Reproxying an unproxied connection

• US 20060047839A1
• Filed: 08/24/2004
• Published: 03/02/2006
• Est. Priority Date: 08/24/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Kahol, Anurag, Tate, Patrick Darrell, Grimm, Martin David, Waterman, Alexander S.
• Granted Patent: US 8,224,966 B2
• Time in Patent Office: Days
• US Class Current: 709/230
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 69/165 Combined use of TCP and UDP protocols; selection criteria therefor

Abstract

A method is disclosed for reproxying connections. According to one aspect, a first connection is established between a client and a proxy device. A second connection is established between the proxy device and a server. The first connection comprises a first endpoint at the client and a second endpoint at the proxy device. The second connection comprises a third endpoint at the proxy device and a fourth endpoint at the server. The first and second connections are unproxied by dissolving the second and third endpoints while maintaining the first and fourth endpoints. After the connections have been unproxied, a packet is received at the proxy device. In response, the first and second connections are reproxied by creating fifth and sixth endpoints at the proxy device, so that the first connection comprises the fifth endpoint and the second connection comprises the sixth endpoint.

Claims

1. A method of reproxying a previously unproxied connection, the method comprising the computer-implemented steps of:

creating, based on first TCP parameters, a first Transmission Control Protocol (TCP) endpoint of a TCP connection to a client;

storing, in a first connection block data structure, (a) one or more of the first TCP parameters, and (b) information that identifies the client;

creating, based on second TCP parameters, a second TCP endpoint of a TCP connection to a first server;

storing, in a second connection block data structure, (a) one or more of the second TCP parameters, and (b) information that identifies the first server;

dissolving the first and second TCP endpoints while maintaining the first and second connection block data structures;

receiving a first packet after the first and second TCP endpoints have been dissolved; and

in response to determining that information indicated in the first packet matches information that is stored in a connection block data structure, performing steps comprising;

based on (a) one or more TCP parameters indicated in the first packet and (b) the one or more of the first TCP parameters stored in the first connection block data structure, creating a third TCP endpoint of a TCP connection to the client; and

based on (a) one or more TCP parameters indicated in the first packet and (b) the one or more of the second TCP parameters stored in the second connection block data structure, creating a fourth TCP endpoint of a TCP connection to the first server.

2. A method as recited in claim 1, the method further comprising:

negotiating the first Transmission Control Protocol (TCP) parameters with the client; and

negotiating the second TCP parameters with the first server.

3. A method as recited in claim 1, wherein the first packet does not indicate either (a) the one or more of the first TCP parameters stored in the first connection block data structure or (b) the one or more of the second TCP parameters stored in the second connection block data structure.

4. A method as recited in claim 1, wherein the first packet is not a TCP SYN packet.

5. A method as recited in claim 1, wherein creating the third TCP endpoint comprises creating the third TCP endpoint without renegotiating TCP parameters with the client.

6. A method as recited in claim 1, wherein (a) the first TCP parameters indicate a TCP sequence number and (b) the first connection block data structure does not indicate a TCP sequence number.

7. A method as recited in claim 6, wherein (a) the first packet indicates a particular TCP sequence number and (b) the third TCP endpoint is based on the particular TCP sequence number.

8. A method as recited in claim 1, wherein (a) the first TCP parameters indicate a maximum segment size, (b) the first connection block data structure indicates the maximum segment size, (c) the first packet does not indicate the maximum segment size, and (d) the third TCP endpoint is based on the maximum segment size.

9. A method as recited in claim 1, wherein (a) the first TCP parameters indicate a window scaling factor, (b) the first connection block data structure indicates the maximum segment size, (c) the first packet does not indicate the maximum segment size, and (d) the third TCP endpoint is based on the maximum segment size.

10. A method as recited in claim 1, the method further comprising:

receiving a second packet at the first TCP endpoint;

in response to receiving the second packet, selecting the first server from among a plurality of servers; and

in response to selecting the first server, sending the second packet through the second TCP endpoint.

11. A method as recited in claim 1, the method further comprising:

in response to receiving the first packet, selecting the first server from among a plurality of servers; and

in response to selecting the first server, sending the first packet through the fourth TCP endpoint.

12. A method as recited in claim 1, the method further comprising:

in response to receiving the first packet, selecting a second server from among a plurality of servers, wherein the second server is not the first server; and

in response to selecting the second server, performing steps comprising;

negotiating third TCP parameters with the second server;

creating a fifth TCP endpoint that is an endpoint in a TCP connection to the second server and that is based on the third TCP parameters; and

sending the first packet through the fifth TCP endpoint.

13. A method as recited in claim 1, the method further comprising:

after receiving the first packet, modifying content contained in a payload of the first packet; and

after modifying the content, sending the first packet through the third TCP endpoint.

14. A method as recited in claim 1, the method further comprising:

after receiving the first packet, modifying content contained in a payload of the first packet; and

after modifying the content, sending the first packet through the fourth TCP endpoint.

15. A method as recited in claim 1, wherein the first connection block data structure indicates a first source Internet Protocol (IP) address, a first destination IP address, a first protocol identifier, a first source port, and a first destination port.

16. A method as recited in claim 15, the method further comprising:

determining whether the first source IP address matches a second source IP address indicated in the first packet;

determining whether the first destination IP address matches a second destination IP address indicated in the first packet;

determining whether the first protocol identifier matches a second protocol identifier indicated in the first packet;

determining whether the first source port matches a second source port indicated in the first packet; and

determining whether the first destination port matches a second destination port indicated in the first packet.

17. A method of reproxying a previously unproxied connection, the method comprising the computer-implemented steps of:

after a first TCP endpoint in a proxy device'"'"'s TCP connection to a client has been dissolved and a second TCP endpoint in the proxy device'"'"'s TCP connection to a server has been dissolved, receiving a packet;

based on (a) one or more TCP parameters indicated in the packet and (b) one or more first TCP parameters upon which the first TCP endpoint was based and that were negotiated and stored at the proxy device before the first TCP endpoint was dissolved, creating a third TCP endpoint of a TCP connection to the client; and

based on (a) one or more TCP parameters indicated in the packet and (b) one or more second TCP parameters upon which the second TCP endpoint was based and that were negotiated and stored at the proxy device before the second TCP endpoint was dissolved, creating a fourth TCP endpoint of a TCP connection to the server.

18. A method of reproxying a previously unproxied connection, the method comprising the computer-implemented steps of:

establishing a first connection between a client and a proxy device, wherein the first connection comprises a first endpoint at the client and a second endpoint at the proxy device;

establishing a second connection between a server and the proxy device, wherein the second connection comprises a third endpoint at the proxy device and a fourth endpoint at the server;

unproxying the first and second connections by dissolving the second and third endpoints while maintaining the first and fourth endpoints;

receiving a first packet after dissolving the second and third endpoints; and

in response to receiving the particular packet, reproxying the first and second connections by creating a fifth endpoint and a sixth endpoint at the proxy device, wherein after reproxying the first and second connections, the first connection comprises the fifth endpoint and the second connection comprises the sixth endpoint.

19. A method as recited in claim 18, wherein reproxying the first and second connections is performed without closing or reopening the first connection or the second connection.

20. A method as recited in claim 18, the method further comprising:

after receiving the particular packet, modifying content contained in a payload of the particular packet; and

after modifying the content, sending the particular packet through the fifth endpoint.

21. A method as recited in claim 18, the method further comprising:

after receiving the particular packet, modifying content contained in a payload of the particular packet; and

after modifying the content, sending the particular packet through the sixth endpoint.

22. A computer-readable medium carrying one or more sequences of instructions for reproxying a previously unproxied connection, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

creating, based on first TCP parameters, a first Transmission Control Protocol (TCP) endpoint of a TCP connection to a client;

storing, in a first connection block data structure, (a) one or more of the first TCP parameters, and (b) information that identifies the client;

creating, based on second TCP parameters, a second TCP endpoint of a TCP connection to a first server;

storing, in a second connection block data structure, (a) one or more of the second TCP parameters, and (b) information that identifies the first server;

dissolving the first and second TCP endpoints while maintaining the first and second connection block data structures;

receiving a first packet after the first and second TCP endpoints have been dissolved; and

in response to determining that information indicated in the first packet matches information that is stored in a connection block data structure, performing steps comprising;

based on (a) one or more TCP parameters indicated in the first packet and (b) the one or more of the first TCP parameters stored in the first connection block data structure, creating a third TCP endpoint of a TCP connection to the client; and

based on (a) one or more TCP parameters indicated in the first packet and (b) the one or more of the second TCP parameters stored in the second connection block data structure, creating a fourth TCP endpoint of a TCP connection to the first server.

23. An apparatus for reproxying a previously unproxied connection, comprising:

means for creating, based on first TCP parameters, a first Transmission Control Protocol (TCP) endpoint of a TCP connection to a client;

means for storing, in a first connection block data structure, (a) one or more of the first TCP parameters, and (b) information that identifies the client;

means for creating, based on second TCP parameters, a second TCP endpoint of a TCP connection to a first server;

means for storing, in a second connection block data structure, (a) one or more of the second TCP parameters, and (b) information that identifies the first server;

means for dissolving the first and second TCP endpoints while maintaining the first and second connection block data structures;

means for receiving a first packet after the first and second TCP endpoints have been dissolved; and

means for creating a third TCP endpoint of a TCP connection to the client in response to determining that information indicated in the first packet matches information that is stored in a connection block data structure, wherein the third TCP endpoint is based on (a) one or more TCP parameters indicated in the first packet and (b) the one or more of the first TCP parameters stored in the first connection block data structure; and

means for creating a fourth TCP endpoint of a TCP connection to the first server in response to determining that information indicated in the first packet matches information that is stored in a connection block data structure, wherein the fourth TCP endpoint is based on (a) one or more TCP parameters indicated in the first packet and (b) the one or more of the second TCP parameters stored in the second connection block data structure.

24. An apparatus for reproxying a previously unproxied connection, comprising:

a network interface that is coupled to a data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

creating, based on first TCP parameters, a first Transmission Control Protocol (TCP) endpoint of a TCP connection to a client;

storing, in a first connection block data structure, (a) one or more of the first TCP parameters, and (b) information that identifies the client;

creating, based on second TCP parameters, a second TCP endpoint of a TCP connection to a first server;

storing, in a second connection block data structure, (a) one or more of the second TCP parameters, and (b) information that identifies the first server;

dissolving the first and second TCP endpoints while maintaining the first and second connection block data structures;

receiving a first packet after the first and second TCP endpoints have been dissolved; and

in response to determining that information indicated in the first packet matches information that is stored in a connection block data structure, performing steps comprising;

based on (a) one or more TCP parameters indicated in the first packet and (b) the one or more of the first TCP parameters stored in the first connection block data structure, creating a third TCP endpoint of a TCP connection to the client; and

based on (a) one or more TCP parameters indicated in the first packet and (b) the one or more of the second TCP parameters stored in the second connection block data structure, creating a fourth TCP endpoint of a TCP connection to the first server.

25. A system comprising:

a client that negotiates a first connection with a proxy device, wherein the first connection comprises a first endpoint at the client and a second endpoint at a proxy device;

a server that negotiates a second connection with a proxy device, wherein the second connection comprises a third endpoint at a proxy device and a fourth endpoint at the server; and

a proxy device that (a) unproxies the first and second connections by dissolving the second and third endpoints while maintaining the first and fourth endpoints, (b) receives a packet after a dissolution of the second and third endpoints, and (c) in response to receiving the packet, reproxies the first and second connections by creating a fifth endpoint and a sixth endpoint at a proxy device, wherein after a reproxying of the first and second connections, the first connection comprises the fifth endpoint and the second connection comprises the sixth endpoint.