WO2021196568A1

WO2021196568A1 - Traffic flow proxy method, server, and storage medium

Info

Publication number: WO2021196568A1
Application number: PCT/CN2020/122270
Authority: WO
Inventors: 吴建国; 许加烜
Original assignee: 厦门网宿有限公司
Priority date: 2020-03-30
Filing date: 2020-10-20
Publication date: 2021-10-07
Also published as: CN112104744A; CN112104744B

Abstract

Embodiments of the present application relate to the technical field of communications, and in particular, to a traffic flow proxy method, a server, and a storage medium. The traffic flow proxy method comprises: receiving an HTTP request packet (101); parsing the request packet to obtain request information (102); determining whether the request information meets a preset whitelist rule (103); if yes, redirecting the request packet to a proxy software, and sending the request information to the proxy software (104); and if not, forwarding the request packet to the next hop (105), wherein an uplink packet of the TCP connection to which the request packet belongs passes through the server, and the server records the SYN packet header option of the TCP connection.

Description

Traffic proxy method, server and storage medium

cross reference

This application requires a Chinese patent application filed on March 30, 2020 under the name "Traffic Proxy Method, Proxy Server and Storage Medium", the application number is 202010237001.3, and the name submitted on September 23, 2020 as "Traffic Proxy Method" , Server and storage medium", the priority of the Chinese patent application with the application number 202011010588.0, all of which are incorporated into this application by reference.

Technical field

The embodiments of the present application relate to the field of communication technologies, and in particular, to a traffic proxy method, a server, and a storage medium.

Background technique

With the rapid development of the Internet, the content on the Internet is becoming more and more abundant, and users are gradually pursuing faster Internet response speed; usually through network proxy and other methods, to provide users with an accelerated Internet access experience. In the traditional proxy acceleration method, the client establishes a connection with the proxy server, the proxy server establishes a connection with the origin site, the proxy server obtains the content of the origin site, and then returns the obtained content to the client.

Summary of the invention

The purpose of the embodiments of the present application is to provide a traffic proxy method, server, and storage medium, which can help reduce the traffic proxy load of the proxy server and prevent the proxy server from processing all proxy client requests.

To solve the above problem, the embodiment of the present application provides a traffic proxy method, including: receiving an HTTP request message; parsing the request message to obtain request information; judging whether the request information conforms to a preset whitelist rule If yes, redirect the request message to the agent software, and send the request information to the agent software, so that the agent software can determine that the request information corresponding to the request information is stored in the preset storage device After the content, the request content is obtained from the preset storage device and sent to the proxy server; if not, the request message is forwarded to the next hop; wherein, the upstream of the TCP connection to which the request message belongs The message passes through the server, and the server records the SYN message header option of the TCP connection.

The embodiment of the present application also provides a server, including: a receiving module and a content recognition module; the receiving module is used to receive HTTP request messages; the content recognition module is used to parse the request messages to obtain the request Information; the content identification module is also used to determine whether the requested information meets the preset whitelist rules; if so, the request message is redirected to the agent software, and the request information is sent to the agent Software for the proxy software to obtain the requested content from the preset storage device and send it to the proxy server after determining that the requested content corresponding to the requested information is stored in the preset storage device; if not, send the requested content to the proxy server; The request message is forwarded to the next hop; wherein, the uplink message of the TCP connection to which the request message belongs passes through the proxy server, and the proxy server records the SYN message header option of the TCP connection.

An embodiment of the present application also provides a server, including: at least one processor; and a memory communicatively connected with the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor The instruction is executed by the at least one processor, so that the at least one processor can execute the above-mentioned traffic proxy method.

The embodiment of the present application also provides a computer storage medium storing a computer program, and the computer program is executed by a processor to implement the above-mentioned traffic proxy method.

Compared with the prior art, this embodiment of the application receives an HTTP request message; parses the request message to obtain request information; judges whether the request information meets the preset whitelist rule; if so, reports the request The document is redirected to the agent software, and the request information is sent to the agent software, so that the agent software can download the request information from the preset storage device after determining that the request content corresponding to the request information is stored in the preset storage device. The storage device obtains the request content and sends it to the proxy server; if not, forwards the request message to the next hop; wherein, the uplink message of the TCP connection to which the request message belongs passes through the server, so The server records the SYN packet header options of the TCP connection. That is to say, after the server transmits the uplink message of the TCP connection, it intercepts the HTTP request message in the TCP connection, parses the request information, and determines whether the request message meets the preset whitelist rules to determine whether to respond to the request message. Proxying can effectively intercept insecure, offensive and other requests that are not allowed to proxy, thereby helping to improve the security of traffic proxy. If it is determined to proxy the request message, the request message will be redirected to the proxy software for processing; if the request message is not proxyed, the request message will be directly forwarded to the next hop, that is, the request message will not be processed by the proxy software. The document is processed, so as to filter the traffic to be loaded by the proxy server and reduce the traffic load pressure of the proxy server; in addition, the request message is redirected to the proxy software, and the request information is sent to the proxy software for After the proxy software determines that the request content corresponding to the request information is stored in the preset storage device, it obtains the request content from the preset storage device and sends it to the proxy server, thereby shortening the time-consuming process of the request and response, and realizing the response to the request. Accelerated service.

