This is a first attempt to address #287.

The aim is to allow the server to maintain a specific per-client UDP readloop thread instead of one global readloop, which would allow it to drain each client connection on a separate CPU thread. See more on this here.

Problem: Currently pion/turn server-side performance is limited at about 40-50 kpps per TURN/UDP listener. This is because we allocate a single global net.PacketConn per UDP listener, which is then drained by a single CPU go-routine. This means that all client allocations made via that listener will share the same CPU thread and there is no way to load-balance client allocations across CPUs. This only affects TURN/UDP: for TCP, TLS and DTLS the TURN sockets are connected back to the client and therefore a separate CPU go-routine is created for each allocation.

Proposed solution: Create a separate net.PacketConn per each UDP client-allocation, by (1) sharing the same listener server socket using SO_REUSEADDR, (2) connecting each per-allocation connection back to the client, and (3) firing up a separate read-loop/go-routine per each client socket.

Security: Care must be taken in implementing this plan: if we blindly create a new socket per received UDP packet then a simple UDP portscan will DoS the TURN listener. In the proposed solution the per-client socket is created only after a client has made a successful allocation, which rules out the blind port-scan problem since the attacker must at least have a set of valid TURN credentials. It is still not completely safe against DoS attacks though, in that an attacker in possession of valid credentials can still open thousands of server sockets, but this is at least the same level of security as provided by the TURN/TCP implementation.

Implementation: Some fairly intrusive changes are required to support this. The patch set in particular:

• moves readLoop() into internal/server/readLoop.go,
• splits server.Request struct into server.State (stuff needed by the readLoop) and server.Request (the rest) that embeds server.State,
• lets the server invoke the Connect callback once it successfully created an TURN allocation for a client to obtain a per-client socket and spawn the readloop go-routine for the new socket,
• adds a WrapConn implementation that wraps the net.Conn returned by the DiapUDP as a net.PacketConn,
• adds an example ( examples/turn-server/udp-connect/main.go) to demonstrate the use of the new feature.

Performance: Attached is a super-simple script to benchmark a naive TURN server with (udp-connect) and without (simple) the patch. Requires the turncat TURN client (you can obtain from here) in the source dir, plus iperfv2 in the PATH. The script opens 4 client connections and runs a UDP iperf benchmark in each, then in every 5 seconds it reports the cumulative packet rate through the tested server. On a 24-core Intel server, the built-in simple server (./test.sh simple 30000000) produced 34816 pps packet rate and used 141.1% CPU (recall, there are 4 clients connected to the same listener so theoretically the server could scale out to 4 CPUs), while the server with the patches (./test.sh udp-connect 30000000) produced 140194 pps with 472% CPU usage.

Feedback appreciated.

test.sh.gz