Cloud-based network function chain optimization

1 . A system, comprising:

a control plane server of a networking service of a cloud computing environment; and

a virtual router of the networking service, comprising a routing decisions node and a set of fast-path packet processing nodes;

wherein the control plane server is configured to:

receive, via one or more programmatic interfaces from a client of the networking service, indications of a set of network functions which are to be executed in a particular sequence on packets directed via the virtual router to a set of traffic destinations from a set of traffic sources within the cloud computing environment, wherein the particular sequence includes a first network function followed by a second network function;

wherein the routing decisions node is configured to:

determine that a particular fast-path packet processing node of the virtual router has received a first packet of a packet flow from a traffic source of the set of traffic sources;

generate, based at least in part on analysis of the set of network functions, an aggregated network function, such that a result of applying the aggregated network function to a particular packet of the packet flow using code generated for performance of the aggregated network function is identical to a result of applying at least the first network function followed by the second network function to the particular packet, wherein information pertaining to the set of network functions is obtained at the routing decisions node from the control plane server; and

transmit a representation of the aggregated network function to the particular fast-path packet processing node; and

wherein the particular fast-path packet processing node is configured to:

perform, with respect to the first packet, a packet processing action which comprises applying the aggregated network function, which was generated based at least in part on the analysis of the set of network functions after receiving the first packet at the particular fast-path packet processing node, to the first packet.

2 . The system of claim 1 , wherein the first packet belongs to a particular packet flow, and wherein the particular fast-path packet processing node is further configured to:

store the representation of the aggregated network function in a cache; and

retrieve the representation from the cache to perform a packet processing action on a second packet of the particular packet flow.

3 . The system of claim 1 , wherein applying the first network function comprises applying a firewall rule, and wherein to perform the packet processing action, the particular fast-path packet processing node is further configured to:

cause at least a portion of the first packet to be sent to a destination permitted by the firewall rule.

4 . The system of claim 1 , wherein applying the first network function to a particular packet comprises modifying a particular header of the particular packet, and wherein to perform the packet processing action, the particular fast-path packet processing node is further configured to:

cause a version of the first packet in which the particular header has been modified according to the first network function to be sent to a destination.

5 . The system of claim 1 , wherein applying the first network function to a particular packet comprises modifying a portion of a payload of the particular packet, and wherein to perform the packet processing action, the particular fast-path packet processing node is further configured to:

cause a version of the first packet in which the payload has been modified according to the first network function to be sent to a destination.

6 . A computer-implemented method, comprising:

generating an aggregated network function based at least in part on analysis of a set of network functions, such that a result of applying the aggregated network function to a packet using code generated for performance of the aggregated network function is equivalent to a result of applying at least (a) a first network function of the set and (b) a second network function of the set to the packet, wherein the set of network functions is indicated to a control plane of a networking service by a client;

transmitting a representation of the aggregated network function to a packet processing node of a virtual router of the networking service; and

implementing, by the packet processing node, with respect to a first packet, a packet processing action which includes applying the aggregated network function, which was generated based at least in part on the analysis of the set of network functions after receiving the first packet at the packet processing node, to the first packet.

7 . The computer-implemented method of claim 6 , wherein applying the first network function comprises applying a firewall rule, and wherein the packet processing action implemented by the packet processing node comprises:

causing at least a portion of the first packet to be sent to a destination permitted by the firewall rule.

8 . The computer-implemented method of claim 6 , wherein applying the first network function to a particular packet comprises modifying a particular header of the particular packet, and wherein the packet processing action implemented by the packet processing node comprises:

causing a version of the first packet in which the particular header has been modified according to the first network function to be sent to a destination.

9 . The computer-implemented method of claim 6 , wherein applying the first network function to a particular packet comprises modifying a portion of a payload of the particular packet, and wherein the packet processing action implemented by the packet processing node comprises:

causing a version of the first packet in which the payload has been modified according to the first network function to be sent to a destination.

10 . The computer-implemented method of claim 6 , wherein applying the first network function to a particular packet comprises generating an encapsulation packet within which the particular packet is stored, and wherein the packet processing action implemented by the packet processing node comprises:

causing an encapsulated packet comprising the first packet to be sent to a destination.

11 . The computer-implemented method of claim 6 , further comprising:

determining a processing location constraint of a packet flow comprising the first packet, wherein the packet processing action implemented by the packet processing node comprises causing at least a portion of the first packet to be sent to a resource at a particular location, wherein the particular location is selected in accordance with the processing location constraint.

12 . The computer-implemented method of claim 6 , wherein the first packet belongs to a particular packet flow, the computer-implemented method further comprising:

storing the representation of the aggregated network function in a cache at the packet processing node; and

retrieving, at the packet processing node, the representation from the cache to process a second packet of the particular packet flow.

13 . The computer-implemented method of claim 6 , wherein the representation of the aggregated network function comprises executable code generated at a decisions node of the virtual router.

14 . The computer-implemented method of claim 6 , wherein the networking service is implemented at a cloud computing environment, the computer-implemented method further comprising:

receiving the first packet at the packet processing node from a virtual machine within a virtual private cloud (VPC) of the cloud computing environment.

15 . The computer-implemented method of claim 6 , wherein the networking service is implemented at a cloud computing environment, and wherein the packet processing action implemented by the packet processing node comprises:

causing at least a portion of contents of the first packet to be received at a destination external to the cloud computing environment.

16 . A non-transitory computer-accessible storage medium storing program instructions that when executed on a processor:

analyze a set of network functions, wherein the set of network functions is indicated for a set of packet flows by a client of a networking service;

generate an aggregated network function based at least in part on analysis of the set of network functions, such that a result of applying the aggregated network function to a packet using code generated for performance of the aggregated network function is equivalent to a result of applying at least (a) a first network function of the set to the packet and (b) a second network function of the set to the packet; and

implement, with respect to a particular packet of a packet flow of the set of packet flows, a packet processing action which includes applying the aggregated network function, which was generated based at least in part on the analysis of the set of network functions after receiving the particular packet, to the particular packet.

17 . The non-transitory computer-accessible storage medium of claim 16 , wherein applying the first network function comprises applying a firewall rule, and wherein to implement the packet processing action, the non-transitory computer-accessible storage medium stores further program instructions that when executed on the processor:

cause at least a portion of the particular packet to be sent to a destination permitted by the firewall rule.

18 . The non-transitory computer-accessible storage medium of claim 16 , wherein applying the first network function to the particular packet comprises modifying a particular header of the particular packet, and wherein to implement the packet processing action, the non-transitory computer-accessible storage medium stores further program instructions that when executed on the processor:

cause a version of the particular packet in which the particular header has been modified according to the first network function to be sent to a destination.

19 . The non-transitory computer-accessible storage medium of claim 16 , wherein the set of network functions comprises a third network function, wherein the packet processing action is implemented at a particular node of a virtual router, the non-transitory computer-accessible storage medium storing further program instructions that when executed on the processor:

cause the third network function to be applied to the particular packet at a resource other than the particular node.

20 . The non-transitory computer-accessible storage medium of claim 19 , wherein the resource other than the particular node is configured within a virtual private cloud indicated by the client.