Method, device and system for assuring correct execution

Abstract

A method for ensuring correct execution includes comparing all rules down-sent on any port of network device to judge whether any two rules are upside down in execution order or not and regulating any two rules according to principle of first down-send rule to be firstly validated if it is then down-sending all regulated rules on said port of network device in sequence for ensuring correct service treatment on message. The unit used fro realizing said method is also disclosed.

Description

technical field [0001] The invention relates to network communication technology, in particular to a method, device and system for ensuring correct implementation of access control list (ACL) rules. Background technique [0002] At present, in order to enable network devices to perform various business processes according to user requirements when receiving packets, for example, to be able to redirect received packets or discard received packets, etc., it is usually necessary to The corresponding ACL rules are delivered to the ports of the device, and the service processing requirements of various packets are recorded in the ACL rules. When a network device receives a packet on a port, it first matches the packet with the ACL rule corresponding to the port, and performs corresponding service processing on the packet according to the matched ACL rule. [0003] In the network device, in order to record all ACL rules issued to each port, hardware entries are set for each port,...

AI Technical Summary

Problems solved by technology

[0016] However, see figure 1 , since the mask corresponding to rule 3 is the same as the first issued rule 1, the MASK entry and RULE entry corresponding to rule 3 are both before the MASK entry and RULE entry corresponding to rule 2. In this way, when After the network device receives a message that can match rule 3 and rule 2 at the same time on port 1, because the actions in rule 3 and rule 2 conflict, it will only execute the rule matched according to the first established MASK entry 1. The action in 3 is to forward the packet, but not to execute the action in rule 2 matched according to the mask entry 2 established later, that is, to discard the packet. In this way, the problem of executing the ACL rules is reversed. That is to say, in the actual service implementation, the network device does not execute the service processing corresponding to rule 1, rule 2 and rule 3 in sequence according to the implementation requirements of the ACL rules

[0017] When the execution sequence of the ACL rules is reversed, if the two ACL rules with the reverse execution order intersect and the actions conflict, for example, for rule 2 and rule 3, rule 2 and rule 3 intersect and the actions conflict, the rule 2 requires discarding packets whose IP addresses meet rule 2.2.11.3 / 32, but rule 3 requires forwarding packets whose IP addresses meet rule 2.2.11.3 / 32, then, after executing the two ACL rules in reverse order, then Cannot perform correct business processing on messages, unable to meet customer needs

Images