WO2018000695A1 - 流量引导的方法和装置 - Google Patents

流量引导的方法和装置 Download PDF

Info

Publication number
WO2018000695A1
WO2018000695A1 PCT/CN2016/106056 CN2016106056W WO2018000695A1 WO 2018000695 A1 WO2018000695 A1 WO 2018000695A1 CN 2016106056 W CN2016106056 W CN 2016106056W WO 2018000695 A1 WO2018000695 A1 WO 2018000695A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
sent
reference label
sent data
label
Prior art date
Application number
PCT/CN2016/106056
Other languages
English (en)
French (fr)
Inventor
范自道
陈鸿
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to US15/774,516 priority Critical patent/US11102177B2/en
Priority to EP16907091.9A priority patent/EP3419232B1/en
Publication of WO2018000695A1 publication Critical patent/WO2018000695A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/166—IP fragmentation; TCP segmentation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/19—Flow control; Congestion control at layers above the network layer
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G06F21/6263—Protecting personal data, e.g. for financial or medical purposes during internet communication, e.g. revealing personal data from cookies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/161—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
    • H04L69/162—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields involving adaptations of sockets based mechanisms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services

Definitions

  • the present invention relates to the field of communication technology applications, and in particular, to a method and apparatus for traffic guidance.
  • Network filter Netfilter tool Netfilter is in the IP layer of Transmission Control Protocol/Internet Protocol (TCP/IP) protocol stack. Filtering, redirection, etc. of network packets can be set by setting Iptables rules.
  • Android application is divided into common application and system application, the system will assign uid to all applications to manage the application's permissions, where the common application has a unique identifier uid, starting from 10000, the system application's uid is unified to 1000;
  • Applications are usually applications with silent installation, resident services, network management, etc., such as local agents for system applications that require resident services, application markets for system applications that require silent installation, and launcher Launcher as the system for boot initiators. application.
  • the application to send the data packet to the local proxy is usually implemented by adding the Iptables redirection rule; Netfilter acts on the IP layer and cannot rely on the redirection rule to distinguish the number of applications to be accelerated and the number of the local proxy. According to the package, the packets sent by the local agent will be redirected to the local proxy again via Netfilter, causing an infinite loop.
  • the Iptables rule For the above problem, you can set the Iptables rule to filter the service port of the acceleration server. At this time, the packet sent by the local agent to the acceleration server will not be redirected again, but it has a great limitation: when the application accesses the port and accelerates When the server port is consistent, the traffic cannot enter the local proxy for acceleration. Secondly, the packet returned by the local proxy back to the source will cause an infinite loop because the port is not the acceleration server port. The above method can only do the full amount of the packet redirecting the local proxy. Accelerated processing, unable to speed up the control of the application whitelist.
  • the acceleration scheme of the related technology has been unable to meet the requirements for accelerating control of different applications, and it is even unable to accelerate the application of the system, thereby causing the impact of accelerating the application efficiency of the product, and no effective solution has been proposed yet.
  • the embodiment of the invention provides a method and a device for traffic guidance, so as to at least solve the problem that the acceleration scheme of the related technology can not meet the requirements of the acceleration control of different applications, and the system application cannot be accelerated, thereby causing the impact of the accelerated product.
  • Technical issues of application efficiency are provided.
  • a method for traffic guidance includes: determining whether a label of a data packet to be sent is the same as a reference label set in a preset matching rule; and if the determination result is negative, By redirecting the to-be-sent data packet, configuring a reference label for the data packet to be sent; and transmitting a data packet to be sent that carries the reference label.
  • a flow guiding device including: a determining module, The method is configured to determine whether the label of the to-be-sent data packet is the same as the reference label of the preset matching rule, and the configuration module is configured to: when the judgment result is negative, configure the data packet to be sent by redirecting the to-be-sent data packet
  • the first sending module is configured to send a to-be-sent data packet that carries the reference label.
  • the label of the data packet to be sent is the same as the reference label set in the preset matching rule; if the judgment result is negative, the data packet to be sent is sent by redirecting the data packet to be sent.
  • FIG. 1 is a schematic flow chart of a method of traffic guidance according to an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of an application scenario in a method of traffic guidance according to an embodiment of the present invention
  • FIG. 3 is a schematic flow chart of a method for traffic guidance according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a flow guiding device according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a flow guiding device according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of another flow guiding device according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of still another flow guiding device according to an embodiment of the present invention.
