Reassembly-free rewriting of out-of-order data payload

• US 7,738,380 B1
• Filed: 07/02/2007
• Issued: 06/15/2010
• Est. Priority Date: 07/02/2007
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Yanovsky, Boris, Yanovsky, Roman, Dubrovsky, Aleksandr
• Primary Examiner(s): Pham; Chi H.
• Assistant Examiner(s): HOM, SHICK C
• Application Number:
  US11/772,723
• Time in Patent Office: 1,079 Days
• Field of Search: 370/394, 370/474, 370411-419, 726/3
• US Class Current: 370/235
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

Techniques for reassembly-free rewriting of out-of-order data packet payload are described herein. In one aspect of the invention, in response to packets received at a network access device from a first network node destined to a second network node, the packets are stored in a buffer within the network access device if the packets need to be modified before sending the packets to the second network node. The original our-of-order packets are dropped and do not reach the second network node. The payloads of the packets stored in the buffer are modified and thereafter, the modified packets with the modified payloads are sent to the second network node. Other methods and apparatuses are also described.

Claims

1. A machine implemented method for processing network data packets, comprising:

in response to packets received at a network access device from a first network node over a first network destined to a second network node over a second network, determining whether the packets need to be modified based on one or more policies associated with the packets maintained by the network access device, wherein the packets are out-of-order network packets transmitted from the first network node;

passing the packets to the second network node without buffering the packets within the network access device if the packets do not need to be modified; and

if the packets need to be modified,

storing the packets in a buffer within the network access device before sending the packets to the second network node,

modifying payloads of the packets stored in the buffer, and

transmitting the packets with the modified payloads to the second network node, wherein original packets without modified are not transmitted to the second network node.

2. The method of claim 1, wherein the modified payloads of the packets are TCP payloads of the packets.

3. The method of claim 1, wherein storing the packets in the buffer comprises buffering a segment of the packets sufficient enough to cover an area that needs to be modified.

4. The method of claim 3, further comprising passing subsequent packets to the second network node without buffering once the segment of the packets has been buffered and modified, and sent to the second network node.

5. The method of claim 1, further comprising calculating a checksum value for the modified packets prior to sending the modified packets to the second network node, wherein the checksum value is used to verify the modified packets by the second network node.

6. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform a method for processing network data packets, the method comprising:

in response to packets received at a network access device from a first network node over a first network destined to a second network node over a second network, determining whether the packets need to be modified based on one or more policies associated with the packets maintained by the network access device, wherein the packets are out-of-order network packets transmitted from the first network;

passing the packets to the second network node without buffering the packets within the network access device if the packets do not need to be modified; and

if the packets need to be modified,

storing the packets in a buffer within the network access device before sending the packets to the second network node,

modifying payloads of the packets stored in the buffer, and

transmitting the packets with the modified payloads to the second network node, wherein original packets without modified are not transmitted to the second network node.

7. The non-transitory machine-readable medium of claim 6, wherein the modified payloads of the packets are TCP payloads of the packets.

8. The non-transitory machine-readable medium of claim 6, wherein storing the packets in the buffer comprises buffering a segment of the packets sufficient enough to cover an area that needs to be modified.

9. The non-transitory machine-readable medium of claim 8, wherein the method further comprises passing subsequent packets to the second network node without buffering once the segment of the packets has been buffered and modified, and sent to the second network node.

10. The non-transitory machine-readable medium of claim 6, wherein the method further comprises calculating a checksum value for the modified packets prior to sending the modified packets to the second network node, wherein the checksum value is used to verify the modified packets by the second network node.

11. A network access device for routing network data packets, comprising:

an ingress interface to receive packets from a first network node over a first network destined to a second network node over a second network, wherein the packets are out-of-order network packets;

a policy module to maintain one or more policies to determine whether the packets need to be modified;

a buffer coupled to temporarily store the packets if the packets need to be modified before sending the packets to the second network node, without sending the packets to the second network node;

a packet reassembly logic coupled to the buffer to modify payloads of the packets stored in the buffer if the packets need to be modified, wherein the packet reassembly logic is configured to pass the packets to the second network node without buffering the packets in the buffer if the packets do not need to be modified; and

an egress interface to transmit the packets having the modified payloads to the second network node over the second network, wherein original packets without modified are not transmitted to the second network node, if the packets need to be modified.

12. The network access device of claim 11, wherein the buffer is configured to store a segment of the packets sufficient enough to cover an area that needs to be modified.

13. The network access device of claim 12, wherein the packet reassembly logic is configured to pass subsequent packets to the second network node without buffering once the segment of the packets has been buffered and modified, and sent to the second network node.

14. The network access device of claim 11, wherein the packet reassembly logic is configured to calculate a checksum value for the modified packets prior to sending the modified packets to the second network node, wherein the checksum value is used to verify the modified packets by the second network node.