Hardware-based packet editor

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of co-pending U.S. patent application entitled “Hardware-Based Packet Editor”, Ser. No. 13/433,290, filed on Mar. 29, 2012.

BACKGROUND OF THE INVENTION

1. Field

This invention relates generally to data communications, and more specifically, to a service gateway.

2. Background

Service gateways such as firewall, server load balancers have been deployed by service providers and enterprises. In the past, service gateways were used for special purposes such as security. They are, however, used in expanded ways today. Many service providers deploy service gateways to perform various service gateway applications to examine and analyze data packets of a communication session between a host device and a server computer. Many gateway applications modify the packets to assist the analysis of the data packets and the communication sessions. Packet modification is a computation intensive and memory access intensive task. The modification task is usually performed by a processor module of a service gateway. Typically the processor or processor module analyzes a data packet, determines the necessary modification data blocks, creates a packet memory buffer, copies some data from the data packet into the data packet memory buffer and copies the modification data blocks into the packet memory buffer. When the data copying is completed, the processor has generated a new data packet from the original data packet. The service gateway then sends the generated data packet onto the network.

The data packet modification process is costly to the processor module, consuming CPU cycles and memory access bandwidth. If the data packet modification process can be offloaded and handled by a high performing hardware-based module of service gateway, the processor module can allocate its resources to handle additional data packets or additional communication sessions.

Therefore, there is a need to introduce a hardware-based high performing packet editing module to handle the data packet modification.

BRIEF SUMMARY OF THE INVENTION

According to one embodiment of the present invention, a method for modifying a data packet by a hardware-based packet editor, comprises: receiving, by the packet editor, a packet editing script comprising one or more script entries indicating modifications to be applied to the data packet and a data block comprising data for the modified packet; for each given script entry in the packet editing script, copying, by the packet editor, data in the data block at a location and a size identified in the given script entry into a packet buffer; and generating, by the packet editor, a modified data packet with the data in the packet buffer.

In one aspect of the present invention, the copying comprises: retrieving the given script entry of the packet editing script; determining whether the given script entry is a first script entry for the modified data packet; in response to determining that the given script entry is the first script entry for the modified data packet, reserving the packet buffer for the modified data packet; copying the data in the data block at a block location and with a block length identified in the given editing script into the packet buffer; determining whether the given script entry is a last script entry for the modified data packet; in response to determining that the given script entry is not the last script entry for the modified data packet, performing the copying the data in the data block at a block location and with a block length identified in the given script entry into the packet buffer and the determining whether the given script is a last script entry for the next given script entry of the packet editing script.

In one aspect of the present invention, the determining whether the given script entry is the first script entry comprises: determining whether a start of packet (SOP) indicator in the given script entry indicates that the given script entry is the first script entry for the modified data packet.

In one aspect of the present invention, the determining whether the given script entry is the last script entry comprises: determining whether an end of packet (EOP) indicator in the given script entry indicates that the given script entry is the last script entry for the modified data packet.

In one aspect of the present invention, the reserving and the copying the data in the data block at a block location and with a block length identified in the given script entry into the packet buffer comprises: setting a packet buffer marker at a beginning of the packet buffer; appending a copy of the data in the data block at the block location and with the block length identified in the given editing script to the packet buffer at the packet buffer marker; and modifying the packet buffer marker by the block length identified in the given editing script.

In one aspect of the present invention, the generating comprises: in response to determining that the given script entry is the last script entry for the modified data packet, generating the modified data packet with the data in the packet buffer.

In one aspect of the present invention, the generating the modified data packet with the data in the packet buffer further comprises: determining whether the given script entry is the last script entry in the packet editing script; and in response to determining that the given script entry is not the last script entry in the packet editing script, repeating the retrieving, the determining whether the given script entry is a first script entry, the reserving, the copying the data in the data block at a block location and with a block length identified in the given script entry into the packet buffer, the determining whether the given script entry is a last script entry, the performing, and the generating the modified data packet with the data in the packet buffer for a next given script entry in the packet editing script.

In one aspect of the present invention, the determining whether the given script entry is the last script entry in the packet editing script comprises: determining whether an end of table (EOT) indicator in the given script entry indicates that the given script entry is the last script entry in the packet editing script.

