CN100423513C - A Merging Method of TCP Connection - Google Patents

Abstract

The invention discloses a method for merging TCP connections, which is characterized in that it comprises: A. The first and second slave devices respectively send a TCP connection establishment request to the master device, and the master device immediately sends a confirmation message to the first and second slave devices in a spoofing manner. The second slave equipment, under the condition that the master equipment does not start the TCP processing flow, the first and second slave equipment respectively establish TCP connections TCP I and TCP II with the master equipment; B. set up the two TCP connections TCP I on the master equipment , the corresponding relationship of TCP II; C. The first and second slave devices perform data transmission through forwarding by the master device. By adopting the merging method of TCP connections of the present invention, since the intermediate nodes do not need to deal with complex TCP protocols and state machines, the processing load of the intermediate nodes is greatly reduced. Network processors or hardware logic can be used to achieve high-speed forwarding, and more than two TCP connections can be combined to achieve end-to-end reliable transmission.

Description

A Merging Method of TCP Connection

technical field

The invention relates to the technical field of computer networks, in particular to a processing method for a TCP connection.

technical background

The Transmission Control Protocol (TCP) is a transport layer protocol in the TCP/IP protocol stack. It provides reliable data stream sending and virtual connection services for applications through sequence confirmation and packet retransmission mechanisms. When the quality of service at the network layer cannot meet the requirements, it can be improved through the TCP service to meet the requirements of the upper layer. In the network, the computer must ensure that the software program on the destination machine can obtain the data packet from the source address machine, and the source computer can receive the correct reply. To this end, TCP establishes a connection or virtual circuit between endpoints for reliable communication , and the TCP process can send and receive packets at the same time. TCP guarantees reliability through connection-oriented, end-to-end reliable datagram delivery. In addition, TCP provides effective flow control. When the confirmation response is returned to the sender, the receiving TCP process will indicate that it can receive and ensure that the buffer will not overflow the information.

Most network services such as file transfer services, remote login services, WEB services, etc. are based on Transmission Control Protocol (TCP) connections. When two computers communicate data through the network, a TCP connection is also required.

However, in TCP applications, such a situation is often encountered. Both computers are located in a private network, and they access the Internet through a network address translation device. server for transfer. As shown in Figure 1, first, computers A and B respectively establish TCP connections with server C, and server C first receives data from one TCP connection TCP1, and then sends it to another TCP connection TCP2, so that the data can reach the other computer . Monitor and establish two TCP connections on the server, and then the server forwards another connection received from one TCP connection.

Two TCP connections need to be established on the server. Since TCP is a relatively complex protocol, the establishment and maintenance of TCP needs to consume a lot of computer resources, so the number and speed of TCP connection establishment are usually indicators to measure the processing capacity of a server.

Another disadvantage is that when the server forwards TCP data, theoretically, there is a possibility that the data may be mistakenly rewritten, and end-to-end reliability in the true sense cannot be achieved.

Contents of the invention

In view of this, the technical problem to be solved by the present invention is to provide a method for processing a TCP connection so as to realize efficient and reliable end-to-end data transmission.

The present invention provides a method for merging TCP connections. The first and second slave devices are pre-registered to the master device through the TCP connection. The method includes:

A. The master device notifies the first and second slave devices to establish a TCP connection, and after receiving the first and second slave devices to send a TCP connection request to the master device respectively, responds to the request and sends an acknowledgment message, and communicates with the first and second slave devices respectively The second slave device establishes TCP connection TCP I, TCP II;

B. set up the mapping relationship of source IP address, source port, destination IP address, destination port between these two TCP connection TCP I, TCP II on main equipment;

C. The master device forwards the data from the first and second slave devices to the second and first slave devices according to the mapping relationship.

The acknowledgment message sent by the master device in step A is a pseudo-acknowledgment message, so that the slave device continues to perform subsequent steps of establishing a TCP connection after receiving the acknowledgment message.

The TCP connection is identified by a source IP address, a source port address, a destination IP address, and a destination port address.

After the TCP connection TCP I and TCP II are established, the master device sends a connection establishment success message to the first and second slave devices through the TCP connection channel during registration, and then the master device enters the data forwarding state.

