CN102984167A - Traversal method for universal firewall based on Socks5 protocol - Google Patents

Abstract

The invention provides a traversal method for a universal firewall based on an Socks5 (sessions traversal across firewall securely 5) protocol, and belongs to the field of firewall traversal. A universal Socks5 client is arranged on a VoIP (voice over internet protocol) system client side in the firewall of an enterprise; the universal Socks5 client is independent of a VoIP system client, can grab, analyze and agent signaling and media messages sent by the VoIP system client, and can be communicated with an Socks5 server positioned outside the firewall of the enterprise; and the traversal of the firewall of the enterprise is achieved in a message agency mode. The method provides different VoIP systems with a universal mode for conducting enterprise firewall traversal and message agency, the agency process of Socks5 is completed without affecting the existing protocol stack of the client, and the coupling degree between the Socks5 client and the original VoIP system client is reduced.

Description

A kind of general Firewall Traversing method based on the Socks5 agreement

Technical field

The invention belongs to the Firewall Traversing field, be specifically related to a kind of general Firewall Traversing method based on the Socks5 agreement.

Background technology

The English of fire compartment wall is called " FireWall ", and it is present a kind of most important network protection equipment.From professional angle, fire compartment wall is to be positioned between two (or a plurality of) networks, implements one group of assembly set of access control between the network.

The initial design philosophy of fire compartment wall is always trusted internal network, and always mistrustful to external network, filter so initial fire compartment wall is the communication of only being come in the outside, and the communication that the inner network user is sent is not restricted.Certainly present fire compartment wall also changes on strobe utility to some extent, the communication connection of not only external network being sent will be filtered, part connection request and packet that the inner network user is sent need to filter equally, but fire compartment wall still only passes through the communication that meets security strategy, also has " one-way conduction " property.

The sorting technique of fire compartment wall is a lot, briefly can classify with following Lung biopsy:

1, be divided into from soft and hardware in form:

Software firewall and hardware firewall and chip-scale fire compartment wall.

2, slave firewall is technical to be divided into:

" packet filter " and " application proxy type " two large classes.

3, be divided on the slave firewall structure:

Three kinds of single host firewall, router integrated firewall and distributed fire walls.

4, be divided into by the application deployment position of fire compartment wall:

Perimeter firewall, personal fire wall and hybrid filewall three major types.

5, be divided into by fire wall performance:

100,000,000 grades of fire compartment walls and gigabit level fire compartment wall two classes.

The present invention mainly for be that the restriction Intranet externally sends the packet filter enterprise firewall of message port.Existing main flow to enterprise firewall is passed through the thought that scheme mainly is based on Message Agent, and the agent way core concept of main flow is to adopt the Socks5 agreement to carry out Message Agent.

As shown in Figure 1, in VoIP system, be positioned at the client after the enterprise firewall, carry out the agency of signaling and media information by the Socks5 server, realize the client communication outer with enterprise firewall.Because what the Socks5 standard adopted is customer end/server mode, the client modules that in VoIP system client (all belonging to the VoIP system client so long as can access the VoIP core net and client that do not adopt proprietary protocol), needs to implant Socks5, carry out by the processing of proxy message and with the communicating by letter of Socks5 server.

The scheme of more detailed Socks5 is as described below, owing to may be carried by TCP or udp protocol by the proxy message transport layer, the also to some extent difference of firewall agent process is specific as follows:

1, based on the Firewall Traversing flow process of TCP

As shown in Figure 2, the several main processes of Firewall Traversing process need process:

(1) the TCP establishment of connection stage

This process is traditional TCP three-way handshake, allows the Socks5 client modules be connected TCP with the Socks5 server and connects.

(2) authentication message is to the transmitting-receiving stage

The Socks5 client sends a version definition message (version identifiermessage) to server, and message structure is as shown in table 1:

Table 1

Version number territory (VER) is made as 05, and the presentation protocol version is that socks 5. method number fields (NMETHODS) comprise the method defined word joint number that occurs in the method territory (METHODS).