According to another embodiment of the present invention, a method for processing a data packet by a service gateway comprising a processor, comprises: receiving, by the processor, a data packet from a host to be sent to a server, or from the server to be sent to the host; determining, by the processor, that the data packet requires modification prior to sending to the server or the host; generating, by the processor, a packet editing script, the script comprising one or more script entries indicating modifications to be applied to the data packet and a data block comprising data for the modified packet, wherein the generating comprises: for each and any given portion of the data packet determined to be included in the modified packet, generating a first script entry identifying a first location and a first length in the data block corresponding to the given portion determined to be included; for each and any given portion of the data packet determined to be removed from the data packet, omitting generation of a script entry corresponding to the given portion determined to be removed; and for each and any new data determined to be added to the modified packet, generating the new data to be comprised in the data block of the packet editing script and generating a second script entry identifying a second location and a second length in the data block corresponding to the new data; and sending, by the processor, the packet editing script to a hardware-based packet editor, wherein the packet editor generates the modified packet according to the script entries in the packet editing script.

System and computer program products corresponding to the above-summarized methods are also described and claimed herein.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE FIGURES

FIG. 1 illustrates an embodiment of a communication session processing method using a service gateway having a hardware-based packet editor according to the present invention.

FIG. 2 illustrates an embodiment of a packet processing flow according to the present invention.

FIG. 3 illustrates an embodiment of a packet editing script according to the present invention.

FIGS. 4 and 4a illustrate an embodiment of a packet editor processing flow according to the present invention.

FIG. 5 illustrates an example of a removal of a HTTP header attribute according to an embodiment of the present invention.

FIG. 6 illustrates an example of an insertion of a HTTP header and a fragmentation of a packet into two packets according to an embodiment of the present invention.

FIG. 7 illustrates additional embodiments of a service gateway application according to the present invention.

DETAILED DESCRIPTION OF THE INVENTION

The following description is presented to enable one of ordinary skill in the art to make and use the present invention and is provided in the context of a patent application and its requirements. Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. Thus, the present invention is not intended to be limited to the embodiment shown but is to be accorded the widest scope consistent with the principles and features described herein.

The present invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In a preferred embodiment, the present invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.

Furthermore, the present invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport eh program for use by or in connection with the instruction execution system, apparatus, or device.

The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W) and DVD.

A data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.

Input/output or I/O devices (including but not limited to keyboards, displays, point devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.

Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified local function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

In an embodiment illustrated in FIG. 1, a service gateway 300 processes a communication session 400 between a host 100 and a server 200. Communication session 400 is delivered over a data network 150.

In one embodiment, data network 150 includes an Internet Protocol (IP) network, a corporate data network, a regional corporate data network, an Internet service provider network, a residential data network, a wired network such as Ethernet, a wireless network such as a WiFi network, a Bluetooth network, or a cellular network. In one embodiment, data network 150 resides in a data center, or connects to a network or application network cloud.

Host 100 is a computing device with network access capabilities. In one embodiment, host 100 is a workstation, a desktop personal computer or a laptop personal computer, a Personal Data Assistant (PDA), a tablet PC, a smartphone, or a cellular phone, a set-top box, an Internet media viewer, an Internet media player, a smart sensor, a smart medical device, a net-top box, a networked television set, a networked DVR, a networked Blu-ray player, a media center, or a network connected device.

Server 200 is a computing device typically coupled to a processor and a computer readable medium which stores computer readable program code. Server 200, with the processor and the computer readable program code, implements functionality of a Web server, a file server, a video server, a database server, an application server, a voice system, a conferencing server, a media gateway, a media center, an app server or a network server providing a network service or an application service to host 100 using the communication session 400.

Service gateway 300 is operationally coupled to a processor module 310, a packet editor 350, a network interface module 330, and a computer readable medium 340. The computer readable medium 340 stores computer readable program code, which when executed by the processor module 310, implements the various embodiments of the present invention as described herein. In some embodiments, service gateway 300 is implemented as a server load balancer, an application delivery controller, a service delivery platform, a traffic manager, a security gateway, a component of a firewall system, a component of a virtual private network (VPN), a load balancer for video servers, a gateway to distribute load to one or more servers, a Web HyperText Transport Protocol (HTTP) server handling the HTTP layer of the HTTP service session, or a gateway performing network address translation (NAT).

