Zero-trust network access with user datagram protocol message forwarding

1 . A method comprising:

determining a forwarding rule based on a destination address associated with a received data traffic packet formatted according to a first protocol, wherein the forwarding rule comprises a zero-trust network access (ZTNA)-compliant traffic forwarding rule and the first protocol comprises a User Datagram Protocol (UDP)-compliant protocol;

creating a bi-directional tunnel to forward the traffic based on the determined forwarding rule;

generating a request over a stream having a corresponding stream identifier within the bi-directional tunnel to establish a connection with a proxy device;

wrapping a payload of the traffic packet formatted according to the first protocol with at least the stream identifier;

forwarding the wrapped payload of the traffic packet to a client device based on the determined forwarding rule to a destination device corresponding to the stream identifier.

2 . The method of claim 1 , wherein the corresponding stream identifier comprises QUIC stream ID corresponding with the QUIC stream that was used to establish the tunnel.

3 . The method of claim 2 , wherein wrapping the payload of the traffic packet formatted according to the first protocol with at least the stream identifier comprises appending the QUIC stream ID to the UDP datagram payload being forwarded.

4 . The method of claim 2 , wherein forwarding the data traffic packet to a client device based on the determined forwarding rule comprises:

using a UDP name server to determine a corresponding ZTNA rule from the destination address; and

sending the UDP packet to a ZTNA client having the address from the determined forwarding rule.

5 . The method of claim 1 , wherein the bi-directional tunnel comprises Quick User Datagram Protocol (UDP) Internet Connections (QUIC)-compliant tunnel.

6 . The method of claim 1 , wherein generating a request over a stream within the bi-directional tunnel to establish a connection with a proxy device comprises generating a GET request on the QUIC-compliant stream to establish a ZTNA tunnel to the proxy device.

7 . The method of claim 1 , wherein wrapping the payload further comprises encoding the stream identifier as a variable-length integer and prefixing the encoded stream identifier to the payload prior to forwarding.

8 . The method of claim 1 , further comprising shifting the stream identifier prior to wrapping to remove protocol-specific flag bits indicating bidirectionality and stream origin.

9 . A non-transitory computer-readable storage medium having stored thereon instructions that, when executed by one or more processors, are configurable to cause one or more computing devices to:

determine a forwarding rule based on a destination address associated with a received data traffic packet formatted according to a first protocol, wherein the forwarding rule comprises a zero-trust network access (ZTNA)-compliant traffic forwarding rule and the first protocol comprises a User Datagram Protocol (UDP)-compliant protocol;

create a bi-directional tunnel to forward the traffic based on the determined forwarding rule;

generate a request over a stream having a corresponding stream identifier within the bi-directional tunnel to establish a connection with a proxy device;

wrap a payload of the traffic packet formatted according to the first protocol with at least the stream identifier;

forward the wrapped payload of the traffic packet to a client device based on the determined forwarding rule to a destination device corresponding to the stream identifier.

10 . The non-transitory computer-readable storage medium of claim 9 , wherein the corresponding stream identifier comprises QUIC stream ID corresponding with the QUIC stream that was used to establish the tunnel.

11 . The non-transitory computer-readable storage medium of claim 10 , wherein wrapping the traffic packet payload formatted according to the first protocol with at least the stream identifier comprises appending the QUIC stream ID to the UDP datagram payload being forwarded.

12 . The non-transitory computer-readable storage medium of claim 9 , wherein forwarding the data traffic packet to a client device based on the determined forwarding rule comprises:

using a UDP name server to determine a corresponding ZTNA rule from the destination address; and

sending the UDP packet to a ZTNA client having the address from the determined forwarding rule.

13 . The non-transitory computer-readable storage medium of claim 9 , wherein the bi-directional tunnel comprises Quick User Datagram Protocol (UDP) Internet Connections (QUIC)-compliant tunnel.

14 . The non-transitory computer-readable storage medium of claim 9 , wherein generating a request over a stream within the bi-directional tunnel to establish a connection with a proxy device comprises generating a GET request on the QUIC-compliant stream to establish a ZTNA tunnel to the proxy device.

15 . The non-transitory computer-readable storage medium of claim 9 , wherein the instructions further cause the computing device to associate received datagrams with a tunnel using the prefixed stream identifier without traversing a QUIC stream.

16 . The non-transitory computer-readable storage medium of claim 9 , wherein the instructions further cause the computing device to close the bidirectional tunnel in response to detecting closure of a local UDP socket associated with an originating application.

17 . A system comprising:

a memory system;

a hardware processor coupled with the memory system, the hardware processor configurable to:

determine a forwarding rule based on a destination address associated with a received data traffic packet formatted according to a first protocol, wherein the forwarding rule comprises a zero-trust network access (ZTNA)-compliant traffic forwarding rule and the first protocol comprises a User Datagram Protocol (UDP)-compliant protocol,

create a bi-directional tunnel to forward the traffic based on the determined forwarding rule,

generate a request over a stream having a corresponding stream identifier within the bi-directional tunnel to establish a connection with a proxy device,

wrap a payload of the traffic packet formatted according to the first protocol with at least the stream identifier, and

forward the wrapped payload of the traffic packet to a client device based on the determined forwarding rule to a destination device corresponding to the stream identifier.

18 . The system of claim 17 , wherein wrapping the traffic packet payload formatted according to the first protocol with at least the stream identifier comprises appending the QUIC stream ID to the UDP datagram payload being forwarded.

19 . The system of claim 17 , wherein the bi-directional tunnel comprises Quick User Datagram Protocol (UDP) Internet Connections (QUIC)-compliant tunnel.

20 . The system of claim 17 , wherein the hardware processor is further configurable to maintain a pool of active tunnels and remove a tunnel from the pool after expiration of a timeout following closure of all associated streams.