Method and apparatus for resource locator identifier rewrite
View Patent ↗A method and apparatus for resource locator identifier rewrite have been presented. A security device receives from a resource host over a non-secure hypertext transfer protocol (HTTP) session a response to a request received from a client over a secure HTTP session. The response includes a uniform resource locator (URL) that is supposed to be for a resource host, but the URL does not designate a secure resource access protocol and the resource host requires the secure resource access protocol. The URL is located in the response and modified to designate the secure resource access protocol. After modification, the response is transmitted via the secure resource access protocol session to the client.
1. A method in a network security device comprising:
receiving from a resource host over a non-secure hypertext transfer protocol (HTTP) session a response to a request received from a client over a secure HTTP session, wherein the response includes a header, a body, and a uniform resource locator (URL) in the response body that is supposed to be for a resource host, but the URL does not designate a secure resource access protocol and the resource host requires the secure resource access protocol;
loading the response into a buffer of a ring buffer;
locating the URL in the response;
rewriting the URL to designate the secure resource access protocol;
parsing boundaries of the response;
transmitting the response via the secure resource access protocol session to the client; and
flushing the buffer up to a partial URL and load the buffer with the response to the partial URL.
2. The method of claim 1 wherein the URL is located and modified if the response includes a header Content-Encoding.
3. The method of claim 1 further comprising ensuring that the response and/or the request does not indicate support of persistent connection.
4. The method of claim 3 wherein ensuring that the response and/or the request does not indicate support of persistent connection comprises:
downgrading the version of HTTP indicated in the header; and
indicating in connection close by either modifying a connection field in the header or inserting a new field in the header.
5. The method of claim 1 wherein the URL is located and modified if the response has a content type of text and transmitting the response without locating and modifying the URL if the content type is not text.
6. The method of claim 1 further comprising ensuring that the response and/or the request does not indicate support of chunked transfer encoding.
7. The method of claim 6 wherein ensuring that the response and/or the request does not indicate support of chunked transfer encoding comprises downgrading the version of HTTP indicated in the header.
8. The method of claim 1 further comprising modifying the request to indicate that the requesting client does not support chunked transfer encoding while preserving persistent connection and chunked transfer encoding in the response if the client supports persistent connection and chunked transfer encoding.
9. The method of claim 1 further comprising modifying the response to prevent the client from using the content length indicated in the response.
10. A network security device comprising:
a set of one or more processors to perform security operations;
a set of one or more interfaces coupled with the set of processors;
a ring buffer to store message data; and
a resource access protocol module coupled with the set of processors, the resource access protocol module to,
load message data for individual resource access protocol sessions into different buffers of the ring buffer;
scan message data to locate resource locator identifiers (RLI) in a body of the message data,
for each located RLI, determine if the located RLI indicates a resource access protocol that should govern a request for a resource indicated by the located RLI,
for each located RLI that does not indicate the resource access protocol, rewrite the located RLI to indicate the resource access protocol,
parse boundaries of the message data
transmit via one of the set of interfaces the response with transport layer information that indicates a port corresponding to the resource access protocol, and
flush one of the buffers in the ring buffer up to a partial RLI and load the one buffer with message data in addition to the partial RLI.
11. The network security device of claim 10 , wherein the resource access protocol module includes a buffer daemon and a scan and parse daemon.
12. The network security device of claim 10 , further comprising a storage device to store a configuration file that indicates a set of one or more resource hosts and their corresponding appropriate request governing resource access protocol.
13. The network security device of claim 10 , further comprising the resource access protocol module to create a chunk with message data from one of the buffers in the ring buffer, wherein the message data includes a plurality of complete RLIs.
14. A non-transitory machine-readable storage medium that provides instructions, executable by a set of one or more processors in a network security device to cause said set of processors to perform operations comprising:
receiving from a resource host over a non-secure hypertext transfer protocol (HTTP) session a response to a request received from a client over a secure HTTP session, wherein the response includes a header, a body, and a uniform resource locator (URL) in the response body that is supposed to be for a resource host, but the URL does not designate a secure resource access protocol and the resource host requires the secure resource access protocol;
loading the response into a buffer of a ring buffer;
locating the URL in the response;
rewriting the URL to designate the secure resource access protocol;
parsing boundaries of the response;
transmitting the response via the secure resource access protocol session to the client; and
flushing the buffer up to a partial URL and load the buffer with the response to the partial URL.
15. The non-transitory machine-readable storage medium of claim 14 , wherein the URL is located and modified if the response includes a header “Content-Encoding”.
16. The non-transitory machine-readable storage medium of claim 14 , wherein the operations further comprise ensuring that the response and/or the request does not indicate support of persistent connection.
17. The non-transitory machine-readable storage medium of claim 16 , wherein ensuring that the response and/or the request does not indicate support of persistent connection comprises:
downgrading the version of HTTP indicated in the header; and
indicating in connection close by either modifying a connection field in the header or inserting a new field in the header.
18. The non-transitory machine-readable storage medium of claim 14 , wherein the URL is located and modified if the response has a content type of text and transmitting the response without locating and modifying the URL if the content type is not text.
19. The non-transitory machine-readable storage medium of claim 14 , wherein the operations further comprise ensuring that the response and/or the request does not indicate support of chunked transfer encoding.
20. The non-transitory machine-readable storage medium of claim 19 , wherein ensuring that the response and/or the request does not indicate support of chunked transfer encoding comprises downgrading the version of HTTP indicated in the header.
21. The non-transitory machine-readable storage medium of claim 14 , wherein the operations further comprise modifying the request to indicate that the requesting client does not support chunked transfer encoding while preserving persistent connection and chunked transfer encoding in the response if the client supports persistent connection and chunked transfer encoding.
22. The non-transitory machine-readable storage medium of claim 14 , wherein the operations further comprise modifying the response to prevent the client from using the content length indicated in the response.