Packet-Induced Connection Tracker Revalidation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Flow-based software switches face challenges in implementing stateful firewall rules due to the need for connection state knowledge, which is not inherently supported by their stateless nature, and frequent rule changes complicate the updating of connection tracker entries.
Innovation Solution
A packet-induced revalidation scheme that uses original network traffic to detect relevant rule changes and update connection tracker entries in-band, leveraging Open vSwitch (OVS) interfaces like 'resubmit with original packet' and 'conntrack commit' to ensure immediate consistency between firewall rules and connection tracker entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional out-of-band approach is used to update connection tracker entries, then updates can be performed without network traffic, but inconsistency between firewall rules and connection tracker entries occurs and performance impact increases
Solution Approach 1:
The system uses original network traffic to automatically detect rule changes and trigger updates of connection tracker entries. The network traffic itself serves as the trigger mechanism, eliminating the need for separate monitoring daemons and ensuring updates only occur when actually needed, thus maintaining consistency while minimizing performance impact.
Solution Approach 2:
The system establishes a feedback loop where network traffic is monitored to detect firewall rule changes, which then triggers revalidation and updating of connection tracker entries. This feedback mechanism ensures that the connection tracker remains consistent with current firewall rules while only performing updates when necessary, optimizing performance.
2Reliability
If all connection tracker entries are updated frequently, then consistency with firewall rules is maintained, but performance degradation occurs due to unnecessary updates
Solution Approach 1:
Instead of updating all connection tracker entries on every firewall rule change, the system performs partial updates only on entries that are actually affected by the changes. Network traffic is analyzed to identify which specific connections are impacted, and only those entries are updated, reducing unnecessary processing while maintaining consistency.
Solution Approach 2:
The connection tracker update process is segmented into individual entry updates based on which connections are affected by firewall rule changes. Rather than a monolithic update of all entries, the system processes only the relevant subset of connections, improving performance while maintaining reliability.
3Reliability
If connection tracker entries are updated in-band using network traffic, then immediate consistency is achieved, but complexity of the updating mechanism increases
Solution Approach 1:
The system merges the firewall rule change detection and connection tracker update functions into a single in-band processing mechanism. Network traffic that would otherwise be processed for forwarding is also used to detect rule changes and trigger updates, combining multiple functions into one flow and reducing overall system complexity despite the sophisticated update logic.
Data Source
AI summary
A method of revalidating a connection tracking table of a flow-based managed forwarding element (MFE) that stores a set of firewall rules associated with each of a set of network connections and a connection table that stores a firewall rule identification and a set of state values associated with each of said network connections. The method receives a change in one or more firewall rules stored at the MFE. The method receives a packet that requires stateful firewall rule check on a particular connection after the change in the firewall rules. When the rule identification retrieved from the connection table is not the same as the new firewall rule associated with the particular connection, the method updates the firewall rule identification and the set of state values associated the particular connection using the new firewall rule identification associated with the particular connection.