Stateful Processing for Stateless Forwarding Elements
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Flow-based software switches are stateless and struggle to implement firewall rules that require knowledge of connection state, leading to performance issues when creating new flow entries for each connection or relying solely on TCP flags, which are not applicable to all packet types.
Innovation Solution
A connection tracking module is introduced within the virtualization software to determine the connection status of packets by using an n-tuple in the packet header, allowing stateless flows to match over stateful information, and caching metadata and register information to restore it efficiently when packets are recirculated.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If new flow entries are created for each established connection to implement stateful firewall rules, then firewall security is improved, but system performance deteriorates due to severe performance problems
Solution Approach 1:
The patent uses connection tracking to create a simplified copy of connection state information (5-tuple: source IP, source port, destination IP, destination port, protocol) and stores it in a connection table. This allows the firewall to reference pre-established connection states without creating complex flow entries for each connection, maintaining security while improving performance.
Solution Approach 2:
The system performs preliminary connection tracking and state recording when connections are first established. By pre-processing and storing connection information in the connection table before firewall rule evaluation, the system avoids the overhead of creating and managing individual flow entries for each connection during subsequent packet processing.
2Productivity
If TCP flags are used to enforce firewall rules quickly, then processing speed is improved, but applicability deteriorates because the technique is only applicable to TCP packets
Solution Approach 1:
The connection tracking mechanism is designed to be protocol-agnostic, tracking connections based on the 5-tuple regardless of the specific transport protocol. This universal approach allows the same connection tracking infrastructure to handle TCP, UDP, and other protocols uniformly, maintaining both speed and versatility.
3Reliability
If packets are sent to connection tracker outside the forwarding element to determine connection status, then stateful firewall capability is improved, but processing efficiency deteriorates due to loss of metadata and register information
Solution Approach 1:
The system implements a feedback mechanism where the connection tracker returns connection status information to the forwarding element. The forwarding element uses this feedback to make firewall decisions without needing to re-process packets through the entire pipeline, maintaining efficiency while enabling stateful inspection.
Solution Approach 2:
The connection tracking function is extracted as a separate module from the main forwarding element, allowing it to operate independently and return only the necessary connection status information. This extraction reduces the processing overhead on the main forwarding path while still providing stateful firewall capabilities.
Data Source
AI summary
Some embodiments provide a method for performing stateful processing of a packet at a flow-based managed forwarding element (MFE). The method receives a packet at the MFE without stateful connection status information. The method sends the packet to a module separate from the MFE that stores stateful connection information for a plurality of connections. The method receives the packet from the module with stateful connection status information appended to the packet. The method performs an action on the packet based on the appended stateful connection status information.