Intercepting network traffic routed by virtual switches for selective security processing
Systems, methods, and apparatuses enable an interface microservice to intercept and filter network traffic generated by virtual machines (VMs) and routed by a virtual switch (vSwitch). A vSwitch receiving network packets from the VMs is configured to route network packets to the interface microservice via a generated VLAN trunk. The interface microservice can retrieve and apply stored packet filters to the network packets intercepted by the microservice. If an intercepted network packet matches any of the applied packet filters, the interface microservice can perform various security operations, send the network packets to another microservice for security processing, or perform any other operations. For network packets which do not match a packet filter, the interface microservice forwards the packets to the originally intended destination.
1. A computer-implemented method, comprising:
retrieving, from a virtual switch (vSwitch) corresponding to a hypervisor running in a computing environment, configuration information including a port group virtual network interface card (VNIC) list and a mapping between at least one port group identifier and at least one existing virtual local area network (VLAN) identifier, wherein the vSwitch tags a network packet with a VLAN associated with the port group included in the configuration information;
for an existing VLAN identifier from the configuration information, creating a separate intercept VLAN associated with an intercept VLAN identifier;
adding the existing VLAN identifier, the intercept VLAN identifier, and an interface microservice to a VLAN trunk;
modifying the configuration information to replace the existing VLAN identifier with the intercept VLAN identifier;
receiving, from the vSwitch and as part of the VLAN trunk, the network packet from a virtual machine (VM) associated with the intercept VLAN; and
determining whether the network packet matches a packet filter.
2. The method of claim 1 , wherein the computing environment includes the hypervisor, and wherein the VM is running on the hypervisor.
3. The method of claim 1 , further comprising:
wherein the packet filter is one of a plurality of packet filters, and wherein the packet filter is associated with the intercept VLAN; and
identifying the packet filter from the plurality of packet filters based on the association of the network packet with the same intercept VLAN.
4. The method of claim 1 , further comprising modifying the VM to use the intercept VLAN for network traffic associated with the VM.
5. The method of claim 1 , wherein the packet filter includes at least one filter criteria and a filter forward address.
6. The method of claim 1 , wherein the packet filter includes at least one filter criteria and a filter forward address, and wherein the filter forward address identifies a network location including a security microservice.
7. The method of claim 1 , wherein the packet filter includes at least one filter criteria and a filter forward address, and wherein the filter forward address indicates a network location to which to forward network packets matching the packet filter.
8. The method of claim 1 , further comprising, in response to determining that the network packet matches the packet filter, sending the network packet to a security microservice which performs one or more security operations on the network packet.
9. The method of claim 1 , further comprising, in response to determining that the network packet does not match the packet filter, modifying the network packet based on the existing VLAN identifier and forwarding the network packet to the existing VLAN.
10. The method of claim 1 , wherein determining whether the network packet matches the packet filter includes determining one or more of: whether the network packet is associated with a defined port, whether the network packet is associated with a defined IP address, whether the network packet exceeds a threshold packet size, whether the network packet exceeds a threshold packet length, and whether the network packet contains a defined type of content.
11. The method of claim 6 , wherein the security microservice is implemented using a container supporting a plurality of security operations including deep packet inspection and data loss prevention.
12. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of:
retrieving, from a virtual switch (vSwitch) corresponding to a hypervisor running in a computing environment, configuration information including a port group virtual network interface card (VNIC) list and a mapping between at least one port group identifier and at least one existing virtual local area network (VLAN) identifier, wherein the vSwitch tags a network packet with a VLAN associated with the port group included in the configuration information;
for an existing VLAN identifier from the configuration information, creating a separate intercept VLAN associated with an intercept VLAN identifier;
adding the existing VLAN identifier, the intercept VLAN identifier, and an interface microservice to a VLAN trunk;
modifying the configuration information to replace the existing VLAN identifier with the intercept VLAN identifier;
receiving, from the vSwitch and as part of the VLAN trunk, the network packet from a virtual machine (VM) associated with the intercept VLAN; and
determining whether the network packet matches a packet filter.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the computing environment includes the hypervisor, and wherein the VM is running on the hypervisor.
14. The non-transitory computer-readable storage medium of claim 12 , further comprising, in response to determining that the network packet matches the packet filter, sending the network packet to a security microservice which performs one or more security operations on the network packet.
15. The non-transitory computer-readable storage medium of claim 12 , further comprising, in response to determining that the network packet does not match the packet filter, modifying the network packet based on the existing VLAN identifier and forwarding the network packet to the existing VLAN.
16. The non-transitory computer-readable storage medium of claim 12 , wherein determining whether the network packet matches the packet filter includes determining one or more of: whether the network packet is associated with a defined port, whether the network packet is associated with a defined IP address, whether the network packet exceeds a threshold packet size, whether the network packet exceeds a threshold packet length, and whether the network packet contains a defined type of content.
17. An apparatus, comprising:
one or more processors;
a non-transitory computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to:
retrieve, from a virtual switch (vSwitch) corresponding to a hypervisor running in a computing environment, configuration information including a port group virtual network interface card (VNIC) list and a mapping between at least one port group identifier and at least one existing virtual local area network (VLAN) identifier, wherein the vSwitch tags a network packet with a VLAN associated with the port group included in the configuration information;
for an existing VLAN identifier from the configuration information, creating a separate intercept VLAN associated with an intercept VLAN identifier;
add the existing VLAN identifier, the intercept VLAN identifier, and an interface microservice to a VLAN trunk;
modify the configuration information to replace the existing VLAN identifier with the intercept VLAN identifier;
receive, from the vSwitch and as part of the VLAN trunk, the network packet from a virtual machine (VM) associated with the intercept VLAN; and
determine whether the network packet matches a packet filter.
18. The apparatus of claim 17 , wherein the computing environment includes the hypervisor, and wherein the VM is running on the hypervisor.
19. The apparatus of claim 17 , further comprising, in response to determining that the network packet matches the packet filter, sending the network packet to a security microservice which performs one or more security operations on the network packet.
20. The apparatus of claim 17 , further comprising, in response to determining that the network packet does not match the packet filter, modifying the network packet based on the existing VLAN identifier and forwarding the network packet to the existing VLAN.
21. The apparatus of claim 17 , wherein determining whether the network packet matches the packet filter includes determining one or more of: whether the network packet is associated with a defined port, whether the network packet is associated with a defined IP address, whether the network packet exceeds a threshold packet size, whether the network packet exceeds a threshold packet length, and whether the network packet contains a defined type of content.