In an embodiment, before the parsing of the request message, the method further includes: determining whether the destination port of the TCP connection is a preset whitelist destination port; if so, parsing the request message to obtain request information If not, the request message is forwarded to the next hop; wherein, the destination port of the TCP connection is obtained by parsing the uplink message; in the above manner, the request information of the request message is used to determine whether Before proxying the request message, perform a pre-filtering through the destination port of the TCP connection to which the request message belongs to reduce the traffic that the proxy software will load.

In one embodiment, the proxy software is pre-configured with a TCP connection quick opening function; the redirecting the request message to the proxy software includes: adding a TCP handshake request flag SYN to the request message to obtain A handshake request message carrying data; the handshake request message carrying data is redirected to the proxy software for the proxy software to confirm and send the handshake request message carrying data after receiving the handshake request message carrying data The client requesting the message establishes a TCP connection; it is understandable that the pre-configured fast TCP connection opening function enables the proxy software and the client sending the upstream message to quickly establish a TCP connection, which speeds up the efficiency of the data transmission process.

In one embodiment, adding a TCP handshake request flag SYN to the request message, and before obtaining a handshake request message carrying data, further includes: modifying the request message according to the recorded header options of the SYN message The message header option of the message, so that the proxy software confirms that the message header option of the TCP connection established with the client is the same as the message header option of the TCP connection to which the request message belongs. The established TCP connection is unaware, and a transparent proxy to the client is realized.

Description of the drawings

One or more embodiments are exemplified by the pictures in the corresponding drawings, and these exemplified descriptions do not constitute a limitation on the embodiments.

Fig. 1 is a flowchart of a traffic proxy method according to the first embodiment of the present application;

Figure 2 is a flowchart of another traffic proxy method according to the first embodiment of the present application;

Fig. 3 is a flowchart of a traffic proxy method according to a second embodiment of the present application;

Fig. 4 is a flowchart of a traffic proxy method according to a third embodiment of the present application;

FIG. 5 is a block diagram of the structure of a server according to a fourth embodiment of the present application;

Fig. 6 is a block diagram of the structure of the server in the fifth embodiment according to the present application.

Detailed ways

In order to make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the various embodiments of the present application will be described in detail below with reference to the accompanying drawings. However, those of ordinary skill in the art can understand that in each embodiment of the present application, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solution claimed in this application can be realized. The following divisions of the various embodiments are for convenience of description, and should not constitute any limitation on the specific implementation manners of the present application, and the various embodiments may be combined with each other without contradiction.

The inventor found the following problems in the related technology: due to the establishment of a connection between the client and the proxy server, the proxy server usually proxies all the requests sent by the client, resulting in a large load on the proxy server, a long proxy time, and the security of the proxy server Sex is difficult to be guaranteed.

The first embodiment of the present application relates to a traffic proxy method. The specific process is shown in Figure 1 and includes the following steps.

Step 101: Receive an HTTP request message.

Step 102: Parse the request message to obtain request information.

Step 103: Determine whether the requested information meets the preset whitelist rules; if yes, go to step 104; if not, go to step 105.

Step 104: Redirect the request message to the agent software, and send the request information to the agent software.

Step 105: Forward the request message to the next hop.

In this embodiment, the upstream message of the TCP connection to which the request message belongs passes through the server, that is, the upstream message sent by the client for establishing a TCP connection with the source station passes through the server. It can be understood that the server transparently transmits the above TCP connection. Uplink message. The following specifically describes the implementation details of the traffic proxy method of this embodiment. The following content is only provided for ease of understanding and is not necessary for implementing this solution.

In step 101, the server receives the HTTP request message; specifically, the HTTP request message can be directed to the server by pre-configured routing strategy.

In step 102, the server parses the request message to obtain the request information; specifically, the request information in this embodiment may include the requested domain name address, requested content type, requested content name, requested content related fields and other information .

