Gateway apparatus, packet forwarding method, and program

• US 7,969,976 B2
• Filed: 12/18/2008
• Issued: 06/28/2011
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Ishikawa, Yuichi, Yamaguchi, Ichiro
• Primary Examiner(s): Kumar; Pankaj
• Assistant Examiner(s): Foud; Hicham B
• Application Number:
  US12/337,983
• Publication Number:
  US 20090161680A1
• Time in Patent Office: 922 Days
• Field of Search: None
• US Class Current: 370/389
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

The present invention provides a gateway apparatus and a packet forwarding method for rewriting the application header of a forwarded packet without terminating a TCP connection between a client and a server. For that purpose, the gateway apparatus in accordance with the present invention uses the conversion section 116 of the gateway module 110 to register, in a conversion table 117, a pair of a sequence number (Seq#) which is expected to be contained in the TCP header of a next packet to forward and a Seq# after conversion which is obtained by considering a change in packet size due to application (AP) header rewriting as a pair of an expected Seq# and a conversion Seq# as well as a pair of an expected Ack# and a conversion Ack# contained in the TCP header of a packet in a direction opposite to that of the previously forwarded packet at the time of forwarding. Then, the conversion section 116 refers to the conversion table 117 at next packet forwarding to rewrite the Seq# and the Ack# contained in the TCP header of a packet to forward to the conversion Seq# and conversion Ack# corresponding to the expected Seq# and expected Ack# matching these numbers.

Claims

1. A gateway apparatus for rewriting and forwarding an application header, namely, data following a TCP header of a packet flowing over a TCP connection between terminals, comprising:

a number conversion table including an entry for registering a pair of a sequence number which is expected to be contained in the TCP header of a next packet to forward and a sequence number after conversion which is obtained by considering a change in packet size due to application header rewriting as a pair of an expected sequence number and a conversion sequence number as well as a pair of an expected Ack number and a conversion Ack number contained in the TCP header of a packet in a direction opposite to that of the forwarded packet at the time of forwarding the packet; and

a conversion unit for performing number rewriting process of rewriting the sequence number and the Ack number contained in the TCP header of a packet to forward to the conversion sequence number and the conversion Ack number corresponding to the expected sequence number and the expected Ack number matching these numbers by referring to the number conversion table at the time of forwarding the packet.

2. The gateway apparatus according to claim 1, wherein the number conversion table includes an entry including a pair of an expected sequence number and a conversion sequence number;

and

an entry including a pair of an expected Ack number and a conversion Ack number, which are registered for each direction of forwarding the packet,

wherein a number rewriting process performed by the conversion unit searches the number conversion table for an entry having the expected sequence number and the expected Ack number having the same forwarding direction as that of the forwarded packet and matching the sequence number and the Ack number of the TCP header of the forwarded packet, and rewrites the sequence number and the Ack number of the TCP header of the forwarded packet to the conversion sequence number and the conversion Ack number written in the found entry.

3. The gateway apparatus according to claim 2, wherein, in addition to the number rewriting process, the conversion unit further performs a number conversion table management process;

wherein the number conversion table management process includes a same forwarding direction entry registration process of registering an entry having the same forwarding direction as that of the forwarded packet and an opposite forwarding direction entry registration process of registering an entry having the opposite forwarding direction to that of the forwarded packet;

wherein the same forwarding direction entry registration process registers in the number conversion table an entry having the expected sequence number which is a sum of the sequence number of the TCP header of the forwarded packet and the application header size before rewriting process of the sequence number and the Ack number and application header rewriting process of the forwarded packet, and having the conversion sequence number which is a sum of the sequence number of the TCP header of the forwarded packet and the application header size after rewriting process of the sequence number and the Ack number and the application header rewriting process; and

wherein the opposite forwarding direction entry registration process registers in the number conversion table an entry having the same conversion Ack number as the expected sequence number of the entry registered in the same forwarding direction entry registration process, and having the same expected Ack number as the conversion sequence number of the entry registered in the same forwarding direction entry registration process.

4. The gateway apparatus according to claim 1, further comprising:

a rewriting position management table in which an entry having a pair of the sequence number and the application header rewriting position of the packet is registered for each direction of forwarding the packet;

an application header parse unit performing a rewriting position search process of searching for the rewriting position by analyzing the application header of the forwarded packet, and a rewriting position management table management process of registering the entry containing the rewriting position found in the rewriting position search process in the rewriting position management table; and

an application header rewriting unit performing an application header rewriting process of rewriting the application header of the forwarded packet by referring to the rewriting position management table.

