Techniques for packet processing with removal of IP layer routing dependencies
View Patent ↗Techniques for packet processing with removal of Internet Protocol (IP) layer routing dependencies are presented. Encrypted packets associated with network communications occurring via a VPN and IP tunnel are grabbed off the network stack before being processed by an IP layer of the network stack. Next, an IP header is generated for the encrypted packets and the encrypted packets are sent to a socket application. The socket application provides the encrypted packets back to the network stack at the data link layer for delivery to the VPN over the IP tunnel.
1. A method implemented and residing in a computer-readable storage medium to process on a processor that is configured to execute the method and the method, comprising:
intercepting, by the processor, an encrypted packet before the encrypted packet is processed by an Internet Protocol (IP) layer of a network communication stack, the IP layer is an IP routing layer of the network communication stack, the encrypted packet was being directed through the network communication stack to a Virtual Private Network (VPN) that is using an IP tunnel at a data link layer of the network communication stack, wherein each additional encrypted packet received by the network communication stack is also intercepted and processed by the method;
generating, by the processor, an IP header for the encrypted packet outside the IP layer of the network communication stack; and
sending, by the processor, the encrypted packet with the generated IP header to a socket application for direct delivery to the data link layer of the network communication stack and for injection into the VPN via the IP tunnel and bypassing the IP routing layer of the network communication stack, the socket application processes to also handle redundant packet processing, removal of all IP layer routing dependencies and control taking away from the IP layer, and fix session failure problems that occur with a client involved in sending the encrypted packet, the IP layer does not receive and process the encrypted packet in any manner, and wherein all secure IP tunnel communication bypasses routing decisions of the IP routing layer on the processor, and wherein a source mask and a destination mask for the encrypted packet are verified before the encrypted packet is delivered to the data link layer.
2. The method of claim 1 , wherein intercepting further includes, intercepting the encrypted packet after a Transmission Control Protocol (TCP) layer of the network communication stack adds a TCP header to the encrypted packet.
3. The method of claim 1 , wherein generating further includes adding a route specified for a VPN server of the VPN to the generated IP header and including the route with the encrypted packet.
4. The method of claim 1 , wherein generating further includes adding a source IP address and a destination IP address to the generated IP header.
5. The method of claim 4 , wherein adding further includes, augmenting the generated IP header with subnet masks.
6. The method of claim 5 , wherein sending further includes verifying, by the socket application, the source IP address, the destination IP address, and the subnet masks.
7. The method of claim 6 , wherein verifying further includes determining, by the socket application, to abort processing and to not deliver the encrypted packet to the data link layer and IP tunnel when the source IP address, the destination IP address, or the subnet masks cannot be verified by the socket application.
8. The method of claim 1 , wherein sending further includes sending the encrypted packet with the generated IP header to the socket application via a socket IP address and port number combination that identifies the socket application that will inject the encrypted packet with the generated IP header into the data link layer of the network communication stack.
9. A method implemented and residing in a computer-readable storage medium to process on a processor that is configured to execute the method and the method, comprising:
receiving, by the processor, an encrypted packet destined for a Virtual Private Network (VPN) via an Internet Protocol (IP) tunnel at a data link layer of a network communication stack, the encrypted packet bypassed the IP layer of the network communication stack but still includes an IP header, the IP layer is an IP routing layer of the network communication stack and that layer was bypassed during packet processing, and wherein each additional encrypted packet received by the network communication stack is also received and processed by the method;
verifying, by the processor, a source IP address and a destination IP address for the encrypted packet;
sending, by the processor, the encrypted packet to the data link layer for delivery to the VPN over the IP tunnel when the source IP address and the destination IP address are verified and when the source IP address or the destination IP address are not validated terminating processing of the encrypted packet without deliver to the data link layer, and wherein a source mask and a destination mask for the encrypted packet are verified before the encrypted packet is delivered to the data link layer; and
processing, by the processor the method as a socket application at a Kernel layer of an Operating System, the socket application processes to also handle redundant packet processing, removal of all IP layer routing dependencies and taking control away from the IP layer, and fix session failure problems that occur with a client involved in sending the encrypted packet, and the IP layer does not receive and process the encrypted packet in any manner, and wherein all secure IP tunnel communication bypasses routing decisions of the IP routing layer on the processor.
10. The method of claim 9 , wherein receiving further includes acquiring the encrypted packet from an application executing on the processor that intercepts the encrypted packet from a Transmission Control Protocol (TCP) layer of the network communication stack after the TCP layer added a TCP header to the encrypted packet.
11. The method of claim 9 , wherein receiving further includes acquiring a route for a VPN server of the VPN from the IP header.
12. The method of claim 11 , wherein acquiring further includes verifying the route and when the route is not verified terminate processing and abort delivery of the encrypted packet to the data link layer of the network communication stack.
13. The method of claim 9 , wherein verifying further includes verifying subnet masks included with the IP header.
14. The method of claim 13 , wherein sending further includes terminating processing and abort delivery of the encrypted packet to the data link layer of the network communication stack when the subnet masks are not verified.
15. A processor-implemented system residing in a computer-readable storage medium and adapted to be executed by a processor of a network, comprising:
a stack intercepting service residing in a computer-readable medium and executed by the processor; and
a socket application residing in a computer-readable medium and executed by the processor;
wherein the stack intercepting service is to intercept every packet being sent through a network stack after the packet exits a Transmission Control Protocol (TCP) layer of the network stack and before the packet is processed by an Internet Protocol (IP) layer of the network stack, the IP layer is an IP routing layer of the network stack and is bypassed, and the stack intercepting service is to add an IP header to each packet and provide each packet with the IP header to the socket application, the socket application is to deliver each packet with the IP header directly back to the network stack at the data link layer where each packet is injected into an IP tunnel for delivery over a Virtual Private Network (VPN) bypassing the IP routing layer of the network stack, the socket application processes to also handle redundant packet processing, removal of all IP layer routing dependencies and taking control away from the IP layer, and fix session failure problems that occur with a client involved in sending each packet, and the IP layer does not receive and process any packet in any manner and wherein all secure IP tunnel communication bypasses routing decisions of the IP routing layer on the processor, and wherein a source mask and a destination mask for the packet are verified before the packet is delivered to the data link layer.
16. The system of claim 15 , wherein the stack intercepting service receives each packet with a TCP header that was added at the TCP layer of the network stack.
17. The system of claim 16 , wherein the stack intercepting service is to generate the IP header and includes within the IP header a source IP address and a destination IP address for each packet.
18. The system of claim 17 , wherein the stack intercepting service is to also add a route to a VPN server associated with the VPN to each packet.
19. The system of claim 18 , wherein the socket application is to verify the source IP address, the destination IP address, and the route when the socket application receives each packet from the stack intercepting service.
20. The system of claim 15 , wherein the stack intercepting service identifies the socket application for delivering each packet via a socket IP address and port address combination.
21. A processor-implemented system residing in a computer-readable storage medium and adapted to be executed by a processor of a network, comprising:
an Internet Protocol (IP) tunnel packet residing in a computer-readable storage medium and being processed by the processor as the IP tunnel packet traverses a network stack for delivery to a Virtual Private Network (VPN) over an IP tunnel at a data link layer of the network stack; and
a socket application implemented and residing in a computer-readable storage medium and being processed by the processor;
wherein the IP tunnel packet bypasses an IP layer of the network stack as it is being processed through the network stack and delivered to the socket application, the IP layer is an IP routing layer of the network stack, the socket application directly supplies the IP tunnel packet to the data link layer for delivery to the VPN over the IP tunnel bypassing the IP routing layer of the network stack, the socket application processes to also handle redundant packet processing, removal of all IP layer routing dependencies and taking control away from the IP layer, and fix session failure problems that occur with a client involved in sending the encrypted packet, and the IP layer does not receive and process the encrypted packet in any manner and wherein all secure IP tunnel communication bypasses routing decisions of the IP routing layer on the processor, and wherein a source mask and a destination mask for the IP tunnel packet are verified before the IP tunnel packet is delivered to the data link layer.
22. The system of claim 21 , wherein an application that is executed by the processor intercepts the IP tunnel Packet after the IP tunnel packet exists a Transmission Control Protocol (TCP) layer of the network stack and before the IP tunnel packet as an opportunity to progress to the IP layer of the network stack, the application adds an IP header to the IP tunnel packet and supplies the IP tunnel packet to the socket application.
23. The system of claim 21 , wherein the socket application verifies a source IP address, a destination IP address, and subnet masks included in the IP header and when verified sends the IP tunnel packet to the data link layer and when not verified terminating processing of the IP tunnel packet and not delivering the IP tunnel packet to the data link layer.