More suitably, wherein step C comprises:

D. The master device transforms the source IP address, source port address and destination IP address and destination port address of the received packet;

E. According to the sending sequence number difference and confirmation sequence number difference between TCP I and TCP II, adjust the sending sequence number and confirmation sequence number of the data packet;

F. The master device forwards data.

More suitably, wherein step D comprises:

Replace the source IP address and source port address of the data packet received from TCP I with the IP address and port address of the master device side corresponding to TCP II, and replace the destination IP address and destination port address of the data packet with TCP II Recorded IP address and port address of the second slave device side;

Replace the source IP address and source port address of the data packet received from TCP II with the IP address and port address of the corresponding master device side of TCP I, and replace the destination IP address and destination port address of the data packet with TCP I Record the IP address and port address of the first slave device.

When packets are changed, IP and TCP checksums need to be recalculated.

When TCP II terminates, the master device deletes the TCP I connection and deletes the relevant forwarding records at the same time. When TCP II terminates, the master device deletes the TCP II connection and deletes the relevant forwarding records at the same time.

A method for merging TCP connections provided by the present invention uses a third device to forward data to realize data exchange between two devices, and the method includes:

The first and second devices are pre-registered to the third device through a TCP connection;

The third device responds to the request for establishing a TCP connection sent by the first and second devices, sends confirmation messages to the first and second devices that send the TCP connection request in a spoofing manner, and communicates with the first and second devices respectively. , the second device establishes a pseudo-TCP connection;

Establish the mapping relationship between source IP address, source port, destination IP address and destination port between two pseudo-TCP connections;

The third device forwards data for the first and second devices corresponding to the two pseudo-TCP connections according to the mapping relationship.

More suitably, the third device transforms the source IP address, source port and destination IP address and destination port of the received data packet;

The third device adjusts the sending sequence number and the acknowledgment sequence number of the data packet according to the difference between the sending sequence numbers and the confirmation sequence numbers of the two pseudo-TCP connections.

According to the method of the present invention, two TCP connections are respectively initiated from the slave device to the master device, and the slave device is not limited by the address conversion device and the firewall to establish a connection with the master device, which is suitable for various networking environments. The master device sends false confirmation information in a timely manner to respond to the TCP establishment request of the slave device, so that the TCP connection can be established smoothly, and then the data between the slave devices is forwarded. processing load. Network processors or hardware logic can be used to achieve high-speed forwarding, and more than two TCP connections can be combined to achieve end-to-end reliable transmission.

Description of drawings

FIG. 1 is a schematic diagram of an existing data transmission based on a TCP connection;

Fig. 2 is a schematic diagram of the working principle for illustrating the method provided by the present invention;

Fig. 3 is a flow chart of the method according to the present invention;

Fig. 4 is a schematic diagram of the working principle according to an embodiment of the present invention.

Detailed ways

The principle of the present invention will be described below in conjunction with the accompanying drawings. With reference to Fig. 2 and Fig. 3, the merging process of TCP connection according to the present invention is as follows:

1. The slave devices I and II register to the master device through the TCP connection, and the master device notifies the slave devices I and II to initiate connection establishment.

2. The slave devices I and II send a TCP connection establishment request (TCP SYN) to the master device respectively, and the master device sends a false acknowledgment (SYN ACK) message to the slave devices I and II respectively, but the master device does not actually start TCP at this time. The purpose of the processing flow is to coax the slave devices I and II into completing the TCP establishment process, so that the slave devices I and II continue to perform subsequent steps of establishing a TCP connection after receiving the confirmation message.

3. Establish the corresponding relationship between the two TCP connections on the master device, that is, establish a mapping relationship between the source IP, source port, destination IP, and destination port of the two TCP connections.

4. After the two TCP connections are established, the master device sends a notification message that the connection is successfully established to the slave devices I and II. Since the master device is a pseudo-TCP connection, there is no real guarantee that the sent message can be sent to the peer end accurately and reliably. , so the successful sending message is sent through the TCP connection channel during registration. Then the master device enters the data forwarding state.

5. Data is normally sent between slave devices I and II, and the master device forwards data from slave devices I and II. See the description below for the forwarding process.

