WO2018209745A1 - 流量引导方法和装置 - Google Patents

流量引导方法和装置 Download PDF

Info

Publication number
WO2018209745A1
WO2018209745A1 PCT/CN2017/088544 CN2017088544W WO2018209745A1 WO 2018209745 A1 WO2018209745 A1 WO 2018209745A1 CN 2017088544 W CN2017088544 W CN 2017088544W WO 2018209745 A1 WO2018209745 A1 WO 2018209745A1
Authority
WO
WIPO (PCT)
Prior art keywords
traffic
proxy
rule
service module
proxy server
Prior art date
Application number
PCT/CN2017/088544
Other languages
English (en)
French (fr)
Inventor
林漳坤
柳小鹏
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to US15/778,886 priority Critical patent/US11212355B2/en
Priority to EP17906785.5A priority patent/EP3439252B1/en
Publication of WO2018209745A1 publication Critical patent/WO2018209745A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/563—Data redirection of data network streams
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2483—Traffic characterised by specific attributes, e.g. priority or QoS involving identification of individual flows
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/32—Flow control; Congestion control by discarding or delaying data units, e.g. packets or frames

Definitions

  • the present invention relates to the field of computer network data technologies, and in particular, to a traffic guidance method and apparatus.
  • transparent proxy is one of the commonly used techniques for traffic grooming.
  • the transparent proxy means that the client does not need to know the existence of the proxy server at all, that is, the user does not need to make any settings, and the traffic requested by the client can obtain the destination internet protocol of the client access through a transparent proxy device, such as a router.
  • a transparent proxy device such as a router.
  • IP internet protocol
  • NAT network address translation
  • the existing transparent proxy technology has the following problems: (1) the prior art can only perform source-back processing in terms of traffic forwarding; (2) the existing transparent proxy function is too single, and there is no traffic identification and traffic grooming function.
  • an embodiment of the present invention provides a traffic guidance method and apparatus.
  • the technical solution is as follows:
  • a traffic steering method includes the following steps:
  • the proxy service module identifies the traffic, and selects a corresponding guiding rule to guide the traffic according to the identification result;
  • the guiding rule includes directing the traffic directly back to the source, guiding the traffic to the traffic processing server, guiding the traffic to the second proxy server, and discarding the traffic.
  • the proxy service module that imports the traffic to the first proxy server includes directing the traffic sent by the client to the local through the switch or the bridge, and then Importing the traffic to the proxy service module by using a traffic hijacking module of the first proxy server;
  • the importing the traffic to the proxy service module of the first proxy server includes directing the traffic to the proxy service module according to the boot rule.
  • the specific method for the traffic hijacking module to import traffic into the proxy service module includes:
  • For user datagram protocol traffic by configuring an iptables rule, and using a transparent proxy and configuring routing rules to direct the user datagram protocol traffic to the proxy service module;
  • the iptables rules are configured, and the marking and configuration routing rules are used to guide the network control packet protocol traffic or the general routing encapsulation protocol traffic to the local return interface, and is The proxy service module is obtained.
  • the method further includes the steps of: performing pre-booting rule matching on the traffic, and if the matching is successful, the traffic is guided according to the traffic guiding rule corresponding to the pre-booting rule. If the match is unsuccessful, the traffic is identified.
  • the pre-booting rules include: an internet protocol address guiding rule, a port guiding rule, and a hot and cold internet protocol address rule.
  • the first proxy server and the second proxy server communicate through a private multiplexing protocol.
  • the operating mode of the second proxy server is a remote proxy service mode.
  • the second proxy server identifies the traffic, and boots the traffic according to the traffic guiding rule corresponding to the identification result.
  • the running system kernels of the first proxy server and the second proxy server are Linux kernels.
  • a traffic guiding device in another aspect, includes: a first proxy server, a second proxy server, a source server, and a traffic processing server, wherein the first proxy server and the second proxy server are connected to each other, and are respectively connected to a source station server and a traffic processing server, wherein the first proxy server includes a traffic hijacking module and a proxy service module, the traffic hijacking module imports the traffic to the proxy service module, and the proxy service module pairs the traffic Identify and guide.
  • first proxy server and the client are connected through a switch or a bridge.
  • the switch or the bridge imports traffic from the client to the first proxy server, and the traffic hijacking module imports the traffic to the proxy service module.
  • the proxy service module includes a traffic identification unit, a protocol rule unit, and a traffic guiding unit, and after the proxy service module acquires the traffic, the traffic identification unit identifies the traffic, and the traffic guiding unit is configured according to the traffic The recognition result acquires a corresponding traffic guidance rule from the protocol rule unit, and guides the traffic according to the traffic guidance rule.
  • the traffic identification unit includes an http subunit, a p2p subunit, a game subunit, and a pptp subunit, and the traffic is identified by the subunit to obtain a recognition result.
  • the protocol rule unit stores a traffic guidance rule corresponding to each traffic identification result, where the traffic guidance rule includes directing the traffic to the source directly, guiding the traffic to the traffic processing server, and guiding the traffic. Go to the second proxy server and discard the traffic.
  • the proxy service module further includes a pre-boot unit, and after the proxy service module acquires the traffic, the pre-boot unit performs a pre-boot rule matching on the traffic, and if the matching is successful, the traffic is And entering the traffic guiding unit to perform a guiding process; if the matching fails, the traffic enters the traffic identifying unit for identification, and the traffic guiding unit guides the traffic according to the identification result.
  • first proxy server and the second proxy server communicate through a private multiplexing protocol.
  • the technical solution provided by the embodiment of the present invention has the beneficial effects that the present invention uses iptables to intercept traffic and redirects the traffic sent by the client to the local proxy service by using a redirect and transparent proxy method; the local proxy service can intercept the traffic.
  • the present invention uses iptables to intercept traffic and redirects the traffic sent by the client to the local proxy service by using a redirect and transparent proxy method; the local proxy service can intercept the traffic.
  • the corresponding traffic can be groomed to different proxy servers, directly returned to the local source or directly discarded.
  • the invention is based on the transparent proxy technology, and realizes the intelligent grooming of the traffic on the basis of the invention, which not only does not require any additional configuration by the client, but also solves the problem that only the network address can be converted back to the source in the traditional transparent proxy, and the function is single and cannot flow through
  • the traffic is identified and the problem of intelligent grooming.
  • FIG. 1 is a flowchart of a traffic guidance method according to a preferred embodiment of the present invention.
  • FIG. 2 is a flowchart of a traffic guidance method according to another preferred embodiment of the present invention.
  • FIG. 3 is a structural diagram of a flow guiding device according to a preferred embodiment of the present invention.
  • FIG. 4 is a structural diagram of a proxy module in the embodiment shown in FIG. 3;
  • FIG 5 is another structural diagram of the proxy module in the embodiment shown in Figure 3;
  • IP address refers to the Internet Protocol Address (English: Internet Protocol Address, also translated as Internet Protocol Address).
  • An IP address is a unified address format provided by the IP protocol. It assigns a logical address to each network and each host on the Internet to shield the difference in physical addresses.
  • Iptables is an IP packet filtering system integrated with the Linux kernel that facilitates better control of IP packet filtering and firewall configuration on Linux systems. Iptables is a tool that works in user space and defines rules. It is not a firewall. It defines rules that allow netfilters (network filters) in the kernel space to be read and implemented to make the firewall work. Iptables works in the kernel to set, maintain, and check the IP packet filtering rules of the Linux kernel. It can be used to form a list of rules to achieve absolute detailed access control. Iptables can define different tables, each containing several internal chains, and can also contain user-defined chains. Each chain is a list of rules that match the corresponding packages: each rule specifies how the matching package should be handled, or it can jump to a user-defined chain within the same table.
  • Transparent proxy means that the client does not need to know the existence of a proxy server at all. It changes your request fields and sends the real IP.
  • Target refers to the operation corresponding to the rule registered to netfilter through iptables, that is, the operation to be performed on the data packet matched by the rule, such as ACCEPT (accepted), DROP (discarded), and so on.
  • Raw socket the original socket, can receive data frames or data packets on the local network card to monitor network traffic and analysis.
  • FIG. 1 illustrates a flow guiding method according to a preferred embodiment of the present invention.
  • the flow guiding method includes the following steps:
  • Step S101 importing the traffic to the proxy service module of the first proxy server.
  • the first proxy server in the embodiment of the present invention includes two operating modes, namely a local proxy service mode and a remote proxy service mode.
  • the traffic imported to the first proxy server is used to direct the traffic of the client to the local through the switch policy routing, ospf dynamic routing or bridge direct connection, and the traffic agitation module of the first proxy server puts the traffic.
  • the proxy service module is directed to the first proxy server. Specifically, the traffic hijacking module forwards the intercepted traffic to the port monitored by the proxy service module, and then the proxy service module receives through the listening port.
  • the traffic hijacking module uses a corresponding method to import traffic to the proxy service module according to different traffic types:
