US 10,757,077 B2 · Stateful connection policy filtering

Abstract

A method for performing stateful processing of a packet at a flow-based managed forwarding element (MFE) is provided. The method sends a first packet from the MFE to a connection tracker that stores headers of a set of original direction packets that each established a new connection. The method receives, from the connection tracker, the first packet with the header of an original direction packet associated with the first packet appended to the first packet. The header of the original direction packet includes (i) a second set of IP addresses different than a first set of IP addresses of the first packet and (ii) stateful connection status information. The method replaces a first set of IP addresses of the first packet with the second set of IP addresses and performs a matching operation on the packet based on the second set of IP addresses and the stateful connection status information.

Claims20

Dependent claims

A method for performing stateful processing of a packet at a flow-based managed forwarding element (MFE) on a host computer, the method comprising:

sending a first packet from the MFE to a connection tracker that stores headers of a set of connection-establishing packets for allowed connections, a header of the first packet comprising a first set of header field values used to identify a first data flow to which the first packet belongs;
from the connection tracker, receiving the first packet with header information of a connection-establishing packet appended to the first packet, the header information comprising (i) a second set of header field values used to identify a second data flow to which the connection-establishing packet belongs and that are different than the first set of header field values and (ii) stateful connection status information indicating a relation of the first data flow to the second data flow;
and
temporarily replacing the first set of header field values in the header of the first packet with the second set of header field values to perform a matching operation on the first packet using the second set of packet header field values and the stateful connection status information;
and
transmitting the first packet with the first set of header field values.

3 more elements

A non-transitory machine readable medium storing a flow-based managed forwarding element (MFE) which when executed by at least one processing unit performs stateful processing of a packet, the program comprising sets of instructions for:

sending a first packet from the MFE to a connection tracker that stores headers of a set of connection-establishing packets for allowed connections, a header of the first packet comprising a first set of header field values used to identify a first data flow to which the first packet belongs;
from the connection tracker, receiving the first packet with header information of a connection-establishing packet appended to the first packet, the header information comprising (i) a second set of header field values used to identify a second data flow to which the connection-establishing packet belongs and that are different than the first set of header field values and (ii) stateful connection status information indicating a relation of the first data flow to the second data flow;
and
temporarily replacing the first set of header field values in the header of the first packet with the second set of header field values to perform a matching operation on the first packet using the second set of packet header field values and the stateful connection status information;
and
transmitting the first packet with the first set of header field values.

3 more elements

Dependencies are inferred from the claim text.

Stateful connection policy filtering

Life of this patent

Stateful connection policy filtering

Life of this patent

Abstract

Claims20