  • an embodiment of a method of traffic guidance is provided, it being noted that the steps illustrated in the flowchart of the figures may be performed in a computer system such as a set of computer executable instructions, and, although The logical order is shown in the flowcharts, but in some cases the steps shown or described may be performed in a different order than the ones described herein.
  • FIG. 1 is a schematic flow chart of a method for traffic guidance according to an embodiment of the present invention, as shown in FIG. Including the following steps:
  • Step S102 determining whether the label of the data packet to be sent is the same as the reference label set in the preset matching rule
  • the method of the traffic guidance provided by the embodiment of the present application can be applied to the acceleration processing process of the mobile terminal for various applications, and the embodiment of the present application is described by using a terminal device applicable to the Android system as an example.
  • the terminal devices in the example may include: a smartphone, a tablet, a palm commerce, and a wearable device.
  • the Netfilter of the IP layer of the terminal device first distinguishes the data packets to be sent of various applications by using preset matching conditions.
  • the preset matching condition in the application embodiment is a mark label matching rule and a redirection rule set by the network firewall Iptable.
  • determining whether the data packet to be sent is Carrying the reference label matching the mark label matching rule set by the Iptable, assuming that the reference label in the real-time of the application is a port number, and the matching rule also performs a matching operation by using the port number.
  • step S104 is executed, and if the result of the determination is YES, step S103 is executed.
  • Step S104 in the case that the determination result is no, the reference data label is configured to be sent by redirecting the to-be-sent data packet;
  • the Netfilter of the IP layer of the terminal device will redirect the data packet to be sent to the local proxy.
  • the local agent configures a reference label for the to-be-sent packet to avoid the related art Packets sent by the local agent will be redirected to the local proxy again via Netfilter.
  • Step S106 Send a data packet to be sent that is configured to carry a reference label.
  • the reference label is configured to be sent according to the step S104, and when the matching operation of step S102 is performed on the data packet to be sent carrying the reference label in the second Netfilter, the reference label and the pre-received data packet may be obtained. Let the matching conditions be the same, and then send the to-be-sent data packet to the next route (ie, the next transmission path) through the network card.
  • FIG. 2 is a schematic diagram of an application scenario in a method of traffic guidance according to an embodiment of the present invention.
  • the traffic guidance method provided by the embodiment of the present application is applied to a terminal device, where In the process of implementing the traffic guidance method, the terminal device is specifically as follows:
  • Step1 The local device and the application to be accelerated are installed in the terminal device, and all are in the application layer;
  • Step 2 Netfilter belongs to the IP layer, which can filter and redirect data packets.
  • Step3 after receiving the data packet, the local agent determines whether the data packet needs to be accelerated, and needs an accelerated proxy to the acceleration server, or the proxy to the source station, and sets a mark label on the proxy socket;
  • Step 4 the acceleration server or the source station sends a response to the local agent, which forwards it to the corresponding application.
  • the label of the data packet to be sent is the same as the reference label set in the preset matching rule; if the determination result is negative, the data packet to be sent is redirected.
  • the reference label of the sending data packet is configured; the data packet to be sent that carries the reference label is sent, and the purpose of distinguishing the data packet sent by the application and the local agent is achieved, thereby realizing the technical effect of performing acceleration control on different applications, thereby solving the problem. Because the acceleration scheme in the related technology can not meet the requirements of accelerating control for different applications, it is even unable to accelerate the application of the system, thereby causing the impact of accelerating the application efficiency of the product. Problems.
  • the reference packet is configured to be sent, including:
  • Step1 redirecting the to-be-sent packet to the local proxy with the labeled reference label function according to the redirection rule
  • the to-be-sent packet is redirected to the local proxy marked with the reference label.
  • the Netfilter in the terminal device redirects the to-be-sent data packet that does not match the preset matching rule to the local proxy in the terminal device.
  • Step 2 configure the reference label to be sent by the preset socket configuration function.
  • the local proxy configures a reference label for the to-be-sent packet by using a preset socket SetSockopt configuration function, that is, configuring a label with a reference label of 8123 to the to-be-sent packet.
  • Step 2 configures a reference label for the data packet to be sent by using a preset socket configuration function, including:
  • Step A Create a corresponding socket for the data packet to be sent
  • Step B Configure a reference label for the socket according to a preset socket configuration function.
  • the method for traffic guidance further includes:
  • step S103 if the determination result is yes, the to-be-sent data packet carrying the reference label is sent, and is not redirected to the home agent.
  • the method is different from the step S104, in the case that the data packet to be sent carries the reference label, and the reference label carried by the to-be-sent data packet is the same as the reference label in the preset matching condition, the local proxy sends the reference label.
  • FIG. 3 is a schematic flowchart of a method for traffic guidance according to an embodiment of the present invention. As shown in FIG. 3, the method for traffic guidance provided by the embodiment of the present application is as follows:
  • the iptables sets the mark label matching rule and the redirection rule, that is, Step 1 in FIG. 3, wherein the mark label matching rule and the redirection rule are as follows:
  • Mark tag matching rule iptables–t nat–A OUTPUT-m mark–mark 8123–j RETURN;
  • the role of the redirect rule is to redirect the packet to port 8123.
  • the matching rule matches, the data packet is not redirected, and is processed in the system default manner; the local proxy is initialized, and the listening port 8123 is set to receive the redirected data packet.
  • the data packet sent by the application is routed to the OUTPUT link of the Netfilter.
  • Netfilter processes the data packet according to the packet attribute, the mark label matching rule and the redirection rule rule, and the data sent by the non-local agent.
  • the data packet sent by the local agent is routed to the Netfilter's OUTPUT chain, matched with the mark tag matching rule, and sent to the next route through the network card (ie, Step 4 in Figure 3).
  • the traffic guidance method can realize the full acceleration control of the data packets sent by the application by using the mark label to distinguish the data packets sent by the local agent, thereby avoiding the setting of the iptables filtering rule (port filtering).
  • the destination port of the application access is coupled with the port of the acceleration server and cannot be accelerated; the local agent has the same uid as other system applications, and the uid of the local agent can also be used to prevent the data packet sent by the local agent from being redirected again. Filtering rules, but the local agent is a system application, coupled with the uid of other system applications, and thus cannot accelerate the application of the system.
  • the method of setting the mark label can distinguish the data packets sent by the local agent without being limited to the application attribute. To enable system application acceleration control.
  • the method of traffic guidance provided by the embodiment of the present application does not change key modules such as Netfilter and TCP/IP protocol stack of Linux, and does not require a customized system, thereby saving development cost.
  • FIG. 4 is an implementation according to the present invention.
  • the apparatus includes: a determining module 42, a configuration module 44, and a first sending module 46, where
  • the determining module 42 is configured to determine whether the label of the to-be-sent data packet is the same as the set reference label in the preset matching rule;
  • the configuration module 44 is configured to: when the determination result is negative, configure a reference label for the data packet to be sent by redirecting the data packet to be sent;
  • the first sending module 46 is configured to send a to-be-sent data packet that is configured to carry the reference label.
  • the device for configuring the MARK tag it is determined whether the label of the to-be-sent data packet is the same as the reference label set in the preset matching rule; if the determination result is negative, the data to be sent is redirected.
  • the packet is configured to be configured with a reference label for sending the data packet; the configuration of the data packet to be sent carrying the reference label is sent to achieve the purpose of distinguishing the data packet sent by the application and the local agent, thereby implementing the technical effect of performing acceleration control on different applications, and further
  • the technical problem that the acceleration solution of the related technology can not meet the requirements of accelerating control for different applications, and the system application cannot be accelerated, thereby affecting the application efficiency of the accelerated product is solved.
  • FIG. 5 is a schematic structural diagram of a device for traffic guidance according to an embodiment of the present invention.
  • the configuration module 44 includes: a redirection unit 441 and a configuration unit 442, where
  • the redirecting unit 441 is configured to, when the preset matching rule includes the redirection rule, redirect the to-be-sent data packet to the local proxy having the function of marking the reference label according to the redirection rule;
  • the configuration unit 442 is configured to redirect the to-be-sent data packet to the local proxy marked with the reference label according to the redirection rule.
  • FIG. 6 is a schematic structural diagram of another traffic guidance device according to an embodiment of the present invention.
  • the configuration unit 442 includes: a creating subunit 4421 and a configuration subunit 4422, where
  • Creating a sub-unit 4421 configured to create a corresponding socket for the data packet to be sent
  • the configuration subunit 4422 is configured to configure a reference label for the socket according to a preset socket configuration function.
  • FIG. 7 is a schematic structural diagram of another flow guiding device according to an embodiment of the present invention.
  • the flow guiding device provided by the embodiment of the present application further includes: a second sending module 43 , wherein ,
  • the second sending module 43 is configured to send the to-be-sent data packet carrying the reference label and not redirect to the local proxy if the determination result is yes.
  • the disclosed technical contents may be implemented in other manners.
  • the device embodiments described above are only schematic.
  • the division of the unit may be a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple units. Some or all of the units may be selected according to actual needs to implement the solution of the embodiment. the goal of.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Theoretical Computer Science (AREA)
  • Bioethics (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Databases & Information Systems (AREA)
  • Medical Informatics (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种流量引导的方法和装置。其中，该方法包括：判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；在判断结果为否的情况下，通过重定向待发送数据包，对待发送数据包配置基准标签；发送配置携带基准标签的待发送数据包。本发明解决了由于相关技术中加速方案已无法满足对不同应用进行加速控制需求，更无法对系统应用进行加速，从而导致的影响加速产品的应用效率的技术问题。