The Socks5 server is selected a kind of from these methods of method territory (METHODS), and answering method selects message (method selection message) to client, and this message structure is as shown in table 2:

Table 2

Wherein the optional value in method territory (method) mainly contains following several:

X ' 00 ': need not authentication mode

X ' 01 ': the GSSAPI mode

X ' 02 ': the usemame/password pattern

X ' 03 ' to X ' 7F ': distributed IANA

X ' 80 ' to X ' FE ': be that private method is reserved

X ' FF ': do not have acceptable mode

(3) the address negotiation stage

The Socks5 client sends a request message (request message) to the Sock5 server, and this message structure is as shown in table 3:

Table 3

Equally, version number territory (VER) is made as 05, and the presentation protocol version is socks 5.

The CMD territory provides three kinds of connected mode: X ' 01 ' (connected mode), X ' 01 ' (binding mode) and X ' 01 ' (UDP interrelational form).

The RSV domain representation keeps the position, is used for the possible expansion of message.

ATYP domain representation address style and destination address is inserted in afterwards DST.ADDR territory, DST.PORT inserts in the territory destination slogan.Optional address style has: X ' 01 ' (IPv4 address), X ' 03 ' (address domain name), X ' 04 ' (IPv6 address).IPV4 wherein, IPV6 address regular length is respectively 4 bytes, 16 bytes, domain name is preserved take the pascal character string: the first byte is as string length, and the back is with the character string content.

The answer of Sock5 server (reply) message is as shown in table 4:

Table 4

VER territory such as preamble are described, and insert 05.

The type of REP domain representation response, optional value:

X ' 00 ': successful connection

X ' 01 ': the failure of Socks server end

X ' 02 ': connection is not allowed to

X ' 03 ': network is unreachable

X ' 04 ': main frame is unreachable

X ' 05 ': connection is rejected

X ' 06 ': TTL is overtime

X ' 07 ': the CMD territory in the request is not supported

X ' 08 ': the address style in the request is not supported

X ' 09 ' to X ' FF ': unallocated

The RSV territory is reserved field, and the ATYP territory is consistent with meaning in the request message, expression address style, and the network address that ensuing DST.ADDR domain representation server end is bound, the port that DST.PORT domain representation server end is bound.

Different for CMD territory in the request message, the meaning of some fields also can be different in the answer:

A. connected mode:

To in the replying of CONNECT order, BND.PORT has comprised the port numbers that is used for linking target machine of server-assignment, and BND.ADDR then is corresponding IP address.Because the SOCKS server has a plurality of IP usually, often to link that IP of SOCKS server different with client for the BND.ADDR in replying.The SOCKS server can utilize DST.ADDR and DST.PORT, and client source address and port come a CONNECT request is analyzed.

B. binding mode:

The BIND request usually is used in those and requires on the agreement of client acceptance from the connection of server.FTP is a typical example.It is set up a connection from the client to the server end and comes the report of fill order and accepting state, and receives the requirement (such as LS, GET, PUT) of the transmission of data with another connection from the server to client end.

Suggestion only just can use the BIND order to set up second connection after the client of an application protocol is using the CONNECT order to set up main the connection.Suggestion SOCKS server is analyzed the BIND request with DST.ADDR and DST.PORT.

In the operating process of a BIND request, the SOCKS server will send two and reply to client.Sending first when a new socket is set up and bound to server replys.The BND.PORT field comprises the port numbers that the SOCKS server is used for monitoring the connection that enters, and the BAND.ADDR field has comprised corresponding IP address.Client is told the convergence point of (connecting or control connection by main) application server connection usually with these information.Reply after the successful connection or failure that occurs over just desired arrival for second.In second was replied, BND.PORT and BND.ADDR field had comprised IP address and the port numbers of the main frame that connects.

The C.UDP interrelational form: what foundation was described is the association of a UDP mode.

