Multitenancy for service machines

One or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by one or more processors, cause the one or more processors to perform:

• detecting a packet by for a service inserter implemented in a hypervisor that is a software layer that supports an execution of a service machine providing one more services to a plurality of tenants;
• based on metadata received along with the packet, identifying, for the service inserter, a tenant identifier;
• determining, for the service inserter, a plurality of attributes of the packet;
• based on the tenant identifier and the plurality of attributes of the packet, retrieving, for the service inserter, an action for the packet from a rule table;
• based on the action, determining, for the service inserter, whether at least one service is to be applied to the packet;
• in response to determining that the at least one service is to be applied to the packet:
• making, by the service inserter, a copy of the packet;
• storing the copy of the packet;
• generating, for the service inserter, an encapsulated packet by encapsulating the packet with the tenant identifier;
• directing, by the service inserter, the encapsulated packet to a service machine that is configured to provide the at least one service to the encapsulated packet;
• upon receiving, for the service inserter, a result from the service machine providing the at least one service to the encapsulated packet:
• determining, for the service inserter based on the result, whether to forward the encapsulated packet toward a packet destination or drop the encapsulated packet;
• and
• in response to determining that the encapsulated packet is to be forwarded toward the packet destination, deleting or overwriting the encapsulated packet and forwarding, for the service inserter, the copy of the packet toward the packet destination;
• and
• in response to determining that the encapsulated packet is to be dropped, deleting or overwriting the encapsulated packet and deleting, by the service inserter, the copy of the packet.

A hypervisor in a host computer configured to implement multitenancy by maintaining mappings between underlying hardware on the host computer and virtual resources allocated to a service machine that provides one or more services to a plurality of tenants, the hypervisor comprising a memory encoded computer instructions causing one or more processors to perform the following operations:

• detecting a packet implemented in the hypervisor;
• based on metadata received along with the packet, identifying a tenant identifier;
• determining a plurality of attributes of the packet;
• based on the tenant identifier and the plurality of attributes of the packet, retrieving an action for the packet from a rule table;
• based on the action, determining whether at least one service is to be applied to the packet;
• in response to determining that the at least one service is to be applied to the packet:
• making a copy of the packet;
• storing the copy of the packet;
• generating an encapsulated packet by encapsulating the packet with the tenant identifier;
• directing the encapsulated packet to a service machine that is configured to provide the at least one service to the encapsulated packet;
• upon receiving a result from the service machine providing the at least one service to the encapsulated packet:
• determining, based on the result, whether to forward the encapsulated packet toward a packet destination or drop the encapsulated packet;
• and
• in response to determining that the encapsulated packet is to be forwarded toward the packet destination, deleting or overwriting the encapsulated packet and forwarding the copy of the packet toward the packet destination;
• or
• in response to determining that the encapsulated packet is to be dropped, deleting or overwriting the encapsulated packet and deleting the copy of the packet.