Rule set verification

1. A method, comprising:

receiving a plurality of packet flow rules from one or more network services;

generating a unified rule set according to the received packet flow rules, wherein the unified rule set comprises one or more prioritized rules each comprising a packet filter and one or more prioritized actions, and wherein each action is either terminating or non-terminating, wherein said generating comprises identifying one or more conflicts between the received packet flow rules and resolving the one or more identified conflicts according to priorities of the conflicting rules; and

subsequent to said identifying and said resolving, validating the unified rule set to identify errors.

2. The method of claim 1 , wherein said validating comprises comparing the unified rule set against one or more defined policies.

3. The method of claim 1 , wherein said validating comprises applying the unified rule set to one or more simulated network packets.

4. The method of claim 3 , wherein the simulated network packets comprise one or more network packets captured during live network traffic.

5. The method of claim 3 , wherein the simulated network packets comprise one or more generated packets based on user specified packet sources and destinations.

6. The method of claim 1 , wherein said validating comprises identifying one or more extraneous rules.

7. The method of claim 6 , wherein said identifying one or more extraneous rules comprises identifying a plurality of rules with identical packet filters; wherein a higher priority one of the rules comprises a terminating action.

8. The method of claim 6 , wherein said identifying one or more extraneous rules comprises identifying two rules with identical action lists; wherein one of the rules has a higher priority and the other has a lower priority, and wherein the higher priority rule comprises a packet filter that specifies a subset of the packet flow specified by the lower priority rule's packet filter.

9. The method of claim 1 , wherein said validating comprises identifying one or more extraneous actions.

10. The method of claim 9 , wherein said identifying one or more extraneous actions comprises identifying a rule that comprises a plurality of actions, wherein a terminating one of the actions has a higher priority than a non-terminating action.

11. The method of claim 1 , wherein said validating comprises:

presenting the unified rule set to a user for manual verification; and

receiving input identifying one or more errors in the unified rule set.

12. The method of claim 11 , further comprising receiving input specifying modifications to the unified rule set to correct the identified errors.

13. The method of claim 11 , further comprising modifying the unified rule set to correct the identified errors.

14. The method of claim 11 , further comprising:

receiving one or more new packet flow rules from at least one of the network services for correction of the identified errors;

generating a new unified rule set according to the received new packet flow rules; and

validating the new unified rule set to identify new errors.

15. The method of claim 11 , further comprising modifying the action list of one or more rules to correct the identified errors.

16. The method of claim 11 , further comprising determining that one or more of the identified errors are false positives.

17. The method of claim 1 , further comprising:

modifying the unified rule set to correct the identified errors; and

revalidating the unified rule set to identifying new errors.

18. The method of claim 17 , further comprising repeating said modifying, and said revalidating until no errors are identified during said revalidating.

19. The method of claim 17 , wherein said modifying comprises:

adding one or more rules to the unified rule set;

deleting one or more rules from the unified rule set; and/or

modifying one or more rules of the unified rule set.

20. A device, comprising:

a processor; and

a memory coupled to the processor, wherein the memory stores program instructions executable by the processor to implement:

receiving a plurality of packet flow rules from one or more network services;

generating a unified rule set according to the received packet flow rules, wherein the unified rule set comprises one or more prioritized rules each comprising a packet filter and one or more prioritized actions, and wherein each action is either terminating or non-terminating, wherein said generating comprises identifying one or more conflicts between the received packet flow rules and resolving the one or more identified conflicts according to priorities of the conflicting rules; and

subsequent to said identifying and said resolving, validating the unified rule set to identify errors.

21. The device of claim 20 , wherein in said validating the program instructions are configured to compare the unified rule set against one or more defined policies.

22. The device of claim 20 , wherein in said validating the program instructions are configured to apply the unified rule set to one or more simulated network packets.

23. The device of claim 22 , wherein the simulated network packets comprise one or more network packets captured during live network traffic.

24. The device of claim 22 , wherein the simulated network packets comprise one or more generated packets based on user specified packet sources and destinations.

25. The device of claim 20 , wherein in said validating the program instructions are configured to identify one or more extraneous rules.

26. The device of claim 25 , wherein in said identifying one or more extraneous rules the program instructions are configured to identify a plurality of rules with identical packet filters; wherein a higher priority one of the rules comprises a terminating action.

27. The device of claim 26 , wherein in said identifying one or more extraneous rules the program instructions are configured to identify two rules with identical action lists; wherein one of the rules has a higher priority and the other has a lower priority, and wherein the higher priority rule comprises a packet filter that specifies a subset of the packet flow specified by the lower priority rule's packet filter.

28. The device of claim 20 , wherein in said validating the program instructions are configured to identify one or more extraneous actions.

29. The device of claim 28 , wherein in said identifying one or more extraneous actions the program instructions are configured to identify a rule that comprises a plurality of actions, wherein a terminating one of the actions has a higher priority than a non-terminating action.

30. The device of claim 20 , wherein in said validating the program instructions are configured to:

present the unified rule set to a user for manual verification; and

receive input identifying one or more errors in the unified rule set.