In step 103, the server determines whether the requested information meets the preset whitelist rules; specifically, the whitelist rules for the requested information can be configured in the server in advance to filter the requested information (for example, it can include Whitelist rules for filtering domain name addresses, whitelist rules for filtering requested content types, whitelist rules for filtering requested content names, etc.). After the server parses and obtains the request information, it performs operations such as comparison or matching according to the pre-configured whitelist rules; if the parsed request information meets the preset whitelist rules, it is determined that the request message is a legal request message. If it belongs to a request message that is allowed to be proxied, go to step 104; if the parsed request information does not meet the preset whitelist rules, it is determined that the request message is an illegal request message and is a request that is not allowed to be proxied Packet, go to step 105. It is understandable that the request information is filtered according to the preset whitelist rules, that is, the function of the firewall is realized, which can effectively intercept insecure, offensive and other request messages that are not allowed to be proxied, thereby It helps to improve the security of the traffic proxy; moreover, the whitelist rules configured in the server can be dynamically adjusted according to requirements at any time, and will not affect the normal operation of the server.

In step 104, when it is determined that the parsed request information meets the preset whitelist rules, the request message is redirected to the proxy software for the proxy software to perform proxy acceleration on the request message; since the request message is sent by The upstream message is sent by the client, so the source address of the request message is the address of the client, and the destination address is the address of the source station that receives the upstream message; when the request message is redirected, it can be based on DNAT (Destination Network Address). Translation (Destination Address Translation) principle is to convert the destination address of the request message to the address of the proxy software, thereby realizing the redirection of the request message to the proxy software.

In one embodiment, the server also sends the request information to the agent software, so that the agent software can determine whether the requested content corresponding to the requested information is stored in the preset storage device according to the request information; if the agent software determines that the preset storage device stores If there is a request content corresponding to the request information, the proxy software can directly obtain the request content from the preset storage device and send it to the proxy server, so that the proxy server can forward the request content to the client, thereby reducing the cost of the request and response process. At the time, the accelerated service of the request was realized. The preset storage device in this embodiment may be a local storage device such as a disk, or a cloud storage device. The preset storage device is used to store content that the agent software has requested from the origin site. In the example, the request information received by the proxy software includes: the requested content type is a picture, the requested content name is A (that is, the requested content includes: picture A), and the proxy software determines that "picture A" is stored in the preset storage device, Then the proxy software directly reads "Picture A" from the preset storage device and sends it to the proxy server without having to request "Picture A" from the origin site again. It is understandable that if the proxy software determines that the requested content corresponding to the requested information is not stored in the preset storage device, the proxy software requests the content requested by the client from the source station, and sends the requested content back to the source via the proxy server. The client, and cache the requested content back to the source in the preset storage device.

In step 105, when it is determined that the parsed request information does not conform to the preset whitelist rule, the request message is directly forwarded to the next hop in the pre-configured routing policy, without proxying by proxy software, so as to The proxy software filters the traffic to be loaded. In addition, when it is determined that the parsed request information does not meet the preset whitelist rules, the request message can also be discarded directly without proxying by proxy software, so that some potentially offensive request messages can be filtered out , To ensure the security of the network.

More specifically, this embodiment also provides a traffic proxy method, as shown in Fig. 2; the traffic proxy method shown in Fig. 2 is roughly the same as the traffic proxy method shown in Fig. 1, and includes the following steps.

Step 201: Receive an HTTP request message; this step is roughly the same as step 101, and will not be repeated here.

Step 202: Determine whether the destination port of the TCP connection is a preset whitelist destination port; if yes, execute step 203, if not, execute step 206.

Specifically, the upstream message of the TCP connection to which the request message belongs includes the source IP address, source port, destination IP address, and destination port; when the server transparently transmits the upstream message of the TCP connection, it can parse the upstream message to obtain Go to the destination port included in the uplink message, and determine whether the parsed destination port (that is, the port of the source station that receives the uplink message) is a preset whitelist destination port; it is understandable that it can be configured in the server in advance The destination port that needs to be served is used as the preset whitelist destination port. If it is determined that the destination port belongs to the preset whitelisted destination port, go to step 203; if it is judged that the destination port does not belong to the preset whitelisted destination port, then go to step 206 to forward the request message directly to the next hop instead of Through the agent software for agent acceleration. Through the above method, a filtering is performed through the destination port of the TCP connection to which the request message belongs, so as to reduce the traffic that the proxy software will load.

Step 203: parse the request message to obtain the request information; this step is roughly the same as step 102, and will not be repeated here.

Step 204: Determine whether the requested information meets the preset whitelist rules; if yes, perform step 205; if not, perform step 206; this step is roughly the same as step 103, and will not be repeated here.

Step 205, redirect the request message to the agent software, and send the request information to the agent software; this step is roughly the same as step 104, and will not be repeated here.

Step 206, forward the request message to the next hop; this step is roughly the same as step 105, and will not be repeated here.

