Method, device and system for assuring correct execution

Abstract

A method for ensuring correct execution includes comparing all rules down-sent on any port of network device to judge whether any two rules are upside down in execution order or not and regulating any two rules according to principle of first down-send rule to be firstly validated if it is then down-sending all regulated rules on said port of network device in sequence for ensuring correct service treatment on message. The unit used fro realizing said method is also disclosed.

Description

Technical field [0001] The present invention relates to network communication technology, in particular to a method, device and system for ensuring correct execution of access control list (ACL) rules. Background technique [0002] At present, in order to enable network devices to perform various business processing according to user requirements when receiving messages, for example, to redirect received messages or discard received messages, it is usually necessary to connect to the network The port of the device issues corresponding ACL rules. In the ACL rules, the service processing requirements of various packets are recorded. When a network device receives a packet on a port, it first matches the packet with the ACL rule corresponding to the port, and performs corresponding service processing on the packet according to the matched ACL rule. [0003] Table name Effect Table item composition structure Function Description MASK table ...

AI Technical Summary

Problems solved by technology

[0015] However, referring to Figure 1, since the mask corresponding to rule 3 is the same as the first issued rule 1, the MASK entry and RULE entry corresponding to rule 3 are both in the MASK entry and RULE entry corresponding to rule 2 Before, in this way, when the network device receives a message that can match rule 3 and rule 2 at the same time on port 1, because the actions in rule 3 and rule 2 conflict, it will only execute according to the first established MASK entry 1 matches the action in rule 3, that is, forwards the packet, and does not execute the action in rule 2 that is matched according to the established MASK entry 2, that is, discards the packet. In this way, the execution of the ACL rule occurs. The problem of reverse order, that is to say, in the actual service implementation, the network device does not execute the service processing corresponding to rule 1, rule 2 and rule 3 in sequence according to the implementation requirements of ACL rules

[0016] When the execution sequence of the ACL rules is reversed, if the two ACL rules with the reverse execution order intersect and the actions conflict, for example, for rule 2 and rule 3, rule 2 and rule 3 intersect and the actions conflict, the rule 2 requires discarding the packets whose IP address meets the rule 2.2.11.3 / 32, but rule 3 requires forwarding the packets whose IP address meets the rule 2.2.11.3 / 32, then, after executing the two ACL rules in reverse order, then Can not perform correct business processing on the message, unable to meet customer needs

Images