Processor module 310 typically includes one or more general processors or micro-processors. In one embodiment, processor module 310 includes a multi-core microprocessor. In one embodiment, processor module 310 includes a memory unit storing variables used during execution of the computer readable program code stored in computer readable medium 340.

Network interface module 330 connects to data network 150. Network interface module 330 receives data packets of communication session 400 from host 100 and server 200, and sends data packets of communication session 400 to host 100 and server 200.

Packet editor 350 is a hardware-based packet processing accelerating module, typically comprising high performing capabilities to process data packets. In one embodiment, packet editor 350 includes a field programmable gate array (FPGA) module, an application specific integrated circuit (ASIC), a digital signal processor (DSP), or a circuitry capable of performing the high speed processing needs of packet editor 350.

In one embodiment, host 100 sends a data packet 403 of communication session 400 towards server 200. Service gateway 300 receives data packet 403 through network module 330. Processor module 310 processes data packet 403 according to the computer readable program code stored on the computer readable medium 340. Processor module 310 determines that data packet 403 is to be modified by packet editor 350. Packet editor 350 receives data packet 403 and generates data packet 408. Network module 330 transmits data packet 408 to server 200.

In one embodiment, server 200 sends a data packet 418 of communication session 400 towards host 100. Service gateway 300 receives data packet 418 through network module 330. Processor module 310 processes data packet 418 according to the computer readable program code stored on the computer readable medium 340. Processor module 310 determines that data packet 418 to be modified by packet editor 350. Packet editor 350 receives data packet 418 and generates data packet 413. Network module 330 transmits data packet 408 to server 200.

In one embodiment, data packet 403 is a packet, and packet editor 350 removes a part of HTTP header of data packet 403 to generate data packet 408. In one embodiment, 418 is a HTTP packet and packet editor 350 inserts a HTTP header to data packet 418 in order to generate data packet 413.

In one embodiment, data packet 403 is an IP packet comprising an IP header, and packet editor 350 inserts a second IP header to data packet 403 in order to generate an IP tunnel data packet 413. In one embodiment, packet editor 350 performs IP fragmentation to generate data packet 413 and a second data packet (not shown) prior to sending data packet 413 and the second data packet to server 200. In one embodiment, data packet 418 is an IP tunnel packet and packet editor 350 removes an IP header from data packet 418 in order to generate data packet 413.

In one embodiment, packet editor 350 processes data packet 403 to generate data packet 408 by copying one or more data blocks of data packet 403 onto data packet 408, copying additional data blocks onto data packet 408 through instruction from processor module 310, computing a checksum using one or more parts of data packet 403, and placing the checksum onto data packet 408.

The above mentioned data packet modification of data packet 408 are applicable in many implementations of service gateway 300, for example, as a HTTP proxy server, TCP proxy server, Layer 3/Layer 4 tunnel gateway, a firewall, IP tunnel gateway, IPv4/IPv6 tunneling gateway, IP-IP tunneling gateway.

FIG. 2 illustrates service gateway 300 processing a data packet 405. Service gateway 300 receives a data packet 405. Data packet 405 may be sent by host 100 or server 200. Service gateway 300 implements a service gateway application 314, which is a software residing in computer readable medium 340 executed by processor module 310. Application 314 determines, based on data packet 405, that data packet 405 requires modification. Application 314 generates a packet editing script 512. Packet editing script 512 includes one or more script entries that indicate the necessary modification(s) to be applied to data packet 405. When the application 314 determines that data is to be included in the data packet 305, the application 314 generates a script entry describing the data to be included. When the application 314 determines that data is to be removed from the data packet 405, the application 314 omits generating a script entry that would describe the data being removed. When the application 314 determines that data is to be inserted into the data packet 405, the application 314 generates a script entry describing the data to be inserted. A more detailed description of the packet editing script 512 follows later in this specification.