5. The gateway apparatus according to claim 4, wherein the application header rewriting position search process is not performed on the packet of the forwarded packet whose entry having the same expected sequence number as the sequence number has already been registered in the number conversion table.

6. The gateway apparatus according to claim 1, wherein, in the number conversion table management process, the conversion unit further performs:

an Ack reach packet detection process of confirming an Ack reach packet guaranteeing that the corresponding Ack is delivered from the receiving side to the sending side of the packet; and

a number conversion table entry deletion process of deleting an entry having the same forwarding direction as that of the Ack reach packet and having a smaller expected sequence number than the sequence number of the Ack reach packet and an entry having the opposite forwarding direction to that of the Ack reach packet and having a smaller conversion Ack number than the sequence number of the Ack reach packet from the number conversion table.

7. The gateway apparatus according to claim 4, wherein, in the rewriting position management table management process, the application header parse unit further performs:

an Ack reach packet detection process of confirming an Ack reach packet guaranteeing that the corresponding Ack is delivered from the receiving side to the sending side; and

a rewriting position management table entry deletion process of deleting an entry having the same forwarding direction as that of the Ack reach packet and having a smaller sequence number than the sequence number of the Ack reach packet from the rewriting position management table.

8. The gateway apparatus according to claim 6, wherein the Ack reach packet detection process confirms, as the Ack reach packet, the packet having a smaller sequence number than the value obtained by subtracting a maximum receive Window Size usable on the TCP connection calculated based on a Window Scale option value determined at the TCP connection establishment from the sequence number of the packet last intercepted on the TCP connection.

9. The gateway apparatus according to claim 6, wherein the Ack reach packet detection process confirms, as the Ack reach packet, the packet having a smaller sequence number than the value obtained by subtracting a maximum Window Size reported from the packet received side at the TCP connection after the TCP connection establishment from the sequence number of the packet last intercepted on the TCP connection.

10. The gateway apparatus according to claim 4, further comprising a buffer for storing a forwarded packet, and a packet buffer unit for performing a message start/end position search process of detecting the start and end positions of an application protocol message and notifying the application header parse unit thereof,

wherein, when the message start/end position search process detects the end position of the application protocol message in the last stored packet and the application header parse unit completes the analysis of the message, the packet buffer unit erases all the packets except the last stored packet from the buffer.

11. The gateway apparatus according to claim 10, wherein the packet buffer unit does not store, in the buffer, the packet of the forwarded packet whose entry having the same expected sequence number as the sequence number has already been registered in the number conversion table.

12. A packet forwarding method for rewriting and forwarding an application header, namely, data following a TCP header of a packet flowing over a TCP connection between terminals in a gateway apparatus, comprising:

a step in which the gateway apparatus registers, in a number conversion table, a pair of a sequence number which is expected to be contained in the TCP header of a next packet to forward and a sequence number after conversion which is obtained by considering a change in packet size due to application header rewriting as a pair of an expected sequence number and a conversion sequence number as well as a pair of an expected Ack number and a conversion Ack number contained in the TCP header of a packet in a direction opposite to that of the previously forwarded packet at the time of forwarding the packet; and

a step in which the gateway apparatus performs number rewriting process of rewriting the sequence number and the Ack number contained in the TCP header of a packet to forward to the conversion sequence number and the conversion Ack number corresponding to the expected sequence number and the expected Ack number matching these numbers by referring to the number conversion table at the time of forwarding the packet.

13. The packet forwarding method according to claim 12, wherein the number conversion table includes an entry including a pair of an expected sequence number and a conversion sequence number;

and

an entry including a pair of an expected Ack number and a conversion Ack number, which are registered for each direction of forwarding the packet;

the number rewriting process searches the number conversion table for an entry having the expected sequence number and the expected Ack number having the same forwarding direction as that of the forwarded packet and matching the sequence number and the Ack number of the TCP header of the forwarded packet, and rewrites the sequence number and the Ack number of the TCP header of the forwarded packet to the conversion sequence number and the conversion Ack number written in the found entry.

14. The packet forwarding method according to claim 13, wherein the gateway apparatus includes a step of performing a number conversion table management process;

wherein the number conversion table management process includes a same forwarding direction entry registration process of registering an entry having the same forwarding direction as that of the forwarded packet and an opposite forwarding direction entry registration process of registering an entry having the opposite forwarding direction to that of the forwarded packet

wherein the same forwarding direction entry registration process registers, in the number conversion table, an entry having the expected sequence number which is a sum of the sequence number of the TCP header of the forwarded packet and the application header size before rewriting process of the sequence number and the Ack number and application header rewriting process of the forwarded packet, and having the conversion sequence number which is a sum of the sequence number of the TCP header of the forwarded packet and the application header size after rewriting process of the sequence number and the Ack number and the application header rewriting process;

wherein the opposite forwarding direction entry registration process registers, in the number conversion table, an entry having the same conversion Ack number as the expected sequence number of the entry registered in the same forwarding direction entry registration process, and having the same expected Ack number as the conversion sequence number of the entry registered in the same forwarding direction entry registration process.

15. The packet forwarding method according to claim 12, wherein the gateway apparatus includes a rewriting position management table in which an entry having a pair of the sequence number and the application header rewriting position of the packet is registered for each direction of forwarding the packet;

the method comprising;

a step in which the gateway apparatus performs a rewriting position search process of searching for the rewriting position by analyzing the application header of the forwarded packet, and a rewriting position management table management process of registering the entry containing the rewriting position found in the rewriting position search process in the rewriting position management table; and

a step in which the gateway apparatus performs an application header rewriting process of rewriting the application header of the forwarded packet by referring to the rewriting position management table.

16. The packet forwarding method according to claim 15, the gateway apparatus does not perform the application header rewriting position search process on the packet of the forwarded packet whose entry having the same expected sequence number as the sequence number has already been registered in the number conversion table.

17. The packet forwarding method according to claim 12, comprising a step in which the gateway apparatus performs an Ack reach packet detection process of confirming an Ack reach packet guaranteeing that the corresponding Ack is delivered from the receiving side to the sending side of the packet;

and

a number conversion table entry deletion process of deleting an entry having the same forwarding direction as that of the Ack reach packet and having a smaller expected sequence number than the sequence number of the Ack reach packet and an entry having the opposite forwarding direction to that of the Ack reach packet and having a smaller conversion Ack number than the sequence number of the Ack reach packet from the number conversion table.

18. The packet forwarding method according to claim 15 further comprising a step in which the gateway apparatus performs an Ack reach packet detection process of confirming an Ack reach packet guaranteeing that the corresponding Ack is delivered from the receiving side to the sending side;

and

a rewriting position management table entry deletion process of deleting an entry having the same forwarding direction as that of the Ack reach packet and having a smaller sequence number than the sequence number of the Ack reach packet from the rewriting position management table.

19. The packet forwarding method according to claim 17, wherein the Ack reach packet detection process confirms, as the Ack reach packet, the packet having a smaller sequence number than the value obtained by subtracting a maximum receive Window Size usable on the TCP connection calculated based on a Window Scale option value determined at the TCP connection establishment from the sequence number of the packet last intercepted on the TCP connection.

20. The packet forwarding method according to claim 17, wherein the Ack reach packet detection process confirms, as the Ack reach packet, the packet having a smaller sequence number than the value obtained by subtracting a maximum Window Size reported from the packet received side at the TCP connection after the TCP connection establishment from the sequence number of the packet last intercepted on the TCP connection.

21. The packet forwarding method according to claim 15, wherein the gateway apparatus comprises a buffer for storing a forwarded packet, the method comprising:

a step in which the gateway apparatus performs a message start/end position search process of detecting the start and end positions of an application protocol message and notifying the application header parse unit thereof; and

a step in which when the message start/end position search process detects the end position of the application protocol message in the last stored packet and the application header parse unit completes the analysis of the message, the gateway apparatus erases all the packets except the last stored packet from the buffer.

22. The packet forwarding method according to claim 21, wherein the gateway apparatus does not store, in the buffer, the packet of the forwarded packet whose entry having the same expected sequence number as the sequence number has already been registered in the number conversion table.

23. A non-transitory storage medium for storing a program causing a computer including a gateway apparatus for rewriting and forwarding an application header, namely, data following a TCP header of a packet flowing over a TCP connection between terminals,

which includes a number conversion table including an entry for registering a pair of a sequence number which is expected to be contained in the TCP header of a next packet to forward and a sequence number after conversion which is obtained by considering a change in packet size due to application header rewriting as a pair of an expected sequence number and a conversion sequence number as well as a pair of an expected Ack number and a conversion Ack number contained in the TCP header of a packet in a direction opposite to that of the previously forwarded packet at the time of forwarding the packet, to function as a conversion unit for performing number rewriting process of rewriting the sequence number and the Ack number contained in the TCP header of a packet to forward to the conversion sequence number and the conversion Ack number corresponding to the expected sequence number and the expected Ack number matching these numbers by referring to the number conversion table at the time of forwarding the packet.

24. The non-transitory storage medium for storing the program according to claim 23, wherein the number conversion table includes an entry including a pair of an expected sequence number;

and

a conversion sequence number and an entry including a pair of an expected Ack number and a conversion Ack number, which are registered for each direction of forwarding the packet;

wherein a number rewriting process performed by the conversion unit searches the number conversion table for an entry having the expected sequence number and the expected Ack number having the same forwarding direction as that of the forwarded packet and matching the sequence number and the Ack number of the TCP header of the forwarded packet, and rewrites the sequence number and the Ack number of the TCP header of the forwarded packet to the conversion sequence number and the conversion Ack number written in the found entry.

25. The non-transitory storage medium for storing the program according to claim 24, wherein, in addition to the number rewriting process, the conversion unit further performs a number conversion table management process, wherein the number conversion table management process includes a same forwarding direction entry registration process of registering an entry having the same forwarding direction as that of the forwarded packet and an opposite forwarding direction entry registration process of registering an entry having the opposite forwarding direction to that of the forwarded packet;

wherein the same forwarding direction entry registration process registers, in the number conversion table, an entry having the expected sequence number which is a sum of the sequence number of the TCP header of the forwarded packet and the application header size before rewriting process of the sequence number and the Ack number and application header rewriting process of the forwarded packet, and having the conversion sequence number which is a sum of the sequence number of the TCP header of the forwarded packet and the application header size after rewriting process of the sequence number and the Ack number and the application header rewriting process;

wherein the opposite forwarding direction entry registration process registers, in the number conversion table, an entry having the same conversion Ack number as the expected sequence number of the entry registered in the same forwarding direction entry registration process, and having the same expected Ack number as the conversion sequence number of the entry registered in the same forwarding direction entry registration process.

26. The non-transitory storage medium for storing the program according to claim 23 further causing the computer to function as

an application header parse unit performing a rewriting position search process of searching for the rewriting position by analyzing the application header of the forwarded packet, and a rewriting position management table management process of registering the entry containing the rewriting position found in the rewriting position search process in a rewriting position management table in which an entry having a pair of the sequence number and the application header rewriting position of the packet is registered for each direction of forwarding the packet;

and

an application header rewriting unit performing an application header rewriting process of rewriting the application header of the forwarded packet by referring to the rewriting position management table.

27. The non-transitory storage medium for storing the program according to claim 26, wherein the application header rewriting position search process is not performed on the packet of the forwarded packet whose entry having the same expected sequence number as the sequence number has already been registered in the number conversion table.

28. The non-transitory storage medium for storing the program according to claim 23, wherein, in the number conversion table management process, the conversion unit further performs:

an Ack reach packet detection process of confirming an Ack reach packet guaranteeing that the corresponding Ack is delivered from the receiving side to the sending side of the packet; and

a number conversion table entry deletion process of deleting an entry having the same forwarding direction as that of the Ack reach packet and having a smaller expected sequence number than the sequence number of the Ack reach packet and an entry having the opposite forwarding direction to that of the Ack reach packet and having a smaller conversion Ack number than the sequence number of the Ack reach packet from the number conversion table.

29. The non-transitory storage medium for storing the program according to claim 26, wherein, in the rewriting position management table management process, the application header parse unit further performs:

an Ack reach packet detection process of confirming an Ack reach packet guaranteeing that the corresponding Ack is delivered from the receiving side to the sending side; and

a rewriting position management table entry deletion process of deleting an entry having the same forwarding direction as that of the Ack reach packet and having a smaller sequence number than the sequence number of the Ack reach packet from the rewriting position management table.

30. The non-transitory storage medium for storing the program according to claim 28, wherein the Ack reach packet detection process confirms, as the Ack reach packet, the packet having a smaller sequence number than the value obtained by subtracting a maximum receive Window Size usable on the TCP connection calculated based on a Window Scale option value determined at the TCP connection establishment from the sequence number of the packet last intercepted on the TCP connection.

31. The non-transitory storage medium for storing the program according to claim 28, wherein the Ack reach packet detection process confirms, as the Ack reach packet, the packet having a smaller sequence number than the value obtained by subtracting a maximum Window Size reported from the packet received side at the TCP connection after the TCP connection establishment from the sequence number of the packet last intercepted on the TCP connection.

32. The non-transitory storage medium for storing the program according to claim 26 further causing the computer to function as

a packet buffer unit for storing a forwarded packet in a buffer;

performing a message start/end position search process of detecting the start and end positions of an application protocol message and notifying the application header parse unit thereof; and

erasing all the packets except the last stored packet from the buffer when the message start/end position search process detects the end position of the application protocol message in the last stored packet and the application header parse unit completes the analysis of the message.

33. The non-transitory storage medium for storing the program according to claim 32, wherein the packet buffer unit does not store, in the buffer, the packet of the forwarded packet whose entry having the same expected sequence number as the sequence number has already been registered in the number conversion table.