6. If one TCP is terminated, the master device will delete another TCP connection and delete the relevant forwarding records at the same time.

The data forwarding process on the master device is as follows:

As shown in Figure 2, suppose a piece of data is sent from device I to device II. The TCP connection between the slave device I and the master device is marked as TCP I, and the TCP connection between the slave device II and the master device is marked as TCP II.

After receiving the data sent from TCP I by slave device I, the master device finds another TCP II connection information corresponding to slave device II, and replaces the source IP and source port of the data packet with the one on the master device side corresponding to TCP II. IP and port, replace the destination IP and port of the data packet with the IP and port of the slave device II recorded by TCP II.

Record the sequence number difference between the initial transmission and confirmation sequence numbers of the two TCP connections, adjust the TCP sequence number and check code, and detect the transmission and confirmation sequence numbers of the two TCP connections. If there is a difference, it needs to be adjusted. At the same time Recalculate IP and TCP checksums accordingly. For example, if the sending serial number of TCP I is smaller than the serial number of TCP II by N, and the confirmation serial number is smaller than M, then the sending and confirmation serial numbers of the data packet are added N and M respectively.

Afterwards, the master device forwards the packet.

The processing of the data packet sent from the slave device II to the slave device I is similar to the above-mentioned process, and will not be described here.

Example

The following uses an example of an SSL application to illustrate in detail how to realize the merging of two TCP connections.

As shown in Figure 4, PC-B is a data server. Computer PC-A wants to access the resources of computer PC-B. Since PC-A and PC-B are not directly connected to the Internet, they can only be accessed through the Internet. Therefore, for safety, Use SSL to access, but since PC-A and PC-B are located in the private network, they access the Internet through address translation equipment, and there is a firewall device at the exit, so an SSL connection cannot be directly established between PC-A and PC-B , need to transfer through a server SERVER-C. The usual solution at present is to directly establish two TCP connections with SERVER-C, and then receive data from one connection and send it to the other connection. This method requires the SERVER-C server to maintain two complete TCP connections. The number and speed of users are very limited, but with the present invention, the server SERVER-C does not need to maintain the TCP connection, and only needs to do a simple forwarding, and the establishment speed, the number of access users, and the forwarding speed are all much higher . Let's explain the specific working process

Assuming that the IP addresses corresponding to PC-A, PC-B, and SERVER-C are IPA, IPB, and IPC respectively, the basic working principles are as follows:

First, PC-A and PC-B first log in to the server SERVER-C and request to establish a connection relationship between PC-A and PC-B. SERVER-C notifies PC-A and PC-B to initiate TCP establishment to SERVER-C. The ports are PORTA, PORTB, and PORTC. In order to facilitate SERVER-C to identify the two connections that need to be merged, a unique connection ID can be sent to PC-A and PC-B at the same time.

Secondly, PC-A and PC-B respectively initiate TCP SYN to start the three-way handshake of TCP establishment, SERVER-C performs TCP spoofing, responds to TCP SYNACK, and two TCP connections are established.

At this time, PC-A and PC-B can send their own connection identifiers to SERVER-C, and SERVER-C establishes a forwarding relationship between two TCP connections according to the connection identifiers.

Then, SERVER-C notifies PC-A and PC-B that the TCP connections corresponding to the connection identifiers are merged successfully, and SERVER-C enters the forwarding state, and no longer interprets the data content of the two connections.

Afterwards, PC-A can initiate the SSL establishment process to PC-B. At this time, PC-APC-B does not feel any changes in the middle, just like PC-A and PC-B directly establish a TCP connection, even if the server SERVER-C does not support SSL and is not affected in the slightest.

Once the SSL establishment is complete, secure data transmission can begin.

The data forwarding process of SERVER-C is as follows:

(1) SERVER-C receives the data packet sent by PC-A, assuming that the sequence number of TCPA is N greater than that of TCPB, and confirms that the sequence number is greater than M. Then replace the source IPA and source port PORTA of the data packet with IPC and PORTC, and replace the destination IPC and destination port PORTC in the data packet with IPB and PORTB.

(2) SERVER-C adjusts the sending and confirmation sequence numbers to be sequence number-N and sequence number-M respectively, and the modulus is the maximum number of TCP sequence numbers.

