System and method to process a chain of network applications

• US 10,318,288 B2
• Filed: 01/13/2016
• Issued: 06/11/2019
• Est. Priority Date: 01/13/2016
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Jalan, Rajkumar, Sampat, Rishi, Sankar, Swaminathan
• Primary Examiner(s): Parry, Chris
• Assistant Examiner(s): Chouat, Abderrahmen
• Application Number:
  US14/995,136
• Publication Number:
  US 20170201418A1
• Time in Patent Office: 1,245 Days
• CPC Class Codes: G06F 9/00 Arrangements for program control, e.g. control units program control for peripheral devices G06F13/10
• CPC Class Codes: H04L 41/5051 Service on demand, e.g. definition and deployment of services in real time

Abstract

Facilitation of processing a chain of network applications by a network controller is provided herein. In some examples, a network controller comprising a fast path module receives a service request data packet from a client side session between a client and the network controller and determines that the service request data packet matches a network application chain order, the network application chain order indicating a configuration to apply a plurality of network applications. The fast path module processes the service request data packet according to the configuration indicated in the network application chain order.

Claims

1. A network controller, comprising:

a fast path module for processing data packets, the fast path module stored in memory at the network controller and executed by at least one processor, wherein the fast path module;

receives a service request data packet from a client side session between a client and the network controller;

determines that the service request data packet matches a network application chain order, the network application chain order indicating a configuration to apply a plurality of network applications, the plurality of network applications residing on the network controller;

sends the service request data packet to a first indicated network application of the plurality of network applications for processing;

sends a session context to the first indicated network application, the session context including an entry of a session table and an indication for the first indicated network application to process the service request data, the entry including the session context being pre-stored in the fast path module;

receives a modified service request data packet and a modified session context back from the first indicated network application after processing;

sends the modified service request data packet and the modified session context to a second indicated network application of the plurality of network applications for processing based on the network application chain order,

sends the modified session context to the second indicated network application, the modified session context further including an indication for the second indicated network application to process the service request data packet;

receives a further modified service request data packet and a further modified session context back from the second indicated network application;

sends the further modified service request data packet to a server;

receives a data packet from a server side session between a server and the network controller;

determines that the data packet matches the network application chain order;

sends the data packet to the second indicated network application;

receives the data packet back from the second indicated network application;

sends the data packet to the first indicated network application;

receives the data packet back from the first indicated network application; and

sends the data packet to the client.

2. The network controller of claim 1, wherein the network application chain order indicates:

a first network application of the plurality of network applications is to be applied before a second network application of the plurality of network applications for a service request data packet from a client to a server; and

the second network application is to be applied before the first network application for a data packet from the server to the client.

3. The network controller of claim 1, wherein the network application chain order indicates a first network application of the plurality of network applications is to be applied before a second network application of the plurality of network applications for a service request data packet from a client to a server and for a data packet from a server to the client.

4. The network controller of claim 1, wherein the service request data packet received back from the first indicated network application is modified by the first indicated network application.

5. The network controller of claim 1, wherein the service request data packet received back from the second indicated network application is modified by the second indicated network application.

6. The network controller of claim 1, wherein the network application chain order is created implicitly by a user or explicitly by a policy.

7. The network controller of claim 1, wherein the plurality of network applications process the service request data packet in conjunction with the fast path module by

determining by the fast path module if the service request data packet matches the session context of the session table;

and

based on the determining the service request data matches the session context, processing by the fast path module the service request data packet according to the session context.

8. The network controller of claim 7, wherein the processing by the fast path module the service request data packet according to the session context comprises modifying at least one network address of the service request data packet.

9. The network controller of claim 7, wherein the processing by the fast path module the service request data packet according to the session context comprises modifying the payload of service request data packet.

10. The network controller of claim 7, further comprising based on the determining the service request data matches the session context, determining by the fast path module if the service request data packet matches a service entry in a service table.

11. A method for processing a chain of network applications by a network controller implemented by a processor, comprising:

receiving, by a fast path module of the network controller implemented by the processor, a service request data packet from a client side session between a client and the network controller;

determining that the service request data packet matches a network application chain order, the network application chain order indicating a configuration to apply a plurality of network applications, the plurality of network applications residing on the network controller;

sending, by the fast path module, the service request data packet to a first indicated network application of the plurality of network applications for processing;

sending, by the fast path module, a session context to the first indicated network application, the session context including an entry of a session table and an indication for the first indicated network application to process the service request data, the entry including the session context being pre-stored in the fast path module;

receiving a modified service request data packet and a modified session context back from the first indicated network application after processing;

sending, by the fast path module, the modified service request data packet and the modified session context to a second indicated network application of the plurality of network applications for processing based on the network application chain order;

sending, by the fast path module, the modified session context to the second indicated network application, the modified session context further including an indication for the second indicated network application to process the service request data packet;

receiving a further modified service request data packet and a further modified session context back from the second indicated network application;

sending the service request data packet to a server;

receiving, by a fast path module of the network controller implemented by the processor, a data packet from a server side session between a server and the network controller;

determining that the data packet matches the network application chain order;

sending the data packet to the second indicated network application;

receiving the data packet back from the second indicated network application;

sending the data packet to the first indicated network application;

receiving the data packet back from the first indicated network application; and

sending the data packet to the client.

