ALG lightweight implementation method and device of embedded network equipment

Abstract

The invention discloses a lightweight implementation method of an ALG (Attribute Language Gateway) of embedded network equipment. The method comprises the following steps: extracting an IP address and port information of an intranet from a specific TCP data message, and adding a new port forwarding strategy; an intranet IP address in the specific TCP data message is changed into a public network IP address, and a port is kept unchanged; the serial number of the head of the TCP message is modified, the checksum of the TCP message is recalculated, the offset of the serial number of the head of the TCP message before and after modification is recorded as ftpalginfo, and the ftpalginfo is recorded in the NAT hash table. According to the method, the NAT module in the TCP / IP protocol stack of the embedded gateway equipment is modified instead of newly adding a module, the ALG function of FTP or SIP is realized by ingeniously adopting a port forwarding function, the code development amount is small, the function integration level is high, and compared with conventional NAT processing, the resource overhead is smaller, and the performance is better.

Description

Technical Field

[0001] The present application relates to a method for implementing an ALG function in a network device. Background Art

[0002] FTP (File Transfer Protocol) is a standard protocol for transferring files over a network. FTP connections are divided into a control connection and a data connection. When an FTP client connects to an FTP server, a control connection is first established between the client and the server, typically connected to the FTP server's public port 21. To transfer files between the client and server, a data connection is negotiated over the control connection before the data connection is established.

[0003] FTP data connection negotiation is divided into two modes, one is active mode (active mode) and the other is passive mode (passive mode).

[0004] Active mode is characterized by the following: When an FTP client and FTP server want to transfer files, the FTP client first uses the PORT command to inform the FTP server that it will use a specific port at a specific IP address as the data connection. Upon receiving the PORT command, the FTP server responds with an ACK (acknowledgement) message indicating its agreement. The FTP server then actively sends a TCP SYN (TCP synchronization) message using its own IP address and port 20 to the IP address and port specified in the PORT command by the FTP client, establishing a data connection with the FTP client.

[0005] Passive mode works as follows: When an FTP client and server want to transfer files, the FTP server first uses the PASV command to inform the client that it will use a specific IP address and port for the data connection. Upon receiving the PASV command, the FTP client responds with an ACK message indicating its agreement. The FTP client then uses its own IP address and a selectable port to establish a data connection with the IP address and port specified by the FTP server in the PASV command.

[0006] In an IPv4 network environment, Network Address Translation (NAT) exists between private and public IPv4 addresses. FTP control connections are handled by the NAT module in the network device and remain unaffected. However, FTP data connections are affected and cannot function properly. This is because the NAT module in the network device only modifies the IP packet header and does not modify the IP address and port number contained in the FTP message (for example, the PORT command). This prevents the FTP server from establishing a connection to a private IP address. Therefore, network devices such as routers often include an independent FTP application layer gateway (ALG) module behind the NAT module. This software module is responsible for monitoring and translating certain FTP protocol packets, adapting the IP address and port number carried in the FTP message during NAT. The FTP ALG module works as follows: After the IP packet header is NATed, if the FTP ALG module detects an FTP connection, it simultaneously changes the IP address and port number in the FTP message. The new IP address and port number are still allocated by the NAT module, occupying new NAT resources. Subsequent FTP data connections are NATed using the new NAT resources. In addition, because FTP is a TCP connection, if the FTP message content is changed, it involves changing some parameters of the entire TCP connection, such as changing the sequence number and the checksum of the TCP message.

[0007] The FTP ALG software module offers excellent versatility and independence, but it also has the disadvantage of high resource consumption. The addition of the new FTP ALG module lengthens the data packet processing process, and data exchange and communication between modules incur additional overhead, which impacts the FTP interaction experience. Furthermore, FTP data connections require NAT processing of IP addresses and ports, which incurs NAT processing overhead.

[0008] SIP (Session Initiation Protocol) is a communication protocol for interactive user sessions, such as video, voice, instant messaging, online gaming, and virtual reality. SIP connections are divided into SIP control connections and SIP data connections. In an IPv4 network environment, SIP data connections also require the SIP ALG software module to adapt and modify the addresses and ports carried in SIP messages during NAT. However, the SIP ALG software module also has the disadvantage of high resource consumption.

