A method and device for managing ACL rules

Abstract

The invention provides an ACL rule management method and device. The ACL rule management method comprises the following steps: establishing Hash chains according to a type of an ACL rule and an ACL rule adding rule; acquiring aging delay of chain table headers of all the Hash chains; and deleting a chain table header corresponding to maximum aging delay according to the aging delay. Through the scheme of the invention, rule loading in various ways can be coped flexibly, and aging of rules which need to be aged firstly can be performed firstly through aging management in the way no matter rule loading is multi-client simultaneous loading or different types of rules are switched in order or a rule capacity is increased.

Description

technical field [0001] The present invention relates to the technical field of communications, in particular to a method and device for managing ACL rules. Background technique [0002] The existing network environment is increasingly complex, and network devices with a small number of ACLs cannot meet the needs of actual network applications. Therefore, the demand for network devices supporting massive ACLs has gradually become prominent, and at this time, the management of massive rule tables has become a challenge. [0003] Most of the aging rule management methods commonly used in the industry are to string up the rule list in chronological order, periodically refresh and check the aging time of the rules, and complete the aging. The aging time refers to the effective time of matching ACL rules. However, this single management method will seriously affect the rule aging accuracy when the number of rules increases and the types of services increase. The aging accuracy re...

AI Technical Summary

Problems solved by technology

[0005] 1. The types of rules are complex and require multiple linked lists to manage independently. Different linked lists have different aging times, and the order of loading rules is changeable, but the aging order is fixed and single, which will cause the aging accuracy of some aging linked lists to change when threads switch between multiple linked lists. Difference

[0006] 2. The number of rules increases, the rule loading speed does not match the rule aging speed, and the rule aging speed cannot keep up with the rule loading speed, which will still cause the aging accuracy of the added rules to become worse and worse

[0007] 3. There is no aging threshold control. Some aging chains reach the aging time almost at the same time, which will cause the aging thread to occupy the thread lock and cannot be released for a long time. When other threads such as query or add rules, the system cannot respond

Images