For example, in one embodiment, application 314 determines that a HTTP header is to be removed from data packet 405. Packet editing script 512 describes the part of HTTP header to be removed. In one embodiment, application 314 determines that a HTTP header is to be inserted into data packet 405. Packet editing script 512 describes the location where the HTTP header is to be inserted and the data for the HTTP header. In one embodiment, application 314 determines that an additional IP header is to be inserted into data packet 405. Packet editing script 512 describes the details of the additional IP header such that packet editor 350 will perform the insertion. In one embodiment, packet editing script 512 includes data packet 405. Application 314 then sends the packet editing script 512 to the packet editor 350, effectively informing the packet editor 350 that it is to modify data packet 405 using packet editing script 512.

Packet editor 350 receives packet editing script 512 and generates data packet 415 based on the packet editing script 512.

In one embodiment, packet editor 350 sends data packet 415 to network module 330 for transmission. In one embodiment, packet editor 350 informs application 314 after generation of data packet 415. Application 314 informs network module 330 to transmit data packet 415.

FIG. 3 illustrates a packet editing script 512. In one embodiment, packet editing script 512 includes a script entry table 524 and a data block 527.

Script entry table 524 includes a script entry 542. In one embodiment, script entry 542 includes a plurality of field comprising a block location 551, a block length 552, a start-of-packet indication (SOP) 554, an end-of-packet indication (EOP) 553, and an end-of-script indication (EOT) 555. In one embodiment, SOP 554, EOP 553 and EOT 555 are 1-bit long indicators; block location 551 has a 10-bit value; block length 552 has an 11-bit value. Script entry 542 may include one or more unused multi-bit fields such that script entry 542 is a 4-byte or 32-bit long data structure.

Block location 551 and block length 552 references a block of data in data block 527. Block location 551 refers to the location of data block 527.

In one embodiment, script entry table 524 includes a second script entry 543 with the same fields. The one or more script entries, such as script entry 542 and script entry 543, are used by packet editor 350 to generate a modified data packet.

Data block 527 contains one or more blocks of data to generate a modified data packet.

FIG. 4 illustrates packet editor 350 generating a data packet 353 based on packet editing script 512. In this embodiment, packet editor 350 includes a control memory 354, a control module 356, a packet buffer 359, and a packet buffer marker 358.

FIG. 4a illustrates, in conjunction with FIG. 4, a processing flow of packet editor 350. In step 931, in response to receiving the packet editing script 512, packet editor 350 retrieves one or more script entries from script entry table 524 and stores the script entries into control memory 354. In one embodiment packet editor 350 retrieves script entry 542 from script entry table 524 and stores script entry 542 into control memory 354. Packet editor 350 examines EOT 555 of script entry 542. In one embodiment, EOT 555 has a value of 0. Packet editor 350 determines script entry 542 is not the last script entry of script entry table 524. Packet editor 350 retrieves a next script entry from script entry table 524. In one embodiment, EOT 555 has a value of 1. Packet editor 350 determines script entry 542 is the last script entry of script entry table 524. Packet editor 350 completes step 951.

In step 933, control module 356 retrieves script entry 542 from control memory 354, and starts to process script entry 542.

In step 935, control module 356 examines SOP 554. In one embodiment, SOP 554 has a value of 1. Control module 356 reserves packet buffer 359 in order to generate a data packet 353. Control module 356 sets the value of packet buffer marker 358 at 0, or at the beginning of packet buffer 359. In one embodiment, SOP 554 has a value of 0. Control module 356 proceeds to another step.

In step 937, control module 356 copies a block of data from data block 527 to packet buffer 359, based on block location 551 and block length 552 of script entry 542. Control module 356 appends to packet buffer 359 at the packet buffer marker 358 the block of data from data block 527 starting from block location 551 with a size of block length 552. Control module 356 increases packet buffer marker 358 by the value of block length 552, such that the subsequent copy would start after the current copied data block.

In step 939, control module 356 examines EOP 553. In one embodiment, EOP 553 has a value of 1. Control module 356 determines the completion of generating data packet 353 in packet buffer 359, with a block of data up to the packet buffer marker 358. Packet editor 350 continues with step 943. In one embodiment, EOP 553 has a value of 0, step 943 is skipped, and control module 356 proceeds to step 949.