It should be noted that the server in this embodiment can be installed with proxy software and used as a proxy server, that is, the proxy server transparently transmits the uplink packets of the TCP connection and parses the received HTTP request packets. The proxy in the proxy server The software mainly performs proxy acceleration and other operations on request messages at the application level. In the example, the upstream traffic of the client is transmitted to our switch (or router) through the office switch (or router), and our switch transmits the upstream traffic to the proxy server, and the proxy server analyzes and judges the request message; After the proxy server redirects the request message to the proxy software in the proxy server and sends the request information to the proxy software in the proxy server, the proxy software obtains the stored request content from the preset storage device, or The request content is obtained from the source site through our switch; the request content obtained by the proxy software is processed by the proxy server, and then routed to the bureau switch via our switch, and then routed by the bureau switch to the client.

Specifically, when the server in this embodiment is used as a proxy server, after the proxy server redirects the request message to the proxy software, it also includes: controlling the proxy software to establish a connection with the source station receiving the uplink message TCP connection, so that the agent software, after determining that the request content corresponding to the request information is not stored in the preset storage device, sends a request to the source station via our switch according to the handshake request message carrying data; And control the proxy software to receive the response message sent by the source station, modify the source address of the response message to the address of the source station, and then the proxy server will process the response message, and route it to the bureau's switch via our switch. It is routed and sent to the client by the central switch.

Alternatively, the proxy software in this embodiment is installed on another server serving as a proxy server, and the proxy software in the other server performs proxy acceleration and other operations on the request message redirected by the server. In the example, the client's upstream traffic is transmitted to our switch through the bureau's switch, and our switch transmits the upstream traffic to server A, and server A analyzes and judges the request message; then, server A rewrites the request message After being directed to the proxy software in another server B (that is, server B as a proxy server), and sending the request information to the proxy software in the other server B, the proxy software in the other server B Perform proxy acceleration, so I won’t go into details here.

In this embodiment, the HTTP request message is received; the request message is parsed to obtain the request information; it is determined whether the request information meets the preset whitelist rules; if so, the request message is redirected to the proxy software, and the request information is sent to Proxy software for the proxy software to obtain the requested content from the preset storage device and send it to the proxy server after determining that the requested content corresponding to the requested information is stored in the preset storage device; if not, forward the request message to the next Jump; Among them, the upstream message of the TCP connection to which the request message belongs passes through the server, and the server records the SYN message header option of the TCP connection. That is to say, after the server transmits the uplink message of the TCP connection, it intercepts the HTTP request message in the TCP connection, parses the request information, and determines whether to respond to the request message according to whether the request information meets the preset whitelist rules. Proxying can effectively intercept insecure, offensive and other requests that are not allowed to proxy, thereby helping to improve the security of traffic proxy. If it is determined to proxy the request message, the request message will be redirected to the proxy software for processing; if the request message is not proxyed, the request message will be directly forwarded to the next hop, that is, the request message will not be processed by the proxy software. The document is processed to filter the traffic to be loaded by the proxy server and reduce the traffic load pressure of the proxy server; in addition, the request message is redirected to the proxy software, and the request information is sent to the proxy software for the proxy software After determining that the request content corresponding to the request information is stored in the preset storage device, the request content is obtained from the preset storage device and sent to the proxy server, which can shorten the time-consuming process of the request and response, and realize the acceleration of the request service.

The second embodiment of the present application relates to a traffic proxy method, which is roughly the same as the first embodiment. The specific process is shown in Figure 3. The steps and implementation details of the traffic proxy method in Figure 3 will be described in detail below. The content is only the implementation details provided for ease of understanding, and is not necessary for the implementation of this solution.

Step 301: Receive an HTTP request message; this step is roughly the same as step 101, and will not be repeated here.

Step 302: parse the request message to obtain the request information; this step is roughly the same as step 102, and will not be repeated here.

Step 303: Determine whether the requested information meets the preset whitelist rules; if yes, go to step 304; if not, go to step 305; this step is roughly the same as step 103, and will not be repeated here.

Step 304: Add a TCP handshake request flag SYN to the request message to obtain a handshake request message carrying data; redirect the handshake request message carrying data to the proxy software, and send the request information to the proxy software.

Specifically, this embodiment provides a specific implementation manner for redirecting the request message to the proxy software. Pre-configure the proxy software of the proxy server to configure the proxy module with the TCP fast open function; in the obtained request message, add the TCP handshake request flag SYN (TCP handshake request flag SYN is a type of TCP connection The flag bit indicates that the connection is established); because the request message itself carries data, after adding the TCP handshake request flag, the result is a handshake request message carrying data; and the handshake request message carrying data is redirected to the proxy software , For the proxy software to confirm that a TCP connection is established with the client sending the uplink message after receiving the handshake request message carrying the data; for the redirection method and the part of the award request information sent to the proxy software, please refer to the steps The description in 104 will not be repeated here.

