Abstract: A device may determine, based on one or more first objects of a first version of a firewall filter, a set of first firewall rules and may determine, based on one or more second objects of a second version of the firewall filter, a set of second firewall rules. The device may determine, based on the set of first firewall rules and the set of second firewall rules, modification information related to the firewall filter, wherein the modification information indicates at least one difference between the set of first firewall rules and the set of second firewall rules. The device may identify, based on the modification information, at least one object, of the one or more first objects or the one or more second objects, is a modification or has been added or deleted and may send the at least one object to an additional device.

Abstract: In general, techniques are described for creating a flexible services-based pipeline for firewall filter processing. A network device may be configured to perform the techniques. In one example, a method includes receiving, by a network device, data defining a plurality of firewall filter processing services, the data defining an order in which to apply services of the plurality of firewall filter processing services to firewall filters; configuring, by the network device and based on the received data, an execution engine pipeline to include the plurality of firewall filter processing services in the defined order; prior to programming a received firewall filter to hardware of the network device for filtering network traffic, processing the firewall filter by the execution engine pipeline to produce a processed firewall filter; and programming, by the network device, the processed firewall filter to the hardware for filtering the network traffic.

Abstract: In general, techniques are described for providing a dynamic system state for a distributed operating system. A network device comprises a plurality of hardware computing nodes configured to execute a distributed operating system that provides an execution environment in which a plurality of applications is executed. A computing node of the plurality of computing nodes is configured to configure a dynamic state application to operate as a proxy to receive one or more requests for state information stored in a data store. The computing node retrieves the state information stored in the data store; stores the retrieved state information in a local data store of the computing node; receives one or more requests for the state information; and sends a response including the requested state information from the local data store.

Abstract: In general, techniques are described for providing a dynamic system state for a distributed operating system. A network device comprises a plurality of hardware computing nodes configured to execute a distributed operating system that provides an execution environment in which a plurality of applications is executed. A computing node of the plurality of computing nodes is configured to configure a dynamic state application to operate as a proxy to receive one or more requests for state information stored in a data store. The computing node retrieves the state information stored in the data store; stores the retrieved state information in a local data store of the computing node; receives one or more requests for the state information; and sends a response including the requested state information from the local data store.