Managing L4 ports
Some embodiments of the invention provide a novel method for managing layer four (L4) ports associated with a machine executing on a host computer. The method collects a set of contextual attributes relating to applications executing on the machine. It then analyzes the collected contextual attributes to identify at least one L4 port that has to have its status modified. Next, it modifies the status of the identified L4 port. In some embodiments, the status of an L4 port can be either open or closed, and the modification can open a closed port or close an open port. In some embodiments, the method is performed when the machine starts up on the host computer, performed each time a new application is installed on the machine, performed periodically to close unused L4 ports, and/or performed periodically to close L4 ports that should not be open based on a set of L4-port control policies.
1. A method of managing layer four (L4) ports for a machine executing on a host computer, the method comprising:
collecting a set of contextual attributes relating to applications executing on the machine;
analyzing the collected contextual attributes to identify at least one L4 port that has to have its status modified; and
modifying the status of the identified L4 port, the status of the identified L4 being used by a data plane enforcement node to determine whether a data message flow that is addressed to the L4 port should be rejected.
2. The method of claim 1 , wherein modifying the status of L4 port comprises creating and storing a record that specifies the status of the L4 port as open or closed.
3. The method of claim 2 , wherein the record is stored in a data store of the machine, the data store defined in a memory space that is specified for the machine on the host computer.
4. The method of claim 2 , wherein the record is stored in a data store defined on the host computer outside of the machine, the data store defined in a memory space on the host computer that is separate from a memory space in which the machine operates on the host computer.
5. The method of claim 4 , wherein the record is stored in a data store of a hypervisor executing on the host computer.
6. The method of claim 4 , wherein the record is stored in a data store of an operating system executing on the host computer.
7. The method of claim 2 further comprising:
receiving a data message flow for the machine.
8. The method of claim 7 , wherein the determination is performed on the machine after a data message of the flow is provided to the machine.
9. The method of claim 7 , wherein the determination is performed outside of the machine before any data message of the flow is provided to the machine.
10. The method of claim 1 , wherein collecting the set of contextual attributes comprises collecting the set of contextual attributes through a guest introspection (GI) agent that executes on the machine to identify contextual attributes relating to applications executing on the host computer.
11. The method of claim 1 , wherein the GI agent further identifies other contextual attributes relating to data message flows associated with the machine.
12. The method of claim 1 , wherein the collecting, analyzing and modifying are performed when the machine starts up on the host computer.
13. The method of claim 1 , wherein the collecting, analyzing and modifying are performed each time a new application is installed on the machine.
14. The method of claim 1 , wherein the collecting, analyzing and modifying are performed periodically to close unused L4 ports.
15. The method of claim 1 , wherein the collecting, analyzing and modifying are performed periodically to close L4 ports that should not be open based on a set of L4-port control policies.
16. The method of claim 1 , wherein a contextual attribute is an attribute other than layers 2-4 header values of data message flows sent by or received for the machine.
17. A non-transitory machine-readable medium storing a program that when executed by at least one processing unit manages layer four (L4) ports for a machine executing on a host computer, the program comprising sets of instructions for:
collecting a set of contextual attributes relating to applications executing on the machine;
analyzing the collected contextual attributes to identify at least one L4 port that has to have its status modified; and
modifying the status of the identified L4 port, the status of the identified L4 being used by a data plane enforcement node to determine whether a data message flow that is addressed to the L4 port should be rejected.
18. The non-transitory machine readable medium of claim 17 , wherein the set of instructions for modifying the status of L4 port comprises sets of instructions for creating and storing a record that specifies the status of the L4 port as open or closed.
19. The non-transitory machine readable medium of claim 18 , wherein the record is stored in a data store of the machine, the data store defined in a memory space that is specified for the machine on the host computer.
20. The non-transitory machine readable medium of claim 18 , wherein the record is stored in a data store defined on the host computer outside of the machine, the data store defined in a memory space on the host computer that is separate from a memory space in which the machine operates on the host computer.