More specifically, the upstream message of the TCP connection to which the request message belongs passes through the server, and the proxy server records the SYN message header option of the TCP connection; therefore, after adding the TCP handshake request flag SYN to the request message, it can also be executed The following steps are as follows: modify the header options of the request message according to the SYN header options recorded by the server; the final result is a handshake request message carrying data and modifying the header options of the message, so as to make the proxy The software confirms that the message header options of the TCP connection established with the client are the same as the message header options of the TCP connection to which the request message belongs. The client side has no perception of the TCP connection established with the proxy software, and realizes the client Transparent proxy. Among them, for example, the recorded SYN packet header option may be TCP OPTIONS, which represents variable-length optional information, including timestamp (message timestamp), windows scale (window scale factor), and so on.

Because the proxy software is pre-configured with the TCP connection fast opening function, the proxy software can think that the proxy software has established a TCP connection with the client after receiving the redirected handshake request message, thus saving the need to transmit when establishing a TCP connection Time-consuming handshake messages; when the default proxy software has established a TCP connection with the client, it helps to speed up the efficiency of the subsequent data transmission process between the proxy software and the client. After the default proxy software has established a TCP connection with the client, the proxy software also establishes a TCP connection with the source station that receives the uplink message, so that the proxy software can send a request to the source station according to the handshake request message carrying data; when the proxy After the software has established a TCP connection with the client and the source station, it can send multiple requests and receive multiple responses, which shortens the time-consuming process of data transmission; in addition, because the proxy software has established TCP with the client and the source station respectively Connection, so the proxy software can implement a transparent proxy to the client on this basis, making the client unaware of the existence of the proxy software.

Step 305: Forward the request message to the next hop. This step is roughly the same as step 105, and will not be repeated here.

In this embodiment, the proxy software quickly establishes a TCP connection with the client and the source station, which speeds up the efficiency of the data transmission process, and implements a transparent proxy to the client by modifying message options and converting message addresses. Make the client unaware of the existence of agent software.

The third embodiment of the present application relates to a traffic proxy method with proxy software as the execution subject. The specific process is shown in FIG. 4 and includes the following steps 401 to 404.

In this embodiment, as described in the first embodiment, the proxy software can be installed in the server used as a proxy server, and the upstream traffic of the client is transmitted to our switch (or router) through the office switch (or router). The party switch transmits the upstream traffic to the proxy server, and the proxy server analyzes and judges the request message; the proxy server redirects the request message to the proxy software in the proxy server, and sends the request information to the proxy server After the proxy software of the proxy software, the proxy software obtains the stored request content from the preset storage device, or obtains the request content from the source site through our switch; the request content obtained by the proxy software is processed by the proxy server and passed through our The switch is routed to the central switch, and then routed by the central switch to the client; in addition, the proxy software can also be installed on another server acting as a proxy server, and the proxy software in the other server redirects the server Perform proxy acceleration and other operations for the request message of the client, that is, the upstream traffic of the client is transmitted to our switch through the bureau's switch, and our switch transmits the upstream traffic to server A, and server A analyzes and judges the request message; then, After server A redirects the request message to the proxy software of another server B (that is, server B as a proxy server), and sends the request information to the proxy software of the other server B, the other The agent software in server B performs agent acceleration.

Step 401: Receive a redirected HTTP request message and request information obtained by parsing the request message.

Specifically, the proxy software receives the redirected request message from the server and the request information obtained by parsing the request message; before that, the server has determined that the request information obtained by parsing the request message conforms to the preset whitelist rule. In addition, as explained in the second embodiment, the proxy software is pre-configured with the TCP connection quick opening function, and the received request message is a handshake request message carrying data, and the handshake request message is added by the request message with the TCP handshake The request flag SYN is obtained; in this way, after the proxy software receives the handshake request message carrying the data, it confirms that the TCP connection is established with the client sending the uplink message, thereby saving the time-consuming transmission of the handshake message when establishing the TCP connection ; When the default proxy software has established a TCP connection with the client, it helps to speed up the efficiency of the data transmission process between the proxy software and the client. After the default proxy software has established a TCP connection with the client, the proxy software also establishes a TCP connection with the source station that receives the uplink message, so that the proxy software can send a request to the source station according to the handshake request message carrying data; when the proxy After the software has established a TCP connection with the client and the source station, it can send multiple requests and receive multiple responses, which shortens the time-consuming process of data transmission; in addition, because the proxy software has established TCP with the client and the source station respectively Connection, so the proxy software can implement a transparent proxy to the client on this basis, making the client unaware of the existence of the proxy software.

It is understandable that when the proxy software is installed in a server used as a proxy server, the proxy server controls the proxy software to also establish a TCP connection with the source station that receives the uplink message, so that the proxy software can determine whether it is not in the preset storage device. After storing the request content corresponding to the request information, the request is sent to the source station according to the handshake request message carrying the data.

Step 402: Determine whether the request content corresponding to the request information is stored in the preset storage device; if yes, execute step 403; if not, execute step 404.

