SYSTEMS AND METHODS FOR CONFIGURATION DRIVEN REWRITE OF SSL VPN CLIENTLESS SESSIONS

• US 20090193126A1
• Filed: 01/26/2009
• Published: 07/30/2009
• Est. Priority Date: 01/26/2008
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Thirunarayanan, Srinivasan, Korrapatti, Vamsi, Mirani, Rajiv, Agarwal, Puneet, Khemani, Prakash, Reddy, Anoop
• Granted Patent: US 8,667,146 B2
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable

Abstract

The present disclosure provides solutions for an enterprise providing services to a variety of clients to enable the client to use the resources provided by the enterprise by modifying URLs received and the URLs from the responses from the servers to the client'"'"'s requests before forwarding the requests and the responses to the intended destinations. An intermediary may identify an access profile for a clients'"'"' request to access a server via a clientless SSL VPN session. The intermediary may detect one or more URLs in content served by the server in response to the request using one or more regular expressions of the access profile. The intermediary may rewrite or modify, responsive to detecting, the one or more detected URLs in accordance with a URL transformation specified by one or more rewrite policies of the access profile. The response with modified URLs may be forwarded to the client.

Claims

1. A method for rewriting by an intermediary content transmitted via a clientless secure socket layer virtual private network (SSL VPN) session between a client and a server, the method comprising:

a) identifying, by an intermediary, an access profile for a request from a client to access a server via a clientless SSL VPN session established between the client and the server, the access profile comprising a first rewrite policy for rewriting uniform resource locators (URLs) and one or more regular expressions to detect one or more URLs in content served by the server;

b) detecting, by the intermediary responsive to the one or more regular expressions of the access profile, one or more URLs in content served by the server in response to the request; and

c) rewriting, by the intermediary responsive to detecting, the one or more detected URLs in accordance with a URL transformation specified by the first rewrite policy.

2. The method of claim 1, wherein step (a) further comprises identifying by the intermediary the access profile comprising a plurality of regular expressions, each of the plurality of regular expressions for detecting one or more URLs in a type of content of a plurality of different types of content and step (b) further comprises identifying one or more types of content in the content served by the server.

3. The method of claim 1, wherein step (a) further comprises identifying by the intermediary the access profile comprising a regular expression for detecting a URL in content comprising JavaScript.

4. The method of claim 1, wherein step (a) further comprises identifying by the intermediary the access profile comprising a regular expression for detecting a URL in content comprising Extensible Markup Language (XML).

5. The method of claim 1, wherein step (a) further comprises identifying by the intermediary the access profile comprising a regular expression for detecting a URL in content comprising Cascading Style Sheets (CSS).

6. The method of claim 1, wherein step (b) further comprises detecting, by the intermediary responsive to a first regular expression identified by the access profile, one or more uniform resource locators (URLs) in a first type of content of the response and detecting, responsive to a second regular expression identified by the access profile, one or more URLs in a second type of content of the response.

7. The method of claim 1, wherein step (c) further comprises rewriting, by the intermediary, portions of JavaScript of the content in accordance with a JavaScript transformation specified by a second rewrite policy associated with the identified access profile.

8. The method of claim 1, wherein step (a) further comprising identifying, by the intermediary, the access profile comprising a second rewrite policy to rewrite a header of the request header and rewriting the header of the request in accordance with a transformation specified by the rewrite policy prior to transmission to the server.

9. The method of claim 1, wherein step (a) further comprising identifying, by the intermediary, the access profile comprising a second rewrite policy to rewrite a header of the response and step (c) further comprises rewriting the header of the response in accordance with a transformation specified by the second rewrite policy prior to transmission to the client.

10. The method of claim 1, wherein step (a) comprises identifying, by the intermediary, the access profile from a plurality of access profiles based on determining an application requested via the request.

11. An intermediary for rewriting content transmitted via a clientless secure socket layer virtual private network (SSL VPN) session between a client and a server, the intermediary comprising:

a policy engine for identifying an access profile for a request from a client to access a server via a clientless SSL VPN session established between the client and the server, the access profile comprising a first rewrite policy for rewriting uniform resource locators (URLs) and one or more regular expressions to detect one or more URLs in content served by the server;

a detector for detecting responsive to the one or more regular expressions of the access profile, one or more URLs in content served by the server in response to the request; and

a rewriter for rewriting responsive to the detector the one or more detected URLs in accordance with a URL transformation specified by the first rewrite policy.

12. The intermediary of claim 11, wherein the policy engine identifies the access profile comprising a plurality of regular expressions, each of the plurality of regular expressions for detecting one or more URLs in a type of content of a plurality of different types of content and the detector determines one or more types of content in the content served by the server.

13. The intermediary of claim 11, wherein the policy engine identifies the access profile comprising a regular expression for detecting a URL in content comprising JavaScript.

14. The intermediary of claim 11, wherein the policy engine identifies the access profile comprising a regular expression for detecting a URL in content comprising Extensible Markup Language (XML).

15. The intermediary of claim 11, wherein the policy engine identifies the access profile comprising a regular expression for detecting a URL in content comprising Cascading Style Sheets (CSS).

16. The intermediary of claim 11, wherein the detector detects responsive to a first regular expression identified by the access profile, one or more uniform resource locators (URLs) in a first type of content of the response and detects responsive to a second regular expression identified by the access profile, one or more URLs in a second type of content of the response.

17. The intermediary of claim 11, wherein the rewriter rewrites portions of JavaScript of the content in accordance with a JavaScript transformation specified by a second rewrite policy associated with the identified access profile.

18. The intermediary of claim 11, wherein the policy engine identifies the access profile comprising a second rewrite policy to rewrite a header of the request header and rewriting the header of the request in accordance with a transformation specified by the rewrite policy prior to transmission to the server.

19. The intermediary of claim 11, wherein the policy engine identifies the access profile comprising a second rewrite policy to rewrite a header of the response and the rewriter rewrites the header of the response in accordance with a transformation specified by the second rewrite policy prior to transmission to the client.

20. A method for rewriting by an intermediary content transmitted via a clientless secure socket layer virtual private network (SSL VPN) session between a client and a server, the method comprising:

a) identifying, by an intermediary, an access profile for a clientless SSL VPN session established between a client and a server, the access profile comprising a plurality of rewrite policies and a plurality of regular expressions, each of the plurality of rewrite policies specify a transformation for a type of content, and each of the plurality of regular expressions specify a regular expression to detect uniform resource locators (URLs) in each of a plurality of types of content;

b) determining, by the intermediary, the type of content served by the server in response to the request;

c) detecting, by the intermediary, one or more URLs in the content based on the regular expression specified for the determined type of content via the access profile; and

d) rewriting, by the intermediary, a portion of the content based on the type of content and a rewrite policy from the plurality of rewrite policies for the type of content.