Executable programs representing firewall rules for evaluating data packets

1. A packet-processing device that controls data flow to a virtual resource, the packet-processing device comprising:

one or more processors; and

one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:

obtain executable instructions representing a firewall rule for the virtual resource that is in a service provider network, the firewall rule indicating:

an allowed protocol type for received data packets;

an allowed destination port value for the received data packets; and

an allowed classless inter-domain routing (CIDR) block for the received data packets; and

receive a data packet in a data flow from a communication device;

extract packet context data from the data packet, the packet context data comprising:

a particular protocol type used to communicate the data packet;

a particular destination port value for the data packet; and

a particular CIDR block associated with the communication device;

load the executable instructions into an instruction cache (I-cache) of the one or more processors;

load the packet context data into a data cache (D-cache) of the one or more processors;

execute, using an arithmetic-logic unit (ALU) of the one or more processors, the executable instructions, wherein the execution of the executable instructions includes:

comparing the allowed protocol type with the particular protocol type;

comparing the allowed destination port value with the particular destination port value; and

comparing the allowed CIDR block with the particular CIDR block;

determine, based on the execution of the executable instructions, to allow the data packet to be communicated to the virtual resource; and

allow the data flow to be communicated to the virtual resource.

2. The packet-processing device of claim 1 , comprising further computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:

receive, from a compilation service, Extended Berkeley Packet Filter (eBPF) code representing the firewall rule for the virtual resource; and

compile, using a just-in-time (JIT) compiler, the eBPF code into machine code for the one or more processors,

wherein executing the executable instructions includes executing the machine code using the ALU of the one or more processors.

3. The packet-processing device of claim 1 , wherein:

the one or more processors comprise an advanced RISC machine (ARM)-based processor or an x86-based processor; and

the executable instructions comprise machine code in a machine language for the ARM-based processor or the x86-based processor.

4. The packet-processing device of claim 1 , wherein:

the virtual resource comprises a virtual network in the service provider network and the firewall rule comprises a network access control list (ACL) for the virtual network; or

the virtual resource comprises a virtual machine (VM) instance and the firewall rule comprises a virtual firewall that filters network traffic for the VM instance.

5. A computer-implemented method comprising:

obtaining, at a firewall-hosting device, byte code representing a firewall rule for a computing resource, the firewall rule indicating at least one of allow data or deny data;

receiving, at the firewall-hosting device, a data packet in a data flow from a communication device;

extracting packet context data from the data packet;

compiling the byte code into machine code that represents the firewall rule;

loading the machine code into one or more level-1 (L1) caches on a processor of the firewall-hosting device;

loading the packet context data into the one or more L1 caches;

executing, at least partly by the processor, the machine code to compare the at least one of the allow data or the deny data with the packet context data; and

determining, based at least in part on executing the machine code, whether to block the data packet or allow the data packet to be communicated to the computing resource.

6. The computer-implemented method of claim 5 , wherein:

loading the machine code into the one or more L1 caches comprises loading the machine code into an instruction cache (I-cache) of the processor; and

loading the packet context data into the one or more L1 caches comprises loading the packet context data into a data cache (D-cache) of the processor.

7. The computer-implemented method of claim 5 , wherein:

the processor comprises an advanced RISC machine (ARM)-based processor or an x86-based processor; and

the machine code is in a machine language for the ARM-based processor or the x86-based processor.

8. The computer-implemented method of claim 5 , wherein the packet context data comprises at least one of:

a particular protocol type used to communicate the data packet;

a particular destination port value for the data packet; or

a particular CIDR block associated with the communication device.

9. The computer-implemented method of claim 8 , wherein:

the allow data comprises at least one of:

an allowed protocol type for received data packets;

an allowed destination port value for the received data packets; or

an allowed classless inter-domain routing (CIDR) block for the received data packets; and

executing the machine code to compare the at least one of the allow data or deny data with the packet context data comprises at least one of:

comparing the allowed protocol type with the particular protocol type;

comparing the allowed destination port value with the particular destination port value; or

comparing the allowed CIDR block with the particular CIDR block.

10. The computer-implemented method of claim 5 , wherein:

the byte code is received from a compilation service and is Extended Berkeley Packet Filter (eBPF) code representing the firewall rule for the computing resource; and

compiling the byte code includes compiling, using a just-in-time (JIT) compiler, the eBPF code into the machine code for the processor.

11. The computer-implemented method of claim 5 , wherein:

the computing resource comprises a virtual network and the firewall rule comprises a network access control list (ACL) for the virtual network; or

the computing resource comprises a virtual machine (VM) instance and the firewall rule comprises a virtual firewall that filters network traffic for the VM instance.

12. A system comprising:

one or more processors; and

one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:

obtain byte code representing a firewall rule for a computing resource, the firewall rule indicating at least one of allow data or deny data;

receive a data packet in a data flow from a communication device, the data packet comprising packet context data;

compile the byte code into machine code that represents the firewall rule;

load the machine code into a level-1 (L1) cache memory on a processor of the one or more processors;

load the packet context data into the L1 cache memory;

execute, at least partly by the processor, the machine code to compare the at least one of allow data or deny data with the packet context data; and

determine, based at least in part on executing the machine code, whether to block the data packet or allow the data packet to be communicated to the computing resource.

13. The system of claim 12 , wherein

loading the machine code into the L1 cache memory comprises loading the machine code into an instruction cache (I-cache) of the processor; and

loading the packet context data into the L1 cache memory comprises loading the packet context data into a data cache (D-cache) of the processor.

14. The system of claim 12 , wherein:

the processor comprises an advanced RISC machine (ARM)-based processor or an x86-based processor; and

the machine code is in a machine language for the ARM-based processor or the x86-based processor.

15. The system of claim 12 , comprising further computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:

extract the packet context data from the data packet, the packet context data comprising at least one of:

a particular protocol type used to communicate the data packet;

a particular destination port value for the data packet; or

a particular CIDR block associated with the communication device.

16. The system of claim 15 , wherein:

the allow packet data comprises at least one of:

an allowed protocol type for received data packets;

an allowed destination port value for the received data packets; or

an allowed classless inter-domain routing (CIDR) block for the received data packets; and

executing the machine code to compare the allow data with the packet context data comprises at least one of:

comparing the allowed protocol type with the particular protocol type;

comparing the allowed destination port value with the particular destination port value; or

comparing the allowed CIDR block with the particular CIDR block.

17. The system of claim 16 , wherein the packet context data and the allow data are located in the L1 cache memory such that execution of the machine code is performed independent of data access to main memory of the processor.

18. The system of claim 12 , comprising further computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:

receive, from a compilation service, the byte code comprising Extended Berkeley Packet Filter (eBPF) code representing the firewall rule for the computing resource; and

compile, using a just-in-time (JIT) compiler, the eBPF code into the machine code for the processor.

19. The system of claim 12 , wherein:

the computing resource comprises a virtual network and the firewall rule comprises a network access control list (ACL) for the virtual network; or

the computing resource comprises a virtual machine (VM) instance and the firewall rule comprises a virtual firewall that filters network traffic for the VM instance.