Distributed identity-based firewalls
Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.
1. For a virtual machine (VM) executing on a host computer, a method for providing a firewall service on the host computer, the method comprising:
on the host computer, outside of the VM,
after a process of the VM requests a network connection to send a packet flow, receiving, from a guest driver module of the VM, identity information comprising a set of header values of the packet flow and an identifier associated with the process and related to the requested network connection;
in response to the received identity information, generating and storing a record associating the set of header values with the identifier;
for a packet of the flow sent by the VM, identifying the record as matching the sent packet by using a set of header values of the sent packet;
using the identifier stored in the record to identify a firewall rule that is applicable to the sent packet from a plurality of firewall rules; and
performing a firewall operation on the sent packet based on the identified firewall rule.
2. The method of claim 1 , wherein performing the firewall operation comprises forwarding the sent packet when the identified firewall rule specifies that the packet should be allowed to pass through.
3. The method of claim 2 , wherein forwarding the sent packet comprises forwarding the packet to a virtual switch executing on the host computer for distribution to a destination of the packet.
4. The method of claim 1 , wherein performing the firewall operation comprises dropping the sent packet when the identified firewall rule specifies that the packet should be blocked.
5. The method of claim 1 , wherein performing the firewall operation comprises redirecting the sent packet to a different destination according to the identified firewall rule.
6. The method of claim 1 , wherein the identifier is a security identifier (SID) of a user associated with the process.
7. The method of claim 1 , wherein the identifier identifies a user logged onto the VM.
8. The method of claim 7 , wherein the user identifier comprises a username or a group identifier that identifies a user group to which the user belongs.
9. The method of claim 1 , wherein the set of header values comprises an Internet Protocol (IP) address and one or more port numbers assigned to the network connection.
10. The method of claim 1 , wherein identifying the record as matching the sent packet comprises matching the set of header values of the sent packet with the set of header values stored in the record.
11. A non-transitory machine readable medium storing a program for execution by at least one processing unit, the program for providing a firewall service for a virtual machine (VM) executing on a host computer, the program comprising sets of instructions for:
on the host computer, outside of the VM,
after a process of the VM requests a network connection to send a packet flow, receiving, from a guest driver module of the VM, identity information comprising a set of header values of the packet flow and an identifier associated with the process and related to the requested network connection;
in response to the received identity information, generating and storing a record associating the set of header values with the identifier;
for a packet of the flow sent by the VM, identifying the record as matching the sent packet by using a set of header values of the sent packet;
using the identifier stored in the record to identify a firewall rule that is applicable to the sent packet from a plurality of firewall rules; and
performing a firewall operation on the sent packet based on the identified firewall rule.
12. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing the firewall operation comprises a set of instructions for forwarding the sent packet when the identified firewall rule specifies that the packet should be allowed to pass through.
13. The non-transitory machine readable medium of claim 12 , wherein the set of instructions for forwarding the sent packet comprises a set of instructions for forwarding the packet to a virtual switch executing on the host computer for distribution to a destination of the packet.
14. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing the firewall operation comprises a set of instructions for dropping the sent packet when the identified firewall rule specifies that the packet should be blocked.
15. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing the firewall operation comprises a set of instructions for redirecting the sent packet to a different destination according to the identified firewall rule.
16. The non-transitory machine readable medium of claim 11 , wherein the identifier is a security identifier (SID) of a user associated with the process.
17. The non-transitory machine readable medium of claim 11 , wherein the identifier identifies a user logged onto the VM.
18. The non-transitory machine readable medium of claim 17 , wherein the user identifier comprises a username or a group identifier that identifies a user group to which the user belongs.
19. The non-transitory machine readable medium of claim 11 , wherein the set of header values comprises an Internet Protocol (IP) address and one or more port numbers assigned to the network connection.
20. The non-transitory machine readable medium of claim 11 , wherein the identity information is retrieved by the guest driver module using an application programming interface (API) provided by a guest operating system of the VM.