In step 943, packet editor 350 further includes a checksum module 357. Checksum module 357 computes a checksum for data packet 353. In one embodiment, data packet 353 includes an IP packet. Checksum module 357 computes a checksum for the IP header and modifies data packet 353 with the computed checksum. In one embodiment, data packet 353 includes a TCP or UDP packet, checksum module 357 computes a checksum for the corresponding TCP or UDP packet, and modifies data packet 353 with the computed checksum. In one embodiment, data packet 353 includes a packet format requiring a checksum, checksum module 357 computes a checksum for the packet format and modifies data packet 353 with the computed checksum.

In step 949, control module 356 examines EOT 555. In one embodiment, EOT 555 has a value of 1. Control module 356 determines processing of packet editing script 512 is completed. In one embodiment, EOT 555 has a value of 0, control module 356 fetches a second script entry from control memory 354 and repeats performing steps 933-949 for the second script entry.

FIG. 5 illustrates an example packet editing script 612 to remove a HTTP header field. In this embodiment, script entry table 624 includes script entry 642 and script entry 643. Script entry 642 includes

Block location 651=8

Block length 652=192

SOP 654=1

EOP 653=0

EOT 655=0

Script entry 643 includes

Block location 661=284

Block length 662=726

SOP 664=0

EOP 663=1

EOT 665=1

Data block 627 includes a total of 1000 bytes of data, which may be a HTTP packet.

Packet editor 350 constructs a data packet 409 according to packet editing script 612, as illustrated in FIG. 4. More specifically, packet editor 350 obtains script entry 642 of script entry table 624. Script entry 642 indicates in EOT 655 (of value 0) that script entry 642 is not the last script entry in script entry table 624. SOP 654 of value 1 indicates a beginning of a data packet. Packet editor 350 prepares a packet buffer for data packet 409. Packet editor 350 examines block location 651 and block length 652. Packet editor 350 copies a total of 192 (value of block length 652) bytes of data block 627, starting at location 8 (value of block location 651).

EOP 653 of value 0 indicates generation of data packet 409 is not completed. After completion of script entry 642, packet editor 350 obtains script entry 643 and processes accordingly. SOP 664 has a value of 0, indicating to packet editor 350 to continue with data packet 409. Packet editor 350 examines block location 661 and block length 662. Packet editor 350 copies 726 (value of block length 662) bytes of data block 627 starting at location 284 (value of block location 661) of packet editing script 612. Upon completion of copying, packet editor 350 determines from the value (1) of EOP 663 that data packet 409 generation is completed.

EOT 665 of value 1 indicates that script entry 643 is the last entry in script entry table 624. Packet editor 350 determines the completion of processing of packet editing script 612.

In this embodiment, packet editor 350 does not copy data block from location 192 to location 284 (for a total of 92 bytes). In one embodiment, the data block not copied represents a HTTP header field to be removed.

FIG. 6 illustrates an example a packet editing script 712 to insert of data, such as a HTTP header field, and to generate two data packets. In one embodiment, generation of two packets indicates fragmenting an IP packet into two IP packets. In this example, packet editing script 712 includes script entry table 724, which includes script entries 742, 743, 744, 745, and 746.

Script entry 742 includes

Block location 821=0

Block length 822=231

SOP 824=1

EOP 823=0

EOT 825=0

Script entry 743 includes

Block location 831=1544

Block length 832=200

SOP 834=0

EOP 833=0

EOT 835=0

Script entry 744 includes

Block location 841=251

Block length 842=1073

SOP 844=0

EOP 843=1

EOT 845=0

Script entry 745 includes

Block location 851=1524

Block length 852=20

SOP 854=1

EOP 853=0

EOT 855=0

Script entry 746 includes

Block location 861=1324

Block length 862=200

SOP 864=0

EOP 863=1

EOT 865=1

Data block 727 includes an original packet 772, a second packet header 773, and a to-be-inserted data block 774. In this example, original packet 772 has a size of 1504 bytes; second packet header 773 is of size 20 bytes and to-be-inserted data block 774 is of size 200 bytes.

The block location of original packet 772 is 20 in data block 727. The block location of the second packet header 773 is 1524. The block location of the to-be-inserted data block 774 is 1324.

