Granted Patent B2

US 12,375,372 · App. 17/842,626 · Granted Jul 29, 2025

Inventors: Amnon Ilan (Raanana, IL); Michael Tsirkin (Yokneam Illit, IL)

Assignee: Red Hat, Inc.

H04L43/028H04L43/04H04L63/0236H04L63/0263H04L63/0281

Abstract

Claims (49)

1. A method, comprising:

receiving, by a supervisor of a virtual execution environment running on a host computer system, a definition of a packet filter originated by the virtual execution environment running on the host computer system;

responsive to validating the packet filter, associating the packet filter with a virtual network interface card (vNIC) of the virtual execution environment;

receiving, by the supervisor, a first network packet originated by the vNIC;

responsive to matching, by the packet filter, the first network packet to a network connection maintained by a proxy application, causing the packet filter to bypass the proxy application by forwarding the first network packet via the network connection, wherein the proxy application runs within one of: the virtual execution environment running on the host computer system, a privileged execution environment running on the host computer system, or a non-privileged execution environment running on the host computer system, or the proxy application runs on another host computer system;

receiving, by the supervisor, a second network packet originated by the vNIC; and

responsive to failing to match the second network packet to the packet filter, causing the proxy application to create a new network connection to a destination specified by the second network packet.

2. The method of claim 1 , wherein forwarding the first network packet further comprises:

substituting a source address of the first network packet with a source address of a network interface card (NIC) associated with the network connection.

3. The method of claim 1 , wherein matching the first network packet to the network connection specified by the packet filter further comprises:

matching a link layer parameter specified by the first network packet to a corresponding network link layer parameter associated with the network connection.

4. The method of claim 3 , wherein the link layer parameter is at least one of: a protocol, a destination address, or a port.

5. The method of claim 1 , wherein the packet filter is a Berkley Packet filter (BPF).

6. The method of claim 1 , further comprising:

responsive to receiving an incoming network packet via the network connection, forwarding the incoming network packet to the vNIC.

7. The method of claim 1 , wherein validating the packet filter further comprises:

ascertaining that two or more rules encoded by the definition of the packet filter are not mutually-exclusive.

8. The method of claim 1 , wherein validating the packet filter further comprises:

ascertaining that two or more rules encoded by the definition of the packet filter do not specify an infinite loop.

9. The method of claim 1 , wherein validating the packet filter further comprises:

ascertaining that two or more rules encoded by the definition of the packet filter do not specify an infinite recursion.

10. A computer system, comprising:

a memory; and

a processing device, coupled to the memory, to:

receive, by a supervisor of a virtual execution environment running on the computer system, a definition of a packet filter originated by a virtual execution environment running on the computer system;

responsive to validating the packet filter, associate the packet filter with the virtual network interface card (vNIC) of the virtual execution environment;

receive, by the supervisor, a first network packet originated by the vNIC;

responsive to matching, by the packet filter, the first network packet to a network connection maintained by a proxy application, cause the packet filter to bypass the proxy application by forwarding the first network packet via the network connection, wherein the proxy application runs within one of: the virtual execution environment running on the host computer system, a privileged execution environment running on the host computer system, or a non-privileged execution environment running on the host computer system, or the proxy application runs on another host computer system;

receive, by the supervisor, a second network packet originated by the vNIC; and

responsive to failing to match the second network packet to the packet filter, cause a proxy application to create a new network connection to a destination specified by the second network packet.

11. The computer system of claim 10 , wherein forwarding the first network packet further comprises:

substituting a source address of the first network packet with a source address of a network interface card (NIC) associated with the network connection.

12. The computer system of claim 10 , wherein matching the first network packet to the network connection specified by the packet filter further comprises:

matching a link layer parameter specified by the first network packet to a corresponding network link layer parameter associated with the network connection.

13. The computer system of claim 12 , wherein the packet filter is a Berkley Packet filter (BPF).

14. A non-transitory computer-readable storage medium comprising executable instructions that, when executed by a host computer system, cause the host computer system to:

receive, by a supervisor of a virtual execution environment running on the host computer system, a definition of a packet filter originated by a virtual execution environment running on the host computer system;

responsive to validating the packet filter, associate the packet filter with the virtual network interface card (vNIC) of the virtual execution environment;

receive, by the supervisor, a first network packet originated by the vNIC;

responsive to matching, by the packet filter, the first network packet to a network connection maintained by a proxy application, cause the packet filter to bypass the proxy application by forwarding the first network packet via the network connection, wherein the proxy application runs within one of: the virtual execution environment running on the host computer system, a privileged execution environment running on the host computer system, or a non-privileged execution environment running on the host computer system, or the proxy application runs on another host computer system;

receive, by the supervisor, a second network packet originated by the vNIC; and

responsive to failing to match the second network packet to the packet filter, cause a proxy application to create a new network connection to a destination specified by the second network packet.

15. The non-transitory computer-readable storage medium of claim 14 , wherein forwarding the first network packet further comprises:

substituting a source address of the first network packet with a source address of a network interface card (NIC) associated with the network connection.

16. The non-transitory computer-readable storage medium of claim 14 , wherein matching the first network packet to the network connection specified by the packet filter further comprises:

matching a link layer parameter specified by the first network packet to a corresponding network link layer parameter associated with the network connection.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the link layer parameter is at least one of: a protocol, a destination address, or a port.

18. The non-transitory computer-readable storage medium of claim 14 , further comprising executable instructions that, when executed by the host computer system, cause the host computer system to:

responsive to receiving an incoming network packet via the network connection, forwarding the incoming network packet to the vNIC.

Assignments (2)

Continuity (2)

References Cited (24)