DATA-PLANE APPROACH FOR POLICY CONFIGURATION
Example methods and systems for policy configuration using a data-plane approach are described. In one example, a first computer system may detect first data- plane packet(s) for establishing a connection between (a) a first virtualized computing instance and (b) a second computer system from which a resource is accessible. The first computer system may extract, from the first data-plane packet(s), parameter information associated with the connection; and configure a policy that is applicable for access control of the resource based on the parameter information. In response to detecting second data-plane packet(s) to access the resource, the computer system may apply the policy to allow or block forwarding of the second data-plane packet towards the second computer system. The second data-plane packet may originate from (a) the first virtualized computing instance or (b) a second virtualized computing instance supported by the first computer system.
1 . A method for a first computer system to perform a data-plane approach for policy configuration, wherein the method comprises:
detecting one or more first data-plane packets for establishing a connection between (a) a first virtualized computing instance supported by the first computer system and (b) a second computer system from which a resource is accessible;
extracting, from the one or more first data-plane packets, parameter information associated with the connection;
based on the parameter information, configuring a policy that is applicable for access control of the resource; and
in response to detecting a second data-plane packet to access the resource, applying the policy to allow or block forwarding of the second data-plane packet towards the second computer system, wherein the second data-plane packet originates from (a) the first virtualized computing instance or (b) a second virtualized computing instance supported by the first computer system.
2 . The method of claim 1 , wherein extracting the parameter information comprises:
performing verification of the parameter information in the form of a digital certificate that is issued by a certificate authority, wherein the digital certificate is extractable from a particular first data-plane packet from the second computer system.
3 . The method of claim 2 , wherein configuring the policy comprises:
configuring the policy based on at least one extensions field of the digital certificate, wherein the extensions field specifies an access control list associated with the resource.
4 . The method of claim 2 , wherein the method further comprises:
generating and storing a cache entry associating the policy with a thumbprint of the digital certificate, wherein the cache entry is subsequently accessible to determine whether the policy has been configured.
5 . The method of claim 1 , wherein configuring the policy comprises:
configuring the policy in the form of an identity firewall rule that is applicable by a firewall engine supported by the first computer system, wherein the identity firewall rule specifies at least one group of users that is permitted to access the resource.
6 . The method of claim 5 , wherein applying the policy comprises:
determining whether a first user associated with the first virtualized computing instance, or a second user associated with the second virtualized computing instance, is a member of the group specified by the identity firewall rule.
7 . The method of claim 1 , wherein detecting the one or more first data-plane packets comprises:
detecting the one or more first data-plane packets associated with a secure connection establishment process based on at least one of the following protocols: transport layer security (TLS) protocol and secure socket layer (SSL) protocol.
8 . A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a first computer system, cause the processor to perform a method for policy configuration using a data-plane approach, wherein the method comprises:
detecting one or more first data-plane packets for establishing a connection between (a) a first virtualized computing instance supported by the first computer system and (b) a second computer system from which a resource is accessible;
extracting, from the one or more first data-plane packets, parameter information associated with the connection;
based on the parameter information, configuring a policy that is applicable for access control of the resource; and
in response to detecting a second data-plane packet to access the resource, applying the policy to allow or block forwarding of the second data-plane packet towards the second computer system, wherein the second data-plane packet originates from (a) the first virtualized computing instance or (b) a second virtualized computing instance supported by the first computer system.
9 . The non-transitory computer-readable storage medium of claim 8 , wherein extracting the parameter information comprises:
performing verification of the parameter information in the form of a digital certificate that is issued by a certificate authority, wherein the digital certificate is extractable from a particular first data-plane packet from the second computer system.
10 . The non-transitory computer-readable storage medium of claim 9 , wherein configuring the policy comprises:
configuring the policy based on at least one extensions field of the digital certificate, wherein the extensions field specifies an access control list associated with the resource.
11 . The non-transitory computer-readable storage medium of claim 9 , wherein the method further comprises:
generating and storing a cache entry associating the policy with a thumbprint of the digital certificate, wherein the cache entry is subsequently accessible to determine whether the policy has been configured.
12 . The non-transitory computer-readable storage medium of claim 8 , wherein configuring the policy comprises:
configuring the policy in the form of an identity firewall rule that is applicable by a firewall engine supported by the first computer system, wherein the identity firewall rule specifies at least one group of users that is permitted to access the resource.
13 . The non-transitory computer-readable storage medium of claim 12 , wherein applying the policy comprises:
determining whether a first user associated with the first virtualized computing instance, or a second user associated with the second virtualized computing instance, is a member of the group specified by the identity firewall rule.
14 . The non-transitory computer-readable storage medium of claim 8 , wherein detecting the one or more first data-plane packets comprises:
detecting the one or more first data-plane packets associated with a secure connection establishment process based on at least one of the following protocols:
transport layer security (TLS) protocol and secure socket layer (SSL) protocol.
15 . A computer system, comprising:
a first virtualized computing instance;
a second virtualized computing instance;
a packet inspector to:
detect one or more first data-plane packets for establishing a connection between (a) the first virtualized computing instance and (b) a server from which a resource is accessible;
extract, from the one or more first data-plane packets, parameter information associated with the connection; and
configure a policy that is applicable for access control of the resource based on the parameter information; and
a policy manager to: in response to detecting a second data-plane packet to access the resource, apply the policy to allow or block forwarding of the second data- plane packet towards the server, wherein the second data-plane packet originates from (a) the first virtualized computing instance or (b) the second virtualized computing instance.
16 . The computer system of claim 15 , wherein the packet inspector is to extract the parameter information and configuring the policy by performing the following:
extract, from a particular first data-plane packet from the server, parameter information that includes a digital certificate that is issued by a certificate authority.
17 . The computer system of claim 16 , wherein the packet inspector is to configure the policy by performing the following:
configure the policy based on at least one extensions field of the digital certificate, wherein the extensions field specifies an access control list associated with the resource.
18 . The computer system of claim 16 , wherein the packet inspector is further to:
generate and store a cache entry associating the policy with a thumbprint of the digital certificate, wherein the cache entry is subsequently accessible to determine whether the policy has been configured.
19 . The computer system of claim 15 , wherein the packet inspector is to configure the policy by performing the following:
configure the policy in the form of an identity firewall rule that is applicable by a firewall engine supported by the first computer system, wherein the identity firewall rule specifies at least one group of users that is permitted to access the resource.
20 . The computer system of claim 19 , wherein the packet inspector is to apply the policy by performing the following:
determine whether a first user associated with the first virtualized computing instance, or a second user associated with the second virtualized computing instance, is a member of the group specified by the identity firewall rule.
21 . The computer system of claim 15 , wherein the packet inspector is to detect the one or more first data-plane packets by performing the following:
detect the one or more first data-plane packets associated with a secure connection establishment process based on at least one of the following protocols: transport layer security (TLS) protocol and secure socket layer (SSL) protocol.