(4) data transfer phase (Message Agent stage)

After the front three phases is finished, if successfully, then carry out the agency of signaling and media information between Socks client and Socks server, the message body of application layer connects by the TCP that just now set up transmits.

2, based on the Firewall Traversing flow process of UDP

As shown in Figure 3, based on the enterprise firewall of UDP pass through flow process with based on TCP pass through the flow process broadly similar, but still have some differences.The below is further described in more detail this flow process:

(1) the TCP establishment of connection stage

This process is the same with the stage of the same name of passing through in the flow process based on TCP, is traditional TCP three-way handshake, directly sets up TCP at Socks5 client modules and Socks5 server and connects.

(2) authentication message is to the transmitting-receiving stage

Consistent with the stage of the same name of passing through in the flow process based on TCP, message structure is also identical.

(3) the address negotiation stage

When carry out based on UDP pass through flow process the time, UDP association (UDP Associate) is selected to fill in CMD territory among the request message request, the message structure of a pair of message in this stage (request and reply) with based on TCP to pass through flow process identical:

UDP ASSOCIATE request normally requires to set up the UDP datagram that a UDP forwarding process is controlled arrival.DST.ADDR and DST.PORT field comprise desirable IP address and the port numbers that is used for sending UDP datagram of client.Server can limit the connection that enters with this information.If client does not have address and port information when sending this request, client must be filled with full 0.

During the TCP disconnecting set up when the stage (1), follow-up Message Agent also will interrupt.When replying the UDPASSOCIATE request, BND.PORT and BND.ADDR field have indicated the client and have sent UDP message to port and the address of server.

(4) data transfer phase (Message Agent stage)

If three phases before successfully carries out, then enter into this stage.In this stage, the media of UDP that client is acted on behalf of carrying and the application layer data of signaling message will be placed in the DATA territory of UDP association request message and be acted on behalf of, and this is a request message that does not have response message, and message format is as shown in table 5:

Table 5

RSV domain representation reserved field is inserted X ' 0000 '.The segment number that the FRAG domain representation is present is used for the long situation that segmentation is arranged of message.ATYP represents address style equally, is consistent with description in the preamble, and destination address and the target port of being acted on behalf of UDP message inserted respectively in DSTA.DDR and DST.PORT territory.Fill out by the application layer data of proxy message in the last DATA territory.

Carry out transfer of data by sending this message between Socks server and the Socks client, i.e. the agency of message.

Can find out from top analysis, existing technical scheme need to be added the Socks5 client modules in existing VoIP client, if signaling message is not identical with media information in the different VoIP clients, then need to make up new Socks5 client modules, the degree of coupling that is module and specific VoIP client is high, do not have versatility, when this causes different VoIP client access VoIP system, can bring extra exploitation cost for enterprise firewall passes through function.

In addition, from more fine-grained angle VoIP client, the transmission of signaling and media information is all finished by complete protocol stack module, generally also can't consider the demand of passing through of enterprise firewall at the design initial stage of protocol stack, this causes introducing above flow process (based on the flow process of passing through of TCP/UDP) in protocol stack module, need to make amendment at existing protocol stack, this tends to bring no small workload, also tends to affect simultaneously original completeness of protocol stack and the original intention of design phase.

Summary of the invention

The object of the invention is to solve a difficult problem that exists in the above-mentioned prior art, a kind of general Firewall Traversing method based on the Socks5 agreement is provided, allows different VoIP system clients can under the prerequisite that does not change its existing signaling media information protocol stack, realize passing through of enterprise firewall.

The present invention is achieved by the following technical solutions:

A kind of general Firewall Traversing method based on the Socks5 agreement, described method arranges general Socks5 client at the VoIP system client-side that is positioned at enterprise firewall inside, described general Socks5 client is independent of the VoIP system client, and can signaling and the media information that described VoIP system client is sent be grasped, analyze and act on behalf of, and can communicate with the Socks5 server that is positioned at the enterprise firewall outside, the mode by Message Agent realizes that enterprise firewall passes through.