[0009] In embedded network devices, NAT module is a basic module, and port forwarding is a basic function of NAT module.Figure 1 ,The existing processing flow of the NAT module of the embedded ,network device includes the following steps.

[0010] Step S11: The NAT module determines whether the IP datagram matches the port forwarding policy. If so, the process proceeds to step S12. If not, the process proceeds to step S13.

[0011] Step S12: The NAT module performs port forwarding on the IP datagram, performing only NAT conversion of the IP address, without NAT processing of the port. Port forwarding directly forwards the specified intranet IP address and the specified port according to the matching strategy, without modifying the port number of the intranet host, and only converting the intranet IP to the public IP.

[0012] Step S13: The NAT module performs conventional NAT processing on the IP datagram, including SNAT (Source Network Address Translation) and DNAT (Destination Network Address Translation). SNAT processing refers to performing NAT processing on the source IP address and source port of the data packet from the intranet, replacing the source IP address and source port with the public network IP address and mapped port. First, the NAT hash table is searched, and the NAT information of the source IP address and source port is recorded in the NAT hash table. If it is not found, the contents of the NAT hash table are created. Then, NAT processing is performed on the source IP address and source port according to the records in the NAT hash table, completing the conversion of the IPv4 private network address to the IPv4 public network address. DNAT is the reverse process, performing NAT processing on the destination IP address and destination port of the data packet from the external network, replacing the destination IP address and destination port of the public network with the IP address and port of the intranet, thereby routing it to the host on the intranet.

[0013] Embedded network devices are typically based on RTOS (real-time operating systems) and use an embedded TCP / IP protocol stack, such as the widely used LwIP protocol stack. Due to hardware resource limitations, embedded network devices cannot afford the resource overhead of independent FTP and SIP ALG software modules, which can affect FTP and SIP transmission rates. Summary of the Invention

[0014] The technical problem to be solved by this application is: how to design a lightweight ALG implementation method based on fully utilizing the existing communication protocol implementations and processes such as FTP and SIP.

[0015] To solve the above technical problems, the present application proposes a lightweight implementation method of ALG of an embedded network device, comprising the following steps. Step S21: The NAT module of the embedded network device determines whether the IP data packet matches the port forwarding policy; if it matches the port forwarding policy, proceed to step S22; if it does not match the port forwarding policy, proceed to step S23. Step S22: The NAT module of the embedded network device performs port forwarding processing on the IP data packet. Step S23: The NAT module of the embedded network device performs NAT processing on the IP data packet. Step S24: The NAT module of the embedded network device determines whether the TCP data packet contained in the IP data packet is a message of an FTP control connection; if so, proceed to step S25; if not, exit directly. Step S25: The NAT module of the embedded network device determines whether the TCP data packet of the FTP control connection is a PORT command message or a PASV command message; if so, proceed to step S26; if not, proceed to step S210. Step S26: The NAT module of the embedded network device parses the PORT command message or PASV command message and obtains the intranet IP address and port information contained in the PORT command message or PASV command message. Step S27: The NAT module of the embedded network device adds the intranet IP address and port information contained in the PORT command message or PASV command message as a new port forwarding policy. Step S28: The NAT module of the embedded network device changes the intranet IP address contained in the PORT command message or PASV command message to a public IP address, while the port contained in the PORT command message or PASV command message remains unchanged. Step S29: The NAT module of the embedded network device modifies the sequence number in the TCP header of the PORT command message or PASV command message, recalculates the checksum of the TCP message, and records the offset of the sequence number in the TCP header before and after the modification of the current PORT command message or PASV command message as ftp_alg_info. The ftp_alg_info is recorded in the NAT hash table; the process then proceeds to step S220. Step S210: The NAT module of the embedded network device determines whether ftp_alg_info is recorded in the NAT hash table; if so, the process proceeds to step S220; if not, the process exits. Step S220: The NAT module of the embedded network device processes the header of subsequent TCP packets of the same FTP control connection, calculates and modifies the sequence number of the TCP packet header based on ftp_alg_info, and recalculates the checksum of the TCP packet.

[0016] Furthermore, in step S22, for the uplink IP data message, only the source IP address is SNAT processed without modifying the source port; for the downlink IP data message, only the destination IP address is DNAT processed without modifying the destination port.

[0017] Furthermore, in step S23, for the uplink IP datagram, the NAT hash table is first searched, which records the NAT information of the source IP address and source port; if the NAT information is not found, the contents of the NAT hash table are newly created; then, SNAT processing of the source IP address and source port is performed according to the records in the NAT hash table. For the downlink IP datagram, the NAT hash table is first searched, which records the NAT information of the destination IP address and destination port; if the NAT information is not found, the contents of the NAT hash table are newly created; then, DNAT processing of the destination IP address and destination port is performed according to the records in the NAT hash table.

[0018] Furthermore, in step S26, if it is a PORT command message, it contains information about the source IP address and source port of the intranet; if it is a PASV command message, it contains information about the destination IP address and destination port of the intranet.

[0019] Furthermore, the step S27 is to implement the FTP ALG function for the FTP data connection, and the step S28 is to implement the FTP ALG function for the FTP control connection.

[0020] This application also proposes a lightweight implementation method for ALG in an embedded network device, comprising the following steps. Step S31: The NAT module of the embedded network device determines whether the IP datagram matches the port forwarding policy; if so, the process proceeds to step S32; if not, the process proceeds to step S33. Step S32: The NAT module of the embedded network device performs port forwarding processing on the IP datagram. Step S33: The NAT module of the embedded network device performs NAT processing on the IP datagram. Step S34: The NAT module of the embedded network device determines whether the TCP datagram contained in the IP datagram is a SIP control connection message; if so, the process proceeds to step S35; if not, the process exits directly. Step S35: The NAT module of the embedded network device determines whether the TCP datagram of the SIP control connection is a REGISTER request or an INVITE request; if so, the process proceeds to step S36; if not, the process proceeds to step S310. Step S36: The NAT module of the embedded network device parses the REGISTER request or INVITE request and obtains the intranet IP address and port information in the REGISTER request or INVITE request. Step S37: The NAT module of the embedded network device adds the intranet IP address and port information carried in the REGISTER request or INVITE request as a new port forwarding policy. Step S38: The NAT module of the embedded network device changes the intranet IP address in the REGISTER request or INVITE request to a public IP address, and the port in the REGISTER request or INVITE request remains unchanged. Step S39: The NAT module of the embedded network device modifies the sequence number of the TCP message header of the REGISTER request or INVITE request, recalculates the checksum of the TCP message, and records the offset of the sequence number of the TCP message header before and after the modification of the current REGISTER request or INVITE request as sip_alg_info, and records sip_alg_info in the NAT hash table; then proceeds to step S320. Step S310: The NAT module of the embedded network device determines whether sip_alg_info is recorded in the NAT hash table; if so, proceeds to step S320; if not, exits directly. Step S320: The NAT module of the embedded network device processes the header of subsequent TCP messages of the same SIP control connection, calculates and modifies the sequence number of the TCP message header according to sip_alg_info, and recalculates the checksum of the TCP message.

[0021] Furthermore, in step S32, for the uplink IP data message, only the source IP address is SNAT processed without modifying the source port; for the downlink IP data message, only the destination IP address is DNAT processed without modifying the destination port.

[0022] Furthermore, in step S33, for the uplink IP datagram, the NAT hash table is first searched, which records the NAT information of the source IP address and source port; if the NAT information is not found, the contents of the NAT hash table are newly created; then SNAT processing of the source IP address and source port is performed according to the records in the NAT hash table. For the downlink IP datagram, the NAT hash table is first searched, which records the NAT information of the destination IP address and destination port; if the NAT information is not found, the contents of the NAT hash table are newly created; then DNAT processing of the destination IP address and destination port is performed according to the records in the NAT hash table.

[0023] Furthermore, the step S37 is to implement the SIP ALG function for the SIP data connection, and the step S38 is to implement the SIP ALG function for the SIP control connection.

[0024] The present application also proposes a lightweight implementation device of ALG of embedded network equipment, including a policy judgment unit, a port forwarding unit, and a NAT processing unit. The policy judgment unit is used to judge whether the IP data packet matches the port forwarding policy; if so, the IP data packet is sent to the port forwarding unit; if not, the IP data packet is sent to the NAT processing unit. The port forwarding unit is used to perform port forwarding processing on the IP data packet. The NAT processing unit is used to perform NAT processing on the IP data packet, and judge whether the TCP data packet contained in the IP data packet is an FTP control connection or a SIP control connection message; if so, further judge whether the FTP control connection message is a PORT command message or a PASV command message, or whether the SIP control connection message is a REGISTER request or an INVITE request; if it is a specific TCP message, parse and obtain the intranet IP address and port information therein, and add the intranet IP address and port information as a new port forwarding policy; also change the intranet IP address in the specific TCP message to the public network IP address, and keep the port unchanged; also modify the TC to which the specific TCP message belongs. The NAT hash table is used to calculate and modify the sequence number of the subsequent TCP message header of the same FTP control connection or the same SIP control connection based on the ftp_alg_info, and recalculate the checksum of the subsequent TCP message. If it is not a specific TCP message, further determine whether the NAT hash table has the record of ftp_alg_info. If so, calculate and modify the sequence number of the subsequent TCP message header of the same FTP control connection or the same SIP control connection based on the ftp_alg_info, and recalculate the checksum of the subsequent TCP message.

[0025] The technical effect achieved by this application is that by modifying the NAT module in the TCP / IP protocol stack of the embedded gateway device, rather than adding a new module, the port forwarding function is cleverly used to implement the ALG function of the FTP (or SIP) data connection. This reduces the code development workload and has a high degree of functional integration. Compared with conventional NAT processing, the resource overhead is reduced and the performance is improved. The implementation of this application is not limited to the LwIP protocol stack and can be extended to other embedded TCP / IP protocols. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a schematic diagram of an existing processing flow of a NAT module of an embedded network device.

[0027] Figure 2This is a flow chart of a lightweight implementation method of FTP ALG for embedded network devices proposed in this application.

[0028] Figure 3 This is a flowchart of a lightweight implementation method of SIP ALG for embedded network devices proposed in this application.

[0029] Figure 4 It is a structural diagram of a lightweight implementation device of ALG of an embedded network device proposed in this application.

[0030] Description of the reference numerals in the figure: policy judgment unit 41, port forwarding unit 42, NAT processing unit 43. DETAILED DESCRIPTION

[0031] See also Figure 2 The first embodiment of the lightweight implementation method of ALG of the embedded network device proposed in this application includes the following steps for implementing the FTP ALG function.

[0032] Step S21: The NAT module of the embedded network device determines whether the IP datagram matches the port forwarding policy. If so, the process proceeds to step S22. If not, the process proceeds to step S23.

[0033] Step S22: The NAT module of the embedded network device performs port forwarding processing on the IP datagram. For uplink IP datagrams, only the source IP address is SNATed, and the source port is not modified. For downlink IP datagrams, only the destination IP address is DNATed, and the destination port is not modified.

[0034] Step S23: The NAT module of the embedded network device performs conventional NAT processing on the IP data message.

[0035] SNAT processing is performed on uplink IP datagrams as follows. First, the NAT hash table is searched, which contains NAT information for the source IP address and source port. If the NAT information is not found in the NAT hash table, a new NAT hash table is created. SNAT processing is then performed on the source IP address and source port based on the information in the NAT hash table, completing the conversion from the private IPv4 address to the public IPv4 address.

[0036] DNAT processing is performed on downlink IP datagrams as follows. First, the NAT hash table is searched, which contains NAT information for the destination IP address and destination port. If the NAT hash table is not found, a new NAT hash table is created. DNAT processing is then performed on the destination IP address and destination port based on the information in the NAT hash table, completing the translation from the public IPv4 address to the private IPv4 address.

[0037] Step S24: The NAT module of the embedded network device determines whether the TCP data message contained in the IP data message is a message of an FTP control connection, if yes, proceeds to step S25, if no, directly exits.

[0038] Step S25: The NAT module of the embedded network device determines whether the TCP data packet of the FTP control connection is a PORT command message or a PASV command message. Only these two types of FTP control messages require FTP ALG processing on their TCP payloads. If it is a PORT command message or a PASV command message, the process proceeds to step S26. If it is any other FTP control message, FTP ALG processing is not required, and the process proceeds to step S210.

[0039] Step S26: The NAT module of the embedded network device parses the PORT command message or PASV command message and obtains the intranet IP address and port information from the PORT command message or PASV command message. If it is a PORT command message, the message contains the intranet source IP address and source port information. If it is a PASV command message, the message contains the intranet destination IP address and destination port information.

[0040] Step S27: The NAT module of the embedded network device adds the intranet IP address and port information carried in the PORT command message or PASV command message as a new port forwarding policy. Subsequent FTP data connections will then follow the port forwarding process (i.e., step S22) based on the newly added port forwarding policy. This newly added port forwarding policy is how this application implements the FTP ALG function for FTP data connections.

[0041] Step S28: The NAT module of the embedded network device changes the internal network IP address in the PORT command message or PASV command message to a public network IP address, while the port number in the PORT command message or PASV command message remains unchanged. This step modifies part of the payload of the PORT command message or PASV command, which is how the present application implements the FTP ALG function for the FTP control connection.

[0042] Step S29: Since the IP address has been modified, the length of the PORT command message or PASV command message (both of which are TCP messages) may change. Therefore, the NAT module of the embedded network device modifies the sequence number in the TCP message header, recalculates the checksum of the TCP message, and records the offset of the sequence number in the TCP message header of the current PORT command message or PASV command message due to the FTPALG processing in step S28 as ftp_alg_info. This adjustment affects all subsequent TCP messages in the same FTP control connection, so ftp_alg_info is recorded in the NAT hash table for use in the calculation of the modified sequence number in the TCP message header of the same FTP control connection. Then, the process proceeds to step S220.

[0043] Step S210: The NAT module of the embedded network device determines whether the NAT hash table contains the entry ftp_alg_info. If so, this indicates that this FTP control connection has previously processed a PORT command message or a PASV command message. Therefore, the sequence number in the TCP message header needs to be modified, and the process proceeds to step S220. If not, the process exits.

[0044] Step S220: The NAT module of the embedded network device processes the header of subsequent TCP messages of the same FTP control connection, calculates and modifies the sequence number of the TCP message header according to ftp_alg_info, and recalculates the checksum of the TCP message.

[0045] See also Figure 3 The second embodiment of the lightweight implementation method of ALG of the embedded network device proposed in this application includes the following steps for implementing the SIP ALG function.

[0046] Step S31: The NAT module of the embedded network device determines whether the IP datagram matches the port forwarding policy. If so, the process proceeds to step S32. If not, the process proceeds to step S33.

[0047] Step S32: The NAT module of the embedded network device performs port forwarding processing on the IP data message. This step is the same as step S22.

[0048] Step S33: The NAT module of the embedded network device performs conventional NAT processing on the IP data message. This step is the same as step S23.

[0049] Step S34: The NAT module of the embedded network device determines whether the TCP data message contained in the IP data message is a message for a SIP control connection, if yes, proceeds to step S35, if no, directly exits.

[0050] Step S35: The NAT module of the embedded network device determines whether the TCP data packet of the SIP control connection is a REGISTER request or an INVITE request. Only these two types of SIP control messages require SIP ALG processing on their TCP payloads. If it is a REGISTER request or an INVITE request, the process proceeds to step S36. If it is any other SIP control message, SIP ALG processing is not required and the process proceeds to step S310.

[0051] Step S36: The NAT module of the embedded network device parses the REGISTER request or the INVITE request, and obtains the intranet IP address and port information in the Via, Contact and other fields in the REGISTER request or the INVITE request.

[0052] Step S37: The NAT module of the embedded network device adds the intranet IP address and port information carried in the REGISTER or INVITE request as a new port forwarding policy. Subsequent SIP data connections will then follow the port forwarding process (i.e., step S32) based on the newly added port forwarding policy. This newly added port forwarding policy is how this application implements the SIP ALG function for SIP data connections.

[0053] Step S38: The NAT module of the embedded network device changes the intranet IP address in the REGISTER request or INVITE request to a public IP address, while the port number in the REGISTER request or INVITE request remains unchanged. This step modifies part of the TCP payload of the REGISTER request or INVITE request, which is how this application implements the SIP ALG function for the SIP control connection.

[0054] Step S39: Because the TCP payload has been modified, the length of the REGISTER or INVITE request (a TCP message) may change. Therefore, the NAT module of the embedded network device modifies the sequence number in the TCP message header, recalculates the checksum of the TCP message, and records the offset in the sequence number of the TCP message header of the current REGISTER or INVITE request due to the SIP ALG processing in step S38 as sip_alg_info. This adjustment affects all subsequent TCP messages for the same SIP control connection, so sip_alg_info is recorded in the NAT hash table for use in subsequent calculations of modified sequence numbers in TCP message headers for the same SIP control connection. The process then proceeds to step S320.

[0055] Step S310: The NAT module of the embedded network device determines whether the NAT hash table contains a record of sip_alg_info. If so, this indicates that this SIP control connection has previously processed a REGISTER request or an INVITE request, and the TCP packet header sequence number needs to be modified. The process then proceeds to step S320. If not, the process exits.

[0056] Step S320: The NAT module of the embedded network device processes the header of subsequent TCP messages of the same SIP control connection, calculates and modifies the sequence number of the TCP message header according to sip_alg_info, and recalculates the checksum of the TCP message.

[0057] See also Figure 4 The lightweight implementation device of ALG of the embedded network device proposed in this application includes a policy judgment unit 41, a port forwarding unit 42, and a NAT processing unit 43. These units are all internal units of the NAT module of the embedded network device. Figure 4 The device shown corresponds to Figure 2 or Figure 3 The method shown.

[0058] The policy determination unit 41 is used to determine whether the IP datagram matches the port forwarding policy. If yes, the IP datagram is sent to the port forwarding unit 42. If not, the IP datagram is sent to the NAT processing unit 43.

[0059] The port forwarding unit 42 is used to perform port forwarding processing on IP data packets.

[0060] The NAT processing unit 43 is configured to perform conventional NAT processing on the IP datagram and determine whether the TCP datagram contained in the IP datagram is a message for an FTP control connection or a SIP control connection. If so, the NAT processing unit 43 further determines whether the message for the FTP control connection is a PORT command message or a PASV command message, or whether the message for the SIP control connection is a REGISTER request or an INVITE request. If it is a specific TCP message (i.e., a PORT command message, a PASV command message, a REGISTER request, or an INVITE request), the internal network IP address and port information are parsed and added as a new port forwarding policy. The internal network IP address in the specific TCP message is also changed to a public network IP address, while the port remains unchanged. The sequence number of the TCP message header to which the specific TCP message belongs is modified, the TCP message checksum is recalculated, and the offset of the current TCP message header sequence number is recorded as ftp_alg_info and recorded in the NAT hash table. The sequence number of subsequent TCP message headers for the same FTP control connection or the same SIP control connection is also calculated and modified based on ftp_alg_info, and the checksum of subsequent TCP messages is recalculated. If it is not a specific TCP message, the NAT hash table is further determined to determine whether ftp_alg_info is recorded. If so, the sequence number of subsequent TCP message headers for the same FTP control connection or the same SIP control connection is calculated and modified based on ftp_alg_info, and the checksum of subsequent TCP messages is recalculated.

[0061] The lightweight implementation method of FTP ALG (or SIP ALG) of embedded network devices proposed in this application no longer sets up an independent FTP ALG (or SIP ALG) software module, but makes appropriate modifications to the existing NAT module and port forwarding function in the network device based on LwIP or other TCP / IP protocol stacks to implement the functions of the original independent FTP ALG (or SIP ALG) software module. In this way, the processing flow of FTP ALG (or SIP ALG) is integrated into the NAT processing flow. At the same time, this application implements the intranet IP address conversion of FTP (or SIP) data connection based on port forwarding, utilizing the existing functions and interfaces of the NAT module, and is simpler in processing; the port forwarded data only needs to undergo IP address conversion, without the need for port conversion, with less processing content and no need to create a new NAT hash table. Compared with independent software modules, the processing overhead is smaller and the performance is better.

[0062] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A lightweight implementation method of ALG for embedded network equipment, characterized by: The method includes the following steps: Step S21: The NAT module of the embedded network device determines whether the IP datagram matches the port forwarding policy; if it matches the port forwarding policy, the process proceeds to step S22; if it does not match the port forwarding policy, the process proceeds to step S23; Step S22: The NAT module of the embedded network device performs port forwarding processing on the IP data message; Step S23: The NAT module of the embedded network device performs NAT processing on the IP data message; Step S24: The NAT module of the embedded network device determines whether the TCP data message contained in the IP data message is a message of an FTP control connection; If yes, proceed to step S25, if no, exit directly; Step S25: The NAT module of the embedded network device determines whether the TCP data message of the FTP control connection is a PORT command message or a PASV command message; If yes, go to step S26; if no, go to step S210; Step S26: The NAT module of the embedded network device parses the PORT command message or the PASV command message to obtain the IP address and port information of the intranet in the PORT command message or the PASV command message; Step S27: The NAT module of the embedded network device adds the IP address and port information of the intranet carried in the PORT command message or the PASV command message as a new port forwarding policy; Step S28: The NAT module of the embedded network device changes the intranet IP address in the PORT command message or the PASV command message to a public network IP address, and the port in the PORT command message or the PASV command message remains unchanged; Step S29: The NAT module of the embedded network device modifies the sequence number of the TCP message header of the PORT command message or the PASV command message, recalculates the checksum of the TCP message, and records the offset of the sequence number of the TCP message header before and after the modification of the current PORT command message or the PASV command message as ftp_alg_info, and records ftp_alg_info in the NAT hash table; then proceeds to step S220; Step S210: The NAT module of the embedded network device determines whether there is a record of ftp_alg_info in the NAT hash table; if yes, proceed to step S220; if not, exit directly; Step S220: The NAT module of the embedded network device processes the header of subsequent TCP messages of the same FTP control connection, calculates and modifies the sequence number of the TCP message header according to ftp_alg_info, and recalculates the checksum of the TCP message.

2. The lightweight implementation method of ALG of embedded network equipment according to claim 1, characterized in that: In step S22, for the uplink IP data message, only the source IP address is SNAT processed without modifying the source port; for the downlink IP data message, only the destination IP address is DNAT processed without modifying the destination port.

3. The lightweight implementation method of ALG of embedded network equipment according to claim 1, characterized in that: In step S23, for the uplink IP data packet, first search the NAT hash table, which records the NAT information of the source IP address and source port; if not found, create a new NAT hash table; then perform SNAT processing on the source IP address and source port according to the records in the NAT hash table; For downlink IP data packets, the NAT hash table is first searched. The NAT hash table records the NAT information of the destination IP address and destination port. If not found, a new NAT hash table is created; then DNAT processing of the destination IP address and destination port is performed according to the records in the NAT hash table.

4. The lightweight implementation method of ALG of embedded network equipment according to claim 1, characterized in that: In step S26, if it is a PORT command message, it contains the information of the source IP address and source port of the intranet; if it is a PASV command message, it contains the information of the destination IP address and destination port of the intranet.

5. The lightweight implementation method of ALG of embedded network equipment according to claim 1, characterized in that: The step S27 is to implement the FTP ALG function for the FTP data connection, and the step S28 is to implement the FTP ALG function for the FTP control connection.

6. A lightweight implementation method of ALG for embedded network equipment, characterized by: The method includes the following steps: Step S31: The NAT module of the embedded network device determines whether the IP datagram matches the port forwarding policy; if it matches the port forwarding policy, the process proceeds to step S32; if it does not match the port forwarding policy, the process proceeds to step S33; Step S32: The NAT module of the embedded network device performs port forwarding processing on the IP data message; Step S33: The NAT module of the embedded network device performs NAT processing on the IP data message; Step S34: The NAT module of the embedded network device determines whether the TCP data message contained in the IP data message is a message of the SIP control connection; If yes, proceed to step S35, if no, exit directly; Step S35: The NAT module of the embedded network device determines whether the TCP data packet of the SIP control connection is a REGISTER request or an INVITE request; if yes, proceeds to step S36; if not, proceeds to step S310; Step S36: The NAT module of the embedded network device parses the REGISTER request or INVITE request and obtains the intranet IP address and port information in the REGISTER request or INVITE request; Step S37: The NAT module of the embedded network device adds the intranet IP address and port information carried in the REGISTER request or the INVITE request as a new port forwarding policy; Step S38: The NAT module of the embedded network device changes the intranet IP address in the REGISTER request or the INVITE request to a public IP address, and the port in the REGISTER request or the INVITE request remains unchanged; Step S39: The NAT module of the embedded network device modifies the sequence number of the TCP message header of the REGISTER request or INVITE request, recalculates the checksum of the TCP message, and records the offset of the sequence number of the TCP message header before and after the modification of the current REGISTER request or INVITE request as sip_alg_info, and records sip_alg_info in the NAT hash table; then proceeds to step S320; Step S310: The NAT module of the embedded network device determines whether there is a record of sip_alg_info in the NAT hash table; if yes, proceed to step S320; if not, exit directly; Step S320: The NAT module of the embedded network device processes the header of subsequent TCP messages of the same SIP control connection, calculates and modifies the sequence number of the TCP message header according to sip_alg_info, and recalculates the checksum of the TCP message.

7. The lightweight implementation method of ALG of embedded network equipment according to claim 6, characterized in that: In step S32, for the uplink IP data message, only the source IP address is SNAT processed without modifying the source port; for the downlink IP data message, only the destination IP address is DNAT processed without modifying the destination port.

8. The lightweight implementation method of ALG of embedded network equipment according to claim 6, characterized in that: In step S33, for the uplink IP data packet, first search the NAT hash table, which records the NAT information of the source IP address and source port; if not found, create a new NAT hash table; then perform SNAT processing on the source IP address and source port according to the records in the NAT hash table; For downlink IP data packets, the NAT hash table is first searched. The NAT hash table records the NAT information of the destination IP address and destination port. If not found, a new NAT hash table is created; then DNAT processing of the destination IP address and destination port is performed according to the records in the NAT hash table.

9. The lightweight implementation method of ALG of embedded network equipment according to claim 6, characterized in that: The step S37 is to implement the SIP ALG function for the SIP data connection, and the step S38 is to implement the SIP ALG function for the SIP control connection.

10. A lightweight implementation device for ALG of an embedded network device, characterized in that: Including policy judgment unit, port forwarding unit, and NAT processing unit; The policy judgment unit is used to judge whether the IP data message matches the port forwarding policy; If yes, send the IP datagram to the port forwarding unit; if no, send the IP datagram to the NAT processing unit; The port forwarding unit is used to perform port forwarding processing on IP data packets; The NAT processing unit is used to perform NAT processing on the IP data message and determine whether the TCP data message contained in the IP data message is a message of an FTP control connection or a SIP control connection; If so, further determine whether the message of the FTP control connection is a PORT command message or a PASV command message, or whether the message of the SIP control connection is a REGISTER request or an INVITE request; if it is a specific TCP message, parse and obtain the intranet IP address and port information therein, and add the intranet IP address and port information as a new port forwarding policy; also change the intranet IP address in the specific TCP message to the public network IP address, and keep the port unchanged; also modify the sequence number of the TCP message header to which the specific TCP message belongs, recalculate the checksum of the TCP message, and record the offset of the sequence number of the current TCP message header as ftp_alg_info, and record it in the NAT hash table; also calculate and modify the sequence number of subsequent TCP message headers of the same FTP control connection or the same SIP control connection based on ftp_alg_info, and recalculate the checksum of subsequent TCP messages; if it is not a specific TCP message, further determine whether there is a record of ftp_alg_info in the NAT hash table; If so, the sequence number of the subsequent TCP message header of the same FTP control connection or the same SIP control connection is calculated and modified according to ftp_alg_info, and the checksum of the subsequent TCP message is recalculated.

Images