SYSTEMS AND METHODS FOR CONFIGURING HANDLING OF UNDEFINED POLICY EVENTS

• US 20080225753A1
• Filed: 03/12/2007
• Published: 09/18/2008
• Est. Priority Date: 03/12/2007
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Bandekar, Vishal, Khemani, Prakash
• Granted Patent: US 7,853,679 B2
• Time in Patent Office: Days
• US Class Current: 370/255
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications

Abstract

Systems and methods for configuring and evaluating policies that direct processing of one or more data streams are described. A configuration interface is described for allowing users to specify object oriented policies. These object oriented policies may allow any data structures to be applied with respect to a payload of a received packet stream, including any portions of HTTP traffic. A configuration interface may also allow the user to control the order in which policies and policy groups are executed, in addition to specifying actions to be taken if one or more policies are undefined. Systems and methods for processing the policies may allow efficient processing of object-oriented policies by applying potentially complex data structures to unstructured data streams. A device may also interpret and process a number of flow control commands and policy group invocation statements to determine an order of execution among a number of policies and policy groups. These policy configurations and processing may allow configuration and processing of complex network behaviors relating to load balancing, VPNs, SSL offloading, content switching, application security, acceleration, and caching.

Claims

1. A method of configuring a policy used by a network device by specifying an action to be taken in the event an element of the policy is undefined, the method comprising:

(a) providing a configuration interface for configuring a policy of a network device;

(b) identifying, by the configuration interface, a policy comprising a first action to be taken based on an evaluation of an expression;

(c) receiving, via the configuration interface, information identifying a second action for the policy, the second action to be taken if an element of the policy is undefined.

2. The method of claim 1, wherein step (a) comprises providing a command-line configuration interface for configuring a policy of a network device.

3. The method of claim 1, wherein step (a) comprises providing a configuration interface comprising one or more of a drag-and-drop interface, a list-selection interface, or a syntax-highlighting interface.

4. The method of claim 1, wherein step (a) comprises executing the configuration interface on a device in communication with the network device.

5. The method of claim 1, wherein step (a) comprises executing the configuration interface on a device in communication with the network device.

6. The method of claim 1, wherein step (b) comprises configuring, by the user via the configuration interface, an object-oriented expression for the policy.

7. The method of claim 1, wherein step (b) comprises receiving, from the user via the configuration interface, an expression for the policy, the expression having an object class and a member of the object class.

8. The method of claim 1, wherein the second action comprises no action.

9. The method of claim 1, wherein the second action comprises blocking transmission of a portion of a packet stream from the network device.

10. The method of claim 1, wherein at least one of the first action or the second action specifies a function performing one of:

load balancing, content switching, application security, application delivery, network acceleration, or application acceleration.

11. The method of claim 1, wherein at least one of the first action and the second action specifies rewriting a portion of the payload of the packet stream.

12. The method of claim 1, wherein at least one of the first action and the second action specifies rewriting a URL contained in an HTTP response.

13. The method of claim 1, wherein at least one of the first action and the second action comprises an object-oriented expression.

14. The method of claim 1, wherein step (c) comprises receiving, via the configuration interface, information identifying a second action for the policy, the second action to be taken if an expression of the policy is undefined.

15. The method of claim 1, wherein step (c) comprises receiving, via the configuration interface, information identifying a second action for the policy, the second action to be taken if a rule of the policy is undefined.

16. The method of claim 1, wherein step (c) comprises receiving, via the configuration interface, information identifying a second action for the policy, the second action to be taken if the first action of the policy is undefined.

17. In an appliance, a method of applying a policy specifying an action to be taken in the event an element of the policy is undefined, the method comprising:

(a) identifying, by an appliance, a policy to evaluate with respect to a payload of a received packet stream, the policy specifying (i) an expression, (ii) a first action to be taken based on an evaluation of the expression and (iii) a second action to be taken if an element of the policy is undefined;

(b) determining, by the appliance, an element of the policy is undefined with respect to the payload; and

(c) taking, by the appliance in response to the determination, the second action.

18. The method of claim 17, wherein step (b) comprises evaluating an object-oriented expression.

19. The method of claim 17, wherein step (b) comprises evaluating an expression having an object class and a member of the object class.

20. The method of claim 17, wherein step (b) comprises determining, by the appliance, the expression is undefined with respect to the packet stream.

21. The method of claim 17, wherein step (b) comprises determining, by the appliance, a rule of the policy is undefined.

22. The method of claim 17, wherein step (b) comprises determining, by the appliance, the first action of the policy is undefined.

23. The method of claim 17, wherein step (c) comprises taking no action.

24. The method of claim 17, wherein step (c) comprises blocking transmission of the packet stream from the appliance.

25. The method of claim 17, wherein step (c) comprises performing one of:

load balancing, content switching, application security, application delivery, network acceleration, or application acceleration.

26. The method of claim 17, wherein step (c) comprises rewriting a portion of the payload of the packet stream.

27. The method of claim 17, wherein step (c) comprises rewriting a URL contained in an HTTP response.

28. An appliance which enables users to specify an action to be taken in the event an expression contained in a policy cannot be evaluated by the appliance, the appliance comprising:

a packet processor which receives a packet stream; and

a policy engine which identifies a policy to evaluate with respect to the payload of the received packet stream, the policy specifying (i) an expression, (ii) a first action to be taken based on an evaluation of the expression and (iii) a second action to be taken if the expression is not successfully evaluated;

determines the expression cannot be successfully evaluated with respect to the packet stream; and

takes the second action.

29. The system of claim 28, wherein the policy engine evaluates an object-oriented expression.

30. The system of claim 28, wherein the policy engine evaluates an expression having an object class and a member of the object class.

31. The system of claim 28, wherein the second action comprises no action.

32. The system of claim 28, wherein the second action comprises blocking a portion of a packet stream.

33. The system of claim 28, wherein at least one of the first action and second action specifies a function directed to at least one of:

load balancing, content switching, application security, application delivery, network acceleration, and application acceleration.

34. The system of claim 28, wherein at least one of the first action or the second action specifies rewriting a portion of the payload of the packet stream.

35. The system of claim 28, wherein at least one of the first action or the second action specifies rewriting a URL contained in an HTTP response.

36. The system of claim 28, wherein the policy engine determines the expression is undefined with respect to the packet stream.

37. The system of claim 28, wherein the policy engine determines a rule of the policy is undefined with respect to the packet stream.

38. The system of claim 28, wherein the policy engine determines the first action is undefined with respect to the packet stream.