Description

流量引导的方法和装置 技术领域
本发明涉及通信技术应用领域，具体而言，涉及一种流量引导的方法和装置。
背景技术
随着移动终端的智能化，应用于智能移动终端的各类应用程序也随之丰富，而如何在应用程序执行过程中加速该应用程序的数据传输效率，成为了亟待解决的问题。
其中，对安卓应用进行加速有两个重要环节，一是将应用发出的数据包引导到本地代理，二是根据加速白名单对应用发出的数据包进行加速控制；网络防火墙Iptables是Linux系统中管理网络过滤器Netfilter的工具，Netfilter处于传输控制协议/因特网互联协议(Transmission Control Protocol/Internet Protocol，简称TCP/IP)协议栈的IP层，通过设置Iptables规则可对网络数据包进行过滤、重定向等操作；安卓应用分为普通应用和系统应用，系统会为所有应用分配uid用于管理应用的权限，其中普通应用具有唯一标识uid，从10000开始各不相同，系统应用的uid统一为1000；系统应用通常为具有静默安装、常驻服务、网络管理等权限要求的应用，如本地代理为需要常驻服务的系统应用，应用市场为需要静默安装的系统应用、启动器Launcher为开机启动器的系统应用。
这里将应用发出的数据包引导至本地代理通常采用添加Iptables重定向规则实现；Netfilter作用于IP层，仅仅依靠重定向规则无法区分待加速应用与本地代理发出的数 据包，本地代理发出的数据包经过Netfilter将再次被重定向至本地代理，造成死循环。
针对上述的问题可采用设置Iptables规则过滤加速服务器的服务端口，此时本地代理发送至加速服务器的数据包不会再次被重定向，但却有很大的局限性：当应用访问的端口与加速服务器端口一致时，则流量无法进入本地代理做加速处理；其次经过本地代理回源的数据包由于端口已不是加速服务器端口将造成死循环，上述方法对重定向本地代理的数据包只能做全量加速处理，无法针对加速应用白名单做是否加速的控制。
针对上述由于相关技术中加速方案已无法满足对不同应用进行加速控制需求，更无法对系统应用进行加速，从而导致的影响加速产品的应用效率的问题，目前尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种流量引导的方法和装置，以至少解决由于相关技术中加速方案已无法满足对不同应用进行加速控制需求，更无法对系统应用进行加速，从而导致的影响加速产品的应用效率的技术问题。
根据本发明实施例的一个方面，提供了一种流量引导的方法，包括：判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；在判断结果为否的情况下，通过重定向待发送数据包，对待发送数据包配置基准标签；发送配置携带基准标签的待发送数据包。
根据本发明实施例的另一方面，还提供了一种流量引导的装置，包括：判断模块， 用于判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；配置模块，用于在判断结果为否的情况下，通过重定向待发送数据包，对待发送数据包配置基准标签；第一发送模块，用于发送配置携带基准标签的待发送数据包。
在本发明实施例中，通过判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；在判断结果为否的情况下，通过重定向待发送数据包，对待发送数据包配置基准标签；发送配置携带基准标签的待发送数据包，达到了区分应用程序与本地代理发出的数据包的目的，从而实现了对不同应用执行加速控制的技术效果，进而解决了由于相关技术中加速方案已无法满足对不同应用进行加速控制需求，更无法对系统应用进行加速，从而导致的影响加速产品的应用效率的技术问题。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的流量引导的方法的流程示意图；
图2是根据本发明实施例的一种流量引导的方法中应用场景的示意图；
图3是根据本发明实施例的一种流量引导的方法的流程示意图；
图4是根据本发明实施例的流量引导的装置的结构示意图；
图5是根据本发明实施例的一种流量引导的装置的结构示意图；
图6是根据本发明实施例的另一种流量引导的装置的结构示意图；
图7是根据本发明实施例的又一种流量引导的装置的结构示意图。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
实施例1
根据本发明实施例，提供了一种流量引导的方法实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
图1是根据本发明实施例的流量引导的方法的流程示意图，如图1所示，该方法 包括如下步骤：
步骤S102，判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；
具体的，本申请实施例提供的流量引导的方法可以适用于移动终端对各类应用的加速处理过程，其中，本申请实施例以适用于安卓系统的终端设备为例进行说明，这里本申请实施例中的终端设备可以包括：智能手机、平板电脑、掌上商务以及穿戴设备。
其中，本申请实施例提供在对终端设备中的各类应用进行加速的过程中，终端设备的IP层的Netfilter会先对各类应用的待发送数据包通过预设匹配条件进行区别，在本申请实施例中预设匹配条件为网络防火墙Iptable设置的mark标签匹配规则和重定向规则，在对接收到的待发送数据包与预设匹配条件进行匹配的过程中，判断该待发送数据包是否携带与Iptable设置的mark标签匹配规则匹配的基准标签，假设本申请实时中的基准标签为一个端口号，匹配规则也以端口号执行匹配操作，这里将通过判断该待发送数据包的基准标签是否与该匹配规则中设置的加速端口相同。即，该基准标签记为mark＝8123，匹配规则设置的加速端口为mark＝X，判断8123是否等于X。在判断结果为否的情况下执行步骤S104，在判断结果为是的情况下执行步骤S103。
步骤S104，在判断结果为否的情况下，通过重定向待发送数据包，对待发送数据包配置基准标签；
具体的，基于步骤S102对待发送数据包是否携带基准标签，在判断结果为待发送数据包未携带基准标签的情况下，终端设备的IP层的Netfilter将会把待发送数据包重定向至本地代理，由本地代理对该待发送数据包配置基准标签，以避免相关技术中本 地代理发出的数据包经过Netfilter将再次被重定向至本地代理。
步骤S106，发送配置携带基准标签的待发送数据包。
具体的，基于步骤S104对待发送数据包配置基准标签，在第二次Netfilter对该携带有基准标签的待发送数据包执行步骤S102的匹配操作时，可以得到该待发送数据包的基准标签与预设匹配条件相同，进而经过网卡将该待发送数据包发送至下一路由(即，下一传输路径)。
结合步骤S102至步骤S106，图2是根据本发明实施例的一种流量引导的方法中应用场景的示意图,如图2所示，本申请实施例提供的流量引导的方法应用于终端设备，其中，在实现流量引导的方法的过程中，该终端设备具体如下：
Step1,终端设备中装有本地代理和需加速的应用，均处于应用层；
Step2,Netfilter属于IP层，可对数据包的进行过滤、重定向等操作；
Step3,本地代理收到数据包后判断数据包是否需要加速，需要加速的代理至加速服务器，否则代理至源站，并在代理socket上设置mark标签；
Step4,加速服务器或源站将响应发送至本地代理，本地代理将其转发至对应应用。