12. The method of claim 11, wherein the network application chain order indicates:

a first network application is to be applied before a second network application for a service request data packet from a client to a server and

the second network application is to be applied before the first network application for a data packet from the server to the client.

13. The method of claim 11, wherein the network application chain order indicates a first network application is to be applied before a second network application for a service request data packet from a client to a server and for a data packet from a server to the client.

14. The method of claim 11, wherein the service request data packet received back from the first indicated network application is modified by the first indicated network application.

15. The method of claim 11, wherein the service request data packet received back from the second indicated network application is modified by the second indicated network application.

16. The method of claim 11, wherein the network application chain order is created implicitly by a user or explicitly by a policy.

17. The method of claim 11, wherein the plurality of network applications process the service request data packet in conjunction with the fast path module by:

determining by the fast path module if the service request data packet matches the session context of the session table; and

based on the determining the service request data matches the session context, processing by the fast path module the service request data packet according to the session context.

18. The network controller of claim 17, wherein the processing by the fast path module the service request data packet according to the session context comprises modifying at least one network address of the service request data packet.

19. The network controller of claim 17, wherein the processing by the fast path module the service request data packet according to the session context comprises modifying the payload of service request data packet.

20. The network controller of claim 17, further comprising based on the determining the service request data matches the session context, determining by the fast path module if the service request data packet matches a service entry in a service table.

21. A network controller, comprising:

a fast path module for processing data packets, the fast path module stored in memory at the network controller and executed by at least one processor, wherein the fast path module;

receives a service request data packet from a client side session between a client and the network controller;

determines if at least one network address of the service request data packet matches a session context in a session table;

based on the determining there is no match, determines that the at least one network address of the service request data packet matches a service entry in a service table, the service table comprising an indication to apply a network application chain order, the network application chain order indicating a configuration to apply a plurality of network applications, the plurality of network applications residing on the network controller;

creates a session context to store the service request data packet, the service request data packet comprising an association of the service request data packet to the network application chain order;

sends the service request data packet and the session context to a first indicated network application of the plurality of network applications for processing;

sends the session context to the first indicated network application, the session context including an entry of the session table and an indication for the first indicated network application to process the service request data, the entry including the session context being pre-stored in the fast path module;

receives a modified service request data packet and a modified session context modified by the first indicated network application after processing;

sends the modified service request data packet and the modified session context to a second indicated network application of the plurality of network applications for processing based on the network application chain order;

sending, by the fast path module, the modified session context and the modified service request data packet to the second indicated network application, the modified session context including an indication for the second indicated network application to process the modified service request data packet;

receives a further modified service request data packet and a further modified session context further modified by the second indicated network application;

receives a data packet from a server side session between a server and the network controller;

matches at least one network address of the data packet to a session context in the session table, the session context associated with the network application chain order;

sends the data packet and the session context to the first indicated network application;

receives the data packet and the session context modified by the first indicated network application;

sends the modified data packet and modified session context to the second indicated network application;

receives the modified data packet and modified session context further modified by the second indicated network application;

determines no other network applications are to be applied; and

sends the modified data packet to the client.

22. The network controller of claim 21, wherein the fast path module further:

determines whether additional network applications are to be applied; and

based on the determining no additional network applications are to be applied, stores the modified session context into the session table.

23. A method for processing a chain of network applications by a network controller implemented by a processor, comprising:

receiving, by a fast path module of the network controller implemented by the processor, a service request data packet from a client side session between a client and the network controller;

determining if at least one network address of the service request data packet matches a session context in a session table;

based on the determining there is no match, determining that the at least one network address of the service request data packet matches a service entry in a service table, the service table comprising an indication to apply a network application chain order, the network application chain order indicating a configuration to apply a plurality of network applications, the plurality of network applications residing on the network controller;

creating a session context to store the service request data packet, the service request data packet comprising an association of the service request data packet to the network application chain order;

sending the service request data packet and the session context to a first indicated network application of the plurality of network applications for processing;

sending the session context to the first indicated network application, the session context including an entry of the session table and an indication for the first indicated network application to process the service request data, the entry including the session context being pre-stored in the fast path module;

receiving a modified service request data packet and a modified session context modified by the first indicated network application after processing;

sending the modified service request data, packet and the modified session context to a second indicated network application of the plurality of network applications for processing based on the network application chain order;

sending a modified session context and the modified service request data packet to the second indicated network application, the modified session context including an indication for the second indicated network application to process the modified service request data packet;

receiving a further modified service request data packet and a further modified session context further modified by the second indicated network application;

receiving a data packet from a server side session between a server and the network controller;

matching at least one network address of the data packet to a session context in the session table, the session context associated with the network application chain order;

sending the data packet and the session context to the first indicated network application;

receiving the data packet and the session context modified by the first indicated network application;

sending the modified data packet and modified session context to the second indicated network application;

receiving the modified data packet and modified session context further modified by the second indicated network application;

determining no other network applications are to be applied; and

sending the modified data packet to the client.

24. The method of claim 23, further comprising:

determining whether additional network applications are to be applied and

based on the determining no additional network applications are to be applied, storing the modified session context into the session table.