▎
▎ On HTTP authentication (POST /api/user), the server allocates a unique UDP port from a configurable pool
▎ (DeltaPortStart–DeltaPortEnd). The port acts as a nonce — when the client connects via UDP to that specific port,
▎ the server matches the connection to the authenticated PUID and FriendCode. This replaces unreliable IP-based
▎ matching, especially for players behind NAT/CGNAT.
▎
▎ - PortPoolService — thread-safe port pool with 5-minute auto-recycle if no connection arrives
▎ - IDeltaListenerManager — starts/stops UDP listeners on allocated ports (implemented by Matchmaker)
▎ - IFirewallService — UFW / firewalld / noop backends that automatically open/close firewall rules for allocated
▎ ports
▎ - Falls back to IP-based matching when the pool is exhausted or the feature is disabled (DeltaPortStart: 0)
▎ - TokenController returns both Port and Hash (matchmakerToken) to the client in the auth response
FangkuaiYa