  • TCP traffic For Transmission Control Protocol (TCP) traffic, redirect TCP traffic to the geographic service module by configuring iptables rules. Specifically, by configuring the iptables rule in the local Linux system, the destination Internet Protocol Address (IP) and the destination port of the protocol type TCP traffic are redirected to the IP address and TCP monitored by the proxy service module. The port, thus enabling the import of local TCP traffic, is monitored and received by the proxy service module.
  • IP Internet Protocol Address
  • UDP User Datagram Protocol
  • the traffic of the protocol type UDP is established through the transparent proxy to establish a connection with the proxy service module, and the UDP traffic is marked, and the local policy routing is configured.
  • the routing table to be searched for by the tagged request configure the local route, add a default routing rule to the routing table, and return the marked UDP traffic to the local interface, so that it is received by the proxy service module.
  • ICMP Internet Control Message Protocol
  • GRE Generic Routing Encapsulation
  • the iptables rules in the local Linux system marking the traffic of the protocol type ICMP or GRE, configuring the local policy routing and routing rules, and specifying the routing table to be searched for by the marked traffic.
  • the marked traffic is sent to the local and back interface, which is received by the local proxy service module. Since ICMP traffic or GRE traffic uses raw sockets, as long as the ICMP traffic or GRE traffic is routed back to the local interface, the local back interface is monitored by the local proxy service module, and the proxy service module can receive this through the raw socket. flow.
  • the traffic received by the first proxy server is the traffic that the local traffic hijacking module forwards the client traffic to the corresponding listening port.
  • the traffic of the proxy service module imported to the remote first proxy server is the traffic directed by the other proxy server, and the proxy service module passes the corresponding port. Listen to receive the traffic.
  • the difference between the remote proxy service mode and the local proxy mode is that the source of the traffic received by the proxy server is different.
  • the proxy server receives the traffic directly sent by the client, and the remote proxy service mode.
  • the traffic received by the proxy server is the traffic processed by other proxy servers, so when the proxy service module is in different operating modes, the ports it listens to are different.
  • the operation mode of the first proxy server may be a local proxy service mode or a remote proxy service mode
  • the operation mode of the second proxy server must be a remote proxy service mode
  • Step S102 The proxy service module identifies the traffic, and selects a corresponding guiding rule to guide the traffic according to the identification result.
  • the proxy service module After receiving the imported traffic, the proxy service module identifies the traffic as http traffic, p2p traffic, game traffic, or pptp traffic or default traffic. According to the identification result, the corresponding boot rule is selected, and the traffic is guided according to the boot rule, including direct traffic. Return the source, direct traffic to the traffic processing server, direct traffic to the second proxy server, or drop traffic.
  • the traffic is identified as http traffic, p2p traffic, game traffic, pptp traffic, or default traffic.
  • Each identification result has a corresponding guiding rule.
  • the guiding rules are preset and are also based on actual requirements. By setting, the agent module can not only identify and distinguish the traffic, but also classify and guide according to different traffic types, so as to more intelligently channel the traffic, not only that, but also the guiding rules corresponding to different traffic types. It can be set separately, so that the traffic can be channeled more clearly and accurately, and adjusted accordingly according to actual needs.
  • the rule for identifying the traffic may be adjusted according to actual requirements. For example, in some embodiments, only the http traffic and the game traffic are identified, and corresponding guiding rules are set. Other traffic is uniformly guided according to the set rules. Not only that, but also the type of identification can be set. For example, traffic can be identified as tcp traffic, udp traffic, etc., and traffic can be identified from other dimensions to better meet the application. The actual needs of the scene.
  • the first proxy server communicates with the second proxy server through a private multiplexing protocol, so that multiple requests can be transmitted in a single TCP channel, saving port usage.
  • the traffic processing server includes but is not limited to a Squid server and a p2pcs cache server.
  • the traffic guidance method provided by the present invention not only can identify the traffic, but also can separately guide the identified traffic, and the guiding manner can also be set as needed, thereby solving the problem that the traditional transparent proxy can only be used as a network.
  • the address is converted back to the source, and the function is single, and it is impossible to identify the traffic flowing through and the problem of intelligent grooming.
  • step S102 the difference from the embodiment shown in FIG. 1 is that before step S102, the method further includes:
  • Step S103 performing pre-boot rule matching on the traffic.
  • the traffic is imported to the proxy service module of the first proxy server in step S101, the traffic is matched according to the preset pre-boot rule. If the matching is successful, the process proceeds to step S104. If the matching is unsuccessful, the process proceeds to step S102.
  • the pre-boot rule matching of the traffic can pre-filter some specific traffic, for example, the traffic of the IP that is accessed as the hot IP can be directly guided without being identified, or for some errors. Access or offensive traffic can be intercepted in advance by pre-booting rule matching, and correspondingly processed.
  • the setting of the pre-booting rule matching step is to further improve the traffic grooming method. This allows specific traffic to be processed directly, improving overall performance and intelligence.
  • the rules in the module mainly include: an IP address guiding rule, a port guiding rule, and a hot and cold IP address rule, wherein the IP address guiding rule is guided by the source IP address or the destination IP address of the traffic request; the port guiding rule is Booting through the destination port of the request; the hot and cold IP address rule is the behavior of calculating the customer traffic through historical data, such as which destination IP addresses are accessed most frequently, thereby forming a hot and cold IP address guiding scheme.
  • pre-booting rules can be set according to actual needs, and are not limited to the description in this specification.
  • step S104 the guiding is performed according to the traffic guiding rule corresponding to the pre-booting rule.
  • the bootstrap mode mainly includes direct traffic back to the source, traffic to the traffic processing server, and traffic to the second. Proxy service module or drop traffic.
  • the traffic guidance rule is preset in the proxy service module, and can be set according to actual needs, and is not limited to the description in this specification.
  • steps S101 and S102 and other contents are the same as those in the embodiment shown in FIG. 1, and therefore will not be described again.
  • special traffic can be specially processed, thereby further improving the intelligence of the traffic guiding method, thereby better meeting the actual requirements of the application scenario.
  • the flow guiding device 1 of the present invention includes: a first proxy server 10, a second proxy server 20, a source station server 30, and a traffic processing server 40.
  • the first proxy server 10 and the second proxy server 20 are connected to each other and to the source station server 30 and the traffic processing server 40, respectively.
  • the first proxy server 10 includes a traffic hijacking module 11 and a proxy service module 12.
  • the first proxy server 10 includes two modes of operation, a local proxy service mode and a remote proxy service mode.
  • the traffic hijacking module 11 directs traffic to the proxy service module 12, which directs the traffic of the client to the first proxy server 10 by means of switch policy routing, ospf dynamic routing or bridge direct connection. And the traffic intercepted by the traffic hijacking module 11. Specifically, the traffic hijacking module 11 forwards the intercepted traffic to the port that the proxy service module 12 listens to, and the proxy service module 12 receives through its listening port.
  • the traffic hijacking module 11 uses different methods to import traffic to the proxy service module 12 according to different traffic types:
  • TCP traffic is redirected to the proxy service module 12 by configuring iptables rules. Specifically, by configuring the iptables rule in the local system, the destination Internet Protocol Address (IP) and the destination port of the protocol type TCP are redirected to the IP address and TCP monitored by the proxy service module 12. The port, thereby enabling the import of local TCP traffic, is monitored and received by the proxy service module 12.
  • IP Internet Protocol Address
  • the iptables rules are configured and UDP traffic is directed to the proxy service module 12 using a transparent proxy.
  • the traffic of the protocol type UDP is established through the transparent proxy to establish a contact with the proxy service module 12, and the UDP traffic is marked, and the local policy routing is configured.
  • the routing table to be searched for by the tag request configure the local route, add a default routing rule to the routing table, send the marked UDP traffic to the local and return interface, and receive it by the proxy service module 12.
  • ICMP Internet Control Message Protocol
  • GRE Generic Routing Encapsulation
  • the proxy service module 12 by configuring the iptables rules in the local system, marking the traffic of the protocol type ICMP or GRE, configuring the local policy routing and routing rules, and specifying the routing table to be marked by the marked traffic, marking the routing table.
  • the traffic is sent to the local and back interface to be received by the proxy service module 12. Since the ICMP traffic or the GRE traffic uses the raw socket, as long as the ICMP traffic or the GRE traffic is routed back to the local interface, the local return interface is monitored by the proxy service module 12, and the proxy service module 12 can receive the data through the raw socket. This traffic.
  • the traffic received by the proxy service module 12 is the traffic that the traffic hijacking module 11 forwards the client traffic to the corresponding listening port.
  • the first proxy server 10 When the operating mode of the first proxy server 10 is the remote proxy service mode, the first proxy server 10 may also be referred to as a remote proxy server, and the traffic of the import proxy service module 12 is determined by other local or remote The traffic directed by the proxy server, the proxy service module 12 also receives the traffic by listening to the corresponding port.
  • the port monitored by the proxy service module 12 is also adjusted accordingly.
