Configuring interactions with a firewall service virtual machine

Patent metadata

Field	Value
Publication number	US-9906494-B2
Application number	US-201414231646-A
Country	US
Kind code	B2
Filing date	Mar 31, 2014
Priority date	Mar 31, 2014
Publication date	Feb 27, 2018
Grant date	Feb 27, 2018

Abstract

For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel virtualization architecture for utilizing a firewall service virtual machine (SVM) on the host to check the packets sent by and/or received for the GVMs. In some embodiments, the GVMs connect to a software forwarding element (e.g., a software switch) that executes on the host to connect to each other and to other devices operating outside of the host. Instead of connecting the firewall SVM to the host's software forwarding element that connects its GVMs, the virtualization architecture of some embodiments provides an SVM interface (SVMI) through which the firewall SVM can be accessed to check the packets sent by and/or received for the GVMs.

First claim

We claim:

1. A method of having a firewall service virtual machine (SVM) process firewall rules on a host on which a plurality of guest virtual machines (GVMs) are executing, the method comprising:
receiving a packet from a source GVM to a destination GVM;
determining that the source and destination GVMs are both executing on the same host;
based on configuration data, determining that the packet has to be examined only at a source side or a destination side; and
based on the determination that the packet has to be examined only at the source side or the destination side, sending a set of attributes of the packet to the SVM only once, so that the SVM processes its firewall rules only once for the received packet.

2. The method of claim 1
wherein sending the packet attribute set comprises:
when the retrieved configuration data specifies that the firewall rules should be processed for the packet at the source side, sending the packet attribute set to the firewall SVM after receiving the packet from the source GVM; and
when the retrieved configuration data specifies that the firewall rules should be processed for the packet at the destination side, sending the packet attribute set to the firewall SVM before supplying the packet to the destination GVM.

3. The method of claim 2 further comprising:
receiving the configuration data from the firewall SVM; and
storing the configuration data;
wherein said receiving and storing the configuration data are before the receiving of the packet.

4. The method of claim 1 further comprising:
from the source GVM, providing the packet to a physical forwarding element (PFE) that directs the packet to the destination GVM;
wherein sending the packet attribute set comprises only one of:
sending the packet attribute set to the firewall SVM before having the PFE perform a set of operations to direct the packet to the packet's destination; and
sending the packet attribute set to the firewall SVM after having the PFE perform the set of operations to direct the packet to the packet's destination.

5. The method of claim 1 further comprising:
from the source GVM, providing the packet to a physical forwarding element (PFE) that directs the packet to the destination GVM;
wherein sending the packet attribute set comprises only one of:
sending the packet attribute set to the firewall SVM at a PFE source port for receiving packets from the source GVM or before the packet is provided to the PFE source port; and
sending the packet attribute set to the firewall SVM at a PFE destination port for supplying packets to the destination GVM or after the packet is received from the PFE destination port.

6. The method of claim 1 further comprising:
receiving an action to perform for the packet from the firewall SVM;
storing the action in a connection state data storage for processing subsequent packets;
upon receiving another packet with the same packet attribute set, examining the connection state data storage to determine the action to perform for the other packet.

7. The method of claim 6 , wherein examining the connection state data storage comprises examining the connection state data storage only once, either after receiving the other packet from the source GVM or before supplying the other packet to the destination GVM.

8. A non-transitory machine readable medium storing a program for performing firewall rule processing on a host on which a plurality of virtual machines (VM) are executing, the program comprising sets of instructions for:
receiving a packet from a source VM to a destination VM;
determining that the source and destination VMs are both executing on the same host;
based on configuration data, determining that the packet has to be examined only at a source side or a destination side; and
based on the determination that the packet has to be examined only at the source side or the destination side, examining firewall rules for the packet only once, either at a source side on behalf of the source VM or at a destination side on behalf of the destination VM.

9. The non-transitory machine readable medium of claim 8 , wherein
the source and destination VMs are guest VMs (GVMs);
the configuration data is received from a firewall service VM (SVM); and
the set of instructions for examining the firewall rules comprises a set of instructions for sending a set of attributes of the packet to the firewall SVM for the firewall SVM to use to examine the firewall rules that the SVM maintains to identify a firewall rule that matches the packet attribute set.

10. The non-transitory machine readable medium of claim 9 , wherein the configuration data ensures that the firewall SVM does not receive the packet attribute set twice and thereby does not examine its firewall rules twice for the same packet attribute set.

11. The non-transitory machine readable medium of claim 8 , wherein the program further comprises sets of instructions for:
from the source VM, providing the packet to a physical forwarding element (PFE) that directs the packet to the destination VM;
wherein the set of instructions for examining the firewall rules at the source side comprises a set of instructions for examining the firewall rules before having the PFE perform a set of operations to direct the packet to the packet's destination;
wherein the set of instructions for examining the firewall rules at the destination side comprises a set of instructions for examining the firewall rules after having the PFE perform the set of operations to direct the packet to the packet's destination but before supplying the packet to the destination.

12. The non-transitory machine readable medium of claim 8 , wherein the program further comprises sets of instructions for:
from the source VM, providing the packet to a physical forwarding element (PFE) that directs the packet to the destination VM;
wherein the set of instructions for examining the firewall rules at the source side comprises a set of instructions for examining the firewall rules at or before a PFE source port receives packets that need to be directed to destinations;
wherein the set of instructions for examining the firewall rules at the destination side comprises a set of instructions for examining the firewall rules at or after a PFE destination port receives packets that need to be supplied to destination VM.

13. A firewall rule processing apparatus for a host that executes a plurality of guest virtual machines (GVMs), the apparatus comprising:
a firewall service virtual machine (SVM) for processing firewall rules;
a module for sending sets of attributes of GVM packets to the firewall SVM to process the firewall rules; and
an SVM interface (SVMI) through which the SVM configures the module to send an attribute set of a packet to the SVM only once when the packet is exchanged between two GVMs executing on the host.

14. The firewall rule processing apparatus of claim 13 further comprising a configuration storage in which the module stores configuration data received from the firewall SVM through the SVMI, the configuration data configuring the module to send only once to the SVM the attribute set of a packet exchanged between two GVMs executing on the host.

15. The firewall rule processing apparatus of claim 14 , wherein upon identifying a packet that is sent from a source GVM executing on the host to a destination GVM executing on the host, the module (i) retrieves the configuration data from the configuration data storage, (ii) sends the packet attribute set to the firewall SVM after receiving the packet for the source GVM when the retrie

Assignees

• Nicira Inc

Inventors

• Raman Chidambareswaran
• Manuguri Subrahmanyam
• Sabin Todd

Classifications

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L63/0263

  Rule management · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title