A method for implementing UDP port multiplexing based on Netfilter

Abstract

The invention discloses a method for realizing UDP port multiplexing based on Netfilter, belonging to the technical field of network communication. A server allocates a plurality of UDP ports for data transmission, a UDP port opened by a firewall is S, Netfilter sets detection points at a plurality of positions of the whole network process, and registers a hook function at the detection point for processing. Netfilter modifies a plurality of UDP data message source ports sent by the server to the UDP port S opened by the firewall through the hook function set in the server, and parses the data sent back to the UDP port S of the server by the client, and converts the destination port thereof to the UDP port originally corresponding to the server. The invention greatly reduces the number of UDP ports opened to the outside by the firewall of the media server, improves the security, and saves the operation and maintenance cost; and without changing the existing media server solution, the server is provided with the ability to transmit media with a small number of ports, thereby improving the deployment adaptability of the media server in different customer environments.

Description

Technical Field

[0001] The patent of this invention belongs to the field of network communication technology, and specifically relates to a method for realizing UDP port multiplexing based on Netfilter. Background Art

[0002] UDP is the abbreviation of User Datagram Protocol. Its Chinese name is User Datagram Protocol. It is a connectionless transport layer protocol in the OSI (Open System Interconnection) reference model, providing simple transaction-oriented unreliable information transmission services. IETF RFC 768 is the official specification of UDP. The protocol number of UDP in IP packets is 17.

[0003] The UDP protocol is used to process data packets like the TCP protocol. In the OSI model, both are located in the transport layer, which is the upper layer of the IP protocol. UDP has the disadvantages of not providing packet grouping, assembly, and ordering of data packets. In other words, after the message is sent, it is impossible to know whether it has arrived safely and completely. UDP is used to support network applications that need to transmit data between computers. Many client / server network applications, including network video conferencing systems, need to use the UDP protocol. When the emphasis is on transmission performance rather than transmission integrity, such as audio and multimedia applications, UDP is the best choice. UDP is also a good choice when the data transmission time is so short that the previous connection process becomes the main body of the entire traffic.

[0004] In the field of video conferencing, media servers need to transmit audio and video data through UDP. Generally, a combination of RTP and RTCP protocols is used to achieve transmission and control. Each media channel needs to use 2 UDP ports, that is, one channel of audio and video requires 4 UDP ports. A meeting with dozens of people requires hundreds of server UDP ports. In order to support the video conferencing media server function, it is generally necessary to open hundreds to thousands of UDP ports on the network firewall according to the user scale. However, if the firewall opens too many ports, it is easy to be scanned and attacked, and the network operation and maintenance is difficult.

[0005] To address the problem of too many open ports, some solutions are to add firewall devices and isolate the video conferencing service from other services. This undoubtedly increases user deployment and subsequent maintenance costs. When the customer environment network is restricted, the firewall can often only open a few ports in a directional manner. In addition, the use of ports can be reduced by improving the media server implementation plan. However, for existing mature video conferencing media servers, it is difficult and labor-intensive to directly modify the implementation plan, and many existing products cannot be modified. Summary of the invention

[0006] The purpose of the present invention is to solve the problems mentioned in the background technology and provide a method for realizing UDP port multiplexing based on Netfilter, which converts data packets that a media server needs to transmit on multiple UDP ports into a single fixed UDP port.

[0007] In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

[0008] A method for realizing UDP port multiplexing based on Netfilter, wherein a server allocates several UDP ports for data transmission, and a UDP port opened by a firewall is S. Netfilter sets detection points at several positions of the entire network process, and registers hook functions at the detection points for processing. Netfilter modifies UDP source ports A to N of data packets sent by the server to the client to firewall UDP port S through the hook function set at the server, and parses data sent back to the server UDP port S by the client, and converts its destination port to the originally corresponding UDP port of the server.

[0009] Preferably, the hook function set by Netfilter on the server is set in the protocol stack of the kernel layer.

[0010] Preferably, during the media negotiation phase of a video conference call, the SDP data of both parties is parsed, and the hook function uses the parsed UDP port to be used for data transmission and the synchronization source contained in the data message sent by the client to the server, namely the client SSRC, as a mapping.

[0011] Based on this preferred solution, a basis can be provided for subsequently matching the data destination port according to the client SSRC.

[0012] Preferably, the client sends back data to the server UDP port S, and the hook function parses the client SSRC corresponding to the data, and matches it with several UDP ports allocated by the server corresponding to the previously recorded client SSRC, thereby modifying the destination port of the data to the corresponding UDP port.

[0013] Based on this preferred solution, the data packet sent back by the client can be sent to the correct destination UDP port.

[0014] Preferably, when the server application session ends, the UDP port address and client SSRC information recorded by the hook function are cleared.

[0015] Based on this preferred solution, system resources can be saved without affecting the next practical use.

[0016] Preferably, the firewall opens two UDP ports, one for transmitting RTP data and the other for transmitting RTCP data.

[0017] Based on this preferred solution, the entire system only needs to set up two UDP ports to achieve data transmission, which greatly reduces the difficulty of operation and maintenance.

[0018] The beneficial effects of the present invention are:

[0019] 1. The present invention uses the hook function of Netfilter to uniformly modify the UDP port originally assigned to the data sent by the server to a fixed UDP port opened by the firewall, and the hook function can also send the data sent back by the client to the UDP port originally assigned by the server, which greatly reduces the number of ports opened by the firewall, not only reduces the difficulty of network operation and maintenance, but also solves the problem that the firewall can only open a few ports in a directional manner when the customer environment network is limited; and avoids too many open ports on the firewall that are easy to be scanned and attacked, thereby improving the security of network operation and maintenance.

[0020] 2. The present invention enables the server to have a small number of ports to transmit media without changing the existing media server solution, thereby improving the adaptability of the media server to be deployed in different customer environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a schematic diagram of the Netfilter framework;

[0022] Figure 2 It is a schematic diagram of the framework of the port data conversion scheme;

[0023] Figure 3 It is a detailed flow chart of port conversion;

[0024] Figure 4 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0025] The embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings.

[0026] It should be noted that the terms such as "upper", "lower", "left", "right", "front", "back", etc. cited in the invention are only for the convenience of description and are not used to limit the scope of implementation of the present invention. Changes or adjustments in their relative relationships should be regarded as the scope of implementation of the present invention without substantially changing the technical content.

[0027] The video conference media server uses RTP / RTCP protocol to transmit media data based on UDP. The present invention proposes a method for realizing UDP port multiplexing based on Netfilter. Without modifying the media service application, the multi-UDP port data of the media service is converted into single-port data at the IP layer through the Netfilter framework of the Linux system. The firewall can open one port for RTP and RTCP respectively to complete data transmission.

[0028] like Figure 1 As shown, port conversion is based on the Linux Netfilter framework. Netfilter is a subsystem of the Linux kernel, which provides a series of hook function (also known as "hook" function) management interfaces, adding some points for user operation to the data packets arriving at the local machine or the data packets forwarded by the local machine. The kernel module can complete various functions by registering hooks, also known as "hooks". Datagrams can be filtered, address converted, processed, etc. through programs. The present invention is Figure 1 The positions marked 1 and 2 process the UDP data. The position marked 1 processes the data received by the server, and the position marked 2 processes the data sent by the server.

[0029] The RTP / RTCP protocol has a synchronization source identifier, namely the SSRC identifier, which can distinguish data from different channels. The synchronization source here refers to the source that generates the media stream. It is identified by a 32-bit SSRC identifier in the RTP header and does not depend on the network address. Two synchronization sources participating in the same video conference cannot have the same SSRC. The receiver will distinguish different sources based on the SSRC identifier and group the RTP messages.

[0030] During the media negotiation phase of a video conference call, the following information can be obtained by parsing the SDP data of both parties:

[0031] 1. The UDP port X that the server will use for data transmission, and the SSRC1 contained in the datagram sent by the server;

[0032] 2. Port Y that the client will use, and SSRC2 contained in the datagram sent by the client to the server;

[0033] The server application modifies the UDP port X (note that UDP port X is only an example here, and can actually be any one of several ports A~N) assigned by the server in the SDP data sent to the client to the UDP port S specified by the firewall, so that the client gets the information that the server uses port S, so that the destination port of the data subsequently sent by the client is port S; at the same time, the application passes the UDP port X assigned by the server and the SSRC2 contained in the corresponding data message sent by the client to the hook function, and X and SSRC2 are used as a mapping to provide a basis for the subsequent conversion of the destination port of the data sent back by the client; it should be noted that the SSRC1 contained in the data message sent by the server and the port Y to be used by the client are both useless information and are not processed by the hook function.

[0034] The specific process is as follows Figure 2 As shown, the port mapping information (ie, the server's real UDP port and the client's SSRC2) is passed to the conversion program in the kernel through the UDP port conversion control program.

[0035] like Figure 3 , 4 As shown in the figure, the specific process of port conversion is as follows: Assume that the media service uses UDP port A (note that port A is used as an example here, and it can actually be any port from ports A to N) to send and receive RTP data, and the UDP port opened by the firewall is S. The media service program normally allocates and uses UDP port A. After the application layer sends UDP data, Figure 1 At mark point 2 in the figure, the conversion program modifies the data of the UDP data packet source port A to the source port S according to the port mapping information, and records the SSRC of the client to which the data packet is to be sent. Then, the modified data packet is sent to the client, and the service port of the UDP data packet received by the client is S.

[0036] When the client sends data to the server, the server port number is S. The server protocol stack receives a UDP data packet with a destination port of S. It first parses out the internal SSRC and finds the mapped server real UDP port based on the previously recorded SSRC. Figure 1 Change the UDP destination port to A at point 1 in the figure so that the server application can receive the client's data packets normally.

[0037] When the call ends, the port conversion control program clears the mapping information.

[0038] Through the above operations, the server can use a single UDP port to transmit RTP data. RTCP data is processed using the same process. Finally, the firewall opens one port for RTP and one port for RTCP. The present invention greatly reduces the number of UDP ports opened to the outside by the media server firewall, improves security, and saves operation and maintenance costs; and without changing the existing media server solution, the server has the ability to transmit media with a small number of ports, thereby improving the adaptability of the media server to be deployed in different customer environments.

[0039] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A method for realizing UDP port multiplexing based on Netfilter, wherein a server allocates several UDP ports for data transmission, and the UDP port opened by the firewall is S. Netfilter sets detection points at several positions of the entire network flow, and registers hook functions at the detection points for processing, wherein the method is characterized in that: Netfilter modifies the source ports of several UDP datagrams sent from the server to the client to the firewall UDP port S through the hook function set in the server, and parses the data sent back to the server UDP port S by the client, and converts its destination port to the UDP port originally corresponding to the server; the hook function set by Netfilter in the server is set in the protocol stack of the kernel layer; in the media negotiation stage of the video conference call, the server parses the SDP data of the two parties in the call, and the hook function uses the UDP port to be used for data transmission obtained by the parsing, and the synchronization source contained in the data message sent by the client to the server, namely the client SSRC as a mapping; The client sends back data to the server UDP port S, and the hook function parses the client SSRC corresponding to the data and compares it with several UDP ports allocated by the server corresponding to the previously recorded client SSRC, so as to modify the destination port of the data to the corresponding UDP port; when the server application session ends, the UDP port and client SSRC information recorded by the hook function are cleared.

2. A method for realizing UDP port multiplexing based on Netfilter according to claim 1, characterized in that: The firewall opens two UDP ports, one for transmitting RTP data and the other for transmitting RTCP data.

Images