建立连接。
于本实施例中，所述释放模块用于在接收到网络服务进程重启完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间，以使所述待处理报文与所述网络服务的新进程建立连接。
如图2所示，在执行网络服务的进程重启脚本，完成新旧进程的交接替换后，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间，以使所述待处理报文与所述网络服务的新进程建立连接。
具体地，于本实施例中，所述释放模块包括设置于所述用户空间内的一报文释放处理程序，利用所述报文释放处理程序在接收到所述网络服务进程重载完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间。
其中，优选地，于本实施例中，所述报文释放处理程序调用libNetfilter_queue程序库或libipq程序库。
也就是说，于本实施例中，所述报文释放处理程序运行在用户空间，并可以使用包括但不仅限于libNetfilter_queue及libipq库的程序库来编写实现。此报文释放处理程序只需要等待网络服务进程的重启脚本执行完成，新旧进程完成替换后，释放队列中的报文到内核空间即可。此时，由于老进程已经退出，只有新进程处于监听状态，这些先前被缓存的SYN报文将全部与新进程建立连接。
综上所述，本发明利用Netfilter框架中的NFQUEUE或QUEUE目标，基于包缓存技术实现了一种新的无丢包零停机重启网络服务的方法，只需要配置一条Iptables命令，以及一个用户空间程序即可实现，具有配置部署简单，对传出传入的连接都有效，使用场景不受限制等优点；本发明用户空间处理缓存的待处理报文的程序实现也较为简单，无需修改Linux内核或者网络服务程序的源代码。所以，本发明有效克服了现有技术中的种种缺点而具高度产业利用价值。
上述实施例仅例示性说明本发明的原理及其功效，而非用于限制本发明。任何熟悉此技术的人士皆可在不违背本发明的精神及范畴下，对上述实施例进行修饰或改变。因此，举凡所属技术领域中具有通常知识者在未脱离本发明所揭示的精神与技术思想下所完成的一切等效修饰或改变，仍应由本发明的权利要求所涵盖。

Claims (8)

  1. 一种重启网络服务的方法，其特征在于：包括：
    在接收到准备进行网络服务进程重启的准备信号时，配置Linux操作系统中Iptables的报文入队处理规则，将待处理报文从内核空间缓存到用户空间；
    在接收到网络服务进程重启完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间，以使所述待处理报文与所述网络服务的新进程建立连接。
  2. 根据权利要求1所述的重启网络服务的方法，其特征在于：配置Iptables的NFQUEUE或者QUEUE的报文入队处理规则，将待处理报文从所述内核空间缓存到所述用户空间。
  3. 根据权利要求1或2所述的重启网络服务的方法，其特征在于：通过在所述用户空间内设置一报文释放处理程序来实现在接收到所述网络服务进程重载完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间。
  4. 根据权利要求3所述的重启网络服务的方法，其特征在于：所述报文释放处理程序调用libNetfilter_queue程序库或libipq程序库。
  5. 一种重启网络服务的系统，其特征在于：包括：
    配置模块，用于在接收到准备进行网络服务进程重启的准备信号时，待处理报文配置Linux操作系统中Iptables的报文入队处理规则，将待处理报文从内核空间缓存到用户空间；
    释放模块，用于在接收到网络服务进程重启完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处理报文释放到所述内核空间，以使所述待处理报文与所述网络服务的新进程建立连接。
  6. 根据权利要求5所述的重启网络服务的系统，其特征在于：配置Iptables的NFQUEUE或者QUEUE的报文入队处理规则，将待处理报文从所述内核空间缓存到所述用户空间。
  7. 根据权利要求5或6所述的重启网络服务的系统，其特征在于：所述释放模块包括设置于所述用户空间内的一报文释放处理程序，利用所述报文释放处理程序在接收到所述网络服务进程重载完成的完成信号时，读取所述用户空间缓存的待处理报文并将读取的所述待处 理报文释放到所述内核空间。
  8. 根据权利要求7所述的重启网络服务的系统，其特征在于：所述报文释放处理程序调用libNetfilter_queue程序库或libipq程序库。
PCT/CN2016/106052 2016-02-25 2016-11-16 一种重启网络服务的方法及系统 WO2017143807A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP16891255.8A EP3309678A4 (en) 2016-02-25 2016-11-16 Method and system for restarting network service
US15/557,426 US10496415B2 (en) 2016-02-25 2016-11-16 Method and system for restarting network service

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610104989.XA CN105808287B (zh) 2016-02-25 2016-02-25 一种重启网络服务的方法及系统
CN201610104989.X 2016-02-25

Publications (1)

Publication Number Publication Date
WO2017143807A1 true WO2017143807A1 (zh) 2017-08-31

Family

ID=56465876

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/106052 WO2017143807A1 (zh) 2016-02-25 2016-11-16 一种重启网络服务的方法及系统

Country Status (4)

Country Link
US (1) US10496415B2 (zh)
EP (1) EP3309678A4 (zh)
CN (1) CN105808287B (zh)
WO (1) WO2017143807A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111158776A (zh) * 2019-12-12 2020-05-15 杭州安恒信息技术股份有限公司 一种Web应用防护系统平滑重启方法