  • the first proxy server 10 is connected to the client 2 through a switch policy routing or ospf dynamic routing or a bridge direct connection (not shown), and the traffic sent by the client 2 is A proxy server 10 receives the traffic received by the second proxy server 20 from the first proxy server 10 instead of directly from the client 2, so in the present embodiment, the current operating mode of the first proxy server 10 For the local proxy service mode, the current operating mode of the second proxy server 20 is the remote proxy service mode. It should be noted that the operation mode of the proxy server in this embodiment may be adjusted according to actual requirements, and is not limited to a certain fixed operation mode.
  • FIG. 4 is a detailed structural diagram of the proxy service module 12 of the first proxy server 10 in this embodiment.
  • the first proxy service module 12 includes a traffic identification unit 121a, a traffic guiding unit 122a, and a protocol rule unit 123a.
  • the identifying unit 121a identifies the traffic and sends the traffic and the identification result to the traffic.
  • the guiding unit 122a, the traffic guiding unit 122a receives the traffic, and acquires the corresponding guiding rule from the protocol rule unit 123a according to the recognition result, and guides the traffic.
  • the traffic identification unit 121a includes an http subunit 1211a, a p2p subunit 1212a, a game subunit 1213a, and a pptp subunit 1214a.
  • the traffic identification unit 121a identifies the traffic through the subunits when identifying the traffic.
  • the http sub-unit 1211a first identifies the traffic, and identifies whether it meets the http traffic characteristics.
  • the traffic is identified as http traffic, and the traffic and the identification result are sent to the traffic guiding unit 122a; If not, the other subunits are sent to identify; if none of the subunits can give an identification structure to the traffic, the identification result of the traffic is the default traffic, and is sent to the traffic guiding unit 122a.
  • the sub-units can be separately turned on and off according to actual needs, for example, only the http sub-unit and the game sub-unit are turned on, the p2p sub-unit and the pptp sub-unit are turned off, and the flow identification unit 121a
  • the given recognition result includes http traffic, or game traffic, or default traffic.
  • the protocol rule unit 123a includes traffic guidance rules corresponding to the respective traffic identification results, and the traffic guidance rules include: guiding the traffic directly back to the source (ie, forwarding to the source server 40), and guiding the traffic to the traffic. Processing server 30, directing traffic to second proxy service module 20 or discarding traffic. For example, if the traffic identification result is http traffic, according to the traffic guidance rule, the traffic may be directly returned to the traffic, or the traffic may be directed to the traffic processing server, or may be directed to the second proxy service module or discarded.
  • the specific boot results are also selected according to the set rules. For example, if the destination IP address is to access the Baidu web address, the source is directly returned.
  • the traffic guiding rules in the protocol rule unit 123a can be set according to actual requirements, that is, the guiding rules corresponding to the traffic of each identification result are mutually independent and unrelated, and The content of the specific guiding rule corresponding to each recognition result is not necessarily unified.
  • the recognition result is http traffic
  • the corresponding guiding rule may include the above four types, and the recognition result is the default traffic, and the corresponding guiding Rules can only be to discard traffic.
  • the traffic guidance rules corresponding to different traffic identification results can be separately set according to actual requirements, thereby further improving the intelligence of traffic grooming and making it more suitable for actual needs.
  • FIG. 5 is a schematic diagram showing another specific structure of the proxy service module in the embodiment shown in FIG.
  • the proxy service module 12 includes a traffic identification unit 121b, a traffic guiding unit 122b, a protocol rule unit 123b, and a pre-booting unit 124. After the proxy service module 12 obtains the traffic, the pre-booting unit 124 first performs traffic flow.
  • the traffic enters the traffic guiding unit 122b for guiding processing; if the matching fails, the traffic enters the traffic identifying unit 121b for identification, and sends the traffic and the identification result to the traffic guiding unit 122b, and the traffic guiding unit 122b receives the traffic, and obtains a corresponding guiding rule from the protocol rule unit 123b according to the identification result, and guides the traffic.
  • the pre-boot unit 124 performs the pre-boot rule matching on the traffic, and directly sends the successfully matched traffic to the traffic guiding unit 122b, and the traffic guiding unit 122b performs traffic according to the corresponding traffic guiding rule in the protocol rule 123b.
  • the traffic is directed, and the unsuccessful traffic is entered into the identification unit 121b for traffic identification.
  • the pre-booting unit 124 performs pre-booting rule matching on the traffic in order to pre-filter some specific traffic and directly send it to the traffic guiding unit 122b for traffic guidance.
  • the traffic of the IP that is accessed is hot IP can be directly Booting without prior identification or access to some erroneous access or offensive traffic can be intercepted in advance by pre-boot rule matching and processed accordingly.
  • pre-boot rule unit 124 The setting is to further improve the traffic guidance device to the traffic, so that some specific traffic can be directly processed, l Overall performance and intelligence.
  • the pre-booting rule is a rule preset in the proxy service module, and mainly includes: an IP address guiding rule, a port guiding rule, and a hot and cold IP address rule, wherein the IP address guiding rule is a source IP address through the traffic request. Or the destination IP address is booted; the port boot rule is guided by the destination port of the request; the hot and cold IP address rule is the behavior of calculating the customer traffic through historical data, such as which destination IP addresses are accessed most frequently, thereby forming a cold set. Boot scheme for hot IP addresses.
  • pre-booting rules can be set according to actual needs, and are not limited to the description in this specification.
  • the pre-booting rule matching result may include a further matching result, for example, matching the traffic to the hot IP request traffic, or the aggressive traffic.
  • the matching results are sent to the traffic guiding unit 122b, and the traffic guiding unit 122b will guide the traffic according to the guiding rule corresponding to the matching result.
  • the traffic identification unit 121b includes an http subunit 1211b, a p2p subunit 1212b, a game subunit 1213b, and a pptp subunit 1214b.
  • the traffic identification unit 121b receives the unsuccessful traffic sent by the preamble guiding unit 124, and performs the traffic. Identifying, when identifying the traffic, is the result of identifying the traffic through the subunits. For example, the http subunit 1211b first identifies the traffic, and identifies whether it conforms to the http traffic characteristic, and if yes, identifies the traffic.
  • the traffic is the http traffic, and the traffic and the identification result are sent to the traffic guiding unit 122b; if not, the other subunits are sent to identify; if the subunits are unable to give the identification structure to the traffic, the given
  • the result of the identification of the traffic is the default traffic and is sent to the traffic directing unit 122b.
  • the setting of the sub-units may be respectively turned on and off according to actual needs, for example, only the http sub-unit and the game sub-unit are turned on, the p2p sub-unit and the pptp sub-unit are turned off, and the flow identification unit 121b
  • the given recognition result includes http traffic, or game traffic, or default traffic.
  • the protocol rule unit 123b includes a traffic guidance rule corresponding to the result of the pre-boot rule matching, and a traffic guidance rule corresponding to each traffic identification result, where the traffic guidance rule includes: directing the traffic back directly to the source (ie, forwarding to the source server 40)
  • the traffic is directed to the traffic processing server 30, the traffic is directed to the second proxy service module 20, or the traffic is discarded.
  • the traffic identification result is http traffic
  • the traffic guidance rule the traffic may be directly returned to the source, or the traffic may be directed to the traffic processing server, or may be directed to the second proxy service module or discarded.
  • the guiding result is also based on The set rules are selected. For example, if the destination IP is set to access the Baidu website, the source is directly returned.
  • the traffic guiding rules in the protocol rule unit 123b can be set according to actual requirements, that is, the matching rules and the guiding rules corresponding to the traffic of each recognition result are mutually independently set, and there is no Correlation, and the content of the specific guiding rules corresponding to each recognition result is not necessarily unified.
  • the recognition result is http traffic
  • the corresponding guiding rule may include the above four types, and the recognition result is the default traffic.
  • the corresponding boot rule can only discard traffic.
  • the structures included in the first proxy server and the second proxy server are the same, and the functions that can be implemented are also the same, except that the operation modes in the current scenario are different, and the embodiment shown in FIG.
  • the operation mode of the first proxy server 10 is the local proxy service mode, so it directly receives the traffic from the client 2, and the second proxy server 20 receives the traffic forwarded from the first proxy server 10.
  • the specific rule settings of the first proxy server 10 and the second proxy server 20 are different.
  • the identification rule in the traffic identification unit and the traffic guidance rule in the protocol rule unit may be different.
  • the first proxy server 10 and the second proxy server 20 communicate through a private multiplexing protocol, so that multiple requests can be transmitted in a single TCP channel, saving port usage.
  • Traffic processing server 30 includes, but is not limited to, a Squid server and a p2pcs cache server.
  • the invention uses iptables to intercept traffic and directs traffic to the local proxy service by means of redirection and transparent proxy; performs traffic identification on the intercepted traffic, and performs corresponding grooming according to the configuration rule, and can be diverted to different proxy servers, Return directly to the source locally or directly.
  • the invention solves the problem that only the network address can be converted back to the source in the traditional transparent proxy, the function is single, the flow through the flow can be identified and the intelligent grooming can be performed.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solution of the embodiment. of. Those of ordinary skill in the art can understand and implement without deliberate labor.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种流量引导方法和装置，所示方法包括以下步骤：导入流量至第一代理服务器的代理服务模块；所述代理服务模块对所述流量进行识别，并根据识别结果选择对应的引导规则对所述流量进行引导；其中所述引导规则包含引导所述流量直接回源，引导所述流量到流量处理服务器，引导所述流量到第二代理服务器，以及丢弃所述流量。通过本发明所提供的流量引导方法解决传统透明代理中只能做网络地址转换回源，功能单一、无法对流经的流量做识别以及智能疏导的问题。本发明还提供一种流量引导装置。