Described method comprises:

After the VoIP system client is sent signaling message or media information, the packet of the message that general Socks5 client is sent in the network interface card of VoIP system client place machine crawl VoIP system client;

The packet that grabs is analyzed, if the transport layer of message is the TCP carrying, then carried out between general Socks5 client and the Socks5 server passing through flow process based on the enterprise firewall of TCP; If the transport layer of message is the UDP carrying, then carry out between general Socks5 client and the Socks5 server passing through flow process based on the enterprise firewall of UDP.

Described enterprise firewall based on TCP passes through flow process and passes through flow process based on the enterprise firewall of UDP and includes that (large flow process all is 4, and the TCP establishment stage is all the same, and other three flow process details are different (to see the background technology part for details.))：

(1) the TCP establishment of connection stage;

(4) authentication message is to the transmitting-receiving stage;

(3) the address negotiation stage;

(4) data transfer phase;

In described step (4), if the TCP carrying, then described general Socks5 client directly sends to the Socks5 server with the packet that grabs by the TCP connection, finishes agent process by the Socks5 server afterwards; If UDP carrying, then the packet that grabs of described general Socks5 client utilization extracts the application layer messages body of message, then this application layer messages body is filled out in the DATA territory, then sent to the Socks5 server, finished afterwards agency's process by the Socks5 server.

Compared with prior art, the invention has the beneficial effects as follows:

One, the inventive method can provide for different VoIP system clients a kind of general mode to carry out the agency with message of passing through of enterprise firewall, eliminated the new client of introducing and will carry out the overhead that Firewall Traversing is brought in VoIP system;

Two, the inventive method can be finished the agent process of Socks5 under the prerequisite that does not affect client existing protocol stack, has reduced the degree of coupling between the realization of Socks5 client and former VoIP system client.

Description of drawings

Fig. 1 is the schematic diagram that existing VoIP client passing through network is disposed.

Fig. 2 is based on the message diagram of the passing fire wall of TCP.

Fig. 3 is based on the message diagram of the passing fire wall of UDP.

Fig. 4 is the schematic diagram that the VoIP client passing through network of the inventive method design is disposed.

Fig. 5 is the step block diagram of the inventive method.

Fig. 6 is the message diagram of the passing fire wall of the inventive method.

Embodiment

Below in conjunction with accompanying drawing the present invention is described in further detail:

The core concept of the inventive method is: provide the general enterprise firewall of a kind of multi-client to pass through scheme by the mode that the Socks5 client is independent.Specifically, be to make up a module that is independent of the VoIP client, carry out the crawl of network card data bag at enterprise firewall internal client place machine, it is analyzed, extract the messages application layer, act on behalf of for it by the mode of socks5.The method is transparent for the VoIP client message, and client does not also know to have the agency to exist.

As shown in Figure 4, in the methods of the invention, the VoIP system client-side after enterprise firewall is provided with a general Socks5 client, and general Socks5 client comprises following components:

A. packet handling module: be responsible for the packet on the crawl network interface card;

B. data packet analysis module: the packet that grabs is analyzed;

C Socks5 proxy module: be responsible for and the Socks5 server contact, carry out enterprise firewall for the message of VoIP client and pass through.

The signaling that the VoIP system client is sent and media information all grasp, analyze and act on behalf of by general Socks5 client.The negotiation agent process that VoIP system client and Socks5 server in the existing main flow scheme are carried out has moved on between general Socks5 client and the Socks5 server.Removed the degree of coupling between Socks client modules and the VoIP system client, the adaptive different VoIP system client of the method energy, for the VoIP system client of new adding, it is just passable only to need to increase a general Socks5 client.The corresponding general Socks5 client of VoIP system client, namely both are corresponding one by one, and general Socks5 client and VoIP system client deployment on a physical machine, are needed to share the same network interface card.For different VoIP system clients, do not need general Socks5 client is carried out any modification.

