Architecture and run-time environment for network filter drivers

Abstract

Filtering data packets in a manner that promotes efficient flow of data through a communication path. A filter stack includes one or more filter instances that may filter data packets that pass through the filter stack. The filter stack is associated with one or more protocol stacks that function in communication paths between a computing device and a network. When filtering instances are inserted to or removed from a filter stack, associated protocol stacks may remain capable of transferring data. An abstract interface facilitates inserting and removing filter instances by passing data to filter drivers that create filter instances. A filter driver may create multiple filter instances. Filtering operations associated with filter instances may be bypassed based on the direction of data flow, control flow, and characteristics of packets.

1 . In a computing device that may be communicatively coupled to a network by one or more communication paths and that includes one or more protocol stacks associated with an abstract interface that manages one or more filter instances that may perform filtering operations on packets, a method for filtering packets associated with the one or more protocols so as to conserve processor and network resources, the method comprising: 
 an act of processing an input packet;    an act of the input packet bypassing one or more of the filtering operations associated with a filter instance; and    an act of sending an output packet that may differ from the input packet if a filtering operation was performed.    
   
   
       2 . The method as recited in  claim 1 , wherein processing an input packet comprises the following: 
 an act of processing an input packet associated with a data link layer.    
   
   
       3 . The method as recited in  claim 1 , wherein processing an input packet associated comprises the following: 
 an act of processing an input packet associated with a data link layer driver.    
   
   
       4 . The method as recited in  claim 1 , wherein processing an input packet comprises the following: 
 an act of processing an input packet associated with a transport layer protocol.    
   
   
       5 . The method as recited in  claim 4 , wherein processing an input packet associated with a transport layer protocol comprises the following: 
 an act of processing an input data packet associated with the Transmission Control Protocol.    
   
   
       6 . The method as recited in  claim 4 , wherein processing an input packet associated with a transport layer protocol comprises the following: 
 an act of processing an input data packet associated with the Internet Protocol.    
   
   
       7 . The method as recited in  claim 4 , wherein processing an input packet associated with a transport layer protocol comprises the following: 
 an act of processing an input packet from a transport layer driver.    
   
   
       8 . The method as recited in  claim 1 , wherein processing an input packet compromises the following: 
 an act of processing a data packet transferred along a data path from a transport layer to a data link layer.    
   
   
       9 . The method as recited in  claim 1 , wherein processing an input packet compromises the following: 
 an act of processing a data packet transferred along a data path from a data link layer to a transport layer.    
   
   
       10 . The method as recited in  claim 1 , wherein processing an input packet compromises the following: 
 an act of processing a control packet, which includes request information, and is being transferred along a control path.    
   
   
       11 . The method as recited in  claim 1 , wherein processing an input packet compromises the following: 
 an act of processing a control packet, which includes system indication information, and is being transferred along a control path.    
   
   
       12 . The method as recited in  claim 1 , wherein the input packet bypassing one or more of the filtering operations associated with a filter instance comprises the following: 
 an act of a received input packet bypassing one or more internal filtering operations associated with a filter instance included in a filter stack.    
   
   
       13 . The method as recited in  claim 1 , wherein the input packet bypassing one or more of the filtering operations associated with a filter instance comprises the following: 
 an act of a received input packet bypassing one or more internal filtering operations associated with a filter instance based on characteristics associated with the input packet.    
   
   
       14 . The method as recited in  claim 1  wherein, the input packet bypassing one or more of the filtering operations associated with a filter instance comprises the following: 
 an act of the input packet completely bypassing the filter instance.    
   
   
       15 . The method as recited in  claim 14 , wherein the input packet completely bypassing the filter instance comprises the following: 
 an act of the input packet completely bypassing the filter instance because the filter instance was configured to operate in bypass mode for the communication path along which the input packet is being transferred.    
   
   
       16 . The method as recited in  claim 13 , wherein the input packet bypassing one or more filtering operations associated with a filter instance based on characteristics associated with the input packet comprises the following: 
 an act of bypassing a first set of filtering operations when an input packet is associated with a first protocol and bypassing a second set of filtering operations when an input packet associated with a second protocol.    
   