本申请实施例提供的流量引导的方法中，通过判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；在判断结果为否的情况下，通过重定向待发送数据包，对待发送数据包配置基准标签；发送配置携带基准标签的待发送数据包，达到了区分应用程序与本地代理发出的数据包的目的，从而实现了对不同应用执行加速控制的技术效果，进而解决了由于相关技术中加速方案已无法满足对不同应用进行加速控制需求，更无法对系统应用进行加速，从而导致的影响加速产品的应用效率的技 术问题。
可选的，在预设匹配规则还包括重定向规则的情况下，步骤S104中通过重定向待发送数据包，对待发送数据包配置基准标签，包括：
Step1,依据重定向规则将待发送数据包重定向至具有标记基准标签功能的本地代理；
具体的，在该待发送数据包的基准标签与预设匹配条件中的匹配规则不匹配的情况下，将该待发送数据包重定向至标记有基准标签的本地代理。这里本申请实施例中终端设备中的Netfilter将与预设匹配规则不匹配的待发送数据包重定向至终端设备中的本地代理。
Step2,通过预设套接字配置函数对待发送数据包配置基准标签。
具体的，基于Step1对待发送数据包的重定向，本地代理通过预设套接字SetSockopt配置函数对该待发送数据包配置基准标签，即，配置基准标签为8123的标签至待发送数据包上。
可选的，Step2中通过预设套接字配置函数对待发送数据包配置基准标签，包括：
步骤A，对待发送数据包创建对应的套接字；
步骤B，依据预设套接字配置函数对套接字配置基准标签。
具体的，结合步骤A和步骤B，本地代理对接收到的待发送数据包后创建代理套接字socket，使用Linux的套接字配置函数setsockopt函数对该套接字socket设置mark＝8123的标签。
可选的，在步骤S102中判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同之后，本申请实施例提供的流量引导的方法还包括：
步骤S103，在判断结果为是的情况下，将携带基准标签的待发送数据包发出，不再重定向至本地代理。
具体的，区别于步骤S104，在判断待发送数据包携带基准标签，且该待发送数据包携带的基准标签与预设匹配条件中的基准标签相同的情况下，本地代理将发送携带基准标签的待发送数据包，其中，本地代理将依据该待发送数据包的应用类型，将该待发送数据包发送至加速服务器或源站。
综上，结合步骤S102至步骤S106，图3是根据本发明实施例的一种流量引导的方法的流程示意图；如图3所示，本申请实施例提供的流量引导的方法具体如下：
首先，本申请实施例中iptables设置mark标签匹配规则、重定向规则，(即，图3中的Step1)其中，mark标签匹配规则和重定向规则如下：
mark标签匹配规则：iptables–t nat–A OUTPUT-m mark–mark 8123–j RETURN；
重定向规则：iptables–t nat–A OUTPUT–p tcp–j REDIRECT–to-port 8123
其中，重定向规则的作用是将数据包重定向至8123端口；
当数据包具有mark＝8123的标签时，匹配规则匹配，数据包不被重定向，以系统默认方式处理；本地代理初始化，设置监听端口8123，用于接收重定向的数据包。
其次，应用(含本地代理)发出的数据包经路由后到达Netfilter的OUTPUT链路，此时Netfilter根据数据包属性，以及mark标签匹配规则和重定向规则规则处理数据包，非本地代理发出的数据包(mark！＝8123)被重定向至本地代理监听的8123端口(即, 图3中的Step2)；
第三，本地代理收到数据包后创建代理socket，使用Linux的setsockopt函数对socket设置mark＝8123的标签，判断该数据包是否需要加速并将其转发至加速服务器或源站(即，图3中的Step3)；其中，在Step3中本地代理收到重定向数据包，创建代理socket并设置mark标签，将数据包由代理socket发出。
第四，本地代理发出的数据包经过路由后到达Netfilter的OUTPUT链，与mark标签匹配规则匹配，经过网卡发送至下一条路由(即，图3中的Step4)。
由上可知，本申请实施例提供的流量引导的方法，依靠mark标签区分本地代理发出的数据包能够实现对应用发出的数据包进行全量加速控制，避免了由于设置iptables过滤规则(端口过滤)造成应用访问的目的端口与加速服务器的端口具有耦合性而无法加速；本地代理与其他系统应用都具有相同的uid，为避免本地代理发出的数据包再次被重定向也可采用设置本地代理的uid的过滤规则，但本地代理为系统应用，与其他系统应用的uid具有耦合性，因而无法对系统应用加速，采用设置mark标签的方法能够在不局限于应用属性的前提下区分本地代理发出的数据包，使系统应用加速控制得以实现。
并且，本申请实施例提供的流量引导的方法，不改变Linux的Netfilter、TCP/IP协议栈等关键模块、不需要定制系统，节约了开发成本。
实施例2
根据本发明实施例，提供了一种流量引导的装置实施例，图4是根据本发明实施 例的流量引导的装置的结构示意图，如图4所示，该装置包括：判断模块42、配置模块44和第一发送模块46，其中，
判断模块42，用于判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；
配置模块44，用于在判断结果为否的情况下，通过重定向待发送数据包，对待发送数据包配置基准标签；
第一发送模块46，用于发送配置携带基准标签的待发送数据包。
本申请实施例提供的配置MARK标签的装置中，通过判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；在判断结果为否的情况下，通过重定向待发送数据包，对待发送数据包配置基准标签；发送配置携带基准标签的待发送数据包，达到了区分应用程序与本地代理发出的数据包的目的，从而实现了对不同应用执行加速控制的技术效果，进而解决了由于相关技术中加速方案已无法满足对不同应用进行加速控制需求，更无法对系统应用进行加速，从而导致的影响加速产品的应用效率的技术问题。
可选的，图5是根据本发明实施例的一种流量引导的装置的结构示意图，如图5所示，配置模块44包括：重定向单元441和配置单元442，其中，
重定向单元441，用于在预设匹配规则包括重定向规则的情况下，依据重定向规则将待发送数据包重定向至具有标记基准标签功能的本地代理；
配置单元442，用于依据重定向规则将待发送数据包重定向至标记有基准标签的本地代理。
可选的，图6是根据本发明实施例的另一种流量引导的装置的结构示意图，如图6所示，配置单元442包括：创建子单元4421和配置子单元4422，其中，
创建子单元4421，用于对待发送数据包创建对应的套接字；
配置子单元4422，用于依据预设套接字配置函数对套接字配置基准标签。
可选的，图7是根据本发明实施例的又一种流量引导的装置的结构示意图，如图7所示，本申请实施例提供的流量引导的装置还包括：第二发送模块43，其中，
第二发送模块43，用于在判断结果为是的情况下，将携带基准标签的待发送数据包发出，不再重定向至本地代理。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
在本发明的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，可以为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案 的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (8)

