Network filtering in a virtualized environment
A physical host executes a hypervisor or virtual machine monitor (VMM) that instantiates at least one virtual machine (VM) and a virtual input/output server (VIOS). The VIOS determines by reference to a policy data structure a disposition of a packet of network communication with the VM, where the disposition includes one of dropping the packet and forwarding the packet. Thereafter, the determined disposition is applied to a subsequent packet in a same packet flow as the packet.
1. A program product, comprising:
a tangible data storage device; and
program code stored within the tangible data storage device that, when processed by a physical data processing system, causes the physical data processing system to:
instantiate, by a virtual machine monitor (VMM), a virtual machine (VM) separate from and hosted by the VMM, wherein the VM is configured as a virtual input/output server (VIOS) that provides input/output services for network communication;
implement, in the VMM, a virtual switch, a virtual network, and a virtual router;
perform routing and switching, utilizing the virtual switch and the virtual router of the VMM, for network communication between a plurality of other VMs on the virtual network;
receive, by the VIOS, a packet of network communication between the plurality of other VMs on the virtual network and determine, by the VIOS by reference to a policy data structure of the VIOS, a disposition of the packet of network communication, wherein the disposition is dropping the packet;
cache, in a flow cache of the VMM, the disposition determined by the VIOS, wherein the disposition is cached in the flow cache in association with a key identifying a packet flow containing the packet; and
thereafter, access, by the VMM, the determined disposition in the flow cache and apply, by the VMM, the determined disposition to a subsequent packet in a same packet flow as the packet without reference to the policy data structure of the VIOS.
2. The program product of claim 1 , wherein:
the key is a hash key; and
the program code further causes the data processing system to:
generate the hash key from a tuple of header values in the subsequent packet, wherein the tuple includes at least a network address and an identifier of a protocol of the packet flow, wherein the protocol is above Layer 3; and
access, by the VMM, the determined disposition in the flow cache utilizing the generated hash key.
3. The program product of claim 2 , wherein:
the physical data processing system includes a physical network interface; and
the program code further causes the data processing system to implement, in the VIOS, a second flow cache for filtering network traffic communicated via the physical network interface.
4. The program product of claim 1 , wherein the program code further causes the VIOS to maintain the policy data structure, the policy data structure including at least one bypass data structure identifying one or more of the plurality of other VMs for which no network filtering by the VIOS is to be enforced.
5. The program product of claim 1 , wherein:
the program code further causes the VIOS to maintain the policy data structure;
the policy data structure includes an exclusion data structure identifying VMs among the plurality of other VMs excluded from network filtering; and
the program code causes the data processing system to determine to forward packets within packet flows between VMs that are all identified in the exclusion data structure.
6. The program product of claim 1 , wherein:
the program code further causes the VIOS to maintain the policy data structure; and
the policy data structure includes an allowed host data structure identifying at least one allowed VM among the plurality of other VMs with which a quarantined VM that is otherwise disallowed from utilizing network communication is permitted to communicate.
7. The program product of claim 1 , wherein:
the virtual network is a distributed virtual network spanning a plurality of physical data processing systems including the physical data processing system; and
the program code causes the VIOS to execute on a different physical data processing system than at least one of a source VM and a destination VM of the packet flow.
8. A data processing system, comprising:
a processor; and
data storage coupled to the processor; and
program code stored within the data storage that, when processed by the processor, causes the data processing system to:
instantiate, by a virtual machine monitor (VMM), a virtual machine (VM) separate from and hosted by the VMM, wherein the VM is configured as a virtual input/output server (VIOS) that provides input/output services for network communication;
implement, in the VMM, a virtual switch, a virtual network, and a virtual router;
perform routing and switching, utilizing the virtual switch and the virtual router of the VMM, for network communication between a plurality of other VMs on the virtual network;
receive, by the VIOS, a packet of network communication between the plurality of other VMs on the virtual network and determine, by the VIOS by reference to a policy data structure of the VIOS, a disposition of the packet, wherein the disposition is dropping the packet;
cache, in a flow cache of the VMM, the disposition determined by the VIOS, wherein the disposition is cached in the flow cache in association with a key identifying a packet flow containing the packet; and
thereafter, access, by the VMM, the determined disposition in the flow cache and apply, by the VMM, the determined disposition to a subsequent packet in a same packet flow as the packet without reference to the policy data structure of the VIOS.
9. The data processing system of claim 8 , wherein:
the key is a hash key; and
the program code further causes the data processing system to:
generate the hash key from a tuple of header values in the subsequent packet, wherein the tuple includes at least a network address and an identifier of a protocol of the packet flow, wherein the protocol is above Layer 3; and
access, by the VMM, the determined disposition in the flow cache utilizing the generated hash key.
10. The data processing system of claim 9 , wherein:
the physical data processing system includes a physical network interface; and
the program code further causes the data processing system to implement, in the VIOS, a second flow cache for filtering network traffic communicated via the physical network interface.
11. The data processing system of claim 8 , wherein the program code further causes the VIOS to maintain the policy data structure, the policy data structure including at least one bypass data structure identifying one or more of the plurality of other VMs for which no network filtering by the VIOS is to be enforced.
12. The data processing system of claim 8 , wherein:
the program code further causes the VIOS to maintain the policy data structure;
the policy data structure includes an exclusion data structure identifying VMs among the plurality of other VMs excluded from network filtering; and
the program code causes the data processing system to determine to forward packets within packet flows between VMs that are all identified in the exclusion data structure.
13. The data processing system of claim 8 , wherein:
the program code further causes the VIOS to maintain the policy data structure; and
the policy data structure includes an allowed host data structure identifying at least one allowed VM among the plurality of other VMs with which a quarantined VM that is otherwise disallowed from utilizing network communication is permitted to communicate.
14. The data processing system of claim 8 , wherein:
the virtual network is a distributed virtual network spanning a plurality of physical data processing systems including the physical data processing system; and
the program code causes the VIOS to execute on a different physical data processing system than at least one of a source VM and a destination VM of the packet flow.