Managing configurations of a firewall
View Patent ↗A method and system for managing multiple firewall configurations are disclosed. The method uses a pointer on a packet object representing a packet to reference a configuration object representing a configuration of the firewall which is assigned to the packet. By using a pointer to link each packet entering a computer system to the most recent configuration, the method can maintain multiple configurations and enable the firewall processing modules to process each packet according to its assigned configuration even if new configurations are released during the transition of the packet through the system. A reference count is also used as a variable by the configuration object to track the number of packets assigned to the configuration. A corresponding system is also provided.
1. A method for managing configurations of a firewall at a computer, comprising:
(a) providing a previous configuration object representing a first firewall configuration, and a current configuration object representing a second firewall configuration;
(b) representing a first packet received at the computer with a first packet object and assigning said first packet object to said previous configuration object;
(c) representing a second packet received at the computer with a second packet object and assigning said second packet object to said current configuration object;
(d) processing, by a hardware processor, the first packet object by a plurality of firewall processing modules based on the previous configuration object assigned to said first packet object; and
(e) processing, by the hardware processor, the second packet object by said plurality of firewall processing modules based on the current configuration object assigned to said second packet object, without waiting for completion of the processing of the first packet object.
2. The method of claim 1 , further comprising deleting said previous configuration object from a configuration database when no more packet object assigned to said previous configuration object is present in the firewall processing modules.
3. The method of claim 1 , further comprising providing a first configuration object pointer on said first packet object for referencing said previous configuration object, and providing a second configuration object pointer on said second packet object for referencing said current configuration object.
4. The method of claim 1 , wherein
the step (a) comprises providing first and second reference counts for the previous and current configuration objects respectively, for counting corresponding numbers of packet objects being currently processed by the firewall according to respective configuration objects.
5. The method of claim 1 , wherein the previous and the current configuration objects are stored in a configuration database.
6. The method of claim 4 , further comprising decrementing the first and second reference counts when the processing of the respective first and second packet objects by said plurality of firewall processing modules is completed.
7. The method of claim 4 , further comprising:
(f) initializing the second reference count to a current value; and
(g) decrementing the first reference count of the previous configuration object once the second reference count of said current configuration object is initialized.
8. The method of claim 6 , further comprising:
(h) deleting said previous configuration object from said configuration database provided the first reference count of said previous configuration object is decremented to a minimal value.
9. The method of claim 1 , wherein the step (b) further comprises providing a first configuration object pointer on said first packet object for referencing said previous configuration object.
10. The method of claim 1 , wherein the steps (b) and (c) further comprise providing at least two pointers on each said first and second packet objects for referencing respective data sections and header sections of corresponding packets received at the computer and represented by said first and second packet objects respectively.
11. The method of claim 1 , wherein said first and second firewall configurations are represented as respective configuration binary structures.
12. The method of claim 11 , wherein the previous and current configuration objects include respective pointers to said respective configuration binary structures.
13. The method of claim 1 , wherein said first and second packet objects include elements selected from the group consisting of: an Access flag, an Ethernet header pointer, an IP header pointer, a transport header pointer, and a configuration object pointer.
14. A system for managing multiple firewall configurations at a computer, comprising:
a hardware processor and a non-transitory computer readable storage medium having computer readable instructions stored thereon for execution by the hardware processor, causing the hardware processor to perform:
(a) providing a previous configuration object representing a first firewall configuration, and a current configuration object representing a second firewall configuration;
(b) representing a first packet received at the computer with a first packet object and assigning said first packet object to said previous configuration object;
(c) representing a second packet received at the computer with a second packet object and assigning said second packet object to said current configuration object;
(d) processing the first packet object by a plurality of firewall processing modules based on the previous configuration object assigned to said first packet object; and
(e) processing the second packet object by said plurality of firewall processing modules based on the current configuration object assigned to said second packet object, without waiting for completion of the processing of the first packet object.
15. The system of claim 14 , wherein each of said previous and current configuration objects includes a respective reference count initialized to a current-value reference count and used for tracking a number of respective packet objects assigned to said corresponding previous and current configuration objects.
16. The system of claim 14 , wherein said first and second packet objects include respective configuration object pointers for respectively referencing said previous and current configuration objects.
17. The system of claim 14 , wherein said first and second packet objects include elements selected from the group consisting of: an Access flag, an Ethernet header pointer, an IP header pointer, a transport header pointer, and a configuration object pointer.
18. The system of claim 14 , wherein said previous and current configuration objects include elements selected from the group consisting of: a sequence number, a pointer to another configuration object, and a pointer to a configuration binary structure.
19. A non-transitory computer readable medium, comprising a computer code instructions stored thereon, which, when executed by a computer, perform:
(a) providing a previous configuration object representing a first firewall configuration, and a current configuration object representing a second firewall configuration;
(b) representing a first packet received at the computer with a first packet object and assigning said first packet object to said previous configuration object;
(c) representing a second packet received at the computer with a second packet object and assigning said second packet object to said current configuration object;
(d) processing the first packet object by a plurality of firewall processing modules based on the previous configuration object assigned to said first packet object; and
(e) processing the second packet object by said plurality of firewall processing modules based on the current configuration object assigned to said second packet object, without waiting for completion of the processing of the first packet object.
20. The system of claim 14 , wherein said previous and current configuration objects include elements selected from the group consisting of: a sequence number, a pointer to another configuration object, and a pointer to a configuration binary structure.