  1. 一种流量引导的方法，其特征在于，包括：
    判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；
    在判断结果为否的情况下，通过重定向所述待发送数据包，对所述待发送数据包配置所述基准标签；
    发送配置携带所述基准标签的所述待发送数据包。
  2. 根据权利要求1所述的方法，其特征在于，在所述预设匹配规则包括重定向规则的情况下，所述通过重定向所述待发送数据包，对所述待发送数据包配置所述基准标签，包括：
    依据所述重定向规则将所述待发送数据包重定向至具有标记所述基准标签功能的本地代理；
    通过预设套接字配置函数对所述待发送数据包配置所述基准标签。
  3. 根据权利要求2所述的方法，其特征在于，所述通过预设套接字配置函数对所述待发送数据包配置所述基准标签，包括：
    对所述待发送数据包创建对应的套接字；
    依据所述预设套接字配置函数对所述套接字配置所述基准标签。
  4. 根据权利要求1所述的方法，其特征在于，在所述判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同之后，所述方法还包括：
    在判断结果为是的情况下，将携带所述基准标签的所述待发送数据包发出， 不再重定向至本地代理。
  5. 一种流量引导的装置，其特征在于，包括：
    判断模块，用于判断待发送数据包的标签是否与预设匹配规则中的设置的基准标签相同；
    配置模块，用于在判断结果为否的情况下，通过重定向所述待发送数据包，对所述待发送数据包配置所述基准标签；
    第一发送模块，用于发送配置携带所述基准标签的所述待发送数据包。
  6. 根据权利要求5所述的装置，其特征在于，所述配置模块包括：
    重定向单元，用于在所述预设匹配规则包括重定向规则的情况下，依据所述重定向规则将所述待发送数据包重定向至具有标记所述基准标签功能的本地代理；
    配置单元，用于依据所述重定向规则将所述待发送数据包重定向至标记有所述基准标签的本地代理。
  7. 根据权利要求6所述的装置，其特征在于，所述配置单元包括：
    创建子单元，用于对所述待发送数据包创建对应的套接字；
    配置子单元，用于依据所述预设套接字配置函数对所述套接字配置所述基准标签。
  8. 根据权利要求5所述的装置，其特征在于，所述装置还包括：
    第二发送模块，用于在判断结果为是的情况下，将携带所述基准标签的所述 待发送数据包发出，不再重定向至本地代理。
PCT/CN2016/106056 2016-06-30 2016-11-16 流量引导的方法和装置 WO2018000695A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/774,516 US11102177B2 (en) 2016-06-30 2016-11-16 Method and device for directing traffic
EP16907091.9A EP3419232B1 (en) 2016-06-30 2016-11-16 Method and device for directing traffic

