Hardware implementation of complex firewalls using chaining technique

A method comprising:

• obtaining, by a firewall device, filter specifications for a first hardware-implemented filter,
• a hardware implementation of the first hardware-implemented filter limiting the first hardware-implemented filter to being associated with a maximum quantity of filter rules;
• generating, by the firewall device and based on the filter specification, a quantity of filter rules;
• determining, by the firewall device, whether the quantity of filter rules exceeds the maximum quantity of filter rules;
• associating, by the firewall device and when the quantity of filter rules does not exceed the maximum quantity of filter rules, the first hardware-implemented filter with the quantity of filter rules;
• and
• when the quantity of filter rules exceeds the maximum quantity of filter rules:
• associating, by the firewall device, the first hardware-implemented filter with a first group of the quantity of filter rules;
• inserting, by the firewall device, a split-filter action as a last rule of the first group of the quantity of filter rules,
• the split-filter action identifying a second hardware-implemented filter as a logical continuation of the first hardware-implemented filter for implementing the quantity of filter rules using the first hardware-implemented filter and the second hardware-implemented filter;
• and
• associating, by the firewall device and based on inserting the split-filter action as the last rule of the first group of the quantity of filter rules, a second group of the quantity of filter rules with the second hardware-implemented filter.

A firewall device comprising:

• a processor to:
• access, based on a filter specification, a first hardware-implemented filter, of a plurality of hardware-implemented filters,
• the filter specification identifying a sequence of hardware attachment points of the firewall device,
• each attachment point, of the sequence of hardware attachment points, being associated with a corresponding hardware-implemented filter of the plurality of hardware-implemented filters, and
• a hardware implementation, of each hardware-implemented filter, limiting the hardware-implemented filter to being associated with a maximum quantity of rules;
• process a packet using the first hardware-implemented filter,
• the packet being processed based on first information included in the packet and a type of filter associated with the first-hardware implemented filter;
• access, based on the filter specification, a second hardware-implemented filter of the plurality of hardware-implemented filters;
• determine whether a last rule associated with the first hardware-implemented filter includes a split-filter action,
• the split-filter action identifying the second hardware-implemented filter;
• process, when the last rule does not include the split-filter action, the packet based on second information included in the packet and a type of filter associated with the second hardware-implemented filter;
• and
• when the last rule includes the split-filter action:
• link the second hardware-implemented filter to the first hardware-implemented filter to cause the second hardware-implemented filter to function as a logical continuation of the first hardware-implemented filter;
• and
• process, based on linking the second hardware-implemented filter to the first hardware-implemented filter, the packet based on the first information and the type of filter associated with the first hardware-implemented filter.

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors of a firewall device, cause the one or more processors to:
• receive a packet;
• obtain, based on the packet, a filter specification,
• the filter specification identifying a sequence of hardware attachment points of the firewall device,
• each attachment point, of the sequence of attachment points, being associated with a corresponding hardware-implemented filter of a plurality of hardware-implemented filters, and
• access, based on the filter specification, a first hardware-implemented filter of the plurality of hardware-implemented filters,
• a hardware implementation of each of the plurality of hardware-implemented filters limiting each of the plurality of hardware-implemented filters to a maximum quantity of rules;
• process, using the first hardware-implemented filter, the packet,
• the packet being processed based on first information included in the packet;
• determine whether a last rule associated with the first hardware implemented filter includes a split-filter action,
• the split-filter action identifying a second hardware-implemented filter of the plurality of hardware-implemented filters;
• process, when the last rule does not include the split-filter action, the packet based on second information included in the packet and a type of filter associated with the second hardware-implemented filter;
• and
• when the last rule includes the split-filter action:
• link the second hardware-implemented filter to the first hardware-implemented filter to cause the second hardware-implemented filter to be a logical continuation of the first hardware-implemented filter;
• and
• process, based on linking the second hardware-implemented filter to the first hardware-implemented filter, the packet based on the first information and the type of filter associated with the first hardware-implemented filter.