Description

流量引导方法和装置 技术领域
本发明涉及计算机网络数据技术领域，特别涉及一种流量引导方法和装置。
背景技术
随着互联网技术的高速发展，对客户端流量的疏导需求日益膨胀，透明代理是用于流量疏导的常用技术之一。透明代理是指客户端根本不需要知道有代理服务器的存在，即用户不用做任何设置，客户端请求的流量在通过透明代理的设备，比如路由器之类的，能够获取客户端访问的目的网际协议地址(IP)和端口，然后回源，多用于路由器的网络地址转换(NAT)转发。
现有的透明代理技术存在有以下一些问题：(1)现有技术在流量转发方面只能进行回源处理；(2)现有的透明代理功能过于单一，没有流量识别和流量疏导功能。
发明内容
为了解决现有技术的问题，本发明实施例提供了一种流量引导方法和装置。所述技术方案如下：
一方面，一种流量引导方法，包括以下步骤：
导入流量至第一代理服务器的代理服务模块；
所述代理服务模块对所述流量进行识别，并根据识别结果选择对应的引导规则对所述流量进行引导；
其中所述引导规则包含引导所述流量直接回源，引导所述流量到流量处理服务器，引导所述流量到第二代理服务器，以及丢弃所述流量
进一步的，当所述第一代理服务器的运行模式为本地代理服务模式时，所述导入流量至第一代理服务器的代理服务模块包含通过交换机或网桥将客户端发送的流量引导到本地，再通过所述第一代理服务器的流量劫持模块将所述流量导入至所述代理服务模块；当所述第一代理服务器的运行模式为远端代理服 务模式时，所述导入流量至第一代理服务器的代理服务模块包含根据所述引导规则引导所述流量至所述代理服务模块。
具体的，流量劫持模块将流量导入至代理服务模块的具体方法包括：
对于传输控制协议流量，通过配置iptables规则，重定向所述传输控制协议流量到所述代理服务模块；
对于用户数据报协议流量，通过配置iptables规则，并使用透明代理和配置路由规则引导所述用户数据报协议流量到所述代理服务模块；
对于网络控制报文协议流量或通用路由封装协议流量，通过配置iptables规则，并设置标记和配置路由规则引导所述网络控制报文协议流量或通用路由封装协议流量到本地还回接口，并被所述代理服务模块获取。
进一步的，所述代理服务模块对所述流量进行识别之前更包括步骤：对所述流量进行前置引导规则匹配，若匹配成功，所述流量则按照前置引导规则对应的流量引导规则进行引导；若匹配不成功，则对所述流量进行识别。
具体的，前置引导规则包括：网际协议地址引导规则，端口引导规则和冷热网际协议地址规则。
具体的，第一代理服务器和第二代理服务器通过私有多路复用协议进行通信。
具体的，第二代理服务器的运行模式为远端代理服务模式。
具体的，所述第二代理服务器接收到所述流量后，对其进行识别，并根据识别结果对应的流量引导规则对所述流量进行引导。
具体的，所述第一代理服务器和所述第二代理服务器的运行系统内核为Linux内核。
另一方面，一种流量引导装置，包括：第一代理服务器，第二代理服务器，源站服务器和流量处理服务器，所述第一代理服务器和所述第二代理服务器相互连接，并且分别连接于源站服务器和流量处理服务器，其中，所述第一代理服务器包含流量劫持模块和代理服务模块，所述流量劫持模块导入所述流量至所述代理服务模块，所述代理服务模块对所述流量进行识别和引导。
进一步的，所述第一代理服务器与客户端之间通过交换机或网桥连接。
进一步的，所述交换机或所述网桥将来自所述客户端的流量导入至所述第一代理服务器，所述流量劫持模块将所述流量导入至所述代理服务模块。
进一步的，所述代理服务模块包含流量识别单元、协议规则单元和流量引导单元，所述代理服务模块获取所述流量后，所述流量识别单元对所述流量进行识别，所述流量引导单元根据识别结果从所述协议规则单元获取对应的流量引导规则，并按照所述流量引导规则对所述流量进行引导。
进一步的，所述流量识别单元包含http子单元、p2p子单元、game子单元和pptp子单元，所述流量经过所述子单元的识别得出识别结果。
进一步的，所述协议规则单元中保存有针对各种流量识别结果对应的流量引导规则，所述流量引导规则包含引导所述流量直接回源，引导所述流量到流量处理服务器，引导所述流量到第二代理服务器，以及丢弃所述流量。
进一步的，所述代理服务模块更包含前置引导单元，所述代理服务模块获取所述流量后，所述前置引导单元对所述流量进行前置引导规则匹配，若匹配成功，所述流量则进入所述流量引导单元进行引导处理；若匹配失败，所述流量进入所述流量识别单元进行识别，所述流量引导单元根据识别结果对所述流量进行引导。
进一步的，所述第一代理服务器与所述第二代理服务器之间通过私有多路复用协议进行通信。
本发明实施例提供的技术方案带来的有益效果是：本发明使用iptables截获流量并用重定向和透明代理的方法把客户端发出的流量引导到本地代理服务中；本地代理服务可对截获的流量做流量识别，并根据配置规则对识别出的不同流量做相应的疏导，可疏导到不同的代理服务器上、在本地直接回源或直接丢弃。本发明基于透明代理技术，并在此基础上实现了流量的智能疏导，不仅无需客户端进行任何额外的配置，而且解决传统透明代理中只能做网络地址转换回源，功能单一、无法对流经的流量做识别以及智能疏导的问题。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明一较佳实施例提供的流量引导方法流程图；
图2为本发明另一较佳实施例提供的流量引导方法流程图；
图3是本发明一较佳实施例提供的流量引导装置结构图；
图4是图3所示实施例中代理模块的一种结构图；
图5是图3所示实施例中代理模块的另一种结构图；
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。本领域技术人员可由本说明书所揭露的内容轻易地了解本发明的其他优点与功效。本发明还可以通过另外不同的具体实施方式加以实施或应用，本说明书中的各项细节也可以基于不同观点与应用，在没有背离本发明的精神下进行各种修饰或改变。需说明的是，在不冲突的情况下，以下实施例及实施例中的特征可以相互组合。
以下实施例中所提供的图示仅以示意方式说明本发明的基本构想，遂图式中仅显示与本发明中有关的组件而非按照实际实施时的组件数目、形状及尺寸绘制，其实际实施时各组件的型态、数量及比例可为一种随意的改变，且其组件布局型态也可能更为复杂。
首先，对本发明说明书中的技术词汇进行解释说明。以下说明是对本发明技术的解释，但本发明并不以此为限。
IP地址，是指互联网协议地址(英语：Internet Protocol Address，又译为网际协议地址)。IP地址是IP协议提供的一种统一的地址格式，它为互联网上的每一个网络和每一台主机分配一个逻辑地址，以此来屏蔽物理地址的差异。
iptables是与Linux内核集成的IP信息包过滤系统，该系统有利于在Linux系统上更好地控制IP信息包过滤和防火墙配置。iptables是工作在用户空间中，定义规则的工具，本身并不算是防火墙。它定义的规则，可以让在内核空间当中的netfilter(网络过滤器)来读取，并且实现让防火墙工作。iptables工作在内核当中，用来设置、维护和检查Linux内核的IP包过滤规则，可以将规则组成一个列表，实现绝对详细的访问控制功能。iptables可以定义不同的表，每个表都包含几个内部的链，也能包含用户定义的链。每个链都是一个规则列表，对对应的包进行匹配：每条规则指定应当如何处理与之相匹配的包，也可以跳向同一个表内的用户定义的链。
透明代理，是指客户端根本不需要知道有代理服务器的存在，它改变你的request fields(报文)，并会传送真实IP。
target，指的是通过iptables注册到netfilter的规则所对应的操作，也就是要对规则匹配到的数据包进行的操作，比如ACCEPT(接受)、DROP(丢弃)等。
raw socket，即原始套接字，可以接收本机网卡上的数据帧或者数据包，用于监听网络的流量和分析。
如图1所示，图1绘示本发明一较佳实施例所提供的流量引导方法，该流量引导方法包括以下步骤：
步骤S101，导入流量至第一代理服务器的代理服务模块。
具体而言，本发明实施例中的第一代理服务器包含两种运行模式，分别为本地代理服务模式和远端代理服务模式。
在本地代理服务模式下，导入至第一代理服务器的流量是通过交换机策略路由、ospf动态路由或网桥直连的方式将客户端的流量引导至本地，第一代理服务器的的流量劫持模块把流量引导到第一代理服务器的代理服务模块，具体而言，流量劫持模块将截获的流量转发至代理服务模块监听的端口，再由代理服务模块通过其监听端口接收。
在本发明的实施例中，流量劫持模块根据不同的流量类型，采用相应方法将流量导入至代理服务模块：
对于传输控制协议(Transmission Control Protocol，TCP)流量，通过配置iptables规则，重定向TCP流量到本地理服务模块。具体而言，通过对本地Linux系统中的iptables规则进行配置，将协议类型为TCP的流量的目的网际协议地址(Internet Protocol Address，IP)和目的端口重定向为代理服务模块监听的IP地址和TCP端口，从而实现导入本地的TCP流量被代理服务模块监听并接收。