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610510950.8A CN106130997A (zh) 2016-06-30 2016-06-30 流量引导的方法和装置
CN201610510950.8 2016-06-30

Publications (1)

Publication Number Publication Date
WO2018000695A1 true WO2018000695A1 (zh) 2018-01-04

Family

ID=57467908

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/106056 WO2018000695A1 (zh) 2016-06-30 2016-11-16 流量引导的方法和装置

Country Status (4)

Country Link
US (1) US11102177B2 (zh)
EP (1) EP3419232B1 (zh)
CN (1) CN106130997A (zh)
WO (1) WO2018000695A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108111414B (zh) * 2016-11-25 2021-01-26 新华三技术有限公司 一种基于段路由的标签部署方法和装置
CN107071034B (zh) 2017-04-20 2019-10-11 网宿科技股份有限公司 一种数据包传输方法和系统
CN107147588B (zh) * 2017-05-16 2020-03-31 网宿科技股份有限公司 流量引导方法和装置
KR20210030073A (ko) * 2019-09-09 2021-03-17 삼성전자주식회사 엣지 컴퓨팅 서비스를 위한 방법 및 장치
CN112804251B (zh) * 2021-02-01 2022-04-15 哈尔滨工业大学 一种基于userId的Android应用流量过滤方法与系统
CN115022286A (zh) * 2022-06-10 2022-09-06 苏州迈科网络安全技术股份有限公司 一种基于网关的域名访问加速方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101695160A (zh) * 2009-10-20 2010-04-14 清华大学 基于策略路由的流定向传输方法
CN102118320A (zh) * 2011-04-18 2011-07-06 北京神州数码思特奇信息技术股份有限公司 一种协议识别和流量控制方法
CN102946347A (zh) * 2012-12-07 2013-02-27 烽火通信科技股份有限公司 一种加速Linux系统本地数据包处理的方法及装置
CN103533060A (zh) * 2013-10-17 2014-01-22 华为技术有限公司 本地代理的处理方法及装置
CN105245464A (zh) * 2015-08-27 2016-01-13 北京华夏创新科技有限公司 一种基于安卓系统的网络加速方法

