Methods and apparatus for preventing packet spoofing with user space communication stacks
Methods and apparatus for efficient data transfer within a user space network stack. Unlike prior art monolithic networking stacks, the exemplary networking stack architecture described hereinafter includes various components that span multiple domains (both in-kernel, and non-kernel). For example, unlike traditional “socket” based communication, disclosed embodiments can transfer data directly between the kernel and user space domains. Direct transfer reduces the per-byte and per-packet costs relative to socket based communication. A user space networking stack is disclosed that enables extensible, cross-platform-capable, user space control of the networking protocol stack functionality. The user space networking stack facilitates tighter integration between the protocol layers (including TLS) and the application or daemon. Exemplary systems can support multiple networking protocol stack instances (including an in-kernel traditional network stack).
1. A method for validating packets for a user space communication stack, the method comprising:
opening a link between user space and kernel space by the user space communication stack;
receiving packets from the user space to a first pool of resources in the kernel space;
writing verification information to a flow entry table in the kernel space upon with the opening of the link between the user space and the kernel space;
copying at least a portion of the received packets to a second pool of resources in the kernel space, subsequent to the writing of the verification information; and
validating the copied at least portion of the received packets based at least on a comparison of the written verification information in the flow entry table to corresponding metadata associated with the copied packets.
2. The method of claim 1 , wherein the writing of the verification information comprises populating the flow entry table through one or more kernel application programming interfaces (APIs).
3. The method of claim 2 , wherein the populating of the flow entry table comprises writing one or more of a universally unique identifier (UUID) or tuple information each associated with the user space communication stack.
4. The method of claim 3 , wherein the user space communication stack is associated with a first party application, and the validating comprises validating one of the UUID or the tuple information.
5. The method of claim 3 , wherein the user space communication stack is associated with a third party application, and the validating comprises validating both the UUID and the tuple information.
6. The method of claim 3 , further comprising constructing a Transmission Control Protocol/Internet Protocol (TCP/IP) header for the copied packets subsequent to the validating of the copied packets, the constructing of the TCP/IP header occurring in the kernel space.
7. The method of claim 1 , further comprising determining that one of the copied packets verification information does not match the written verification information in the flow entry table,. and in response to the determining, discarding the one of the copied packets.
8. A system for validating packets for a user space communication stack, the system comprising:
an application that comprises the user space communication stack, the application residing in user space;
a first pool of dedicated memory resources for the application, the first pool of dedicated resources associated with kernel space;
a second pool of dedicated memory resources for a driver, the second pool of dedicated resources associated with the kernel space;
a flow entry table configured for the validating of the packets; and
a non-transitory computer readable apparatus comprising a storage medium having one or more computer programs stored thereon, the one or more computer programs being configured to, when executed by a processing apparatus, cause the system to:
write verification information to the flow entry table associated with the kernel space based at least upon an opening of a link between the user space and the kernel space by the application;
write packets from the user space to the first pool of dedicated resources associated with the kernel space, by the application, subsequent to the writing of the verification information;
copy at least a portion of the written packets to the second pool of dedicated resources associated with the kernel space; and
validate the copied packets in the second pool of dedicated resources based at least on a comparison of the written verification information in the flow entry table to verification information associated with the copied packets.
9. The system of claim 8 , wherein the written verification information comprises packet metadata.
10. The system of claim 9 , wherein the packet metadata comprises a universally unique identifier (UUID) and tuple information each associated with the user space communication stack.
11. The system of claim 10 , wherein the user space communication stack is associated with a first party application and the validation of the copied packets comprises a validation of one of the UUID or the tuple information.
12. The system of claim 10 , wherein the user space communication stack is associated with a third party application and the validation of the copied packets comprises a validation of both the UUID and the tuple information.
13. The system of claim 8 , wherein the one or more computer programs are further configured to, when executed by the processing apparatus, cause the system to:
determine that at least one of the copied packets verification information does not match the written verification information in the flow entry table, and in response to the determination, discard the at least one of the copied packets.
14. A non-transitory computer readable apparatus comprising a storage medium having one or more computer programs stored thereon, the one or more computer programs being configured to, when executed by a processing apparatus, cause a computerized device to:
write one or more packets from a user space to a first pool of dedicated resources associated with a kernel space;
write verification information to a flow entry table associated with the kernel space, the verification information being associated with an opening of a link between the user space and the kernel space by an application;
copy at least a portion of the one or more packets to a second pool of dedicated resources associated with the kernel space, subsequent to the writing of the verification information; and
validate the copied at least portion of the one or more packets in the second pool of dedicated resources at least by comparison of the written verification information in the flow entry table to verification information associated with the copied at least portion of the one or more packets.
15. The non-transitory computer readable apparatus of claim 14 , wherein the writing of the verification information comprises a write of packet metadata to the flow entry table.
16. The non-transitory computer readable apparatus of claim 15 , wherein the writing of the packet metadata to the flow entry table comprises a write of one or more of a universally unique identifier (UUID) and tuple information each associated with a user space communication stack of the application.
17. The non-transitory computer readable apparatus of claim 16 , wherein the user space communication stack is associated with a first party application and the validation comprises a validation of one of the UUID or the tuple information.
18. The non-transitory computer readable apparatus of claim 16 , wherein the user space communication stack is associated with a third party application and the validation comprises a validation of both the UUID and the tuple information.
19. The non-transitory computer readable apparatus of claim 16 , wherein the one or more computer programs are further configured to, when executed by the processing apparatus, cause the computerized device to:
construct a Transmission Control Protocol/Internet Protocol (TCP/IP) header for the copied at least portion of the one or more packets subsequent to the validating of the copied at least portion of the one or more packets, the construction of the TCP/IP header occurring in the kernel space.
20. The non-transitory computer readable apparatus of claim 14 , wherein the one or more computer programs are further configured to, when executed by the processing apparatus, cause the computerized device to:
determine that at least one of the copied at least portion of the one or more packets verification information does not match the written verification information in the flow entry table and in response to the determination, discard the at least one of the copied at least portion of the one or more packets.