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105808287B (zh) 2016-02-25 2019-06-18 网宿科技股份有限公司 一种重启网络服务的方法及系统
US11228657B2 (en) * 2019-12-03 2022-01-18 Red Hat, Inc. Hybrid proxying with user space hold
CN114915669A (zh) * 2021-02-08 2022-08-16 北京金山云网络技术有限公司 一种基于quic协议的服务升级方法、装置及电子设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150163197A1 (en) * 2013-12-06 2015-06-11 Qualcomm Innovation Center, Inc. Systems, methods, and apparatus for full-cone and address restricted cone network address translation using hardware acceleration
CN104753752A (zh) * 2013-12-30 2015-07-01 上海格尔软件股份有限公司 一种适用于vpn的按需连接方法
CN105808287A (zh) * 2016-02-25 2016-07-27 网宿科技股份有限公司 一种重启网络服务的方法及系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7827152B1 (en) * 2005-10-26 2010-11-02 Oracle America, Inc. Asynchronous on-demand service startup
US8549135B1 (en) * 2007-05-18 2013-10-01 Raytheon Company Method and apparatus for performing quality of service in secure networks
WO2010123140A1 (ja) * 2009-04-24 2010-10-28 日本電気株式会社 パケット通信システム、パケット通信装置、パケット通信方法、パケット通信プログラムを記録したコンピュータ読み取り可能な記録媒体
US8924560B2 (en) * 2010-11-29 2014-12-30 At&T Intellectual Property I, L.P. Optimized game server relocation environment
US8893274B2 (en) * 2011-08-03 2014-11-18 Trend Micro, Inc. Cross-VM network filtering
US9003141B2 (en) * 2011-11-14 2015-04-07 Ca, Inc. Enhanced software application platform
CN103777969B (zh) * 2012-10-19 2017-04-12 阿里巴巴集团控股有限公司 一种无需重启部署服务器参数的方法和装置
US9185058B2 (en) * 2013-03-15 2015-11-10 Alcatel Lucent Method and apparatus for processing GPRS tunneling protocol user plane traffic in a cloud-based mobile network

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150163197A1 (en) * 2013-12-06 2015-06-11 Qualcomm Innovation Center, Inc. Systems, methods, and apparatus for full-cone and address restricted cone network address translation using hardware acceleration
CN104753752A (zh) * 2013-12-30 2015-07-01 上海格尔软件股份有限公司 一种适用于vpn的按需连接方法
CN105808287A (zh) * 2016-02-25 2016-07-27 网宿科技股份有限公司 一种重启网络服务的方法及系统

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
GARFIELT ET AL., TRUE ZERO DOWNTIME HAPROXY RELOADS, 27 April 2015 (2015-04-27), Retrieved from the Internet <URL:www.lupaworld.com/article-252090-1.html> *
See also references of EP3309678A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111158776A (zh) * 2019-12-12 2020-05-15 杭州安恒信息技术股份有限公司 一种Web应用防护系统平滑重启方法
CN111158776B (zh) * 2019-12-12 2023-12-26 杭州安恒信息技术股份有限公司 一种Web应用防护系统平滑重启方法

Also Published As

Publication number Publication date
US20180275997A1 (en) 2018-09-27
CN105808287B (zh) 2019-06-18
EP3309678A4 (en) 2018-08-08
EP3309678A1 (en) 2018-04-18
US10496415B2 (en) 2019-12-03
CN105808287A (zh) 2016-07-27

Similar Documents

Publication Publication Date Title
WO2017143807A1 (zh) 一种重启网络服务的方法及系统
US9231881B2 (en) Transparent middlebox with graceful connection entry and exit
US8307417B2 (en) Port enablement
WO2017121063A1 (zh) 一种无丢包零停机重启网络服务的方法和系统
WO2020151030A1 (zh) 一种处理数据报文的方法和装置
US20110158239A1 (en) Method of communicating packet multimedia to restricted endpoints
US20240069977A1 (en) Data transmission method and data transmission server
CN110768994B (zh) 一种基于dpdk技术的提高sip网关性能的方法
CN105915658B (zh) 获取客户端ip地址的数据调用方法、数据传输方法
JP2012027925A (ja) クライアント側の加速技術を提供するシステムおよび方法
WO2017219813A1 (zh) 一种流量处理方法及透明缓存系统
Qian et al. Silent TCP connection closure for cellular networks
US20150288763A1 (en) Remote asymmetric tcp connection offload over rdma
CN113810397A (zh) 协议数据的处理方法及装置
US20240036535A1 (en) Industrial control device, industrial control system and method of operating the same
US20050165983A1 (en) System and method for processing data in kernel area by a user command
US10805981B2 (en) Method and apparatus for closing a transmission control protocol connection for a wireless communications network
TW201806358A (zh) 於一網路系統中藉助於網路位址轉譯來轉送封包之方法與裝置
WO2015167375A1 (en) Method and tcp proxy for supporting communication between a client device and a server node
AT&T
CN111669318A (zh) 一种Linux系统下数据包转发的方法及装置
CN110891008A (zh) 一种基于l2tp/ipsec的ip代理方法
KR101577034B1 (ko) 소프트웨어적인 네트워크 부가기능 추가가 용이한 멀티코어 기반의 toe 시스템 및 그 제어 방법
US11716395B2 (en) Minimizing connection delay for a data session
KR101469244B1 (ko) 수신된 데이터에서의 불필요한 패킷 제거 장치 및 방법

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 15557426

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16891255

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE