Distributed identity-based firewalls
Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.
1. For a virtual machine executing on a host computer, a method for providing firewall services on the host computer, the method comprising:
for a network connection, receiving a record associating a set of header values of packets sent from the virtual machine with an identifier associated with a process associated with the network connection;
associating a packet received from the virtual machine with the identifier by comparing the packet's set of header values with the set of header values of the record;
using the identifier to identify a firewall rule from a plurality of firewall rules that have rule identifiers defined by reference to a plurality of identifiers;
performing a firewall operation on the received packet based on the identified firewall rule by forwarding the packet to a virtual switch executing on the host computer for distribution to a destination of the packet, the virtual switch being configured to apply routing policies based on a user identity and a group membership.
2. The method of claim 1 , wherein performing the firewall operation comprises forwarding the received packet when the identified firewall rule specifies that the packet should be allowed to pass through.
3. The method of claim 1 , wherein performing the firewall operation comprises dropping the received packet when the identified firewall rule specifies that the packet should be blocked.
4. The method of claim 1 , wherein performing the firewall operation comprises redirecting the received packet to a different destination according to the identified firewall rule.
5. The method of claim 1 , wherein the identifier is a security identifier (SID) of a user associated with the process.
6. The method of claim 1 , wherein the identifier identifies a user logged onto the machine on which the process executes.
7. The method of claim 1 , wherein the identifier comprises a username or a group identifier that identifies a user group to which the user belongs.
8. The method of claim 1 further comprising storing the record that associates the identifier with the set of header values before associating the packet with the identifier.
9. The method of claim 8 , wherein the set of header values are associated with the network connection, and comprise an Internet Protocol (IP) address and one or more port numbers assigned to the network connection.
10. The method of claim 8 further comprising configuring a guest driver module executing on the machine to perform the operation of the identified firewall rule for subsequent packets that belong to a same flow as the received packet.
11. A non-transitory machine readable medium storing a program for execution by at least one processing unit, the program for providing firewall services for a virtual machine executing on a host computer, the program comprising sets of instructions for:
for a network connection, receiving a record associating a set of header values of packets sent from the machine with an identifier associated with a process associated with the network connection;
associating a packet received from the machine with the identifier by comparing the packet's set of header values with the set of header values of the record;
using the identifier to identify a firewall rule from a plurality of firewall rules that have rule identifiers defined by reference to a plurality of identifiers;
performing a firewall operation on the received packet based on the identified firewall rule by forwarding the packet to a virtual switch executing on the host computer for distribution to a destination of the packet, the virtual switch being configured to apply routing policies based on a user identity and a group membership.
12. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing the firewall operation comprises a set of instructions for forwarding the received packet when the identified firewall rule specifies that the packet should be allowed to pass through.
13. The non-transitory machine readable medium of claim 12 , wherein the set of instructions for forwarding the received packet comprises a set of instructions for forwarding the packet to a virtual switch executing on the host computer for distribution to a destination of the packet.
14. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing the firewall operation comprises a set of instructions for dropping the received packet when the identified firewall rule specifies that the packet should be blocked.
15. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for performing the firewall operation comprises a set of instructions for redirecting the received packet to a different destination according to the identified firewall rule.
16. The non-transitory machine readable medium of claim 11 , wherein the identifier is a security identifier (SID) of a user associated with the process.
17. The non-transitory machine readable medium of claim 11 , wherein the identifier identifies a user logged onto the machine on which the process executes.
18. The non-transitory machine readable medium of claim 11 , wherein the identifier comprises a username or a group identifier that identifies a user group to which the user belongs.