Distributed identity-based firewalls

A method for providing firewall services on the host computer for a machine executing on the host computer, the method comprising:

• receiving, for a network connection initiated on the machine, an identifier associated with the network connection, the identifier being a value different than a layer 2 (L2), a layer 3 (L3), or a layer 4 (L4) header value, said identifier identified by a network driver and received through an identity module that receives the identifier from the network driver;
• using, for a packet received for the network connection, the identifier to identify a firewall rule by comparing the identifier with one or more match attributes of one or more firewall rules, said match attributes of at least a subset of the firewall rules comprising non-L2 to L4 identifiers;
• and
• performing a firewall operation on the received packet based on the identified firewall rule.

A non-transitory machine readable medium storing a program for execution by at least one processing unit, the program for providing firewall services on the host computer for a machine executing on the host computer, the program comprising sets of instructions for:

• receiving, for a network connection initiated on the machine, an identifier associated with the network connection, the identifier being a value different than a layer 2 (L2), a layer 3 (L3), or a layer 4 (L4) header value, said identifier identified by a network driver and received through an identity module that receives the identifier from the network driver;
• using, for a packet received for the network connection, the identifier to identify a firewall rule by comparing the identifier with one or more match attributes of one or more firewall rules, said match attributes of at least a subset of the firewall rules comprising non-L2 to L4 identifiers;
• and
• performing a firewall operation on the received packet based on the identified firewall rule.