Juniper Networks, Inc.

Erin MacNeil

Sreekanth Rupavatharam

Hariprasad Shanmugam

Prashant Singh

A disclosed method may include (1) receiving a packet at a tunnel driver in kernel space on a routing engine of a network device, (2) identifying, at the tunnel driver, metadata of the packet that indicates whether at least one firewall filter had already been correctly applied to the packet before the packet arrived at the tunnel driver, (3) determining, based at least in part on the metadata of the packet, that the firewall filter had not been correctly applied to the packet before the packet arrived at the tunnel driver, and then in response to determining that the firewall filter had not been correctly applied to the packet, (4) invoking at least one firewall filter hook that applies at least one firewall rule on the packet before the packet is allowed to exit kernel space on the routing engine. Various other apparatuses, systems, and methods are also disclosed.

Apparatus, system, and method for applying firewall rules at dynamic offsets within packets in kernel space

A socket-intercept layer in kernel space on a network device may intercept a packet destined to egress out of the network device. The socket-intercept layer may then query a routing daemon for the Maximum Transmission Unit (MTU) value of the interface out of which that packet is to egress from the network device. In response to this query, the routing daemon may provide the socket-intercept layer with the MTU value of that interface. A tunnel driver in kernel space may identify the size of the packet and fragment the packet into segments whose sizes are each less than or equal to the MTU value of the interface. The tunnel driver may then push the segments of the packet to a packet forwarding engine on the network device. In turn, the packet forwarding engine may forward the segments of the packet to the corresponding destination via the interface.

Apparatus, device, and method for fragmenting packets into segments that comply with the maximum transmission unit of egress interfaces

A disclosed method may include (1) receiving a packet at a tunnel driver in kernel space on a routing engine of a network device, (2) identifying, at the tunnel driver, metadata of the packet that indicates whether at least one firewall filter had already been correctly applied to the packet before the packet arrived at the tunnel driver, (3) determining, based at least in part on the metadata of the packet, that the firewall filter had not been correctly applied to the packet before the packet arrived at the tunnel driver, and then in response to determining that the firewall filter had not been correctly applied to the packet, (4) invoking at least one firewall filter hook that applies at least one firewall rule on the packet before the packet is allowed to exit kernel space on the routing engine. Various other apparatuses systems, and methods are also disclosed.

A device may receive, by a kernel of the device and from a loadable kernel module of the device, information that instructs the kernel to invoke a callback function associated with the loadable kernel module based on an execution of a hook of the kernel. The device may receive, by the kernel of the device and from an application of the device, a socket application programming interface (API) call. The socket API call may include control information. The device may execute, by the kernel of the device, the hook based on receiving the socket API call. The device may invoke, by the kernel of the device, the callback function associated with the loadable kernel module based on executing the hook to permit a functionality associated with the callback function to be provided. The kernel may provide the control information, associated with the socket API call, to the callback function as an argument.

Intercepting socket metadata

A device may receive, from the packet processing component and through an internal interface, a packet that includes a virtual routing and forwarding (VRF) interface identifier associated with a VRF interface of a virtual device. The internal interface may be associated with multiple external interfaces. The device may modify a value identifying an incoming interface via which the packet is received after receiving the packet that includes the VRF interface identifier. The modified value may be associated with the virtual device, and the modified value may allow an upper communication layer to determine that the packet is associated with the virtual device. The device may provide the packet to the upper communication layer after modifying the value identifying the incoming interface via which the packet is received to permit the upper communication layer to forward the packet to a destination.

Utilizing virtual routing and forwarding (VRF) interfaces to manage packet transmission through an internal interface

A disclosed method may include (1) detecting, at a network stack of a network device, a packet that (A) is destined at least intermediately for a network interface of the network device and (B) has been flagged by the network stack to be dropped instead of forwarded to the network interface based on at least one characteristic of the packet, (2) instead of dropping the packet, forwarding the packet to an alternative network interface of the network device that analyzes content of packets, (3) identifying, at the alternative network interface, the characteristic of the packet, and then (4) executing, based on the characteristic of the packet, at least one action in connection with the packet that improves the performance of the network device. Various other apparatuses, systems, and methods are also disclosed.

Apparatus, system, and method for debugging network devices based on the contents of dropped packets

The disclosed apparatus may include (1) a physical routing engine that comprises (A) a socket-intercept layer, stored in kernel space, that (I) intercepts a packet that is destined for a remote device and (II) queries, in response to intercepting the packet in kernel space, a routing daemon in user space for an MTU value of an egress interface that is to forward the packet from the network device to the remote device and (B) a tunnel driver, stored in kernel space, that fragments the packet into segments whose respective sizes each comply with the MTU value of the egress interface and (2) a physical packet forwarding engine that forwards the segments of the packet to the remote device by way of the egress interface. Various other apparatuses, systems, and methods are also disclosed.

Apparatus, system, and method for fragmenting packets into segments that comply with the maximum transmission unit of egress interfaces

A disclosed method for applying firewall rules on packets in kernel space on network devices may include (1) intercepting, via a socket-intercept layer in kernel space on a routing engine of a network device, a packet that is destined for a remote device and then, in response to intercepting the packet in kernel space on the routing engine, (2) identifying an egress interface index that specifies an egress interface that (A) is external to kernel space and (B) is capable of forwarding the packet from the network device to the remote device and (3) applying, on the packet in kernel space, at least one firewall rule based at least in part on the egress interface index before the packet egresses from the routing engine. Various other apparatuses, systems, and methods are also disclosed.

Apparatus, system, and method for applying firewall rules on packets in kernel space on network devices

The disclosed method may include (1) receiving a synchronize message from a computing device to initiate synchronization between the computing device and a server with respect to a communication protocol, (2) notifying an application in user space on the server of the synchronize message such that the application in user space selects at least one attribute to be applied to a communication session resulting from the synchronization between the computing device and the server, (3) sending a synchronize acknowledgment that identifies the attribute selected by the application in user space to the computing device to further the synchronization between the computing device and the server, and then (4) establishing the communication session with the attribute selected by the application in user space upon receiving an acknowledgment message from the computing device to complete the synchronization. Various other methods, systems, and apparatuses are also disclosed.

Method, system, and apparatus for achieving user space intervention during connection-establishment handshakes

The disclosed computer-implemented method may include (1) identifying, in kernel space on a network device, a packet that is destined for a remote device, (2) passing, along with the packet, metadata for the packet to a packet buffer in kernel space on the network device, (3) framing, by the kernel module in kernel space, the packet such that the packet egresses via a tunnel interface driver on the network device, (4) encapsulating, by the tunnel interface driver, the packet with the metadata, and then (5) forwarding, by the tunnel interface driver, the packet to the remote device based at least in part on the metadata with which the packet was encapsulated. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Carp, Canada

Erin MacNeil