Stateful Connection Policy Filtering via Original Packet Headers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Implementing stateful firewalls with connection tracking is resource-intensive and inefficient, particularly when frequent policy changes require revalidation of thousands of connection tracking entries, and managing reply direction packets with varying headers complicates firewall rule creation and resource usage.
Innovation Solution
A connection tracker that stores and makes available the packet headers of the original direction packet for all connections and related connections, allowing firewall rules to be checked based on these headers without relying solely on connection tracking entries, thereby simplifying policy enforcement and reducing resource duplication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If connection tracking entries are revalidated after firewall policy changes by iterating through all entries, then policy enforcement accuracy is improved, but processing time and computational resources are excessively consumed
Solution Approach 1:
The patent applies preliminary action by pre-storing the original packet headers in connection tracking entries when connections are initially established. This allows the firewall to directly use these stored headers for policy matching without needing to revalidate or reconstruct headers during policy changes, thereby eliminating time-consuming iteration through connection tracking entries while maintaining accurate policy enforcement.
2Reliability
If full packet headers and metadata are retained for revalidation, then policy revalidation accuracy is improved, but memory resources are excessively consumed
Solution Approach 1:
The patent extracts only the essential original packet headers needed for firewall policy matching from the complete packet data structure. By storing only these specific header fields (such as source/destination IP addresses, ports, and protocol information) rather than full packet metadata, the system achieves accurate policy revalidation while significantly reducing memory consumption.
3Reliability
If firewall rules are duplicated for each packet direction to properly match reply direction packets, then packet filtering accuracy is improved, but rule storage and processing resources are doubled
Solution Approach 1:
The patent applies universality by designing a single set of firewall rules that can match both original direction and reply direction packets. The connection tracking mechanism stores original packet headers and uses them to evaluate reply packets against the same firewall rules, allowing one rule set to serve multiple packet directions and eliminating the need for separate rule duplications.
4Productivity
If connection tracking implicitly trusts existing connection state for admitting return traffic, then processing speed is improved, but security against policy violations deteriorates
Solution Approach 1:
The patent implements feedback by continuously evaluating reply direction packets against the original firewall policy using stored original headers. Instead of implicitly trusting connection state, the system provides feedback by re-checking whether reply packets conform to the original admission criteria, thereby maintaining security while enabling efficient processing through avoided full revalidation.
Data Source
AI summary
A method for performing stateful processing of a packet at a flow-based managed forwarding element (MFE) is provided. The method sends a first packet from the MFE to a connection tracker that stores headers of a set of original direction packets that each established a new connection. The method receives, from the connection tracker, the first packet with the header of an original direction packet associated with the first packet appended to the first packet. The header of the original direction packet includes (i) a second set of IP addresses different than a first set of IP addresses of the first packet and (ii) stateful connection status information. The method replaces a first set of IP addresses of the first packet with the second set of IP addresses and performs a matching operation on the packet based on the second set of IP addresses and the stateful connection status information.