对于用户数据报协议(User Datagram Protocol，UDP)流量，通过配置iptables规则，并使用透明代理引导UDP流量到代理服务模块。具体而言，通过对本地Linux系统中的iptables规则进行配置，将协议类型为UDP的流量通过透明代理来建立与代理服务模块的联系，并对该UDP流量进行标记，并配置本地策略路由，通过指定被标记请求所要查找的路由表，再配置本地路由，在路由表中添加默认路由规则，把被标记UDP流量往本地还回接口，从而被代理服务模块接收。
对于网络控制报文协议(Internet Control Message Protocol，ICMP)流量和通用路由封装协议(Generic Routing Encapsulation，GRE)流量，通过配置iptables规则，并设置标记和配置路由规则引导ICMP流量或GRE流量到本地还回接口，并被代理服务模块获取。
具体而言，通过对本地Linux系统中的iptables规则进行配置，对协议类型为ICMP或GRE的流量进行标记，同时配置本地策略路由和路由规则，指定被标记的流量所要查找的路由表，把被标记的流量发往本地还回接口，从而被本地代理服务模块接收。由于ICMP流量或GRE流量使用的是raw socket，只要把ICMP流量或GRE流量路由到本地还回接口以后，本地还回接口被本地代理服务模块所监听，代理服务模块就能够通过raw socket接收到这个流量。
由此可见，当第一代理服务器处于本地代理服务运行模式时，第一代理服务器接收到的流量是由本地流量劫持模块转发客户端流量到相应监听端口的流量。
当第一代理服务器的运行模式为远端代理服务模式时，导入远端第一代理服务器的代理服务模块的流量则是由其他代理服务器引导而来的流量，代理服务模块是通过对相应端口的监听，来接收该些流量。
远端代理服务模式和本地代理模式的区别在于，代理服务器所接收的流量来源不同，本地代理代理服务模式中，代理服务器接收到的是由客户端直接发出的流量，而在远端代理服务模式中，代理服务器接收到的流量，则是经过其他代理服务器进行处理过的流量，所以当代理服务模块处于不同的运行模式时，其所监听的端口是不同的。
在本实施例的流量引导方法中，第一代理服务器的运行模式可能是本地代理服务模式，也可能是远端代理服务模式，而第二代理服务器的运行模式一定为远端代理服务模式。
步骤S102，代理服务模块对流量进行识别，并根据识别结果选择对应的引导规则对流量进行引导。
代理服务模块收到导入的流量后，识别流量为http流量、p2p流量、game流量或pptp流量或默认流量，根据识别结果，选择对应的引导规则，根据引导规则对流量进行引导，包括引导流量直接回源、引导流量到流量处理服务器、引导流量到第二代理服务器或丢弃流量。
本实施例中，将流量识别为http流量、p2p流量、game流量、pptp流量或默认流量，每种识别结果都有对应的引导规则，该些引导规则是预先设定好的，也是根据实际需求进行设置的，如此一来，代理模块不仅可对流量进行识别区分，还能根据不同的流量类型进行分类引导，从而更加智能化的对流量进行疏导，不仅如此，不同流量类型对应的引导规则也可以分别进行设置，从而可以更加清晰准确的对流量进行疏导，并根据实际需求进行相应调整。
值得注意的是，本发明的实施例中，对流量进行识别的规则是可以实际需求调整的，例如在某些实施例中，仅对http流量和game流量进行识别，并设置相应的引导规则，其他流量则按照设置的规则进行统一引导，不仅如此，还可以对识别的类型进行设置，例如可将流量识别为tcp流量、udp流量等，从其他维度对流量进行识别，从而更好的满足应用场景的实际需求。
本发明的实施例中，第一代理服务器与第二代理服务器中间通过私有多路复用协议进行通信，从而可以实现多个请求在单个TCP通道中传输，节省端口的使用。流量处理服务器包含但不限于squid服务器和p2pcs缓存服务器。
由此可见，本发明提供的流量引导方法，不仅可以对流量进行识别，还能对识别后的流量分别进行引导，而且引导的方式也可以按需设置，解决了传统透明代理中只能做网络地址转换回源，功能单一、无法对流经的流量做识别以及智能疏导的问题。
在本发明的另一较佳实施例中，如图2所示，与图1所示的实施例区别在于步骤S102前，还包括：
步骤S103，对流量进行前置引导规则匹配。
当流量通过步骤S101导入到第一代理服务器的代理服务模块后，根据预设的前置引导规则对流量进行匹配，若匹配成功，则进入步骤S104，若匹配不成功，则进入步骤S102。
具体而言，对流量进行前置引导规则匹配可以对一些特定的流量进行预先过滤处理，例如，对所访问的IP为热度IP的流量可直接进行引导，而无需经过识别，或者对一些错误的访问或攻击性的流量，可通过前置引导规则匹配预先进行拦截，并对其进行相应的处理，简而言之，前置引导规则匹配步骤的设定，是为了进一步完善流量的疏导方法，使得一些特定的流量可以直接进行特定处理，从而提升整体性能和智能性。其中，前置引导规则为预先设置在代理服务 模块中的规则，主要包括包括：IP地址引导规则，端口引导规则和冷热IP地址规则，其中，IP地址引导规则是通过流量请求的源IP地址或是目的IP地址进行引导；端口引导规则是通过请求的目的端口来引导；冷热IP地址规则是通过历史数据计算出客户流量的行为，比如访问哪些目的IP地址最频繁，从而形成一套冷热IP地址的引导方案。
可以理解的是，前置引导规则可以按照实际需求进行设定，并不受限于本说明书中的描述。
步骤S104，按照前置引导规则对应的流量引导规则进行引导。
流量经过前置引导规则匹配成功后，将根据预设的前置引导规则对应的流量引导规则进行引导，引导的方式主要包括引导流量直接回源、引导流量到流量处理服务器、引导流量到第二代理服务模块或丢弃流量。
可以理解的是，该流量引导规则是预先设定在代理服务模块中的，并且是可以根据实际需求进行设定的，并不受限于本说明书中的描述。
在本较佳实施例中，步骤S101与步骤S102的及其他内容与图1所示实施例相同，故不再赘述。
本较佳实施例中，通过增设了前置引导规则配合，可对一些特定的流量进行特别处理，从而更进一步的提升了流量引导方法的智能性，从而更好的满足应用场景的实际需求。
此外，本发明还提供的一种流量引导装置1，如图3所示，包括：第一代理服务器10、第二代理服务器20、源站服务器30和流量处理服务器40。第一代理服务器10和第二代理服务器20相互连接，并且分别连接于源站服务器30和流量处理服务器40。
第一代理服务器10包含流量劫持模块11和代理服务模块12。
第一代理服务器10包含两种运行模式，分别为本地代理服务模式和远端代理服务模式。
在本地代理服务模式下，流量劫持模块11引导流量到代理服务模块12，该些流量是通过交换机策略路由、ospf动态路由或网桥直连的方式将客户端的流量引导至第一代理服务器10，并被流量劫持模块11截获的流量。具体而言，流量劫持模块11将截获的流量转发至代理服务模块12监听的端口，代理服务模块12通过其监听端口接收。
在本发明的实施例中，流量劫持模块11根据不同的流量类型，采用不同的方法将流量导入至代理服务模块12：
对于传输控制协议(Transmission Control Protocol，TCP)流量，通过配置iptables规则，重定向TCP流量到代理服务模块12。具体而言，通过对本地系统中的iptables规则进行配置，将协议类型为TCP的流量的目的网际协议地址(Internet Protocol Address，IP)和目的端口重定向为代理服务模块12监听的IP地址和TCP端口，从而实现导入本地的TCP流量被代理服务模块12监听并接收。
对于用户数据报协议(User Datagram Protocol，UDP)流量，通过配置iptables规则，并使用透明代理引导UDP流量到代理服务模块12。具体而言，通过对本地系统中的iptables规则进行配置，将协议类型为UDP的流量通过透明代理来建立与代理服务模块12的联系，并对该UDP流量进行标记，并配置本地策略路由，通过指定被标记请求所要查找的路由表，再配置本地路由，在路由表中添加默认路由规则，把被标记UDP流量发往本地还回接口，从而被代理服务模块12接收。
对于网络控制报文协议(Internet Control Message Protocol，ICMP)流量和通用路由封装协议(Generic Routing Encapsulation，GRE)流量，通过配置iptables规则，并设置标记和配置路由规则引导ICMP流量或GRE流量到本地还回接口，并被代理服务模块12获取。
具体而言，通过对本地系统中的iptables规则进行配置，对协议类型为ICMP或GRE的流量进行标记，同时配置本地策略路由和路由规则，指定被标记的流量所要查找的路由表，把被标记的流量发往本地还回接口，从而被代理服务模块12接收。由于ICMP流量或GRE流量使用的是raw socket，只要把ICMP流量或GRE流量路由到本地还回接口以后，本地还回接口被代理服务模块12所监听，代理服务模块12就能够通过raw socket接收到这个流量。
由此可见，当第一代理服务器10处于本地代理服务运行模式时，代理服务模块12接收到的流量是由流量劫持模块11转发客户端流量到相应监听端口的流量。