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6980526B2 (en) * 2000-03-24 2005-12-27 Margalla Communications, Inc. Multiple subscriber videoconferencing system
US7355970B2 (en) * 2001-10-05 2008-04-08 Broadcom Corporation Method and apparatus for enabling access on a network switch
GB2394382A (en) * 2002-10-19 2004-04-21 Hewlett Packard Co Monitoring the propagation of viruses through an Information Technology network
US7394756B1 (en) * 2003-03-17 2008-07-01 Sprint Communications Company L.P. Secure hidden route in a data network
US7590728B2 (en) * 2004-03-10 2009-09-15 Eric White System and method for detection of aberrant network behavior by clients of a network access gateway
US7809126B2 (en) * 2005-05-19 2010-10-05 Cisco Technology, Inc. Proxy server for internet telephony
WO2010056809A2 (en) * 2008-11-14 2010-05-20 Raytheon Company Automatic invocation of dtn bundle protocol
US20140282542A1 (en) * 2013-03-14 2014-09-18 Infinio Systems Inc. Hypervisor Storage Intercept Method
US9825913B2 (en) * 2014-06-04 2017-11-21 Nicira, Inc. Use of stateless marking to speed up stateful firewall rule processing
US10785130B2 (en) * 2015-04-23 2020-09-22 Hewlett Packard Enterprise Development Lp Network infrastructure device to implement pre-filter rules
US9948611B2 (en) * 2015-12-14 2018-04-17 Nicira, Inc. Packet tagging for improved guest system security

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101695160A (zh) * 2009-10-20 2010-04-14 清华大学 基于策略路由的流定向传输方法
CN102118320A (zh) * 2011-04-18 2011-07-06 北京神州数码思特奇信息技术股份有限公司 一种协议识别和流量控制方法
CN102946347A (zh) * 2012-12-07 2013-02-27 烽火通信科技股份有限公司 一种加速Linux系统本地数据包处理的方法及装置
CN103533060A (zh) * 2013-10-17 2014-01-22 华为技术有限公司 本地代理的处理方法及装置
CN105245464A (zh) * 2015-08-27 2016-01-13 北京华夏创新科技有限公司 一种基于安卓系统的网络加速方法

Also Published As

Publication number Publication date
EP3419232A1 (en) 2018-12-26
CN106130997A (zh) 2016-11-16
EP3419232A4 (en) 2019-04-17
US11102177B2 (en) 2021-08-24
EP3419232B1 (en) 2020-03-18
US20200259797A1 (en) 2020-08-13

Similar Documents

Publication Publication Date Title
WO2018000695A1 (zh) 流量引导的方法和装置
US10122629B2 (en) Systems and methods for externalizing network functions via packet trunking
CN110506411B (zh) 虚拟计算环境中用于使用逻辑端口提供分组实施的方法和系统
CA2968964C (en) Source ip address transparency systems and methods
CN109361606B (zh) 一种报文处理系统及网络设备
WO2021017930A1 (zh) 报文转发
WO2018149338A1 (zh) 基于sdn的远端流镜像控制方法、实现方法及相关设备
US10193758B2 (en) Communication via a connection management message that uses an attribute having information on queue pair objects of a proxy node in a switchless network
CN106992915A (zh) 一种报文解封装处理、数据写入方法及装置
CN110086798B (zh) 一种基于公共虚拟接口进行通信的方法及装置
CN103313308A (zh) 一种数据传输方法和设备
CN113395212B (zh) 网络装置及其操作方法和非暂时性计算机可读介质
CN105812322A (zh) 因特网安全协议安全联盟的建立方法及装置
CN101997772B (zh) 流量控制方法、装置、系统及网络设备
US10904132B2 (en) Method, system, and computer program product for configuring an attribute for propagating management datagrams in a switchless network
CN103227822A (zh) 一种p2p通信连接建立方法和设备
WO2014117474A1 (zh) 路由方法、系统及相关设备
CN106657015B (zh) 基于sdn网络的数据传输方法
CN111447131A (zh) 报文解封装方法及装置、报文封装方法及装置
EP4184888A1 (en) Systems and methods for tunneling network traffic to apply network functions
CN104518937B (zh) 虚拟局域网vlan多设备间通信的方法及装置
CN116346536A (zh) 虚拟机访问云平台管理网的方法、装置、设备及介质
CN105991307B (zh) 一种远程控制路由器的方法和装置
CN117596205A (zh) 报文处理方法、装置、电子设备及可读介质
TWI400912B (zh) 封包導向方法

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2016907091

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2016907091

Country of ref document: EP

Effective date: 20180918

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16907091

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE