Hardware-based packet editor

• US 9,118,620 B1
• Filed: 06/20/2012
• Issued: 08/25/2015
• Est. Priority Date: 03/29/2012
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Davis, Ian E.
• Primary Examiner(s): Mejia, Anthony
• Application Number:
  US13/527,618
• Time in Patent Office: 1,161 Days
• Field of Search: 709/200, 709/246
• US Class Current: 1/1
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields

Abstract

Hardware-based packet editor receives a packet editing script which includes script entries indicating modifications to a data packet and a data block with data for the modified data packet. For a script entry in the packet editing script, the packet editor copies data in the data block at a block location and with a block length identified in the script entry into a packet buffer. The packet editor repeats the copying for the remaining script entries for the modified data packet. The packet editor then generates the modified data packet with the data in the packet buffer. The packet editing script is generated such that a script entry is created for data to be included in the modified data packet and data to be inserted into the modified data packet. Creation of a script entry is omitted for data to be removed.

Claims

1. A method for processing a data packet by a service gateway comprising a processor module, comprising:

receiving, by the processor, a data packet from a host to be sent to a server, or from the server to be sent to the host;

determining, by the processor, that the data packet requires modification prior to sending to the server or the host; and

generating, by the processor, a packet editing script, the script comprising a plurality of script entries and a data block wherein each of the plurality of script entries indicates a modification to be applied to the data block, wherein the data block comprises at least a portion of the data packet, wherein the generating comprises;

for each and any given portion of the data packet determined to be included in the modified packet, generating a first script entry identifying a first location and a first length in the data block corresponding to the given portion determined to be included;

for each and any given portion of the data packet determined to be removed from the data packet, omitting generation of a script entry corresponding to the given portion determined to be removed;

for each any new data determined to be added to the modified packet, generating the new data to be comprised in the data block of the packet editing script and generating a second script entry identifying a second location and a second length in the data block corresponding to the new data; and

for each and any given portion of the data packet determined to be replaced in the modified packet, generating a third script entry identifying a third location and a third length in the data block corresponding to a replacement data, and omitting generation of the script entry corresponding to the given portion determined to be replaced.

2. The method of claim 1, further comprising:

sending, by the processor, the packet editing script to a hardware-based packet editor, wherein the packet editor generates the modified packet according to the plurality of script entries in the packet editing script.

3. The method of claim 1, wherein the data packet comprises a HTTP request packet from the host to the server, wherein the omitting comprises:

omitting generation of the script entry corresponding to a HTTP header or a HTTP sub-header in the HTTP request packet to be removed.

4. The method of claim 1, wherein the data packet comprises a HTTP response packet from the server to the host, wherein the generating the new data and generating a second script entry comprises:

generating in the data block of the packet editing script a new HTTP header or a new HTTP sub-header to be inserted into the HTTP response packet; and

generating the second script entry identifying the second location and the second length in the data block corresponding to the new HTTP header or the new HTTP sub-header.

5. The method of claim 1, wherein the data packet comprises an IP packet, wherein the generating the new data and generating a second script entry comprises:

generating in the data block of the packet editing script an IP tunnel to be inserted into a header of the IP packet; and

generating the second script identifying the second location and the second length in the data block corresponding to the new IP tunnel.

6. The method of claim 1, wherein the data packet comprises an IP packet, wherein the omitting comprises:

omitting generation of the script entry corresponding to an IP tunnel header of the IP packet to be removed.

7. The method of claim 5, wherein the IP tunnel comprises an IPV4/IPV6 tunnel or an IP-IP tunnel.

8. The method of claim 1, wherein the data packet comprises a data packet of a NAT or proxy communication session, wherein the omitting and the generating the new data and generating a second script entry comprise:

omitting generation of the script entry corresponding to a first field in the data packet to be replaced;

generating in the data block of the packet editing script a second field to replace the first field in the data packet; and

generating the second script identifying the second location and the second length in the data block corresponding to the second field.

9. A computer program product for processing a data packet, the computer program product comprising:

a computer readable memory device having computer readable program code embodied therewith, the computer readable program code configured to;

receive a data packet from a host to be sent to a server, or from the server to be sent to the host;

determine that the data packet requires modification prior to sending to the server or the host; and

generate a packet editing script, the script comprising a plurality of script entries and a data block wherein each of the plurality of script entries indicates a modification to be applied to the data block, wherein the data block comprises at least a portion of the data packet, wherein the computer readable program code configured to generate is further configured to;

for each and any given portion of the data packet determined to be included in the modified packet, generate a first script entry identifying a first location and a first length in the data block corresponding to the given portion determined to be included;

for each and any given portion of the data packet determined to be removed from the data packet, omit generation of a script entry corresponding to the given portion determined to be removed;

for each any new data determined to be added to the modified packet, generate the new data to be comprised in the data block of the packet editing script and generating a second script entry identifying a second location and a second length in the data block corresponding to the new data; and

for each and any given portion of the data packet determined to be replaced in the modified packet, generate a third script entry identifying a third location and a third length in the data block corresponding to a replacement data, and omitting generation of the script entry corresponding to the given portion determined to be replaced.

10. The computer program product of claim 9, wherein the computer readable program code is further configured to:

send the packet editing script to a hardware-based packet editor, wherein the packet editor generates the modified packet according to the plurality of script entries in the packet editing script.

11. The computer program product of claim 9, wherein the data packet comprises a HTTP request packet from the host to the server, wherein the computer readable program code configured to omit is further configured to:

omit generation of the script entry corresponding to a HTTP header or a HTTP sub-header in the HTTP request packet to be removed.

12. The computer program product of claim 9, wherein the data packet comprises a HTTP response packet from the server to the host, wherein the computer readable program code configured to generate the new data and generate a second script entry is further configured to:

generate in the data block of the packet editing script a new HTTP header or a new HTTP sub-header to be inserted into the HTTP response packet; and

generate the second script entry identifying the second location and the second length in the data block corresponding to the new HTTP header or the new HTTP sub-header.

13. The computer program product of claim 9, wherein the data packet comprises an IP packet, wherein the computer readable program code configured to generate the new data and generate a second script entry are further configured to:

generate in the data block of the packet editing script an IP tunnel to be inserted into a header of the IP packet; and

generate the second script identifying the second location and the second length in the data block corresponding to the new IP tunnel.

14. The computer program product of claim 9, wherein the data packet comprises an IP packet, wherein the computer readable program code configured to omit is further configured to:

omit generation of the script entry corresponding to an IP tunnel header of the IP packet to be removed.

15. The computer program product of claim 13, wherein the IP tunnel comprises an IPV4/IPV6 tunnel or an IP-IP tunnel.

16. The computer program product of claim 9, wherein the data packet comprises a data packet of a NAT or proxy communication session, wherein the computer readable program code configured to omit and to generate the new data and generate a second script entry are further configured to:

omit generation of the script entry corresponding to a first field in the data packet to be replaced;

generate in the data block of the packet editing script a second field to replace the first field in the data packet; and

generate the second script identifying the second location and the second length in the data block corresponding to the second field.

17. A system, comprising:

a processor module for executing computer readable program code; and

a computer readable memory device having the computer readable program code embodied therewith, wherein the computer readable program code is configured to;

receive a data packet from a host to be sent to a server, or from the server to be sent to the host;

determine that the data packet requires modification prior to sending to the server or the host; and

generate a packet editing script, the script comprising a plurality of script entries and a data block wherein each of the plurality of script entries indicates a modification to be applied to the data block, wherein the data block comprises at least a portion of the data packet, wherein the computer readable program code configured to generate is further configured to;

for each and any given portion of the data packet determined to be included in the modified packet, generate a first script entry identifying a first location and a first length in the data block corresponding to the given portion determined to be included;

for each and any given portion of the data packet determined to be removed from the data packet, omit generation of a script entry corresponding to the given portion determined to be removed;

for each any new data determined to be added to the modified packet, generate the new data to be comprised in the data block of the packet editing script and generating a second script entry identifying a second location and a second length in the data block corresponding to the new data; and

for each and any given portion of the data packet determined to be replaced in the modified packet, generate a third script entry identifying a third location and a third length in the data block corresponding to a replacement data, and omitting generation of the script entry corresponding to the given portion determined to be replaced.

18. The system of claim 17, wherein the computer readable program code is further configured to:

send the packet editing script to a hardware-based packet editor, wherein the packet editor generates the modified packet according to the script entries in the packet editing script.

19. The system of claim 17, wherein the data packet comprises a HTTP request packet from the host to the server, wherein the computer readable program code configured to omit is further configured to:

omit generation of the script entry corresponding to a HTTP header or a HTTP sub-header in the HTTP request packet to be removed.

20. The system of claim 17, wherein the data packet comprises a HTTP response packet from the server to the host, wherein the computer readable program code configured to generate the new data and generate a second script entry is further configured to:

generate in the data block of the packet editing script a new HTTP header or a new HTTP sub-header to be inserted into the HTTP response packet; and

generate the second script entry identifying the second location and the second length in the data block corresponding to the new HTTP header or the new HTTP sub-header.

21. The system of claim 17, wherein the data packet comprises an IP packet, wherein the computer readable program code configured to generate the new data and generate a second script entry are further configured to:

generate in the data block of the packet editing script an IP tunnel to be inserted into a header of the IP packet; and

generate the second script identifying the second location and the second length in the data block corresponding to the new IP tunnel.

22. The system of claim 17, wherein the data packet comprises an IP packet, wherein the computer readable program code configured to omit is further configured to:

omit generation of the script entry corresponding to an IP tunnel header of the IP packet to be removed.

23. The system of claim 21, wherein the IP tunnel comprises an IPV4/IPV6 tunnel or an IP-IP tunnel.

24. The system of claim 17, wherein the data packet comprises a data packet of a NAT or proxy communication session, wherein the computer readable program code configured to omit and to generate the new data and generate a second script entry are further configured to:

omit generation of the script entry corresponding to a first field in the data packet to be replaced;

generate in the data block of the packet editing script a second field to replace the first field in the data packet; and

generate the second script identifying the second location and the second length in the data block corresponding to the second field.

25. A method for processing a data packet by a service gateway comprising a processor module, comprising:

receiving, by the processor, a data packet from a host to be sent to a server, or from the server to be sent to the host;

determining, by the processor, that the data packet requires modification prior to sending to the server or the host, wherein the determining comprises determining that the data packet is to be fragmented into a first new data packet and a second new data packet; and

generating, by the processor, a packet editing script, the script comprising a plurality of script entries and a data block wherein each of the plurality of script entries indicates a modification to be applied to the data block, wherein the data block comprises at least a portion of the data packet, wherein the generating comprises;

generating a first script comprising at least one first script entry identifying a first location and a first length corresponding to a first portion of the data packet to be included in the first new data packet and an indication of an end to the first new data packet; and

generating a second script comprising an indication of a start of the second new data packet and at least one second script entry identifying a second location and a second length corresponding to a second portion of the data packet to be included in the second new data packet.

26. A computer program product for processing a data packet, the computer program product comprising:

a computer readable memory device having computer readable program code embodied therewith, the computer readable program code configured to;

receive a data packet from a host to be sent to a server, or from the server to be sent to the host;

determine that the data packet requires modification prior to sending to the server or the host wherein the computer readable program code configured to determine comprises determine that the data packet is to be fragmented into a first new data packet and a second new data packet; and

generate a packet editing script, the script comprising a plurality of script entries and a data block wherein each of the plurality of script entries indicates a modification to be applied to the data block, wherein the data block comprises at least a portion of the data packet, wherein the computer readable program code configured to generate comprises;

generate the first script comprising at least one first script entry identifying a first location and a first length corresponding to a first portion of the data packet to be included in the first new data packet and an indication of an end to the first new data packet; and

generate a second script comprising an indication of a start of the second new data packet and at least one second script entry identifying a second location and a second length corresponding to a second portion of the data packet to be included in the second new data packet.

27. A system comprising:

a processor module for executing computer readable program code; and

a computer readable memory device having the computer readable program code embodied therewith, wherein the computer readable program code is configured to;

receive a data packet from a host to be sent to a server, or from the server to be sent to the host;

determine that the data packet requires modification prior to sending to the server or the host wherein the computer readable program code configured to determine comprises determine that the data packet is to be fragmented into a first new data packet and a second new data packet; and

generate a packet editing script, the script comprising a plurality of script entries and a data block wherein each of the plurality of script entries indicates a modification to be applied to the data block, wherein the data block comprises at least a portion of the data packet, wherein the computer readable program code configured to generate comprises;

generate the first script comprising at least one first script entry identifying a first location and a first length corresponding to a first portion of the data packet to be included in the first new data packet and an indication of an end to the first new data packet; and

generate a second script comprising an indication of a start of the second new data packet and at least one second script entry identifying a second location and a second length corresponding to a second portion of the data packet to be included in the second new data packet.