The step block diagram of the inventive method as shown in Figure 5, after the VoIP system client is sent signaling message or media information, general Socks5 client can be caught at network interface card the packet (being similar to the function of packet capturing software from the mode of network interface card packet capturing) of the message that the VoIP system client sends, afterwards it is analyzed that (packet that grabs can come by the level of TCP/IP the decomposition data bag by the analysis tool that programming realizes, obtain the message body on each level, can find out that like this transport layer is to adopt TCP or UDP, also can obtain the message body of application layer, agent process after being used for), is the transport layer of seeing message TCP carrying or UDP carrying? if TCP carrying, general Socks5 client then and carry out enterprise firewall based on TCP between the Socks5 server and pass through flow process (detailed process is asked for an interview 4 steps described in " 1; based on the flow process of passing through of TCP " in " background technology "), in like manner, if message is the UDP carrying, then passing through flow process (detailed process is asked for an interview 4 steps described in " 2; based on the flow process of passing through of UDP " in " background technology ") according to the enterprise firewall based on UDP processes, until the conversation procedure of VoIP client finishes, agent process also stops thereupon.The present invention carries out the agency of VoIP client message by the mode of network interface card packet capturing and is transparent for VoIP client agent process, i.e. client and do not know agent process between general Socks5 client and the Socks5 server.

More detailed flow chart as shown in Figure 6, after initiating a message, VoIP client VoIP client grabbed by general Socks5 client, analyze, judge that TCP or UDP carry the flow process of passing through of being correlated with afterwards, in the 4th stage (data transfer phase) of flow process separately, the packet of crawl extracts the application layer messages body of message before the utilization of general Socks5 client, afterwards this application layer data is filled out in the DATA territory (based on the mode of UDP) or connected by TCP and directly send (based on the mode of TCP), finish agency's process.

Technique scheme is one embodiment of the present invention, for those skilled in the art, on the basis that the invention discloses application process and principle, be easy to make various types of improvement or distortion, and be not limited only to the described method of the above-mentioned embodiment of the present invention, therefore previously described mode is just preferred, and does not have restrictive meaning.

Claims (3)

1. general Firewall Traversing method based on the Socks5 agreement, it is characterized in that: described method arranges general Socks5 client at the VoIP system client-side that is positioned at enterprise firewall inside, described general Socks5 client is independent of the VoIP system client, and can signaling and the media information that described VoIP system client is sent be grasped, analyze and act on behalf of, and can communicate with the Socks5 server that is positioned at the enterprise firewall outside, the mode by Message Agent realizes that enterprise firewall passes through.

2. the general Firewall Traversing method based on the Socks5 agreement according to claim 1, it is characterized in that: described method comprises:

After the VoIP system client is sent signaling message or media information, the packet of the message that general Socks5 client is sent in the network interface card of VoIP system client place machine crawl VoIP system client;

The packet that grabs is analyzed, if the transport layer of message is the TCP carrying, then carried out between general Socks5 client and the Socks5 server passing through flow process based on the enterprise firewall of TCP; If the transport layer of message is the UDP carrying, then carry out between general Socks5 client and the Socks5 server passing through flow process based on the enterprise firewall of UDP.

3. the general Firewall Traversing method based on the Socks5 agreement according to claim 2 is characterized in that: described enterprise firewall based on TCP passes through flow process and passes through flow process based on the enterprise firewall of UDP and includes:

(1) the TCP establishment of connection stage;

(3) authentication message is to the transmitting-receiving stage;

(3) the address negotiation stage;

(4) data transfer phase;

In described step (4), if the TCP carrying, then described general Socks5 client directly sends to the Socks5 server with the packet that grabs by the TCP connection, finishes agent process by the Socks5 server afterwards; If UDP carrying, then the packet that grabs of described general Socks5 client utilization extracts the application layer messages body of message, then this application layer messages body is filled out in the DATA territory, then sent to the Socks5 server, finished afterwards agency's process by the Socks5 server.

Images