SYSTEMS AND METHODS FOR CONFIGURING FLOW CONTROL OF POLICY EXPRESSIONS

• US 20080225720A1
• Filed: 03/12/2007
• Published: 09/18/2008
• Est. Priority Date: 03/12/2007
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Bandekar, Vishal, Khemani, Prakash
• Granted Patent: US 7,853,678 B2
• Time in Patent Office: Days
• US Class Current: 370/235
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1012 based on compliance of requirements or conditions with available server resources
• CPC Class Codes: H04L 67/1014 based on the content of a request
• CPC Class Codes: H04L 67/1029 using data related to the state of servers by a load balancer
• CPC Class Codes: H04L 67/1031 Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests
• CPC Class Codes: H04L 67/1034 Reaction to server failures by a load balancer
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Systems and methods for configuring and evaluating policies that direct processing of one or more data streams are described. A configuration interface is described for allowing users to specify object oriented policies. These object oriented policies may allow any data structures to be applied with respect to a payload of a received packet stream, including any portions of HTTP traffic. A configuration interface may also allow the user to control the order in which policies and policy groups are executed, in addition to specifying actions to be taken if one or more policies are undefined. Systems and methods for processing the policies may allow efficient processing of object-oriented policies by applying potentially complex data structures to unstructured data streams. A device may also interpret and process a number of flow control commands and policy group invocation statements to determine an order of execution among a number of policies and policy groups. These policy configurations and processing may allow configuration and processing of complex network behaviors relating to load balancing, VPNs, SSL offloading, content switching, application security, acceleration, and caching.

Claims

1. A method of configuring a network device to specify flow control among policies used in processing a packet stream, the method comprising:

(a) providing a configuration interface for configuring a plurality of policies of a network device, at least one policy of the plurality of policies comprising a policy identifier; and

(b) receiving, via the configuration interface, information identifying a first policy of the plurality of policies, the first policy identifying (i) a rule comprising a first expression and (ii) a first action to be taken based on an evaluation of the rule; and

(c) receiving, via the configuration interface, information identifying a second policy of the plurality of policies to apply subsequent to the first policy if the rule evaluates to true.

2. The method of claim 1, wherein step (a) comprises providing a command-line configuration interface.

3. The method of claim 1, wherein step (a) comprises providing a configuration interface comprising one or more of a drag-and-drop interface, a list-selection interface, or a syntax-highlighting interface.

4. The method of claim 1, wherein step (a) comprises executing the configuration interface on a device in communication with the network device.

5. The method of claim 1, wherein step (a) comprises executing the configuration interface on the network device.

6. The method of claim 1, wherein the first expression is an object-oriented expression.

7. The method of claim 1, wherein the first action comprises no action.

8. The method of claim 1, wherein the first action specifies a function performing one of:

load balancing, content switching, application security, application delivery, network acceleration, or application acceleration.

9. The method of claim 1, wherein step (c) comprises receiving an integer specifying a line number of a second policy.

10. The method of claim 1, wherein step (c) comprises receiving an policy identifier specifying a second policy.

11. The method of claim 1, wherein step (c) comprises receiving an expression to be evaluated at runtime to specify a line number of a second policy.

12. The method of claim 1, wherein step (c) comprises receiving an object-oriented expression to be evaluated at runtime to specify a line number of a second policy.

13. The method of claim 1, wherein the plurality of policies comprises a policy bank.

14. The method of claim 1, wherein each policy of the plurality of policies comprises a ranking indicating a default order in which the policies will be processed by a network device.

15. A method of flow control among policies used in a network device processing a packet stream, the method comprising:

(a) identifying, by an appliance, a plurality of policies to apply to a received packet stream, at least one policy of the plurality of policies comprising a policy identifier;

(b) processing, by the appliance, a first policy of the plurality of policies, the first policy identifying (i) a rule comprising a first expression and (ii) a first action to be taken based on an evaluation of the rule, and (iii) a second policy of the plurality of policies;

(c) determining, by the appliance based on an evaluation of the expression, the rule evaluates to true; and

(d) processing, by the appliance in response to the determination, the identified second policy.

16. The method of claim 15, wherein step (c) comprises evaluating an object-oriented expression.

17. The method of claim 15, further comprising the step of performing, in response to the determination, an action identified by the first policy.

18. The method of claim 15, further comprising the step of executing, in response to the determination, an action identified by the first policy;

the action comprising performing one of;

load balancing, content switching, application security, application delivery, network acceleration, or application acceleration.

19. The method of claim 15, wherein the first policy comprises an integer specifying a ranking of a second policy of the plurality of policies to be processed next if the first action applies.

20. The method of claim 15, wherein step (d) comprises evaluating, by the appliance, an expression to determine a ranking of a second policy of the plurality of policies to be processed next.

21. The method of claim 15, wherein step (d) comprises evaluating, by the appliance, an object oriented expression to determine a ranking of a second policy of the plurality of policies to be processed next.

22. The method of claim 15, wherein the plurality of policies comprises a policy bank.

23. The method of claim 15, wherein each policy of the plurality of policies comprises a ranking indicating a default order in which the policies should be processed.

24. The method of claim 15, further comprising storing in a list, in response to the determination, an action identified by the first policy.

25. The method of claim 24, further comprising storing, in the list, at least one other action, the at least one other action identified in at least one other policy having a rule evaluated to true.

26. The method of claim 25 further comprising performing each action stored in the list of actions.

27. An appliance providing flow control among policies used in a network device processing a packet stream, the appliance comprising:

a packet processor which receives a packet stream; and

a policy engine which identifies a plurality of policies to apply to a received packet stream, at least one policy of the plurality of policies comprising a policy identifier;

processes a first policy of the plurality of policies, the first policy identifying (i) a rule comprising a first expression and (ii) a first action to be taken based on an evaluation of the rule, and (iii) a second policy of the plurality of policies;

determines, based on an evaluation of the expression, the rule evaluates to true; and

processes, by the appliance in response to the determination, the identified second policy.

28. The system of claim 27, wherein the policy engine evaluates an object-oriented expression.

29. The system of claim 27, wherein the policy engine performs, in response to the determination, an action identified by the first policy.

30. The system of claim 27, wherein the policy engine performs, in response to the determination, an action identified by the first policy;

the action comprising performing one of;

load balancing, content switching, application security, application delivery, network acceleration, or application acceleration.

31. The system of claim 27, wherein the first policy comprises an integer specifying a ranking of a second policy of the plurality of policies to be processed next if the first action applies.

32. The system of claim 27, wherein the policy engine evaluates an expression to determine a ranking of a second policy of the plurality of policies to be processed next.

33. The system of claim 27, wherein the policy engine evaluates an object oriented expression to determine a ranking of a second policy of the plurality of policies to be processed next.

34. The system of claim 27, wherein the plurality of policies comprises a policy bank.

35. The system of claim 27, wherein each policy of the plurality of policies comprises a ranking indicating a default order in which the policies should be processed.

36. The system of claim 27, wherein the policy engine stores in a list, in response to the determination, an action identified by the first policy.

37. The system of claim 36, wherein the policy engine stores, in the list, at least one other action, the at least one other action identified in at least one other policy having a rule evaluated to true.

38. The system of claim 37, wherein the policy engine performs each action stored in the list of actions.