   
       17 . The method as recited in  claim 16 , wherein the first set of filtering operations and the second set of filtering operations are different.  
   
   
       18 . The method as recited in  claim 1 , wherein sending an output packet that may differ from the input packet if a filtering operation was performed on the input packet comprises the following: 
 an act of sending an output packet that may differ from the input packet if a filtering operation modified the input packet.    
   
   
       19 . In a computing device that may be communicatively coupled to a network by one or more communication paths and that includes one or more protocol stacks associated with an abstract interface that manages a filter stack, a method for filtering packets associated with the one or more protocols so as to conserve processor and network resources, the method comprising: 
 an act of receiving an input packet associated with a protocol;    a step for transferring an output packet the may have been filtered by some but not all of the filtering operations included in a filter stack so as to increase efficiency of the filtering process.    
   
   
       20 . In a computing device that may be communicatively coupled to a network by one or more communication paths and that includes one or more protocol stacks associated one or more filter instances that may perform filtering operations on packets, a method for filtering packets associated with the one or more protocols so as to conserve processor and network resources, the method comprising: 
 an act of a filter instance receiving an input packet;    an act of bypassing a first set of filtering operations when the input packet is transferred across a communication path from a data link layer to a transport layer and bypassing a second set of filtering operations when the input packet is transferred across a communication path from a transport layer to a data link layer; and    an act of sending an output packet that may differ from the input packet if a filtering operation was performed.    
   
   
       21 . The method as recited in  claim 20 , wherein the first set of filtering operations and the second set of filtering operations are different.  
   
   
       22 . The method as recited in  claim 20 , wherein the communication path is a data path.  
   
   
       23 . The method as recited in  claim 20 , wherein the communication path is a control path.  
   
   
       24 . In a computing device that may be communicatively coupled to a network by one or more communication paths and that includes one or more protocol stacks associated one or more filter instances that may perform filtering operations on packets, a method for filtering packets associated with the one or more protocols so as to conserve processor and network resources, the method comprising: 
 an act of a processing a packet currently being transferred across a communication path;    an act of the packet completely bypassing a first filter instance in the communication path because the first filter instance was configured to operate in bypass mode for the communication path; and    an act of the packet being received by a second filter instance in the communication path that was configured to receive packets being transferred across the communication path.    
   
   
       25 . The method as recited in  claim 24 , wherein the packet completely bypassing a first filter instance in the communication path because the first filter instance was configured to operate in bypass mode for the communication path comprises the following: 
 an act of the packet completely bypassing a first filter instance in the communication path because the first filter instance was configured by an abstract interface to operate in bypass mode for the communication path    
   
   
       26 . The method as recited in  claim 25 , further comprising: 
 an act of the abstract interface configuring the filter instance to resume receiving packets.    
   
   
       27 . The method as recited in  claim 24 , an act of the packet completely bypassing a first filter instance in the communication path because the first filter instance was configured to operate in bypass mode for the communication path wherein comprises the following: 
 an act of an input data packet completely bypassing a first filter instance in a data path because the first filter instance was configured to operate in bypass mode for the data path.    
   
   
       28 . The method as recited in  claim 24 , an act of the packet completely bypassing a first filter instance in the communication path because the first filter instance was configured to operate in bypass mode for the communication path wherein comprises the following: 
 an act of an input control packet completely bypassing a first filter instance in a control path because the first filter instance was configured to operate in bypass mode for the control path.    
   
   
       29 . A computer program product for implementing, in a computing device that may be communicatively coupled to a network by one or more communication paths and that includes one or more protocol stacks associated with an abstract interface that manages a filter stack, the filter stack including one or more filter instances that may perform filtering operations on portions of packets, a method for filtering packets associated with the one or more protocols so as to conserve processor and network resources, the computer program product comprising: 
 a computer-readable medium carrying computer-executable instructions, that when executing at the computing device cause the computing device to perform the method, including: 
 an act of processing an input packet;  
 an act of the input packet bypassing one or more of the filtering operations associated with a filter instance; and  
 an act of sending an output packet that may differ from the input packet if a filtering operation was performed on the input packet.