当第一代理服务器10的运行模式为远端代理服务模式时，第一代理服务器10也可称为远端代理服务器，导入代理服务模块12的流量则是由其他本地或远 端代理服务器引导而来的流量，代理服务模块12也是通过对相应端口的监听，来接收该些流量。
由此本发明的实施例中，代理服务器在不同的运行模式下，代理服务模块12所监听端口也会相应进行调整。
如图3所示，本实施例中，第一代理服务器10通过交换机策略路由或ospf动态路由或网桥直连的方式(图未视)连接于客户端2，客户端2发出的流量由第一代理服务器10接收；而第二代理服务器20所接收到的流量则是来自第一代理服务器10，而不是直接来自于客户端2，故本实施例中，第一代理服务器10的当前运行模式为本地代理服务模式，第二代理服务器20的当前运行模式为远端代理服务模式。值得注意的是，本实施例中的代理服务器的运行模式可以随实际需求进行调整，而不限于某一固定运行模式。
如图4所示，图4绘示了本实施例中第一代理服务器10的代理服务模块12的具体结构图。第一代理服务模块12包含流量识别单元121a、流量引导单元122a和协议规则单元123a，第一代理服务模块12接收到流量后，识别单元121a对流量进行识别，并将流量及识别结果发送至流量引导单元122a，流量引导单元122a接收流量，并根据识别结果从协议规则单元123a获取对应的引导规则，对流量进行引导。
具体而言，流量识别单元121a包含http子单元1211a、p2p子单元1212a、game子单元1213a和pptp子单元1214a，流量识别单元121a在对流量进行识别时，是经过该些子单元对流量进行识别而得出的结果，例如http子单元1211a先对流量进行识别，识别其是否符合http流量特征，若符合，则识别该流量为http流量，并将该流量及识别结果发送至流量引导单元122a；若不符合，则传入其他子单元进行识别；若该些子单元都无法对流量给出识别结构，则给定该流量的识别结果为默认流量，并发送至流量引导单元122a。
在本发明的实施例中，可根据实际需求对该些子单元分别进行开启和关闭的设置，例如只开启http子单元和game子单元，关闭p2p子单元和pptp子单元，那么流量识别单元121a给定的识别结果则包含http流量、或game流量、或默认流量。
协议规则单元123a中包含各流量识别结果对应的流量引导规则，该些流量引导规则包含：引导流量直接回源(即转发至源站服务器40)、引导流量到流量 处理服务器30、引导流量到第二代理服务模块20或丢弃流量。举例而言，若流量的识别结果为http流量，那么根据流量引导规则，该可能会对该流量直接回源，或者将该流量引导至流量处理服务器，或引导到第二代理服务模块或丢弃，具体的引导结果也是根据设置的规则进行选定的，例如，设置目的IP是访问百度网址的，则直接进行回源。
可以理解的是，协议规则单元123a中的流量引导规则可根据实际需求进行设定，也就是说，各识别结果的流量对应的引导规则相互之间是相互独立设定的，并无关联，而且每种识别结果对应的具体引导规则所包含的内容也并非一定是统一的，例如，识别结果为http流量的，对应的引导规则可包含上述四种，而识别结果为默认流量的，对应的引导规则可仅为丢弃流量。
由此可见，本发明实施例中，针对不同的流量识别结果对应的流量引导规则可按实际需求分别设定，从而更进一步的提升了流量疏导的智能性，使其更加贴合实际需求。
图5绘示图3所示实施例中代理服务模块的另一种具体结构图。如图5所示，代理服务模块12包含流量识别单元121b，流量引导单元122b，协议规则单元123b和前置引导单元124，代理服务模块12获取流量后，先由前置引导单元124对流量进行前置引导规则匹配，若匹配成功，流量则进入流量引导单元122b进行引导处理；若匹配失败，流量进入流量识别单元121b进行识别，并将流量及识别结果发送至流量引导单元122b，流量引导单元122b接收流量，并根据识别结果从协议规则单元123b获取对应的引导规则，对流量进行引导。
具体而言，前置引导单元124通过对流量进行前置引导规则匹配，并将匹配成功的流量直接发送给流量引导单元122b，流量引导单元122b根据协议规则123b中对应的流量引导规则对流量进行引导，而匹配不成功的流量则进入识别单元121b进行流量识别。
前置引导单元124对流量进行前置引导规则匹配是为了能对一些特定的流量进行预先过滤并直接发送给流量引导单元122b进行流量引导，例如，对所访问的IP为热度IP的流量可直接进行引导，而无需经过识别，或者对一些错误的访问或攻击性的流量，可通过前置引导规则匹配预先进行拦截，并对其进行相应的处理，简而言之，前置引导规则单元124的设定，是为了进一步完善流量引导装置对流量的疏导，使得一些特定的流量可以直接进行特定处理，从而提 升整体性能和智能性。
其中，前置引导规则为预先设置在代理服务模块中的规则，主要包括包括：IP地址引导规则，端口引导规则和冷热IP地址规则，其中，IP地址引导规则是通过流量请求的源IP地址或是目的IP地址进行引导；端口引导规则是通过请求的目的端口来引导；冷热IP地址规则是通过历史数据计算出客户流量的行为，比如访问哪些目的IP地址最频繁，从而形成一套冷热IP地址的引导方案。
可以理解的是，前置引导规则可以按照实际需求进行设定，并不受限于本说明书中的描述。
在本发明的实施例中，对于前置引导单元124匹配成功的流量，其前置引导规则匹配结果可包含进一步的匹配结果，例如匹配该流量为热门IP请求流量，或为攻击性流量，该些匹配结果会一并发送至流量引导单元122b，流量引导单元122b将根据匹配结果相应的引导规则对该流量进行引导。
流量识别单元121b包含http子单元1211b、p2p子单元1212b、game子单元1213b和pptp子单元1214b，流量识别单元121b接收由前置引导单元124发送来的匹配不成功的流量，并对该流量进行识别，在对流量进行识别时，是经过该些子单元对流量进行识别而得出的结果，例如http子单元1211b先对流量进行识别，识别其是否符合http流量特征，若符合，则识别该流量为http流量，并将该流量及识别结果发送至流量引导单元122b；若不符合，则传入其他子单元进行识别；若该些子单元都无法对流量给出识别结构，则给定该流量的识别结果为默认流量，并发送至流量引导单元122b。
在本发明的实施例中，可根据实际需求对该些子单元分别进行开启和关闭的设置，例如只开启http子单元和game子单元，关闭p2p子单元和pptp子单元，那么流量识别单元121b给定的识别结果则包含http流量、或game流量、或默认流量。
协议规则单元123b中包含前置引导规则匹配结果对应的流量引导规则，和各流量识别结果对应的流量引导规则，该些流量引导规则包含：引导流量直接回源(即转发至源站服务器40)、引导流量到流量处理服务器30、引导流量到第二代理服务模块20或丢弃流量。举例而言，若流量的识别结果为http流量，那么根据流量引导规则，可能会对该流量直接回源，或者将该流量引导至流量处理服务器，或引导到第二代理服务模块或丢弃，具体的引导结果也是根据设 置的规则进行选定的，例如，设置目的IP是访问百度网址的，则直接进行回源。
可以理解的是，协议规则单元123b中的流量引导规则可根据实际需求进行设定，也就是说，匹配结果和各识别结果的流量对应的引导规则相互之间是相互独立设定的，并无关联，而且每种识别结果对应的具体引导规则所包含的内容也并非一定是统一的，例如，识别结果为http流量的，对应的引导规则可包含上述四种，而识别结果为默认流量的，对应的引导规则可仅为丢弃流量。
在本实施例中，通过增设前置引导单元124对流量进行前置引导规则匹配可对一些特定的流量进行特别处理，从而更进一步的提升了流量引导方法的智能性，从而更好的满足应用场景的实际需求。
本发明的实施例中，第一代理服务器、第二代理服务器所包含的结构是相同的，所能实现的功能也相同，区别在于，在当前场景中的运行模式不同，图3所示实施例中，第一代理服务器10的运行模式为本地代理服务模式，故其直接接收来自客户端2的流量，而第二代理服务器20则接收的是来自第一代理服务器10转发而来的流量。而在不同运行模式下，第一代理服务器10和第二代理服务器20的具体规则设置不同，例如流量识别单元中的识别规则、协议规则单元中的流量引导规则可能会存在差异。
本发明的实施例中，第一代理服务器10与第二代理服务器20中间通过私有多路复用协议进行通信，从而可以实现多个请求在单个TCP通道中传输，节省端口的使用。流量处理服务器30包含但不限于squid服务器和p2pcs缓存服务器。
本发明使用iptables截获流量并用重定向和透明代理的方法把流量引导到本地代理服务中；对截获的流量做流量识别，并根据配置规则做相应的疏导，可疏导到不同的代理服务器上、在本地直接回源或直接丢弃。本发明解决传统透明代理中只能做网络地址转换回源，功能单一、无法对流经的流量做识别以及智能疏导的问题。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目 的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (17)