Step 403: Obtain the requested content from the preset storage device and send it to the proxy server.

Step 404: Send a request according to the request message to the source station that receives the request message.

Specifically, the preset storage device in this embodiment may be a local storage device such as a disk, or a cloud storage device. The preset storage device is used to store content that the agent software has requested from the source site. In the example, the request information received by the proxy software includes: the requested content type is a picture, the requested content name is A (that is, the requested content includes: picture A), and the proxy software determines that "picture A" is stored in the preset storage device, Then the proxy software directly reads "Picture A" from the preset storage device and sends it to the proxy server without having to request "Picture A" from the origin site again.

It is understandable that if the proxy software determines that the requested content corresponding to the requested information is not stored in the preset storage device, the proxy software will request the content requested by the client from the source station according to the redirected request message, and return to the source. The requested content of is sent to the client via the proxy server, and the requested content is cached back to the source in the preset storage device. In the example, the request information received by the proxy software includes: the requested content type is a picture, the requested content name is A (that is, the requested content includes: picture A), and the proxy software determines that "picture A" is not stored in the preset storage device , The proxy software sends a request to the origin site according to the request message, and the content of the request includes "picture A"; after the proxy software requests "picture A" from the origin site, it is sent to the client via the proxy server and is preset "Picture A" is cached in the storage device so that it can be directly obtained from the preset storage device when a request for "Picture A" is received next time. The specific method for the proxy software to send the request message to the source station will not be repeated here.

It should be noted that the proxy software obtains the stored request content from the preset storage device, or obtains the request content from the source site through our switch, which needs to be processed by the proxy server and routed to the office through our switch. The central switch is routed to the client by the central switch. In the example, the proxy server can parse the upstream message of the TCP connection to which the request message belongs, and obtain the upstream message header options, including seq (sequence number), timestamp (message timestamp), windows scale (window scale factor), etc. ; The proxy server can send the request content to the client by responding to the message; when sending the response message, it can make the header option of the response message the same as the parsed upstream message header option, and send the response The source address of the message is modified to the address of the source station, so that after the client receives the response message, it can be considered that the response message is sent from the source station, thus realizing a transparent proxy for the client.

It is understandable that when the proxy software is installed in the server used as a proxy server, the proxy server controls the proxy software to send requests to the source station and receive the response message sent by the source station; the proxy server also controls the proxy software to respond The source address of the message is modified to the address of the source station, and the modified response message is processed by the proxy server.

In this embodiment, the proxy software receives the redirected request message and the request information obtained by parsing the request message, and when determining that the request content corresponding to the request information is stored in the preset storage device, obtains the request from the preset storage device The content is sent to the proxy server, which can shorten the time-consuming process of the request and response, and realize the accelerated service of the request.

The fourth embodiment of the present application relates to a server 50, as shown in FIG. 5, including: a receiving module 501 and a content identification module 502;

The receiving module 501 is configured to receive HTTP request messages;

The content identification module 502 is used to parse the request message to obtain the request information;

The content identification module 502 is also used to determine whether the request information meets the preset whitelist rules; if so, the request message is redirected to the agent software, and the request information is sent to the agent software for the agent software to determine the preset storage After the request content corresponding to the request information is stored in the device, the request content is obtained from the preset storage device and sent to the proxy server; if not, the request message is forwarded to the next hop; where the request message belongs to the TCP connection The upstream message passes through the server, and the server records the SYN message header option of the TCP connection.

In an example, before the content identification module 502 parses the request message, it further includes: judging whether the destination port of the TCP connection is a preset whitelist destination port; if so, parse the request message to obtain the request information; if not, The request message is forwarded to the next hop; among them, the destination port of the TCP connection is obtained by parsing the uplink message.

In one example, the proxy software is pre-configured with a TCP connection quick opening function; the content recognition module 502 redirects the request message to the proxy software, including: adding a TCP handshake request flag SYN to the request message to obtain a handshake request carrying data Message: Redirect the handshake request message carrying data to the proxy software for the proxy software to confirm the establishment of a TCP connection with the client sending the request message after receiving the handshake request message carrying the data.

In an example, the content recognition module 502 adds the TCP handshake request flag SYN to the request message, and before the handshake request message carrying data is obtained, the content recognition module 502 is also used to: modify the header options of the SYN message The header options of the request message.

In an example, the server is the proxy server, and the proxy server is installed with the proxy software; after the content identification module 502 redirects the request message to the proxy software, the content identification module 502 is also used for : Control the proxy software to establish a TCP connection with the source station that receives the uplink message, so that the proxy software determines that the request content corresponding to the request information is not stored in the preset storage device, and then according to the carrying The data handshake request message sends a request to the source station.

