System and Method of Delaying Connection Acceptance to Support Connection Request Processing at Layer-7

• US 20080244085A1
• Filed: 07/19/2007
• Published: 10/02/2008
• Est. Priority Date: 03/29/2007
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Blue Coat Systems Incorporated (Gen Digital Inc.)
• Inventors: Li, Qing, Frederick, Ronald
• Granted Patent: US 7,743,160 B2
• Time in Patent Office: Days
• US Class Current: 709/237
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

Techniques for suspending a TCP three-way handshake, offering the partial connection to an L-7 application or module at a proxy to perform further processing, and then allowing the L-7 application or module to instruct the proxy'"'"'s network kernel to perform various actions are described. In various embodiments these actions may include: silently dropping the connection, verbosely rejecting the connection, accepting and processing the connection locally, or forwarding the connection to another proxy or the original destination. This additional functionality is provided, in one particular embodiment, via extensions to the POSIX socket API.

Claims

1. A method, comprising:

suspending a transmission control protocol (TCP) connection handshake with a connection initiator;

creating a connection state information template to account for the TCP connection with the connection initiator, said connection state information template artificially reflecting a successful, completed connection with the connection initiator; and

notifying an application layer process of the artificially reflected successful, completed connection with the connection initiator.

2. The method of claim 1, wherein suspending the TCP connection handshake occurs at a proxy logically disposed between the connection initiator and a target host of the TCP connection.

3. The method of claim 1, wherein creating the connection state information template comprises creating the connection state information template and performing a state transition therein to artificially reflect the successful, completed connection with the connection initiator.

4. The method of claim 3, further comprising performing a second state transition in the connection state information template to move the TCP connection to an appropriate state following processing of the TCP connection by the application layer process.

5. The method of claim 4, further comprising responding to the connection initiator with an action directed by the appropriate state resulting from the second state transition.

6. The method of claim 5, wherein responding to the connection initiator comprises silently dropping the TCP connection.

7. The method of claim 5, wherein responding to the connection initiator comprises rejecting the TCP connection.

8. The method of claim 5, wherein responding to the connection initiator comprises accepting the TCP connection.

9. The method of claim 5, wherein responding to the connection initiator comprises sending an error message to the connection initiator.

10. The method of claim 9, wherein the error message comprises a message indicative of a network error.

11. The method of claim 5, wherein responding to the connection initiator comprises forwarding the TCP connection to a network device other than the connection initiator.

12. The method of claim 5, wherein responding to the connection initiator comprises bypassing packets associated with the TCP connection to a target host of the TCP connection.

13. The method of claim 1, further comprising saving a TCP <

SYN>

packet received from the connection initiator during suspension of the TCP connection handshake.

14. The method of claim 13, further comprising saving a TCP <

SYN, ACK>

packet responsive to the <

SYN>

packet during suspension of the TCP connection handshake.

15. The method of claim 1, further comprising initiating a second TCP connection request with a target host of the TCP connection request during suspension of the TCP connection handshake with the connection initiator.

16. The method of claim 15, further comprising responding to the connection initiator so as to emulate a response received from the target host of the TCP connection request responsive to the second TCP connection request.

17. The method of claim 15, further comprising completing a second TCP connection handshake with the target host of the TCP connection request during suspension of the TCP connection handshake with the connection initiator.

18. The method of claim 17, further comprising silently dropping the TCP connection.

19. The method of claim 17, further comprising rejecting the TCP connection.

20. The method of claim 17, further comprising accepting the TCP connection.

21. The method of claim 17, further comprising bypassing packets associated with the TCP connection to the target host of the TCP connection.

22. The method of claim 17, further comprising sending an error message to the connection initiator.

23. The method of claim 22, wherein the error message comprises a message indicative of a network error.

24. The method of claim 17, further comprising exchanging data with the target host of the TCP connection request after completing the second TCP connection handshake.

25. The method of claim 1, wherein suspending the TCP connection handshake is facilitated through an extension to a POSIX socket application programming interface (API) on a port on which a TCP connection request is received from the connection initiator.

26. The method of claim 25, wherein the extension to the POSIX socket API causes an accept function for the port to create the connection state information template.

27. The method of claim 26, wherein the extension to the POSIX socket API further specifies an action to be performed in response to the TCP connection request.

28. The method of claim 27, wherein the action to be performed in response to the TCP connection request comprises one of:

dropping the TCP connection, denying the TCP connection, accepting the TCP connection, bypassing packets associated with the TCP connection, and forwarding the TCP connection to a network device other than the connection initiator.

29. A method, comprising:

receiving, from a connection initiator, multiple transmission control protocol (TCP) connection requests, each of the requests transmitted on a different port number;

delaying acceptance of all of the multiple TCP connection requests while initiating independent TCP connection requests to a target host of the multiple TCP connection requests on each of the different port numbers; and

responding to the connection initiator so as to emulate one or more responses to the independent TCP connection requests received from the target host.

30. The method of claim 29, wherein delaying acceptance of all of the multiple TCP connection requests comprises suspending TCP connection handshakes corresponding to the multiple TCP connection requests from a connection initiator;

creating, for each TCP connection request, a connection state information template to account for a respective one of the multiple TCP connection requests from the connection initiator, each of said connection state information templates artificially reflecting one or a number of a successful, completed connections with the connection initiator; and

notifying an application layer process of the artificially reflected successful, completed connections with the connection initiator.

31. The method of claim 29, wherein responding to the connection initiator comprises completing a TCP connection handshake with the connection initiator on one of the different port numbers that corresponds to a port number on which a response to the independent TCP connection requests was received from the target host.