  1. 一种流量引导方法，其特征在于，包括以下步骤：
    导入流量至第一代理服务器的代理服务模块；
    所述代理服务模块对所述流量进行识别，并根据识别结果选择对应的引导规则对所述流量进行引导；
    其中所述引导规则包含引导所述流量直接回源，引导所述流量到流量处理服务器，引导所述流量到第二代理服务器，以及丢弃所述流量。
  2. 如权利要求1所述的流量引导方法，其特征在于，当所述第一代理服务器的运行模式为本地代理服务模式时，所述导入流量至第一代理服务器的代理服务模块包含通过交换机或网桥将客户端发送的流量引导到本地，再通过所述第一代理服务器的流量劫持模块将所述流量导入至所述代理服务模块；当所述第一代理服务器的运行模式为远端代理服务模式时，所述导入流量至第一代理服务器的代理服务模块包含根据所述引导规则引导所述流量至所述代理服务模块。
  3. 如权利要求2所述的流量引导方法，其特征在于，所述流量劫持模块将所述流量导入至所述代理服务模块的具体方法包括：
    对于传输控制协议流量，通过配置iptables规则，重定向所述传输控制协议流量到所述代理服务模块；
    对于用户数据报协议流量，通过配置iptables规则，并使用透明代理和配置路由规则引导所述用户数据报协议流量到所述代理服务模块；
    对于网络控制报文协议流量或通用路由封装协议流量，通过配置iptables规则，并设置标记和配置路由规则引导所述网络控制报文协议流量或通用路由封装协议流量到本地还回接口，并被所述代理服务模块获取。
  4. 如权利要求1所述的流量引导方法，其特征在于，所述代理服务模块对所述流量进行识别之前更包括步骤：对所述流量进行前置引导规则匹配，若匹配成功，所述流量则按照前置引导规则对应的流量引导规则进行引导；若匹配 不成功，则对所述流量进行识别。
  5. 如权利要求4所述的流量引导方法，其特征在于，所述前置引导规则包括：网际协议地址引导规则，端口引导规则和冷热网际协议地址规则。
  6. 如权利要求1所述的流量引导方法，其特征在于，所述第一代理服务器和所述第二代理服务器通过私有多路复用协议进行通信。
  7. 如权利要求1所述的流量引导方法，其特征在于，所述第二代理服务器的运行模式为远端代理服务模式。
  8. 如权利要求1所述的流量引导方法，其特征在于，所述第二代理服务器接收到所述流量后，对其进行识别，并根据识别结果对应的流量引导规则对所述流量进行引导。
  9. 如权利要求1所述的流量引导方法，其特征在于，所述第一代理服务器和所述第二代理服务器的运行系统内核为Linux内核。
  10. 一种流量引导装置，其特征在于，包括：第一代理服务器，第二代理服务器，源站服务器和流量处理服务器，所述第一代理服务器和所述第二代理服务器相互连接，并且分别连接于源站服务器和流量处理服务器，其中，所述第一代理服务器包含流量劫持模块和代理服务模块，所述流量劫持模块导入所述流量至所述代理服务模块，所述代理服务模块对所述流量进行识别和引导。
  11. 如权利要求10所述的流量引导装置，其特征在于，所述第一代理服务器与客户端之间通过交换机或网桥连接。
  12. 如权利要求11所述的流量引导装置，其特征在于，所述交换机或所述网桥将来自所述客户端的流量导入至所述第一代理服务器，所述流量劫持模块将所述流量导入至所述代理服务模块。
  13. 如权利要求10所述的流量引导装置，其特征在于，所述代理服务模块包含流量识别单元、协议规则单元和流量引导单元，所述代理服务模块获取所述流量后，所述流量识别单元对所述流量进行识别，所述流量引导单元根据识别结果从所述协议规则单元获取对应的流量引导规则，并按照所述流量引导规则对所述流量进行引导。
  14. 如权利要求13所述的流量引导装置，其特征在于，所述流量识别单元包含http子单元、p2p子单元、game子单元和pptp子单元，所述流量经过所述子单元的识别得出识别结果。
  15. 如权利要求13所述的流量引导装置，其特征在于，所述协议规则单元中保存有针对各种流量识别结果对应的流量引导规则，所述流量引导规则包含引导所述流量直接回源，引导所述流量到流量处理服务器，引导所述流量到第二代理服务器，以及丢弃所述流量。
  16. 如权利要求13所述的流量引导装置，其特征在于，所述代理服务模块更包含前置引导单元，所述代理服务模块获取所述流量后，所述前置引导单元对所述流量进行前置引导规则匹配，若匹配成功，所述流量则进入所述流量引导单元进行引导处理；若匹配失败，所述流量进入所述流量识别单元进行识别，所述流量引导单元根据识别结果对所述流量进行引导。
  17. 如权利要求10所述的流量引导装置，其特征在于，所述第一代理服务器与所述第二代理服务器之间通过私有多路复用协议进行通信。
PCT/CN2017/088544 2017-05-16 2017-06-16 流量引导方法和装置 WO2018209745A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/778,886 US11212355B2 (en) 2017-05-16 2017-06-16 Method and device for redirecting traffic
EP17906785.5A EP3439252B1 (en) 2017-05-16 2017-06-16 Traffic directing method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710341240.1A CN107147588B (zh) 2017-05-16 2017-05-16 流量引导方法和装置
CN201710341240.1 2017-05-16