In an example, the content recognition module 502 controls the proxy software to establish a TCP connection with the source station that receives the uplink message, and the proxy software determines that the request corresponding to the request information is not stored in the preset storage device After the content, the content recognition module 502 is further used to: control the proxy software to send a request to the source station according to the handshake request message carrying data, and receive a response message sent by the source station; control the proxy The software modifies the source address of the response message to the address of the source station for the proxy server to send the modified response message to the client.

It is not difficult to find that this embodiment is an embodiment of a device corresponding to the first embodiment or the second embodiment. This embodiment can be implemented in cooperation with the first embodiment or the second embodiment. The related technical details mentioned in the second embodiment are still valid in this embodiment, and in order to reduce repetition, they will not be repeated here. Correspondingly, the related technical details mentioned in this embodiment can also be applied in the first embodiment or the second embodiment.

It is worth mentioning that the modules involved in this embodiment are all logical modules. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or multiple physical units. The combination of units is realized. In addition, in order to highlight the innovative part of the present application, this embodiment does not introduce a unit that is not closely related to solving the technical problem proposed by the present application, but this does not indicate that there are no other units in this embodiment.

The fifth embodiment of the present application relates to a server. As shown in FIG. 6, it includes: at least one processor 601; and a memory 602 communicatively connected to the at least one processor 601; The instructions executed by the processor 601 are executed by the at least one processor 601, so that the at least one processor 601 can execute the foregoing traffic proxy method.

The memory 602 and the processor 601 are connected in a bus manner. The bus may include any number of interconnected buses and bridges. The bus connects one or more processors and various circuits of the memory 602 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, power management circuits, etc., which are all well-known in the art, and therefore, no further description will be given herein. The bus interface provides an interface between the bus and the transceiver. The transceiver may be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on the transmission medium. The data processed by the processor 601 is transmitted on the wireless medium through the antenna. In this embodiment, the antenna also receives the data and transmits the data to the processor 601.

The processor 601 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. The memory 602 may be used to store data used by the processor 601 when performing operations.

The sixth embodiment of the present application relates to a computer storage medium, which stores a computer program. When the computer program is executed by the processor, the foregoing embodiment of the traffic proxy method is implemented.

That is, those skilled in the art can understand that all or part of the steps in the method of the foregoing embodiments can be implemented by instructing relevant hardware through a program. The program is stored in a storage medium and includes several instructions to enable a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods in the embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes. .

A person of ordinary skill in the art can understand that the above-mentioned embodiments are specific embodiments for realizing the present application, and in practical applications, various changes can be made to them in form and details without departing from the spirit and spirit of the present application. Scope.

Claims

A traffic proxy method, including:

Receive HTTP request message;

Parse the request message to obtain request information;

Judging whether the requested information complies with preset whitelist rules;

If yes, redirect the request message to the agent software, and send the request information to the agent software, so that the agent software can determine that the requested content corresponding to the request information is stored in a preset storage device Afterwards, obtain the requested content from the preset storage device and send it to the proxy server;

If not, forward the request message to the next hop;

Wherein, the uplink message of the TCP connection to which the request message belongs passes through a server, and the server records the SYN message header option of the TCP connection.
The traffic proxy method according to claim 1, wherein before the parsing of the request message, the method further comprises:

Judging whether the destination port of the TCP connection is a preset whitelist destination port;

If yes, parse the request message to obtain request information;

If not, forward the request message to the next hop;

Wherein, the destination port of the TCP connection is obtained by parsing the uplink packet.
The traffic proxy method according to claim 1, wherein the proxy software is pre-configured with a TCP connection quick opening function; and the redirecting the request message to the proxy software includes:

Adding a TCP handshake request flag SYN to the request message to obtain a handshake request message carrying data;

Redirect the handshake request message carrying data to the proxy software, so that the proxy software, after receiving the handshake request message carrying data, confirms that it has established a connection with the client that sent the request message TCP connection.
The traffic proxy method according to claim 3, wherein adding a TCP handshake request flag SYN to the request message, before obtaining a handshake request message carrying data, further comprises:

Modify the message header option of the request message according to the recorded header option of the SYN message.
The traffic proxy method according to claim 3, wherein the server is the proxy server, and the proxy server is installed with the proxy software; after redirecting the request message to the proxy software, the method further comprises:

Control the proxy software to establish a TCP connection with the source station that receives the uplink message, so that the proxy software determines that the request content corresponding to the request information is not stored in the preset storage device, and then according to the carried data The handshake request message sends a request to the source station.
The traffic proxy method according to claim 5, wherein a TCP connection is established between the control proxy software and the source station that receives the uplink message, and the proxy software determines that no data is stored in the preset storage device. After the request content corresponding to the request information, it also includes:

Control the proxy software to send a request to the source station according to the handshake request message carrying data.
The traffic proxy method according to claim 6, wherein after the controlling the proxy software sends a request to the source station according to the handshake request message carrying data, the method further comprises:

Controlling the proxy software to receive the response message sent by the source station;

Control the proxy software to modify the source address of the response message to the address of the source station, so that the proxy server can send the modified response message to the client.
A server, including: a receiving module and a content recognition module;

The receiving module is used to receive HTTP request messages;

The content identification module is used to parse the request message to obtain request information;

The content identification module is also used to determine whether the request information complies with preset whitelist rules; if so, redirect the request message to the proxy software, and send the request information to the proxy software, After determining that the request content corresponding to the request information is stored in the preset storage device, the proxy software obtains the request content from the preset storage device and sends it to the proxy server;

If not, forward the request message to the next hop;

Wherein, the uplink message of the TCP connection to which the request message belongs passes through a server, and the server records the SYN message header option of the TCP connection.
The server according to claim 8, wherein, before the content identification module parses the request message, the content identification module is further configured to:

Judging whether the destination port of the TCP connection is a preset whitelist destination port;

If yes, parse the request message to obtain request information;

If not, forward the request message to the next hop;

Wherein, the destination port of the TCP connection is obtained by parsing the uplink packet.
The server according to claim 8, wherein the proxy software is pre-configured with a TCP connection quick opening function; and the content identification module redirects the request message to the proxy software, comprising:

Adding a TCP handshake request flag SYN to the request message to obtain a handshake request message carrying data;

Redirect the handshake request message carrying data to the proxy software, so that the proxy software, after receiving the handshake request message carrying data, confirms that it has established a connection with the client that sent the request message TCP connection.
The server according to claim 10, wherein the content identification module adds a TCP handshake request flag SYN to the request message, and before the handshake request message carrying data is obtained, the content identification module is further configured to:

Modify the message header option of the request message according to the recorded header option of the SYN message.
The server according to claim 10, wherein the server is the proxy server, and the proxy server is installed with the proxy software; after the content recognition module redirects the request message to the proxy software, The content recognition module is also used for:

Control the proxy software to establish a TCP connection with the source station that receives the uplink message, so that the proxy software determines that the request content corresponding to the request information is not stored in the preset storage device, and then according to the carried data The handshake request message sends a request to the source station.
The server according to claim 12, wherein the content recognition module controls the proxy software to establish a TCP connection with the source station that receives the uplink message, and the proxy software determines that there is no After the request content corresponding to the request information, the content identification module is further configured to:

Control the proxy software to send a request to the source station according to the handshake request message carrying data.
The server according to claim 13, wherein after said controlling said agent software sends a request to said source station according to said handshake request message carrying data, the method further comprises:

Controlling the proxy software to receive the response message sent by the source station;

Control the proxy software to modify the source address of the response message to the address of the source station, so that the proxy server can send the modified response message to the client.
A server that includes:

At least one processor; and,

A memory communicatively connected with the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can execute:

Receive HTTP request message;

Parse the request message to obtain request information;

Judging whether the requested information complies with preset whitelist rules;

If yes, redirect the request message to the agent software, and send the request information to the agent software, so that the agent software can determine that the requested content corresponding to the request information is stored in a preset storage device Afterwards, obtain the requested content from the preset storage device and send it to the proxy server;

If not, forward the request message to the next hop;

Wherein, the uplink message of the TCP connection to which the request message belongs passes through a server, and the server records the SYN message header option of the TCP connection.
The server according to claim 15, wherein, before the parsing of the request message, the at least one processor is further capable of executing:

Judging whether the destination port of the TCP connection is a preset whitelist destination port;

If yes, parse the request message to obtain request information;

If not, forward the request message to the next hop;

Wherein, the destination port of the TCP connection is obtained by parsing the uplink packet.
The server according to claim 15, wherein the proxy software is pre-configured with a TCP connection quick opening function; the at least one processor is also capable of executing: the redirecting the request message to the proxy software includes:

Adding a TCP handshake request flag SYN to the request message to obtain a handshake request message carrying data;

Redirect the handshake request message carrying data to the proxy software, so that the proxy software, after receiving the handshake request message carrying data, confirms that it has established a connection with the client that sent the request message TCP connection.
The server according to claim 17, wherein the TCP handshake request flag SYN is added to the request message, and before the handshake request message carrying data is obtained, the at least one processor can further execute:

Modify the message header option of the request message according to the recorded header option of the SYN message.
The server according to claim 17, wherein the server is the proxy server, and the proxy server is installed with the proxy software; after the request message is redirected to the proxy software, the at least one processing The device can also execute:

Control the proxy software to establish a TCP connection with the source station that receives the uplink message, so that the proxy software determines that the request content corresponding to the request information is not stored in the preset storage device, and then according to the carried data The handshake request message sends a request to the source station.
A computer storage medium storing a computer program, which, when executed by a processor, implements the traffic proxy method according to any one of claims 1-6.