According to the process illustrated in FIG. 4, packet editor 350 processes in the order of script entries 742, 743, 744, 745 and 746, and generates data packet 411 and data packet 412. In processing script entry 742 with SOP 824 being 1, packet editor 350 prepares data buffer for data packet 411. Packet editor 350 copies a block of data from data block 727 of size 231 bytes (value of block length 822) from location 20 (value of block location 821). The block of data copied is the first 231 bytes of original packet 772. Next, packet editor 350, according to script entry 743, copies a block of data from data block 727 of size 200 (value of block length 832) from location 1544 (value of block location 831) onto data packet 411. The block of data copied includes the entirety of the to-be-inserted data block 774.

Then packet editor 350, according to script entry 744, copies a block of data from data block 727 of size 1073 (value of block length 842) from location 251 (value of block location 841) onto data packet 411. The block of data copied is a data block in original packet 772 immediately following the block of data copied in script entry 742. EOP 843 being 1 indicates completion of data packet 411 generation.

Then packet editor 350 proceeds to process script entry 745. SOP 854 being 1 instructs packet editor 350 to prepare to generate data packet 412. Packet editor 350 copies a block of data from data block 727 of size 20 bytes (value of block length 852) from location 1524 (value of block location 851) onto data packet 412. The block of data copied includes the entirety of the second packet header 773.

Packet editor 350 proceeds to process script entry 746. Packet editor 350 copies a block of data from data block 727 of size 200 bytes (value of block length 862) from location 1324 (value of block location 861) onto data packet 412. The block of data copied is the remaining data of the original packet 772, after the block of data copied in script entry 744.

EOP 863 of script entry 746 has a value 1. Packet editor 350 determines data packet 412 generation is completed. EOT 865 of script entry 746 has a value 1. Packet editor 350 determines processing of packet editing script 712 is completed. As a result of completing packet editing script 712, packet editor 350 generates data packet 411 and data packet 412.

The above figures illustrate embodiments of packet editing script 512 to remove or not to copy one or more blocks of data from data block 527 and to copy one or more blocks of data from data block 527. By using the copying instructions, those skilled in the art may formulate a packet editing script for various data packet manipulation.

In one embodiment, service gateway application 314, illustrated in FIG. 7, implements a network address translation of an input data packet 405. Service gateway application 314 prepares a data block 532 as a replacement IP/TCP/UDP header for data packet 405. Service gateway application 314 creates a packet editing script 512 wherein the data block 527 includes data packet 405 and data block 532, and script entry table 524 to include one or more script entries to instruct packet editor 350 not to copy the IP/TCP/UDP header of data packet 405, copy data block 532, and copy the remaining portion of data packet 405.

In one embodiment of the present invention, service gateway application 314 implements an IP tunneling gateway (such as IP-IP tunnel, IPv4/IPv6 tunnel). Service gateway application 314 receives data packet 405 and determines that an IP tunnel header is to be inserted. Service gateway application 314 prepares data block 532 as the IP tunnel header. Service gateway application 314 creates a packet editing script 512, where the data block 527 includes data packet 405 and data block 532, and script entry table 524 to include one or more script entries to instruct packet editor 350 to copy data block 532, and to copy data packet 405.

In one embodiment, service gateway application 314 determines an IP tunnel header is to be removed. Service gateway application 314 determines the size of the IP tunnel header. Service gateway application 314 creates a packet editing script 512, where the data block 527 includes data packet 405, and a script entry 542 such that the block location of script entry 542 skips the tunnel header. Packet editing script 512 instructs packet editor 350 to copy data packet 405 while skipping, or not copying, the IP tunnel header.

In one embodiment, service gateway application 314 implements a proxy service such as TCP proxy or HTTP proxy. Service gateway application 314 receives an input data packet 405 and determines that a first plurality of data blocks in data packet 403 is to be replaced by a second plurality of data blocks. Service gateway application 314 prepares the second plurality of data blocks, and creates a packet editing script 512, where the data block 527 of packet editing script 512 includes data packet 405 and the second plurality of data blocks. The packet editing script 512 also prepares script entry table 524 to include a plurality of script entries instructing packet editor 350 to copy certain data blocks from data packet 405, not to copy the first plurality of data blocks from data packet 405, and to copy the second plurality of data blocks, in essence replacing the first plurality of data blocks with the second plurality of data blocks.

Although the present invention has been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations to the embodiments and those variations would be within the spirit and scope of the present invention. Accordingly, many modifications may be made by one of ordinary skill in the art without departing from the spirit and scope of the appended claims.