Publications (1)

Publication Number Publication Date
WO2018209745A1 true WO2018209745A1 (zh) 2018-11-22

Family

ID=59778641

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/088544 WO2018209745A1 (zh) 2017-05-16 2017-06-16 流量引导方法和装置

Country Status (4)

Country Link
US (1) US11212355B2 (zh)
EP (1) EP3439252B1 (zh)
CN (1) CN107147588B (zh)
WO (1) WO2018209745A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107846470B (zh) * 2017-11-16 2021-06-22 网宿科技股份有限公司 一种流量引导的方法和系统
CN108282414B (zh) * 2017-12-29 2020-05-29 网宿科技股份有限公司 一种数据流的引导方法、服务器和系统
CN108809795B (zh) * 2018-04-19 2021-10-15 中国科学院计算机网络信息中心 一种局域网环境中透明分流方法和装置
CN110392074B (zh) * 2018-04-19 2022-05-17 贵州白山云科技股份有限公司 一种基于动态加速的调度方法及装置
CN109150725B (zh) * 2018-07-09 2021-07-16 网宿科技股份有限公司 流量疏导方法及服务器
CN109639442B (zh) * 2018-11-20 2022-01-18 网宿科技股份有限公司 流量分类引导方法及系统
CN111447144A (zh) * 2020-04-01 2020-07-24 中核武汉核电运行技术股份有限公司 一种基于透明代理的应用路由方法
US11671347B2 (en) * 2020-09-30 2023-06-06 Vmware, Inc. On-demand packet redirection

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102594876A (zh) * 2012-01-19 2012-07-18 网宿科技股份有限公司 游戏实时数据和更新数据的混合加速方法和系统
CN105101147A (zh) * 2015-08-19 2015-11-25 网宿科技股份有限公司 一种实现移动app的定向流量的方法和系统
CN105791315A (zh) * 2016-04-25 2016-07-20 网宿科技股份有限公司 一种udp协议加速方法和系统
CN106130997A (zh) * 2016-06-30 2016-11-16 网宿科技股份有限公司 流量引导的方法和装置
US20160352683A1 (en) * 2011-10-17 2016-12-01 Mcafee, Inc. System and method for redirected firewall discovery in a network environment

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6687732B1 (en) * 1998-09-28 2004-02-03 Inktomi Corporation Adaptive traffic bypassing in an intercepting network driver
CN101399749B (zh) * 2007-09-27 2012-04-04 华为技术有限公司 一种报文过滤的方法、系统和设备
WO2010001188A1 (en) * 2008-07-01 2010-01-07 Thomson Licensing Transparent web proxy
EP2737741A4 (en) * 2011-07-27 2015-01-21 Seven Networks Inc SURVEILLANCE OF MOBILE APPLICATION ACTIVITIES IN SEARCH OF MALICIOUS TRAFFIC ON A MOBILE DEVICE

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160352683A1 (en) * 2011-10-17 2016-12-01 Mcafee, Inc. System and method for redirected firewall discovery in a network environment
CN102594876A (zh) * 2012-01-19 2012-07-18 网宿科技股份有限公司 游戏实时数据和更新数据的混合加速方法和系统
CN105101147A (zh) * 2015-08-19 2015-11-25 网宿科技股份有限公司 一种实现移动app的定向流量的方法和系统
CN105791315A (zh) * 2016-04-25 2016-07-20 网宿科技股份有限公司 一种udp协议加速方法和系统
CN106130997A (zh) * 2016-06-30 2016-11-16 网宿科技股份有限公司 流量引导的方法和装置

Also Published As

Publication number Publication date
US20210203738A1 (en) 2021-07-01
CN107147588B (zh) 2020-03-31
CN107147588A (zh) 2017-09-08
EP3439252A1 (en) 2019-02-06
EP3439252A4 (en) 2019-07-03
US11212355B2 (en) 2021-12-28
EP3439252B1 (en) 2020-07-08

Similar Documents

Publication Publication Date Title
WO2018209745A1 (zh) 流量引导方法和装置
US9614739B2 (en) Defining service chains in terms of service functions
US9813338B2 (en) Co-existence of routable and non-routable RDMA solutions on the same network interface
CA2968964C (en) Source ip address transparency systems and methods
CA3010741C (en) Method and system for automatically bypassing network proxies in the presence of interdependent traffic flows
US11799821B2 (en) Service chains for inter-cloud traffic
KR20140143155A (ko) 네트워킹 장치 가상화를 위한 패킷 처리 오프로딩 기법
US10795717B2 (en) Hypervisor flow steering for address sharing
US10178068B2 (en) Translating network attributes of packets in a multi-tenant environment
US9042272B2 (en) Distributed proxy addressing operations
US11489810B2 (en) Intelligently routing a response packet along a same connection as a request packet
CN111010340B (zh) 数据报文转发控制方法、装置及计算装置
CN116547953A (zh) 由网络结构控制平面实施段间流量策略
US10229459B1 (en) Method and apparatus for routing in transaction management systems
US9806984B1 (en) Separating network traffic among virtual servers
US20090292796A1 (en) Method and device for providing routing policies to user terminals according to applications executed on user terminals
US20230171194A1 (en) Customized tuple definition for hashing at a network appliance routing service
US10897488B1 (en) Multiplexing traffic from multiple network namespaces to a single listener in a stream-based server application
CN117811798A (zh) 基于防火墙的报文处理方法、装置以及目标处理系统
CN116527627A (zh) 一种nat类型的确定方法、客户端、系统和存储介质
CN115632980A (zh) 路由配置实现方法、装置、存储介质及电子设备

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2017906785

Country of ref document: EP

Effective date: 20181101

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17906785

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE