Multiplexing encrypted tunnels
Multiplexing of encrypted tunnels is facilitated by the use of a custom header. Upon receiving a packet, information about the packet is collected stored, such as a port number, destination instance identifier, and a hash key. A custom packet is generated that includes the encrypted packet and a custom header including some or all of the collected information. Middleware may retrieve information from the custom header to perform load balancing, routing, or other function. The destination instance may use information from the custom header to obtain the port number, which may be changed in the custom packet to accommodate limitations of the middleware.
1 . A method comprising:
encrypting an original packet and encapsulating the encrypted packet for tunneling;
modifying the tunneling encapsulated encrypted packet, wherein the modifying comprises adding a custom header to the tunneling encapsulated encrypted packet, changing a first port number in a tunnel user datagram protocol (UDP) header to a second port number, and recording the first port number or an offset between the first and second port numbers into the custom header; and
transmitting the modified packet to a destination.
2 . The method of claim 1 further comprising determining a source identifier and a hash key derived from a L3 or L4 header of the original packet.
3 . The method of claim 2 further comprising storing the source identifier and the hash key from the original packet prior to encrypting the original packet.
4 . The method of claim 3 further comprising:
storing the source identifier and a second hash key derived from a second original packet;
encrypting the second original packet and encapsulating the encrypted second original packet for tunneling;
modifying the tunneling encapsulated, encrypted second original packet, wherein the modifying comprises adding a second custom header to the tunneling encapsulated encrypted second original packet, changing a third port number in a tunnel user datagram protocol (UDP) header to a fourth port number, and recording the third port number or an offset between the third and fourth port numbers into the custom header to obtain a second modified packet; and
transmitting the second modified packet to a second destination.
5 . The method of claim 1 , further comprising passing the original packet to a networking stack for the encrypting and encapsulating, wherein the modifying is after the networking stack encrypts and encapsulates the original packet for tunneling.
6 . The method of claim 1 , wherein the first port number is an open port of a firewall between a source of the original packet and the destination.
7 . A method comprising:
retrieving a base port number or port offset from a custom header of a tunneling encapsulated packet that comprises an encrypted packet, the custom header, a tunnel header, a tunnel user datagram protocol (UDP) header that indicates a first port number, and a tunnel Internet Protocol (IP) header;
modifying, the tunneling encapsulated packet to change the first port number in the tunnel UDP header to a second port number that is the base port number or based on applying the port offset to the first port number and removing the custom header; and
passing the modified, tunneling encapsulated packet to a networking stack for tunnel decapsulation and decrypting.
8 . A method comprising:
retrieving a custom header from a tunneling encapsulated packet which comprises an encrypted packet, the custom header, a tunnel header, a tunnel user datagram protocol (UDP) header, and a tunnel Internet Protocol (IP) header;
determining an identifier of a source of the encrypted packet from the customer header;
selecting a destination from a plurality of destinations based, at least in part, on the source identifier determined from the custom header; and
transmitting the tunneling encapsulated packet to the selected destination.
9 . The method of claim 8 , further comprising determining, from the custom header, a hash key derived from a L3 or L4 header of the encrypted packet, wherein selecting the destination is also based on the hash key.
10 . The method of claim 9 , wherein selecting the destination based on the source identifier and the hash key comprises load balancing based on the hash key.