Packet filtering system and methods

1. A network data filtering method, comprising:

compiling a rule and a procedure into at least one machine readable rule and at least one procedure;

loading the compiled at least one rule and the compiled at least one procedure onto a device with at least one network adapter;

intercepting network data passing through the at least one network adapter;

interpreting the network data with respect to the loaded at least one rule; and

executing at least one procedure based on the results of a comparison;

wherein the loading step includes:

converting the compiled at least one rule into at least one 5-tuple filtering rule;

creating a tuple buffer to hold the at least one 5 -tuple filtering rule, the tuple buffer defined to have a beginning;

setting a next byte pointer to the beginning of the tuple buffer;

constructing a 5-tuple for a filtering rule, copying the 5-tuple to the tuple buffer at a location set by the next byte pointer, and incrementing said next byte pointer;

setting a next rule tuple element to point to the next byte pointer; and

repeating the constructing step while more filter rule statements exist in a compiled rules file.

2. The network data filtering method of claim 1 , wherein the rules are entered by a user.

3. The network data filtering method of claim 1 , further comprising the step of loading the compiled at least one rule and the compiled at least one procedure for each network adapter within the device.

4. The network data filtering method of claim 1 , wherein the intercepting step occurs within a device driver operating on the device.

5. The network data filtering method of claim 1 , wherein each of said at least one 5-tuple filtering rules includes a length field, a procedure index, a rule offset field, a data offset field and a value field.

6. The network data filtering method of claim 5 , wherein the rule offset field includes a next flag.

7. A network data filtering method, comprising:

compiling a rule and a procedure into at least one machine readable rule and at least one procedure;

loading the compiled at least one rule and the compiled at least one procedure onto a device with at least one network adapter;

intercepting network data passing through the at least one network adapter;

interpreting the network data with respect to the loaded at least one rule; and

executing at least one procedure based on the results of a comparison;

wherein the loading step includes converting the compiled at least one rule into at least one 5-tuple filtering rule;

wherein each of said at least one 5-tuple filtering rules includes a length field, a procedure index, a rule offset field, a data offset field and a value field;

wherein the rule offset field includes a next flag; and

wherein the interpreting step further comprises:

obtaining a pointer to a packet;

obtaining a tuple pointer to a 5-tuple;

setting a loop termination flag to false;

repeating in a loop, until the loop termination flag is true, the steps of:

implementing, if the length field of the 5-tuple pointed to by the tuple pointer is zero, the steps of:

calling a procedure function corresponding to the procedure index of the 5-tuple designated by the tuple pointer; and

passing as parameters to the procedure function the tuple pointer and the packet pointer; and

setting the loop termination flag to true;

implementing, if the length field of the 5-tuple pointed to by the tuple pointer is not zero, the steps of:

calculating a starting location by adding to a value of the packet pointer a value of the data offset field of the 5-tuple designated by the tuple pointer;

calculating an ending location by adding to the value of the packet pointer the value of the data offset field of the 5-tuple designated by the tuple pointer and a value of the data length field pointed to by the 5-tuple designated by the tuple pointer;

comparing a portion of a packet data, beginning at the starting location and ending at the ending location, to the value field of the 5-tuple designated by the tuple pointer;

executing, if the packet data comparison returns a true:

pointing, if the next flag and the procedure index of the 5-tuple designated by the tuple pointer indicate a logical AND relationship with a next 5-tuple, the tuple pointer to the next 5-tuple; or

calling, if the next flag and the procedure index of the 5-tuple designated by the tuple pointer indicate a logical OR relationship with the next 5-tuple, a procedure function corresponding to the procedure index of the 5-tuple designated by the tuple pointer and passing the tuple pointer and the packet pointer as parameters to the procedure function; or

calling, if the next flag and the procedure index of the 5-tuple designated by the tuple pointer indicate no relationship to the next 5-tuple, the procedure function corresponding to the procedure index of the 5-tuple designated by the tuple pointer and passing the tuple pointer and the packet pointer as parameters to the procedure function;

executing, if the packet data comparison returns a false;

pointing, if the next flag and the procedure index of the 5-tuple designated by the tuple pointer indicate the logical AND relationship with a the next 5-tuple, the tuple pointer to a 5-tuple in a next rule; or

pointing, if the next flag and the procedure index of the 5-tuple designated by the tuple pointer indicate no relationship with the next 5-tuple, the tuple pointer to the 5-tuple in the next rule; or

pointing, if the next flag and the procedure index of the 5-tuple designated by the tuple pointer indicate the logical OR relationship with the next 5-tuple, the tuple pointer to the next 5-tuple.

8. The network data filtering method of claim 7 , wherein the network data corresponds to network packets.