(3) Send data.

If the present invention is not used, SERVER-C must maintain two more complete TCP connections, first receive data flow from one TCP connection, and then write to another TCP connection, which consumes much more resources of SERVER-C.

The above-mentioned embodiments are exemplary embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the scope of the claims of the present invention.

Claims (10)

1. A method for merging TCP connections, characterized in that the first and second slave devices are pre-registered to the master device through the TCP connection, the method comprising: A. The master device notifies the first and second slave devices to establish a TCP connection, and after receiving the first and second slave devices respectively send a TCP connection establishment request to the master device, it responds to the request and sends a false confirmation message to continue to establish a TCP connection next steps of After the first and second slave devices receive the false confirmation message, the master device establishes TCP connections TCP I and TCP II with the first and second slave devices respectively; B. set up the mapping relationship of source IP address, source port, destination IP address, destination port between these two TCP connection TCP I, TCP II on main equipment; C. The master device forwards the data from the first and second slave devices to the second and first slave devices respectively according to the mapping relationship. 2. the merging method of TCP connection as claimed in claim 1, is characterized in that, described TCP connection is identified by source IP address, source port, destination IP address, destination port. 3. the merging method of TCP connection as claimed in claim 1, it is characterized in that, after TCP connects TCPI, TCP II to set up, main equipment sends respectively connection establishment success message to first, second from the TCP connection channel when registering device, and then the master device enters a data forwarding state. 4. the merging method of TCP connection as claimed in claim 1, is characterized in that, wherein step C comprises: D. The master device transforms the source IP address, source port and destination IP address and destination port of the received data packet; E. According to the sending sequence number difference and confirmation sequence number difference between TCP I and TCP II, adjust the sending sequence number and confirmation sequence number of the data packet; F. The master device forwards data. 5. the merging method of TCP connection as claimed in claim 4, is characterized in that, wherein step D comprises: Replace the source IP address and source port of the data packet received from TCP I with the IP address and port of the master device side corresponding to TCP II, and replace the destination IP address and destination port of the data packet with the first IP address and destination port of the TCP II record. 2. The IP address and port of the slave device; Change the source IP address and source port of the data packet received from TCP II into the IP address and port of the master device side corresponding to TCP I, and replace the destination IP address and destination port of the data packet with the first TCP I record 1. The IP address and port of the slave device. 6. The merging method of TCP connection as claimed in claim 5, is characterized in that, after data packet is changed, need to recalculate IP and TCP checksum. 7. The merging method of TCP connection as claimed in claim 1 or 5, it is characterized in that, when TCPI terminates, main equipment deletes TCP II connection, deletes relevant forwarding record simultaneously; When TCP II terminates, main equipment deletes TCP I connection , and delete related forwarding records at the same time. 8. A method for merging TCP connections, characterized in that, forwarding data through a third device to realize data exchange between two devices, the method comprising: The first and second devices are pre-registered to the third device through a TCP connection; The third device responds to the request for establishing a TCP connection sent by the first and second devices, sends confirmation messages to the first and second devices that send the TCP connection request in a spoofing manner, and communicates with the first and second devices respectively. , the second device establishes a pseudo-TCP connection; Establish the mapping relationship between source IP address, source port, destination IP address and destination port between two pseudo-TCP connections; The third device forwards data for the first and second devices corresponding to the two pseudo-TCP connections according to the mapping relationship. 9. The merging method of TCP connection as claimed in claim 8, is characterized in that, described the 3rd device transforms the source IP address and source port and destination IP address and destination port of the received packet; The third device adjusts the sending sequence number and the acknowledgment sequence number of the data packet according to the difference between the sending sequence numbers and the confirmation sequence numbers of the two pseudo-TCP connections. 10. The merging method of TCP connection as claimed in claim 9, is characterized in that, wherein said IP address and port transformation comprise: The source IP address and source port address of the data packet received from one of the pseudo-TCP connections are replaced with the IP address and port address of the third device side corresponding to another pseudo-TCP connection, and the destination IP address of the data packet is The address and destination port are replaced with the IP address and port of the device corresponding to another fake TCP connection.

Images