31. The device of claim 30 , wherein the program instructions are further configured to receive input specifying modifications to the unified rule set to correct the identified errors.

32. The device of claim 30 , wherein the program instructions are further configured to modify the unified rule set to correct the identified errors.

33. The device of claim 30 , wherein the program instructions are further configured to:

receive one or more new packet flow rules from at least one of the network services for correction of the identified errors;

generate a new unified rule set according to the received new packet flow rules; and

validate the new unified rule set to identify new errors.

34. The device of claim 30 , wherein the program instructions are further configured to modify the action list of one or more rules to correct the identified errors.

35. The device of claim 30 , wherein the program instructions are further configured to determine that one or more of the identified errors are false positives.

36. The device of claim 20 , wherein the program instructions are further configured to:

modify the unified rule set to correct the identified errors; and

revalidate the unified rule set to identifying new errors.

37. The device of claim 36 , wherein the program instructions are further configured to repeat said modifying, and said revalidating until no errors are identified during said revalidating.

38. The device of claim 36 , wherein in said modifying the program instructions are configured to:

add one or more rules to the unified rule set;

delete one or more rules from the unified rule set; and/or

modify one or more rules of the unified rule set.

39. A computer accessible storage medium, storing program instructions computer-executable to implement:

receiving a plurality of packet flow rules from one or more network services;

generating a unified rule set according to the received packet flow rules, wherein the unified rule set comprises one or more prioritized rules each comprising a packet filter and one or more prioritized actions, and wherein each action is either terminating or non-terminating, wherein said generating comprises identifying one or more conflicts between the received packet flow rules and resolving the one or more identified conflicts according to priorities of the conflicting rules; and

subsequent to said identifying and said resolving, validating the unified rule set to identify errors.

40. The computer accessible storage medium of claim 39 , wherein in said validating the program instructions are computer-executable to implement comparing the unified rule set against one or more defined policies.

41. The computer accessible storage medium of claim 39 , wherein in said validating the program instructions are computer-executable to implement applying the unified rule set to one or more simulated network packets.

42. The computer accessible storage medium of claim 41 , wherein the simulated network packets comprise one or more network packets captured during live network traffic.

43. The computer accessible storage medium of claim 41 , wherein the simulated network packets comprise one or more generated packets based on user specified packet sources and destinations.

44. The computer accessible storage medium of claim 38 , wherein in said validating the program instructions are computer-executable to implement identifying one or more extraneous rules.

45. The computer accessible storage medium of claim 44 , wherein in said identifying one or more extraneous rules the program instructions are computer-executable to implement identifying a plurality of rules with identical packet filters; wherein a higher priority one of the rules comprises a terminating action.

46. The computer accessible storage medium of claim 44 , wherein in said identifying one or more extraneous rules the program instructions are computer-executable to implement identifying two rules with identical action lists; wherein one of the rules has a higher priority and the other has a lower priority, and wherein the higher priority rule comprises a packet filter that specifies a subset of the packet flow specified by the lower priority rule's packet filter.

47. The computer accessible storage medium of claim 39 , wherein in said validating the program instructions are computer-executable to implement identifying one or more extraneous actions.

48. The computer accessible storage medium of claim 47 , wherein in said identifying one or more extraneous actions the program instructions are computer-executable to implement identifying a rule that comprises a plurality of actions, wherein a terminating one of the actions has a higher priority than a non-terminating action.

49. The computer accessible storage medium of claim 39 , wherein in said validating the program instructions are computer-executable to implement:

presenting the unified rule set to a user for manual verification; and

receiving input identifying one or more errors in the unified rule set.

50. The computer accessible storage medium of claim 49 , wherein the program instructions are further computer-executable to implement receiving input specifying modifications to the unified rule set to correct the identified errors.

51. The computer accessible storage medium of claim 49 , wherein the program instructions are further computer-executable to implement modifying the unified rule set to correct the identified errors.

52. The computer accessible storage medium of claim 49 , wherein the program instructions are further computer-executable to implement:

receiving one or more new packet flow rules from at least one of the network services for correction of the identified errors;

generating a new unified rule set according to the received new packet flow rules; and

validating the new unified rule set to identify new errors.

53. The computer accessible storage medium of claim 49 , wherein the program instructions are further computer-executable to implement modifying the action list of one or more rules to correct the identified errors.

54. The computer accessible storage medium of claim 49 , wherein the program instructions are further computer-executable to implement determining that one or more of the identified errors are false positives.

55. The computer accessible storage medium of claim 39 , wherein the program instructions are further computer-executable to implement:

modifying the unified rule set to correct the identified errors; and

revalidating the unified rule set to identifying new errors.

56. The computer accessible storage medium of claim 55 , wherein the program instructions are further computer-executable to implement repeating said modifying, and said revalidating until no errors are identified during said revalidating.

57. The computer accessible storage medium of claim 55 , wherein in said modifying the program instructions are computer-executable to implement:

adding one or more rules to the unified rule set;

deleting one or more rules from the unified rule set; and/or

modifying one or more rules of the unified rule set.